@sanity/workflow-engine 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,17 +1,18 @@
 import { parse, evaluate } from "groq-js";
-import { z } from "zod";
+import { WORKFLOW_DEFINITION_TYPE } from "./_chunks-es/schema.js";
+import * as v from "valibot";
 function validateDefinition(definition) {
-  const v = createDefinitionValidator();
+  const v2 = createDefinitionValidator();
   for (const slot of definition.state ?? [])
-    v.checkSlot(slot, "workflow.state", `workflow.state "${slot.id}"`);
+    v2.checkSlot(slot, `workflow.state "${slot.id}"`);
   for (const p of definition.predicates ?? [])
-    p.groq && v.checkFilter(p.groq, `predicate "${p.id}"`);
+    p.groq && v2.checkFilter(p.groq, `predicate "${p.id}"`);
   for (const stage of definition.stages)
-    validateStage(v, stage);
-  if (v.errors.length > 0)
+    validateStage(v2, stage);
+  if (v2.errors.length > 0)
     throw new Error(
-      `defineWorkflow("${definition.workflowId}", v${definition.version}): ${v.errors.length} validation error${v.errors.length === 1 ? "" : "s"}:
-` + v.errors.join(`
+      `defineWorkflow("${definition.workflowId}", v${definition.version}): ${v2.errors.length} validation error${v2.errors.length === 1 ? "" : "s"}:
+` + v2.errors.join(`
 `)
     );
 }
@@ -30,31 +31,29 @@ function createDefinitionValidator() {
   };
   return { errors, tryParse, checkFilter: (groq, where) => {
     tryParse(groq, where), rejectTypeScan(groq, where);
-  }, checkSlot: (slot, scopeLabel, slotLabel) => {
-    slot.source.kind === "computed" && errors.push(
-      `  \xB7 ${scopeLabel} slot "${slot.id}": source.kind="computed" is reserved (not implemented in v0.1)`
-    ), slot.source.kind === "query" && tryParse(slot.source.query, `${slotLabel}.query`);
+  }, checkSlot: (slot, slotLabel) => {
+    slot.source.kind === "query" && tryParse(slot.source.query, `${slotLabel}.query`);
   } };
 }
-function validateStage(v, stage) {
+function validateStage(v2, stage) {
   for (const slot of stage.state ?? [])
-    v.checkSlot(slot, `stage "${stage.id}".state`, `stage "${stage.id}".state "${slot.id}"`);
-  typeof stage.completion == "string" && v.tryParse(stage.completion, `stage "${stage.id}".completion`);
+    v2.checkSlot(slot, `stage "${stage.id}".state "${slot.id}"`);
+  typeof stage.completion == "string" && v2.tryParse(stage.completion, `stage "${stage.id}".completion`);
   for (const t of stage.transitions ?? [])
-    typeof t.filter == "string" && v.checkFilter(t.filter, `transition ${stage.id} \u2192 ${t.to} filter`);
+    typeof t.filter == "string" && v2.checkFilter(t.filter, `transition ${stage.id} \u2192 ${t.to} filter`);
   for (const task of stage.tasks ?? [])
-    validateTask(v, stage.id, task);
+    validateTask(v2, stage.id, task);
 }
-function validateTask(v, stageId, task) {
+function validateTask(v2, stageId, task) {
   const where = `stage "${stageId}" task "${task.id}"`;
   for (const slot of task.state ?? [])
-    v.checkSlot(slot, `${where}.state`, `${where}.state "${slot.id}"`);
-  typeof task.filter == "string" && v.checkFilter(task.filter, `${where}.filter`), typeof task.completeWhen == "string" && v.checkFilter(task.completeWhen, `${where}.completeWhen`);
+    v2.checkSlot(slot, `${where}.state "${slot.id}"`);
+  typeof task.filter == "string" && v2.checkFilter(task.filter, `${where}.filter`), typeof task.completeWhen == "string" && v2.checkFilter(task.completeWhen, `${where}.completeWhen`);
   for (const a of task.actions ?? [])
-    typeof a.filter == "string" && v.checkFilter(a.filter, `task "${task.id}" action "${a.id}".filter`);
-  task.spawns?.forEach?.groq && v.tryParse(task.spawns.forEach.groq, `task "${task.id}".spawns.forEach.groq`);
+    typeof a.filter == "string" && v2.checkFilter(a.filter, `task "${task.id}" action "${a.id}".filter`);
+  task.spawns?.forEach?.groq && v2.tryParse(task.spawns.forEach.groq, `task "${task.id}".spawns.forEach.groq`);
 }
-const KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
+const wallClock = () => (/* @__PURE__ */ new Date()).toISOString(), KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
 function parseGdr(uri) {
   const colon = uri.indexOf(":");
   if (colon < 0)
@@ -121,6 +120,9 @@ function gdrFromResource(res, documentId) {
   }
   return gdrUri({ scheme: res.type, resourceId: res.id, documentId });
 }
+function selfGdr(doc) {
+  return gdrFromResource(doc.workflowResource, doc._id);
+}
 function isGdrUri(value) {
   if (typeof value != "string") return !1;
   try {
@@ -135,15 +137,15 @@ function gdrRef(res, documentId, type) {
 function isGdr(value) {
   return typeof value == "object" && value !== null && typeof value.id == "string" && typeof value.type == "string";
 }
-function buildParams(instance, extra) {
+function buildParams(instance, now, extra) {
   return {
-    self: gdrFromResource(instance.workflowResource, instance._id),
+    self: selfGdr(instance),
     state: stateMap(instance.state ?? []),
     parent: instance.ancestors.at(-1)?.id ?? null,
     ancestors: instance.ancestors.map((a) => a.id),
     /** Current stage id — bind for filters that scope to the current stage. */
     stage: instance.currentStageId,
-    now: (/* @__PURE__ */ new Date()).toISOString(),
+    now,
     ...extra
   };
 }
@@ -167,8 +169,8 @@ function stripStateForLake(value) {
   if (Array.isArray(value)) return value.map(stripStateForLake);
   if (typeof value == "object") {
     const out = {};
-    for (const [k, v] of Object.entries(value))
-      out[k] = stripStateForLake(v);
+    for (const [k, v2] of Object.entries(value))
+      out[k] = stripStateForLake(v2);
     return out;
   }
   return value;
@@ -176,9 +178,94 @@ function stripStateForLake(value) {
 function bareId(id) {
   return isGdrUri(id) ? extractDocumentId(id) : id;
 }
-function randomKey(length = 12) {
-  const bytes = new Uint8Array(length);
-  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+function getPath(value, path) {
+  let current = value;
+  for (const part of path.split(".")) {
+    if (current == null || typeof current != "object") return;
+    current = current[part];
+  }
+  return current;
+}
+function readStateSlot(instance, scope, slotId, stageId, taskId) {
+  if (scope === "workflow")
+    return slotValue$1(instance.state?.find((s) => s.id === slotId));
+  const stageEntry = instance.stages.find(
+    (s) => s.id === (stageId ?? instance.currentStageId) && s.exitedAt === void 0
+  );
+  if (stageEntry === void 0) return;
+  if (scope === "stage")
+    return slotValue$1(stageEntry.state?.find((s) => s.id === slotId));
+  const taskEntry = stageEntry.tasks.find((t) => t.id === taskId);
+  return slotValue$1(taskEntry?.state?.find((s) => s.id === slotId));
+}
+function slotValue$1(slot) {
+  if (slot != null && typeof slot == "object")
+    return slot.value;
+}
+function resolveStaticSource(src, ctx) {
+  switch (src.source) {
+    case "literal":
+      return { handled: !0, value: src.value };
+    case "param":
+      return { handled: !0, value: ctx.params?.[src.paramId] };
+    case "actor":
+      return { handled: !0, value: ctx.actor };
+    case "now":
+      return { handled: !0, value: ctx.now };
+    default:
+      return { handled: !1 };
+  }
+}
+function resolveSource(src, ctx) {
+  const staticValue = resolveStaticSource(src, ctx);
+  if (staticValue.handled) return staticValue.value;
+  switch (src.source) {
+    case "self":
+      return ctx.instance._id;
+    case "stageId":
+      return ctx.stageId ?? ctx.instance.currentStageId;
+    case "stateRead":
+      return resolveStateRead(src, ctx);
+    case "effectOutput":
+      return resolveEffectOutput(src, ctx);
+    case "object":
+      return resolveObject(src, ctx);
+    case "row":
+    case "parentState":
+      return;
+    default:
+      return;
+  }
+}
+function resolveStateRead(src, ctx) {
+  const value = readStateSlot(ctx.instance, src.scope, src.slotId, ctx.stageId, ctx.taskId);
+  return src.path !== void 0 ? getPath(value, src.path) : value;
+}
+function resolveEffectOutput(src, ctx) {
+  const entry = ctx.instance.effectsContext.find((e) => e.id === src.contextId);
+  if (entry === void 0) return null;
+  const value = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
+  return value === void 0 ? null : value;
+}
+function resolveObject(src, ctx) {
+  const out = {};
+  for (const [field, fieldSrc] of Object.entries(src.fields))
+    out[field] = resolveSource(fieldSrc, ctx);
+  return out;
+}
+async function resolveBindings(args) {
+  const { bindings, staticInput, instance, now, params, actor } = args, resolved = {};
+  if (bindings) {
+    const ctx = {
+      instance,
+      now,
+      ...params !== void 0 ? { params } : {},
+      ...actor !== void 0 ? { actor } : {}
+    };
+    for (const [key, src] of Object.entries(bindings))
+      resolved[key] = resolveSource(src, ctx);
+  }
+  return { ...resolved, ...staticInput };
 }
 async function evaluateFilter(args) {
   const { filter, definition, snapshot, params } = args;
@@ -226,7 +313,7 @@ function matchesParamType(type, value) {
     case "boolean":
       return typeof value == "boolean";
     case "string[]":
-      return Array.isArray(value) && value.every((v) => typeof v == "string");
+      return Array.isArray(value) && value.every((v2) => typeof v2 == "string");
     case "reference":
       return isGdr(value);
   }
@@ -234,6 +321,183 @@ function matchesParamType(type, value) {
 function describeValue(value) {
   return Array.isArray(value) ? "array" : value === null ? "null" : typeof value;
 }
+const GUARD_DOC_TYPE = "temp.system.guard";
+class MutationGuardDeniedError extends Error {
+  denied;
+  documentId;
+  action;
+  constructor(args) {
+    const ids = args.denied.map((d) => d.guardId).join(", ");
+    super(`Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, this.action = args.action;
+  }
+}
+function lakeGuardId(args) {
+  return `${GUARD_DOC_TYPE}.${args.instanceDocId}.${args.stageId}.${args.index}`;
+}
+function compileGuard(args) {
+  return {
+    _id: args.id,
+    _type: GUARD_DOC_TYPE,
+    resourceType: args.resourceType,
+    resourceId: args.resourceId,
+    owner: args.owner,
+    sourceInstanceId: args.sourceInstanceId,
+    sourceDefinitionId: args.sourceDefinitionId,
+    sourceStageId: args.sourceStageId,
+    ...args.name !== void 0 ? { name: args.name } : {},
+    ...args.description !== void 0 ? { description: args.description } : {},
+    match: args.match,
+    predicate: args.predicate,
+    metadata: args.metadata
+  };
+}
+function toGroqJsPredicate(predicate) {
+  return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
+}
+function globMatch(pattern, value) {
+  if (!pattern.includes("*")) return pattern === value;
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+function guardMatches(guard, doc, action) {
+  const m = guard.match;
+  if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type)))
+    return !1;
+  if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
+    const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some((p) => globMatch(p, doc.id)) ?? !1;
+    if (!byRef && !byPattern) return !1;
+  }
+  return !0;
+}
+async function evaluateMutationGuard(args) {
+  const { guard, context } = args;
+  if (guard.predicate === "") return !1;
+  const params = { guard, mutation: { action: context.action } };
+  try {
+    const tree = parse(toGroqJsPredicate(guard.predicate), { mode: "delta", params });
+    return await (await evaluate(tree, {
+      before: context.before,
+      after: context.after,
+      params,
+      ...context.identity !== void 0 ? { identity: context.identity } : {}
+    })).get() === !0;
+  } catch {
+    return !1;
+  }
+}
+async function denyingGuards(args) {
+  const { guards, doc, context } = args, denied = [];
+  for (const guard of guards)
+    guardMatches(guard, doc, context.action) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
+  return denied;
+}
+function resourceOf(p) {
+  return p.scheme === "dataset" ? { type: "dataset", id: `${p.projectId}.${p.dataset}` } : { type: p.scheme, id: p.resourceId ?? "" };
+}
+function resolveIdRefTarget(src, ctx) {
+  const value = resolveSource(src, ctx);
+  if (typeof value == "string" && isGdrUri(value))
+    return { parsed: parseGdr(value) };
+  if (value && typeof value == "object") {
+    const v2 = value;
+    if (typeof v2.id == "string" && isGdrUri(v2.id))
+      return typeof v2.type == "string" ? { parsed: parseGdr(v2.id), type: v2.type } : { parsed: parseGdr(v2.id) };
+  }
+  return null;
+}
+function resolveIdRefTargets(idRefs, ctx) {
+  const targets = [];
+  for (const src of idRefs ?? []) {
+    const target = resolveIdRefTarget(src, ctx);
+    if (target === null) return null;
+    targets.push(target);
+  }
+  return targets.length === 0 ? null : targets;
+}
+function assertSingleResource(targets) {
+  const resource = resourceOf(targets[0].parsed);
+  for (const g of targets) {
+    const r = resourceOf(g.parsed);
+    if (r.type !== resource.type || r.id !== resource.id)
+      throw new Error(
+        `Guard targets span multiple resources (${resource.type}:${resource.id} vs ${r.type}:${r.id}); a guard is single-resource.`
+      );
+  }
+  return resource;
+}
+function bareIdRefs(targets) {
+  return targets.flatMap((g) => [g.parsed.documentId, `drafts.${g.parsed.documentId}`]);
+}
+function resolveMatchTypes(targets, authorTypes) {
+  if (authorTypes !== void 0) return authorTypes;
+  const inferred = [...new Set(targets.map((g) => g.type).filter((t) => !!t))];
+  return inferred.length > 0 ? inferred : void 0;
+}
+function resolveMetadata(metadata, ctx) {
+  const out = {};
+  for (const [k, src] of Object.entries(metadata ?? {}))
+    out[k] = resolveSource(src, ctx);
+  return out;
+}
+const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
+function resolveGuard(guard, index, instance, stageId, now) {
+  const ctx = { instance, stageId, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
+  if (targets === null) return null;
+  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
+  return { doc: compileGuard({
+    id: lakeGuardId({ instanceDocId: instance._id, stageId, index }),
+    resourceType: resource.type,
+    resourceId: resource.id,
+    owner: GUARD_OWNER,
+    sourceInstanceId: instance._id,
+    sourceDefinitionId: instance.workflowId,
+    sourceStageId: stageId,
+    ...guard.name !== void 0 ? { name: guard.name } : {},
+    ...guard.description !== void 0 ? { description: guard.description } : {},
+    match: {
+      ...types !== void 0 ? { types } : {},
+      idRefs: bareIdRefs(targets),
+      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
+      actions: guard.match.actions
+    },
+    predicate: guard.predicate ?? "",
+    metadata: resolveMetadata(guard.metadata, ctx)
+  }), routeGdr: targets[0].parsed };
+}
+async function upsertGuard(client, doc) {
+  if (!await client.getDocument(doc._id)) {
+    await client.create(doc);
+    return;
+  }
+  const { _id, _type, _rev, _createdAt, _updatedAt, ...body } = doc;
+  await client.patch(doc._id).set(body).commit();
+}
+function resolvedStageGuards(args) {
+  const stage = args.definition.stages.find((s) => s.id === args.stageId), out = [];
+  for (const [index, guard] of (stage?.guards ?? []).entries()) {
+    const resolved = resolveGuard(guard, index, args.instance, args.stageId, args.now);
+    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
+  }
+  return out;
+}
+async function committedStageId(args) {
+  return (await args.client.getDocument(args.instance._id))?.currentStageId;
+}
+async function deployStageGuards(args) {
+  if (await committedStageId(args) === args.stageId)
+    for (const { client, doc } of resolvedStageGuards(args))
+      await upsertGuard(client, doc);
+}
+async function retractStageGuards(args) {
+  const live = await committedStageId(args);
+  if (!(live === void 0 || live === args.stageId))
+    for (const { client, doc } of resolvedStageGuards(args))
+      await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
+}
+function randomKey(length = 12) {
+  const bytes = new Uint8Array(length);
+  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
 function buildSnapshot(args) {
   const docs = [], knownIds = /* @__PURE__ */ new Set();
   for (const { doc, resource } of args.docs) {
@@ -247,74 +511,100 @@ function restampForSnapshot(doc, gdrUri2, resource) {
 }
 function rewriteRefsRecursive(value, resource) {
   if (Array.isArray(value))
-    return value.map((v) => rewriteRefsRecursive(v, resource));
+    return value.map((v2) => rewriteRefsRecursive(v2, resource));
   if (value === null || typeof value != "object") return value;
   const obj = value, out = {};
-  for (const [k, v] of Object.entries(obj))
-    k === "_ref" && typeof v == "string" ? out[k] = v.includes(":") ? v : gdrFromResource(resource, v) : out[k] = rewriteRefsRecursive(v, resource);
+  for (const [k, v2] of Object.entries(obj))
+    k === "_ref" && typeof v2 == "string" ? out[k] = v2.includes(":") ? v2 : gdrFromResource(resource, v2) : out[k] = rewriteRefsRecursive(v2, resource);
   return out;
 }
+function findOpenStageEntry(host) {
+  return host.stages.find((s) => s.id === host.currentStageId && s.exitedAt === void 0);
+}
+function collectWatchRefs(instance) {
+  const stage = findOpenStageEntry(instance);
+  return [
+    gdrRef(instance.workflowResource, instance._id, instance._type),
+    ...instance.ancestors,
+    ...slotDocRefs(instance.state),
+    ...slotDocRefs(stage?.state),
+    ...slotReleaseRefs(instance.state),
+    ...slotReleaseRefs(stage?.state)
+  ];
+}
+function readsRaw(ref) {
+  return ref.type === "workflow.instance" || ref.type === "system.release";
+}
+function contentReleaseName(args) {
+  const { ref, perspective } = args;
+  if (!readsRaw(ref) && Array.isArray(perspective))
+    return perspective.find((entry) => entry !== "drafts" && entry !== "published" && entry !== "raw");
+}
+function subscriptionDocumentsForInstance(instance) {
+  const seen = /* @__PURE__ */ new Set(), documents = [];
+  for (const ref of collectWatchRefs(instance))
+    !isGdrUri(ref.id) || seen.has(ref.id) || (seen.add(ref.id), documents.push({ ...parseGdr(ref.id), globalDocumentId: ref.id, type: ref.type }));
+  return {
+    documents,
+    ...instance.perspective !== void 0 ? { perspective: instance.perspective } : {}
+  };
+}
+function slotDocRefs(slots) {
+  return slotEntries(slots).flatMap((slot) => slot._type === "workflow.state.doc.ref" ? isGdr(slot.value) ? [slot.value] : [] : slot._type === "workflow.state.doc.refs" ? Array.isArray(slot.value) ? slot.value.filter(isGdr) : [] : []);
+}
+function slotReleaseRefs(slots) {
+  return slotEntries(slots).flatMap(
+    (slot) => slot._type === "workflow.state.release.ref" && isGdr(slot.value) ? [slot.value] : []
+  );
+}
+function slotEntries(slots) {
+  return Array.isArray(slots) ? slots.filter(
+    (slot) => !!slot && typeof slot == "object"
+  ) : [];
+}
 async function hydrateSnapshot(args) {
-  const { client, clientForGdr, instance, definition } = args, loaded = [], visited = /* @__PURE__ */ new Set(), loadInto = async (uri) => {
+  const { client, clientForGdr, instance, overlay } = args, loaded = [], visited = /* @__PURE__ */ new Set(), loadInto = async (uri, perspective) => {
     if (visited.has(uri)) return;
-    const fetched = await loadByGdr(client, clientForGdr, instance.workflowResource, uri);
+    const held = overlay?.get(uri);
+    if (held !== void 0) {
+      loaded.push(held), visited.add(uri);
+      return;
+    }
+    const fetched = await loadByGdr(
+      client,
+      clientForGdr,
+      instance.workflowResource,
+      uri,
+      perspective
+    );
     fetched && (loaded.push(fetched), visited.add(uri));
   };
-  loaded.push({ doc: instance, resource: instance.workflowResource }), visited.add(gdrFromResource(instance.workflowResource, instance._id));
-  for (const ancestor of instance.ancestors)
-    await loadInto(ancestor.id);
-  for (const uri of collectSlotDocUris(instance.state))
-    await loadInto(uri);
-  if (definition) {
-    const stageEntry = instance.stages.find(
-      (s) => s.id === instance.currentStageId && s.exitedAt === void 0
-    );
-    for (const uri of collectSlotDocUris(stageEntry?.state))
-      await loadInto(uri);
-  }
+  loaded.push({ doc: instance, resource: instance.workflowResource }), visited.add(selfGdr(instance));
+  for (const ref of collectWatchRefs(instance))
+    await loadInto(ref.id, readsRaw(ref) ? void 0 : instance.perspective);
   return buildSnapshot({ docs: loaded });
 }
-async function loadByGdr(defaultClient, clientForGdr, defaultResource, uri) {
+async function loadByGdr(defaultClient, clientForGdr, defaultResource, uri, perspective) {
   let parsed;
   try {
     parsed = parseGdr(uri);
   } catch {
-    const doc2 = await defaultClient.getDocument(uri);
+    const doc2 = await readDoc(defaultClient, uri, perspective);
     return doc2 ? { doc: doc2, resource: defaultResource } : null;
   }
-  const doc = await clientForGdr(parsed).getDocument(parsed.documentId);
+  const routed = clientForGdr(parsed), doc = await readDoc(routed, parsed.documentId, perspective);
   return doc ? { doc, resource: resourceFromParsed(parsed) } : null;
 }
+async function readDoc(client, id, perspective) {
+  return perspective === void 0 ? await client.getDocument(id) ?? null : await client.fetch("*[_id == $id][0]", { id }, { perspective }) ?? null;
+}
 function resourceFromParsed(parsed) {
   return parsed.scheme === "dataset" ? { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` } : { type: parsed.scheme, id: parsed.resourceId ?? "" };
 }
 function collectSlotDocUris(resolvedStateSlots) {
-  return Array.isArray(resolvedStateSlots) ? resolvedStateSlots.flatMap(slotDocUris) : [];
-}
-function slotDocUris(slot) {
-  if (!slot || typeof slot != "object") return [];
-  const s = slot;
-  if (s._type === "workflow.state.doc.ref") {
-    const v = s.value, id = refId(v);
-    return id !== void 0 ? [id] : [];
-  }
-  if (s._type === "workflow.state.doc.refs") {
-    const v = s.value;
-    return Array.isArray(v) ? v.map(refId).filter((id) => id !== void 0) : [];
-  }
-  return [];
-}
-function refId(ref) {
-  return ref && typeof ref.id == "string" ? ref.id : void 0;
-}
-function getPath(value, path) {
-  let current = value;
-  for (const part of path.split(".")) {
-    if (current == null || typeof current != "object") return;
-    current = current[part];
-  }
-  return current;
+  return slotDocRefs(resolvedStateSlots).map((ref) => ref.id);
 }
+const WORKFLOW_INSTANCE_TYPE = "workflow.instance";
 class SlotValueShapeError extends Error {
   slotType;
   slotId;
@@ -324,50 +614,61 @@ class SlotValueShapeError extends Error {
     super(`Slot ${args.mode} shape invalid for "${args.slotId}" (${args.slotType}): ${issueText}`), this.name = "SlotValueShapeError", this.slotType = args.slotType, this.slotId = args.slotId, this.issues = args.issues;
   }
 }
-const GdrShape = z.object({
-  id: z.string().refine((s) => isGdrUri(s), { message: "must be a GDR URI" }),
-  type: z.string().min(1)
-}).passthrough(), ReleaseRefShape = z.object({
-  id: z.string().refine((s) => isGdrUri(s), { message: "must be a GDR URI" }),
-  type: z.literal("system.release"),
-  releaseName: z.string().min(1)
-}).passthrough(), ActorShape = z.object({
-  kind: z.enum(["user", "ai", "system"]),
-  id: z.string().min(1),
-  roles: z.array(z.string()).optional(),
-  onBehalfOf: z.string().optional()
-}).passthrough(), AssigneeShape = z.union([
-  z.object({ kind: z.literal("user"), id: z.string().min(1) }).passthrough(),
-  z.object({ kind: z.literal("role"), role: z.string().min(1) }).passthrough()
-]), ChecklistItemShape = z.object({
-  label: z.string().min(1),
-  done: z.boolean(),
-  doneBy: z.string().optional(),
-  doneAt: z.string().optional(),
-  _key: z.string().min(1).optional()
-}).passthrough(), NoteItemShape = z.object({
-  _key: z.string().min(1).optional()
-}).passthrough().refine((v) => typeof v == "object" && v !== null && !Array.isArray(v), {
-  message: "must be an object"
-}), NullableString = z.union([z.null(), z.string()]), NullableNumber = z.union([z.null(), z.number()]), NullableBoolean = z.union([z.null(), z.boolean()]), NullableDateTime = z.union([
-  z.null(),
-  z.string().refine((s) => !Number.isNaN(Date.parse(s)), {
-    message: "must be an ISO-8601 datetime string"
-  })
+const GdrShape = v.looseObject({
+  id: v.pipe(
+    v.string(),
+    v.check((s) => isGdrUri(s), "must be a GDR URI")
+  ),
+  type: v.pipe(v.string(), v.minLength(1))
+}), ReleaseRefShape = v.looseObject({
+  id: v.pipe(
+    v.string(),
+    v.check((s) => isGdrUri(s), "must be a GDR URI")
+  ),
+  type: v.literal("system.release"),
+  releaseName: v.pipe(v.string(), v.minLength(1))
+}), ActorShape = v.looseObject({
+  kind: v.picklist(["user", "ai", "system"]),
+  id: v.pipe(v.string(), v.minLength(1)),
+  roles: v.optional(v.array(v.string())),
+  onBehalfOf: v.optional(v.string())
+}), AssigneeShape = v.union([
+  v.looseObject({ kind: v.literal("user"), id: v.pipe(v.string(), v.minLength(1)) }),
+  v.looseObject({ kind: v.literal("role"), role: v.pipe(v.string(), v.minLength(1)) })
+]), ChecklistItemShape = v.looseObject({
+  label: v.pipe(v.string(), v.minLength(1)),
+  done: v.boolean(),
+  doneBy: v.optional(v.string()),
+  doneAt: v.optional(v.string()),
+  _key: v.optional(v.pipe(v.string(), v.minLength(1)))
+}), NoteItemShape = v.pipe(
+  v.looseObject({
+    _key: v.optional(v.pipe(v.string(), v.minLength(1)))
+  }),
+  v.check(
+    (val) => typeof val == "object" && val !== null && !Array.isArray(val),
+    "must be an object"
+  )
+), NullableString = v.union([v.null(), v.string()]), NullableNumber = v.union([v.null(), v.number()]), NullableBoolean = v.union([v.null(), v.boolean()]), NullableDateTime = v.union([
+  v.null(),
+  v.pipe(
+    v.string(),
+    v.check((s) => !Number.isNaN(Date.parse(s)), "must be an ISO-8601 datetime string")
+  )
 ]), NullableUrl = NullableString, valueSchemas = {
-  "workflow.state.doc.ref": z.union([z.null(), GdrShape]),
-  "workflow.state.doc.refs": z.array(GdrShape),
-  "workflow.state.release.ref": z.union([z.null(), ReleaseRefShape]),
-  "workflow.state.query": z.any(),
+  "workflow.state.doc.ref": v.union([v.null(), GdrShape]),
+  "workflow.state.doc.refs": v.array(GdrShape),
+  "workflow.state.release.ref": v.union([v.null(), ReleaseRefShape]),
+  "workflow.state.query": v.any(),
   "workflow.state.value.string": NullableString,
   "workflow.state.value.url": NullableUrl,
   "workflow.state.value.number": NullableNumber,
   "workflow.state.value.boolean": NullableBoolean,
   "workflow.state.value.dateTime": NullableDateTime,
-  "workflow.state.value.actor": z.union([z.null(), ActorShape]),
-  "workflow.state.checklist": z.array(ChecklistItemShape),
-  "workflow.state.notes": z.array(NoteItemShape),
-  "workflow.state.assignees": z.array(AssigneeShape)
+  "workflow.state.value.actor": v.union([v.null(), ActorShape]),
+  "workflow.state.checklist": v.array(ChecklistItemShape),
+  "workflow.state.notes": v.array(NoteItemShape),
+  "workflow.state.assignees": v.array(AssigneeShape)
 }, itemSchemas = {
   "workflow.state.doc.refs": GdrShape,
   "workflow.state.checklist": ChecklistItemShape,
@@ -386,12 +687,12 @@ function validateSlotValue(args) {
       issues: [`unknown slot type ${args.slotType}`],
       mode: "value"
     });
-  const result = schema.safeParse(args.value);
+  const result = v.safeParse(schema, args.value);
   if (!result.success)
     throw new SlotValueShapeError({
       slotType: args.slotType,
       slotId: args.slotId,
-      issues: formatIssues(result.error.issues),
+      issues: formatIssues(result.issues),
       mode: "value"
     });
 }
@@ -403,17 +704,20 @@ function validateSlotAppendItem(args) {
       issues: [`slot type ${args.slotType} does not support append`],
       mode: "item"
     });
-  const result = itemSchemas[args.slotType].safeParse(args.item);
+  const schema = itemSchemas[args.slotType], result = v.safeParse(schema, args.item);
   if (!result.success)
     throw new SlotValueShapeError({
       slotType: args.slotType,
       slotId: args.slotId,
-      issues: formatIssues(result.error.issues),
+      issues: formatIssues(result.issues),
       mode: "item"
     });
 }
 function formatIssues(issues) {
-  return issues.map((i) => `${i.path.length > 0 ? `at ${i.path.join(".")}: ` : ""}${i.message}`);
+  return issues.map((i) => {
+    const keys = i.path?.map((p) => p.key) ?? [];
+    return `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${i.message}`;
+  });
 }
 function derivePerspectiveFromState(slots) {
   if (slots !== void 0) {
@@ -458,7 +762,7 @@ async function resolveQueryValue(slot, source, ctx, client, defaultValue) {
     state: stateMapFromResolved(ctx.resolvedState ?? []),
     stage: ctx.stageId ?? null,
     task: ctx.taskId ?? null,
-    now: (/* @__PURE__ */ new Date()).toISOString(),
+    now: ctx.now,
     engineTags: ctx.tags ?? []
   });
   try {
@@ -475,7 +779,7 @@ async function resolveSlotValue(slot, initialState, ctx, defaultValue) {
   const source = slot.source;
   return source.kind === "init" ? resolveInitValue(slot, initialState, defaultValue) : source.kind === "literal" ? source.value ?? defaultValue : source.kind === "stateRead" ? resolveStateReadValue(source, ctx, defaultValue) : source.kind === "query" && ctx.client !== void 0 ? resolveQueryValue(slot, source, ctx, ctx.client, defaultValue) : defaultValue;
 }
-function buildResolvedSlot(slot, value, _key) {
+function buildResolvedSlot(slot, value, _key, now) {
   const titleProp = slot.title !== void 0 ? { title: slot.title } : {}, descriptionProp = slot.description !== void 0 ? { description: slot.description } : {};
   return slot.type === "workflow.state.query" ? {
     _key,
@@ -484,7 +788,7 @@ function buildResolvedSlot(slot, value, _key) {
     ...titleProp,
     ...descriptionProp,
     value,
-    resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
+    resolvedAt: now
   } : {
     _key,
     _type: slot.type,
@@ -496,7 +800,7 @@ function buildResolvedSlot(slot, value, _key) {
 }
 async function resolveOneSlot(slot, initialState, ctx, randomKey2) {
   const defaultValue = defaultSlotValue(slot.type), value = await resolveSlotValue(slot, initialState, ctx, defaultValue);
-  return validateSlotValue({ slotType: slot.type, slotId: slot.id, value }), buildResolvedSlot(slot, value, randomKey2());
+  return validateSlotValue({ slotType: slot.type, slotId: slot.id, value }), buildResolvedSlot(slot, value, randomKey2(), ctx.now);
 }
 function stateMapFromResolved(slots) {
   const out = {};
@@ -510,10 +814,10 @@ function assertInitValueShape(slot, value) {
   }
   if (slot.type === "workflow.state.release.ref") {
     assertGdrShape(value, `state slot "${slot.id}" (workflow.state.release.ref)`);
-    const v = value;
-    if (typeof v.releaseName != "string" || v.releaseName.length === 0)
+    const v2 = value;
+    if (typeof v2.releaseName != "string" || v2.releaseName.length === 0)
       throw new Error(
-        `Invalid init value for state slot "${slot.id}" (workflow.state.release.ref): \`releaseName\` must be a non-empty string. Got ${JSON.stringify(v.releaseName)}.`
+        `Invalid init value for state slot "${slot.id}" (workflow.state.release.ref): \`releaseName\` must be a non-empty string. Got ${JSON.stringify(v2.releaseName)}.`
       );
     return;
   }
@@ -531,18 +835,18 @@ function assertGdrShape(value, context) {
     throw new Error(
       `Invalid GDR for ${context}: expected { id: "<scheme>:...", type: "<schema>" }, got ${typeof value}.`
     );
-  const v = value;
-  if (typeof v.id != "string" || !isGdrUri(v.id))
+  const v2 = value;
+  if (typeof v2.id != "string" || !isGdrUri(v2.id))
     throw new Error(
-      `Invalid GDR for ${context}: \`id\` must be a GDR URI ("<scheme>:<...id-parts>" with scheme dataset|canvas|media-library|dashboard). Got ${JSON.stringify(v.id)}. Construct via \`gdrFromResource\` / \`refDataset\` / \`refCanvas\` etc. \u2014 bare document ids are not accepted.`
+      `Invalid GDR for ${context}: \`id\` must be a GDR URI ("<scheme>:<...id-parts>" with scheme dataset|canvas|media-library|dashboard). Got ${JSON.stringify(v2.id)}. Construct via \`gdrFromResource\` / \`refDataset\` / \`refCanvas\` etc. \u2014 bare document ids are not accepted.`
     );
-  if (typeof v.type != "string" || v.type.length === 0)
+  if (typeof v2.type != "string" || v2.type.length === 0)
     throw new Error(
-      `Invalid GDR for ${context}: \`type\` (schema name) must be a non-empty string. Got ${JSON.stringify(v.type)}.`
+      `Invalid GDR for ${context}: \`type\` (schema name) must be a non-empty string. Got ${JSON.stringify(v2.type)}.`
     );
 }
 function normalizeQueryResult(slotType, raw, workflowResource) {
-  return raw == null ? raw : slotType === "workflow.state.doc.ref" ? coerceToGdr(raw, workflowResource) : slotType === "workflow.state.doc.refs" ? Array.isArray(raw) ? raw.map((item) => coerceToGdr(item, workflowResource)).filter((v) => v !== null) : [] : raw;
+  return raw == null ? raw : slotType === "workflow.state.doc.ref" ? coerceToGdr(raw, workflowResource) : slotType === "workflow.state.doc.refs" ? Array.isArray(raw) ? raw.map((item) => coerceToGdr(item, workflowResource)).filter((v2) => v2 !== null) : [] : raw;
 }
 function toGdrUri(docId, workflowResource) {
   return isGdrUri(docId) ? docId : gdrFromResource(workflowResource, docId);
@@ -567,25 +871,32 @@ async function loadContext(client, instanceId, options) {
   const instance = await client.getDocument(instanceId);
   if (!instance)
     throw new Error(`Workflow instance ${instanceId} not found`);
-  const definition = JSON.parse(instance.definitionSnapshot), clientForGdr = options?.clientForGdr ?? (() => client), snapshot = await hydrateSnapshot({ client, clientForGdr, instance, definition });
-  return { client, clientForGdr, instance, definition, snapshot };
+  const definition = JSON.parse(instance.definitionSnapshot), clientForGdr = options?.clientForGdr ?? (() => client), clock = options?.clock ?? wallClock, snapshot = await hydrateSnapshot({
+    client,
+    clientForGdr,
+    instance,
+    ...options?.overlay !== void 0 ? { overlay: options.overlay } : {}
+  });
+  return { client, clientForGdr, clock, now: clock(), instance, definition, snapshot };
 }
 function ctxEvaluateFilter(ctx, filter) {
   return evaluateFilter({
     filter,
     definition: ctx.definition,
     snapshot: ctx.snapshot,
-    params: buildParams(ctx.instance)
+    params: buildParams(ctx.instance, ctx.now)
   });
 }
 async function buildEngineContext(args) {
-  const { client, clientForGdr, instance, definition } = args;
+  const { client, clientForGdr, instance, definition } = args, clock = args.clock ?? wallClock;
   return {
     client,
     clientForGdr,
+    clock,
+    now: clock(),
     instance,
     definition,
-    snapshot: await hydrateSnapshot({ client, clientForGdr, instance, definition })
+    snapshot: await hydrateSnapshot({ client, clientForGdr, instance })
   };
 }
 function findStage(definition, stageId) {
@@ -595,12 +906,13 @@ function findStage(definition, stageId) {
   return stage;
 }
 async function resolveStageStateSlots(args) {
-  const { client, instance, stage, initialState } = args;
+  const { client, instance, stage, now, initialState } = args;
   return resolveDeclaredState({
     slotDefs: stage.state,
     initialState: initialState ?? [],
     ctx: {
       client,
+      now,
       selfId: instance._id,
       tags: instance.tags ?? [],
       stageId: stage.id,
@@ -615,12 +927,13 @@ async function resolveStageStateSlots(args) {
   });
 }
 async function resolveTaskStateSlots(args) {
-  const { client, instance, stage, task } = args;
+  const { client, instance, stage, task, now } = args;
   return resolveDeclaredState({
     slotDefs: task.state,
     initialState: [],
     ctx: {
       client,
+      now,
       selfId: instance._id,
       tags: instance.tags ?? [],
       stageId: stage.id,
@@ -632,73 +945,6 @@ async function resolveTaskStateSlots(args) {
     randomKey
   });
 }
-function readStateSlot(instance, scope, slotId, stageId, taskId) {
-  if (scope === "workflow")
-    return slotValue$1(instance.state?.find((s) => s.id === slotId));
-  const stageEntry = instance.stages.find(
-    (s) => s.id === (stageId ?? instance.currentStageId) && s.exitedAt === void 0
-  );
-  if (stageEntry === void 0) return;
-  if (scope === "stage")
-    return slotValue$1(stageEntry.state?.find((s) => s.id === slotId));
-  const taskEntry = stageEntry.tasks.find((t) => t.id === taskId);
-  return slotValue$1(taskEntry?.state?.find((s) => s.id === slotId));
-}
-function slotValue$1(slot) {
-  if (slot != null && typeof slot == "object")
-    return slot.value;
-}
-function resolveSource(src, ctx) {
-  switch (src.source) {
-    case "literal":
-      return src.value;
-    case "param":
-      return ctx.params?.[src.paramId];
-    case "actor":
-      return ctx.actor;
-    case "now":
-      return (/* @__PURE__ */ new Date()).toISOString();
-    case "self":
-      return ctx.instance._id;
-    case "stageId":
-      return ctx.stageId ?? ctx.instance.currentStageId;
-    case "stateRead":
-      return resolveStateRead(src, ctx);
-    case "effectOutput":
-      return resolveEffectOutput(src, ctx);
-    case "object":
-      return resolveObject(src, ctx);
-  }
-}
-function resolveStateRead(src, ctx) {
-  const value = readStateSlot(ctx.instance, src.scope, src.slotId, ctx.stageId, ctx.taskId);
-  return src.path !== void 0 ? getPath(value, src.path) : value;
-}
-function resolveEffectOutput(src, ctx) {
-  const entry = ctx.instance.effectsContext.find((e) => e.id === src.contextId);
-  if (entry === void 0) return null;
-  const value = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
-  return value === void 0 ? null : value;
-}
-function resolveObject(src, ctx) {
-  const out = {};
-  for (const [field, fieldSrc] of Object.entries(src.fields))
-    out[field] = resolveSource(fieldSrc, ctx);
-  return out;
-}
-async function resolveBindings(args) {
-  const { bindings, staticInput, instance, params, actor } = args, resolved = {};
-  if (bindings) {
-    const ctx = {
-      instance,
-      ...params !== void 0 ? { params } : {},
-      ...actor !== void 0 ? { actor } : {}
-    };
-    for (const [key, src] of Object.entries(bindings))
-      resolved[key] = resolveSource(src, ctx);
-  }
-  return { ...resolved, ...staticInput };
-}
 function effectsContextEntry(id, value) {
   const _key = randomKey();
   return typeof value == "string" ? { _key, _type: "effectsContext.string", id, value } : typeof value == "number" ? { _key, _type: "effectsContext.number", id, value } : typeof value == "boolean" ? { _key, _type: "effectsContext.boolean", id, value } : { _key, _type: "effectsContext.ref", id, value };
@@ -707,7 +953,7 @@ function buildInstanceBase(args) {
   const { id, now, actor, perspective } = args;
   return {
     _id: id,
-    _type: "workflow.instance",
+    _type: WORKFLOW_INSTANCE_TYPE,
     _rev: "",
     _createdAt: now,
     _updatedAt: now,
@@ -737,175 +983,337 @@ function buildInstanceBase(args) {
     lastChangedAt: now
   };
 }
-function lakeGuardId(args) {
-  return `temp.system.guard.${args.instanceDocId}.${args.stageId}.${args.index}`;
+function startMutation(instance) {
+  return {
+    currentStageId: instance.currentStageId,
+    // Deep-ish copy. Per-scope state slot arrays need their own copies
+    // so ops can mutate without leaking into the source.
+    state: (instance.state ?? []).map((s) => ({ ...s })),
+    stages: instance.stages.map((s) => ({
+      ...s,
+      state: (s.state ?? []).map((slot) => ({ ...slot })),
+      tasks: s.tasks.map((t) => ({
+        ...t,
+        ...t.state !== void 0 ? { state: t.state.map((slot) => ({ ...slot })) } : {}
+      }))
+    })),
+    pendingEffects: [...instance.pendingEffects],
+    effectHistory: [...instance.effectHistory],
+    effectsContext: [...instance.effectsContext],
+    history: [...instance.history],
+    lastChangedAt: instance.lastChangedAt,
+    ...instance.completedAt !== void 0 ? { completedAt: instance.completedAt } : {},
+    pendingCreates: []
+  };
 }
-function compileGuard(args) {
+function taskStatusChangedEntry(args) {
   return {
-    _id: args.id,
-    _type: "temp.system.guard",
-    resourceType: args.resourceType,
-    resourceId: args.resourceId,
-    owner: args.owner,
-    ...args.name !== void 0 ? { name: args.name } : {},
-    ...args.description !== void 0 ? { description: args.description } : {},
-    match: args.match,
-    predicate: args.predicate,
-    metadata: args.metadata
+    _key: randomKey(),
+    _type: "workflow.history.taskStatusChanged",
+    at: args.at,
+    stageId: args.stageId,
+    taskId: args.taskId,
+    from: args.from,
+    to: args.to,
+    ...args.actor !== void 0 ? { actor: args.actor } : {}
   };
 }
-function toGroqJsPredicate(predicate) {
-  return predicate.replace(new RegExp("(?<!\\$)\\bguard\\.", "g"), "$guard.").replace(new RegExp("(?<!\\$)\\bmutation\\.", "g"), "$mutation.");
+function stageTransitionHistory(args) {
+  const { fromStageId, toStageId, at, transitionId, actor, via, reason } = args, shared = {
+    at,
+    ...transitionId !== void 0 ? { transitionId } : {},
+    ...actor !== void 0 ? { actor } : {},
+    ...via !== void 0 ? { via } : {},
+    ...reason !== void 0 ? { reason } : {}
+  };
+  return [
+    {
+      _key: randomKey(),
+      _type: "workflow.history.stageExited",
+      stageId: fromStageId,
+      toStageId,
+      ...shared
+    },
+    {
+      _key: randomKey(),
+      _type: "workflow.history.transitionFired",
+      fromStageId,
+      toStageId,
+      ...shared
+    },
+    {
+      _key: randomKey(),
+      _type: "workflow.history.stageEntered",
+      stageId: toStageId,
+      fromStageId,
+      ...shared
+    }
+  ];
 }
-function globMatch(pattern, value) {
-  if (!pattern.includes("*")) return pattern === value;
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`).test(value);
+function instanceStateFields(src) {
+  const fields = {
+    currentStageId: src.currentStageId,
+    state: src.state,
+    stages: src.stages,
+    pendingEffects: src.pendingEffects,
+    effectHistory: src.effectHistory,
+    effectsContext: src.effectsContext,
+    history: src.history
+  };
+  return src.completedAt !== void 0 && (fields.completedAt = src.completedAt), fields;
 }
-function guardMatches(guard, doc, action) {
-  const m = guard.match;
-  if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type)))
-    return !1;
-  if (m.idRefs && m.idRefs.length > 0 || m.idPatterns && m.idPatterns.length > 0) {
-    const byRef = m.idRefs?.includes(doc.id) ?? !1, byPattern = m.idPatterns?.some((p) => globMatch(p, doc.id)) ?? !1;
-    if (!byRef && !byPattern) return !1;
-  }
-  return !0;
+function materializeInstance(base, mutation) {
+  return {
+    ...base,
+    currentStageId: mutation.currentStageId,
+    state: mutation.state,
+    stages: mutation.stages
+  };
 }
-async function evaluateMutationGuard(args) {
-  const { guard, context } = args;
-  if (guard.predicate === "") return !1;
-  const params = { guard, mutation: { action: context.action } };
-  try {
-    const tree = parse(toGroqJsPredicate(guard.predicate), { mode: "delta", params });
-    return await (await evaluate(tree, {
-      before: context.before,
-      after: context.after,
-      params,
-      ...context.identity !== void 0 ? { identity: context.identity } : {}
-    })).get() === !0;
-  } catch {
-    return !1;
-  }
+async function persist(ctx, mutation) {
+  const set = {
+    ...instanceStateFields(mutation),
+    lastChangedAt: ctx.now
+  }, pendingCreates = mutation.pendingCreates;
+  if (pendingCreates.length === 0)
+    return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit();
+  const tx = ctx.client.transaction();
+  for (const body of pendingCreates) tx.create(body);
+  tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), await tx.commit(), mutation.pendingCreates = [];
+  const actorForPriming = void 0;
+  for (const body of pendingCreates)
+    await primeInitialStage(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await cascadeAutoTransitions(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await propagateToAncestors(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock);
+  const reloaded = await ctx.client.getDocument(ctx.instance._id);
+  if (!reloaded)
+    throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
+  return reloaded;
 }
-async function denyingGuards(args) {
-  const { guards, doc, context } = args, denied = [];
-  for (const guard of guards)
-    guardMatches(guard, doc, context.action) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
-  return denied;
+function currentStageEntry(mutation) {
+  const entry = findOpenStageEntry(mutation);
+  if (entry === void 0)
+    throw new Error(
+      `Mutation invariant broken: no current (un-exited) StageEntry for currentStageId "${mutation.currentStageId}"`
+    );
+  return entry;
 }
-function resourceOf(p) {
-  return p.scheme === "dataset" ? { type: "dataset", id: `${p.projectId}.${p.dataset}` } : { type: p.scheme, id: p.resourceId ?? "" };
+function currentTasks(mutation) {
+  return currentStageEntry(mutation).tasks;
 }
-function resolveIdRefTarget(src, ctx) {
-  const value = resolveSource(src, ctx);
-  if (typeof value == "string" && isGdrUri(value))
-    return { parsed: parseGdr(value) };
-  if (value && typeof value == "object") {
-    const v = value;
-    if (typeof v.id == "string" && isGdrUri(v.id))
-      return typeof v.type == "string" ? { parsed: parseGdr(v.id), type: v.type } : { parsed: parseGdr(v.id) };
-  }
-  return null;
+function findTaskInCurrentStage(ctx, taskId) {
+  const stage = findStage(ctx.definition, ctx.instance.currentStageId), task = (stage.tasks ?? []).find((t) => t.id === taskId);
+  if (task === void 0)
+    throw new Error(
+      `Task "${taskId}" not found in current stage "${stage.id}" of ${ctx.definition.workflowId}`
+    );
+  return { stage, task };
 }
-function resolveIdRefTargets(idRefs, ctx) {
-  const targets = [];
-  for (const src of idRefs ?? []) {
-    const target = resolveIdRefTarget(src, ctx);
-    if (target === null) return null;
-    targets.push(target);
-  }
-  return targets.length === 0 ? null : targets;
+function requireMutationTaskEntry(mutation, taskId) {
+  const mutEntry = currentTasks(mutation).find((t) => t.id === taskId);
+  if (mutEntry === void 0)
+    throw new Error(`Task "${taskId}" disappeared from mutation copy \u2014 invariant broken`);
+  return mutEntry;
 }
-function assertSingleResource(targets) {
-  const resource = resourceOf(targets[0].parsed);
-  for (const g of targets) {
-    const r = resourceOf(g.parsed);
-    if (r.type !== resource.type || r.id !== resource.id)
-      throw new Error(
-        `Guard targets span multiple resources (${resource.type}:${resource.id} vs ${r.type}:${r.id}); a guard is single-resource.`
-      );
-  }
-  return resource;
+function findCurrentStageEntry(instance) {
+  return findOpenStageEntry(instance);
 }
-function bareIdRefs(targets) {
-  return targets.flatMap((g) => [g.parsed.documentId, `drafts.${g.parsed.documentId}`]);
+function findCurrentTasks(instance) {
+  return findCurrentStageEntry(instance)?.tasks ?? [];
 }
-function resolveMatchTypes(targets, authorTypes) {
-  if (authorTypes !== void 0) return authorTypes;
-  const inferred = [...new Set(targets.map((g) => g.type).filter((t) => !!t))];
-  return inferred.length > 0 ? inferred : void 0;
+async function completeEffect(args) {
+  const { client, instanceId, effectKey, status, outputs, detail, error, durationMs, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {}
+  });
+  return commitCompleteEffect(
+    ctx,
+    effectKey,
+    status,
+    outputs,
+    detail,
+    error,
+    durationMs,
+    options?.actor
+  );
 }
-function resolveMetadata(metadata, ctx) {
-  const out = {};
-  for (const [k, src] of Object.entries(metadata ?? {}))
-    out[k] = resolveSource(src, ctx);
-  return out;
+function buildEffectHistoryEntry(pending, outcome) {
+  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
+  return {
+    _key: pending._key,
+    effectId: pending.effectId,
+    ...pending.title !== void 0 ? { title: pending.title } : {},
+    ...pending.description !== void 0 ? { description: pending.description } : {},
+    params: pending.params,
+    origin: pending.origin,
+    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
+    ranAt,
+    ...durationMs !== void 0 ? { durationMs } : {},
+    status,
+    ...detail !== void 0 ? { detail } : {},
+    ...error !== void 0 ? { error } : {},
+    ...outputs !== void 0 ? { outputs } : {}
+  };
 }
-const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
-function resolveGuard(guard, index, instance, stageId) {
-  const ctx = { instance, stageId }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
-  if (targets === null) return null;
-  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
-  return { doc: compileGuard({
-    id: lakeGuardId({ instanceDocId: instance._id, stageId, index }),
-    resourceType: resource.type,
-    resourceId: resource.id,
-    owner: GUARD_OWNER,
-    ...guard.name !== void 0 ? { name: guard.name } : {},
-    ...guard.description !== void 0 ? { description: guard.description } : {},
-    match: {
-      ...types !== void 0 ? { types } : {},
-      idRefs: bareIdRefs(targets),
-      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
-      actions: guard.match.actions
-    },
-    predicate: guard.predicate ?? "",
-    metadata: resolveMetadata(guard.metadata, ctx)
-  }), routeGdr: targets[0].parsed };
+function upsertEffectsContext(mutation, outputs) {
+  for (const [id, value] of Object.entries(outputs)) {
+    const existingIndex = mutation.effectsContext.findIndex((e) => e.id === id), entry = effectsContextEntry(id, value);
+    existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
+  }
 }
-async function upsertGuard(client, doc) {
-  const existing = await client.getDocument(doc._id), set = {
-    resourceType: doc.resourceType,
-    resourceId: doc.resourceId,
-    owner: doc.owner,
-    match: doc.match,
-    predicate: doc.predicate,
-    metadata: doc.metadata
+async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
+  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
+  if (pending === void 0)
+    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
+  const mutation = startMutation(ctx.instance);
+  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
+  const ranAt = ctx.now;
+  return mutation.effectHistory.push(
+    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
+  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, outputs), mutation.history.push({
+    _key: randomKey(),
+    _type: "workflow.history.effectCompleted",
+    at: ranAt,
+    effectKey,
+    effectId: pending.effectId,
+    status,
+    ...outputs !== void 0 ? { outputs } : {},
+    ...detail !== void 0 ? { detail } : {},
+    ...actor !== void 0 ? { actor } : {}
+  }), await persist(ctx, mutation), { effectKey, status };
+}
+function buildQueuedEffect(effect, origin, params, actor, now) {
+  const key = randomKey(), pending = {
+    _key: key,
+    _type: "workflow.pendingEffect",
+    effectId: effect.id,
+    ...effect.title !== void 0 ? { title: effect.title } : {},
+    ...effect.description !== void 0 ? { description: effect.description } : {},
+    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
+    params,
+    origin,
+    ...actor !== void 0 ? { actor } : {},
+    queuedAt: now
+  }, history = {
+    _key: randomKey(),
+    _type: "workflow.history.effectQueued",
+    at: now,
+    effectKey: key,
+    effectId: effect.id,
+    origin
   };
-  doc.name !== void 0 && (set.name = doc.name), doc.description !== void 0 && (set.description = doc.description), existing ? await client.patch(doc._id).set(set).commit() : await client.create(doc);
+  return { pending, history };
 }
-function resolvedStageGuards(args) {
-  const stage = args.definition.stages.find((s) => s.id === args.stageId), out = [];
-  for (const [index, guard] of (stage?.guards ?? []).entries()) {
-    const resolved = resolveGuard(guard, index, args.instance, args.stageId);
-    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
+async function queueEffects(ctx, mutation, effects, origin, actor, callerParams) {
+  if (!effects) return;
+  const now = ctx.now, liveInstance = {
+    ...ctx.instance,
+    state: mutation.state,
+    stages: mutation.stages,
+    effectsContext: mutation.effectsContext
+  };
+  for (const effect of effects) {
+    const params = await resolveBindings({
+      bindings: effect.bindings,
+      staticInput: effect.input,
+      instance: liveInstance,
+      now,
+      ...callerParams !== void 0 ? { params: callerParams } : {},
+      ...actor !== void 0 ? { actor } : {}
+    }), { pending, history } = buildQueuedEffect(effect, origin, params, actor, now);
+    mutation.pendingEffects.push(pending), mutation.history.push(history);
   }
-  return out;
 }
-async function deployStageGuards(args) {
-  for (const { client, doc } of resolvedStageGuards(args))
-    await upsertGuard(client, doc);
+class ActionParamsInvalidError extends Error {
+  action;
+  taskId;
+  issues;
+  constructor(args) {
+    const lines = args.issues.map((i) => `  - ${i.paramId}: ${i.reason}`).join(`
+`);
+    super(`Action "${args.action}" on task "${args.taskId}" rejected: invalid params
+${lines}`), this.name = "ActionParamsInvalidError", this.action = args.action, this.taskId = args.taskId, this.issues = args.issues;
+  }
 }
-async function retractStageGuards(args) {
-  for (const { client, doc } of resolvedStageGuards(args))
-    await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
+class WorkflowStateDivergedError extends Error {
+  instanceId;
+  /** The guard-deploy failure that triggered the (attempted) rollback. */
+  guardError;
+  /** The rollback failure, when rollback was attempted and itself failed. */
+  rollbackError;
+  constructor(args) {
+    super(
+      `Workflow "${args.instanceId}" state committed but its guards could not be reconciled: ${args.reason}.`,
+      { cause: args.guardError }
+    ), this.name = "WorkflowStateDivergedError", this.instanceId = args.instanceId, this.guardError = args.guardError, args.rollbackError !== void 0 && (this.rollbackError = args.rollbackError);
+  }
 }
-async function reconcileStageGuards(args) {
-  const { client, clientForGdr, instance, definition, exitedStageId, enteredStageId } = args;
-  exitedStageId !== void 0 && await retractStageGuards({
-    client,
-    clientForGdr,
-    instance,
-    definition,
-    stageId: exitedStageId
-  }), enteredStageId !== void 0 && await deployStageGuards({
-    client,
-    clientForGdr,
-    instance,
-    definition,
-    stageId: enteredStageId
-  });
+const CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS = 3;
+class ConcurrentFireActionError extends Error {
+  instanceId;
+  taskId;
+  action;
+  attempts;
+  constructor(args) {
+    super(
+      `Action "${args.action}" on task "${args.taskId}" (instance ${args.instanceId}) lost the optimistic-locking race ${args.attempts} attempts running \u2014 a concurrent writer kept committing first. Re-read and retry, or investigate a write storm on this instance.`
+    ), this.name = "ConcurrentFireActionError", this.instanceId = args.instanceId, this.taskId = args.taskId, this.action = args.action, this.attempts = args.attempts;
+  }
+}
+function isRevisionConflict(error) {
+  if (typeof error != "object" || error === null) return !1;
+  const { statusCode, message } = error;
+  return statusCode === 409 ? !0 : typeof message == "string" && message.includes("ifRevisionId check failed");
+}
+class CascadeLimitError extends Error {
+  instanceId;
+  limit;
+  constructor(args) {
+    super(
+      `Cascade did not stabilise after ${args.limit} auto-transitions on ${args.instanceId} \u2014 likely a runaway loop (transition guards that stay mutually satisfied). Check that each transition's filter eventually goes false.`
+    ), this.name = "CascadeLimitError", this.instanceId = args.instanceId, this.limit = args.limit;
+  }
+}
+async function deployOrRollback(args) {
+  try {
+    await args.deploy();
+  } catch (guardError) {
+    if (!args.reversible)
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        reason: "the move created child instances a parent-only rollback cannot undo"
+      });
+    try {
+      let patch = args.client.patch(args.instanceId).set(args.restore);
+      args.unset && args.unset.length > 0 && (patch = patch.unset(args.unset)), args.committedRev !== void 0 && (patch = patch.ifRevisionId(args.committedRev)), await patch.commit();
+    } catch (rollbackError) {
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        rollbackError,
+        reason: "rollback of the committed move failed"
+      });
+    }
+    throw guardError;
+  }
+}
+const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+function validateTags(tags) {
+  if (tags.length === 0)
+    throw new Error("tags: must be a non-empty array");
+  for (const tag of tags)
+    if (!TAG_RE.test(tag))
+      throw new Error(
+        `tags: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
+      );
+}
+function canonicalTag(tags) {
+  return tags[0];
+}
+function tagScopeFilter(param = "engineTags") {
+  return `count(tags[@ in $${param}]) > 0`;
+}
+function definitionLookupGroq(explicit) {
+  const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && workflowId == $workflowId && ${tagScopeFilter()}`;
+  return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
 }
 async function discoverItems(args) {
   const { client, groq, params, perspective } = args, fetchOptions = perspective !== void 0 ? { perspective } : void 0;
@@ -922,31 +1330,29 @@ function clientForDiscovery(defaultClient, clientForGdr, subjectGdrUri) {
 const MAX_SPAWN_DEPTH = 6;
 async function spawnChildren(ctx, mutation, task, spawn, actor) {
   if (ctx.instance.ancestors.length + 1 > MAX_SPAWN_DEPTH) {
-    const chain = [
-      ...ctx.instance.ancestors.map((a) => a.id),
-      gdrFromResource(ctx.instance.workflowResource, ctx.instance._id)
-    ].join(" \u2192 ");
+    const chain = [...ctx.instance.ancestors.map((a) => a.id), selfGdr(ctx.instance)].join(" \u2192 ");
     throw new Error(
       `Spawn depth limit (${MAX_SPAWN_DEPTH}) exceeded on task "${task.id}" of ${ctx.instance._id}. Ancestor chain: ${chain}`
     );
   }
-  const rows = await resolveSpawnRows(ctx, spawn), refs = [];
+  const now = ctx.now, rows = await resolveSpawnRows(ctx, spawn), refs = [];
   for (const row of rows) {
-    const projected = projectSpawnRow(ctx.instance, spawn, row), { ref, body } = await prepareChildInstance({
+    const projected = projectSpawnRow(ctx.instance, spawn, row, now), { ref, body } = await prepareChildInstance({
       client: ctx.client,
       parent: ctx.instance,
       task,
       spawn,
       initialState: projected.initialState,
       effectsContext: projected.effectsContext,
-      actor
+      actor,
+      now
     });
     refs.push(ref), mutation.pendingCreates.push(body);
   }
   return refs;
 }
 async function resolveSpawnRows(ctx, spawn) {
-  const params = buildParams(ctx.instance), groq = spawn.forEach.groq;
+  const params = buildParams(ctx.instance, ctx.now), groq = spawn.forEach.groq;
   let value;
   if (groq.includes("*")) {
     const routingUri = firstDocRefGdrUri(ctx.instance.state), client = clientForDiscovery(ctx.client, ctx.clientForGdr, routingUri);
@@ -968,7 +1374,7 @@ function firstDocRefGdrUri(slots) {
       if (s._type === "workflow.state.doc.ref" && s.value !== null) return s.value.id;
   }
 }
-function resolveSpawnSource(source, parent, row) {
+function resolveSpawnSource(source, parent, row, now) {
   switch (source.source) {
     case "literal":
       return source.value;
@@ -979,15 +1385,15 @@ function resolveSpawnSource(source, parent, row) {
       return slot === void 0 ? null : source.path !== void 0 ? getPath(slot, source.path) : slot;
     }
     case "self":
-      return gdrFromResource(parent.workflowResource, parent._id);
+      return selfGdr(parent);
     case "stageId":
       return parent.currentStageId;
     case "now":
-      return (/* @__PURE__ */ new Date()).toISOString();
+      return now;
     case "object": {
       const out = {};
-      for (const [k, v] of Object.entries(source.fields))
-        out[k] = resolveSpawnSource(v, parent, row);
+      for (const [k, v2] of Object.entries(source.fields))
+        out[k] = resolveSpawnSource(v2, parent, row, now);
       return out;
     }
     case "actor":
@@ -997,10 +1403,10 @@ function resolveSpawnSource(source, parent, row) {
       return null;
   }
 }
-function projectSpawnRow(parent, spawn, row) {
+function projectSpawnRow(parent, spawn, row, now) {
   const initialState = [];
   for (const entry of spawn.forEach.as.initialState ?? []) {
-    const raw = resolveSpawnSource(entry.value, parent, row), value = canonicaliseSpawnValue(entry.type, raw, parent.workflowResource);
+    const raw = resolveSpawnSource(entry.value, parent, row, now), value = canonicaliseSpawnValue(entry.type, raw, parent.workflowResource);
     initialState.push({
       type: entry.type,
       id: entry.id,
@@ -1009,13 +1415,13 @@ function projectSpawnRow(parent, spawn, row) {
   }
   const effectsContext = {};
   for (const [k, src] of Object.entries(spawn.forEach.as.effectsContext ?? {})) {
-    const v = resolveSpawnSource(src, parent, row);
-    v != null && (typeof v == "string" || typeof v == "number" || typeof v == "boolean" || typeof v == "object" && "id" in v && "type" in v) && (effectsContext[k] = v);
+    const v2 = resolveSpawnSource(src, parent, row, now);
+    v2 != null && (typeof v2 == "string" || typeof v2 == "number" || typeof v2 == "boolean" || typeof v2 == "object" && "id" in v2 && "type" in v2) && (effectsContext[k] = v2);
   }
   return { initialState, effectsContext };
 }
 function canonicaliseSpawnValue(slotType, value, workflowResource) {
-  return slotType === "workflow.state.doc.ref" ? coerceSpawnGdr(value, workflowResource) : slotType === "workflow.state.doc.refs" && Array.isArray(value) ? value.map((v) => coerceSpawnGdr(v, workflowResource)).filter((v) => v !== null) : value;
+  return slotType === "workflow.state.doc.ref" ? coerceSpawnGdr(value, workflowResource) : slotType === "workflow.state.doc.refs" && Array.isArray(value) ? value.map((v2) => coerceSpawnGdr(v2, workflowResource)).filter((v2) => v2 !== null) : value;
 }
 function coerceSpawnGdr(raw, workflowResource) {
   const toUri = (id) => isGdrUri(id) ? id : gdrFromResource(workflowResource, id);
@@ -1032,30 +1438,32 @@ function coerceSpawnGdr(raw, workflowResource) {
   return typeof raw == "string" && raw.length > 0 ? { id: toUri(raw), type: "document" } : null;
 }
 async function resolveLogicalDefinition(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, tags };
-  wantsExplicit && (params.version = ref.version);
-  const groq = wantsExplicit ? '*[_type == "workflow.definition" && workflowId == $workflowId && version == $version && count(tags[@ in $tags]) > 0][0]' : '*[_type == "workflow.definition" && workflowId == $workflowId && count(tags[@ in $tags]) > 0] | order(version desc)[0]';
-  return await client.fetch(groq, params) ?? null;
+  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, engineTags: tags };
+  return wantsExplicit && (params.version = ref.version), await client.fetch(
+    definitionLookupGroq(wantsExplicit),
+    params
+  ) ?? null;
 }
 async function prepareChildInstance(args) {
-  const { client, parent, task, spawn, initialState, effectsContext, actor } = args, definition = await resolveLogicalDefinition(client, spawn.definitionRef, parent.tags ?? []);
+  const { client, parent, task, spawn, initialState, effectsContext, actor, now } = args, definition = await resolveLogicalDefinition(client, spawn.definitionRef, parent.tags ?? []);
   if (definition === null) {
     const versionLabel = spawn.definitionRef.version === void 0 || spawn.definitionRef.version === "latest" ? "latest" : `v${spawn.definitionRef.version}`;
     throw new Error(
       `Spawn target workflowId="${spawn.definitionRef.workflowId}" ${versionLabel} not deployed (parent ${parent._id}, task ${task.id})`
     );
   }
-  const childTags = parent.tags ?? [], childPrefix = childTags[0] ?? "wf", workflowResource = parent.workflowResource, childDocId = `${childPrefix}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: "workflow.instance" }, ancestors = [
+  const childTags = parent.tags ?? [], childPrefix = childTags[0] ?? "wf", workflowResource = parent.workflowResource, childDocId = `${childPrefix}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
     ...parent.ancestors,
     {
-      id: gdrFromResource(parent.workflowResource, parent._id),
-      type: "workflow.instance"
+      id: selfGdr(parent),
+      type: WORKFLOW_INSTANCE_TYPE
     }
   ], inheritedPerspective = parent.perspective, childState = await resolveDeclaredState({
     slotDefs: definition.state,
     initialState,
     ctx: {
       client,
+      now,
       selfId: childDocId,
       tags: childTags,
       workflowResource,
@@ -1075,7 +1483,7 @@ async function prepareChildInstance(args) {
     }
   ), base = buildInstanceBase({
     id: childDocId,
-    now: (/* @__PURE__ */ new Date()).toISOString(),
+    now,
     tags: childTags,
     workflowResource,
     workflowId: definition.workflowId,
@@ -1111,7 +1519,9 @@ async function checkSpawnCompletion(client, entry, spawn) {
   }
 }
 async function invokeTask(args) {
-  const { client, instanceId, taskId, options } = args, ctx = await loadContext(client, instanceId);
+  const { client, instanceId, taskId, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {}
+  });
   return commitInvoke(ctx, taskId, options?.actor);
 }
 async function commitInvoke(ctx, taskId, actor) {
@@ -1123,41 +1533,41 @@ async function commitInvoke(ctx, taskId, actor) {
   const mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskId);
   return await activateTask(ctx, mutation, task, mutEntry, actor), await persist(ctx, mutation), { invoked: !0, taskId };
 }
-async function autoResolveOnActivate(ctx, mutation, task, entry) {
+async function autoResolveOnActivate(ctx, mutation, task, entry, now) {
   const checks = [
     { filter: task.failWhen, outcome: "failed", systemId: "engine.failWhen" },
     { filter: task.completeWhen, outcome: "done", systemId: "engine.completeWhen" }
   ];
-  for (const { filter, outcome, systemId } of checks) {
-    if (filter === void 0 || !await ctxEvaluateFilter(ctx, filter)) continue;
-    const completedAt = (/* @__PURE__ */ new Date()).toISOString();
-    return entry.status = outcome, entry.completedAt = completedAt, entry.completedBy = systemId, mutation.history.push(
-      taskStatusChangedEntry({
-        stageId: mutation.currentStageId,
-        taskId: task.id,
-        from: "active",
-        to: outcome,
-        actor: { kind: "system", id: systemId },
-        at: completedAt
-      })
-    ), !0;
-  }
+  for (const { filter, outcome, systemId } of checks)
+    if (filter !== void 0 && await ctxEvaluateFilter(ctx, filter))
+      return entry.status = outcome, entry.completedAt = now, entry.completedBy = systemId, mutation.history.push(
+        taskStatusChangedEntry({
+          stageId: mutation.currentStageId,
+          taskId: task.id,
+          from: "active",
+          to: outcome,
+          at: now,
+          actor: { kind: "system", id: systemId }
+        })
+      ), !0;
   return !1;
 }
 async function activateTask(ctx, mutation, task, entry, actor) {
-  if (entry.status = "active", entry.startedAt = (/* @__PURE__ */ new Date()).toISOString(), task.state !== void 0 && task.state.length > 0) {
+  const now = ctx.now;
+  if (entry.status = "active", entry.startedAt = now, task.state !== void 0 && task.state.length > 0) {
     const stage = findStage(ctx.definition, mutation.currentStageId);
     entry.state = await resolveTaskStateSlots({
       client: ctx.client,
       instance: ctx.instance,
       stage,
-      task
+      task,
+      now
     });
   }
-  if (!await autoResolveOnActivate(ctx, mutation, task, entry) && (mutation.history.push({
+  if (!await autoResolveOnActivate(ctx, mutation, task, entry, now) && (mutation.history.push({
     _key: randomKey(),
     _type: "workflow.history.taskActivated",
-    at: (/* @__PURE__ */ new Date()).toISOString(),
+    at: now,
     stageId: mutation.currentStageId,
     taskId: task.id,
     ...actor !== void 0 ? { actor } : {}
@@ -1177,18 +1587,19 @@ async function activateTask(ctx, mutation, task, entry, actor) {
       mutation.history.push({
         _key: randomKey(),
         _type: "workflow.history.spawned",
-        at: (/* @__PURE__ */ new Date()).toISOString(),
+        at: now,
         taskId: task.id,
         instanceRef: ref
       });
     if (await checkSpawnCompletion(ctx.client, entry, task.spawns)) {
       const previousStatus = entry.status;
-      entry.status = "done", entry.completedAt = (/* @__PURE__ */ new Date()).toISOString(), mutation.history.push(
+      entry.status = "done", entry.completedAt = now, mutation.history.push(
         taskStatusChangedEntry({
           stageId: mutation.currentStageId,
           taskId: task.id,
           from: previousStatus,
           to: "done",
+          at: now,
           ...actor !== void 0 ? { actor } : {}
         })
       );
@@ -1205,7 +1616,7 @@ async function buildStageTasks(ctx, stage) {
       status: inScope ? "pending" : "skipped",
       ...task.filter !== void 0 ? {
         filterEvaluation: {
-          at: (/* @__PURE__ */ new Date()).toISOString(),
+          at: ctx.now,
           truthy: inScope
         }
       } : {}
@@ -1217,7 +1628,9 @@ function activatesOnStageEnter(task) {
   return task.invokeOn === "stageEnter" || task.spawns !== void 0 || task.completeWhen !== void 0 || task.failWhen !== void 0;
 }
 async function setStage(args) {
-  const { client, instanceId, targetStageId, reason, options } = args, ctx = await loadContext(client, instanceId);
+  const { client, instanceId, targetStageId, reason, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {}
+  });
   return commitSetStage(ctx, targetStageId, reason, options?.actor);
 }
 async function enterStage(ctx, mutation, nextStage, actor, at) {
@@ -1229,7 +1642,8 @@ async function enterStage(ctx, mutation, nextStage, actor, at) {
     state: await resolveStageStateSlots({
       client: ctx.client,
       instance: ctx.instance,
-      stage: nextStage
+      stage: nextStage,
+      now: at
     }),
     tasks: await buildStageTasks(ctx, nextStage)
   };
@@ -1248,7 +1662,7 @@ async function enterStage(ctx, mutation, nextStage, actor, at) {
   nextStage.kind === "terminal" && (mutation.completedAt = at);
 }
 async function beginStageMove(ctx, currentStage, actor) {
-  const mutation = startMutation(ctx.instance), at = (/* @__PURE__ */ new Date()).toISOString();
+  const mutation = startMutation(ctx.instance), at = ctx.now;
   return await queueEffects(
     ctx,
     mutation,
@@ -1282,13 +1696,46 @@ async function commitSetStage(ctx, targetStageId, reason, actor) {
   };
 }
 async function persistStageMove(ctx, mutation, exitedStageId, enteredStageId) {
-  await persist(ctx, mutation), await reconcileStageGuards({
+  await persistThenDeploy(
+    ctx,
+    mutation,
+    () => deployStageGuards({
+      client: ctx.client,
+      clientForGdr: ctx.clientForGdr,
+      instance: materializeInstance(ctx.instance, mutation),
+      definition: ctx.definition,
+      stageId: enteredStageId,
+      now: ctx.now
+    })
+  ), await retractStageGuards({
     client: ctx.client,
     clientForGdr: ctx.clientForGdr,
     instance: ctx.instance,
     definition: ctx.definition,
-    exitedStageId,
-    enteredStageId
+    stageId: exitedStageId,
+    now: ctx.now
+  });
+}
+async function persistThenDeploy(ctx, mutation, deploy) {
+  const spawned = mutation.pendingCreates.length > 0, committed = await persist(ctx, mutation);
+  await deployOrRollback({
+    client: ctx.client,
+    instanceId: ctx.instance._id,
+    committedRev: committed._rev,
+    restore: instanceStateFields(ctx.instance),
+    unset: ctx.instance.completedAt === void 0 ? ["completedAt"] : [],
+    reversible: !spawned,
+    deploy
+  });
+}
+async function refreshStageGuards(ctx, mutation, stageId) {
+  await deployStageGuards({
+    client: ctx.client,
+    clientForGdr: ctx.clientForGdr,
+    instance: materializeInstance(ctx.instance, mutation),
+    definition: ctx.definition,
+    stageId,
+    now: ctx.now
   });
 }
 async function commitTransition(ctx, action, actor) {
@@ -1330,26 +1777,29 @@ async function pickTransition(ctx, stage, action) {
     if (await ctxEvaluateFilter(ctx, candidate.filter)) return candidate;
 }
 async function evaluateAutoTransitions(args) {
-  const { client, instanceId, options, clientForGdr } = args, ctx = await loadContext(client, instanceId, clientForGdr ? { clientForGdr } : void 0);
+  const { client, instanceId, options, clientForGdr, clock, overlay } = args, ctx = await loadContext(client, instanceId, {
+    ...clientForGdr ? { clientForGdr } : {},
+    ...clock ? { clock } : {},
+    ...overlay ? { overlay } : {}
+  });
   return commitTransition(ctx, void 0, options?.actor);
 }
-async function primeInitialStage(client, instanceId, actor, clientForGdr) {
+async function primeInitialStage(client, instanceId, actor, clientForGdr, clock) {
   const instance = await client.getDocument(instanceId);
   if (!instance || instance.stages.length > 0 || instance.pendingEffects.length > 0) return;
   const definition = JSON.parse(instance.definitionSnapshot), stage = definition.stages.find((s) => s.id === instance.currentStageId);
   if (stage === void 0) return;
-  const snapshot = await hydrateSnapshot({
+  const now = (clock ?? wallClock)(), snapshot = await hydrateSnapshot({
     client,
     clientForGdr: clientForGdr ?? (() => client),
-    instance,
-    definition
+    instance
   }), tasks = [];
   for (const task of stage.tasks ?? []) {
     const inScope = await evaluateFilter({
       filter: task.filter,
       definition,
       snapshot,
-      params: buildParams(instance)
+      params: buildParams(instance, now)
     });
     tasks.push({
       _key: randomKey(),
@@ -1360,8 +1810,8 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr) {
   const initialStageEntry = {
     _key: randomKey(),
     id: stage.id,
-    enteredAt: (/* @__PURE__ */ new Date()).toISOString(),
-    state: await resolveStageStateSlots({ client, instance, stage }),
+    enteredAt: now,
+    state: await resolveStageStateSlots({ client, instance, stage, now }),
     tasks
   }, pendingEffects = [], newHistory = [...instance.history];
   for (const effect of stage.onEnter ?? []) {
@@ -1369,29 +1819,44 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr) {
       bindings: effect.bindings,
       staticInput: effect.input,
       instance,
+      now,
       ...actor !== void 0 ? { actor } : {}
     }), { pending, history } = buildQueuedEffect(
       effect,
       { kind: "stageEnter", id: stage.id },
       params,
-      actor
+      actor,
+      now
     );
     pendingEffects.push(pending), newHistory.push(history);
   }
-  await client.patch(instance._id).set({
+  const committed = await client.patch(instance._id).set({
     stages: [initialStageEntry],
     pendingEffects,
     history: newHistory,
-    lastChangedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }).ifRevisionId(instance._rev).commit(), await deployStageGuards({
+    lastChangedAt: now
+  }).ifRevisionId(instance._rev).commit();
+  await deployOrRollback({
     client,
-    clientForGdr: clientForGdr ?? (() => client),
-    instance,
-    definition,
-    stageId: stage.id
-  }), await autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr);
+    instanceId: instance._id,
+    committedRev: committed._rev,
+    restore: {
+      stages: instance.stages,
+      pendingEffects: instance.pendingEffects,
+      history: instance.history
+    },
+    reversible: !0,
+    deploy: () => deployStageGuards({
+      client,
+      clientForGdr: clientForGdr ?? (() => client),
+      instance,
+      definition,
+      stageId: stage.id,
+      now
+    })
+  }), await autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr, clock);
 }
-async function autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr) {
+async function autoActivatePrimedTasks(client, instanceId, definition, stage, actor, clientForGdr, clock) {
   const resolvedClientForGdr = clientForGdr ?? (() => client);
   for (const task of stage.tasks ?? []) {
     if (!activatesOnStageEnter(task)) continue;
@@ -1401,7 +1866,8 @@ async function autoActivatePrimedTasks(client, instanceId, definition, stage, ac
       client,
       clientForGdr: resolvedClientForGdr,
       instance: updated,
-      definition
+      definition,
+      ...clock ? { clock } : {}
     }), mutation = startMutation(updated), mutEntry = currentTasks(mutation).find((t) => t.id === task.id);
     mutEntry && mutEntry.status === "pending" && (await activateTask(updatedCtx, mutation, task, mutEntry, actor), await persist(updatedCtx, mutation));
   }
@@ -1419,8 +1885,12 @@ async function gatherAutoResolveCandidates(ctx, tasks) {
     }
   return candidates;
 }
-async function resolveCompleteWhen(client, instanceId, clientForGdr) {
-  const ctx = await loadContext(client, instanceId, clientForGdr ? { clientForGdr } : void 0), stage = findStage(ctx.definition, ctx.instance.currentStageId), tasksWithAutoPredicate = (stage.tasks ?? []).filter(
+async function resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay) {
+  const ctx = await loadContext(client, instanceId, {
+    ...clientForGdr ? { clientForGdr } : {},
+    ...clock ? { clock } : {},
+    ...overlay ? { overlay } : {}
+  }), stage = findStage(ctx.definition, ctx.instance.currentStageId), tasksWithAutoPredicate = (stage.tasks ?? []).filter(
     (t) => t.completeWhen !== void 0 || t.failWhen !== void 0
   );
   if (tasksWithAutoPredicate.length === 0) return 0;
@@ -1434,302 +1904,480 @@ async function resolveCompleteWhen(client, instanceId, clientForGdr) {
     const previousStatus = mutEntry.status, actor = {
       kind: "system",
       id: outcome === "failed" ? "engine.failWhen" : "engine.completeWhen"
-    };
-    mutEntry.status = outcome, mutEntry.completedAt = (/* @__PURE__ */ new Date()).toISOString(), mutEntry.completedBy = actor.id, mutation.history.push(
+    }, now = ctx.now;
+    mutEntry.status = outcome, mutEntry.completedAt = now, mutEntry.completedBy = actor.id, mutation.history.push(
       taskStatusChangedEntry({
         stageId: stage.id,
         taskId: task.id,
         from: previousStatus,
         to: outcome,
+        at: now,
         actor
       })
     ), count++;
   }
   return count > 0 && await persist(ctx, mutation), count;
 }
-async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr) {
+async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, clock, overlay) {
   let count = 0;
   for (; ; ) {
-    if (await resolveCompleteWhen(client, instanceId, clientForGdr), !(await evaluateAutoTransitions({
+    if (await resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay), !(await evaluateAutoTransitions({
       client,
       instanceId,
       ...actor !== void 0 ? { options: { actor } } : {},
-      ...clientForGdr ? { clientForGdr } : {}
+      ...clientForGdr ? { clientForGdr } : {},
+      ...clock ? { clock } : {},
+      ...overlay ? { overlay } : {}
     })).fired) return count;
-    if (count++, count > CASCADE_LIMIT)
-      throw new Error(
-        `Cascade did not stabilise after ${CASCADE_LIMIT} auto-transitions on ${instanceId} \u2014 possible infinite loop`
-      );
+    if (count++, count >= CASCADE_LIMIT)
+      throw new CascadeLimitError({ instanceId, limit: CASCADE_LIMIT });
   }
 }
-async function propagateToAncestors(client, instanceId, actor, clientForGdr) {
-  const instance = await client.getDocument(instanceId);
-  if (!instance || instance.ancestors.length === 0) return;
-  const parentRef = instance.ancestors[instance.ancestors.length - 1];
+async function findSatisfiedParentSpawn(client, child) {
+  const parentRef = child.ancestors.at(-1);
   if (parentRef === void 0) return;
-  const parentId = gdrToBareId(parentRef.id), parent = await client.getDocument(parentId);
-  if (!parent || parent._type !== "workflow.instance" || typeof parent.definitionSnapshot != "string")
-    return;
-  const parentDefinition = JSON.parse(parent.definitionSnapshot), parentStage = parentDefinition.stages.find((s) => s.id === parent.currentStageId);
-  if (parentStage === void 0) return;
-  const parentCurrentTasks = findCurrentTasks(parent), parentTask = (parentStage.tasks ?? []).find((t) => t.spawns === void 0 ? !1 : parentCurrentTasks.find((e) => e.id === t.id)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === instance._id) ?? !1);
-  if (parentTask === void 0) return;
-  const parentEntry = parentCurrentTasks.find((e) => e.id === parentTask.id);
-  if (parentEntry === void 0 || parentEntry.status === "done" || !await checkSpawnCompletion(client, parentEntry, parentTask.spawns)) return;
-  const ctx = await buildEngineContext({
+  const parent = await client.getDocument(gdrToBareId(parentRef.id));
+  if (!parent || parent._type !== WORKFLOW_INSTANCE_TYPE || typeof parent.definitionSnapshot != "string") return;
+  const definition = JSON.parse(parent.definitionSnapshot), stage = definition.stages.find((s) => s.id === parent.currentStageId);
+  if (stage === void 0) return;
+  const parentCurrentTasks = findCurrentTasks(parent), task = (stage.tasks ?? []).find((t) => t.spawns === void 0 ? !1 : parentCurrentTasks.find((e) => e.id === t.id)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
+  if (task?.spawns === void 0) return;
+  const entry = parentCurrentTasks.find((e) => e.id === task.id);
+  if (!(entry === void 0 || entry.status === "done") && await checkSpawnCompletion(client, entry, task.spawns))
+    return { parent, definition, stage, task };
+}
+async function propagateToAncestors(client, instanceId, actor, clientForGdr, clock) {
+  const instance = await client.getDocument(instanceId);
+  if (!instance) return;
+  const found = await findSatisfiedParentSpawn(client, instance);
+  if (found === void 0) return;
+  const { parent, definition, stage, task } = found, ctx = await buildEngineContext({
     client,
     clientForGdr: clientForGdr ?? (() => client),
     instance: parent,
-    definition: parentDefinition
-  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.id === parentTask.id);
+    definition,
+    ...clock ? { clock } : {}
+  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.id === task.id);
   if (mutEntry === void 0) return;
-  const previousStatus = mutEntry.status;
-  mutEntry.status = "done", mutEntry.completedAt = (/* @__PURE__ */ new Date()).toISOString(), mutation.history.push(
+  const previousStatus = mutEntry.status, now = ctx.now;
+  mutEntry.status = "done", mutEntry.completedAt = now, mutation.history.push(
     taskStatusChangedEntry({
-      stageId: parentStage.id,
-      taskId: parentTask.id,
+      stageId: stage.id,
+      taskId: task.id,
       from: previousStatus,
       to: "done",
+      at: now,
       ...actor !== void 0 ? { actor } : {}
     })
-  ), await persist(ctx, mutation), await cascadeAutoTransitions(client, parentId, actor, clientForGdr), await propagateToAncestors(client, parentId, actor, clientForGdr);
-}
-function startMutation(instance) {
-  return {
-    currentStageId: instance.currentStageId,
-    // Deep-ish copy. Per-scope state slot arrays need their own copies
-    // so ops can mutate without leaking into the source.
-    state: (instance.state ?? []).map((s) => ({ ...s })),
-    stages: instance.stages.map((s) => ({
-      ...s,
-      state: (s.state ?? []).map((slot) => ({ ...slot })),
-      tasks: s.tasks.map((t) => ({
-        ...t,
-        ...t.state !== void 0 ? { state: t.state.map((slot) => ({ ...slot })) } : {}
-      }))
-    })),
-    pendingEffects: [...instance.pendingEffects],
-    effectHistory: [...instance.effectHistory],
-    effectsContext: [...instance.effectsContext],
-    history: [...instance.history],
-    lastChangedAt: instance.lastChangedAt,
-    ...instance.completedAt !== void 0 ? { completedAt: instance.completedAt } : {},
-    pendingCreates: []
-  };
+  ), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock);
 }
-function taskStatusChangedEntry(args) {
-  return {
-    _key: randomKey(),
-    _type: "workflow.history.taskStatusChanged",
-    at: args.at ?? (/* @__PURE__ */ new Date()).toISOString(),
-    stageId: args.stageId,
-    taskId: args.taskId,
-    from: args.from,
-    to: args.to,
-    ...args.actor !== void 0 ? { actor: args.actor } : {}
-  };
-}
-function stageTransitionHistory(args) {
-  const { fromStageId, toStageId, at, transitionId, actor, via, reason } = args, shared = {
-    at,
-    ...transitionId !== void 0 ? { transitionId } : {},
-    ...actor !== void 0 ? { actor } : {},
-    ...via !== void 0 ? { via } : {},
-    ...reason !== void 0 ? { reason } : {}
-  };
-  return [
-    {
-      _key: randomKey(),
-      _type: "workflow.history.stageExited",
-      stageId: fromStageId,
-      toStageId,
-      ...shared
-    },
-    {
-      _key: randomKey(),
-      _type: "workflow.history.transitionFired",
-      fromStageId,
-      toStageId,
-      ...shared
-    },
-    {
-      _key: randomKey(),
-      _type: "workflow.history.stageEntered",
-      stageId: toStageId,
-      fromStageId,
-      ...shared
-    }
-  ];
-}
-async function persist(ctx, mutation) {
-  const set = {
-    currentStageId: mutation.currentStageId,
-    state: mutation.state,
-    stages: mutation.stages,
-    pendingEffects: mutation.pendingEffects,
-    effectHistory: mutation.effectHistory,
-    effectsContext: mutation.effectsContext,
-    history: mutation.history,
-    lastChangedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  mutation.completedAt !== void 0 && (set.completedAt = mutation.completedAt);
-  const pendingCreates = mutation.pendingCreates;
-  if (pendingCreates.length === 0)
-    return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit();
-  const tx = ctx.client.transaction();
-  for (const body of pendingCreates) tx.create(body);
-  tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), await tx.commit(), mutation.pendingCreates = [];
-  const actorForPriming = void 0;
-  for (const body of pendingCreates)
-    await primeInitialStage(ctx.client, body._id, actorForPriming, ctx.clientForGdr), await cascadeAutoTransitions(ctx.client, body._id, actorForPriming, ctx.clientForGdr), await propagateToAncestors(ctx.client, body._id, actorForPriming, ctx.clientForGdr);
-  const reloaded = await ctx.client.getDocument(ctx.instance._id);
-  if (!reloaded)
-    throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
-  return reloaded;
-}
-function findOpenStageEntry(host) {
-  return host.stages.find((s) => s.id === host.currentStageId && s.exitedAt === void 0);
+const parsedFilters = /* @__PURE__ */ new Map();
+async function matchesFilter(args) {
+  const { document, filter, userId } = args;
+  parsedFilters.has(filter) || parsedFilters.set(filter, parse(`*[${filter}]`));
+  const ast = parsedFilters.get(filter), data = await (await evaluate(ast, {
+    dataset: [document],
+    ...userId !== void 0 ? { identity: userId } : {}
+  })).get();
+  return Array.isArray(data) && data.length === 1;
 }
-function currentStageEntry(mutation) {
-  const entry = findOpenStageEntry(mutation);
-  if (entry === void 0)
-    throw new Error(
-      `Mutation invariant broken: no current (un-exited) StageEntry for currentStageId "${mutation.currentStageId}"`
-    );
-  return entry;
+async function grantsPermissionOn(args) {
+  const { document, grants, permission, userId } = args;
+  if (!document || grants.length === 0) return !1;
+  for (const grant of grants)
+    if (grant.permissions.includes(permission) && await matchesFilter({
+      document,
+      filter: grant.filter,
+      ...userId !== void 0 ? { userId } : {}
+    }))
+      return !0;
+  return !1;
 }
-function currentTasks(mutation) {
-  return currentStageEntry(mutation).tasks;
+async function fetchGrants(args) {
+  const { client, resourcePath, signal } = args;
+  return client.request({ url: resourcePath, ...signal ? { signal } : {} });
 }
-function findTaskInCurrentStage(ctx, taskId) {
-  const stage = findStage(ctx.definition, ctx.instance.currentStageId), task = (stage.tasks ?? []).find((t) => t.id === taskId);
-  if (task === void 0)
+const actorCache = /* @__PURE__ */ new WeakMap(), grantsCache = /* @__PURE__ */ new WeakMap();
+async function resolveAccess(client, args = {}) {
+  const overrideActor = args.override?.actor, overrideGrants = args.override?.grants;
+  if (overrideActor !== void 0 && overrideGrants !== void 0)
+    return { actor: overrideActor, grants: overrideGrants };
+  const requestFn = client.request === void 0 ? void 0 : (opts) => client.request(opts);
+  if (requestFn === void 0) {
+    if (overrideActor === void 0)
+      throw new Error(
+        "workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ url: '/users/me' })`. Supply a real `@sanity/client` configured with a token, or pass an explicit `access.actor` override (the test bench provides one by default)."
+      );
+    return { actor: overrideActor };
+  }
+  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = resolveGrants(overrideGrants, args.grantsFromPath, client, requestFn), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
+  if (actor === void 0)
     throw new Error(
-      `Task "${taskId}" not found in current stage "${stage.id}" of ${ctx.definition.workflowId}`
+      "workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity \u2014 check the token, or pass `access.actor` explicitly."
     );
-  return { stage, task };
-}
-function requireMutationTaskEntry(mutation, taskId) {
-  const mutEntry = currentTasks(mutation).find((t) => t.id === taskId);
-  if (mutEntry === void 0)
-    throw new Error(`Task "${taskId}" disappeared from mutation copy \u2014 invariant broken`);
-  return mutEntry;
+  return { actor, ...grants !== void 0 ? { grants } : {} };
 }
-function findCurrentStageEntry(instance) {
-  return findOpenStageEntry(instance);
+function cachedActor(client, requestFn) {
+  const cached = actorCache.get(client);
+  if (cached !== void 0) return cached;
+  const pending = fetchActor(requestFn).catch((err) => {
+    throw actorCache.get(client) === pending && actorCache.delete(client), err;
+  });
+  return actorCache.set(client, pending), pending;
 }
-function findCurrentTasks(instance) {
-  return findCurrentStageEntry(instance)?.tasks ?? [];
+function resolveGrants(overrideGrants, grantsFromPath, client, requestFn) {
+  return overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : grantsFromPath !== void 0 ? cachedGrants(client, requestFn, grantsFromPath) : Promise.resolve(void 0);
 }
-async function completeEffect(args) {
-  const { client, instanceId, effectKey, status, outputs, detail, error, durationMs, options } = args, ctx = await loadContext(client, instanceId);
-  return commitCompleteEffect(
-    ctx,
-    effectKey,
-    status,
-    outputs,
-    detail,
-    error,
-    durationMs,
-    options?.actor
-  );
+function cachedGrants(client, requestFn, resourcePath) {
+  let byPath = grantsCache.get(client);
+  byPath === void 0 && (byPath = /* @__PURE__ */ new Map(), grantsCache.set(client, byPath));
+  let cached = byPath.get(resourcePath);
+  return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), byPath.set(resourcePath, cached)), cached;
 }
-function buildEffectHistoryEntry(pending, outcome) {
-  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome;
+async function fetchActor(requestFn) {
+  let user;
+  try {
+    user = await requestFn({
+      uri: "/users/me",
+      tag: "workflow.access.resolve-actor"
+    });
+  } catch (err) {
+    throw new Error(
+      'workflow: /users/me request failed. The engine resolves the actor from the client\'s token via `client.request({ uri: "/users/me" })`. Check the token/connectivity, or pass an explicit `access.actor` override.',
+      { cause: err }
+    );
+  }
+  if (!user || typeof user.id != "string" || user.id.length === 0) return;
+  const roleNames = user.roles?.map((r) => r.name).filter((n) => !!n) ?? [];
   return {
-    _key: pending._key,
-    effectId: pending.effectId,
-    ...pending.title !== void 0 ? { title: pending.title } : {},
-    ...pending.description !== void 0 ? { description: pending.description } : {},
-    params: pending.params,
-    origin: pending.origin,
-    ...actor !== void 0 ? { actor } : pending.actor !== void 0 ? { actor: pending.actor } : {},
-    ranAt,
-    ...durationMs !== void 0 ? { durationMs } : {},
-    status,
-    ...detail !== void 0 ? { detail } : {},
-    ...error !== void 0 ? { error } : {},
-    ...outputs !== void 0 ? { outputs } : {}
+    kind: "user",
+    id: user.id,
+    ...roleNames.length > 0 ? { roles: roleNames } : {}
   };
 }
-function upsertEffectsContext(mutation, outputs) {
-  for (const [id, value] of Object.entries(outputs)) {
-    const existingIndex = mutation.effectsContext.findIndex((e) => e.id === id), entry = effectsContextEntry(id, value);
-    existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
+async function fetchGrantsCached(requestFn, resourcePath) {
+  try {
+    return await fetchGrants({ client: { request: requestFn }, resourcePath });
+  } catch (err) {
+    console.warn(
+      `workflow: failed to fetch grants from "${resourcePath}"; skipping permission gate. Original error: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return;
   }
 }
-async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
-  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
-  if (pending === void 0)
-    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
-  const mutation = startMutation(ctx.instance);
-  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
-  const ranAt = (/* @__PURE__ */ new Date()).toISOString();
-  return mutation.effectHistory.push(
-    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
-  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, outputs), mutation.history.push({
-    _key: randomKey(),
-    _type: "workflow.history.effectCompleted",
-    at: ranAt,
-    effectKey,
-    effectId: pending.effectId,
-    status,
-    ...outputs !== void 0 ? { outputs } : {},
-    ...detail !== void 0 ? { detail } : {},
-    ...actor !== void 0 ? { actor } : {}
-  }), await persist(ctx, mutation), { effectKey, status };
-}
-function buildQueuedEffect(effect, origin, params, actor) {
-  const key = randomKey(), pending = {
-    _key: key,
-    _type: "workflow.pendingEffect",
-    effectId: effect.id,
-    ...effect.title !== void 0 ? { title: effect.title } : {},
-    ...effect.description !== void 0 ? { description: effect.description } : {},
-    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
-    params,
-    origin,
-    ...actor !== void 0 ? { actor } : {},
-    queuedAt: (/* @__PURE__ */ new Date()).toISOString()
-  }, history = {
-    _key: randomKey(),
-    _type: "workflow.history.effectQueued",
-    at: (/* @__PURE__ */ new Date()).toISOString(),
-    effectKey: key,
-    effectId: effect.id,
-    origin
-  };
-  return { pending, history };
+const WILDCARD_ROLE = "*";
+async function evaluateInstance(args) {
+  const { client, tags, instanceId, resourceClients } = args, now = (args.clock ?? wallClock)();
+  validateTags(tags);
+  const { actor, grants } = await resolveAccess(client, {
+    ...args.access !== void 0 ? { override: args.access } : {},
+    ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
+  }), instance = await client.getDocument(instanceId);
+  if (!instance)
+    throw new Error(`Workflow instance "${instanceId}" not found`);
+  if (!tags.some((t) => instance.tags?.includes(t)))
+    throw new Error(`Workflow instance "${instanceId}" not visible to this engine (tag mismatch)`);
+  const definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance });
+  return evaluateFromSnapshot({
+    instance,
+    definition,
+    actor,
+    snapshot,
+    now,
+    ...grants !== void 0 ? { grants } : {}
+  });
 }
-async function queueEffects(ctx, mutation, effects, origin, actor, callerParams) {
-  if (!effects) return;
-  const liveInstance = {
-    ...ctx.instance,
-    state: mutation.state,
-    stages: mutation.stages,
-    effectsContext: mutation.effectsContext
-  };
-  for (const effect of effects) {
-    const params = await resolveBindings({
-      bindings: effect.bindings,
-      staticInput: effect.input,
-      instance: liveInstance,
-      ...callerParams !== void 0 ? { params: callerParams } : {},
-      ...actor !== void 0 ? { actor } : {}
-    }), { pending, history } = buildQueuedEffect(effect, origin, params, actor);
-    mutation.pendingEffects.push(pending), mutation.history.push(history);
+async function evaluateFromSnapshot(args) {
+  const { instance, definition, actor, grants, snapshot } = args, now = args.now ?? wallClock(), stage = definition.stages.find((s) => s.id === instance.currentStageId);
+  if (stage === void 0)
+    throw new Error(
+      `Instance "${instance._id}" currentStageId "${instance.currentStageId}" not in definition`
+    );
+  const currentTaskEntries = findOpenStageEntry(instance)?.tasks ?? [], taskEvaluations = [];
+  for (const task of stage.tasks ?? [])
+    taskEvaluations.push(
+      await evaluateTask({
+        task,
+        statusEntry: currentTaskEntries.find((t) => t.id === task.id),
+        instance,
+        definition,
+        actor,
+        grants,
+        snapshot,
+        now
+      })
+    );
+  const transitionEvaluations = [];
+  for (const transition of stage.transitions ?? [])
+    transitionEvaluations.push({
+      transition,
+      filterSatisfied: await evaluateFilter({
+        filter: transition.filter,
+        definition,
+        snapshot,
+        params: buildParams(instance, now)
+      })
+    });
+  const currentStage = {
+    stage,
+    tasks: taskEvaluations,
+    transitions: transitionEvaluations
+  }, pendingOnYou = taskEvaluations.filter((t) => t.pendingOnActor), canInteract = taskEvaluations.some((t) => t.actions.some((a) => a.allowed));
+  return {
+    instance,
+    definition,
+    actor,
+    currentStage,
+    pendingOnYou,
+    canInteract
+  };
+}
+async function evaluateTask(args) {
+  const { task, statusEntry, instance, definition, actor, grants, snapshot, now } = args, status = statusEntry?.status ?? "pending", actions = [];
+  for (const action of task.actions ?? [])
+    actions.push(
+      await evaluateAction({
+        action,
+        task,
+        ...statusEntry !== void 0 ? { statusEntry } : {},
+        status,
+        instance,
+        definition,
+        actor,
+        ...grants !== void 0 ? { grants } : {},
+        snapshot,
+        now
+      })
+    );
+  return {
+    task,
+    status,
+    // "pending on actor" treats both `pending` and `active` as waiting on
+    // the assignee — pending tasks just haven't been auto-invoked yet, but
+    // they're still inbox items.
+    pendingOnActor: (status === "active" || status === "pending") && actorIsAssignee(actor, task.assignees ?? []),
+    actions
+  };
+}
+async function evaluateAction(args) {
+  const { action, task, status, instance, definition, actor, grants, snapshot, now } = args, syncReason = lifecycleReason(instance, definition, status) ?? actorReason(action, task, actor);
+  if (syncReason !== void 0) return disabled(action, syncReason);
+  const asyncReason = await permissionReason(action, instance, actor, grants) ?? await filterReason(action, instance, definition, snapshot, now);
+  return asyncReason !== void 0 ? disabled(action, asyncReason) : { action, allowed: !0 };
+}
+function lifecycleReason(instance, definition, status) {
+  if (instance.completedAt !== void 0)
+    return { kind: "instance-completed", completedAt: instance.completedAt };
+  if (definition.stages.find((s) => s.id === instance.currentStageId)?.kind === "terminal")
+    return { kind: "stage-terminal", stageId: instance.currentStageId };
+  if (status === "done" || status === "skipped" || status === "failed")
+    return { kind: "task-not-active", status };
+}
+function actorReason(action, task, actor) {
+  const actorRoles = actor.roles ?? [];
+  if (action.roles !== void 0 && action.roles.length > 0 && !(actorRoles.includes(WILDCARD_ROLE) || action.roles.some((r) => actorRoles.includes(r))))
+    return { kind: "role-required", required: [...action.roles], actorRoles: [...actorRoles] };
+  if (action.requireAssignment === !0 && !actorIsAssignee(actor, task.assignees ?? []))
+    return { kind: "not-assigned", assignees: [...task.assignees ?? []], actorId: actor.id };
+}
+async function permissionReason(action, instance, actor, grants) {
+  if (grants === void 0) return;
+  const permission = action.requiredPermission ?? "update";
+  if (!await grantsPermissionOn({
+    document: instance,
+    grants,
+    permission,
+    userId: actor.id
+  }))
+    return { kind: "permission-denied", permission, matchingGrants: grants.length };
+}
+async function filterReason(action, instance, definition, snapshot, now) {
+  if (!(action.filter === void 0 || await evaluateFilter({
+    filter: action.filter,
+    definition,
+    snapshot,
+    params: buildParams(instance, now)
+  })))
+    return { kind: "filter-failed", filter: action.filter };
+}
+function disabled(action, reason) {
+  return { action, allowed: !1, disabledReason: reason };
+}
+function actorIsAssignee(actor, assignees) {
+  if (assignees.length === 0) return !1;
+  const actorRoles = actor.roles ?? [], wildcard = actorRoles.includes(WILDCARD_ROLE);
+  for (const assignee of assignees)
+    if (assignee.kind === "user" && assignee.id === actor.id || assignee.kind === "role" && (wildcard || actorRoles.includes(assignee.role)))
+      return !0;
+  return !1;
+}
+function parseDefinitionSnapshot(instance) {
+  try {
+    return JSON.parse(instance.definitionSnapshot);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse definitionSnapshot on instance "${instance._id}": ${err instanceof Error ? err.message : String(err)}`,
+      { cause: err }
+    );
   }
 }
-class ActionParamsInvalidError extends Error {
-  action;
-  taskId;
-  issues;
-  constructor(args) {
-    const lines = args.issues.map((i) => `  - ${i.paramId}: ${i.reason}`).join(`
-`);
-    super(`Action "${args.action}" on task "${args.taskId}" rejected: invalid params
-${lines}`), this.name = "ActionParamsInvalidError", this.action = args.action, this.taskId = args.taskId, this.issues = args.issues;
+const resourceKey = (r) => `${r.type}.${r.id}`;
+function guardsForResource(client) {
+  return client.fetch("*[_type == $t] | order(_id asc)", { t: GUARD_DOC_TYPE });
+}
+async function guardsForInstance(args) {
+  const { client, clientForGdr, instance } = args, clientsByResource = /* @__PURE__ */ new Map([
+    [resourceKey(instance.workflowResource), client]
+  ]), stateUris = [
+    ...collectSlotDocUris(instance.state),
+    ...instance.stages.flatMap((stage) => collectSlotDocUris(stage.state))
+  ];
+  for (const uri of stateUris) {
+    const parsed = tryParseGdr(uri);
+    if (parsed === void 0) continue;
+    const key = resourceKey(resourceFromParsed(parsed));
+    clientsByResource.has(key) || clientsByResource.set(key, clientForGdr(parsed));
+  }
+  const perResource = await Promise.all(
+    [...clientsByResource.values()].map(
+      (c) => c.fetch("*[_type == $t && sourceInstanceId == $id]", {
+        t: GUARD_DOC_TYPE,
+        id: instance._id
+      })
+    )
+  );
+  return dedupById(perResource.flat());
+}
+function tryParseGdr(uri) {
+  try {
+    return parseGdr(uri);
+  } catch {
+    return;
+  }
+}
+function dedupById(guards) {
+  return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
+}
+function definitionDocId(_workflowResource, prefix, workflowId, version) {
+  return `${prefix}.${workflowId}.v${version}`;
+}
+async function sortByDependencies(client, definitions, tags, workflowResource) {
+  const prefix = canonicalTag(tags), byWorkflowId = /* @__PURE__ */ new Map();
+  for (const def of definitions) {
+    const list = byWorkflowId.get(def.workflowId) ?? [];
+    list.push(def), byWorkflowId.set(def.workflowId, list);
+  }
+  const findInBatch = (ref) => findRefInBatch(byWorkflowId, ref);
+  return await assertCrossBatchRefsDeployed(client, definitions, {
+    tags,
+    workflowResource,
+    prefix,
+    findInBatch
+  }), topoSortDefinitions(definitions, { workflowResource, prefix, findInBatch });
+}
+function findRefInBatch(byWorkflowId, ref) {
+  const candidates = byWorkflowId.get(ref.workflowId);
+  if (!(candidates === void 0 || candidates.length === 0))
+    return typeof ref.version == "number" ? candidates.find((c) => c.version === ref.version) : candidates.reduce(
+      (best, c) => best === void 0 || c.version > best.version ? c : best,
+      void 0
+    );
+}
+async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
+  const missing = [];
+  for (const def of definitions) {
+    const fromId = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
+    for (const ref of refsOf(def)) {
+      if (ctx.findInBatch(ref) !== void 0) continue;
+      const label = await resolveDeployedRefLabel(client, ref, ctx.tags);
+      label !== void 0 && missing.push({ from: fromId, ref: label });
+    }
+  }
+  if (missing.length === 0) return;
+  const lines = missing.map((m) => `  - ${m.from} \u2192 ${m.ref} (neither in batch nor deployed)`);
+  throw new Error(
+    `workflow.deployDefinitions: ${missing.length} unresolved reference${missing.length === 1 ? "" : "s"}:
+` + lines.join(`
+`)
+  );
+}
+async function resolveDeployedRefLabel(client, ref, tags) {
+  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, engineTags: tags };
+  if (wantsExplicit && (params.version = ref.version), !await client.fetch(
+    definitionLookupGroq(wantsExplicit),
+    params
+  ))
+    return wantsExplicit ? `${ref.workflowId} v${ref.version}` : ref.workflowId;
+}
+function topoSortDefinitions(definitions, ctx) {
+  const visited = /* @__PURE__ */ new Set(), visiting = /* @__PURE__ */ new Set(), ordered = [], visit = (def) => {
+    const id = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
+    if (!visited.has(id)) {
+      if (visiting.has(id))
+        throw new Error(`workflow.deployDefinitions: dependency cycle involving "${id}"`);
+      visiting.add(id);
+      for (const ref of refsOf(def)) {
+        const child = ctx.findInBatch(ref);
+        child !== void 0 && visit(child);
+      }
+      visiting.delete(id), visited.add(id), ordered.push(def);
+    }
+  };
+  for (const def of definitions) visit(def);
+  return ordered;
+}
+function refsOf(def) {
+  const out = [];
+  for (const stage of def.stages)
+    for (const task of stage.tasks ?? []) {
+      const ref = task.spawns?.definitionRef;
+      ref !== void 0 && out.push({
+        workflowId: ref.workflowId,
+        ...ref.version !== void 0 ? { version: ref.version } : {}
+      });
+    }
+  return out;
+}
+function isDefinitionUnchanged(existing, expected) {
+  return stableStringify(stripSystemFields(existing)) === stableStringify(stripSystemFields(expected));
+}
+function stripSystemFields(doc) {
+  const out = {};
+  for (const [k, v2] of Object.entries(doc))
+    k === "_rev" || k === "_createdAt" || k === "_updatedAt" || (out[k] = v2);
+  return out;
+}
+function stableStringify(value) {
+  return value === null || typeof value != "object" ? JSON.stringify(value) : Array.isArray(value) ? `[${value.map(stableStringify).join(",")}]` : `{${Object.entries(value).toSorted(
+    ([a], [b]) => a.localeCompare(b)
+  ).map(([k, v2]) => `${JSON.stringify(k)}:${stableStringify(v2)}`).join(",")}}`;
+}
+async function loadDefinition(client, workflowId, version, tags) {
+  if (version !== void 0) {
+    const doc = await client.fetch(
+      definitionLookupGroq(!0),
+      { workflowId, version, engineTags: tags }
+    );
+    if (!doc)
+      throw new Error(`Workflow definition ${workflowId} v${version} not deployed`);
+    return doc;
   }
+  const latest = await client.fetch(definitionLookupGroq(!1), {
+    workflowId,
+    engineTags: tags
+  });
+  if (!latest)
+    throw new Error(`No deployed definition for workflow ${workflowId}`);
+  return latest;
+}
+const STATE_OP_TYPES = [
+  "workflow.op.state.set",
+  "workflow.op.state.append",
+  "workflow.op.state.updateWhere",
+  "workflow.op.state.removeWhere"
+];
+function isStateOp(summary) {
+  return STATE_OP_TYPES.includes(summary.opType);
 }
 function validateActionParams(action, taskId, callerParams) {
   const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
@@ -1766,7 +2414,7 @@ function checkParamType(value, decl) {
     case "doc.ref":
       return hasStringField(value, "id");
     case "doc.refs":
-      return Array.isArray(value) && value.every((v) => checkParamType(v, { paramType: "doc.ref" }));
+      return Array.isArray(value) && value.every((v2) => checkParamType(v2, { paramType: "doc.ref" }));
     case "json":
       return !0;
     default:
@@ -1774,15 +2422,15 @@ function checkParamType(value, decl) {
   }
 }
 async function runActionOps(args) {
-  const { ops, mutation, stageId, taskId, actionName, params, actor } = args;
+  const { ops, mutation, stageId, taskId, actionName, params, actor, self, now } = args;
   if (ops === void 0 || ops.length === 0) return [];
   const summaries = [];
   for (const op of ops) {
-    const summary = applyOp(op, { mutation, stageId, taskId, params, actor });
+    const summary = applyOp(op, { mutation, stageId, taskId, params, actor, self, now });
     summaries.push(summary), mutation.history.push({
       _key: randomKey(),
       _type: "workflow.history.opApplied",
-      at: (/* @__PURE__ */ new Date()).toISOString(),
+      at: now,
       stageId,
       taskId,
       actionId: actionName,
@@ -1841,8 +2489,8 @@ function applyStateUpdateWhere(op, ctx) {
     /*createIfMissing*/
     !1
   ), resolvedMerge = {};
-  for (const [k, v] of Object.entries(op.merge))
-    resolvedMerge[k] = resolveOpSource(v, ctx);
+  for (const [k, v2] of Object.entries(op.merge))
+    resolvedMerge[k] = resolveOpSource(v2, ctx);
   return slot !== void 0 && Array.isArray(slot.value) && (slot.value = slot.value.map(
     (row) => evalOpPredicate(op.where, row, ctx) ? { ...row, ...resolvedMerge } : row
   )), { opType: op.type, target: op.target, resolved: { merge: resolvedMerge } };
@@ -1885,18 +2533,11 @@ function locateSlot(ctx, target, createIfMissing) {
   }, host.push(slot)), slot;
 }
 function resolveOpSource(src, ctx) {
+  const staticValue = resolveStaticSource(src, ctx);
+  if (staticValue.handled) return staticValue.value;
   switch (src.source) {
-    case "literal":
-      return src.value;
-    case "param":
-      return ctx.params[src.paramId];
-    case "actor":
-      return ctx.actor;
-    case "now":
-      return (/* @__PURE__ */ new Date()).toISOString();
     case "self":
-      return;
-    // Not applicable inside ops; reserved for higher-level binding.
+      return ctx.self;
     case "stageId":
       return ctx.stageId;
     case "stateRead": {
@@ -1906,8 +2547,8 @@ function resolveOpSource(src, ctx) {
     case "effectOutput": {
       const entry = ctx.mutation.effectsContext.find((e) => e.id === src.contextId);
       if (entry === void 0) return null;
-      const v = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
-      return v === void 0 ? null : v;
+      const v2 = src.path !== void 0 ? getPath(entry.value, src.path) : entry.value;
+      return v2 === void 0 ? null : v2;
     }
     case "object": {
       const out = {};
@@ -1915,6 +2556,11 @@ function resolveOpSource(src, ctx) {
         out[field] = resolveOpSource(fieldSrc, ctx);
       return out;
     }
+    case "row":
+    case "parentState":
+      return;
+    default:
+      return;
   }
 }
 function slotValue(slots, slotId) {
@@ -1933,333 +2579,101 @@ function evalOpPredicate(p, row, ctx) {
   const target = resolveOpSource(p.equals, ctx);
   return row[p.field] === target;
 }
-async function fireAction(args) {
-  const { client, instanceId, taskId, action, params, options } = args, ctx = await loadContext(client, instanceId);
-  return commitAction(ctx, taskId, action, params, options?.actor);
-}
-async function resolveActionCommit(ctx, taskId, actionName, callerParams) {
-  const { stage, task } = findTaskInCurrentStage(ctx, taskId), action = (task.actions ?? []).find((a) => a.id === actionName);
-  if (action === void 0)
-    throw new Error(`Action "${actionName}" not declared on task "${taskId}"`);
-  if (!await ctxEvaluateFilter(ctx, action.filter))
-    throw new Error(`Action "${actionName}" filter rejected on task "${taskId}"`);
-  const entry = findCurrentTasks(ctx.instance).find((t) => t.id === taskId);
-  if (entry === void 0 || entry.status !== "active")
-    throw new Error(
-      `Task "${taskId}" must be active to fire action "${actionName}"; status is ${entry?.status ?? "missing"}`
-    );
-  const params = validateActionParams(action, taskId, callerParams);
-  return { stage, task, action, params };
-}
-function applyActionSetStatus(action, mutation, mutEntry, stageId, taskId, actor) {
-  if (action.setStatus === void 0) return;
-  const initialStatus = mutEntry.status, newStatus = action.setStatus;
-  return mutEntry.status = newStatus, mutEntry.completedAt = (/* @__PURE__ */ new Date()).toISOString(), actor && (mutEntry.completedBy = actor.id), mutation.history.push(
-    taskStatusChangedEntry({
-      stageId,
-      taskId,
-      from: initialStatus,
-      to: newStatus,
-      ...actor !== void 0 ? { actor } : {}
-    })
-  ), newStatus;
-}
-async function commitAction(ctx, taskId, actionName, callerParams, actor) {
-  const { stage, task, action, params } = await resolveActionCommit(
-    ctx,
-    taskId,
-    actionName,
-    callerParams
-  ), mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskId);
-  mutation.history.push({
-    _key: randomKey(),
-    _type: "workflow.history.actionFired",
-    at: (/* @__PURE__ */ new Date()).toISOString(),
-    stageId: stage.id,
-    taskId,
-    actionId: actionName,
-    ...actor !== void 0 ? { actor } : {}
-  });
-  const ranOps = await runActionOps({
-    ops: action.ops,
-    mutation,
-    stageId: stage.id,
-    taskId,
-    actionName,
-    params,
-    actor
-  }), newStatus = applyActionSetStatus(action, mutation, mutEntry, stage.id, taskId, actor);
-  return await queueEffects(
-    ctx,
-    mutation,
-    action.effects,
-    {
-      kind: "action",
-      id: `${task.id}:${actionName}`
-    },
-    actor,
-    params
-  ), await persist(ctx, mutation), {
-    fired: !0,
-    taskId,
-    action: actionName,
-    ...newStatus !== void 0 ? { newStatus } : {},
-    ...ranOps.length > 0 ? { ranOps } : {}
-  };
-}
-const parsedFilters = /* @__PURE__ */ new Map();
-async function matchesFilter(args) {
-  const { document, filter, userId } = args;
-  parsedFilters.has(filter) || parsedFilters.set(filter, parse(`*[${filter}]`));
-  const ast = parsedFilters.get(filter), data = await (await evaluate(ast, {
-    dataset: [document],
-    ...userId !== void 0 ? { identity: userId } : {}
-  })).get();
-  return Array.isArray(data) && data.length === 1;
-}
-async function grantsPermissionOn(args) {
-  const { document, grants, permission, userId } = args;
-  if (!document || grants.length === 0) return !1;
-  for (const grant of grants)
-    if (grant.permissions.includes(permission) && await matchesFilter({
-      document,
-      filter: grant.filter,
-      ...userId !== void 0 ? { userId } : {}
-    }))
-      return !0;
-  return !1;
-}
-async function fetchGrants(args) {
-  const { client, resourcePath, signal } = args;
-  return client.request({ url: resourcePath, ...signal ? { signal } : {} });
-}
-const actorCache = /* @__PURE__ */ new WeakMap(), grantsCache = /* @__PURE__ */ new WeakMap();
-async function resolveAccess(client, args = {}) {
-  const overrideActor = args.override?.actor, overrideGrants = args.override?.grants;
-  if (overrideActor !== void 0 && overrideGrants !== void 0)
-    return { actor: overrideActor, grants: overrideGrants };
-  const requestFn = client.request;
-  if (requestFn === void 0) {
-    if (overrideActor === void 0)
-      throw new Error(
-        "workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ url: '/users/me' })`. Supply a real `@sanity/client` configured with a token, or pass an explicit `access.actor` override (the test bench provides one by default)."
-      );
-    return { actor: overrideActor };
-  }
-  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : args.grantsFromPath !== void 0 ? cachedGrants(client, requestFn, args.grantsFromPath) : Promise.resolve(void 0), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
-  if (actor === void 0)
-    throw new Error(
-      "workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity \u2014 check the token, or pass `access.actor` explicitly."
-    );
-  return { actor, ...grants !== void 0 ? { grants } : {} };
-}
-function cachedActor(client, requestFn) {
-  const cached = actorCache.get(client);
-  if (cached !== void 0) return cached;
-  const pending = fetchActor(requestFn).catch((err) => {
-    throw actorCache.get(client) === pending && actorCache.delete(client), err;
-  });
-  return actorCache.set(client, pending), pending;
-}
-function cachedGrants(client, requestFn, resourcePath) {
-  let byPath = grantsCache.get(client);
-  byPath === void 0 && (byPath = /* @__PURE__ */ new Map(), grantsCache.set(client, byPath));
-  let cached = byPath.get(resourcePath);
-  return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), byPath.set(resourcePath, cached)), cached;
-}
-async function fetchActor(requestFn) {
-  let user;
-  try {
-    user = await requestFn({
-      uri: "/users/me",
-      tag: "workflow.access.resolve-actor"
-    });
-  } catch (err) {
-    throw new Error(
-      'workflow: /users/me request failed. The engine resolves the actor from the client\'s token via `client.request({ uri: "/users/me" })`. Check the token/connectivity, or pass an explicit `access.actor` override.',
-      { cause: err }
-    );
-  }
-  if (!user || typeof user.id != "string" || user.id.length === 0) return;
-  const roleNames = user.roles?.map((r) => r.name).filter((n) => !!n) ?? [];
-  return {
-    kind: "user",
-    id: user.id,
-    ...roleNames.length > 0 ? { roles: roleNames } : {}
-  };
-}
-async function fetchGrantsCached(requestFn, resourcePath) {
-  try {
-    return await fetchGrants({ client: { request: requestFn }, resourcePath });
-  } catch (err) {
-    console.warn(
-      `workflow: failed to fetch grants from "${resourcePath}"; skipping permission gate. Original error: ${err instanceof Error ? err.message : String(err)}`
-    );
-    return;
-  }
-}
-const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
-function validateTags(tags) {
-  if (tags.length === 0)
-    throw new Error("tags: must be a non-empty array");
-  for (const tag of tags)
-    if (!TAG_RE.test(tag))
-      throw new Error(
-        `tags: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
-      );
-}
-function canonicalTag(tags) {
-  return tags[0];
-}
-const WILDCARD_ROLE = "*";
-async function evaluateInstance(args) {
-  const { client, tags, instanceId, resourceClients } = args;
-  validateTags(tags);
-  const { actor, grants } = await resolveAccess(client, {
-    ...args.access !== void 0 ? { override: args.access } : {},
-    ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
-  }), instance = await client.getDocument(instanceId);
-  if (!instance)
-    throw new Error(`Workflow instance "${instanceId}" not found`);
-  if (!tags.some((t) => instance.tags?.includes(t)))
-    throw new Error(`Workflow instance "${instanceId}" not visible to this engine (tag mismatch)`);
-  const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find((s) => s.id === instance.currentStageId);
-  if (stage === void 0)
-    throw new Error(
-      `Instance "${instanceId}" currentStageId "${instance.currentStageId}" not in definition`
-    );
-  const snapshot = await hydrateSnapshot({
-    client,
-    clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client,
-    instance,
-    definition
-  }), currentTaskEntries = instance.stages.find(
-    (s) => s.id === instance.currentStageId && s.exitedAt === void 0
-  )?.tasks ?? [], taskEvaluations = [];
-  for (const task of stage.tasks ?? [])
-    taskEvaluations.push(
-      await evaluateTask({
-        task,
-        statusEntry: currentTaskEntries.find((t) => t.id === task.id),
-        instance,
-        definition,
-        actor,
-        grants,
-        snapshot
-      })
-    );
-  const transitionEvaluations = [];
-  for (const transition of stage.transitions ?? [])
-    transitionEvaluations.push({
-      transition,
-      filterSatisfied: await evaluateFilter({
-        filter: transition.filter,
-        definition,
-        snapshot,
-        params: buildParams(instance)
-      })
-    });
-  const currentStage = {
-    stage,
-    tasks: taskEvaluations,
-    transitions: transitionEvaluations
-  }, pendingOnYou = taskEvaluations.filter((t) => t.pendingOnActor), canInteract = taskEvaluations.some((t) => t.actions.some((a) => a.allowed));
-  return {
-    instance,
-    definition,
-    actor,
-    currentStage,
-    pendingOnYou,
-    canInteract
-  };
-}
-async function evaluateTask(args) {
-  const { task, statusEntry, instance, definition, actor, grants, snapshot } = args, status = statusEntry?.status ?? "pending", actions = [];
-  for (const action of task.actions ?? [])
-    actions.push(
-      await evaluateAction({
-        action,
-        task,
-        ...statusEntry !== void 0 ? { statusEntry } : {},
-        status,
-        instance,
-        definition,
-        actor,
-        ...grants !== void 0 ? { grants } : {},
-        snapshot
-      })
-    );
-  return {
-    task,
-    status,
-    // "pending on actor" treats both `pending` and `active` as waiting on
-    // the assignee — pending tasks just haven't been auto-invoked yet, but
-    // they're still inbox items.
-    pendingOnActor: (status === "active" || status === "pending") && actorIsAssignee(actor, task.assignees ?? []),
-    actions
-  };
-}
-async function evaluateAction(args) {
-  const { action, task, status, instance, definition, actor, grants, snapshot } = args, syncReason = lifecycleReason(instance, definition, status) ?? actorReason(action, task, actor);
-  if (syncReason !== void 0) return disabled(action, syncReason);
-  const asyncReason = await permissionReason(action, instance, actor, grants) ?? await filterReason(action, instance, definition, snapshot);
-  return asyncReason !== void 0 ? disabled(action, asyncReason) : { action, allowed: !0 };
-}
-function lifecycleReason(instance, definition, status) {
-  if (instance.completedAt !== void 0)
-    return { kind: "instance-completed", completedAt: instance.completedAt };
-  if (definition.stages.find((s) => s.id === instance.currentStageId)?.kind === "terminal")
-    return { kind: "stage-terminal", stageId: instance.currentStageId };
-  if (status === "done" || status === "skipped" || status === "failed")
-    return { kind: "task-not-active", status };
-}
-function actorReason(action, task, actor) {
-  const actorRoles = actor.roles ?? [];
-  if (action.roles !== void 0 && action.roles.length > 0 && !(actorRoles.includes(WILDCARD_ROLE) || action.roles.some((r) => actorRoles.includes(r))))
-    return { kind: "role-required", required: [...action.roles], actorRoles: [...actorRoles] };
-  if (action.requireAssignment === !0 && !actorIsAssignee(actor, task.assignees ?? []))
-    return { kind: "not-assigned", assignees: [...task.assignees ?? []], actorId: actor.id };
-}
-async function permissionReason(action, instance, actor, grants) {
-  if (grants === void 0) return;
-  const permission = action.requiredPermission ?? "update";
-  if (!await grantsPermissionOn({
-    document: instance,
-    grants,
-    permission,
-    userId: actor.id
-  }))
-    return { kind: "permission-denied", permission, matchingGrants: grants.length };
-}
-async function filterReason(action, instance, definition, snapshot) {
-  if (!(action.filter === void 0 || await evaluateFilter({
-    filter: action.filter,
-    definition,
-    snapshot,
-    params: buildParams(instance)
-  })))
-    return { kind: "filter-failed", filter: action.filter };
-}
-function disabled(action, reason) {
-  return { action, allowed: !1, disabledReason: reason };
-}
-function actorIsAssignee(actor, assignees) {
-  if (assignees.length === 0) return !1;
-  const actorRoles = actor.roles ?? [], wildcard = actorRoles.includes(WILDCARD_ROLE);
-  for (const assignee of assignees)
-    if (assignee.kind === "user" && assignee.id === actor.id || assignee.kind === "role" && (wildcard || actorRoles.includes(assignee.role)))
-      return !0;
-  return !1;
+async function fireAction(args) {
+  const { client, instanceId, taskId, action, params, options } = args;
+  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
+    const ctx = await loadContext(client, instanceId, {
+      ...options?.clock ? { clock: options.clock } : {}
+    });
+    try {
+      return await commitAction(ctx, taskId, action, params, options?.actor);
+    } catch (error) {
+      if (!isRevisionConflict(error)) throw error;
+    }
+  }
+  throw new ConcurrentFireActionError({
+    instanceId,
+    taskId,
+    action,
+    attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+  });
 }
-function parseDefinitionSnapshot(instance) {
-  try {
-    return JSON.parse(instance.definitionSnapshot);
-  } catch (err) {
+async function resolveActionCommit(ctx, taskId, actionName, callerParams) {
+  const { stage, task } = findTaskInCurrentStage(ctx, taskId), action = (task.actions ?? []).find((a) => a.id === actionName);
+  if (action === void 0)
+    throw new Error(`Action "${actionName}" not declared on task "${taskId}"`);
+  if (!await ctxEvaluateFilter(ctx, action.filter))
+    throw new Error(`Action "${actionName}" filter rejected on task "${taskId}"`);
+  const entry = findCurrentTasks(ctx.instance).find((t) => t.id === taskId);
+  if (entry === void 0 || entry.status !== "active")
     throw new Error(
-      `Failed to parse definitionSnapshot on instance "${instance._id}": ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
+      `Task "${taskId}" must be active to fire action "${actionName}"; status is ${entry?.status ?? "missing"}`
     );
-  }
+  const params = validateActionParams(action, taskId, callerParams);
+  return { stage, task, action, params };
+}
+function applyActionSetStatus(action, mutation, mutEntry, stageId, taskId, actor, now) {
+  if (action.setStatus === void 0) return;
+  const initialStatus = mutEntry.status, newStatus = action.setStatus;
+  return mutEntry.status = newStatus, mutEntry.completedAt = now, actor && (mutEntry.completedBy = actor.id), mutation.history.push(
+    taskStatusChangedEntry({
+      stageId,
+      taskId,
+      from: initialStatus,
+      to: newStatus,
+      at: now,
+      ...actor !== void 0 ? { actor } : {}
+    })
+  ), newStatus;
+}
+async function commitAction(ctx, taskId, actionName, callerParams, actor) {
+  const { stage, task, action, params } = await resolveActionCommit(
+    ctx,
+    taskId,
+    actionName,
+    callerParams
+  ), mutation = startMutation(ctx.instance), mutEntry = requireMutationTaskEntry(mutation, taskId), now = ctx.now;
+  mutation.history.push({
+    _key: randomKey(),
+    _type: "workflow.history.actionFired",
+    at: now,
+    stageId: stage.id,
+    taskId,
+    actionId: actionName,
+    ...actor !== void 0 ? { actor } : {}
+  });
+  const ranOps = await runActionOps({
+    ops: action.ops,
+    mutation,
+    stageId: stage.id,
+    taskId,
+    actionName,
+    params,
+    actor,
+    self: selfGdr(ctx.instance),
+    now
+  }), newStatus = applyActionSetStatus(action, mutation, mutEntry, stage.id, taskId, actor, now);
+  return await queueEffects(
+    ctx,
+    mutation,
+    action.effects,
+    {
+      kind: "action",
+      id: `${task.id}:${actionName}`
+    },
+    actor,
+    params
+  ), await persistThenDeploy(
+    ctx,
+    mutation,
+    () => ranOps.some(isStateOp) ? refreshStageGuards(ctx, mutation, stage.id) : Promise.resolve()
+  ), {
+    fired: !0,
+    taskId,
+    action: actionName,
+    ...newStatus !== void 0 ? { newStatus } : {},
+    ...ranOps.length > 0 ? { ranOps } : {}
+  };
 }
 class ActionDisabledError extends Error {
   reason;
@@ -2283,121 +2697,6 @@ function formatDisabledReason(taskId, action, reason) {
   const detail = disabledReasonDetail[reason.kind](reason);
   return `Action "${taskId}:${action}" is not allowed: ${detail}`;
 }
-function definitionDocId(_workflowResource, prefix, workflowId, version) {
-  return `${prefix}.${workflowId}.v${version}`;
-}
-async function sortByDependencies(client, definitions, tags, workflowResource) {
-  const prefix = canonicalTag(tags), byWorkflowId = /* @__PURE__ */ new Map();
-  for (const def of definitions) {
-    const list = byWorkflowId.get(def.workflowId) ?? [];
-    list.push(def), byWorkflowId.set(def.workflowId, list);
-  }
-  const findInBatch = (ref) => findRefInBatch(byWorkflowId, ref);
-  return await assertCrossBatchRefsDeployed(client, definitions, {
-    tags,
-    workflowResource,
-    prefix,
-    findInBatch
-  }), topoSortDefinitions(definitions, { workflowResource, prefix, findInBatch });
-}
-function findRefInBatch(byWorkflowId, ref) {
-  const candidates = byWorkflowId.get(ref.workflowId);
-  if (!(candidates === void 0 || candidates.length === 0))
-    return typeof ref.version == "number" ? candidates.find((c) => c.version === ref.version) : candidates.reduce(
-      (best, c) => best === void 0 || c.version > best.version ? c : best,
-      void 0
-    );
-}
-async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
-  const missing = [];
-  for (const def of definitions) {
-    const fromId = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
-    for (const ref of refsOf(def)) {
-      if (ctx.findInBatch(ref) !== void 0) continue;
-      const label = await resolveDeployedRefLabel(client, ref, ctx.tags);
-      label !== void 0 && missing.push({ from: fromId, ref: label });
-    }
-  }
-  if (missing.length === 0) return;
-  const lines = missing.map((m) => `  - ${m.from} \u2192 ${m.ref} (neither in batch nor deployed)`);
-  throw new Error(
-    `workflow.deployDefinitions: ${missing.length} unresolved reference${missing.length === 1 ? "" : "s"}:
-` + lines.join(`
-`)
-  );
-}
-async function resolveDeployedRefLabel(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { workflowId: ref.workflowId, tags };
-  if (wantsExplicit && (params.version = ref.version), !await client.fetch(
-    definitionLookupGroq(wantsExplicit),
-    params
-  ))
-    return wantsExplicit ? `${ref.workflowId} v${ref.version}` : ref.workflowId;
-}
-function topoSortDefinitions(definitions, ctx) {
-  const visited = /* @__PURE__ */ new Set(), visiting = /* @__PURE__ */ new Set(), ordered = [], visit = (def) => {
-    const id = definitionDocId(ctx.workflowResource, ctx.prefix, def.workflowId, def.version);
-    if (!visited.has(id)) {
-      if (visiting.has(id))
-        throw new Error(`workflow.deployDefinitions: dependency cycle involving "${id}"`);
-      visiting.add(id);
-      for (const ref of refsOf(def)) {
-        const child = ctx.findInBatch(ref);
-        child !== void 0 && visit(child);
-      }
-      visiting.delete(id), visited.add(id), ordered.push(def);
-    }
-  };
-  for (const def of definitions) visit(def);
-  return ordered;
-}
-function definitionLookupGroq(wantsExplicit) {
-  return wantsExplicit ? '*[_type == "workflow.definition" && workflowId == $workflowId && version == $version && count(tags[@ in $tags]) > 0][0]' : '*[_type == "workflow.definition" && workflowId == $workflowId && count(tags[@ in $tags]) > 0] | order(version desc)[0]';
-}
-function refsOf(def) {
-  const out = [];
-  for (const stage of def.stages)
-    for (const task of stage.tasks ?? []) {
-      const ref = task.spawns?.definitionRef;
-      ref !== void 0 && out.push({
-        workflowId: ref.workflowId,
-        ...ref.version !== void 0 ? { version: ref.version } : {}
-      });
-    }
-  return out;
-}
-function isDefinitionUnchanged(existing, expected) {
-  return stableStringify(stripSystemFields(existing)) === stableStringify(stripSystemFields(expected));
-}
-function stripSystemFields(doc) {
-  const out = {};
-  for (const [k, v] of Object.entries(doc))
-    k === "_rev" || k === "_createdAt" || k === "_updatedAt" || (out[k] = v);
-  return out;
-}
-function stableStringify(value) {
-  return value === null || typeof value != "object" ? JSON.stringify(value) : Array.isArray(value) ? `[${value.map(stableStringify).join(",")}]` : `{${Object.entries(value).toSorted(
-    ([a], [b]) => a.localeCompare(b)
-  ).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
-}
-async function loadDefinition(client, workflowId, version, tags) {
-  if (version !== void 0) {
-    const doc = await client.fetch(
-      "*[_type == 'workflow.definition' && workflowId == $id && version == $v && count(tags[@ in $engineTags]) > 0][0]",
-      { id: workflowId, v: version, engineTags: tags }
-    );
-    if (!doc)
-      throw new Error(`Workflow definition ${workflowId} v${version} not deployed`);
-    return doc;
-  }
-  const latest = await client.fetch(
-    "*[_type == 'workflow.definition' && workflowId == $id && count(tags[@ in $engineTags]) > 0] | order(version desc)[0]",
-    { id: workflowId, engineTags: tags }
-  );
-  if (!latest)
-    throw new Error(`No deployed definition for workflow ${workflowId}`);
-  return latest;
-}
 function bareIdFromSpawnRef(uri) {
   if (!uri.includes(":")) return [uri];
   try {
@@ -2418,9 +2717,16 @@ async function resolveOperationContext(args) {
     clientForGdr: buildClientForGdr(args.client, args.resourceClients)
   };
 }
-async function cascade(client, instanceId, actor, clientForGdr) {
-  const count = await cascadeAutoTransitions(client, instanceId, actor, clientForGdr);
-  return await propagateToAncestors(client, instanceId, actor, clientForGdr), count;
+async function cascade(client, instanceId, actor, clientForGdr, clock, overlay) {
+  const count = await cascadeAutoTransitions(
+    client,
+    instanceId,
+    actor,
+    clientForGdr,
+    clock,
+    overlay
+  );
+  return await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), count;
 }
 function buildClientForGdr(defaultClient, resolver) {
   return resolver === void 0 ? () => defaultClient : (parsed) => resolver(parsed) ?? defaultClient;
@@ -2438,6 +2744,22 @@ function intersectsTags(docTags, engineTags) {
 function toEffectsContextEntries(ctx) {
   return Object.entries(ctx).map(([id, value]) => effectsContextEntry(id, value));
 }
+function assertActionAllowed(evaluation, taskId, action) {
+  const actionEval = evaluation.currentStage.tasks.find((t) => t.task.id === taskId)?.actions.find((a) => a.action.id === action);
+  if (actionEval?.allowed === !1 && actionEval.disabledReason)
+    throw new ActionDisabledError({ taskId, action, reason: actionEval.disabledReason });
+}
+async function applyAction(args) {
+  const { client, instance, taskId, action, params, actor, clock } = args, options = { actor, ...clock !== void 0 ? { clock } : {} };
+  return findOpenStageEntry(instance)?.tasks.find((t) => t.id === taskId)?.status === "pending" && await invokeTask({ client, instanceId: instance._id, taskId, options }), (await fireAction({
+    client,
+    instanceId: instance._id,
+    taskId,
+    action,
+    ...params !== void 0 ? { params } : {},
+    options
+  })).ranOps;
+}
 const workflow = {
   /**
    * Persist a workflow definition to the lake. Stored as a
@@ -2470,7 +2792,7 @@ const workflow = {
       const id = definitionDocId(workflowResource, prefix, def.workflowId, def.version), expected = {
         ...def,
         _id: id,
-        _type: "workflow.definition",
+        _type: WORKFLOW_DEFINITION_TYPE,
         tags
       }, existing = await client.getDocument(id);
       if (existing && intersectsTags(existing.tags, tags) && isDefinitionUnchanged(existing, expected)) {
@@ -2512,16 +2834,17 @@ const workflow = {
       effectsContext,
       instanceId,
       perspective
-    } = args, { actor, clientForGdr } = await resolveOperationContext(args), definition = await loadDefinition(client, workflowId, version, tags), id = instanceId ?? `${canonicalTag(tags)}.wf-instance.${randomKey()}`;
+    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, workflowId, version, tags), id = instanceId ?? `${canonicalTag(tags)}.wf-instance.${randomKey()}`;
     if (definition.stages.find((s) => s.id === definition.initialStageId) === void 0)
       throw new Error(
         `Initial stage "${definition.initialStageId}" missing in ${workflowId} v${definition.version}`
       );
-    const now = (/* @__PURE__ */ new Date()).toISOString(), effectsContextEntries = effectsContext ? toEffectsContextEntries(effectsContext) : [], resolvedState = await resolveDeclaredState({
+    const now = clock(), effectsContextEntries = effectsContext ? toEffectsContextEntries(effectsContext) : [], resolvedState = await resolveDeclaredState({
       slotDefs: definition.state ?? [],
       initialState: initialState ?? [],
       ctx: {
         client,
+        now,
         selfId: id,
         tags,
         workflowResource,
@@ -2543,7 +2866,7 @@ const workflow = {
       initialStageId: definition.initialStageId,
       actor
     });
-    return await client.create(base), await primeInitialStage(client, id, actor, clientForGdr), await cascade(client, id, actor, clientForGdr), reload(client, id, tags);
+    return await client.create(base), await primeInitialStage(client, id, actor, clientForGdr, clock), await cascade(client, id, actor, clientForGdr, clock), reload(client, id, tags);
   },
   /**
    * Fire an action against a task. If the task is pending, it is
@@ -2565,43 +2888,32 @@ const workflow = {
       params,
       idempotent,
       resourceClients
-    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), before = await reload(client, instanceId, tags), taskEntry = before.stages.find(
-      (s) => s.id === before.currentStageId && s.exitedAt === void 0
-    )?.tasks.find((t) => t.id === taskId);
-    if (taskEntry === void 0 && idempotent === !0)
+    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tags);
+    if (findOpenStageEntry(before)?.tasks.find((t) => t.id === taskId) === void 0 && idempotent === !0)
       return { instance: before, cascaded: 0, fired: !1 };
-    const actionEval = (await evaluateInstance({
+    const evaluation = await evaluateInstance({
       client,
       tags,
       instanceId,
       access,
+      clock,
       ...resourceClients !== void 0 ? { resourceClients } : {}
-    })).currentStage.tasks.find((t) => t.task.id === taskId)?.actions.find((a) => a.action.id === action);
-    if (actionEval !== void 0 && !actionEval.allowed && actionEval.disabledReason)
-      throw new ActionDisabledError({
-        taskId,
-        action,
-        reason: actionEval.disabledReason
-      });
-    taskEntry?.status === "pending" && await invokeTask({
-      client,
-      instanceId,
-      taskId,
-      options: { actor }
     });
-    const actionResult = await fireAction({
+    assertActionAllowed(evaluation, taskId, action);
+    const ranOps = await applyAction({
       client,
-      instanceId,
+      instance: before,
       taskId,
       action,
-      ...params !== void 0 ? { params } : {},
-      options: { actor }
-    }), cascaded = await cascade(client, instanceId, actor, clientForGdr);
+      actor,
+      clock,
+      ...params !== void 0 ? { params } : {}
+    }), cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
       instance: await reload(client, instanceId, tags),
       cascaded,
       fired: !0,
-      ...actionResult.ranOps !== void 0 ? { ranOps: actionResult.ranOps } : {}
+      ...ranOps !== void 0 ? { ranOps } : {}
     };
   },
   /**
@@ -2612,7 +2924,7 @@ const workflow = {
    * reference them. Cascades after.
    */
   completeEffect: async (args) => {
-    const { client, tags, instanceId, effectKey, status, outputs, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args);
+    const { client, tags, instanceId, effectKey, status, outputs, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await completeEffect({
       client,
       instanceId,
@@ -2622,9 +2934,9 @@ const workflow = {
       ...detail !== void 0 ? { detail } : {},
       ...error !== void 0 ? { error } : {},
       ...durationMs !== void 0 ? { durationMs } : {},
-      ...actor !== void 0 ? { options: { actor } } : {}
+      options: { ...actor !== void 0 ? { actor } : {}, clock }
     });
-    const cascaded = await cascade(client, instanceId, actor, clientForGdr);
+    const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
       instance: await reload(client, instanceId, tags),
       cascaded,
@@ -2641,9 +2953,9 @@ const workflow = {
    * affected instances and the engine re-evaluates.
    */
   tick: async (args) => {
-    const { client, tags, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args);
+    const { client, tags, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await reload(client, instanceId, tags);
-    const cascaded = await cascade(client, instanceId, actor, clientForGdr);
+    const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
       instance: await reload(client, instanceId, tags),
       cascaded,
@@ -2656,15 +2968,15 @@ const workflow = {
    * upstream; this verb performs the mechanical move.
    */
   setStage: async (args) => {
-    const { client, tags, instanceId, targetStageId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args);
+    const { client, tags, instanceId, targetStageId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await reload(client, instanceId, tags);
     const result = await setStage({
       client,
       instanceId,
       targetStageId,
       ...reason !== void 0 ? { reason } : {},
-      ...actor !== void 0 ? { options: { actor } } : {}
-    }), cascaded = result.fired ? await cascade(client, instanceId, actor, clientForGdr) : 0;
+      options: { ...actor !== void 0 ? { actor } : {}, clock }
+    }), cascaded = result.fired ? await cascade(client, instanceId, actor, clientForGdr, clock) : 0;
     return {
       instance: await reload(client, instanceId, tags),
       cascaded,
@@ -2680,6 +2992,16 @@ const workflow = {
     const { client, tags, instanceId } = args;
     return validateTags(tags), reload(client, instanceId, tags);
   },
+  guardsForInstance: async (args) => {
+    const { client, tags, instanceId, resourceClients } = args;
+    validateTags(tags);
+    const instance = await reload(client, instanceId, tags);
+    return guardsForInstance({
+      client,
+      clientForGdr: buildClientForGdr(client, resourceClients),
+      instance
+    });
+  },
   /**
    * Run a caller-supplied GROQ query with the engine's tags bound as
    * `$engineTags`. This does NOT rewrite the query — arbitrary GROQ
@@ -2714,9 +3036,9 @@ const workflow = {
    * without re-implementing hydration. Pure read — never writes.
    */
   queryInScope: async (args) => {
-    const { client, tags, instanceId, groq, params, resourceClients } = args;
+    const { client, tags, instanceId, groq, params, resourceClients } = args, clock = args.clock ?? wallClock;
     validateTags(tags);
-    const instance = await reload(client, instanceId, tags), definition = JSON.parse(instance.definitionSnapshot), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance, definition }), reserved = buildParams(instance), tree = parse(groq, { params: { ...reserved, ...params } });
+    const instance = await reload(client, instanceId, tags), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams(instance, clock()), tree = parse(groq, { params: { ...reserved, ...params } });
     return await (await evaluate(tree, {
       dataset: snapshot.docs,
       params: { ...reserved, ...params }
@@ -2759,7 +3081,7 @@ const workflow = {
     validateTags(tags);
     const parent = await reload(client, instanceId, tags), isSpawned = (h) => h._type === "workflow.history.spawned", ids = parent.history.filter(isSpawned).filter((h) => taskId === void 0 || h.taskId === taskId).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
     return ids.length === 0 ? [] : client.fetch(
-      "*[_id in $ids && count(tags[@ in $engineTags]) > 0] | order(startedAt asc)",
+      `*[_id in $ids && ${tagScopeFilter()}] | order(startedAt asc)`,
       { ids, engineTags: tags }
     );
   },
@@ -2778,7 +3100,7 @@ async function verifyDeployedDefinitionsInternal(args) {
   const { client, tags, effectHandlers, missingHandler, logger } = args;
   validateTags(tags);
   const log = logger("verifyDeployedDefinitions"), definitions = await client.fetch(
-    '*[_type == "workflow.definition" && count(tags[@ in $engineTags]) > 0] | order(workflowId asc, version asc)',
+    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}] | order(workflowId asc, version asc)`,
     { engineTags: tags }
   ), seen = [], missingByName = /* @__PURE__ */ new Map();
   for (const def of definitions)
@@ -2900,7 +3222,8 @@ async function claimPendingEffect(client, instance, effectKey, drainerActor) {
   };
   try {
     return await client.patch(instance._id).ifRevisionId(instance._rev).set({ [`pendingEffects[_key=="${effectKey}"].claim`]: claim }).commit(), !0;
-  } catch {
+  } catch (error) {
+    if (!isRevisionConflict(error)) throw error;
     return !1;
   }
 }
@@ -2928,6 +3251,89 @@ async function applyMissingHandler(policy, info, log) {
     return "fail";
   }
 }
+function createInstanceSession(args) {
+  const { client, tags, clock } = args, clientForGdr = buildClientForGdr(client, args.resourceClients);
+  let instance = asHeldInstance(args.instance), overlay = /* @__PURE__ */ new Map(), committing = !1, buffered;
+  const selfUri = () => gdrFromResource(instance.workflowResource, instance._id), applyUpdate = (docs) => {
+    const next = /* @__PURE__ */ new Map();
+    for (const ld of docs) {
+      const owned = { doc: structuredClone(ld.doc), resource: ld.resource }, uri = gdrFromResource(owned.resource, owned.doc._id);
+      if (uri === selfUri()) {
+        instance = asHeldInstance(owned.doc);
+        continue;
+      }
+      next.set(uri, owned);
+    }
+    overlay = next;
+  }, access = () => resolveAccess(client, {
+    ...args.access !== void 0 ? { override: args.access } : {},
+    ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
+  }), snapshotFrom = (held) => buildSnapshot({ docs: [{ doc: instance, resource: instance.workflowResource }, ...held.values()] }), evaluateWith = async (held) => {
+    const { actor, grants } = await access();
+    return evaluateFromSnapshot({
+      instance,
+      definition: parseDefinitionSnapshot(instance),
+      actor,
+      snapshot: snapshotFrom(held),
+      ...clock !== void 0 ? { now: clock() } : {},
+      ...grants !== void 0 ? { grants } : {}
+    });
+  }, commit = async (run) => {
+    committing = !0;
+    const held = new Map(overlay);
+    try {
+      const { actor } = await access();
+      return await run(actor, held);
+    } finally {
+      if (committing = !1, buffered !== void 0) {
+        const next = buffered;
+        buffered = void 0, applyUpdate(next);
+      }
+    }
+  };
+  return {
+    get subscriptionDocuments() {
+      return subscriptionDocumentsForInstance(instance);
+    },
+    update(docs) {
+      if (committing) {
+        buffered = docs;
+        return;
+      }
+      applyUpdate(docs);
+    },
+    evaluate() {
+      return evaluateWith(overlay);
+    },
+    tick() {
+      return commit(async (actor, held) => {
+        const cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
+        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: cascaded > 0 };
+      });
+    },
+    fireAction({ taskId, action, params }) {
+      return commit(async (actor, held) => {
+        assertActionAllowed(await evaluateWith(held), taskId, action);
+        const ranOps = await applyAction({
+          client,
+          instance,
+          taskId,
+          action,
+          actor,
+          ...clock !== void 0 ? { clock } : {},
+          ...params !== void 0 ? { params } : {}
+        }), cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
+        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
+      });
+    }
+  };
+}
+function asHeldInstance(doc) {
+  const candidate = doc;
+  if (candidate._type !== "workflow.instance" || typeof candidate.currentStageId != "string" || !Array.isArray(candidate.stages))
+    throw new Error(`update: self-doc ${doc._id} is not a valid workflow.instance`);
+  return doc;
+}
 const defaultLoggerFactory = (name) => ({
   // info/warn/error all go to stderr — these are diagnostic, not
   // program output. Keeps stdout reserved for the caller's own data
@@ -2945,13 +3351,14 @@ const defaultLoggerFactory = (name) => ({
   }
 };
 function createEngine(args) {
-  const { client, workflowResource, tags, resourceClients } = args;
+  const { client, workflowResource, tags, resourceClients, clock } = args;
   validateTags(tags);
   const effectHandlers = args.effectHandlers ?? {}, missingHandler = args.missingHandler ?? "fail", logger = args.loggerFactory ?? defaultLoggerFactory, bind = (rest) => ({
     client,
     tags,
     workflowResource,
     ...resourceClients !== void 0 ? { resourceClients } : {},
+    ...clock !== void 0 ? { clock } : {},
     ...rest
   });
   return {
@@ -2969,6 +3376,23 @@ function createEngine(args) {
     evaluateInstance: (rest) => evaluateInstance(bind(rest)),
     setStage: (rest) => workflow.setStage(bind(rest)),
     getInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }),
+    subscriptionDocumentsForInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }).then(subscriptionDocumentsForInstance),
+    instance: (instanceDoc, opts) => createInstanceSession({
+      client,
+      tags,
+      instance: instanceDoc,
+      ...resourceClients !== void 0 ? { resourceClients } : {},
+      ...clock !== void 0 ? { clock } : {},
+      ...opts?.access !== void 0 ? { access: opts.access } : {},
+      ...opts?.grantsFromPath !== void 0 ? { grantsFromPath: opts.grantsFromPath } : {}
+    }),
+    guardsForInstance: ({ instanceId }) => workflow.guardsForInstance({
+      client,
+      tags,
+      workflowResource,
+      instanceId,
+      ...resourceClients !== void 0 ? { resourceClients } : {}
+    }),
     children: ({ instanceId, taskId }) => workflow.children({
       client,
       tags,
@@ -2989,7 +3413,8 @@ function createEngine(args) {
       workflowResource,
       instanceId,
       groq,
-      ...params !== void 0 ? { params } : {}
+      ...params !== void 0 ? { params } : {},
+      ...clock !== void 0 ? { clock } : {}
     }),
     listPendingEffects: ({ instanceId }) => workflow.listPendingEffects({ client, tags, workflowResource, instanceId }),
     findPendingEffects: ({ instanceId, claimed, names }) => workflow.findPendingEffects({
@@ -3020,15 +3445,6 @@ function createEngine(args) {
     })
   };
 }
-class MutationGuardDeniedError extends Error {
-  denied;
-  documentId;
-  action;
-  constructor(args) {
-    const ids = args.denied.map((d) => d.guardId).join(", ");
-    super(`Mutation on "${args.documentId}" (${args.action}) denied by guard(s) [${ids}]`), this.name = "MutationGuardDeniedError", this.denied = args.denied, this.documentId = args.documentId, this.action = args.action;
-  }
-}
 const HISTORY_DISPLAY = {
   "workflow.history.stageEntered": {
     title: "Stage entered",
@@ -3224,41 +3640,58 @@ export {
   AUTHORING_DISPLAY,
   ActionDisabledError,
   ActionParamsInvalidError,
+  CascadeLimitError,
+  ConcurrentFireActionError,
   DISPLAY,
   EFFECTS_CONTEXT_DISPLAY,
+  GUARD_DOC_TYPE,
   GUARD_LIFTED_PREDICATE,
   GUARD_OWNER,
   HISTORY_DISPLAY,
   MutationGuardDeniedError,
   OP_DISPLAY,
   STATE_SLOT_DISPLAY,
+  WORKFLOW_DEFINITION_TYPE,
+  WORKFLOW_INSTANCE_TYPE,
+  WorkflowStateDivergedError,
+  buildSnapshot,
   canonicalTag,
   compileGuard,
+  contentReleaseName,
   createEngine,
   defaultLoggerFactory,
   denyingGuards,
   deployStageGuards,
   displayDescription,
   displayTitle,
+  evaluateFromSnapshot,
   evaluateMutationGuard,
   extractDocumentId,
   gdrFromResource,
   gdrRef,
   gdrUri,
   guardMatches,
+  guardsForInstance,
+  guardsForResource,
+  isDefinitionUnchanged,
   isGdr,
   lakeGuardId,
   parseGdr,
-  reconcileStageGuards,
+  readsRaw,
   refCanvas,
   refDashboard,
   refDataset,
   refMediaLibrary,
   resolveAccess,
+  resourceFromParsed,
   retractStageGuards,
   silentLogger,
+  stripSystemFields,
+  subscriptionDocumentsForInstance,
+  tagScopeFilter,
   validateDefinition,
   validateTags,
+  wallClock,
   workflow
 };
 //# sourceMappingURL=index.js.map