@sanity/workflow-engine 0.12.0 → 0.13.0

package/dist/index.js

@@ -1,10 +1,32 @@
 import { parse, evaluate } from "groq-js";
-import { actorFulfillsRole, isTerminalActivityStatus, WORKFLOW_DEFINITION_TYPE, andConditions, DOCUMENT_VALUE_PERMISSIONS } from "./_chunks-es/schema.js";
+import { actorFulfillsRole, isTerminalActivityStatus, StoredFieldOpSchema, WORKFLOW_DEFINITION_TYPE, andConditions, DOCUMENT_VALUE_PERMISSIONS } from "./_chunks-es/schema.js";
 import { ACTIVITY_KINDS, DRIVER_KINDS, isStartableDefinition } from "./_chunks-es/schema.js";
 import * as v from "valibot";
 function findOpenStageEntry(host) {
   return host.stages.find((s) => s.name === host.currentStage && s.exitedAt === void 0);
 }
+function findCurrentActivityEntry(host, activityName) {
+  return findOpenStageEntry(host)?.activities.find((a) => a.name === activityName);
+}
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function rethrowWithContext(err, context) {
+  throw new Error(`${context}: ${errorMessage(err)}`, { cause: err });
+}
+function mapJsonStrings(value, transform) {
+  const walk = (val, key) => {
+    if (typeof val == "string") return transform(val, key);
+    if (Array.isArray(val)) return val.map((item) => walk(item, key));
+    if (val !== null && typeof val == "object") {
+      const out = {};
+      for (const [k, v2] of Object.entries(val)) out[k] = walk(v2, k);
+      return out;
+    }
+    return val;
+  };
+  return walk(value, void 0);
+}
 const KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
 function parseGdr(uri) {
   const colon = uri.indexOf(":");
@@ -44,22 +66,56 @@ function parseGdr(uri) {
     documentId: parts[1]
   };
 }
+function tryParseGdr(uri) {
+  try {
+    return parseGdr(uri);
+  } catch {
+    return;
+  }
+}
 function gdrUri(parts) {
   return parts.scheme === "dataset" ? `dataset:${parts.projectId}:${parts.dataset}:${parts.documentId}` : `${parts.scheme}:${parts.resourceId}:${parts.documentId}`;
 }
 function extractDocumentId(gdrUriString) {
   return parseGdr(gdrUriString).documentId;
 }
-function refDataset(projectId, dataset, documentId, type) {
+const RESOURCE_ALIAS_NAME_SOURCE = "[a-z0-9][a-z0-9-]*", RESOURCE_ALIAS_NAME_RE = new RegExp(`^${RESOURCE_ALIAS_NAME_SOURCE}$`);
+function validateResourceAliasName(name) {
+  if (!RESOURCE_ALIAS_NAME_RE.test(name))
+    throw new Error(
+      `Invalid resource alias name "${name}": expected lowercase letters, digits, and dashes (no leading dash).`
+    );
+}
+function toPhysicalGdr(id, home) {
+  return isGdrUri(id) ? id : gdrFromResource(home, id);
+}
+function refDataset({
+  projectId,
+  dataset,
+  documentId,
+  type
+}) {
   return { id: gdrUri({ scheme: "dataset", projectId, dataset, documentId }), type };
 }
-function refCanvas(resourceId, documentId, type) {
+function refCanvas({
+  resourceId,
+  documentId,
+  type
+}) {
   return { id: gdrUri({ scheme: "canvas", resourceId, documentId }), type };
 }
-function refMediaLibrary(resourceId, documentId, type) {
+function refMediaLibrary({
+  resourceId,
+  documentId,
+  type
+}) {
   return { id: gdrUri({ scheme: "media-library", resourceId, documentId }), type };
 }
-function refDashboard(resourceId, documentId, type) {
+function refDashboard({
+  resourceId,
+  documentId,
+  type
+}) {
   return { id: gdrUri({ scheme: "dashboard", resourceId, documentId }), type };
 }
 function datasetResourceParts(id) {
@@ -75,17 +131,16 @@ function gdrFromResource(res, documentId) {
   }
   return gdrUri({ scheme: res.type, resourceId: res.id, documentId });
 }
+function gdrResourcePrefix(res) {
+  const full = gdrFromResource(res, "x");
+  return full.slice(0, full.length - 1);
+}
+function resourceFromParsed(parsed) {
+  return parsed.scheme === "dataset" ? { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` } : { type: parsed.scheme, id: parsed.resourceId ?? "" };
+}
 function resourceFromGdrUri(uri) {
-  let parsed;
-  try {
-    parsed = parseGdr(uri);
-  } catch {
-    return;
-  }
-  if (parsed.scheme === "dataset")
-    return parsed.projectId === void 0 || parsed.dataset === void 0 ? void 0 : { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` };
-  if (parsed.resourceId !== void 0)
-    return { type: parsed.scheme, id: parsed.resourceId };
+  const parsed = tryParseGdr(uri);
+  return parsed === void 0 ? void 0 : resourceFromParsed(parsed);
 }
 function sameResource(a, b) {
   return a.type === b.type && a.id === b.id;
@@ -93,15 +148,24 @@ function sameResource(a, b) {
 function selfGdr(doc) {
   return gdrFromResource(doc.workflowResource, doc._id);
 }
+function definitionDocId({
+  tag,
+  definition,
+  version
+}) {
+  return `${tag}.${definition}.v${version}`;
+}
 function isGdrUri(value) {
-  if (typeof value != "string") return !1;
-  try {
-    return parseGdr(value), !0;
-  } catch {
-    return !1;
-  }
+  return typeof value == "string" && tryParseGdr(value) !== void 0;
+}
+function toBareId(id) {
+  return isGdrUri(id) ? extractDocumentId(id) : id;
 }
-function gdrRef(res, documentId, type) {
+function gdrRef({
+  res,
+  documentId,
+  type
+}) {
   return { id: gdrFromResource(res, documentId), type };
 }
 function isGdr(value) {
@@ -136,17 +200,26 @@ function renderedFields(entries, snapshot) {
 function renderedValue(entry, snapshot) {
   return entry._type !== "doc.ref" || entry.value === null || snapshot === void 0 ? entry.value : snapshot.docs.find((d) => d._id === entry.value.id) ?? entry.value;
 }
-function scopedFieldOverlay(instance, snapshot, activityName) {
+function scopedFieldOverlay({
+  instance,
+  snapshot,
+  activityName
+}) {
   const stageEntry = findOpenStageEntry(instance);
   if (stageEntry === void 0) return {};
   const stageFields = renderedFields(stageEntry.fields ?? [], snapshot), activity = activityName ? stageEntry.activities.find((t) => t.name === activityName) : void 0;
   return { ...stageFields, ...renderedFields(activity?.fields ?? [], snapshot) };
 }
-function assignedFor(instance, activityName, actor, roleAliases) {
+function assignedFor({
+  instance,
+  activityName,
+  actor,
+  roleAliases
+}) {
   if (actor === void 0) return !1;
-  const entry = findOpenStageEntry(instance)?.activities.find((t) => t.name === activityName)?.fields?.find((s) => s._type === "assignees");
+  const entry = findCurrentActivityEntry(instance, activityName)?.fields?.find((s) => s._type === "assignees");
   return entry === void 0 ? !1 : entry.value.some(
-    (a) => a.type === "user" ? a.id === actor.id : actorFulfillsRole(actor.roles, a.role, roleAliases)
+    (a) => a.type === "user" ? a.id === actor.id : actorFulfillsRole({ actorRoles: actor.roles, required: a.role, aliases: roleAliases })
   );
 }
 function effectsContextMap(instance) {
@@ -159,35 +232,20 @@ function parseJsonContextEntry(entry) {
   try {
     return JSON.parse(entry.value);
   } catch (err) {
-    throw new Error(
-      `effectsContext entry "${entry.name}" holds unparseable JSON: ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
+    rethrowWithContext(err, `effectsContext entry "${entry.name}" holds unparseable JSON`);
   }
 }
 function paramsForLake(params) {
   return {
     ...params,
-    self: typeof params.self == "string" ? bareId(params.self) : params.self,
-    parent: typeof params.parent == "string" ? bareId(params.parent) : params.parent,
-    ancestors: Array.isArray(params.ancestors) ? params.ancestors.map((a) => typeof a == "string" ? bareId(a) : a) : params.ancestors,
+    self: typeof params.self == "string" ? toBareId(params.self) : params.self,
+    parent: typeof params.parent == "string" ? toBareId(params.parent) : params.parent,
+    ancestors: Array.isArray(params.ancestors) ? params.ancestors.map((a) => typeof a == "string" ? toBareId(a) : a) : params.ancestors,
     fields: stripFieldsForLake(params.fields)
   };
 }
 function stripFieldsForLake(value) {
-  if (value == null) return value;
-  if (typeof value == "string") return bareId(value);
-  if (Array.isArray(value)) return value.map(stripFieldsForLake);
-  if (typeof value == "object") {
-    const out = {};
-    for (const [k, v2] of Object.entries(value))
-      out[k] = stripFieldsForLake(v2);
-    return out;
-  }
-  return value;
-}
-function bareId(id) {
-  return isGdrUri(id) ? extractDocumentId(id) : id;
+  return mapJsonStrings(value, (s) => toBareId(s));
 }
 function getPath(value, path) {
   let current = value;
@@ -197,9 +255,6 @@ function getPath(value, path) {
   }
   return current;
 }
-function resourceOf(p) {
-  return p.scheme === "dataset" ? { type: "dataset", id: `${p.projectId}.${p.dataset}` } : { type: p.scheme, id: p.resourceId ?? "" };
-}
 const FIELD_READ = /^\$fields\.(\w+)(?:\.(.+))?$/, EFFECTS_READ = /^\$effects\['([^']+)'\](?:\.(.+))?$/;
 function isGuardReadExpr(expr) {
   return expr === "$self" || expr === "$now" || FIELD_READ.test(expr) || EFFECTS_READ.test(expr);
@@ -242,9 +297,9 @@ function resolveIdRefTargets(idRefs, ctx) {
   return targets.length === 0 ? null : targets;
 }
 function assertSingleResource(targets) {
-  const resource = resourceOf(targets[0].parsed);
+  const resource = resourceFromParsed(targets[0].parsed);
   for (const g of targets) {
-    const r = resourceOf(g.parsed);
+    const r = resourceFromParsed(g.parsed);
     if (r.type !== resource.type || r.id !== resource.id)
       throw new Error(
         `Guard targets span multiple resources (${resource.type}:${resource.id} vs ${r.type}:${r.id}); a guard is single-resource.`
@@ -308,23 +363,31 @@ function validateStage(v2, stage) {
   for (const entry of stage.fields ?? [])
     v2.checkEntry(entry, `stage "${stage.name}".fields "${entry.name}"`);
   for (const guard of stage.guards ?? [])
-    validateGuardReads(v2, stage.name, guard);
+    validateGuardReads({ v: v2, stageName: stage.name, guard });
   for (const t of stage.transitions ?? []) {
     v2.checkCondition(t.filter, `transition "${t.name}" (${stage.name} \u2192 ${t.to}) filter`);
     for (const [key, groq] of effectBindings(t.effects))
       v2.tryParse(groq, `transition "${t.name}" effect binding "${key}"`);
   }
   for (const activity of stage.activities ?? [])
-    validateActivity(v2, stage.name, activity);
+    validateActivity({ v: v2, stageName: stage.name, activity });
 }
-function validateGuardReads(v2, stageName, guard) {
+function validateGuardReads({
+  v: v2,
+  stageName,
+  guard
+}) {
   const where = `stage "${stageName}" guard "${guard.name}"`;
   for (const expr of guard.match.idRefs ?? [])
     v2.checkGuardRead(expr, `${where} match.idRefs`);
   for (const [key, expr] of Object.entries(guard.metadata ?? {}))
     v2.checkGuardRead(expr, `${where} metadata "${key}"`);
 }
-function validateActivity(v2, stageName, activity) {
+function validateActivity({
+  v: v2,
+  stageName,
+  activity
+}) {
   const where = `stage "${stageName}" activity "${activity.name}"`;
   for (const entry of activity.fields ?? [])
     v2.checkEntry(entry, `${where}.fields "${entry.name}"`);
@@ -333,7 +396,7 @@ function validateActivity(v2, stageName, activity) {
     v2.checkCondition(groq, `${where}.requirements "${name}"`);
   for (const [key, groq] of effectBindings(activity.effects))
     v2.tryParse(groq, `${where} effect binding "${key}"`);
-  validateActivityActions(v2, activity), activity.subworkflows !== void 0 && validateSubworkflows(v2, where, activity.subworkflows);
+  validateActivityActions(v2, activity), activity.subworkflows !== void 0 && validateSubworkflows({ v: v2, where, sub: activity.subworkflows });
 }
 function validateActivityActions(v2, activity) {
   for (const a of activity.actions ?? []) {
@@ -342,7 +405,11 @@ function validateActivityActions(v2, activity) {
       v2.tryParse(groq, `activity "${activity.name}" action "${a.name}" effect binding "${key}"`);
   }
 }
-function validateSubworkflows(v2, where, sub) {
+function validateSubworkflows({
+  v: v2,
+  where,
+  sub
+}) {
   v2.tryParse(sub.forEach, `${where}.subworkflows.forEach`);
   for (const [key, groq] of Object.entries(sub.with ?? {}))
     v2.tryParse(groq, `${where}.subworkflows.with "${key}"`);
@@ -421,7 +488,11 @@ function globMatch(pattern, value) {
   const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
   return new RegExp(`^${escaped}$`).test(value);
 }
-function guardMatches(guard, doc, action) {
+function guardMatches({
+  guard,
+  doc,
+  action
+}) {
   const m = guard.match;
   if (!m.actions.includes(action) || m.types && m.types.length > 0 && !(doc.type !== void 0 && m.types.includes(doc.type)))
     return !1;
@@ -450,7 +521,7 @@ async function evaluateMutationGuard(args) {
 async function denyingGuards(args) {
   const { guards, doc, context } = args, denied = [];
   for (const guard of guards)
-    guardMatches(guard, doc, context.action) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
+    guardMatches({ guard, doc, action: context.action }) && (await evaluateMutationGuard({ guard, context }) || denied.push(guard));
   return denied;
 }
 async function instanceWriteDenials(args) {
@@ -621,6 +692,16 @@ ${lines}`
     ), this.name = "ActionParamsInvalidError", this.action = args.action, this.activity = args.activity, this.issues = args.issues;
   }
 }
+class EffectOpsInvalidError extends Error {
+  effect;
+  issues;
+  constructor(args) {
+    const lines = args.issues.map((i) => `  - ${i}`).join(`
+`);
+    super(`Effect "${args.effect}" returned invalid completion ops:
+${lines}`), this.name = "EffectOpsInvalidError", this.effect = args.effect, this.issues = args.issues;
+  }
+}
 class RequiredFieldNotProvidedError extends Error {
   definition;
   missing;
@@ -697,38 +778,39 @@ class CascadeLimitError extends Error {
 function buildSnapshot(args) {
   const docs = [], knownIds = /* @__PURE__ */ new Set();
   for (const { doc, resource } of args.docs) {
-    const uri = gdrFromResource(resource, doc._id), restamped = restampForSnapshot(doc, uri, resource);
+    const uri = gdrFromResource(resource, doc._id), restamped = restampForSnapshot({ doc, gdrUri: uri, resource });
     docs.push(restamped), knownIds.add(uri);
   }
   return { docs, knownIds };
 }
-function restampForSnapshot(doc, gdrUri2, resource) {
+function restampForSnapshot({
+  doc,
+  gdrUri: gdrUri2,
+  resource
+}) {
   return { ...rewriteRefsRecursive(doc, resource), _id: gdrUri2 };
 }
 function rewriteRefsRecursive(value, resource) {
-  if (Array.isArray(value))
-    return value.map((v2) => rewriteRefsRecursive(v2, resource));
-  if (value === null || typeof value != "object") return value;
-  const obj = value, out = {};
-  for (const [k, v2] of Object.entries(obj))
-    k === "_ref" && typeof v2 == "string" ? out[k] = v2.includes(":") ? v2 : gdrFromResource(resource, v2) : out[k] = rewriteRefsRecursive(v2, resource);
-  return out;
+  return mapJsonStrings(
+    value,
+    (str, key) => (
+      // Only `_ref` string values become URIs; already-qualified ones pass through.
+      key === "_ref" && !str.includes(":") ? gdrFromResource(resource, str) : str
+    )
+  );
 }
 const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 function parseDefinitionSnapshot(instance) {
   try {
     return JSON.parse(instance.definitionSnapshot);
   } catch (err) {
-    throw new Error(
-      `Failed to parse definitionSnapshot on instance "${instance._id}": ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
+    rethrowWithContext(err, `Failed to parse definitionSnapshot on instance "${instance._id}"`);
   }
 }
 function collectWatchRefs(instance) {
   const stage = findOpenStageEntry(instance);
   return [
-    gdrRef(instance.workflowResource, instance._id, instance._type),
+    gdrRef({ res: instance.workflowResource, documentId: instance._id, type: instance._type }),
     ...instance.ancestors,
     ...entryDocRefs(instance.fields),
     ...entryDocRefs(stage?.fields),
@@ -786,13 +868,13 @@ async function hydrateSnapshot(args) {
       loaded.push(held), visited.add(uri);
       return;
     }
-    const fetched = await loadByGdr(
-      client,
+    const fetched = await loadByGdr({
+      defaultClient: client,
       clientForGdr,
-      instance.workflowResource,
+      defaultResource: instance.workflowResource,
       uri,
       perspective
-    );
+    });
     fetched && (loaded.push(fetched), visited.add(uri));
   };
   loaded.push({ doc: instance, resource: instance.workflowResource }), visited.add(selfGdr(instance));
@@ -803,23 +885,28 @@ async function hydrateSnapshot(args) {
     );
   return buildSnapshot({ docs: loaded });
 }
-async function loadByGdr(defaultClient, clientForGdr, defaultResource, uri, perspective) {
-  let parsed;
-  try {
-    parsed = parseGdr(uri);
-  } catch {
-    const doc2 = await readDoc(defaultClient, uri, perspective);
+async function loadByGdr({
+  defaultClient,
+  clientForGdr,
+  defaultResource,
+  uri,
+  perspective
+}) {
+  const parsed = tryParseGdr(uri);
+  if (parsed === void 0) {
+    const doc2 = await readDoc({ client: defaultClient, id: uri, perspective });
     return doc2 ? { doc: doc2, resource: defaultResource } : null;
   }
-  const routed = clientForGdr(parsed), doc = await readDoc(routed, parsed.documentId, perspective);
+  const routed = clientForGdr(parsed), doc = await readDoc({ client: routed, id: parsed.documentId, perspective });
   return doc ? { doc, resource: resourceFromParsed(parsed) } : null;
 }
-async function readDoc(client, id, perspective) {
+async function readDoc({
+  client,
+  id,
+  perspective
+}) {
   return perspective === "raw" ? await client.getDocument(id) ?? null : await client.fetch("*[_id == $id][0]", { id }, { perspective }) ?? null;
 }
-function resourceFromParsed(parsed) {
-  return parsed.scheme === "dataset" ? { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` } : { type: parsed.scheme, id: parsed.resourceId ?? "" };
-}
 function collectEntryDocUris(resolvedFieldEntries) {
   return entryDocRefs(resolvedFieldEntries).map((ref) => ref.id);
 }
@@ -841,13 +928,13 @@ async function guardsForInstance(args) {
   const { client, clientForGdr, instance } = args, stateUris = [
     ...collectEntryDocUris(instance.fields),
     ...instance.stages.flatMap((stage) => collectEntryDocUris(stage.fields))
-  ], clients = resourceClientMap(
-    instance.workflowResource,
-    client,
+  ], clients = resourceClientMap({
+    base: instance.workflowResource,
+    baseClient: client,
     clientForGdr,
-    stateUris.map((uri) => tryParseGdr(uri))
-  ), { query, params } = instanceGuardQuery(instance._id);
-  return queryGuardsAcross(clients.values(), query, params);
+    gdrs: stateUris.map((uri) => tryParseGdr(uri))
+  }), { query, params } = instanceGuardQuery(instance._id);
+  return queryGuardsAcross({ clients: clients.values(), query, params });
 }
 async function guardsForDefinition(args) {
   const perClient = await guardsForDefinitionByClient(args);
@@ -855,8 +942,13 @@ async function guardsForDefinition(args) {
 }
 async function guardsForDefinitionByClient(args) {
   const { client, clientForGdr, workflowResource, definition, definitions } = args, gdrs = definitions.flatMap(
-    (def) => guardIdRefs(def).map(({ idRef, stage }) => staticIdRefGdr(idRef, stage, def))
-  ), clients = resourceClientMap(workflowResource, client, clientForGdr, gdrs), query = "*[_type == $t && sourceDefinition == $definition]", params = { t: GUARD_DOC_TYPE, definition };
+    (def) => guardIdRefs(def).map(({ idRef, stage }) => staticIdRefGdr({ idRef, stage, definition: def }))
+  ), clients = resourceClientMap({
+    base: workflowResource,
+    baseClient: client,
+    clientForGdr,
+    gdrs
+  }), query = "*[_type == $t && sourceDefinition == $definition]", params = { t: GUARD_DOC_TYPE, definition };
   return Promise.all(
     [...clients.values()].map(async (resourceClient) => ({
       client: resourceClient,
@@ -871,7 +963,11 @@ function guardIdRefs(definition) {
     )
   );
 }
-function staticIdRefGdr(idRef, stage, definition) {
+function staticIdRefGdr({
+  idRef,
+  stage,
+  definition
+}) {
   const read = /^\$fields\.([\w-]+)/.exec(idRef);
   if (read === null) return;
   const seed = entriesInScope(stage, definition).find((e) => e.name === read[1])?.initialValue;
@@ -891,14 +987,12 @@ function gdrFromValue(value) {
     return typeof id == "string" ? tryParseGdr(id) : void 0;
   }
 }
-function tryParseGdr(uri) {
-  try {
-    return parseGdr(uri);
-  } catch {
-    return;
-  }
-}
-function resourceClientMap(base, baseClient, clientForGdr, gdrs) {
+function resourceClientMap({
+  base,
+  baseClient,
+  clientForGdr,
+  gdrs
+}) {
   const map = /* @__PURE__ */ new Map([[resourceKey(base), baseClient]]);
   for (const parsed of gdrs) {
     if (parsed === void 0) continue;
@@ -907,7 +1001,11 @@ function resourceClientMap(base, baseClient, clientForGdr, gdrs) {
   }
   return map;
 }
-async function queryGuardsAcross(clients, query, params) {
+async function queryGuardsAcross({
+  clients,
+  query,
+  params
+}) {
   const perResource = await Promise.all(
     [...clients].map((c) => c.fetch(query, params))
   );
@@ -917,7 +1015,12 @@ function dedupById(guards) {
   return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
 }
 const SYNC_COMMIT = { visibility: "sync" }, GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
-function resolveGuard(guard, instance, stageName, now) {
+function resolveGuard({
+  guard,
+  instance,
+  stageName,
+  now
+}) {
   const ctx = { instance, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
   if (targets === null) return null;
   const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
@@ -952,7 +1055,12 @@ async function upsertGuard(client, doc) {
 function resolvedStageGuards(args) {
   const stage = args.definition.stages.find((s) => s.name === args.stageName), out = [];
   for (const guard of stage?.guards ?? []) {
-    const resolved = resolveGuard(guard, args.instance, args.stageName, args.now);
+    const resolved = resolveGuard({
+      guard,
+      instance: args.instance,
+      stageName: args.stageName,
+      now: args.now
+    });
     resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
   }
   return out;
@@ -1001,13 +1109,16 @@ function randomKey(length = 12) {
   const bytes = new Uint8Array(length);
   return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
 }
+function instanceDocId(tag) {
+  return `${tag}.wf-instance.${randomKey()}`;
+}
 function isUnevaluable(result) {
   return result == null;
 }
 async function evaluateConditionOutcome(args) {
   const { condition, snapshot, params } = args;
   if (condition === void 0) return "satisfied";
-  const result = await runGroq(condition, params, snapshot);
+  const result = await runGroq({ groq: condition, params, snapshot });
   return isUnevaluable(result) ? "unevaluable" : result ? "satisfied" : "unsatisfied";
 }
 async function evaluateCondition(args) {
@@ -1016,7 +1127,7 @@ async function evaluateCondition(args) {
 async function evaluatePredicates(args) {
   const out = {};
   for (const [name, groq] of Object.entries(args.predicates ?? {})) {
-    const result = await runGroq(groq, args.params, args.snapshot);
+    const result = await runGroq({ groq, params: args.params, snapshot: args.snapshot });
     out[name] = isUnevaluable(result) ? null : !!result;
   }
   return out;
@@ -1027,7 +1138,11 @@ async function evaluateRequirements(args) {
     await evaluateCondition({ condition, snapshot: args.snapshot, params: args.params }) || unmet.push(name);
   return unmet;
 }
-async function runGroq(groq, params, snapshot) {
+async function runGroq({
+  groq,
+  params,
+  snapshot
+}) {
   const tree = parse(groq, { params });
   return (await evaluate(tree, { dataset: snapshot.docs, params })).get();
 }
@@ -1157,15 +1272,19 @@ function derivePerspectiveFromFields(entries) {
 async function resolveDeclaredFields(args) {
   const { entryDefs, initialFields, ctx, randomKey: randomKey2 } = args;
   if (entryDefs === void 0 || entryDefs.length === 0) return [];
-  assertRequiredInputProvided(entryDefs, initialFields, ctx.definitionName);
+  assertRequiredInputProvided({ entryDefs, initialFields, definitionName: ctx.definitionName });
   const out = [];
   for (const entry of entryDefs) {
     const scopedCtx = { ...ctx, resolvedFields: out };
-    out.push(await resolveOneEntry(entry, initialFields, scopedCtx, randomKey2));
+    out.push(await resolveOneEntry({ entry, initialFields, ctx: scopedCtx, randomKey: randomKey2 }));
   }
   return out;
 }
-function assertRequiredInputProvided(entryDefs, initialFields, definitionName) {
+function assertRequiredInputProvided({
+  entryDefs,
+  initialFields,
+  definitionName
+}) {
   const missing = entryDefs.filter((entry) => entry.required === !0 && entry.initialValue?.type === "input").filter((entry) => {
     const match = initialFields.find((s) => s.name === entry.name && s.type === entry.type);
     return match === void 0 || match.value === void 0 || match.value === null;
@@ -1180,15 +1299,29 @@ const ARRAY_SLOT_TYPES = /* @__PURE__ */ new Set(["doc.refs", "array", "assignee
 function defaultEntryValue(entryType) {
   return ARRAY_SLOT_TYPES.has(entryType) ? [] : null;
 }
-function resolveInputValue(entry, initialFields, defaultValue) {
+function resolveInputValue({
+  entry,
+  initialFields,
+  defaultValue
+}) {
   const initMatch = initialFields.find((s) => s.name === entry.name && s.type === entry.type);
   return initMatch === void 0 ? defaultValue : (assertInputValueShape(entry, initMatch.value), initMatch.value);
 }
-function resolveFieldReadValue(source, ctx, defaultValue) {
+function resolveFieldReadValue({
+  source,
+  ctx,
+  defaultValue
+}) {
   const target = (source.scope === "workflow" ? ctx.workflowFields ?? [] : ctx.resolvedFields ?? []).find((s) => s.name === source.field), targetValue = target === void 0 ? void 0 : target.value;
   return (source.path !== void 0 ? getPath(targetValue, source.path) : targetValue) ?? defaultValue;
 }
-async function resolveQueryValue(entry, source, ctx, client, defaultValue) {
+async function resolveQueryValue({
+  entry,
+  source,
+  ctx,
+  client,
+  defaultValue
+}) {
   const params = paramsForLake({
     self: ctx.selfId ?? null,
     fields: fieldMapFromResolved(ctx.resolvedFields ?? []),
@@ -1199,19 +1332,30 @@ async function resolveQueryValue(entry, source, ctx, client, defaultValue) {
   });
   try {
     const fetchOptions = { perspective: ctx.perspective ?? DEFAULT_CONTENT_PERSPECTIVE }, result = await client.fetch(source.query, params, fetchOptions);
-    return normalizeQueryResult(entry.type, result, ctx.workflowResource) ?? defaultValue;
+    return normalizeQueryResult({
+      entryType: entry.type,
+      raw: result,
+      workflowResource: ctx.workflowResource
+    }) ?? defaultValue;
   } catch (err) {
-    throw new Error(
-      `Failed to resolve query entry "${entry.name}" (${entry.type}): ${err instanceof Error ? err.message : String(err)}`,
-      { cause: err }
-    );
+    rethrowWithContext(err, `Failed to resolve query entry "${entry.name}" (${entry.type})`);
   }
 }
-async function resolveEntryValue(entry, initialFields, ctx, defaultValue) {
+async function resolveEntryValue({
+  entry,
+  initialFields,
+  ctx,
+  defaultValue
+}) {
   const source = entry.initialValue;
-  return source === void 0 ? defaultValue : source.type === "input" ? resolveInputValue(entry, initialFields, defaultValue) : source.type === "literal" ? source.value ?? defaultValue : source.type === "fieldRead" ? resolveFieldReadValue(source, ctx, defaultValue) : source.type === "query" && ctx.client !== void 0 ? resolveQueryValue(entry, source, ctx, ctx.client, defaultValue) : defaultValue;
-}
-function buildResolvedEntry(entry, value, _key, now) {
+  return source === void 0 ? defaultValue : source.type === "input" ? resolveInputValue({ entry, initialFields, defaultValue }) : source.type === "literal" ? source.value ?? defaultValue : source.type === "fieldRead" ? resolveFieldReadValue({ source, ctx, defaultValue }) : source.type === "query" && ctx.client !== void 0 ? resolveQueryValue({ entry, source, ctx, client: ctx.client, defaultValue }) : defaultValue;
+}
+function buildResolvedEntry({
+  entry,
+  value,
+  _key,
+  now
+}) {
   return {
     _key,
     _type: entry.type,
@@ -1224,8 +1368,13 @@ function buildResolvedEntry(entry, value, _key, now) {
     ...entry.type === "array" ? { of: entry.of ?? [] } : {}
   };
 }
-async function resolveOneEntry(entry, initialFields, ctx, randomKey2) {
-  const defaultValue = defaultEntryValue(entry.type), value = await resolveEntryValue(entry, initialFields, ctx, defaultValue);
+async function resolveOneEntry({
+  entry,
+  initialFields,
+  ctx,
+  randomKey: randomKey2
+}) {
+  const defaultValue = defaultEntryValue(entry.type), value = await resolveEntryValue({ entry, initialFields, ctx, defaultValue });
   if (entry.initialValue?.type === "query") {
     const issues = checkFieldValue({
       entryType: entry.type,
@@ -1233,7 +1382,7 @@ async function resolveOneEntry(entry, initialFields, ctx, randomKey2) {
       fields: entry.fields,
       of: entry.of
     });
-    return issues !== void 0 ? (ctx.recordDiscard?.({ field: entry.name, detail: issues.join("; ") }), buildResolvedEntry(entry, defaultValue, randomKey2(), ctx.now)) : buildResolvedEntry(entry, value, randomKey2(), ctx.now);
+    return issues !== void 0 ? (ctx.recordDiscard?.({ field: entry.name, detail: issues.join("; ") }), buildResolvedEntry({ entry, value: defaultValue, _key: randomKey2(), now: ctx.now })) : buildResolvedEntry({ entry, value, _key: randomKey2(), now: ctx.now });
   }
   return validateFieldValue({
     entryType: entry.type,
@@ -1241,7 +1390,7 @@ async function resolveOneEntry(entry, initialFields, ctx, randomKey2) {
     value,
     fields: entry.fields,
     of: entry.of
-  }), buildResolvedEntry(entry, value, randomKey2(), ctx.now);
+  }), buildResolvedEntry({ entry, value, _key: randomKey2(), now: ctx.now });
 }
 function fieldMapFromResolved(entries) {
   const out = {};
@@ -1286,35 +1435,57 @@ function assertGdrShape(value, context) {
       `Invalid GDR for ${context}: \`type\` (schema name) must be a non-empty string. Got ${JSON.stringify(v2.type)}.`
     );
 }
-function normalizeQueryResult(entryType, raw, workflowResource) {
+function normalizeQueryResult({
+  entryType,
+  raw,
+  workflowResource
+}) {
   return raw == null ? raw : entryType === "doc.ref" ? coerceToGdr(raw, workflowResource) : entryType === "doc.refs" ? Array.isArray(raw) ? raw.map((item) => coerceToGdr(item, workflowResource)).filter((v2) => v2 !== null) : [] : raw;
 }
-function toGdrUri(docId, workflowResource) {
-  return isGdrUri(docId) ? docId : gdrFromResource(workflowResource, docId);
-}
 function coerceGdrShape(raw, workflowResource) {
   if (!("id" in raw) || !("type" in raw)) return null;
   const r = raw;
-  return typeof r.id != "string" || typeof r.type != "string" ? null : isGdrUri(r.id) ? { id: r.id, type: r.type } : workflowResource ? { id: gdrFromResource(workflowResource, r.id), type: r.type } : null;
+  return typeof r.id != "string" || typeof r.type != "string" ? null : isGdrUri(r.id) ? { id: r.id, type: r.type } : workflowResource ? { id: toPhysicalGdr(r.id, workflowResource), type: r.type } : null;
 }
 function coerceRefEnvelope(raw, workflowResource) {
   if (!("_ref" in raw)) return null;
   const r = raw;
-  return typeof r._ref != "string" || !workflowResource ? null : { id: toGdrUri(r._ref, workflowResource), type: "document" };
+  return typeof r._ref != "string" || !workflowResource ? null : { id: toPhysicalGdr(r._ref, workflowResource), type: "document" };
 }
 function coerceToGdr(raw, workflowResource) {
-  return raw == null ? null : typeof raw == "object" ? coerceGdrShape(raw, workflowResource) ?? coerceRefEnvelope(raw, workflowResource) : typeof raw == "string" && workflowResource ? { id: toGdrUri(raw, workflowResource), type: "document" } : null;
-}
-function gdrToBareId(uri) {
-  return uri.includes(":") ? extractDocumentId(uri) : uri;
-}
-function loadCallContext(client, instanceId, options) {
-  return loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {},
-    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
+  return raw == null ? null : typeof raw == "object" ? coerceGdrShape(raw, workflowResource) ?? coerceRefEnvelope(raw, workflowResource) : typeof raw == "string" && workflowResource ? { id: toPhysicalGdr(raw, workflowResource), type: "document" } : null;
+}
+function loadCallContext({
+  client,
+  instanceId,
+  options
+}) {
+  return loadContext({
+    client,
+    instanceId,
+    options: {
+      ...options?.clock ? { clock: options.clock } : {},
+      ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
+    }
   });
 }
-async function loadContext(client, instanceId, options) {
+async function retryOnRevisionConflict(args) {
+  const { client, instanceId, options, commit, onExhausted } = args;
+  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
+    const ctx = await loadCallContext({ client, instanceId, options });
+    try {
+      return await commit(ctx);
+    } catch (error) {
+      if (!isRevisionConflict(error)) throw error;
+    }
+  }
+  throw onExhausted();
+}
+async function loadContext({
+  client,
+  instanceId,
+  options
+}) {
   const instance = await client.getDocument(instanceId);
   if (!instance)
     throw new Error(`Workflow instance ${instanceId} not found`);
@@ -1329,12 +1500,21 @@ async function loadContext(client, instanceId, options) {
 async function ctxConditionParams(ctx, opts) {
   const base = buildParams({ instance: ctx.instance, now: ctx.now, snapshot: ctx.snapshot }), fields = {
     ...base.fields,
-    ...scopedFieldOverlay(ctx.instance, ctx.snapshot, opts?.activityName)
+    ...scopedFieldOverlay({
+      instance: ctx.instance,
+      snapshot: ctx.snapshot,
+      activityName: opts?.activityName
+    })
   }, params = {
     ...base,
     fields,
     actor: opts?.actor,
-    assigned: opts?.activityName !== void 0 ? assignedFor(ctx.instance, opts.activityName, opts?.actor, ctx.definition.roleAliases) : !1,
+    assigned: opts?.activityName !== void 0 ? assignedFor({
+      instance: ctx.instance,
+      activityName: opts.activityName,
+      actor: opts?.actor,
+      roleAliases: ctx.definition.roleAliases
+    }) : !1,
     ...opts?.vars
   };
   return { ...await evaluatePredicates({
@@ -1343,15 +1523,23 @@ async function ctxConditionParams(ctx, opts) {
     params
   }), ...params };
 }
-async function ctxEvaluateConditionOutcome(ctx, condition, opts) {
+async function ctxEvaluateConditionOutcome({
+  ctx,
+  condition,
+  opts
+}) {
   return condition === void 0 ? "satisfied" : evaluateConditionOutcome({
     condition,
     snapshot: ctx.snapshot,
     params: await ctxConditionParams(ctx, opts)
   });
 }
-async function ctxEvaluateCondition(ctx, condition, opts) {
-  return await ctxEvaluateConditionOutcome(ctx, condition, opts) === "satisfied";
+async function ctxEvaluateCondition({
+  ctx,
+  condition,
+  opts
+}) {
+  return await ctxEvaluateConditionOutcome({ ctx, condition, opts }) === "satisfied";
 }
 async function buildEngineContext(args) {
   const { client, clientForGdr, instance, definition } = args, clock = args.clock ?? wallClock;
@@ -1415,10 +1603,14 @@ async function resolveActivityFieldEntries(args) {
 async function resolveBindings(args) {
   const resolved = {};
   for (const [key, groq] of Object.entries(args.bindings ?? {}))
-    resolved[key] = await runGroq(groq, args.params, args.snapshot);
+    resolved[key] = await runGroq({ groq, params: args.params, snapshot: args.snapshot });
   return { ...resolved, ...args.staticInput };
 }
-async function reload(client, instanceId, tag) {
+async function reload({
+  client,
+  instanceId,
+  tag
+}) {
   const doc = await client.getDocument(instanceId);
   if (!doc)
     throw new Error(`Workflow instance ${instanceId} not found`);
@@ -1527,13 +1719,25 @@ async function persist(ctx, mutation) {
   const actorForPriming = void 0;
   for (const body of pendingCreates)
     try {
-      await primeInitialStage(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await cascadeAutoTransitions(
-        ctx.client,
-        body._id,
-        actorForPriming,
-        ctx.clientForGdr,
-        ctx.clock
-      ), await propagateToAncestors(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock);
+      await primeInitialStage({
+        client: ctx.client,
+        instanceId: body._id,
+        actor: actorForPriming,
+        clientForGdr: ctx.clientForGdr,
+        clock: ctx.clock
+      }), await cascadeAutoTransitions({
+        client: ctx.client,
+        instanceId: body._id,
+        actor: actorForPriming,
+        clientForGdr: ctx.clientForGdr,
+        clock: ctx.clock
+      }), await propagateToAncestors({
+        client: ctx.client,
+        instanceId: body._id,
+        actor: actorForPriming,
+        clientForGdr: ctx.clientForGdr,
+        clock: ctx.clock
+      });
     } catch (cause) {
       throw cause instanceof WorkflowStateDivergedError ? cause : new WorkflowStateDivergedError({
         instanceId: ctx.instance._id,
@@ -1577,159 +1781,16 @@ function findCurrentStageEntry(instance) {
 function findCurrentActivities(instance) {
   return findCurrentStageEntry(instance)?.activities ?? [];
 }
-async function deployOrRollback(args) {
-  try {
-    await args.deploy();
-  } catch (guardError) {
-    if (!args.reversible)
-      throw new WorkflowStateDivergedError({
-        instanceId: args.instanceId,
-        guardError,
-        reason: "the move created child instances a parent-only rollback cannot undo"
-      });
-    try {
-      let patch = args.client.patch(args.instanceId).set(args.restore);
-      args.unset && args.unset.length > 0 && (patch = patch.unset(args.unset)), args.committedRev !== void 0 && (patch = patch.ifRevisionId(args.committedRev)), await patch.commit(SYNC_COMMIT);
-    } catch (rollbackError) {
-      throw new WorkflowStateDivergedError({
-        instanceId: args.instanceId,
-        guardError,
-        rollbackError,
-        reason: "rollback of the committed move failed"
-      });
-    }
-    throw guardError instanceof PartialGuardDeployError ? new WorkflowStateDivergedError({
-      instanceId: args.instanceId,
-      guardError,
-      reason: "a multi-guard deploy partially applied; the rolled-back move left orphaned guard locks"
-    }) : guardError;
-  }
-}
-async function persistThenDeploy(ctx, mutation, deploy) {
-  const spawned = mutation.pendingCreates.length > 0, committed = await persist(ctx, mutation);
-  await deployOrRollback({
-    client: ctx.client,
-    instanceId: ctx.instance._id,
-    committedRev: committed._rev,
-    restore: instanceStateFields(ctx.instance),
-    unset: ctx.instance.completedAt === void 0 ? ["completedAt"] : [],
-    reversible: !spawned,
-    deploy
-  });
-}
-async function refreshStageGuards(ctx, mutation, stageName) {
-  await deployStageGuards({
-    client: ctx.client,
-    clientForGdr: ctx.clientForGdr,
-    instance: materializeInstance(ctx.instance, mutation),
-    definition: ctx.definition,
-    stageName,
-    now: ctx.now
-  });
-}
-async function completeEffect(args) {
-  const { client, instanceId, effectKey, status, outputs, detail, error, durationMs, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {},
-    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
-  });
-  return commitCompleteEffect(
-    ctx,
-    effectKey,
-    status,
-    outputs,
-    detail,
-    error,
-    durationMs,
-    options?.actor
-  );
-}
-function buildEffectHistoryEntry(pending, outcome) {
-  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
-  return {
-    _key: pending._key,
-    name: pending.name,
-    ...pending.title !== void 0 ? { title: pending.title } : {},
-    ...pending.description !== void 0 ? { description: pending.description } : {},
-    params: pending.params,
-    origin: pending.origin,
-    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
-    ranAt,
-    ...durationMs !== void 0 ? { durationMs } : {},
-    status,
-    ...detail !== void 0 ? { detail } : {},
-    ...error !== void 0 ? { error } : {},
-    ...outputs !== void 0 ? { outputs } : {}
-  };
-}
-function upsertEffectsContext(mutation, effectName, outputs) {
-  const existingIndex = mutation.effectsContext.findIndex((e) => e.name === effectName), entry = effectsContextJsonEntry(effectName, outputs);
-  existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
-}
-async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
-  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
-  if (pending === void 0)
-    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
-  const mutation = startMutation(ctx.instance);
-  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
-  const ranAt = ctx.now;
-  mutation.effectHistory.push(
-    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
-  );
-  const wroteEffectsContext = status === "done" && outputs !== void 0;
-  return wroteEffectsContext && upsertEffectsContext(mutation, pending.name, outputs), mutation.history.push({
-    _key: randomKey(),
-    _type: "effectCompleted",
-    at: ranAt,
-    effectKey,
-    effect: pending.name,
-    status,
-    ...outputs !== void 0 ? { outputs } : {},
-    ...detail !== void 0 ? { detail } : {},
-    ...actor !== void 0 ? { actor } : {}
-  }), await persistThenDeploy(
-    ctx,
-    mutation,
-    () => wroteEffectsContext ? refreshStageGuards(ctx, mutation, ctx.instance.currentStage) : Promise.resolve()
-  ), { effectKey, status };
-}
-function buildQueuedEffect(effect, origin, params, actor, now) {
-  const key = randomKey(), pending = {
-    _key: key,
-    _type: "pendingEffect",
-    name: effect.name,
-    ...effect.title !== void 0 ? { title: effect.title } : {},
-    ...effect.description !== void 0 ? { description: effect.description } : {},
-    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
-    params,
-    origin,
-    ...actor !== void 0 ? { actor } : {},
-    queuedAt: now
-  }, history = {
-    _key: randomKey(),
-    _type: "effectQueued",
-    at: now,
-    effectKey: key,
-    effect: effect.name,
-    origin
-  };
-  return { pending, history };
-}
-async function queueEffects(ctx, mutation, effects, origin, actor, opts) {
-  if (!effects || effects.length === 0) return;
-  const now = ctx.now, liveCtx = { ...ctx, instance: materializeInstance(ctx.instance, mutation) }, params = await ctxConditionParams(liveCtx, {
-    ...opts?.activityName !== void 0 ? { activityName: opts.activityName } : {},
-    ...actor !== void 0 ? { actor } : {},
-    // Caller-supplied action params, readable in bindings as `$params.<name>`.
-    vars: { params: opts?.callerParams ?? {} }
-  });
-  for (const effect of effects) {
-    const resolved = await resolveBindings({
-      bindings: effect.bindings,
-      staticInput: effect.input,
-      snapshot: ctx.snapshot,
-      params
-    }), { pending, history } = buildQueuedEffect(effect, origin, resolved, actor, now);
-    mutation.pendingEffects.push(pending), mutation.history.push(history);
+function resolveStaticValueExpr(src, ctx) {
+  switch (src.type) {
+    case "literal":
+      return src.value;
+    case "param":
+      return ctx.params?.[src.param];
+    case "actor":
+      return ctx.actor;
+    case "now":
+      return ctx.now;
   }
 }
 function fieldQueryDiscardedEntry(args) {
@@ -1742,7 +1803,11 @@ function fieldQueryDiscardedEntry(args) {
     detail: args.detail
   };
 }
-function recordFieldDiscards(target, scope, at) {
+function recordFieldDiscards({
+  target,
+  scope,
+  at
+}) {
   return (discard) => target.push(fieldQueryDiscardedEntry({ scope, field: discard.field, detail: discard.detail, at }));
 }
 function applyActivityStatusChange(args) {
@@ -1790,18 +1855,6 @@ function stageTransitionHistory(args) {
     }
   ];
 }
-function resolveStaticValueExpr(src, ctx) {
-  switch (src.type) {
-    case "literal":
-      return src.value;
-    case "param":
-      return ctx.params?.[src.param];
-    case "actor":
-      return ctx.actor;
-    case "now":
-      return ctx.now;
-  }
-}
 const FIELD_OP_TYPES = [
   "field.set",
   "field.unset",
@@ -1812,7 +1865,11 @@ const FIELD_OP_TYPES = [
 function isFieldOp(summary) {
   return FIELD_OP_TYPES.includes(summary.opType);
 }
-function validateActionParams(action, activityName, callerParams) {
+function validateActionParams({
+  action,
+  activityName,
+  callerParams
+}) {
   const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
   for (const decl of declared) {
     const value = params[decl.name], present = decl.name in params && value !== void 0 && value !== null;
@@ -1847,7 +1904,7 @@ function checkParamType(value, decl) {
     case "doc.ref":
       return hasStringField(value, "id");
     case "doc.refs":
-      return Array.isArray(value) && value.every((v2) => checkParamType(v2, { type: "doc.ref" }));
+      return Array.isArray(value) && value.every((ref) => checkParamType(ref, { type: "doc.ref" }));
     case "json":
       return !0;
     default:
@@ -1883,12 +1940,27 @@ function opAppliedEntry(args) {
     ...origin.action !== void 0 ? { action: origin.action } : {},
     ...origin.transition !== void 0 ? { transition: origin.transition } : {},
     ...origin.edit === !0 ? { edit: !0 } : {},
+    ...origin.effect !== void 0 ? { effect: origin.effect } : {},
     opType: summary.opType,
     ...summary.target !== void 0 ? { target: summary.target } : {},
     ...summary.resolved !== void 0 ? { resolved: summary.resolved } : {},
     ...actor !== void 0 ? { actor } : {}
   };
 }
+function validateEffectOps(ops, effectName) {
+  const result = v.safeParse(v.array(StoredFieldOpSchema), ops);
+  if (!result.success)
+    throw new EffectOpsInvalidError({ effect: effectName, issues: formatIssues(result.issues) });
+  const activityScoped = result.output.find((op) => op.target.scope === "activity");
+  if (activityScoped !== void 0)
+    throw new EffectOpsInvalidError({
+      effect: effectName,
+      issues: [
+        `${activityScoped.type} targets an activity-scope field \u2014 an effect's completion ops write workflow- or stage-scope fields`
+      ]
+    });
+  return result.output;
+}
 function applyOp(op, ctx) {
   switch (op.type) {
     case "field.set":
@@ -1944,7 +2016,7 @@ function applyFieldUpdateWhere(op, ctx) {
   return setEntryValue(
     entry,
     rows.map(
-      (row) => evalOpPredicate(op.where, row, ctx) ? { ...row, ...merge } : row
+      (row) => evalOpPredicate({ p: op.where, row, ctx }) ? { ...row, ...merge } : row
     )
   ), { opType: op.type, target: op.target, resolved: { merge } };
 }
@@ -1952,7 +2024,7 @@ function applyFieldRemoveWhere(op, ctx) {
   const entry = locateEntry(ctx, op.target), rows = requireArrayValue(entry, op);
   return setEntryValue(
     entry,
-    rows.filter((row) => !evalOpPredicate(op.where, row, ctx))
+    rows.filter((row) => !evalOpPredicate({ p: op.where, row, ctx }))
   ), { opType: op.type, target: op.target };
 }
 function requireArrayValue(entry, op) {
@@ -1963,7 +2035,7 @@ function requireArrayValue(entry, op) {
   return entry.value;
 }
 function applyStatusSet(op, ctx) {
-  const entry = findOpenStageEntry(ctx.mutation)?.activities.find((t) => t.name === op.activity);
+  const entry = findCurrentActivityEntry(ctx.mutation, op.activity);
   if (entry === void 0)
     throw new Error(
       `status.set targets activity "${op.activity}" which has no entry in the open stage`
@@ -2018,24 +2090,247 @@ function resolveOpValue(src, ctx) {
     }
   }
 }
-function entryValue(entries, name) {
-  return entries?.find((s) => s.name === name)?.value;
+function entryValue(entries, name) {
+  return entries?.find((s) => s.name === name)?.value;
+}
+function readEntryFromMutation(ctx, src) {
+  const scopes = src.scope !== void 0 ? [src.scope] : ["stage", "workflow"], stageEntry = findOpenStageEntry(ctx.mutation);
+  for (const scope of scopes) {
+    const host = scope === "workflow" ? ctx.mutation.fields : stageEntry?.fields, value = entryValue(host, src.field);
+    if (value !== void 0) return value;
+  }
+}
+function evalOpPredicate({
+  p,
+  row,
+  ctx
+}) {
+  switch (p.type) {
+    case "all":
+      return p.of.every((sub) => evalOpPredicate({ p: sub, row, ctx }));
+    case "any":
+      return p.of.some((sub) => evalOpPredicate({ p: sub, row, ctx }));
+    case "field":
+      return row[p.field] === resolveOpValue(p.equals, ctx);
+  }
+}
+async function deployOrRollback(args) {
+  try {
+    await args.deploy();
+  } catch (guardError) {
+    if (!args.reversible)
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        reason: "the move created child instances a parent-only rollback cannot undo"
+      });
+    try {
+      let patch = args.client.patch(args.instanceId).set(args.restore);
+      args.unset && args.unset.length > 0 && (patch = patch.unset(args.unset)), args.committedRev !== void 0 && (patch = patch.ifRevisionId(args.committedRev)), await patch.commit(SYNC_COMMIT);
+    } catch (rollbackError) {
+      throw new WorkflowStateDivergedError({
+        instanceId: args.instanceId,
+        guardError,
+        rollbackError,
+        reason: "rollback of the committed move failed"
+      });
+    }
+    throw guardError instanceof PartialGuardDeployError ? new WorkflowStateDivergedError({
+      instanceId: args.instanceId,
+      guardError,
+      reason: "a multi-guard deploy partially applied; the rolled-back move left orphaned guard locks"
+    }) : guardError;
+  }
+}
+async function persistThenDeploy({
+  ctx,
+  mutation,
+  deploy
+}) {
+  const spawned = mutation.pendingCreates.length > 0, committed = await persist(ctx, mutation);
+  await deployOrRollback({
+    client: ctx.client,
+    instanceId: ctx.instance._id,
+    committedRev: committed._rev,
+    restore: instanceStateFields(ctx.instance),
+    unset: ctx.instance.completedAt === void 0 ? ["completedAt"] : [],
+    reversible: !spawned,
+    deploy
+  });
+}
+async function persistThenMaybeRefresh({
+  ctx,
+  mutation,
+  stageName,
+  didChangeState
+}) {
+  await persistThenDeploy({
+    ctx,
+    mutation,
+    deploy: () => didChangeState ? refreshStageGuards({ ctx, mutation, stageName }) : Promise.resolve()
+  });
+}
+async function refreshStageGuards({
+  ctx,
+  mutation,
+  stageName
+}) {
+  await deployStageGuards({
+    client: ctx.client,
+    clientForGdr: ctx.clientForGdr,
+    instance: materializeInstance(ctx.instance, mutation),
+    definition: ctx.definition,
+    stageName,
+    now: ctx.now
+  });
+}
+async function completeEffect(args) {
+  const { client, instanceId, effectKey, status, outputs, ops, detail, error, durationMs, options } = args, ctx = await loadCallContext({ client, instanceId, options });
+  return commitCompleteEffect({
+    ctx,
+    effectKey,
+    status,
+    outputs,
+    ops,
+    detail,
+    error,
+    durationMs,
+    actor: options?.actor
+  });
+}
+function buildEffectHistoryEntry(pending, outcome) {
+  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
+  return {
+    _key: pending._key,
+    name: pending.name,
+    ...pending.title !== void 0 ? { title: pending.title } : {},
+    ...pending.description !== void 0 ? { description: pending.description } : {},
+    params: pending.params,
+    origin: pending.origin,
+    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
+    ranAt,
+    ...durationMs !== void 0 ? { durationMs } : {},
+    status,
+    ...detail !== void 0 ? { detail } : {},
+    ...error !== void 0 ? { error } : {},
+    ...outputs !== void 0 ? { outputs } : {}
+  };
 }
-function readEntryFromMutation(ctx, src) {
-  const scopes = src.scope !== void 0 ? [src.scope] : ["stage", "workflow"], stageEntry = findOpenStageEntry(ctx.mutation);
-  for (const scope of scopes) {
-    const host = scope === "workflow" ? ctx.mutation.fields : stageEntry?.fields, value = entryValue(host, src.field);
-    if (value !== void 0) return value;
-  }
+function upsertEffectsContext({
+  mutation,
+  effectName,
+  outputs
+}) {
+  const existingIndex = mutation.effectsContext.findIndex((e) => e.name === effectName), entry = effectsContextJsonEntry(effectName, outputs);
+  existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
 }
-function evalOpPredicate(p, row, ctx) {
-  switch (p.type) {
-    case "all":
-      return p.of.every((sub) => evalOpPredicate(sub, row, ctx));
-    case "any":
-      return p.of.some((sub) => evalOpPredicate(sub, row, ctx));
-    case "field":
-      return row[p.field] === resolveOpValue(p.equals, ctx);
+async function commitCompleteEffect({
+  ctx,
+  effectKey,
+  status,
+  outputs,
+  ops,
+  detail,
+  error,
+  durationMs,
+  actor
+}) {
+  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
+  if (pending === void 0)
+    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
+  if (status === "failed" && ops !== void 0 && ops.length > 0)
+    throw new EffectOpsInvalidError({
+      effect: pending.name,
+      issues: [
+        "ops cannot accompany a failed completion \u2014 field.set the outcome on a done completion instead"
+      ]
+    });
+  const validatedOps = ops !== void 0 ? validateEffectOps(ops, pending.name) : [], mutation = startMutation(ctx.instance);
+  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
+  const ranAt = ctx.now;
+  mutation.effectHistory.push(
+    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
+  );
+  const wroteEffectsContext = status === "done" && outputs !== void 0;
+  wroteEffectsContext && upsertEffectsContext({ mutation, effectName: pending.name, outputs }), mutation.history.push({
+    _key: randomKey(),
+    _type: "effectCompleted",
+    at: ranAt,
+    effectKey,
+    effect: pending.name,
+    status,
+    ...outputs !== void 0 ? { outputs } : {},
+    ...detail !== void 0 ? { detail } : {},
+    ...actor !== void 0 ? { actor } : {}
+  });
+  const ranOps = runOps({
+    ops: validatedOps,
+    mutation,
+    stage: ctx.instance.currentStage,
+    origin: { effect: pending.name },
+    params: pending.params,
+    actor,
+    self: selfGdr(ctx.instance),
+    now: ranAt
+  }), needsGuardRefresh = wroteEffectsContext || ranOps.some(isFieldOp);
+  return await persistThenMaybeRefresh({
+    ctx,
+    mutation,
+    stageName: ctx.instance.currentStage,
+    didChangeState: needsGuardRefresh
+  }), { effectKey, status };
+}
+function buildQueuedEffect({
+  effect,
+  origin,
+  params,
+  actor,
+  now
+}) {
+  const key = randomKey(), pending = {
+    _key: key,
+    _type: "pendingEffect",
+    name: effect.name,
+    ...effect.title !== void 0 ? { title: effect.title } : {},
+    ...effect.description !== void 0 ? { description: effect.description } : {},
+    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
+    params,
+    origin,
+    ...actor !== void 0 ? { actor } : {},
+    queuedAt: now
+  }, history = {
+    _key: randomKey(),
+    _type: "effectQueued",
+    at: now,
+    effectKey: key,
+    effect: effect.name,
+    origin
+  };
+  return { pending, history };
+}
+async function queueEffects({
+  ctx,
+  mutation,
+  effects,
+  origin,
+  actor,
+  opts
+}) {
+  if (!effects || effects.length === 0) return;
+  const now = ctx.now, liveCtx = { ...ctx, instance: materializeInstance(ctx.instance, mutation) }, params = await ctxConditionParams(liveCtx, {
+    ...opts?.activityName !== void 0 ? { activityName: opts.activityName } : {},
+    ...actor !== void 0 ? { actor } : {},
+    // Caller-supplied action params, readable in bindings as `$params.<name>`.
+    vars: { params: opts?.callerParams ?? {} }
+  });
+  for (const effect of effects) {
+    const resolved = await resolveBindings({
+      bindings: effect.bindings,
+      staticInput: effect.input,
+      snapshot: ctx.snapshot,
+      params
+    }), { pending, history } = buildQueuedEffect({ effect, origin, params: resolved, actor, now });
+    mutation.pendingEffects.push(pending), mutation.history.push(history);
   }
 }
 const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
@@ -2056,13 +2351,14 @@ async function discoverItems(args) {
   const { client, groq, params, perspective } = args, fetchOptions = perspective !== void 0 ? { perspective } : void 0;
   return client.fetch(groq, paramsForLake(params), fetchOptions);
 }
-function clientForDiscovery(defaultClient, clientForGdr, subjectGdrUri) {
-  if (!subjectGdrUri || !subjectGdrUri.includes(":")) return defaultClient;
-  try {
-    return clientForGdr(parseGdr(subjectGdrUri));
-  } catch {
-    return defaultClient;
-  }
+function clientForDiscovery({
+  defaultClient,
+  clientForGdr,
+  subjectGdrUri
+}) {
+  if (subjectGdrUri === void 0) return defaultClient;
+  const parsed = tryParseGdr(subjectGdrUri);
+  return parsed !== void 0 ? clientForGdr(parsed) : defaultClient;
 }
 const ENGINE_ACTOR_ID_PREFIX = "engine.";
 function engineSystemActor(name) {
@@ -2075,25 +2371,49 @@ const MAX_SPAWN_DEPTH = 6, SUBWORKFLOWS_ALL_DONE = "count($subworkflows[status !
 function gateActor(outcome) {
   return engineSystemActor(outcome === "failed" ? "failWhen" : "completeWhen");
 }
+function applyGateOutcome(args) {
+  applyActivityStatusChange({
+    entry: args.entry,
+    history: args.history,
+    stage: args.stage,
+    to: args.outcome,
+    at: args.at,
+    actor: gateActor(args.outcome)
+  });
+}
 function effectiveCompleteWhen(activity) {
   return activity.completeWhen ?? (activity.subworkflows !== void 0 ? SUBWORKFLOWS_ALL_DONE : void 0);
 }
-async function evaluateResolutionGate(ctx, activity, vars) {
+async function evaluateResolutionGate({
+  ctx,
+  activity,
+  vars
+}) {
   const scope = { activityName: activity.name, vars };
-  if (activity.failWhen !== void 0 && await ctxEvaluateCondition(ctx, activity.failWhen, scope))
+  if (activity.failWhen !== void 0 && await ctxEvaluateCondition({ ctx, condition: activity.failWhen, opts: scope }))
     return "failed";
   const completeWhen = effectiveCompleteWhen(activity);
-  if (completeWhen !== void 0 && await ctxEvaluateCondition(ctx, completeWhen, scope))
+  if (completeWhen !== void 0 && await ctxEvaluateCondition({ ctx, condition: completeWhen, opts: scope }))
     return "done";
 }
-async function spawnSubworkflows(ctx, mutation, activity, sub, actor) {
+async function spawnSubworkflows({
+  ctx,
+  mutation,
+  activity,
+  sub,
+  actor
+}) {
   if (ctx.instance.ancestors.length + 1 > MAX_SPAWN_DEPTH) {
     const chain = [...ctx.instance.ancestors.map((a) => a.id), selfGdr(ctx.instance)].join(" \u2192 ");
     throw new Error(
       `Subworkflow depth limit (${MAX_SPAWN_DEPTH}) exceeded on activity "${activity.name}" of ${ctx.instance._id}. Ancestor chain: ${chain}`
     );
   }
-  const now = ctx.now, definition = await resolveDefinitionRef(ctx.client, sub.definition, ctx.instance.tag);
+  const now = ctx.now, definition = await resolveDefinitionRef({
+    client: ctx.client,
+    ref: sub.definition,
+    tag: ctx.instance.tag
+  });
   if (definition === null) {
     const versionLabel = sub.definition.version === void 0 || sub.definition.version === "latest" ? "latest" : `v${sub.definition.version}`;
     throw new Error(
@@ -2103,16 +2423,16 @@ async function spawnSubworkflows(ctx, mutation, activity, sub, actor) {
   const parentScope = await ctxConditionParams(ctx, {
     activityName: activity.name,
     ...actor ? { actor } : {}
-  }), { rows, discoveryResource } = await resolveSpawnRows(ctx, sub), effectsContext = await resolveContextHandoff(ctx, sub, parentScope), refs = [];
+  }), { rows, discoveryResource } = await resolveSpawnRows(ctx, sub), effectsContext = await resolveContextHandoff({ ctx, sub, parentScope }), refs = [];
   for (const row of rows) {
-    const initialFields = await projectRowFields(
+    const initialFields = await projectRowFields({
       ctx,
       sub,
-      definition,
+      childDefinition: definition,
       parentScope,
       row,
       discoveryResource
-    ), { ref, body } = await prepareChildInstance({
+    }), { ref, body } = await prepareChildInstance({
       client: ctx.client,
       parent: ctx.instance,
       definition,
@@ -2129,7 +2449,11 @@ async function resolveSpawnRows(ctx, sub) {
   const params = buildParams({ instance: ctx.instance, now: ctx.now, snapshot: ctx.snapshot }), groq = sub.forEach;
   let value, discoveryResource;
   if (groq.includes("*")) {
-    const routingUri = entrySubjectRefs(ctx.instance.fields)[0]?.id, client = clientForDiscovery(ctx.client, ctx.clientForGdr, routingUri);
+    const routingUri = entrySubjectRefs(ctx.instance.fields)[0]?.id, client = clientForDiscovery({
+      defaultClient: ctx.client,
+      clientForGdr: ctx.clientForGdr,
+      subjectGdrUri: routingUri
+    });
     client !== ctx.client && routingUri !== void 0 && (discoveryResource = resourceFromGdrUri(routingUri)), value = await discoverItems({
       client,
       groq,
@@ -2145,7 +2469,14 @@ async function resolveSpawnRows(ctx, sub) {
   }
   return Array.isArray(value) ? { rows: value, discoveryResource } : value == null ? { rows: [], discoveryResource } : { rows: [value], discoveryResource };
 }
-async function projectRowFields(ctx, sub, childDefinition, parentScope, row, discoveryResource) {
+async function projectRowFields({
+  ctx,
+  sub,
+  childDefinition,
+  parentScope,
+  row,
+  discoveryResource
+}) {
   const out = [];
   for (const [name, groq] of Object.entries(sub.with ?? {})) {
     const declared = (childDefinition.fields ?? []).find((e) => e.name === name);
@@ -2153,11 +2484,15 @@ async function projectRowFields(ctx, sub, childDefinition, parentScope, row, dis
       throw new Error(
         `subworkflows.with["${name}"]: subworkflow "${childDefinition.name}" declares no field entry "${name}"`
       );
-    const raw = await runGroq(groq, { ...parentScope, row }, ctx.snapshot), value = canonicaliseSpawnValue(declared.type, raw, {
-      parentResource: ctx.instance.workflowResource,
-      discoveryResource,
-      entryName: name,
-      childName: childDefinition.name
+    const raw = await runGroq({ groq, params: { ...parentScope, row }, snapshot: ctx.snapshot }), value = canonicaliseSpawnValue({
+      kind: declared.type,
+      value: raw,
+      cx: {
+        parentResource: ctx.instance.workflowResource,
+        discoveryResource,
+        entryName: name,
+        childName: childDefinition.name
+      }
     });
     value != null && out.push({
       type: declared.type,
@@ -2167,15 +2502,23 @@ async function projectRowFields(ctx, sub, childDefinition, parentScope, row, dis
   }
   return out;
 }
-async function resolveContextHandoff(ctx, sub, parentScope) {
+async function resolveContextHandoff({
+  ctx,
+  sub,
+  parentScope
+}) {
   const out = {};
   for (const [name, groq] of Object.entries(sub.context ?? {})) {
-    const v2 = await runGroq(groq, parentScope, ctx.snapshot);
+    const v2 = await runGroq({ groq, params: parentScope, snapshot: ctx.snapshot });
     v2 != null && (typeof v2 == "string" || typeof v2 == "number" || typeof v2 == "boolean" || typeof v2 == "object" && "id" in v2 && "type" in v2) && (out[name] = v2);
   }
   return out;
 }
-function canonicaliseSpawnValue(kind, value, cx) {
+function canonicaliseSpawnValue({
+  kind,
+  value,
+  cx
+}) {
   return kind === "doc.ref" ? coerceSpawnGdr(value, cx) : kind === "doc.refs" && Array.isArray(value) ? value.map((v2) => coerceSpawnGdr(v2, cx)).filter((v2) => v2 !== null) : value;
 }
 function assertBareIdRootsCorrectly(id, cx) {
@@ -2198,7 +2541,11 @@ function coerceSpawnGdr(raw, cx) {
   }
   return typeof raw == "string" && raw.length > 0 ? { id: toUri(raw), type: "document" } : null;
 }
-async function resolveDefinitionRef(client, ref, tag) {
+async function resolveDefinitionRef({
+  client,
+  ref,
+  tag
+}) {
   const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, tag };
   return wantsExplicit && (params.version = ref.version), await client.fetch(
     definitionLookupGroq(wantsExplicit),
@@ -2206,7 +2553,7 @@ async function resolveDefinitionRef(client, ref, tag) {
   ) ?? null;
 }
 async function prepareChildInstance(args) {
-  const { client, parent, definition, initialFields, effectsContext, actor, now } = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = `${childTag}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
+  const { client, parent, definition, initialFields, effectsContext, actor, now } = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
     ...parent.ancestors,
     {
       id: selfGdr(parent),
@@ -2223,7 +2570,7 @@ async function prepareChildInstance(args) {
       workflowResource,
       definitionName: definition.name,
       ...inheritedPerspective !== void 0 ? { perspective: inheritedPerspective } : {},
-      recordDiscard: recordFieldDiscards(fieldDiscards, "workflow", now)
+      recordDiscard: recordFieldDiscards({ target: fieldDiscards, scope: "workflow", at: now })
     },
     randomKey
   }), childPerspective = derivePerspectiveFromFields(childFields) ?? inheritedPerspective, effectsContextEntries = Object.entries(effectsContext).map(
@@ -2258,7 +2605,7 @@ async function prepareChildInstance(args) {
 }
 async function subworkflowRows(ctx, refs) {
   if (refs.length === 0) return [];
-  const ids = refs.map((r) => gdrToBareId(r.id));
+  const ids = refs.map((r) => toBareId(r.id));
   return (await ctx.client.fetch("*[_id in $ids]{_id, currentStage, completedAt}", { ids })).map((c) => ({
     _id: c._id,
     stage: c.currentStage,
@@ -2266,13 +2613,14 @@ async function subworkflowRows(ctx, refs) {
   }));
 }
 async function invokeActivity(args) {
-  const { client, instanceId, activity: activityName, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {},
-    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
-  });
-  return commitInvoke(ctx, activityName, options?.actor);
-}
-async function commitInvoke(ctx, activityName, actor) {
+  const { client, instanceId, activity: activityName, options } = args, ctx = await loadCallContext({ client, instanceId, options });
+  return commitInvoke({ ctx, activityName, actor: options?.actor });
+}
+async function commitInvoke({
+  ctx,
+  activityName,
+  actor
+}) {
   const { activity } = findActivityInCurrentStage(ctx, activityName), entry = findCurrentActivities(ctx.instance).find((t) => t.name === activityName);
   if (entry === void 0)
     throw new Error(
@@ -2281,9 +2629,15 @@ async function commitInvoke(ctx, activityName, actor) {
   if (entry.status !== "pending")
     return { invoked: !1, activity: activityName };
   const mutation = startMutation(ctx.instance), mutEntry = requireMutationActivityEntry(mutation, activityName);
-  return await activateActivity(ctx, mutation, activity, mutEntry, actor), await persist(ctx, mutation), { invoked: !0, activity: activityName };
-}
-async function activateActivity(ctx, mutation, activity, entry, actor) {
+  return await activateActivity({ ctx, mutation, activity, entry: mutEntry, actor }), await persist(ctx, mutation), { invoked: !0, activity: activityName };
+}
+async function activateActivity({
+  ctx,
+  mutation,
+  activity,
+  entry,
+  actor
+}) {
   const now = ctx.now;
   if (entry.status = "active", entry.startedAt = now, activity.fields !== void 0 && activity.fields.length > 0) {
     const stage = findStage(ctx.definition, mutation.currentStage);
@@ -2293,7 +2647,7 @@ async function activateActivity(ctx, mutation, activity, entry, actor) {
       stage,
       activity,
       now,
-      recordDiscard: recordFieldDiscards(mutation.history, "activity", now)
+      recordDiscard: recordFieldDiscards({ target: mutation.history, scope: "activity", at: now })
     });
   }
   runOps({
@@ -2312,19 +2666,25 @@ async function activateActivity(ctx, mutation, activity, entry, actor) {
     stage: mutation.currentStage,
     activity: activity.name,
     ...actor !== void 0 ? { actor } : {}
-  }), await queueEffects(
+  }), await queueEffects({
     ctx,
     mutation,
-    activity.effects,
-    { kind: "activity", name: activity.name },
+    effects: activity.effects,
+    origin: { kind: "activity", name: activity.name },
     actor,
-    {
+    opts: {
       activityName: activity.name
     }
-  );
+  });
   let pendingChildren;
   if (activity.subworkflows !== void 0) {
-    const createsBefore = mutation.pendingCreates.length, refs = await spawnSubworkflows(ctx, mutation, activity, activity.subworkflows, actor);
+    const createsBefore = mutation.pendingCreates.length, refs = await spawnSubworkflows({
+      ctx,
+      mutation,
+      activity,
+      sub: activity.subworkflows,
+      actor
+    });
     entry.spawnedInstances = refs, pendingChildren = mutation.pendingCreates.slice(createsBefore).map((c) => ({ _id: c._id, stage: c.currentStage, status: "active" }));
     for (const ref of refs)
       mutation.history.push({
@@ -2335,24 +2695,42 @@ async function activateActivity(ctx, mutation, activity, entry, actor) {
         instanceRef: ref
       });
   }
-  await autoResolveOnActivate(ctx, mutation, activity, entry, now, pendingChildren) || resolveMachineStep(mutation, activity, entry, now);
-}
-async function autoResolveOnActivate(ctx, mutation, activity, entry, now, pendingChildren) {
+  await autoResolveOnActivate({
+    ctx,
+    mutation,
+    activity,
+    entry,
+    now,
+    ...pendingChildren !== void 0 ? { pendingChildren } : {}
+  }) || resolveMachineStep({ mutation, activity, entry, now });
+}
+async function autoResolveOnActivate({
+  ctx,
+  mutation,
+  activity,
+  entry,
+  now,
+  pendingChildren
+}) {
   if (activity.failWhen === void 0 && effectiveCompleteWhen(activity) === void 0) return !1;
-  const vars = pendingChildren !== void 0 ? { subworkflows: pendingChildren } : await activityConditionVars(ctx, entry), outcome = await evaluateResolutionGate(ctx, activity, vars);
-  return outcome === void 0 ? !1 : (applyActivityStatusChange({
+  const vars = pendingChildren !== void 0 ? { subworkflows: pendingChildren } : await activityConditionVars(ctx, entry), outcome = await evaluateResolutionGate({ ctx, activity, vars });
+  return outcome === void 0 ? !1 : (applyGateOutcome({
     entry,
     history: mutation.history,
     stage: mutation.currentStage,
-    to: outcome,
     at: now,
-    actor: gateActor(outcome)
+    outcome
   }), !0);
 }
 async function activityConditionVars(ctx, entry) {
   return entry.spawnedInstances === void 0 || entry.spawnedInstances.length === 0 ? { subworkflows: [] } : { subworkflows: await subworkflowRows(ctx, entry.spawnedInstances) };
 }
-function resolveMachineStep(mutation, activity, entry, now) {
+function resolveMachineStep({
+  mutation,
+  activity,
+  entry,
+  now
+}) {
   const waitsForActor = activity.actions !== void 0 && activity.actions.length > 0, waitsForCondition = activity.completeWhen !== void 0 || activity.subworkflows !== void 0;
   waitsForActor || waitsForCondition || applyActivityStatusChange({
     entry,
@@ -2366,19 +2744,25 @@ function resolveMachineStep(mutation, activity, entry, now) {
 async function buildStageActivities(ctx, stage) {
   const entries = [];
   for (const activity of stage.activities ?? []) {
-    const outcome = await ctxEvaluateConditionOutcome(ctx, activity.filter, {
-      activityName: activity.name
+    const outcome = await ctxEvaluateConditionOutcome({
+      ctx,
+      condition: activity.filter,
+      opts: { activityName: activity.name }
     }), inScope = outcome !== "unsatisfied";
     entries.push({
       _key: randomKey(),
       name: activity.name,
       status: inScope ? "pending" : "skipped",
-      ...activity.filter !== void 0 ? { filterEvaluation: buildFilterEvaluation(ctx.now, activity.filter, outcome) } : {}
+      ...activity.filter !== void 0 ? { filterEvaluation: buildFilterEvaluation({ at: ctx.now, filter: activity.filter, outcome }) } : {}
     });
   }
   return entries;
 }
-function buildFilterEvaluation(at, filter, outcome) {
+function buildFilterEvaluation({
+  at,
+  filter,
+  outcome
+}) {
   return outcome === "unevaluable" ? {
     at,
     truthy: !1,
@@ -2390,13 +2774,16 @@ function isTerminalStage(stage) {
   return (stage.transitions ?? []).length === 0;
 }
 async function setStage(args) {
-  const { client, instanceId, targetStage, reason, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {},
-    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
-  });
-  return commitSetStage(ctx, targetStage, reason, options?.actor);
-}
-async function enterStage(ctx, mutation, nextStage, actor, at) {
+  const { client, instanceId, targetStage, reason, options } = args, ctx = await loadCallContext({ client, instanceId, options });
+  return commitSetStage({ ctx, targetStage, reason, actor: options?.actor });
+}
+async function enterStage({
+  ctx,
+  mutation,
+  nextStage,
+  actor,
+  at
+}) {
   mutation.currentStage = nextStage.name;
   const nextStageEntry = {
     _key: randomKey(),
@@ -2407,7 +2794,7 @@ async function enterStage(ctx, mutation, nextStage, actor, at) {
       instance: ctx.instance,
       stage: nextStage,
       now: at,
-      recordDiscard: recordFieldDiscards(mutation.history, "stage", at)
+      recordDiscard: recordFieldDiscards({ target: mutation.history, scope: "stage", at })
     }),
     activities: await buildStageActivities(ctx, nextStage)
   };
@@ -2415,14 +2802,19 @@ async function enterStage(ctx, mutation, nextStage, actor, at) {
   for (const activity of nextStage.activities ?? []) {
     if (activity.activation !== "auto") continue;
     const entry = nextStageEntry.activities.find((t) => t.name === activity.name);
-    entry && entry.status === "pending" && await activateActivity(ctx, mutation, activity, entry, actor);
+    entry && entry.status === "pending" && await activateActivity({ ctx, mutation, activity, entry, actor });
   }
   isTerminalStage(nextStage) && (mutation.completedAt = at);
 }
 function isTerminal(ctx) {
   return ctx.instance.completedAt !== void 0;
 }
-async function commitSetStage(ctx, targetStage, reason, actor) {
+async function commitSetStage({
+  ctx,
+  targetStage,
+  reason,
+  actor
+}) {
   if (isTerminal(ctx))
     return { fired: !1 };
   const currentStage = findStage(ctx.definition, ctx.instance.currentStage), nextStage = findStage(ctx.definition, targetStage);
@@ -2441,18 +2833,28 @@ async function commitSetStage(ctx, targetStage, reason, actor) {
     })
   );
   const priorEntry = findOpenStageEntry(mutation);
-  return priorEntry !== void 0 && (priorEntry.exitedAt = at), await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.name, nextStage.name), {
+  return priorEntry !== void 0 && (priorEntry.exitedAt = at), await enterStage({ ctx, mutation, nextStage, actor, at }), await persistStageMove({
+    ctx,
+    mutation,
+    exitedStage: currentStage.name,
+    enteredStage: nextStage.name
+  }), {
     fired: !0,
     fromStage: currentStage.name,
     toStage: nextStage.name,
     transition: transitionName
   };
 }
-async function persistStageMove(ctx, mutation, exitedStage, enteredStage) {
-  await persistThenDeploy(
+async function persistStageMove({
+  ctx,
+  mutation,
+  exitedStage,
+  enteredStage
+}) {
+  await persistThenDeploy({
     ctx,
     mutation,
-    () => deployStageGuards({
+    deploy: () => deployStageGuards({
       client: ctx.client,
       clientForGdr: ctx.clientForGdr,
       instance: materializeInstance(ctx.instance, mutation),
@@ -2460,7 +2862,7 @@ async function persistStageMove(ctx, mutation, exitedStage, enteredStage) {
       stageName: enteredStage,
       now: ctx.now
     })
-  ), await retractStageGuards({
+  }), await retractStageGuards({
     client: ctx.client,
     clientForGdr: ctx.clientForGdr,
     instance: ctx.instance,
@@ -2485,16 +2887,16 @@ async function commitTransition(ctx, actor) {
     actor,
     self: selfGdr(ctx.instance),
     now: at
-  }), await queueEffects(
+  }), await queueEffects({
     ctx,
     mutation,
-    transition.effects,
-    {
+    effects: transition.effects,
+    origin: {
       kind: "transition",
       name: transition.name
     },
     actor
-  ), mutation.history.push(
+  }), mutation.history.push(
     ...stageTransitionHistory({
       fromStage: currentStage.name,
       toStage: transition.to,
@@ -2506,7 +2908,12 @@ async function commitTransition(ctx, actor) {
   const priorEntry = findOpenStageEntry(mutation);
   priorEntry !== void 0 && (priorEntry.exitedAt = at);
   const nextStage = findStage(ctx.definition, transition.to);
-  return await enterStage(ctx, mutation, nextStage, actor, at), await persistStageMove(ctx, mutation, currentStage.name, nextStage.name), {
+  return await enterStage({ ctx, mutation, nextStage, actor, at }), await persistStageMove({
+    ctx,
+    mutation,
+    exitedStage: currentStage.name,
+    enteredStage: nextStage.name
+  }), {
     fired: !0,
     fromStage: currentStage.name,
     toStage: transition.to,
@@ -2515,20 +2922,30 @@ async function commitTransition(ctx, actor) {
 }
 async function pickTransition(ctx, stage) {
   for (const candidate of stage.transitions ?? []) {
-    const outcome = await ctxEvaluateConditionOutcome(ctx, candidate.filter);
+    const outcome = await ctxEvaluateConditionOutcome({ ctx, condition: candidate.filter });
     if (outcome === "satisfied") return candidate;
     if (outcome === "unevaluable") return;
   }
 }
 async function evaluateAutoTransitions(args) {
-  const { client, instanceId, options, clientForGdr, clock, overlay } = args, ctx = await loadContext(client, instanceId, {
-    ...clientForGdr ? { clientForGdr } : {},
-    ...clock ? { clock } : {},
-    ...overlay ? { overlay } : {}
+  const { client, instanceId, options, clientForGdr, clock, overlay } = args, ctx = await loadContext({
+    client,
+    instanceId,
+    options: {
+      ...clientForGdr ? { clientForGdr } : {},
+      ...clock ? { clock } : {},
+      ...overlay ? { overlay } : {}
+    }
   });
   return commitTransition(ctx, options?.actor);
 }
-async function primeInitialStage(client, instanceId, actor, clientForGdr, clock) {
+async function primeInitialStage({
+  client,
+  instanceId,
+  actor,
+  clientForGdr,
+  clock
+}) {
   const instance = await client.getDocument(instanceId);
   if (!instance || instance.stages.length > 0) return;
   const definition = parseDefinitionSnapshot(instance), stage = definition.stages.find((s) => s.name === instance.currentStage);
@@ -2548,7 +2965,7 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
       instance,
       stage,
       now,
-      recordDiscard: recordFieldDiscards(discards, "stage", now)
+      recordDiscard: recordFieldDiscards({ target: discards, scope: "stage", at: now })
     }),
     activities: await buildStageActivities(ctx, stage)
   }, committed = await client.patch(instance._id).set({
@@ -2573,7 +2990,7 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
       stageName: stage.name,
       now
     })
-  }), await autoActivatePrimedActivities(
+  }), await autoActivatePrimedActivities({
     client,
     instanceId,
     definition,
@@ -2581,9 +2998,17 @@ async function primeInitialStage(client, instanceId, actor, clientForGdr, clock)
     actor,
     clientForGdr,
     clock
-  );
+  });
 }
-async function autoActivatePrimedActivities(client, instanceId, definition, stage, actor, clientForGdr, clock) {
+async function autoActivatePrimedActivities({
+  client,
+  instanceId,
+  definition,
+  stage,
+  actor,
+  clientForGdr,
+  clock
+}) {
   const resolvedClientForGdr = clientForGdr ?? (() => client);
   for (const activity of stage.activities ?? []) {
     if (activity.activation !== "auto") continue;
@@ -2596,7 +3021,7 @@ async function autoActivatePrimedActivities(client, instanceId, definition, stag
       definition,
       ...clock ? { clock } : {}
     }), mutation = startMutation(updated), mutEntry = currentActivities(mutation).find((t) => t.name === activity.name);
-    mutEntry && mutEntry.status === "pending" && (await activateActivity(updatedCtx, mutation, activity, mutEntry, actor), await persist(updatedCtx, mutation));
+    mutEntry && mutEntry.status === "pending" && (await activateActivity({ ctx: updatedCtx, mutation, activity, entry: mutEntry, actor }), await persist(updatedCtx, mutation));
   }
 }
 const CASCADE_LIMIT = 100;
@@ -2605,20 +3030,30 @@ async function gatherAutoResolveCandidates(ctx, activities) {
   for (const activity of activities) {
     const entry = currentActivitiesList.find((e) => e.name === activity.name);
     if (entry?.status !== "active") continue;
-    const outcome = await evaluateResolutionGate(
+    const outcome = await evaluateResolutionGate({
       ctx,
       activity,
-      await activityConditionVars(ctx, entry)
-    );
+      vars: await activityConditionVars(ctx, entry)
+    });
     outcome !== void 0 && candidates.push({ activity, outcome });
   }
   return candidates;
 }
-async function resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay) {
-  const ctx = await loadContext(client, instanceId, {
-    ...clientForGdr ? { clientForGdr } : {},
-    ...clock ? { clock } : {},
-    ...overlay ? { overlay } : {}
+async function resolveCompleteWhen({
+  client,
+  instanceId,
+  clientForGdr,
+  clock,
+  overlay
+}) {
+  const ctx = await loadContext({
+    client,
+    instanceId,
+    options: {
+      ...clientForGdr ? { clientForGdr } : {},
+      ...clock ? { clock } : {},
+      ...overlay ? { overlay } : {}
+    }
   }), stage = findStage(ctx.definition, ctx.instance.currentStage), gatedActivities = (stage.activities ?? []).filter(
     (t) => effectiveCompleteWhen(t) !== void 0 || t.failWhen !== void 0
   );
@@ -2629,21 +3064,27 @@ async function resolveCompleteWhen(client, instanceId, clientForGdr, clock, over
   let count = 0;
   for (const { activity, outcome } of candidates) {
     const mutEntry = currentActivities(mutation).find((t) => t.name === activity.name);
-    mutEntry === void 0 || mutEntry.status !== "active" || (applyActivityStatusChange({
+    mutEntry === void 0 || mutEntry.status !== "active" || (applyGateOutcome({
       entry: mutEntry,
       history: mutation.history,
       stage: stage.name,
-      to: outcome,
       at: ctx.now,
-      actor: gateActor(outcome)
+      outcome
     }), count++);
   }
   return count > 0 && await persist(ctx, mutation), count;
 }
-async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, clock, overlay) {
+async function cascadeAutoTransitions({
+  client,
+  instanceId,
+  actor,
+  clientForGdr,
+  clock,
+  overlay
+}) {
   let count = 0;
   for (; ; ) {
-    if (await resolveCompleteWhen(client, instanceId, clientForGdr, clock, overlay), !(await evaluateAutoTransitions({
+    if (await resolveCompleteWhen({ client, instanceId, clientForGdr, clock, overlay }), !(await evaluateAutoTransitions({
       client,
       instanceId,
       ...actor !== void 0 ? { options: { actor } } : {},
@@ -2655,14 +3096,19 @@ async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, c
       throw new CascadeLimitError({ instanceId, limit: CASCADE_LIMIT });
   }
 }
-async function findResolvedParentSpawn(client, child, clientForGdr, clock) {
+async function findResolvedParentSpawn({
+  client,
+  child,
+  clientForGdr,
+  clock
+}) {
   const parentRef = child.ancestors.at(-1);
   if (parentRef === void 0) return;
-  const parent = await client.getDocument(gdrToBareId(parentRef.id));
+  const parent = await client.getDocument(toBareId(parentRef.id));
   if (!parent || parent._type !== WORKFLOW_INSTANCE_TYPE || typeof parent.definitionSnapshot != "string") return;
   const definition = parseDefinitionSnapshot(parent), stage = definition.stages.find((s) => s.name === parent.currentStage);
   if (stage === void 0) return;
-  const parentCurrentActivities = findCurrentActivities(parent), activity = (stage.activities ?? []).find((t) => t.subworkflows === void 0 ? !1 : parentCurrentActivities.find((e) => e.name === t.name)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
+  const parentCurrentActivities = findCurrentActivities(parent), activity = (stage.activities ?? []).find((t) => t.subworkflows === void 0 ? !1 : parentCurrentActivities.find((e) => e.name === t.name)?.spawnedInstances?.some((r) => toBareId(r.id) === child._id) ?? !1);
   if (activity?.subworkflows === void 0) return;
   const entry = parentCurrentActivities.find((e) => e.name === activity.name);
   if (entry === void 0 || entry.status !== "active") return;
@@ -2672,18 +3118,29 @@ async function findResolvedParentSpawn(client, child, clientForGdr, clock) {
     instance: parent,
     definition,
     ...clock ? { clock } : {}
-  }), outcome = await evaluateResolutionGate(
+  }), outcome = await evaluateResolutionGate({
     ctx,
     activity,
-    await activityConditionVars(ctx, entry)
-  );
+    vars: await activityConditionVars(ctx, entry)
+  });
   if (outcome !== void 0)
     return { parent, definition, stage, activity, outcome };
 }
-async function propagateToAncestors(client, instanceId, actor, clientForGdr, clock) {
+async function propagateToAncestors({
+  client,
+  instanceId,
+  actor,
+  clientForGdr,
+  clock
+}) {
   const instance = await client.getDocument(instanceId);
   if (!instance) return;
-  const resolvedClientForGdr = clientForGdr ?? (() => client), found = await findResolvedParentSpawn(client, instance, resolvedClientForGdr, clock);
+  const resolvedClientForGdr = clientForGdr ?? (() => client), found = await findResolvedParentSpawn({
+    client,
+    child: instance,
+    clientForGdr: resolvedClientForGdr,
+    clock
+  });
   if (found === void 0) return;
   const { parent, definition, stage, activity, outcome } = found, ctx = await buildEngineContext({
     client,
@@ -2692,14 +3149,13 @@ async function propagateToAncestors(client, instanceId, actor, clientForGdr, clo
     definition,
     ...clock ? { clock } : {}
   }), mutation = startMutation(parent), mutEntry = currentActivities(mutation).find((e) => e.name === activity.name);
-  mutEntry !== void 0 && (applyActivityStatusChange({
+  mutEntry !== void 0 && (applyGateOutcome({
     entry: mutEntry,
     history: mutation.history,
     stage: stage.name,
-    to: outcome,
     at: ctx.now,
-    actor: gateActor(outcome)
-  }), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock));
+    outcome
+  }), await persist(ctx, mutation), await cascadeAutoTransitions({ client, instanceId: parent._id, actor, clientForGdr, clock }), await propagateToAncestors({ client, instanceId: parent._id, actor, clientForGdr, clock }));
 }
 const parsedFilters = /* @__PURE__ */ new Map();
 async function matchesFilter(args) {
@@ -2740,7 +3196,12 @@ async function resolveAccess(client, args = {}) {
       );
     return { actor: overrideActor };
   }
-  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = resolveGrants(overrideGrants, args.grantsFromPath, client, requestFn), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
+  const actorPromise = overrideActor !== void 0 ? Promise.resolve(overrideActor) : cachedActor(client, requestFn), grantsPromise = resolveGrants({
+    overrideGrants,
+    grantsFromPath: args.grantsFromPath,
+    client,
+    requestFn
+  }), [actor, grants] = await Promise.all([actorPromise, grantsPromise]);
   if (actor === void 0)
     throw new Error(
       "workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity \u2014 check the token, or pass `access.actor` explicitly."
@@ -2755,10 +3216,19 @@ function cachedActor(client, requestFn) {
   });
   return actorCache.set(client, pending), pending;
 }
-function resolveGrants(overrideGrants, grantsFromPath, client, requestFn) {
-  return overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : grantsFromPath !== void 0 ? cachedGrants(client, requestFn, grantsFromPath) : Promise.resolve(void 0);
-}
-function cachedGrants(client, requestFn, resourcePath) {
+function resolveGrants({
+  overrideGrants,
+  grantsFromPath,
+  client,
+  requestFn
+}) {
+  return overrideGrants !== void 0 ? Promise.resolve(overrideGrants) : grantsFromPath !== void 0 ? cachedGrants({ client, requestFn, resourcePath: grantsFromPath }) : Promise.resolve(void 0);
+}
+function cachedGrants({
+  client,
+  requestFn,
+  resourcePath
+}) {
   let byPath = grantsCache.get(client);
   byPath === void 0 && (byPath = /* @__PURE__ */ new Map(), grantsCache.set(client, byPath));
   let cached = byPath.get(resourcePath);
@@ -2858,9 +3328,7 @@ function slotWindowOpen(instance, slot) {
   if (instance.completedAt !== void 0) return { open: !1, detail: "instance completed" };
   if (instance.abortedAt !== void 0) return { open: !1, detail: "instance aborted" };
   if (slot.scope !== "activity") return { open: !0 };
-  const status = findOpenStageEntry(instance)?.activities.find(
-    (t) => t.name === slot.activity
-  )?.status;
+  const status = findCurrentActivityEntry(instance, slot.activity)?.status;
   return status === "active" ? { open: !0 } : { open: !1, detail: `activity "${slot.activity}" is ${status ?? "not active"}` };
 }
 function readSlotValue(instance, slot) {
@@ -2895,7 +3363,7 @@ async function evaluateInstance(args) {
   const { actor, grants } = await resolveAccess(client, {
     ...args.access !== void 0 ? { override: args.access } : {},
     ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
-  }), instance = await reload(client, instanceId, tag), definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance }), guards = await verdictGuardsForInstance(client, instance._id);
+  }), instance = await reload({ client, instanceId, tag }), definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance }), guards = await verdictGuardsForInstance(client, instance._id);
   return evaluateFromSnapshot({
     instance,
     definition,
@@ -2912,7 +3380,7 @@ async function evaluateFromSnapshot(args) {
     throw new Error(
       `Instance "${instance._id}" currentStage "${instance.currentStage}" not in definition`
     );
-  const scope = await renderScope({ instance, definition, actor, grants, snapshot, now }), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason(instance, actor, args.guards), activityEvaluations = [];
+  const scope = await renderScope({ instance, definition, actor, grants, snapshot, now }), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({ instance, actor, guards: args.guards }), activityEvaluations = [];
   for (const activity of stage.activities ?? [])
     activityEvaluations.push(
       await evaluateActivity({
@@ -3015,7 +3483,7 @@ async function renderScope(args) {
     ...buildParams({ instance, now, snapshot }),
     actor,
     assigned: !1,
-    can: await advisoryCan(instance, actor, grants)
+    can: await advisoryCan({ instance, actor, grants })
   };
   return { ...await evaluatePredicates({
     predicates: definition.predicates,
@@ -3023,7 +3491,11 @@ async function renderScope(args) {
     params
   }), ...params };
 }
-async function advisoryCan(instance, actor, grants) {
+async function advisoryCan({
+  instance,
+  actor,
+  grants
+}) {
   if (grants === void 0) return;
   const can = {};
   for (const permission of DOCUMENT_VALUE_PERMISSIONS)
@@ -3041,9 +3513,9 @@ function activityScopeFor(args) {
     ...scope,
     fields: {
       ...scope.fields,
-      ...scopedFieldOverlay(instance, snapshot, activityName)
+      ...scopedFieldOverlay({ instance, snapshot, activityName })
     },
-    assigned: assignedFor(instance, activityName, actor, roleAliases)
+    assigned: assignedFor({ instance, activityName, actor, roleAliases })
   };
 }
 async function evaluateActivity(args) {
@@ -3105,14 +3577,18 @@ async function evaluateAction(args) {
     stageHasExits,
     guardDenial,
     requirementsReason
-  } = args, lifecycle = lifecycleReason(instance, status, stageHasExits);
+  } = args, lifecycle = lifecycleReason({ instance, status, stageHasExits });
   return lifecycle !== void 0 ? disabled(action, lifecycle) : guardDenial !== void 0 ? disabled(action, guardDenial) : requirementsReason !== void 0 ? disabled(action, requirementsReason) : action.filter !== void 0 && !await evaluateCondition({
     condition: action.filter,
     snapshot,
     params: activityScope
   }) ? disabled(action, { kind: "filter-failed", filter: action.filter }) : { action, allowed: !0 };
 }
-async function instanceGuardReason(instance, actor, guards) {
+async function instanceGuardReason({
+  instance,
+  actor,
+  guards
+}) {
   if (guards === void 0 || guards.length === 0) return;
   const denied = await instanceWriteDenials({ instance, guards, identity: actor.id });
   if (denied.length !== 0)
@@ -3122,7 +3598,11 @@ async function instanceGuardReason(instance, actor, guards) {
       detail: denied.map((g) => g.name ?? g._id).join(", ")
     };
 }
-function lifecycleReason(instance, status, stageHasExits) {
+function lifecycleReason({
+  instance,
+  status,
+  stageHasExits
+}) {
   if (instance.completedAt !== void 0)
     return { kind: "instance-completed", completedAt: instance.completedAt };
   if (!stageHasExits)
@@ -3133,10 +3613,11 @@ function lifecycleReason(instance, status, stageHasExits) {
 function disabled(action, reason) {
   return { action, allowed: !1, disabledReason: reason };
 }
-function definitionDocId(_workflowResource, tag, definition, version) {
-  return `${tag}.${definition}.v${version}`;
-}
-async function sortByDependencies(client, definitions, tag) {
+async function sortByDependencies({
+  client,
+  definitions,
+  tag
+}) {
   const byName = /* @__PURE__ */ new Map();
   for (const def of definitions) {
     if (byName.has(def.name))
@@ -3146,18 +3627,22 @@ async function sortByDependencies(client, definitions, tag) {
     byName.set(def.name, def);
   }
   const findInBatch = (ref) => findRefInBatch(byName, ref);
-  return await assertCrossBatchRefsDeployed(client, definitions, { tag, findInBatch }), topoSortDefinitions(definitions, { findInBatch });
+  return await assertCrossBatchRefsDeployed({ client, definitions, ctx: { tag, findInBatch } }), topoSortDefinitions(definitions, { findInBatch });
 }
 function findRefInBatch(byName, ref) {
   if (typeof ref.version != "number")
     return byName.get(ref.name);
 }
-async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
+async function assertCrossBatchRefsDeployed({
+  client,
+  definitions,
+  ctx
+}) {
   const missing = [];
   for (const def of definitions)
     for (const ref of refsOf(def)) {
       if (ctx.findInBatch(ref) !== void 0) continue;
-      const label = await resolveDeployedRefLabel(client, ref, ctx.tag);
+      const label = await resolveDeployedRefLabel({ client, ref, tag: ctx.tag });
       label !== void 0 && missing.push({ from: def.name, ref: label });
     }
   if (missing.length === 0) return;
@@ -3168,7 +3653,11 @@ async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
 `)
   );
 }
-async function resolveDeployedRefLabel(client, ref, tag) {
+async function resolveDeployedRefLabel({
+  client,
+  ref,
+  tag
+}) {
   const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, tag };
   if (wantsExplicit && (params.version = ref.version), !await client.fetch(
     definitionLookupGroq(wantsExplicit),
@@ -3211,9 +3700,17 @@ function hashDefinitionContent(def) {
     hash ^= BigInt(canonical.charCodeAt(i)), hash = hash * 0x100000001b3n & 0xffffffffffffffffn;
   return hash.toString(16).padStart(16, "0");
 }
-function planDefinitionDeploy(def, latest, target) {
-  const contentHash = hashDefinitionContent(def), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = definitionDocId(target.workflowResource, target.tag, def.name, version), document = {
-    ...def,
+function planDefinitionDeploy({
+  def,
+  latest,
+  target
+}) {
+  const expanded = expandResourceAliases(def, target.resourceAliases), contentHash = hashDefinitionContent(expanded), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = definitionDocId({
+    tag: target.tag,
+    definition: expanded.name,
+    version
+  }), document = {
+    ...expanded,
     _id: docId,
     _type: WORKFLOW_DEFINITION_TYPE,
     tag: target.tag,
@@ -3222,6 +3719,38 @@ function planDefinitionDeploy(def, latest, target) {
   };
   return { status: unchanged ? "unchanged" : "create", version, contentHash, docId, document };
 }
+const RESOURCE_ALIAS_REF_RE = new RegExp(`@(${RESOURCE_ALIAS_NAME_SOURCE}):`, "g"), STANDALONE_RESOURCE_ALIAS_RE = new RegExp(`^@${RESOURCE_ALIAS_NAME_SOURCE}:`), PROSE_KEYS = /* @__PURE__ */ new Set(["title", "description"]);
+function expandResourceAliases(definition, resourceAliases) {
+  assertResourceAliasNamesValid(resourceAliases);
+  const map = resourceAliases ?? {};
+  return mapJsonStrings(
+    definition,
+    (value, key) => key !== void 0 && PROSE_KEYS.has(key) ? value : expandAliasString({ value, map, definitionName: definition.name })
+  );
+}
+function expandAliasString({
+  value,
+  map,
+  definitionName
+}) {
+  const expanded = value.replace(RESOURCE_ALIAS_REF_RE, (_match, alias) => {
+    if (!Object.hasOwn(map, alias))
+      throw new Error(
+        `workflow.deployDefinitions: definition "${definitionName}" references unbound resource alias "@${alias}". Bind it in the deploy target's resource map, or remove the reference.`
+      );
+    return gdrResourcePrefix(map[alias]);
+  });
+  if (expanded === value) return value;
+  if (STANDALONE_RESOURCE_ALIAS_RE.test(value) && !isGdrUri(expanded))
+    throw new Error(
+      `workflow.deployDefinitions: definition "${definitionName}" reference "${value}" expands to the malformed GDR "${expanded}". A resource alias reference must be "@<alias>:<documentId>" with a single document id.`
+    );
+  return expanded;
+}
+function assertResourceAliasNamesValid(resourceAliases) {
+  for (const name of Object.keys(resourceAliases ?? {}))
+    validateResourceAliasName(name);
+}
 function stripSystemFields(doc) {
   const out = {};
   for (const [k, v2] of Object.entries(doc))
@@ -3233,7 +3762,13 @@ function stableStringify(value) {
     ([a], [b]) => a.localeCompare(b)
   ).map(([k, v2]) => `${JSON.stringify(k)}:${stableStringify(v2)}`).join(",")}}`;
 }
-async function loadDefinition(client, definition, version, tag) {
+const noDeployedDefinitionMessage = (definition) => `No deployed definition for workflow ${definition}`;
+async function loadDefinition({
+  client,
+  definition,
+  version,
+  tag
+}) {
   if (version !== void 0) {
     const doc = await client.fetch(definitionLookupGroq(!0), {
       definition,
@@ -3244,31 +3779,50 @@ async function loadDefinition(client, definition, version, tag) {
       throw new Error(`Workflow definition ${definition} v${version} not deployed`);
     return doc;
   }
-  const latest = await loadLatestDeployed(client, definition, tag);
+  const latest = await loadLatestDeployed({ client, definition, tag });
   if (!latest)
-    throw new Error(`No deployed definition for workflow ${definition}`);
+    throw new Error(noDeployedDefinitionMessage(definition));
   return latest;
 }
-async function loadLatestDeployed(client, definition, tag) {
+async function loadLatestDeployed({
+  client,
+  definition,
+  tag
+}) {
   return await client.fetch(definitionLookupGroq(!1), {
     definition,
     tag
   }) ?? void 0;
 }
-async function loadDefinitionVersions(client, definition, tag) {
+async function loadDefinitionVersions({
+  client,
+  definition,
+  tag
+}) {
   return client.fetch(
     `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}] | order(version desc)`,
     { definition, tag }
   );
 }
-async function abortInstance(args) {
-  const { client, instanceId, reason, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {},
-    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
-  });
-  return commitAbort(ctx, reason, options?.actor);
+async function loadDefinitionVersionsOrThrow({
+  client,
+  definition,
+  tag
+}) {
+  const versions = await loadDefinitionVersions({ client, definition, tag });
+  if (versions.length === 0)
+    throw new Error(noDeployedDefinitionMessage(definition));
+  return versions;
 }
-async function commitAbort(ctx, reason, actor) {
+async function abortInstance(args) {
+  const { client, instanceId, reason, options } = args, ctx = await loadCallContext({ client, instanceId, options });
+  return commitAbort({ ctx, reason, actor: options?.actor });
+}
+async function commitAbort({
+  ctx,
+  reason,
+  actor
+}) {
   if (ctx.instance.completedAt !== void 0)
     return { fired: !1 };
   const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), at = ctx.now, openEntry = findOpenStageEntry(mutation);
@@ -3302,30 +3856,44 @@ async function commitAbort(ctx, reason, actor) {
 }
 async function fireAction(args) {
   const { client, instanceId, activity, action, params, options } = args;
-  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
-    const ctx = await loadCallContext(client, instanceId, options);
-    try {
-      return await commitAction(ctx, activity, action, params, options);
-    } catch (error) {
-      if (!isRevisionConflict(error)) throw error;
-    }
-  }
-  throw new ConcurrentFireActionError({
+  return retryOnRevisionConflict({
+    client,
     instanceId,
-    activity,
-    action,
-    attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+    options,
+    commit: (ctx) => commitAction({
+      ctx,
+      activityName: activity,
+      actionName: action,
+      callerParams: params,
+      options
+    }),
+    onExhausted: () => new ConcurrentFireActionError({
+      instanceId,
+      activity,
+      action,
+      attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+    })
   });
 }
-async function resolveActionCommit(ctx, activityName, actionName, callerParams, options) {
+async function resolveActionCommit({
+  ctx,
+  activityName,
+  actionName,
+  callerParams,
+  options
+}) {
   const actor = options?.actor, { stage, activity } = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find((a) => a.name === actionName);
   if (action === void 0)
     throw new Error(`Action "${actionName}" not declared on activity "${activityName}"`);
-  const can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan(ctx.instance, actor, options.grants) : void 0;
-  if (!await ctxEvaluateCondition(ctx, action.filter, {
-    activityName,
-    ...actor !== void 0 ? { actor } : {},
-    ...can !== void 0 ? { vars: { can } } : {}
+  const can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan({ instance: ctx.instance, actor, grants: options.grants }) : void 0;
+  if (!await ctxEvaluateCondition({
+    ctx,
+    condition: action.filter,
+    opts: {
+      activityName,
+      ...actor !== void 0 ? { actor } : {},
+      ...can !== void 0 ? { vars: { can } } : {}
+    }
   }))
     throw new Error(`Action "${actionName}" filter rejected on activity "${activityName}"`);
   const entry = findCurrentActivities(ctx.instance).find((t) => t.name === activityName);
@@ -3333,17 +3901,23 @@ async function resolveActionCommit(ctx, activityName, actionName, callerParams,
     throw new Error(
       `Activity "${activityName}" must be active to fire action "${actionName}"; status is ${entry?.status ?? "missing"}`
     );
-  const params = validateActionParams(action, activityName, callerParams);
+  const params = validateActionParams({ action, activityName, callerParams });
   return { stage, activity, action, params };
 }
-async function commitAction(ctx, activityName, actionName, callerParams, options) {
-  const actor = options?.actor, { stage, action, params } = await resolveActionCommit(
+async function commitAction({
+  ctx,
+  activityName,
+  actionName,
+  callerParams,
+  options
+}) {
+  const actor = options?.actor, { stage, action, params } = await resolveActionCommit({
     ctx,
     activityName,
     actionName,
     callerParams,
     options
-  ), mutation = startMutation(ctx.instance), mutEntry = requireMutationActivityEntry(mutation, activityName), now = ctx.now;
+  }), mutation = startMutation(ctx.instance), mutEntry = requireMutationActivityEntry(mutation, activityName), now = ctx.now;
   mutation.history.push({
     _key: randomKey(),
     _type: "actionFired",
@@ -3363,14 +3937,19 @@ async function commitAction(ctx, activityName, actionName, callerParams, options
     self: selfGdr(ctx.instance),
     now
   }), newStatus = mutEntry.status !== statusBefore ? mutEntry.status : void 0;
-  return await queueEffects(ctx, mutation, action.effects, { kind: "action", name: actionName }, actor, {
-    callerParams: params,
-    activityName
-  }), await persistThenDeploy(
+  return await queueEffects({
+    ctx,
+    mutation,
+    effects: action.effects,
+    origin: { kind: "action", name: actionName },
+    actor,
+    opts: { callerParams: params, activityName }
+  }), await persistThenMaybeRefresh({
     ctx,
     mutation,
-    () => ranOps.some(isFieldOp) ? refreshStageGuards(ctx, mutation, stage.name) : Promise.resolve()
-  ), {
+    stageName: stage.name,
+    didChangeState: ranOps.some(isFieldOp)
+  }), {
     fired: !0,
     activity: activityName,
     action: actionName,
@@ -3383,7 +3962,7 @@ class ActionDisabledError extends Error {
   activity;
   action;
   constructor(args) {
-    super(formatDisabledReason(args.activity, args.action, args.reason)), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, this.action = args.action;
+    super(formatDisabledReason({ activity: args.activity, action: args.action, reason: args.reason })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, this.action = args.action;
   }
 }
 const disabledReasonDetail = {
@@ -3394,7 +3973,11 @@ const disabledReasonDetail = {
   "mutation-guard-denied": (r) => `blocked by mutation guard(s) [${r.guardIds.join(", ")}]${r.detail ? ` (${r.detail})` : ""}`,
   "requirements-unmet": (r) => `unmet requirement(s): ${r.unmetRequirements.join(", ")}`
 };
-function formatDisabledReason(activity, action, reason) {
+function formatDisabledReason({
+  activity,
+  action,
+  reason
+}) {
   const detail = disabledReasonDetail[reason.kind](reason);
   return `Action "${activity}:${action}" is not allowed: ${detail}`;
 }
@@ -3420,28 +4003,32 @@ function formatEditDisabledReason(target, reason) {
 }
 async function editField(args) {
   const { client, instanceId, target, mode = "set", value, options } = args;
-  for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
-    const ctx = await loadCallContext(client, instanceId, options);
-    try {
-      return await commitEdit(ctx, target, mode, value, options);
-    } catch (error) {
-      if (!isRevisionConflict(error)) throw error;
-    }
-  }
-  throw new ConcurrentEditFieldError({
+  return retryOnRevisionConflict({
+    client,
     instanceId,
-    target: labelTarget(target),
-    attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+    options,
+    commit: (ctx) => commitEdit({ ctx, target, mode, value, options }),
+    onExhausted: () => new ConcurrentEditFieldError({
+      instanceId,
+      target: labelTarget(target),
+      attempts: CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS
+    })
   });
 }
-async function commitEdit(ctx, target, mode, value, options) {
+async function commitEdit({
+  ctx,
+  target,
+  mode,
+  value,
+  options
+}) {
   const actor = options?.actor, stage = findStage(ctx.definition, ctx.instance.currentStage), slot = resolveEditTarget({ definition: ctx.definition, stage, target });
   if (slot === void 0)
     throw new Error(
       `No field slot "${describeTarget(target)}" resolves in current stage "${stage.name}" of ${ctx.definition.name}`
     );
-  await assertSlotEditable(ctx, slot, options);
-  const op = buildEditOp(slot, mode, value), mutation = startMutation(ctx.instance), ranOps = runOps({
+  await assertSlotEditable({ ctx, slot, options });
+  const op = buildEditOp({ slot, mode, value }), mutation = startMutation(ctx.instance), ranOps = runOps({
     ops: [op],
     mutation,
     stage: stage.name,
@@ -3454,21 +4041,30 @@ async function commitEdit(ctx, target, mode, value, options) {
     self: selfGdr(ctx.instance),
     now: ctx.now
   });
-  return await persistThenDeploy(
+  return await persistThenMaybeRefresh({
     ctx,
     mutation,
-    () => ranOps.some(isFieldOp) ? refreshStageGuards(ctx, mutation, stage.name) : Promise.resolve()
-  ), {
+    stageName: stage.name,
+    didChangeState: ranOps.some(isFieldOp)
+  }), {
     edited: !0,
     target: slotTarget(slot),
     ...ranOps.length > 0 ? { ranOps } : {}
   };
 }
-async function assertSlotEditable(ctx, slot, options) {
-  const actor = options?.actor, window = slotWindowOpen(ctx.instance, slot), can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan(ctx.instance, actor, options.grants) : void 0, predicateSatisfied = window.open && slot.effective !== !0 && slot.effective !== void 0 ? await ctxEvaluateCondition(ctx, slot.effective, {
-    ...slot.activity !== void 0 ? { activityName: slot.activity } : {},
-    ...actor !== void 0 ? { actor } : {},
-    ...can !== void 0 ? { vars: { can } } : {}
+async function assertSlotEditable({
+  ctx,
+  slot,
+  options
+}) {
+  const actor = options?.actor, window = slotWindowOpen(ctx.instance, slot), can = options?.grants !== void 0 && actor !== void 0 ? await advisoryCan({ instance: ctx.instance, actor, grants: options.grants }) : void 0, predicateSatisfied = window.open && slot.effective !== !0 && slot.effective !== void 0 ? await ctxEvaluateCondition({
+    ctx,
+    condition: slot.effective,
+    opts: {
+      ...slot.activity !== void 0 ? { activityName: slot.activity } : {},
+      ...actor !== void 0 ? { actor } : {},
+      ...can !== void 0 ? { vars: { can } } : {}
+    }
   }) : slot.effective === !0, reason = editDisabledReason({
     effective: slot.effective,
     instance: ctx.instance,
@@ -3478,7 +4074,11 @@ async function assertSlotEditable(ctx, slot, options) {
   });
   if (reason !== void 0) throw new EditFieldDeniedError({ target: slotTarget(slot), reason });
 }
-function buildEditOp(slot, mode, value) {
+function buildEditOp({
+  slot,
+  mode,
+  value
+}) {
   if (mode === "unset") return { type: "field.unset", target: slot.ref };
   if (value === void 0)
     throw new Error(`editField mode "${mode}" requires a value for slot "${slot.name}"`);
@@ -3526,25 +4126,45 @@ async function resolveOperationContext(args) {
     clientForGdr: buildClientForGdr(args.client, args.resourceClients)
   };
 }
-async function cascade(client, instanceId, actor, clientForGdr, clock, overlay) {
-  const count = await cascadeAutoTransitions(
+async function cascade({
+  client,
+  instanceId,
+  actor,
+  clientForGdr,
+  clock,
+  overlay
+}) {
+  const count = await cascadeAutoTransitions({
     client,
     instanceId,
     actor,
-    clientForGdr,
-    clock,
-    overlay
-  );
-  return await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), count;
+    ...clientForGdr !== void 0 ? { clientForGdr } : {},
+    ...clock !== void 0 ? { clock } : {},
+    ...overlay !== void 0 ? { overlay } : {}
+  });
+  return await propagateToAncestors({
+    client,
+    instanceId,
+    actor,
+    ...clientForGdr !== void 0 ? { clientForGdr } : {},
+    ...clock !== void 0 ? { clock } : {}
+  }), count;
+}
+function engineOptionsForActor({
+  actor,
+  clock,
+  clientForGdr
+}) {
+  return { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr };
 }
 async function abortAndPropagate(args) {
   const { client, instanceId, reason, actor, clientForGdr, clock } = args, result = await abortInstance({
     client,
     instanceId,
     ...reason !== void 0 ? { reason } : {},
-    options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
+    options: engineOptionsForActor({ actor, clock, clientForGdr })
   });
-  return result.fired && await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), result.fired;
+  return result.fired && await propagateToAncestors({ client, instanceId, actor, clientForGdr, clock }), result.fired;
 }
 function buildClientForGdr(defaultClient, resolver) {
   return resolver === void 0 ? () => defaultClient : (parsed) => resolver(parsed) ?? defaultClient;
@@ -3560,15 +4180,25 @@ async function dispatchGatedWrite(args) {
     access,
     clock: args.clock,
     ...resourceClients !== void 0 ? { resourceClients } : {}
-  }), ranOps = await apply(args.before, evaluation), cascaded = await cascade(client, instanceId, args.actor, args.clientForGdr, args.clock);
+  }), ranOps = await apply(args.before, evaluation), cascaded = await cascade({
+    client,
+    instanceId,
+    actor: args.actor,
+    clientForGdr: args.clientForGdr,
+    clock: args.clock
+  });
   return {
-    instance: await reload(client, instanceId, tag),
+    instance: await reload({ client, instanceId, tag }),
     cascaded,
     fired: !0,
     ...ranOps !== void 0 ? { ranOps } : {}
   };
 }
-function assertActionAllowed(evaluation, activity, action) {
+function assertActionAllowed({
+  evaluation,
+  activity,
+  action
+}) {
   const actionEval = evaluation.currentStage.activities.find((t) => t.activity.name === activity)?.actions.find((a) => a.action.name === action);
   if (actionEval?.allowed === !1 && actionEval.disabledReason)
     throw new ActionDisabledError({ activity, action, reason: actionEval.disabledReason });
@@ -3606,7 +4236,7 @@ function buildEngineCallOptions(args) {
 }
 async function applyAction(args) {
   const { client, instance, activity, action, params, actor, grants, clock, clientForGdr } = args, options = buildEngineCallOptions({ actor, grants, clock, clientForGdr });
-  return findOpenStageEntry(instance)?.activities.find((t) => t.name === activity)?.status === "pending" && await invokeActivity({ client, instanceId: instance._id, activity, options }), (await fireAction({
+  return findCurrentActivityEntry(instance, activity)?.status === "pending" && await invokeActivity({ client, instanceId: instance._id, activity, options }), (await fireAction({
     client,
     instanceId: instance._id,
     activity,
@@ -3616,15 +4246,12 @@ async function applyAction(args) {
   })).ranOps;
 }
 async function deleteDefinition(args) {
-  const { client, tag, definition, version, cascade: cascade2, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersions(client, definition, tag);
-  if (versions.length === 0)
-    throw new Error(`No deployed definition for workflow ${definition}`);
-  const targets = version === void 0 ? versions : versions.filter((d) => d.version === version);
+  const { client, tag, definition, version, cascade: cascade2, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersionsOrThrow({ client, definition, tag }), targets = version === void 0 ? versions : versions.filter((d) => d.version === version);
   if (targets.length === 0)
     throw new Error(`Workflow definition ${definition} v${version} not deployed`);
   const lastVersionGoes = targets.length === versions.length;
-  await assertNoSpawnReferrers(client, tag, definition, targets, lastVersionGoes);
-  const instanceIds = await nonTerminalInstanceIds(client, tag, definition, version);
+  await assertNoSpawnReferrers({ client, tag, definition, targets, lastVersionGoes });
+  const instanceIds = await nonTerminalInstanceIds({ client, tag, definition, version });
   if (instanceIds.length > 0 && cascade2 !== !0)
     throw new Error(
       `Cannot delete ${definition}: ${instanceIds.length} non-terminal instance(s) exist (${previewIds(instanceIds)}). Pass cascade to abort them first \u2014 instances are aborted in place, never deleted.`
@@ -3654,7 +4281,13 @@ async function deleteDefinition(args) {
     deletedGuardCount
   };
 }
-async function assertNoSpawnReferrers(client, tag, definition, targets, lastVersionGoes) {
+async function assertNoSpawnReferrers({
+  client,
+  tag,
+  definition,
+  targets,
+  lastVersionGoes
+}) {
   const deployed = await client.fetch(
     `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}]`,
     { tag }
@@ -3670,7 +4303,12 @@ async function assertNoSpawnReferrers(client, tag, definition, targets, lastVers
     );
   }
 }
-async function nonTerminalInstanceIds(client, tag, definition, version) {
+async function nonTerminalInstanceIds({
+  client,
+  tag,
+  definition,
+  version
+}) {
   const versionFilter = version === void 0 ? "" : " && pinnedVersion == $version";
   return (await client.fetch(
     `*[_type == "${WORKFLOW_INSTANCE_TYPE}" && definition == $definition && ${tagScopeFilter()} && !defined(completedAt)${versionFilter}] | order(_id asc){_id}`,
@@ -3707,14 +4345,19 @@ const workflow = {
    * Cycles in the dependency graph error before any write happens.
    */
   deployDefinitions: async (args) => {
-    const { client, tag, workflowResource, definitions } = args;
-    validateTag(tag);
-    for (const def of definitions)
-      validateDefinition(def);
-    const ordered = await sortByDependencies(client, definitions, tag), results = [], tx = client.transaction();
+    const { client, tag, resourceAliases, definitions } = args;
+    validateTag(tag), definitions.forEach(validateDefinition);
+    const ordered = await sortByDependencies({ client, definitions, tag }), results = [], tx = client.transaction();
     let hasWrites = !1;
     for (const def of ordered) {
-      const latest = await loadLatestDeployed(client, def.name, tag), plan = planDefinitionDeploy(def, latest, { tag, workflowResource });
+      const latest = await loadLatestDeployed({ client, definition: def.name, tag }), plan = planDefinitionDeploy({
+        def,
+        latest,
+        target: {
+          tag,
+          ...resourceAliases !== void 0 ? { resourceAliases } : {}
+        }
+      });
       if (plan.status === "unchanged") {
         results.push({ definition: def.name, version: plan.version, status: "unchanged" });
         continue;
@@ -3751,7 +4394,7 @@ const workflow = {
       effectsContext,
       instanceId,
       perspective
-    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, definitionName, version, tag), id = instanceId ?? `${tag}.wf-instance.${randomKey()}`;
+    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition({ client, definition: definitionName, version, tag }), id = instanceId ?? instanceDocId(tag);
     if (definition.stages.find((s) => s.name === definition.initialStage) === void 0)
       throw new Error(
         `Initial stage "${definition.initialStage}" missing in ${definitionName} v${definition.version}`
@@ -3767,7 +4410,7 @@ const workflow = {
         workflowResource,
         definitionName: definition.name,
         ...perspective !== void 0 ? { perspective } : {},
-        recordDiscard: recordFieldDiscards(fieldDiscards, "workflow", now)
+        recordDiscard: recordFieldDiscards({ target: fieldDiscards, scope: "workflow", at: now })
       },
       randomKey
     }), effectivePerspective = perspective ?? derivePerspectiveFromFields(resolvedFields), base = buildInstanceBase({
@@ -3787,7 +4430,7 @@ const workflow = {
       actor,
       ...fieldDiscards.length > 0 ? { extraHistory: fieldDiscards } : {}
     });
-    return await client.create(base, SYNC_COMMIT), await primeInitialStage(client, id, actor, clientForGdr, clock), await cascade(client, id, actor, clientForGdr, clock), reload(client, id, tag);
+    return await client.create(base, SYNC_COMMIT), await primeInitialStage({ client, instanceId: id, actor, clientForGdr, clock }), await cascade({ client, instanceId: id, actor, clientForGdr, clock }), reload({ client, instanceId: id, tag });
   },
   /**
    * Fire an action against an activity. If the activity is pending, it is
@@ -3809,8 +4452,8 @@ const workflow = {
       params,
       idempotent,
       resourceClients
-    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tag);
-    return findOpenStageEntry(before)?.activities.find((t) => t.name === activity) === void 0 && idempotent === !0 ? { instance: before, cascaded: 0, fired: !1 } : dispatchGatedWrite({
+    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload({ client, instanceId, tag });
+    return findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0 ? { instance: before, cascaded: 0, fired: !1 } : dispatchGatedWrite({
       client,
       tag,
       instanceId,
@@ -3820,7 +4463,7 @@ const workflow = {
       clock,
       before,
       ...resourceClients !== void 0 ? { resourceClients } : {},
-      apply: (instance, evaluation) => (assertActionAllowed(evaluation, activity, action), applyAction({
+      apply: (instance, evaluation) => (assertActionAllowed({ evaluation, activity, action }), applyAction({
         client,
         instance,
         activity,
@@ -3849,7 +4492,7 @@ const workflow = {
    * never an `onChange` per keystroke.
    */
   editField: async (args) => {
-    const { client, tag, instanceId, target, mode, value, resourceClients } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tag);
+    const { client, tag, instanceId, target, mode, value, resourceClients } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload({ client, instanceId, tag });
     return dispatchGatedWrite({
       client,
       tag,
@@ -3878,24 +4521,27 @@ const workflow = {
    * appends an `effectHistory` entry, and (if `outputs` are supplied
    * and the effect succeeded) upserts those values into
    * `effectsContext` by key — so downstream effect bindings can
-   * reference them. Cascades after.
+   * reference them. Any `ops` the handler returned (`field.*`) are
+   * validated and applied to the instance in the same commit, through the
+   * same op applier an action's field ops use. Cascades after.
    */
   completeEffect: async (args) => {
-    const { client, tag, instanceId, effectKey, status, outputs, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    const { client, tag, instanceId, effectKey, status, outputs, ops, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await completeEffect({
       client,
       instanceId,
       effectKey,
       status,
       ...outputs !== void 0 ? { outputs } : {},
+      ...ops !== void 0 ? { ops } : {},
       ...detail !== void 0 ? { detail } : {},
       ...error !== void 0 ? { error } : {},
       ...durationMs !== void 0 ? { durationMs } : {},
-      options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
+      options: engineOptionsForActor({ actor, clock, clientForGdr })
     });
-    const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
+    const cascaded = await cascade({ client, instanceId, actor, clientForGdr, clock });
     return {
-      instance: await reload(client, instanceId, tag),
+      instance: await reload({ client, instanceId, tag }),
       cascaded,
       fired: !0
     };
@@ -3910,11 +4556,11 @@ const workflow = {
    * affected instances and the engine re-evaluates.
    */
   tick: async (args) => {
-    const { client, tag, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload(client, instanceId, tag), guards = await verdictGuardsForInstance(client, current._id);
+    const { client, tag, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload({ client, instanceId, tag }), guards = await verdictGuardsForInstance(client, current._id);
     await assertInstanceWriteAllowed({ instance: current, guards, identity: actor.id });
-    const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
+    const cascaded = await cascade({ client, instanceId, actor, clientForGdr, clock });
     return {
-      instance: await reload(client, instanceId, tag),
+      instance: await reload({ client, instanceId, tag }),
       cascaded,
       fired: cascaded > 0
     };
@@ -3926,16 +4572,16 @@ const workflow = {
    */
   setStage: async (args) => {
     const { client, tag, instanceId, targetStage, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
-    await reload(client, instanceId, tag);
+    await reload({ client, instanceId, tag });
     const result = await setStage({
       client,
       instanceId,
       targetStage,
       ...reason !== void 0 ? { reason } : {},
-      options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
-    }), cascaded = result.fired ? await cascade(client, instanceId, actor, clientForGdr, clock) : 0;
+      options: engineOptionsForActor({ actor, clock, clientForGdr })
+    }), cascaded = result.fired ? await cascade({ client, instanceId, actor, clientForGdr, clock }) : 0;
     return {
-      instance: await reload(client, instanceId, tag),
+      instance: await reload({ client, instanceId, tag }),
       cascaded,
       fired: result.fired
     };
@@ -3948,10 +4594,10 @@ const workflow = {
    */
   abortInstance: async (args) => {
     const { client, tag, instanceId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
-    await reload(client, instanceId, tag);
+    await reload({ client, instanceId, tag });
     const fired = await abortAndPropagate({ client, instanceId, reason, actor, clientForGdr, clock });
     return {
-      instance: await reload(client, instanceId, tag),
+      instance: await reload({ client, instanceId, tag }),
       cascaded: 0,
       fired
     };
@@ -3963,12 +4609,12 @@ const workflow = {
    */
   getInstance: async (args) => {
     const { client, tag, instanceId } = args;
-    return validateTag(tag), reload(client, instanceId, tag);
+    return validateTag(tag), reload({ client, instanceId, tag });
   },
   guardsForInstance: async (args) => {
     const { client, tag, instanceId, resourceClients } = args;
     validateTag(tag);
-    const instance = await reload(client, instanceId, tag);
+    const instance = await reload({ client, instanceId, tag });
     return guardsForInstance({
       client,
       clientForGdr: buildClientForGdr(client, resourceClients),
@@ -3978,9 +4624,7 @@ const workflow = {
   guardsForDefinition: async (args) => {
     const { client, tag, workflowResource, definition, resourceClients } = args;
     validateTag(tag);
-    const definitions = await loadDefinitionVersions(client, definition, tag);
-    if (definitions.length === 0)
-      throw new Error(`No deployed definition for workflow ${definition}`);
+    const definitions = await loadDefinitionVersionsOrThrow({ client, definition, tag });
     return guardsForDefinition({
       client,
       clientForGdr: buildClientForGdr(client, resourceClients),
@@ -4025,7 +4669,7 @@ const workflow = {
   queryInScope: async (args) => {
     const { client, tag, instanceId, groq, params, resourceClients } = args, clock = args.clock ?? wallClock;
     validateTag(tag);
-    const instance = await reload(client, instanceId, tag), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams({ instance, now: clock(), snapshot }), tree = parse(groq, { params: { ...reserved, ...params } });
+    const instance = await reload({ client, instanceId, tag }), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams({ instance, now: clock(), snapshot }), tree = parse(groq, { params: { ...reserved, ...params } });
     return await (await evaluate(tree, {
       dataset: snapshot.docs,
       params: { ...reserved, ...params }
@@ -4035,13 +4679,13 @@ const workflow = {
    * List every pending effect on the instance. Returns the same entries
    * the runtime would see — claimed and unclaimed alike.
    */
-  listPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tag)).pendingEffects,
+  listPendingEffects: async (args) => (await reload({ client: args.client, instanceId: args.instanceId, tag: args.tag })).pendingEffects,
   /**
    * Filter pending effects on the instance by criteria. `claimed`
    * filters on claim presence; `names` restricts to specific effect
    * names. Both filters compose (AND).
    */
-  findPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tag)).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.name))),
+  findPendingEffects: async (args) => (await reload({ client: args.client, instanceId: args.instanceId, tag: args.tag })).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.name))),
   /**
    * Project the instance from a given actor's perspective. Returns a
    * `WorkflowEvaluation` with per-action verdicts (`allowed` + a
@@ -4090,7 +4734,7 @@ const workflow = {
   children: async (args) => {
     const { client, tag, instanceId, activity } = args;
     validateTag(tag);
-    const parent = await reload(client, instanceId, tag), isSpawned = (h) => h._type === "spawned", ids = parent.history.filter(isSpawned).filter((h) => activity === void 0 || h.activity === activity).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
+    const parent = await reload({ client, instanceId, tag }), isSpawned = (h) => h._type === "spawned", ids = parent.history.filter(isSpawned).filter((h) => activity === void 0 || h.activity === activity).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
     return ids.length === 0 ? [] : client.fetch(
       `*[_id in $ids && ${tagScopeFilter()}] | order(startedAt asc)`,
       { ids, tag }
@@ -4186,7 +4830,7 @@ async function verifyDeployedDefinitionsInternal(args) {
       locations: m.locations,
       definitionId: m.definitionId
     };
-    if (await applyMissingHandler(missingHandler, info, log) === "fail")
+    if (await applyMissingHandler({ policy: missingHandler, info, log }) === "fail")
       throw new Error(
         `verifyDeployedDefinitions: missing handler for "${m.name}" referenced by ${m.definitionId} at ${m.locations.join(", ")}`
       );
@@ -4227,21 +4871,30 @@ async function drainEffectsInternal(args) {
   validateTag(tag);
   const log = logger("drainEffects"), drained = [], failed = [], skipped = [], skippedKeys = /* @__PURE__ */ new Set();
   for (; ; ) {
-    const before = await reload(client, instanceId, tag), candidate = before.pendingEffects.find(
+    const before = await reload({ client, instanceId, tag }), candidate = before.pendingEffects.find(
       (e) => e.claim === void 0 && !skippedKeys.has(e._key)
     );
     if (candidate === void 0) break;
     const handler = effectHandlers[candidate.name];
     if (handler === void 0) {
-      await assertSkippableOrThrow(missingHandler, candidate, instanceId, log), skipped.push(candidate), skippedKeys.add(candidate._key);
+      await assertSkippableOrThrow({ missingHandler, candidate, instanceId, log }), skipped.push(candidate), skippedKeys.add(candidate._key);
       continue;
     }
-    if (!await claimPendingEffect(client, before, candidate._key, drainerActor)) continue;
-    const { outputs, dispatchError } = await dispatchEffect(handler, candidate, {
+    if (!await claimPendingEffect({
       client,
-      clientFor,
-      instanceId,
-      logger
+      instance: before,
+      effectKey: candidate._key,
+      drainerActor
+    })) continue;
+    const { outputs, ops, dispatchError } = await dispatchEffect({
+      handler,
+      candidate,
+      ctx: {
+        client,
+        clientFor,
+        instanceId,
+        logger
+      }
     });
     await reportEffectOutcome({
       client,
@@ -4252,32 +4905,44 @@ async function drainEffectsInternal(args) {
       effectKey: candidate._key,
       access: completionAccess,
       outputs,
+      ops,
       dispatchError
     }), dispatchError === void 0 ? drained.push(candidate) : failed.push(candidate);
   }
   return { drained, failed, skipped };
 }
 async function reportEffectOutcome(args) {
-  const { outputs, dispatchError, resourceClients, ...rest } = args;
+  const { outputs, ops, dispatchError, resourceClients, ...rest } = args;
   await workflow.completeEffect({
     ...rest,
     ...resourceClients !== void 0 ? { resourceClients } : {},
     status: dispatchError === void 0 ? "done" : "failed",
     ...outputs !== void 0 ? { outputs } : {},
+    ...ops !== void 0 ? { ops } : {},
     ...dispatchError !== void 0 ? { error: dispatchError } : {}
   });
 }
-async function assertSkippableOrThrow(missingHandler, candidate, instanceId, log) {
-  if (await applyMissingHandler(
-    missingHandler,
-    { phase: "drain", name: candidate.name, effectKey: candidate._key, instanceId },
+async function assertSkippableOrThrow({
+  missingHandler,
+  candidate,
+  instanceId,
+  log
+}) {
+  if (await applyMissingHandler({
+    policy: missingHandler,
+    info: { phase: "drain", name: candidate.name, effectKey: candidate._key, instanceId },
     log
-  ) === "fail")
+  }) === "fail")
     throw new Error(
       `drainEffects: no handler registered for "${candidate.name}" (effectKey=${candidate._key}, instanceId=${instanceId})`
     );
 }
-async function claimPendingEffect(client, instance, effectKey, drainerActor) {
+async function claimPendingEffect({
+  client,
+  instance,
+  effectKey,
+  drainerActor
+}) {
   const claim = {
     _type: "pendingEffect.claim",
     claimedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -4290,7 +4955,11 @@ async function claimPendingEffect(client, instance, effectKey, drainerActor) {
     return !1;
   }
 }
-async function dispatchEffect(handler, candidate, ctx) {
+async function dispatchEffect({
+  handler,
+  candidate,
+  ctx
+}) {
   try {
     const result = await handler(candidate.params, {
       client: ctx.client,
@@ -4299,13 +4968,20 @@ async function dispatchEffect(handler, candidate, ctx) {
       effectKey: candidate._key,
       log: (message, extra) => ctx.logger(`effect.${candidate.name}`).info(message, extra)
     });
-    return result?.outputs !== void 0 ? { outputs: result.outputs } : {};
+    return {
+      ...result?.outputs !== void 0 ? { outputs: result.outputs } : {},
+      ...result?.ops !== void 0 ? { ops: result.ops } : {}
+    };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err), stack = err instanceof Error && err.stack !== void 0 ? err.stack : void 0;
     return { dispatchError: stack !== void 0 ? { message, stack } : { message } };
   }
 }
-async function applyMissingHandler(policy, info, log) {
+async function applyMissingHandler({
+  policy,
+  info,
+  log
+}) {
   if (policy === "fail") return "fail";
   if (policy === "skip")
     return log.warn(`Missing effect handler "${info.name}" \u2014 skipping`, { info }), "skip";
@@ -4343,9 +5019,20 @@ function createInstanceSession(args) {
       ...clock !== void 0 ? { now: clock() } : {},
       ...grants !== void 0 ? { grants } : {}
     });
-  }, settleAfterApply = async (actor, held, ranOps) => {
-    const cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
-    return instance = await reload(client, instance._id, tag), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
+  }, settleAfterApply = async ({
+    actor,
+    held,
+    ranOps
+  }) => {
+    const cascaded = await cascade({
+      client,
+      instanceId: instance._id,
+      actor,
+      clientForGdr,
+      ...clock !== void 0 ? { clock } : {},
+      overlay: held
+    });
+    return instance = await reload({ client, instanceId: instance._id, tag }), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
   }, commit = async (run) => {
     committing = !0;
     const held = new Map(overlay);
@@ -4379,13 +5066,20 @@ function createInstanceSession(args) {
     tick() {
       return commit(async (actor, held) => {
         await assertInstanceWriteAllowed({ instance, guards: heldGuards, identity: actor.id });
-        const cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
-        return instance = await reload(client, instance._id, tag), { instance, cascaded, fired: cascaded > 0 };
+        const cascaded = await cascade({
+          client,
+          instanceId: instance._id,
+          actor,
+          clientForGdr,
+          ...clock !== void 0 ? { clock } : {},
+          overlay: held
+        });
+        return instance = await reload({ client, instanceId: instance._id, tag }), { instance, cascaded, fired: cascaded > 0 };
       });
     },
     fireAction({ activity, action, params }) {
       return commit(async (actor, held) => {
-        assertActionAllowed(await evaluateWith(held, heldGuards), activity, action);
+        assertActionAllowed({ evaluation: await evaluateWith(held, heldGuards), activity, action });
         const { grants } = await access(), ranOps = await applyAction({
           client,
           instance,
@@ -4397,7 +5091,7 @@ function createInstanceSession(args) {
           ...clock !== void 0 ? { clock } : {},
           ...params !== void 0 ? { params } : {}
         });
-        return settleAfterApply(actor, held, ranOps);
+        return settleAfterApply({ actor, held, ranOps });
       });
     },
     editField({ target, mode, value }) {
@@ -4414,7 +5108,7 @@ function createInstanceSession(args) {
           ...grants !== void 0 ? { grants } : {},
           ...clock !== void 0 ? { clock } : {}
         });
-        return settleAfterApply(actor, held, ranOps);
+        return settleAfterApply({ actor, held, ranOps });
       });
     }
   };
@@ -4549,8 +5243,12 @@ function createEngine(args) {
     })
   };
 }
-function diffEntry(def, latestRaw, target) {
-  const plan = planDefinitionDeploy(def, asLatest(latestRaw), target), existing = latestRaw ? stripSystemFields(latestRaw) : void 0;
+function diffEntry({
+  def,
+  latestRaw,
+  target
+}) {
+  const plan = planDefinitionDeploy({ def, latest: asLatest(latestRaw), target }), existing = latestRaw ? stripSystemFields(latestRaw) : void 0;
   return {
     name: def.name,
     version: plan.version,
@@ -4563,11 +5261,15 @@ function diffEntry(def, latestRaw, target) {
 function asLatest(raw) {
   return raw === void 0 ? void 0 : { version: typeof raw.version == "number" ? raw.version : 0, ...typeof raw.contentHash == "string" ? { contentHash: raw.contentHash } : {} };
 }
-async function computeDiffEntries(client, defs, target) {
+async function computeDiffEntries({
+  client,
+  defs,
+  target
+}) {
   const entries = [];
   for (const def of defs) {
-    const latest = await loadLatestDeployed(client, def.name, target.tag);
-    entries.push(diffEntry(def, latest, target));
+    const latest = await loadLatestDeployed({ client, definition: def.name, tag: target.tag });
+    entries.push(diffEntry({ def, latestRaw: latest, target }));
   }
   return entries;
 }
@@ -4802,6 +5504,7 @@ export {
   DRIVER_KIND_DISPLAY,
   EFFECTS_CONTEXT_DISPLAY,
   EditFieldDeniedError,
+  EffectOpsInvalidError,
   FIELD_SLOT_DISPLAY,
   GUARD_DOC_TYPE,
   GUARD_LIFTED_PREDICATE,