@sanity/workflow-engine 0.12.0 → 0.14.0

package/dist/_chunks-es/schema.js

@@ -1,9 +1,323 @@
 import * as v from "valibot";
+const KNOWN_SCHEMES = /* @__PURE__ */ new Set(["dataset", "canvas", "media-library", "dashboard"]);
+function parseGdr(uri) {
+  const colon = uri.indexOf(":");
+  if (colon < 0)
+    throw new Error(
+      `Invalid GDR "${uri}": must be a URI of form "<scheme>:<...id-parts>". Known schemes: dataset, canvas, media-library, dashboard.`
+    );
+  const scheme = uri.slice(0, colon), rest = uri.slice(colon + 1);
+  if (!KNOWN_SCHEMES.has(scheme))
+    throw new Error(
+      `Invalid GDR "${uri}": unknown scheme "${scheme}". Known: dataset, canvas, media-library, dashboard.`
+    );
+  const parts = rest.split(":");
+  if (parts.some((part) => part.length === 0))
+    throw new Error(
+      `Invalid GDR "${uri}": id parts must be non-empty (no leading, trailing, or doubled ":").`
+    );
+  if (scheme === "dataset") {
+    if (parts.length !== 3)
+      throw new Error(
+        `Invalid GDR "${uri}": dataset scheme requires <projectId>:<dataset>:<documentId> (3 parts after scheme); got ${parts.length}.`
+      );
+    return {
+      scheme: "dataset",
+      projectId: parts[0],
+      dataset: parts[1],
+      documentId: parts[2]
+    };
+  }
+  if (parts.length !== 2)
+    throw new Error(
+      `Invalid GDR "${uri}": ${scheme} scheme requires <resourceId>:<documentId> (2 parts after scheme); got ${parts.length}.`
+    );
+  return {
+    scheme,
+    resourceId: parts[0],
+    documentId: parts[1]
+  };
+}
+function tryParseGdr(uri) {
+  try {
+    return parseGdr(uri);
+  } catch {
+    return;
+  }
+}
+function gdrUri(parts) {
+  return parts.scheme === "dataset" ? `dataset:${parts.projectId}:${parts.dataset}:${parts.documentId}` : `${parts.scheme}:${parts.resourceId}:${parts.documentId}`;
+}
+function extractDocumentId(gdrUriString) {
+  return parseGdr(gdrUriString).documentId;
+}
+const RESOURCE_ALIAS_NAME_SOURCE = "[a-z0-9][a-z0-9-]*", RESOURCE_ALIAS_NAME_RE = new RegExp(`^${RESOURCE_ALIAS_NAME_SOURCE}$`);
+function validateResourceAliasName(name) {
+  if (!RESOURCE_ALIAS_NAME_RE.test(name))
+    throw new Error(
+      `Invalid resource alias name "${name}": expected lowercase letters, digits, and dashes (no leading dash).`
+    );
+}
+function toPhysicalGdr(id, home) {
+  return isGdrUri(id) ? id : gdrFromResource(home, id);
+}
+function refDataset({
+  projectId,
+  dataset,
+  documentId,
+  type
+}) {
+  return { id: gdrUri({ scheme: "dataset", projectId, dataset, documentId }), type };
+}
+function refCanvas({
+  resourceId,
+  documentId,
+  type
+}) {
+  return { id: gdrUri({ scheme: "canvas", resourceId, documentId }), type };
+}
+function refMediaLibrary({
+  resourceId,
+  documentId,
+  type
+}) {
+  return { id: gdrUri({ scheme: "media-library", resourceId, documentId }), type };
+}
+function refDashboard({
+  resourceId,
+  documentId,
+  type
+}) {
+  return { id: gdrUri({ scheme: "dashboard", resourceId, documentId }), type };
+}
+function datasetResourceParts(id) {
+  const dot = id.indexOf(".");
+  if (dot <= 0 || dot === id.length - 1)
+    throw new Error(`Invalid dataset resource id "${id}": expected "<projectId>.<dataset>".`);
+  return { projectId: id.slice(0, dot), dataset: id.slice(dot + 1) };
+}
+function gdrFromResource(res, documentId) {
+  if (res.type === "dataset") {
+    const { projectId, dataset } = datasetResourceParts(res.id);
+    return gdrUri({ scheme: "dataset", projectId, dataset, documentId });
+  }
+  return gdrUri({ scheme: res.type, resourceId: res.id, documentId });
+}
+function gdrResourcePrefix(res) {
+  const full = gdrFromResource(res, "x");
+  return full.slice(0, full.length - 1);
+}
+function resourceFromParsed(parsed) {
+  return parsed.scheme === "dataset" ? { type: "dataset", id: `${parsed.projectId}.${parsed.dataset}` } : { type: parsed.scheme, id: parsed.resourceId ?? "" };
+}
+function resourceFromGdrUri(uri) {
+  const parsed = tryParseGdr(uri);
+  return parsed === void 0 ? void 0 : resourceFromParsed(parsed);
+}
+function sameResource(a, b) {
+  return a.type === b.type && a.id === b.id;
+}
+function selfGdr(doc) {
+  return gdrFromResource(doc.workflowResource, doc._id);
+}
+function definitionDocId({
+  tag,
+  definition,
+  version
+}) {
+  return `${tag}.${definition}.v${version}`;
+}
+function isGdrUri(value) {
+  return typeof value == "string" && tryParseGdr(value) !== void 0;
+}
+function toBareId(id) {
+  return isGdrUri(id) ? extractDocumentId(id) : id;
+}
+function gdrRef({
+  res,
+  documentId,
+  type
+}) {
+  return { id: gdrFromResource(res, documentId), type };
+}
+function isGdr(value) {
+  return typeof value == "object" && value !== null && typeof value.id == "string" && typeof value.type == "string";
+}
+class WorkflowError extends Error {
+  kind;
+  // oxlint-disable-next-line max-params -- the platform `Error(message, options)` signature with the discriminant prepended
+  constructor(kind, message, options) {
+    super(message, options), this.kind = kind;
+  }
+}
+class ContractViolationError extends WorkflowError {
+  constructor(message) {
+    super("contract-violation", message), this.name = "ContractViolationError";
+  }
+}
+class InstanceNotFoundError extends WorkflowError {
+  instanceId;
+  constructor(args) {
+    super(
+      "instance-not-found",
+      `Workflow instance ${args.instanceId} not found${args.detail ? ` (${args.detail})` : ""}`
+    ), this.name = "InstanceNotFoundError", this.instanceId = args.instanceId;
+  }
+}
+class DefinitionNotFoundError extends WorkflowError {
+  definition;
+  version;
+  constructor(args) {
+    super(
+      "definition-not-found",
+      args.version !== void 0 ? `Workflow definition ${args.definition} v${args.version} not deployed` : `Workflow definition ${args.definition} has no deployed versions`
+    ), this.name = "DefinitionNotFoundError", this.definition = args.definition, args.version !== void 0 && (this.version = args.version);
+  }
+}
+class DefinitionInUseError extends WorkflowError {
+  definition;
+  blockedBy;
+  constructor(args) {
+    super("definition-in-use", definitionInUseMessage(args.definition, args.blockedBy)), this.name = "DefinitionInUseError", this.definition = args.definition, this.blockedBy = args.blockedBy;
+  }
+}
+function definitionInUseMessage(definition, blockedBy) {
+  if (blockedBy.reason === "non-terminal-instances") {
+    const head = blockedBy.instanceIds.slice(0, 3).join(", "), preview = blockedBy.instanceIds.length > 3 ? `${head}, \u2026` : head;
+    return `Cannot delete ${definition}: ${blockedBy.instanceIds.length} non-terminal instance(s) exist (${preview}). Pass cascade to abort them first \u2014 instances are aborted in place, never deleted.`;
+  }
+  const names = blockedBy.referrers.map((r) => `${r.definition} v${r.version}`).join(", ");
+  return `Cannot delete ${definition}: still spawn-referenced by deployed definition(s) ${names}. Delete or redeploy the referrer(s) first.`;
+}
+class EffectNotFoundError extends WorkflowError {
+  instanceId;
+  effectKey;
+  constructor(args) {
+    super(
+      "effect-not-found",
+      `Pending effect "${args.effectKey}" not found on instance ${args.instanceId}`
+    ), this.name = "EffectNotFoundError", this.instanceId = args.instanceId, this.effectKey = args.effectKey;
+  }
+}
+const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+function validateTag(tag) {
+  if (!TAG_RE.test(tag))
+    throw new ContractViolationError(
+      `tag: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
+    );
+}
+function tagScopeFilter() {
+  return "tag == $tag";
+}
+const NonEmptyString = v.pipe(v.string(), v.nonEmpty("must not be empty"));
+function asPredicate(validate) {
+  return (value) => {
+    try {
+      return validate(value), !0;
+    } catch {
+      return !1;
+    }
+  };
+}
+const isValidTag = asPredicate(validateTag), isValidAliasName = asPredicate(validateResourceAliasName), isValidDatasetId = asPredicate(datasetResourceParts), WorkflowResourceSchema = v.variant("type", [
+  v.object({
+    type: v.literal("dataset"),
+    id: v.pipe(
+      NonEmptyString,
+      v.check(isValidDatasetId, 'invalid dataset resource id \u2014 expected "<projectId>.<dataset>"')
+    )
+  }),
+  v.object({ type: v.literal("canvas"), id: NonEmptyString }),
+  v.object({ type: v.literal("media-library"), id: NonEmptyString }),
+  v.object({ type: v.literal("dashboard"), id: NonEmptyString })
+]), ResourceBindingSchema = v.object({
+  name: v.pipe(
+    NonEmptyString,
+    v.check(
+      isValidAliasName,
+      "invalid resource handle name \u2014 lowercase letters, digits and dashes only, no leading dash"
+    )
+  ),
+  resource: WorkflowResourceSchema
+}), DefinitionSchema = v.custom(
+  (input) => typeof input == "object" && input !== null && typeof input.name == "string",
+  "expected a workflow definition (an object with a string `name`)"
+), DeploymentSchema = v.object({
+  name: NonEmptyString,
+  tag: v.pipe(
+    v.string(),
+    v.nonEmpty(),
+    v.check(
+      isValidTag,
+      "invalid tag \u2014 lowercase letters, digits and dashes only, no leading dash, no dots"
+    )
+  ),
+  workflowResource: WorkflowResourceSchema,
+  // Optional — omit for a workflow whose definitions reference no `@handle:`.
+  // No valibot default: a default makes the inferred output `resourceAliases`
+  // required (poor authoring ergonomics) and diverges input from output,
+  // which the shared `parseOrThrow` can't model. resourceAliasesToMap treats
+  // an absent map as none.
+  //
+  // Handle names must be unique: resourceAliasesToMap collapses bindings into a
+  // map, so a duplicate would silently overwrite — and the dup is gone before
+  // the engine sees it. Caught here, at the only layer that still can.
+  resourceAliases: v.optional(
+    v.pipe(
+      v.array(ResourceBindingSchema),
+      v.check(
+        (bindings) => new Set(bindings.map((binding) => binding.name)).size === bindings.length,
+        "duplicate resource handle name \u2014 each binding name must be unique within a deployment"
+      )
+    )
+  ),
+  definitions: v.pipe(
+    v.array(DefinitionSchema),
+    v.minLength(1, "a deployment needs at least one definition")
+  )
+}), WorkflowConfigSchema = v.object({
+  // Tags must be unique: a tag is the environment key the CLI selects a
+  // deployment by, so two deployments sharing one make selection ambiguous.
+  // Enforced here so the ambiguity is a config error, not a deploy-time
+  // surprise — and so consumers can treat a tag as naming one deployment.
+  deployments: v.pipe(
+    v.array(DeploymentSchema),
+    v.minLength(1, "a config needs at least one deployment"),
+    v.check(
+      (deployments) => new Set(deployments.map((deployment) => deployment.tag)).size === deployments.length,
+      "duplicate deployment tag \u2014 each deployment must use a unique tag"
+    )
+  )
+});
+function resourceAliasesToMap(resourceAliases) {
+  return Object.fromEntries(
+    (resourceAliases ?? []).map((binding) => [
+      binding.name,
+      binding.resource
+    ])
+  );
+}
 function andConditions(parts) {
   const present = parts.filter((p) => p !== void 0);
   if (present.length !== 0)
     return present.length === 1 ? present[0] : present.map((p) => `(${p})`).join(" && ");
 }
+const FIELD_READ = /^\$fields\.(\w+)(?:\.(.+))?$/, EFFECTS_READ = /^\$effects\['([^']+)'\](?:\.(.+))?$/;
+function isGuardReadExpr(expr) {
+  return expr === "$self" || expr === "$now" || FIELD_READ.test(expr) || EFFECTS_READ.test(expr);
+}
+function printGuardRead(read) {
+  switch (read.type) {
+    case "self":
+      return "$self";
+    case "now":
+      return "$now";
+    case "fieldRead":
+      return read.path === void 0 ? `$fields.${read.field}` : `$fields.${read.field}.${read.path}`;
+    case "effectsRead":
+      return read.path === void 0 ? `$effects['${read.effect}']` : `$effects['${read.effect}'].${read.path}`;
+  }
+}
 const UNIVERSAL_ROLE_ALIAS_KEY = "$all";
 function normalizeRoleAliases(aliases) {
   if (aliases === void 0 || !("*" in aliases)) return aliases;
@@ -20,11 +334,259 @@ function expandRequiredRoles(required, aliases) {
   for (const fulfiller of aliases[UNIVERSAL_ROLE_ALIAS_KEY] ?? []) out.add(fulfiller);
   return [...out];
 }
-function actorFulfillsRole(actorRoles, required, aliases) {
+function actorFulfillsRole({
+  actorRoles,
+  required,
+  aliases
+}) {
   if (actorRoles === void 0 || actorRoles.length === 0) return !1;
   const accepted = new Set(expandRequiredRoles([required], aliases));
   return actorRoles.some((role) => accepted.has(role));
 }
+const CONDITION_VARS = [
+  {
+    name: "self",
+    binding: "always",
+    description: "GDR URI of the instance document itself \u2014 `*[_id == $self][0]` reads the instance in the snapshot."
+  },
+  {
+    name: "fields",
+    binding: "always",
+    description: "Declared field entries rendered by name (`$fields.<name>` is the value, no envelope). Stage/activity scopes overlay lexically; `doc.ref` values render the hydrated document when the snapshot holds it."
+  },
+  {
+    name: "parent",
+    binding: "always",
+    description: "The parent instance's GDR URI, `null` on a root instance."
+  },
+  {
+    name: "ancestors",
+    binding: "always",
+    description: "GDR URIs of the ancestor chain, root first."
+  },
+  { name: "stage", binding: "always", description: "The current stage's name." },
+  {
+    name: "now",
+    binding: "always",
+    description: "The ISO clock reading shared by every condition in one evaluation pass, so they agree on the time."
+  },
+  {
+    name: "effects",
+    binding: "always",
+    description: "The `effectsContext` map: stable handler params seeded at start plus completed effects' outputs namespaced by effect name (`$effects['<effect>'].<output>`). Handler fuel \u2014 transition filters should read instance/lake state (or $effectStatus) instead."
+  },
+  {
+    name: "effectStatus",
+    binding: "always",
+    description: "Effect name \u2192 `'done'` | `'failed'` of the latest completed run queued during the current stage entry; absent until the effect drains for this entry. Re-entry-safe: runs queued under a prior entry never count, so `$effectStatus['<effect>'] == 'done'` (or `defined($effectStatus['<effect>'])` for settled-either-way) waits for the fresh run."
+  },
+  {
+    name: "activities",
+    binding: "always",
+    description: "The current stage's activity rows, statuses included."
+  },
+  {
+    name: "allActivitiesDone",
+    binding: "always",
+    description: "Every current-stage activity is `done` or `skipped` \u2014 the default transition gate."
+  },
+  {
+    name: "anyActivityFailed",
+    binding: "always",
+    description: "Some current-stage activity is `failed`."
+  },
+  {
+    name: "actor",
+    binding: "caller",
+    description: "The acting identity (id + roles); `undefined` when no caller rides the evaluation."
+  },
+  {
+    name: "assigned",
+    binding: "caller",
+    description: "Whether the caller matches the activity's assignees-kind field entry (by user id, or by a role under the definition's `roleAliases`); `false` outside an activity context."
+  },
+  {
+    name: "can",
+    binding: "caller",
+    description: "Advisory per-permission booleans computed from the caller's grants; `undefined` without grants. Bound only while an action fires, so it may appear in action filters only (deploy-enforced)."
+  },
+  {
+    name: "row",
+    binding: "spawn",
+    description: "One `subworkflows.forEach` result row, bound while its `with` map evaluates \u2014 and the row under test while a where-op `where` evaluates (per row)."
+  },
+  {
+    name: "params",
+    binding: "caller",
+    description: "The firing action's args \u2014 bound while its effect bindings and where-op `where` conditions evaluate."
+  },
+  {
+    name: "subworkflows",
+    binding: "spawn",
+    description: "The spawned child rows (status included) of the spawning activity, bound for its `completeWhen`/`failWhen` \u2014 the implicit completion gate reads it."
+  }
+], RESERVED_CONDITION_VARS = CONDITION_VARS.map((v2) => v2.name), FILTER_SCOPE_VARS = CONDITION_VARS.filter(
+  (v2) => v2.binding === "always"
+).map((v2) => v2.name), GUARD_PREDICATE_VARS = [
+  {
+    name: "guard",
+    description: "The guard document itself (its `metadata` carries deploy-time resolved values)."
+  },
+  {
+    name: "mutation",
+    description: "The attempted mutation \u2014 `mutation.action` is the write kind being gated."
+  }
+], ACTOR_KINDS = ["person", "agent", "system"];
+class FieldValueShapeError extends WorkflowError {
+  entryType;
+  entryName;
+  issues;
+  constructor(args) {
+    const issueText = args.issues.join("; ");
+    super(
+      "field-value-shape",
+      `Field entry ${args.mode} shape invalid for "${args.entryName}" (${args.entryType}): ${issueText}`
+    ), this.name = "FieldValueShapeError", this.entryType = args.entryType, this.entryName = args.entryName, this.issues = args.issues;
+  }
+}
+const GdrShape = v.looseObject({
+  id: v.pipe(
+    v.string(),
+    v.check((s) => isGdrUri(s), "must be a GDR URI")
+  ),
+  type: v.pipe(v.string(), v.minLength(1))
+}), ReleaseRefShape = v.looseObject({
+  id: v.pipe(
+    v.string(),
+    v.check((s) => isGdrUri(s), "must be a GDR URI")
+  ),
+  type: v.literal("system.release"),
+  releaseName: v.pipe(v.string(), v.minLength(1))
+}), ActorShape = v.looseObject({
+  kind: v.picklist(ACTOR_KINDS),
+  id: v.pipe(v.string(), v.minLength(1)),
+  roles: v.optional(v.array(v.string())),
+  onBehalfOf: v.optional(v.string())
+}), AssigneeShape = v.union([
+  v.looseObject({ type: v.literal("user"), id: v.pipe(v.string(), v.minLength(1)) }),
+  v.looseObject({ type: v.literal("role"), role: v.pipe(v.string(), v.minLength(1)) })
+]), NullableString = v.union([v.null(), v.string()]), NullableNumber = v.union([v.null(), v.number()]), NullableBoolean = v.union([v.null(), v.boolean()]), NullableDateTime = v.union([
+  v.null(),
+  v.pipe(
+    v.string(),
+    v.check((s) => !Number.isNaN(Date.parse(s)), "must be an ISO-8601 datetime string")
+  )
+]), NullableDate = v.union([
+  v.null(),
+  v.pipe(v.string(), v.regex(/^\d{4}-\d{2}-\d{2}$/, "must be a `YYYY-MM-DD` date"))
+]), NullableUrl = NullableString, valueSchemas = {
+  "doc.ref": v.union([v.null(), GdrShape]),
+  "doc.refs": v.array(GdrShape),
+  "release.ref": v.union([v.null(), ReleaseRefShape]),
+  query: v.any(),
+  string: NullableString,
+  text: NullableString,
+  number: NullableNumber,
+  boolean: NullableBoolean,
+  date: NullableDate,
+  datetime: NullableDateTime,
+  url: NullableUrl,
+  actor: v.union([v.null(), ActorShape]),
+  assignee: v.union([v.null(), AssigneeShape]),
+  assignees: v.array(AssigneeShape)
+};
+function shapeValueSchema(shape, leaf) {
+  return shape.type === "object" ? objectSchema(shape.fields ?? [], leaf) : shape.type === "array" ? v.array(objectSchema(shape.of ?? [], leaf)) : leaf[shape.type] ?? v.any();
+}
+function objectSchema(fields, leaf) {
+  const entries = /* @__PURE__ */ Object.create(null);
+  for (const f of fields) entries[f.name] = v.optional(shapeValueSchema(f, leaf));
+  return v.looseObject(entries);
+}
+function wholeValueSchema(args) {
+  const { entryType, shape, leaf } = args;
+  return entryType === "object" ? v.union([v.null(), objectSchema(shape.fields ?? [], leaf)]) : entryType === "array" ? v.array(objectSchema(shape.of ?? [], leaf)) : leaf[entryType];
+}
+function appendItemSchema(entryType, shape) {
+  if (entryType === "array") return objectSchema(shape.of ?? [], valueSchemas);
+  if (entryType === "doc.refs") return GdrShape;
+  if (entryType === "assignees") return AssigneeShape;
+}
+function checkFieldValue(args) {
+  return checkValueAgainst(args, valueSchemas);
+}
+function checkValueAgainst(args, leaf) {
+  const schema = wholeValueSchema({ entryType: args.entryType, shape: args, leaf });
+  if (schema === void 0) return [`unknown field entry type ${args.entryType}`];
+  const result = v.safeParse(schema, args.value);
+  return result.success ? void 0 : formatIssues(result.issues);
+}
+function validateFieldValue(args) {
+  const issues = checkFieldValue(args);
+  if (issues !== void 0)
+    throw new FieldValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
+      issues,
+      mode: "value"
+    });
+}
+const BARE_ID_SOURCE = "[A-Za-z0-9_][A-Za-z0-9._-]*", BARE_ID_RE = new RegExp(`^${BARE_ID_SOURCE}$`), ALIAS_REF_RE = new RegExp(`^@${RESOURCE_ALIAS_NAME_SOURCE}:${BARE_ID_SOURCE}$`);
+function isAuthoringRefId(id) {
+  return id.startsWith("@") ? ALIAS_REF_RE.test(id) : id.includes(":") ? isGdrUri(id) : BARE_ID_RE.test(id);
+}
+function isBareSeedId(id) {
+  return BARE_ID_RE.test(id);
+}
+const AuthoringRefId = v.pipe(
+  v.string(),
+  v.check(
+    isAuthoringRefId,
+    "must be a bare document id, a GDR URI, or a portable `@<alias>:<id>` reference"
+  )
+), AuthoringGdrShape = v.looseObject({
+  id: AuthoringRefId,
+  type: v.pipe(v.string(), v.minLength(1))
+}), seedValueSchemas = {
+  ...valueSchemas,
+  "doc.ref": v.union([v.null(), AuthoringGdrShape]),
+  "doc.refs": v.array(AuthoringGdrShape),
+  "release.ref": v.union([
+    v.null(),
+    v.looseObject({
+      id: AuthoringRefId,
+      type: v.literal("system.release"),
+      releaseName: v.pipe(v.string(), v.minLength(1))
+    })
+  ])
+};
+function checkLiteralSeed(args) {
+  return args.value === null ? ["a literal seed cannot be null \u2014 omit `initialValue` to start the field empty"] : checkValueAgainst(args, seedValueSchemas);
+}
+function validateFieldAppendItem(args) {
+  const schema = appendItemSchema(args.entryType, args);
+  if (schema === void 0)
+    throw new FieldValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
+      issues: [`field entry type ${args.entryType} does not support append`],
+      mode: "item"
+    });
+  const result = v.safeParse(schema, args.item);
+  if (!result.success)
+    throw new FieldValueShapeError({
+      entryType: args.entryType,
+      entryName: args.entryName,
+      issues: formatIssues(result.issues),
+      mode: "item"
+    });
+}
+function formatIssues(issues) {
+  return issues.map((i) => {
+    const keys = i.path?.map((p) => p.key) ?? [];
+    return `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${i.message}`;
+  });
+}
 const ACTIVITY_STATUSES = ["pending", "active", "done", "skipped", "failed"], TERMINAL_ACTIVITY_STATUSES = ["done", "skipped", "failed"];
 function isTerminalActivityStatus(status) {
   return TERMINAL_ACTIVITY_STATUSES.includes(status);
@@ -51,6 +613,9 @@ function picklist(options) {
     `Invalid option: expected one of ${options.map((o) => `"${o}"`).join("|")}`
   );
 }
+function pinned() {
+  return (schema, ..._exact) => schema;
+}
 const LiteralSchema = v.strictObject({ type: v.literal("literal"), value: v.unknown() }), FieldReadSchema = v.strictObject({
   type: v.literal("fieldRead"),
   scope: v.optional(v.union([v.literal("workflow"), v.literal("stage")])),
@@ -99,17 +664,7 @@ function manualTargetSchema(ref) {
     v.strictObject({ type: v.literal("field"), field: ref })
   ]);
 }
-const StoredManualTargetSchema = manualTargetSchema(StoredFieldRefSchema), AuthoringManualTargetSchema = manualTargetSchema(v.union([NonEmpty, AuthoringFieldRefSchema])), OpPredicateSchema = v.lazy(
-  () => v.union([
-    v.strictObject({
-      type: v.literal("field"),
-      field: NonEmpty,
-      equals: ValueExprSchema
-    }),
-    v.strictObject({ type: v.literal("all"), of: v.array(OpPredicateSchema) }),
-    v.strictObject({ type: v.literal("any"), of: v.array(OpPredicateSchema) })
-  ])
-);
+const StoredManualTargetSchema = manualTargetSchema(StoredFieldRefSchema), AuthoringManualTargetSchema = manualTargetSchema(v.union([NonEmpty, AuthoringFieldRefSchema])), ConditionSchema = NonEmpty;
 function opSchemas(targetSchema) {
   return [
     v.strictObject({
@@ -129,24 +684,24 @@ function opSchemas(targetSchema) {
     v.strictObject({
       type: v.literal("field.updateWhere"),
       target: targetSchema,
-      where: OpPredicateSchema,
+      where: ConditionSchema,
       value: ValueExprSchema
     }),
     v.strictObject({
       type: v.literal("field.removeWhere"),
       target: targetSchema,
-      where: OpPredicateSchema
+      where: ConditionSchema
     })
   ];
 }
-const StoredOpSchema = v.variant("type", [
+const StoredFieldOpSchema = v.variant("type", [...opSchemas(StoredFieldRefSchema)]), StoredOpSchema = v.variant("type", [
   ...opSchemas(StoredFieldRefSchema),
   v.strictObject({
     type: v.literal("status.set"),
     activity: NonEmpty,
     status: picklist(ACTIVITY_STATUSES)
   })
-]), StoredTransitionOpSchema = v.variant("type", [...opSchemas(StoredFieldRefSchema)]), AuditOpSchema = v.strictObject({
+]), StoredTransitionOpSchema = StoredFieldOpSchema, AuditOpSchema = v.strictObject({
   type: v.literal("audit"),
   target: AuthoringFieldRefSchema,
   value: ValueExprSchema,
@@ -235,7 +790,7 @@ const FieldShapeSchema = v.lazy(
     of: v.optional(v.array(FieldShapeSchema))
   })
 ), StoredEditableSchema = v.union([v.literal(!0), NonEmpty]), AuthoringEditableSchema = v.union([v.literal(!0), v.array(NonEmpty), NonEmpty]);
-function slotFields(editable) {
+function fieldBase(editable) {
   return {
     name: FieldEntryName,
     title: v.optional(v.string()),
@@ -251,41 +806,62 @@ function slotFields(editable) {
     /**
      * How this field SEEDS its value at materialisation — see
      * {@link FieldSourceSchema}. Optional: an absent `initialValue` is working
-     * memory (the slot starts empty and an op fills it later), the common case.
+     * memory (the field starts empty and an op fills it later), the common case.
      */
     initialValue: v.optional(FieldSourceSchema),
-    /** Who-may-edit this slot via the edit seam — see {@link StoredEditableSchema}. */
+    /** Who-may-edit this field via the edit seam — see {@link StoredEditableSchema}. */
     editable: v.optional(editable)
   };
 }
 function fieldEntryFields(editable) {
   return {
     type: FieldKindSchema,
-    ...slotFields(editable),
+    ...fieldBase(editable),
     /** Sub-field shapes for an `object` kind (see {@link compositeShapeOk}). */
     fields: v.optional(v.array(FieldShapeSchema)),
     /** Item sub-field shapes for an `array` kind (see {@link compositeShapeOk}). */
     of: v.optional(v.array(FieldShapeSchema))
   };
 }
-const FieldEntrySchema = compositeChecked(fieldEntryFields(StoredEditableSchema)), RawAuthoringFieldEntrySchema = compositeChecked(fieldEntryFields(AuthoringEditableSchema)), ClaimFieldSchema = v.strictObject({
-  type: v.literal("claim"),
-  name: FieldEntryName,
-  title: v.optional(v.string()),
-  description: v.optional(v.string())
-});
+function literalSeedIssues(entry) {
+  if (entry.initialValue?.type === "literal")
+    return checkLiteralSeed({
+      entryType: entry.type,
+      value: entry.initialValue.value,
+      fields: entry.fields,
+      of: entry.of
+    });
+}
+function literalSeedCheck() {
+  return v.check(
+    (entry) => literalSeedIssues(entry) === void 0,
+    (issue) => `initialValue literal does not fit the declared kind: ${(literalSeedIssues(issue.input) ?? []).join("; ")}`
+  );
+}
+const FieldEntrySchema = pinned()(
+  v.pipe(compositeChecked(fieldEntryFields(StoredEditableSchema)), literalSeedCheck())
+), RawAuthoringFieldEntrySchema = pinned()(
+  v.pipe(
+    compositeChecked(fieldEntryFields(AuthoringEditableSchema)),
+    literalSeedCheck()
+  )
+), ClaimFieldSchema = pinned()(
+  v.strictObject({
+    type: v.literal("claim"),
+    name: FieldEntryName,
+    title: v.optional(v.string()),
+    description: v.optional(v.string())
+  })
+);
 function listSugarFields(type) {
   return {
     type: v.literal(type),
-    ...slotFields(AuthoringEditableSchema)
+    ...fieldBase(AuthoringEditableSchema)
   };
 }
-const TodoListFieldSchema = v.strictObject(listSugarFields("todoList")), NotesFieldSchema = v.strictObject(listSugarFields("notes")), AuthoringFieldEntrySchema = v.union([
-  RawAuthoringFieldEntrySchema,
-  ClaimFieldSchema,
-  TodoListFieldSchema,
-  NotesFieldSchema
-]), ConditionSchema = NonEmpty, EffectSchema = v.strictObject({
+const TodoListFieldSchema = pinned()(v.strictObject(listSugarFields("todoList"))), NotesFieldSchema = pinned()(v.strictObject(listSugarFields("notes"))), AuthoringFieldEntrySchema = pinned()(
+  v.union([RawAuthoringFieldEntrySchema, ClaimFieldSchema, TodoListFieldSchema, NotesFieldSchema])
+), EffectSchema = v.strictObject({
   name: NonEmpty,
   title: v.optional(v.string()),
   description: v.optional(v.string()),
@@ -317,8 +893,8 @@ function actionFields(op) {
     description: v.optional(v.string()),
     /**
      * The one gate mechanism: a condition over the rendered scope. Hard
-     * enforcement lives outside the engine entirely (the lake ACL on the
-     * documents, and guards) — every engine-evaluated gate is authoring/UX.
+     * enforcement lives outside the engine; every engine-evaluated gate is
+     * authoring/UX.
      */
     filter: v.optional(ConditionSchema),
     params: v.optional(v.array(ActionParamSchema)),
@@ -326,21 +902,27 @@ function actionFields(op) {
     effects: v.optional(v.array(EffectSchema))
   };
 }
-const StoredActionSchema = v.strictObject(actionFields(StoredOpSchema)), TerminalActivityStatus = picklist(TERMINAL_ACTIVITY_STATUSES), RawAuthoringActionSchema = v.strictObject({
-  ...actionFields(AuthoringOpSchema),
-  roles: v.optional(v.array(NonEmpty)),
-  status: v.optional(TerminalActivityStatus)
-}), ClaimActionSchema = v.strictObject({
-  type: v.literal("claim"),
-  name: NonEmpty,
-  title: v.optional(v.string()),
-  description: v.optional(v.string()),
-  field: v.union([NonEmpty, AuthoringFieldRefSchema]),
-  roles: v.optional(v.array(NonEmpty)),
-  filter: v.optional(ConditionSchema),
-  params: v.optional(v.array(ActionParamSchema)),
-  effects: v.optional(v.array(EffectSchema))
-}), AuthoringActionSchema = v.union([RawAuthoringActionSchema, ClaimActionSchema]), DefinitionRefSchema = v.strictObject({
+const StoredActionSchema = pinned()(v.strictObject(actionFields(StoredOpSchema))), TerminalActivityStatus = picklist(TERMINAL_ACTIVITY_STATUSES), RawAuthoringActionSchema = pinned()(
+  v.strictObject({
+    ...actionFields(AuthoringOpSchema),
+    roles: v.optional(v.array(NonEmpty)),
+    status: v.optional(TerminalActivityStatus)
+  })
+), ClaimActionSchema = pinned()(
+  v.strictObject({
+    type: v.literal("claim"),
+    name: NonEmpty,
+    title: v.optional(v.string()),
+    description: v.optional(v.string()),
+    field: v.union([NonEmpty, AuthoringFieldRefSchema]),
+    roles: v.optional(v.array(NonEmpty)),
+    filter: v.optional(ConditionSchema),
+    params: v.optional(v.array(ActionParamSchema)),
+    effects: v.optional(v.array(EffectSchema))
+  })
+), AuthoringActionSchema = pinned()(
+  v.union([RawAuthoringActionSchema, ClaimActionSchema])
+), DefinitionRefSchema = v.strictObject({
   name: NonEmpty,
   version: v.optional(v.union([PositiveInt, v.literal("latest")]))
 }), SubworkflowsSchema = v.strictObject({
@@ -356,7 +938,7 @@ const StoredActionSchema = v.strictObject(actionFields(StoredOpSchema)), Termina
    */
   context: v.optional(v.record(NonEmpty, ConditionSchema))
 });
-function activityFields(field, action, op, target) {
+function activityFields({ field, action, op, target }) {
   return {
     name: NonEmpty,
     title: v.optional(v.string()),
@@ -379,8 +961,8 @@ function activityFields(field, action, op, target) {
      * (visibility). An unmet requirement keeps the activity visible but disables
      * its actions with a `requirements-unmet` verdict naming the unmet keys;
      * all must hold (any-of lives inside one condition). Advisory like every
-     * engine gate — the lake still enforces. Distinct from ACL (authorization)
-     * and guards (content-write locks).
+     * engine gate. Distinct from ACL (authorization) and guards
+     * (content-write locks).
      */
     requirements: v.optional(v.record(NonEmpty, ConditionSchema)),
     /**
@@ -403,14 +985,23 @@ function activityFields(field, action, op, target) {
     fields: v.optional(v.array(field))
   };
 }
-const StoredActivitySchema = v.strictObject(
-  activityFields(FieldEntrySchema, StoredActionSchema, StoredOpSchema, StoredManualTargetSchema)
-), AuthoringActivitySchema = v.strictObject(
-  activityFields(
-    AuthoringFieldEntrySchema,
-    AuthoringActionSchema,
-    AuthoringOpSchema,
-    AuthoringManualTargetSchema
+const StoredActivitySchema = pinned()(
+  v.strictObject(
+    activityFields({
+      field: FieldEntrySchema,
+      action: StoredActionSchema,
+      op: StoredOpSchema,
+      target: StoredManualTargetSchema
+    })
+  )
+), AuthoringActivitySchema = pinned()(
+  v.strictObject(
+    activityFields({
+      field: AuthoringFieldEntrySchema,
+      action: AuthoringActionSchema,
+      op: AuthoringOpSchema,
+      target: AuthoringManualTargetSchema
+    })
   )
 );
 function transitionFields(op, filter) {
@@ -425,47 +1016,84 @@ function transitionFields(op, filter) {
     effects: v.optional(v.array(EffectSchema))
   };
 }
-const StoredTransitionSchema = v.strictObject(
-  transitionFields(StoredTransitionOpSchema, ConditionSchema)
+const StoredTransitionSchema = pinned()(
+  v.strictObject(transitionFields(StoredTransitionOpSchema, ConditionSchema))
 ), AuthoringTransitionOpSchema = v.variant("type", [
   ...opSchemas(AuthoringFieldRefSchema),
   AuditOpSchema
-]), AuthoringTransitionSchema = v.strictObject(
-  transitionFields(AuthoringTransitionOpSchema, v.optional(ConditionSchema))
-), GuardActionSchema = picklist(MUTATION_GUARD_ACTIONS), GuardMatchSchema = v.strictObject({
-  /** Subject `_type`(s); empty matches any type. */
-  types: v.optional(v.array(NonEmpty)),
-  /** Target docs as `$fields` reads (or `"$self"`), resolved at deploy to bare ids + the resource. */
-  idRefs: v.optional(v.array(NonEmpty)),
-  /** Glob id patterns (bare, resource-local). */
-  idPatterns: v.optional(v.array(NonEmpty)),
-  actions: v.pipe(
-    v.array(GuardActionSchema),
-    v.minLength(1, "a guard must match at least one action")
+]), AuthoringTransitionSchema = pinned()(
+  v.strictObject(transitionFields(AuthoringTransitionOpSchema, v.optional(ConditionSchema)))
+), GuardActionSchema = picklist(MUTATION_GUARD_ACTIONS), GuardReadPath = v.pipe(
+  NonEmpty,
+  v.check(
+    (path) => !/[\r\n\u2028\u2029]/.test(path),
+    "a guard read path cannot contain a line break"
   )
-}), GuardSchema = v.strictObject({
-  name: NonEmpty,
-  title: v.optional(v.string()),
-  description: v.optional(v.string()),
-  match: GuardMatchSchema,
-  /**
-   * Lake GROQ predicate — a distinct eval context reading
-   * `document.before`/`document.after`, `mutation`, `guard`, and
-   * `identity()`. Bare ids/fields only. Omitted or empty means
-   * UNCONDITIONAL DENY.
-   */
-  predicate: v.optional(v.string()),
-  /**
-   * Projected workflow fields the predicate reads as `guard.metadata.*` —
-   * the only bridge from the lake eval context (which cannot see `$fields`)
-   * to workflow fields. Values are NOT GROQ: each is a deploy-time read in
-   * the guard mini-language — `"$self"`, `"$now"`, or
-   * `"$fields.<name>[.path]"` — resolved into a bare value at deploy and
-   * re-synced by the post-field-op guard refresh.
-   */
-  metadata: v.optional(v.record(NonEmpty, NonEmpty))
-});
-function stageFields(field, activity, transition, editable) {
+), GuardReadSchema = v.variant("type", [
+  v.strictObject({ type: v.literal("self") }),
+  v.strictObject({ type: v.literal("now") }),
+  v.strictObject({
+    type: v.literal("fieldRead"),
+    field: FieldEntryName,
+    path: v.optional(GuardReadPath)
+  }),
+  v.strictObject({
+    type: v.literal("effectsRead"),
+    // The stored spelling bracket-quotes the name (`$effects['<name>']`), so a
+    // quote inside it would corrupt the printed read.
+    effect: v.pipe(
+      NonEmpty,
+      v.check((name) => !name.includes("'"), "an effect name cannot contain `'`")
+    ),
+    path: v.optional(GuardReadPath)
+  })
+]);
+function guardMatchFields(read) {
+  return {
+    /** Subject `_type`(s); empty matches any type. */
+    types: v.optional(v.array(NonEmpty)),
+    /** Target docs as field reads (or the instance itself), resolved at deploy to bare ids + the resource. */
+    idRefs: v.optional(v.array(read)),
+    /** Glob id patterns (bare, resource-local). */
+    idPatterns: v.optional(v.array(NonEmpty)),
+    actions: v.pipe(
+      v.array(GuardActionSchema),
+      v.minLength(1, "a guard must match at least one action")
+    )
+  };
+}
+function guardFields(read) {
+  return {
+    name: NonEmpty,
+    title: v.optional(v.string()),
+    description: v.optional(v.string()),
+    match: v.strictObject(guardMatchFields(read)),
+    /**
+     * Lake GROQ predicate — a distinct eval context reading
+     * `document.before`/`document.after`, `mutation`, `guard`, and
+     * `identity()`. Bare ids/fields only. Omitted or empty means
+     * UNCONDITIONAL DENY.
+     */
+    predicate: v.optional(v.string()),
+    /**
+     * Projected workflow fields the predicate reads as `guard.metadata.*` —
+     * the only bridge from the lake eval context (which cannot see `$fields`)
+     * to workflow fields. Each value is a deploy-time read — a typed
+     * {@link GuardRead} when authoring, the printed string spelling once
+     * stored — resolved into a bare value at deploy and re-synced by the
+     * post-field-op guard refresh.
+     */
+    metadata: v.optional(v.record(NonEmpty, read))
+  };
+}
+const GuardSchema = v.strictObject(guardFields(NonEmpty)), AuthoringGuardSchema = v.strictObject(guardFields(GuardReadSchema));
+function stageFields({
+  field,
+  activity,
+  transition,
+  guard,
+  editable
+}) {
   return {
     name: NonEmpty,
     title: v.optional(v.string()),
@@ -474,49 +1102,60 @@ function stageFields(field, activity, transition, editable) {
     transitions: v.optional(v.array(transition)),
     /**
      * Lake mutation guards active while this stage holds. Each compiles to a
-     * `temp.system.guard` doc deployed on stage entry and retracted on exit.
+     * persisted guard document deployed on stage entry and retracted on exit.
      */
-    guards: v.optional(v.array(GuardSchema)),
+    guards: v.optional(v.array(guard)),
     /** Stage-scoped field entries. Resolved at stage entry. */
     fields: v.optional(v.array(field)),
     /**
      * Tighten-only editability overrides for the time this stage holds, keyed
-     * by an in-scope slot name. The slot's own `editable` is the ceiling; a
+     * by an in-scope field name. The field's own `editable` is the ceiling; a
      * stage value is ANDed with it at runtime, so an override can only NARROW
-     * (never open a slot the baseline left closed). An unlisted slot inherits
+     * (never open a field the baseline left closed). An unlisted field inherits
      * its baseline.
      */
     editable: v.optional(v.record(FieldEntryName, editable))
   };
 }
-const StoredStageSchema = v.strictObject(
-  stageFields(FieldEntrySchema, StoredActivitySchema, StoredTransitionSchema, StoredEditableSchema)
-), AuthoringStageSchema = v.strictObject(
-  stageFields(
-    AuthoringFieldEntrySchema,
-    AuthoringActivitySchema,
-    AuthoringTransitionSchema,
-    AuthoringEditableSchema
+const StoredStageSchema = pinned()(
+  v.strictObject(
+    stageFields({
+      field: FieldEntrySchema,
+      activity: StoredActivitySchema,
+      transition: StoredTransitionSchema,
+      guard: GuardSchema,
+      editable: StoredEditableSchema
+    })
+  )
+), AuthoringStageSchema = pinned()(
+  v.strictObject(
+    stageFields({
+      field: AuthoringFieldEntrySchema,
+      activity: AuthoringActivitySchema,
+      transition: AuthoringTransitionSchema,
+      guard: AuthoringGuardSchema,
+      editable: AuthoringEditableSchema
+    })
   )
 ), RoleAliasesSchema = v.record(
   NonEmpty,
   v.pipe(v.array(NonEmpty), v.minLength(1, "a role alias must list at least one fulfilling role"))
-), WORKFLOW_ROLES = ["workflow", "child"];
+), WORKFLOW_LIFECYCLES = ["standalone", "child"];
 function workflowFields(field, stage) {
   return {
     name: NonEmpty,
     title: NonEmpty,
     description: v.optional(v.string()),
     /**
-     * Whether a human may start this workflow standalone. `'child'` marks a
+     * How instances of this workflow come to exist. `'child'` marks a
      * spawn-only definition — instantiated by a parent via `activity.subworkflows`,
-     * never started cold from a picker. Omitted ⇒ `'workflow'` (startable).
+     * never started cold from a picker. Omitted ⇒ `'standalone'` (startable).
      * Advisory: consumers filter their start pickers on it (see
      * {@link isStartableDefinition}); the engine does NOT refuse a
      * `startInstance` on a `'child'` def — load-bearing `required` field is the
      * runtime backstop.
      */
-    role: v.optional(picklist(WORKFLOW_ROLES)),
+    lifecycle: v.optional(picklist(WORKFLOW_LIFECYCLES)),
     /** Reference field: named for the target, holds the stage's `name`. */
     initialStage: NonEmpty,
     /** Workflow-scope field entries. Persist for the instance lifetime. */
@@ -532,12 +1171,14 @@ function workflowFields(field, stage) {
     roleAliases: v.optional(RoleAliasesSchema)
   };
 }
-v.strictObject(workflowFields(FieldEntrySchema, StoredStageSchema));
-const AuthoringWorkflowSchema = v.strictObject(
-  workflowFields(AuthoringFieldEntrySchema, AuthoringStageSchema)
+pinned()(
+  v.strictObject(workflowFields(FieldEntrySchema, StoredStageSchema))
+);
+const AuthoringWorkflowSchema = pinned()(
+  v.strictObject(workflowFields(AuthoringFieldEntrySchema, AuthoringStageSchema))
 ), WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
 function isStartableDefinition(definition) {
-  return definition.role !== "child";
+  return definition.lifecycle !== "child";
 }
 function formatValidationError(label, issues) {
   const lines = issues.map((issue) => `  - ${issue.path.length === 0 ? "(root)" : formatPath(issue.path)}: ${issue.message}`);
@@ -559,26 +1200,75 @@ function formatPath(path) {
 }
 export {
   ACTIVITY_KINDS,
+  ACTOR_KINDS,
   AuthoringActionSchema,
   AuthoringActivitySchema,
   AuthoringFieldEntrySchema,
+  AuthoringGuardSchema,
   AuthoringOpSchema,
   AuthoringStageSchema,
   AuthoringTransitionSchema,
   AuthoringWorkflowSchema,
+  CONDITION_VARS,
+  ContractViolationError,
   DOCUMENT_VALUE_PERMISSIONS,
   DRIVER_KINDS,
+  DefinitionInUseError,
+  DefinitionNotFoundError,
+  EFFECTS_READ,
+  EffectNotFoundError,
   EffectSchema,
+  FIELD_READ,
+  FILTER_SCOPE_VARS,
+  FieldValueShapeError,
   GROQ_IDENTIFIER,
-  GuardSchema,
+  GUARD_PREDICATE_VARS,
+  InstanceNotFoundError,
+  RESERVED_CONDITION_VARS,
+  RESOURCE_ALIAS_NAME_SOURCE,
+  StoredFieldOpSchema,
   WORKFLOW_DEFINITION_TYPE,
+  WorkflowConfigSchema,
+  WorkflowError,
   actorFulfillsRole,
   andConditions,
+  checkFieldValue,
+  datasetResourceParts,
+  definitionDocId,
   expandRequiredRoles,
+  extractDocumentId,
+  formatIssues,
   formatValidationError,
+  gdrFromResource,
+  gdrRef,
+  gdrResourcePrefix,
+  gdrUri,
+  isBareSeedId,
+  isGdr,
+  isGdrUri,
+  isGuardReadExpr,
   isStartableDefinition,
   isTerminalActivityStatus,
   issuesFromValibot,
-  normalizeRoleAliases
+  normalizeRoleAliases,
+  parseGdr,
+  printGuardRead,
+  refCanvas,
+  refDashboard,
+  refDataset,
+  refMediaLibrary,
+  resourceAliasesToMap,
+  resourceFromGdrUri,
+  resourceFromParsed,
+  sameResource,
+  selfGdr,
+  tagScopeFilter,
+  toBareId,
+  toPhysicalGdr,
+  tryParseGdr,
+  validateFieldAppendItem,
+  validateFieldValue,
+  validateResourceAliasName,
+  validateTag
 };
 //# sourceMappingURL=schema.js.map