@sanity/workflow-engine 0.13.0 → 0.15.0

package/dist/_chunks-cjs/invariants.cjs

@@ -0,0 +1,2461 @@
+"use strict";
+
+var v = require("valibot"), groqConditionDescribe = require("@sanity/groq-condition-describe"), groqJs = require("groq-js");
+
+function _interopNamespaceCompat(e) {
+    if (e && typeof e == "object" && "default" in e) return e;
+    var n = /* @__PURE__ */ Object.create(null);
+    return e && Object.keys(e).forEach(function(k) {
+        if (k !== "default") {
+            var d = Object.getOwnPropertyDescriptor(e, k);
+            Object.defineProperty(n, k, d.get ? d : {
+                enumerable: !0,
+                get: function() {
+                    return e[k];
+                }
+            });
+        }
+    }), n.default = e, Object.freeze(n);
+}
+
+var v__namespace = /* @__PURE__ */ _interopNamespaceCompat(v);
+
+function errorMessage(err) {
+    return (err instanceof Error ? err.message : String(err)).replace(/[^\P{Cc}\n\t]/gu, "");
+}
+
+function rethrowWithContext(err, context) {
+    throw new Error(`${context}: ${errorMessage(err)}`, {
+        cause: err
+    });
+}
+
+function andConditions(parts) {
+    const present = parts.filter(p => p !== void 0);
+    if (present.length !== 0) return present.length === 1 ? present[0] : present.map(p => `(${p})`).join(" && ");
+}
+
+const KNOWN_SCHEMES = /* @__PURE__ */ new Set([ "dataset", "canvas", "media-library", "dashboard" ]), KNOWN_SCHEMES_TEXT = [ ...KNOWN_SCHEMES ].join(", ");
+
+function parseGdr(uri) {
+    const colon = uri.indexOf(":");
+    if (colon < 0) throw new Error(`Invalid GDR "${uri}": must be a URI of form "<scheme>:<...id-parts>". Known schemes: ${KNOWN_SCHEMES_TEXT}.`);
+    const scheme = uri.slice(0, colon), rest = uri.slice(colon + 1);
+    if (!KNOWN_SCHEMES.has(scheme)) throw new Error(`Invalid GDR "${uri}": unknown scheme "${scheme}". Known: ${KNOWN_SCHEMES_TEXT}.`);
+    const parts = rest.split(":");
+    if (parts.some(part => part.length === 0)) throw new Error(`Invalid GDR "${uri}": id parts must be non-empty (no leading, trailing, or doubled ":").`);
+    if (scheme === "dataset") {
+        if (parts.length !== 3) throw new Error(`Invalid GDR "${uri}": dataset scheme requires <projectId>:<dataset>:<documentId> (3 parts after scheme); got ${parts.length}.`);
+        return {
+            scheme: "dataset",
+            projectId: parts[0],
+            dataset: parts[1],
+            documentId: parts[2]
+        };
+    }
+    if (parts.length !== 2) throw new Error(`Invalid GDR "${uri}": ${scheme} scheme requires <resourceId>:<documentId> (2 parts after scheme); got ${parts.length}.`);
+    return {
+        scheme: scheme,
+        resourceId: parts[0],
+        documentId: parts[1]
+    };
+}
+
+function tryParseGdr(uri) {
+    try {
+        return parseGdr(uri);
+    } catch {
+        return;
+    }
+}
+
+function gdrUri(parts) {
+    return parts.scheme === "dataset" ? `dataset:${parts.projectId}:${parts.dataset}:${parts.documentId}` : `${parts.scheme}:${parts.resourceId}:${parts.documentId}`;
+}
+
+function extractDocumentId(gdrUriString) {
+    return parseGdr(gdrUriString).documentId;
+}
+
+const RESOURCE_ALIAS_NAME_SOURCE = "[a-z0-9][a-z0-9-]*", RESOURCE_ALIAS_NAME_RE = new RegExp(`^${RESOURCE_ALIAS_NAME_SOURCE}$`);
+
+function validateResourceAliasName(name) {
+    if (!RESOURCE_ALIAS_NAME_RE.test(name)) throw new Error(`Invalid resource alias name "${name}": expected lowercase letters, digits, and dashes (no leading dash).`);
+}
+
+function toPhysicalGdr(id, home) {
+    return isGdrUri(id) ? id : gdrFromResource(home, id);
+}
+
+function refDataset({projectId: projectId, dataset: dataset, documentId: documentId, type: type}) {
+    return {
+        id: gdrUri({
+            scheme: "dataset",
+            projectId: projectId,
+            dataset: dataset,
+            documentId: documentId
+        }),
+        type: type
+    };
+}
+
+function refCanvas({resourceId: resourceId, documentId: documentId, type: type}) {
+    return {
+        id: gdrUri({
+            scheme: "canvas",
+            resourceId: resourceId,
+            documentId: documentId
+        }),
+        type: type
+    };
+}
+
+function refMediaLibrary({resourceId: resourceId, documentId: documentId, type: type}) {
+    return {
+        id: gdrUri({
+            scheme: "media-library",
+            resourceId: resourceId,
+            documentId: documentId
+        }),
+        type: type
+    };
+}
+
+function refDashboard({resourceId: resourceId, documentId: documentId, type: type}) {
+    return {
+        id: gdrUri({
+            scheme: "dashboard",
+            resourceId: resourceId,
+            documentId: documentId
+        }),
+        type: type
+    };
+}
+
+function datasetResourceParts(id) {
+    const dot = id.indexOf(".");
+    if (dot <= 0 || dot === id.length - 1) throw new Error(`Invalid dataset resource id "${id}": expected "<projectId>.<dataset>".`);
+    return {
+        projectId: id.slice(0, dot),
+        dataset: id.slice(dot + 1)
+    };
+}
+
+function clientConfigFromResource(res) {
+    return res.type === "dataset" ? datasetResourceParts(res.id) : {
+        resource: res
+    };
+}
+
+function gdrFromResource(res, documentId) {
+    if (res.type === "dataset") {
+        const {projectId: projectId, dataset: dataset} = datasetResourceParts(res.id);
+        return gdrUri({
+            scheme: "dataset",
+            projectId: projectId,
+            dataset: dataset,
+            documentId: documentId
+        });
+    }
+    return gdrUri({
+        scheme: res.type,
+        resourceId: res.id,
+        documentId: documentId
+    });
+}
+
+function resourceGdr(res) {
+    return `${res.type}:${res.id}`;
+}
+
+function parseResourceGdr(uri) {
+    const expected = 'expected "<type>:<id>" with no document part, e.g. "dataset:<projectId>.<dataset>" or "media-library:<resourceId>"', parts = uri.split(":");
+    if (parts.length !== 2 || parts.some(part => part.length === 0)) throw new Error(`Invalid resource GDR "${uri}": ${expected}.`);
+    const [type, id] = parts;
+    if (!KNOWN_SCHEMES.has(type)) throw new Error(`Invalid resource GDR "${uri}": unknown resource type "${type}". Known: ${KNOWN_SCHEMES_TEXT}.`);
+    return type === "dataset" && datasetResourceParts(id), {
+        type: type,
+        id: id
+    };
+}
+
+function gdrResourcePrefix(res) {
+    const full = gdrFromResource(res, "x");
+    return full.slice(0, full.length - 1);
+}
+
+function resourceFromParsed(parsed) {
+    return parsed.scheme === "dataset" ? {
+        type: "dataset",
+        id: `${parsed.projectId}.${parsed.dataset}`
+    } : {
+        type: parsed.scheme,
+        id: parsed.resourceId ?? ""
+    };
+}
+
+function resourceFromGdrUri(uri) {
+    const parsed = tryParseGdr(uri);
+    return parsed === void 0 ? void 0 : resourceFromParsed(parsed);
+}
+
+function sameResource(a, b) {
+    return a.type === b.type && a.id === b.id;
+}
+
+function selfGdr(doc) {
+    return gdrFromResource(doc.workflowResource, doc._id);
+}
+
+function definitionDocId({tag: tag, definition: definition, version: version}) {
+    return `${tag}.${definition}.v${version}`;
+}
+
+function isGdrUri(value) {
+    return typeof value == "string" && tryParseGdr(value) !== void 0;
+}
+
+function toBareId(id) {
+    return isGdrUri(id) ? extractDocumentId(id) : id;
+}
+
+function gdrRef({res: res, documentId: documentId, type: type}) {
+    return {
+        id: gdrFromResource(res, documentId),
+        type: type
+    };
+}
+
+function isGdr(value) {
+    return typeof value == "object" && value !== null && typeof value.id == "string" && typeof value.type == "string";
+}
+
+class WorkflowError extends Error {
+    kind;
+    constructor(kind, message, options) {
+        super(message, options), this.kind = kind;
+    }
+}
+
+class ContractViolationError extends WorkflowError {
+    constructor(message) {
+        super("contract-violation", message), this.name = "ContractViolationError";
+    }
+}
+
+class InstanceNotFoundError extends WorkflowError {
+    instanceId;
+    constructor(args) {
+        super("instance-not-found", `Workflow instance ${args.instanceId} not found${args.detail ? ` (${args.detail})` : ""}`), 
+        this.name = "InstanceNotFoundError", this.instanceId = args.instanceId;
+    }
+}
+
+class DefinitionNotFoundError extends WorkflowError {
+    definition;
+    version;
+    constructor(args) {
+        super("definition-not-found", args.version !== void 0 ? `Workflow definition ${args.definition} v${args.version} not deployed` : `Workflow definition ${args.definition} has no deployed versions`), 
+        this.name = "DefinitionNotFoundError", this.definition = args.definition, args.version !== void 0 && (this.version = args.version);
+    }
+}
+
+class DefinitionInUseError extends WorkflowError {
+    definition;
+    blockedBy;
+    constructor(args) {
+        super("definition-in-use", definitionInUseMessage(args.definition, args.blockedBy)), 
+        this.name = "DefinitionInUseError", this.definition = args.definition, this.blockedBy = args.blockedBy;
+    }
+}
+
+function definitionInUseMessage(definition, blockedBy) {
+    if (blockedBy.reason === "non-terminal-instances") {
+        const head = blockedBy.instanceIds.slice(0, 3).join(", "), preview = blockedBy.instanceIds.length > 3 ? `${head}, …` : head;
+        return `Cannot delete ${definition}: ${blockedBy.instanceIds.length} non-terminal instance(s) exist (${preview}). Pass cascade to abort them first — instances are aborted in place, never deleted.`;
+    }
+    const names = blockedBy.referrers.map(r => `${r.definition} v${r.version}`).join(", ");
+    return `Cannot delete ${definition}: still spawn-referenced by deployed definition(s) ${names}. Delete or redeploy the referrer(s) first.`;
+}
+
+class EffectNotFoundError extends WorkflowError {
+    instanceId;
+    effectKey;
+    settled;
+    constructor(args) {
+        super("effect-not-found", effectNotFoundMessage(args)), this.name = "EffectNotFoundError", 
+        this.instanceId = args.instanceId, this.effectKey = args.effectKey, args.settled !== void 0 && (this.settled = args.settled);
+    }
+}
+
+function effectNotFoundMessage(args) {
+    const base = `Pending effect "${args.effectKey}" not found on instance ${args.instanceId}`;
+    if (args.settled === void 0) return base;
+    const cause = args.settled.detail !== void 0 ? ` (${args.settled.detail})` : "";
+    return args.settled.status === "cancelled" ? `${base} — it was cancelled at ${args.settled.ranAt}${cause}` : `${base} — it already settled "${args.settled.status}" at ${args.settled.ranAt}${cause}`;
+}
+
+const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+
+function validateTag(tag) {
+    if (!TAG_RE.test(tag)) throw new ContractViolationError(`tag: invalid tag "${tag}" — must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`);
+}
+
+function tagScopeFilter() {
+    return "tag == $tag";
+}
+
+const NonEmptyString = v__namespace.pipe(v__namespace.string(), v__namespace.nonEmpty("must not be empty"));
+
+function asPredicate(validate) {
+    return value => {
+        try {
+            return validate(value), !0;
+        } catch {
+            return !1;
+        }
+    };
+}
+
+const isValidTag = asPredicate(validateTag), isValidAliasName = asPredicate(validateResourceAliasName), isValidDatasetId = asPredicate(datasetResourceParts), WorkflowResourceSchema = v__namespace.variant("type", [ v__namespace.object({
+    type: v__namespace.literal("dataset"),
+    id: v__namespace.pipe(NonEmptyString, v__namespace.check(isValidDatasetId, 'invalid dataset resource id — expected "<projectId>.<dataset>"'))
+}), v__namespace.object({
+    type: v__namespace.literal("canvas"),
+    id: NonEmptyString
+}), v__namespace.object({
+    type: v__namespace.literal("media-library"),
+    id: NonEmptyString
+}), v__namespace.object({
+    type: v__namespace.literal("dashboard"),
+    id: NonEmptyString
+}) ]), ResourceBindingSchema = v__namespace.object({
+    name: v__namespace.pipe(NonEmptyString, v__namespace.check(isValidAliasName, "invalid resource handle name — lowercase letters, digits and dashes only, no leading dash")),
+    resource: WorkflowResourceSchema
+}), DefinitionSchema = v__namespace.custom(input => typeof input == "object" && input !== null && typeof input.name == "string", "expected a workflow definition (an object with a string `name`)"), DeploymentSchema = v__namespace.object({
+    name: NonEmptyString,
+    tag: v__namespace.pipe(v__namespace.string(), v__namespace.nonEmpty(), v__namespace.check(isValidTag, "invalid tag — lowercase letters, digits and dashes only, no leading dash, no dots")),
+    workflowResource: WorkflowResourceSchema,
+    resourceAliases: v__namespace.optional(v__namespace.pipe(v__namespace.array(ResourceBindingSchema), v__namespace.check(bindings => new Set(bindings.map(binding => binding.name)).size === bindings.length, "duplicate resource handle name — each binding name must be unique within a deployment"))),
+    definitions: v__namespace.pipe(v__namespace.array(DefinitionSchema), v__namespace.minLength(1, "a deployment needs at least one definition"))
+}), TelemetryLoggerSchema = v__namespace.custom(input => typeof input == "object" && input !== null && typeof input.log == "function", "expected a telemetry logger (an object with a `log` function)"), WorkflowConfigSchema = v__namespace.object({
+    deployments: v__namespace.pipe(v__namespace.array(DeploymentSchema), v__namespace.minLength(1, "a config needs at least one deployment"), v__namespace.check(deployments => new Set(deployments.map(deployment => deployment.tag)).size === deployments.length, "duplicate deployment tag — each deployment must use a unique tag")),
+    telemetry: v__namespace.optional(TelemetryLoggerSchema)
+});
+
+function resourceAliasesToMap(resourceAliases) {
+    return Object.fromEntries((resourceAliases ?? []).map(binding => [ binding.name, binding.resource ]));
+}
+
+const FIELD_READ = /^\$fields\.(\w+)(?:\.(.+))?$/, EFFECTS_READ = /^\$effects\['([^']+)'\](?:\.(.+))?$/;
+
+function isGuardReadExpr(expr) {
+    return expr === "$self" || expr === "$now" || FIELD_READ.test(expr) || EFFECTS_READ.test(expr);
+}
+
+function printGuardRead(read) {
+    switch (read.type) {
+      case "self":
+        return "$self";
+
+      case "now":
+        return "$now";
+
+      case "fieldRead":
+        return read.path === void 0 ? `$fields.${read.field}` : `$fields.${read.field}.${read.path}`;
+
+      case "effectsRead":
+        return read.path === void 0 ? `$effects['${read.effect}']` : `$effects['${read.effect}'].${read.path}`;
+    }
+}
+
+const UNIVERSAL_ROLE_ALIAS_KEY = "$all";
+
+function normalizeRoleAliases(aliases) {
+    if (aliases === void 0 || !("*" in aliases)) return aliases;
+    const {["*"]: universal, ...perRole} = aliases;
+    return {
+        ...perRole,
+        [UNIVERSAL_ROLE_ALIAS_KEY]: universal
+    };
+}
+
+function expandRequiredRoles(required, aliases) {
+    if (aliases === void 0) return [ ...required ];
+    const out = /* @__PURE__ */ new Set;
+    for (const role of required) {
+        out.add(role);
+        for (const fulfiller of aliases[role] ?? []) out.add(fulfiller);
+    }
+    for (const fulfiller of aliases[UNIVERSAL_ROLE_ALIAS_KEY] ?? []) out.add(fulfiller);
+    return [ ...out ];
+}
+
+function actorFulfillsRole({actorRoles: actorRoles, required: required, aliases: aliases}) {
+    if (actorRoles === void 0 || actorRoles.length === 0) return !1;
+    const accepted = new Set(expandRequiredRoles([ required ], aliases));
+    return actorRoles.some(role => accepted.has(role));
+}
+
+function isUnevaluable(result) {
+    return result == null;
+}
+
+async function evaluateConditionOutcome(args) {
+    const {condition: condition, snapshot: snapshot, params: params} = args;
+    return groqConditionDescribe.evaluateConditionOutcome({
+        condition: condition,
+        params: params,
+        dataset: snapshot.docs
+    });
+}
+
+async function evaluateCondition(args) {
+    return await evaluateConditionOutcome(args) === "satisfied";
+}
+
+async function evaluatePredicates(args) {
+    const out = {};
+    for (const [name, groq] of Object.entries(args.predicates ?? {})) {
+        const result = await runGroq({
+            groq: groq,
+            params: args.params,
+            snapshot: args.snapshot
+        }), outcome = groqConditionDescribe.conditionOutcome(result);
+        out[name] = outcome === "unevaluable" ? null : outcome === "satisfied";
+    }
+    return out;
+}
+
+async function runGroq({groq: groq, params: params, snapshot: snapshot}) {
+    return groqConditionDescribe.runGroq({
+        groq: groq,
+        params: params,
+        dataset: snapshot.docs
+    });
+}
+
+function conditionSyntaxIssues(groq, boundVars) {
+    const issues = [];
+    let tree;
+    try {
+        tree = groqJs.parse(groq);
+    } catch (err) {
+        issues.push(errorMessage(err));
+    }
+    if (/\*\s*\[\s*_type\b/.test(groq) && issues.push('condition scans by `_type` — that\'s a discovery query, not a predicate. Conditions evaluate against the in-memory snapshot (instance + ancestors + field-declared docs). To bring extra docs in scope, declare a `doc.ref` (or `doc.refs`) field entry on the workflow or this stage. For lake scans like "all articles in this release", use `subworkflows.forEach` instead.'), 
+    boundVars !== void 0 && tree !== void 0) for (const name of conditionParameterNames(groq)) boundVars.includes(name) || issues.push(`reads $${name}, which this scope does not bind — an unbound variable evaluates to GROQ null, so the condition silently never matches. Bound here: ` + boundVars.map(n => `$${n}`).join(", "));
+    return issues;
+}
+
+function conditionParameterNames(groq) {
+    const read = /* @__PURE__ */ new Set;
+    return walkAstNodes(tryParseGroq(groq), node => {
+        node.type === "Parameter" && typeof node.name == "string" && read.add(node.name);
+    }), read;
+}
+
+function conditionFieldReadNames(groq) {
+    const read = /* @__PURE__ */ new Set;
+    return walkAstNodes(tryParseGroq(groq), node => {
+        if (node.type !== "AccessAttribute" || typeof node.name != "string") return;
+        const base = node.base;
+        base?.type === "Parameter" && base.name === "fields" && read.add(node.name);
+    }), read;
+}
+
+function conditionEffectReads(groq) {
+    const reads = [];
+    return walkAstNodes(tryParseGroq(groq), node => {
+        if (node.type !== "AccessAttribute" || typeof node.name != "string") return;
+        const base = node.base;
+        base?.type !== "AccessAttribute" || typeof base.name != "string" || base.base?.type === "Parameter" && base.base.name === "effects" && reads.push({
+            effect: base.name,
+            key: node.name
+        });
+    }), reads;
+}
+
+function tryParseGroq(groq) {
+    try {
+        return groqJs.parse(groq);
+    } catch {
+        return;
+    }
+}
+
+function walkAstNodes(node, visit) {
+    if (Array.isArray(node)) {
+        for (const item of node) walkAstNodes(item, visit);
+        return;
+    }
+    if (!(typeof node != "object" || node === null)) {
+        visit(node);
+        for (const value of Object.values(node)) walkAstNodes(value, visit);
+    }
+}
+
+const CONDITION_VARS = [ {
+    name: "self",
+    binding: "always",
+    label: "this workflow instance",
+    description: "GDR URI of the instance document itself — `*[_id == $self][0]` reads the instance in the snapshot."
+}, {
+    name: "fields",
+    binding: "always",
+    label: "the workflow's fields",
+    description: "Declared field entries rendered by name (`$fields.<name>` is the value, no envelope). Stage/activity scopes overlay lexically; `doc.ref` values render the hydrated document when the snapshot holds it."
+}, {
+    name: "parent",
+    binding: "always",
+    label: "the parent workflow",
+    description: "The parent instance's GDR URI, `null` on a root instance."
+}, {
+    name: "ancestors",
+    binding: "always",
+    label: "the workflow's ancestors",
+    description: "GDR URIs of the ancestor chain, root first."
+}, {
+    name: "stage",
+    binding: "always",
+    label: "the current stage",
+    description: "The current stage's name."
+}, {
+    name: "now",
+    binding: "always",
+    label: "the current time",
+    description: "The ISO clock reading shared by every condition in one evaluation pass, so they agree on the time."
+}, {
+    name: "effects",
+    binding: "always",
+    label: "automation outputs",
+    description: "The `effectsContext` map: stable handler params seeded at start plus completed effects' outputs namespaced by effect name (`$effects['<effect>'].<output>`). Handler fuel — transition filters should read instance/lake state (or $effectStatus) instead."
+}, {
+    name: "effectStatus",
+    binding: "always",
+    label: "automation status",
+    description: "Effect name → `'done'` | `'failed'` of the latest completed run queued during the current stage entry; absent until the effect drains for this entry. Re-entry-safe: runs queued under a prior entry never count, so `$effectStatus['<effect>'] == 'done'` (or `defined($effectStatus['<effect>'])` for settled-either-way) waits for the fresh run."
+}, {
+    name: "activities",
+    binding: "always",
+    label: "this stage's activities",
+    description: "The current stage's activity rows, statuses included."
+}, {
+    name: "allActivitiesDone",
+    binding: "always",
+    label: "all activities in this stage are finished",
+    description: "Every current-stage activity is `done` or `skipped` — the default transition gate."
+}, {
+    name: "anyActivityFailed",
+    binding: "always",
+    label: "an activity in this stage has failed",
+    description: "Some current-stage activity is `failed`."
+}, {
+    name: "actor",
+    binding: "caller",
+    label: "you",
+    description: "The acting identity (id + roles); `undefined` when no caller rides the evaluation. Never holds a value in the cascade gates (deploy-rejected there)."
+}, {
+    name: "assigned",
+    binding: "caller",
+    label: "you are assigned to this activity",
+    description: "Whether the caller matches the activity's assignees-kind field entry (by user id, or by a role under the definition's `roleAliases`); `false` outside an activity context. Constant `false` in the cascade gates (deploy-rejected there)."
+}, {
+    name: "can",
+    binding: "caller",
+    label: "your permissions",
+    description: "Advisory per-permission booleans computed from the caller's grants; `undefined` without grants. Bound wherever grants ride the evaluation: the projection's rendered scope (action filters, activity requirements, editability predicates) and the fireAction/editField commit gates. Deploy rejects it at every site that evaluates without grants: transition filters, activity `filter`/`completeWhen`/`failWhen`, effect bindings, where-op `where`s, and the subworkflow `forEach`/`with`/`context` sites."
+}, {
+    name: "row",
+    binding: "spawn",
+    label: "the spawned row",
+    description: "One `subworkflows.forEach` result row, bound while its `with` map evaluates — and the row under test while a where-op `where` evaluates (per row)."
+}, {
+    name: "params",
+    binding: "caller",
+    label: "the action's arguments",
+    description: "The firing action's args — they hold values only while that action's effect bindings and where-op `where`s evaluate (activity/transition boundaries bind `{}`; subworkflow sites don't bind it at all). Deploy rejects a read in the cascade gates and in the caller-bound projection (action filters, requirements, editable predicates): args exist only once the caller fires the action, after those sites have evaluated."
+}, {
+    name: "subworkflows",
+    binding: "always",
+    label: "the spawned subworkflows",
+    description: "Every row of the instance's subworkflow registry, faceted by `activity`/`definition`/`rowKey`/`status` (`'active'|'done'|'aborted'`) with `current` marking the open stage entry's cohort and `stage` the child's current stage. Usable anywhere — transition filters, requirements, any stage's gates; the implicit spawn gate is `count($subworkflows[activity == <name> && current && status == 'active']) == 0`."
+} ], RESERVED_CONDITION_VARS = CONDITION_VARS.map(v2 => v2.name), FILTER_SCOPE_VARS = CONDITION_VARS.filter(v2 => v2.binding === "always").map(v2 => v2.name), CALLER_BOUND_VARS = CONDITION_VARS.filter(v2 => v2.binding === "caller").map(v2 => v2.name), GUARD_PREDICATE_VARS = [ {
+    name: "guard",
+    description: "The guard document itself (its `metadata` carries deploy-time resolved values)."
+}, {
+    name: "mutation",
+    description: "The attempted mutation — `mutation.action` is the write kind being gated."
+} ], ACTOR_KINDS = [ "person", "agent", "system" ];
+
+function releaseDocId(releaseName) {
+    return `_.releases.${releaseName}`;
+}
+
+function releaseRef({res: res, releaseName: releaseName}) {
+    if (releaseName.length === 0) throw new ContractViolationError("releaseRef: releaseName must be a non-empty release name");
+    return {
+        id: gdrFromResource(res, releaseDocId(releaseName)),
+        type: "system.release",
+        releaseName: releaseName
+    };
+}
+
+function isTodoListItem(row) {
+    if (typeof row != "object" || row === null) return !1;
+    const candidate = row, status = candidate.status;
+    return typeof candidate._key == "string" && typeof candidate.label == "string" && (status == null || typeof status == "string");
+}
+
+function declaredRowColumns(entry) {
+    if (("_type" in entry ? entry._type : entry.type) === "array") return new Set((("of" in entry ? entry.of : void 0) ?? []).map(shape => shape.name));
+}
+
+function isTodoListEntry(entry) {
+    const columns = declaredRowColumns(entry);
+    return columns !== void 0 && columns.has("label") && columns.has("status");
+}
+
+function isNotesEntry(entry) {
+    const columns = declaredRowColumns(entry);
+    return columns !== void 0 && columns.has("body") && columns.has("actor") && columns.has("at");
+}
+
+class FieldValueShapeError extends WorkflowError {
+    entryType;
+    entryName;
+    issues;
+    constructor(args) {
+        const issueText = args.issues.join("; ");
+        super("field-value-shape", `Field entry ${args.mode} shape invalid for "${args.entryName}" (${args.entryType}): ${issueText}`), 
+        this.name = "FieldValueShapeError", this.entryType = args.entryType, this.entryName = args.entryName, 
+        this.issues = args.issues;
+    }
+}
+
+const GdrShape = v__namespace.looseObject({
+    id: v__namespace.pipe(v__namespace.string(), v__namespace.check(s => isGdrUri(s), "must be a GDR URI")),
+    type: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+}), ReleaseRefShape = v__namespace.pipe(v__namespace.looseObject({
+    id: v__namespace.pipe(v__namespace.string(), v__namespace.check(s => isGdrUri(s), "must be a GDR URI")),
+    type: v__namespace.literal("system.release"),
+    releaseName: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+}), v__namespace.check(ref => !isGdrUri(ref.id) || extractDocumentId(ref.id) === releaseDocId(ref.releaseName), "id must point at the `_.releases.<releaseName>` doc named by releaseName")), ActorShape = v__namespace.looseObject({
+    kind: v__namespace.picklist(ACTOR_KINDS),
+    id: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1)),
+    roles: v__namespace.optional(v__namespace.array(v__namespace.string())),
+    onBehalfOf: v__namespace.optional(v__namespace.string())
+}), AssigneeShape = v__namespace.union([ v__namespace.looseObject({
+    type: v__namespace.literal("user"),
+    id: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+}), v__namespace.looseObject({
+    type: v__namespace.literal("role"),
+    role: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+}) ]), NullableString = v__namespace.union([ v__namespace.null(), v__namespace.string() ]), NullableNumber = v__namespace.union([ v__namespace.null(), v__namespace.number() ]), NullableBoolean = v__namespace.union([ v__namespace.null(), v__namespace.boolean() ]), NullableDateTime = v__namespace.union([ v__namespace.null(), v__namespace.pipe(v__namespace.string(), v__namespace.check(s => !Number.isNaN(Date.parse(s)), "must be an ISO-8601 datetime string")) ]), NullableDate = v__namespace.union([ v__namespace.null(), v__namespace.pipe(v__namespace.string(), v__namespace.regex(/^\d{4}-\d{2}-\d{2}$/, "must be a `YYYY-MM-DD` date")) ]), NullableUrl = NullableString, valueSchemas = {
+    "doc.ref": v__namespace.union([ v__namespace.null(), GdrShape ]),
+    "doc.refs": v__namespace.array(GdrShape),
+    "release.ref": v__namespace.union([ v__namespace.null(), ReleaseRefShape ]),
+    query: v__namespace.any(),
+    string: NullableString,
+    text: NullableString,
+    number: NullableNumber,
+    boolean: NullableBoolean,
+    date: NullableDate,
+    datetime: NullableDateTime,
+    url: NullableUrl,
+    actor: v__namespace.union([ v__namespace.null(), ActorShape ]),
+    assignee: v__namespace.union([ v__namespace.null(), AssigneeShape ]),
+    assignees: v__namespace.array(AssigneeShape)
+};
+
+function shapeValueSchema(shape, leaf) {
+    return shape.type === "object" ? objectSchema(shape.fields ?? [], leaf) : shape.type === "array" ? v__namespace.array(objectSchema(shape.of ?? [], leaf)) : leaf[shape.type] ?? v__namespace.any();
+}
+
+function objectSchema(fields, leaf) {
+    const entries = /* @__PURE__ */ Object.create(null);
+    for (const f of fields) entries[f.name] = v__namespace.optional(shapeValueSchema(f, leaf));
+    return v__namespace.looseObject(entries);
+}
+
+function wholeValueSchema(args) {
+    const {entryType: entryType, shape: shape, leaf: leaf} = args;
+    return entryType === "object" ? v__namespace.union([ v__namespace.null(), objectSchema(shape.fields ?? [], leaf) ]) : entryType === "array" ? v__namespace.array(objectSchema(shape.of ?? [], leaf)) : leaf[entryType];
+}
+
+function appendItemSchema(entryType, shape) {
+    if (entryType === "array") return objectSchema(shape.of ?? [], valueSchemas);
+    if (entryType === "doc.refs") return GdrShape;
+    if (entryType === "assignees") return AssigneeShape;
+}
+
+function rejectedRefTypes(args) {
+    const {entryType: entryType, types: types, value: value} = args;
+    if (types === void 0 || value === null || value === void 0) return [];
+    if (entryType !== "doc.ref" && entryType !== "doc.refs") return [];
+    let items = [ value ];
+    return entryType === "doc.refs" && (items = Array.isArray(value) ? value : []), 
+    [ ...new Set(items.map(gdrTypeOf).filter(t => t !== void 0 && !types.includes(t))) ];
+}
+
+function refTypeIssues(args) {
+    const rejected = rejectedRefTypes(args);
+    if (rejected.length === 0) return;
+    const accepts = (args.types ?? []).map(t => `"${t}"`).join(", ");
+    return rejected.map(t => `document type "${t}" is not accepted — this entry accepts ${accepts} (a GDR's \`type\` names the target document's schema type)`);
+}
+
+function gdrTypeOf(item) {
+    if (typeof item != "object" || item === null) return;
+    const t = item.type;
+    return typeof t == "string" ? t : void 0;
+}
+
+function checkFieldValue(args) {
+    return checkValueAgainst(args, valueSchemas);
+}
+
+function checkValueAgainst(args, leaf) {
+    const schema = wholeValueSchema({
+        entryType: args.entryType,
+        shape: args,
+        leaf: leaf
+    });
+    if (schema === void 0) return [ `unknown field entry type ${args.entryType}` ];
+    const result = v__namespace.safeParse(schema, args.value);
+    return result.success ? refTypeIssues({
+        entryType: args.entryType,
+        types: args.types,
+        value: args.value
+    }) : formatIssues(result.issues);
+}
+
+function validateFieldValue(args) {
+    const issues = checkFieldValue(args);
+    if (issues !== void 0) throw new FieldValueShapeError({
+        entryType: args.entryType,
+        entryName: args.entryName,
+        issues: issues,
+        mode: "value"
+    });
+}
+
+const BARE_ID_SOURCE = "[A-Za-z0-9_][A-Za-z0-9._-]*", BARE_ID_RE = new RegExp(`^${BARE_ID_SOURCE}$`), ALIAS_REF_RE = new RegExp(`^@${RESOURCE_ALIAS_NAME_SOURCE}:${BARE_ID_SOURCE}$`);
+
+function isAuthoringRefId(id) {
+    return id.startsWith("@") ? ALIAS_REF_RE.test(id) : id.includes(":") ? isGdrUri(id) : BARE_ID_RE.test(id);
+}
+
+function isBareSeedId(id) {
+    return BARE_ID_RE.test(id);
+}
+
+const AuthoringRefId = v__namespace.pipe(v__namespace.string(), v__namespace.check(isAuthoringRefId, "must be a bare document id, a GDR URI, or a portable `@<alias>:<id>` reference")), AuthoringGdrShape = v__namespace.looseObject({
+    id: AuthoringRefId,
+    type: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+}), seedValueSchemas = {
+    ...valueSchemas,
+    "doc.ref": v__namespace.union([ v__namespace.null(), AuthoringGdrShape ]),
+    "doc.refs": v__namespace.array(AuthoringGdrShape),
+    "release.ref": v__namespace.union([ v__namespace.null(), v__namespace.looseObject({
+        id: AuthoringRefId,
+        type: v__namespace.literal("system.release"),
+        releaseName: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+    }) ])
+};
+
+function checkLiteralSeed(args) {
+    return args.value === null ? [ "a literal seed cannot be null — omit `initialValue` to start the field empty" ] : checkValueAgainst(args, seedValueSchemas);
+}
+
+function validateFieldAppendItem(args) {
+    const schema = appendItemSchema(args.entryType, args);
+    if (schema === void 0) throw new FieldValueShapeError({
+        entryType: args.entryType,
+        entryName: args.entryName,
+        issues: [ `field entry type ${args.entryType} does not support append` ],
+        mode: "item"
+    });
+    const result = v__namespace.safeParse(schema, args.item);
+    if (!result.success) throw new FieldValueShapeError({
+        entryType: args.entryType,
+        entryName: args.entryName,
+        issues: formatIssues(result.issues),
+        mode: "item"
+    });
+    const typeIssues = refTypeIssues({
+        entryType: args.entryType,
+        types: args.types,
+        value: [ args.item ]
+    });
+    if (typeIssues !== void 0) throw new FieldValueShapeError({
+        entryType: args.entryType,
+        entryName: args.entryName,
+        issues: typeIssues,
+        mode: "item"
+    });
+}
+
+function formatIssues(issues) {
+    return issues.map(i => {
+        const keys = i.path?.map(p => p.key) ?? [];
+        return `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${i.message}`;
+    });
+}
+
+const ACTIVITY_STATUSES = [ "pending", "active", "done", "skipped", "failed" ], TERMINAL_ACTIVITY_STATUSES = [ "done", "skipped", "failed" ];
+
+function isTerminalActivityStatus(status) {
+    return TERMINAL_ACTIVITY_STATUSES.includes(status);
+}
+
+const FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISSIONS = [ "create", "read", "update" ], MUTATION_GUARD_ACTIONS = [ "create", "update", "delete", "publish", "unpublish" ], ACTIVITY_KINDS = [ "user", "service", "script", "manual", "receive" ], GROUP_KINDS = [ "core", "details" ], DRIVER_KINDS = [ "person", "agent", "service", "engine" ], NonEmpty = v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1, "must be a non-empty string")), PositiveInt = v__namespace.pipe(v__namespace.number(), v__namespace.integer(), v__namespace.minValue(1)), GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function groqIdentifier(referencedAs) {
+    return v__namespace.pipe(v__namespace.string(), v__namespace.regex(GROQ_IDENTIFIER, `must be a GROQ-safe identifier (letters, digits, underscore; not starting with a digit) because it is referenced as ${referencedAs} in GROQ conditions`));
+}
+
+function picklist(options) {
+    return v__namespace.picklist(options, `Invalid option: expected one of ${options.map(o => `"${o}"`).join("|")}`);
+}
+
+function pinned() {
+    return (schema, ..._exact) => schema;
+}
+
+const LiteralSchema = v__namespace.strictObject({
+    type: v__namespace.literal("literal"),
+    value: v__namespace.unknown()
+}), FieldReadSchema = v__namespace.strictObject({
+    type: v__namespace.literal("fieldRead"),
+    scope: v__namespace.optional(v__namespace.union([ v__namespace.literal("workflow"), v__namespace.literal("stage") ])),
+    field: NonEmpty,
+    path: v__namespace.optional(v__namespace.string())
+}), FieldSourceSchema = v__namespace.union([ v__namespace.strictObject({
+    type: v__namespace.literal("input")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("query"),
+    query: NonEmpty
+}), LiteralSchema, FieldReadSchema ]), ValueExprSchema = v__namespace.lazy(() => v__namespace.union([ LiteralSchema, FieldReadSchema, v__namespace.strictObject({
+    type: v__namespace.literal("param"),
+    param: NonEmpty
+}), v__namespace.strictObject({
+    type: v__namespace.literal("actor")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("now")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("self")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("stage")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("object"),
+    fields: v__namespace.record(NonEmpty, ValueExprSchema)
+}) ])), StoredFieldRefSchema = v__namespace.strictObject({
+    scope: picklist(FIELD_SCOPES),
+    field: NonEmpty
+}), AuthoringFieldRefSchema = v__namespace.strictObject({
+    scope: v__namespace.optional(picklist(FIELD_SCOPES)),
+    field: NonEmpty
+}), HREF_SCHEMES = [ "http:", "https:" ];
+
+function isHttpUrl(value) {
+    try {
+        return HREF_SCHEMES.includes(new URL(value).protocol);
+    } catch {
+        return !1;
+    }
+}
+
+const UrlString = v__namespace.pipe(v__namespace.string(), v__namespace.url("must be a valid URL"), v__namespace.check(isHttpUrl, "must be an http(s) URL"));
+
+function manualTargetSchema(ref) {
+    return v__namespace.variant("type", [ v__namespace.strictObject({
+        type: v__namespace.literal("url"),
+        url: UrlString
+    }), v__namespace.strictObject({
+        type: v__namespace.literal("field"),
+        field: ref
+    }) ]);
+}
+
+const StoredManualTargetSchema = manualTargetSchema(StoredFieldRefSchema), AuthoringManualTargetSchema = manualTargetSchema(v__namespace.union([ NonEmpty, AuthoringFieldRefSchema ])), ConditionSchema = NonEmpty;
+
+function opSchemas(targetSchema) {
+    return [ v__namespace.strictObject({
+        type: v__namespace.literal("field.set"),
+        target: targetSchema,
+        value: ValueExprSchema
+    }), v__namespace.strictObject({
+        type: v__namespace.literal("field.unset"),
+        target: targetSchema
+    }), v__namespace.strictObject({
+        type: v__namespace.literal("field.append"),
+        target: targetSchema,
+        value: ValueExprSchema
+    }), v__namespace.strictObject({
+        type: v__namespace.literal("field.updateWhere"),
+        target: targetSchema,
+        where: ConditionSchema,
+        value: ValueExprSchema
+    }), v__namespace.strictObject({
+        type: v__namespace.literal("field.removeWhere"),
+        target: targetSchema,
+        where: ConditionSchema
+    }) ];
+}
+
+const StoredFieldOpSchema = v__namespace.variant("type", [ ...opSchemas(StoredFieldRefSchema) ]), StoredOpSchema = v__namespace.variant("type", [ ...opSchemas(StoredFieldRefSchema), v__namespace.strictObject({
+    type: v__namespace.literal("status.set"),
+    activity: NonEmpty,
+    status: picklist(ACTIVITY_STATUSES)
+}) ]), StoredTransitionOpSchema = StoredFieldOpSchema, AuditOpSchema = v__namespace.strictObject({
+    type: v__namespace.literal("audit"),
+    target: AuthoringFieldRefSchema,
+    value: ValueExprSchema,
+    stampFields: v__namespace.optional(v__namespace.strictObject({
+        actor: v__namespace.optional(NonEmpty),
+        at: v__namespace.optional(NonEmpty)
+    }))
+}), AuthoringOpSchema = v__namespace.variant("type", [ ...opSchemas(AuthoringFieldRefSchema), v__namespace.strictObject({
+    type: v__namespace.literal("status.set"),
+    activity: v__namespace.optional(NonEmpty),
+    status: picklist(ACTIVITY_STATUSES)
+}), AuditOpSchema ]), GroupName = v__namespace.pipe(v__namespace.string(), v__namespace.regex(GROQ_IDENTIFIER, "must be an identifier (letters, digits, underscore; not starting with a digit)")), GroupSchema = pinned()(v__namespace.strictObject({
+    name: GroupName,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    kind: v__namespace.optional(picklist(GROUP_KINDS))
+})), GroupNameList = v__namespace.pipe(v__namespace.array(GroupName), v__namespace.minLength(1, "name at least one group, or omit `group`"), v__namespace.check(names => new Set(names).size === names.length, "a group is listed more than once — list each group once")), StoredGroupMembershipSchema = GroupNameList, AuthoringGroupMembershipSchema = v__namespace.union([ GroupName, GroupNameList ]);
+
+function groupMembershipNames(group) {
+    return group === void 0 ? [] : typeof group == "string" ? [ group ] : [ ...group ];
+}
+
+const FIELD_VALUE_KINDS = [ "doc.ref", "doc.refs", "release.ref", "string", "text", "number", "boolean", "date", "datetime", "url", "actor", "assignee", "assignees", "object", "array" ], FieldValueKindSchema = picklist(FIELD_VALUE_KINDS), FieldKindSchema = picklist(FIELD_VALUE_KINDS), FieldEntryName = groqIdentifier("`$fields.<name>`");
+
+function asShape(input) {
+    return typeof input == "object" && input !== null ? input : {};
+}
+
+function compositeShapeOk(input) {
+    const shape = asShape(input);
+    return shape.type === "object" ? Array.isArray(shape.fields) && shape.fields.length > 0 && shape.of === void 0 : shape.type === "array" ? Array.isArray(shape.of) && shape.of.length > 0 && shape.fields === void 0 : shape.fields === void 0 && shape.of === void 0;
+}
+
+function compositeShapeMessage(input) {
+    const shape = asShape(input);
+    return shape.type === "object" ? shape.of !== void 0 ? "an `object` kind declares its sub-fields with `fields`, not `of`" : "an `object` kind needs a non-empty `fields` list of sub-field shapes" : shape.type === "array" ? shape.fields !== void 0 ? "an `array` kind declares its item shape with `of`, not `fields`" : "an `array` kind needs a non-empty `of` list of sub-field shapes" : `\`fields\` / \`of\` are only valid on the \`object\` / \`array\` kinds, not "${String(shape.type)}"`;
+}
+
+function duplicateSubfieldName(input) {
+    const shape = asShape(input);
+    let list = [];
+    Array.isArray(shape.fields) ? list = shape.fields : Array.isArray(shape.of) && (list = shape.of);
+    const seen = /* @__PURE__ */ new Set;
+    for (const item of list) {
+        const name = asShape(item).name;
+        if (typeof name == "string") {
+            if (seen.has(name)) return name;
+            seen.add(name);
+        }
+    }
+}
+
+function compositeChecked(entries) {
+    return v__namespace.pipe(v__namespace.strictObject(entries), v__namespace.check(input => compositeShapeOk(input), issue => compositeShapeMessage(issue.input)), v__namespace.check(input => duplicateSubfieldName(input) === void 0, issue => `duplicate sub-field name "${duplicateSubfieldName(issue.input)}" — sub-field names must be unique within \`fields\` / \`of\``));
+}
+
+const FieldShapeSchema = v__namespace.lazy(() => compositeChecked({
+    type: FieldValueKindSchema,
+    name: FieldEntryName,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    fields: v__namespace.optional(v__namespace.array(FieldShapeSchema)),
+    of: v__namespace.optional(v__namespace.array(FieldShapeSchema))
+})), StoredEditableSchema = v__namespace.union([ v__namespace.literal(!0), NonEmpty ]), AuthoringEditableSchema = v__namespace.union([ v__namespace.literal(!0), v__namespace.array(NonEmpty), NonEmpty ]);
+
+function fieldBase(editable, group) {
+    return {
+        name: FieldEntryName,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        group: v__namespace.optional(group),
+        required: v__namespace.optional(v__namespace.boolean()),
+        initialValue: v__namespace.optional(FieldSourceSchema),
+        editable: v__namespace.optional(editable)
+    };
+}
+
+function fieldEntryFields(editable, group) {
+    return {
+        type: FieldKindSchema,
+        ...fieldBase(editable, group),
+        types: v__namespace.optional(v__namespace.pipe(v__namespace.array(NonEmpty), v__namespace.minLength(1, "declare at least one accepted type, or omit `types` to accept any"))),
+        fields: v__namespace.optional(v__namespace.array(FieldShapeSchema)),
+        of: v__namespace.optional(v__namespace.array(FieldShapeSchema))
+    };
+}
+
+function literalSeedIssues(entry) {
+    if (entry.initialValue?.type === "literal") return checkLiteralSeed({
+        entryType: entry.type,
+        value: entry.initialValue.value,
+        types: entry.types,
+        fields: entry.fields,
+        of: entry.of
+    });
+}
+
+function literalSeedCheck() {
+    return v__namespace.check(entry => literalSeedIssues(entry) === void 0, issue => `initialValue literal does not fit the declared kind: ${(literalSeedIssues(issue.input) ?? []).join("; ")}`);
+}
+
+function refTypesCheck() {
+    return v__namespace.check(entry => entry.types === void 0 || entry.type === "doc.ref" || entry.type === "doc.refs", issue => `\`types\` is only valid on \`doc.ref\` / \`doc.refs\` entries, not "${issue.input.type}"`);
+}
+
+const FieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields(StoredEditableSchema, StoredGroupMembershipSchema)), refTypesCheck(), literalSeedCheck())), RawAuthoringFieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields(AuthoringEditableSchema, AuthoringGroupMembershipSchema)), refTypesCheck(), literalSeedCheck())), ClaimFieldSchema = pinned()(v__namespace.strictObject({
+    type: v__namespace.literal("claim"),
+    name: FieldEntryName,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    group: v__namespace.optional(AuthoringGroupMembershipSchema)
+}));
+
+function listSugarFields(type) {
+    return {
+        type: v__namespace.literal(type),
+        ...fieldBase(AuthoringEditableSchema, AuthoringGroupMembershipSchema)
+    };
+}
+
+const TodoListFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("todoList"))), NotesFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("notes"))), AuthoringFieldEntrySchema = pinned()(v__namespace.union([ RawAuthoringFieldEntrySchema, ClaimFieldSchema, TodoListFieldSchema, NotesFieldSchema ])), EffectSchema = v__namespace.strictObject({
+    name: NonEmpty,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    bindings: v__namespace.optional(v__namespace.record(v__namespace.string(), ConditionSchema)),
+    input: v__namespace.optional(v__namespace.record(v__namespace.string(), v__namespace.unknown())),
+    outputs: v__namespace.optional(v__namespace.array(FieldShapeSchema))
+}), ActionParamSchema = v__namespace.strictObject({
+    type: picklist([ "string", "number", "boolean", "url", "dateTime", "actor", "doc.ref", "doc.refs", "json" ]),
+    name: NonEmpty,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    required: v__namespace.optional(v__namespace.boolean())
+});
+
+function actionFields(op, group) {
+    return {
+        name: NonEmpty,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        group: v__namespace.optional(group),
+        filter: v__namespace.optional(ConditionSchema),
+        params: v__namespace.optional(v__namespace.array(ActionParamSchema)),
+        ops: v__namespace.optional(v__namespace.array(op)),
+        effects: v__namespace.optional(v__namespace.array(EffectSchema))
+    };
+}
+
+const StoredActionSchema = pinned()(v__namespace.strictObject(actionFields(StoredOpSchema, StoredGroupMembershipSchema))), TerminalActivityStatus = picklist(TERMINAL_ACTIVITY_STATUSES), RawAuthoringActionSchema = pinned()(v__namespace.strictObject({
+    ...actionFields(AuthoringOpSchema, AuthoringGroupMembershipSchema),
+    roles: v__namespace.optional(v__namespace.array(NonEmpty)),
+    status: v__namespace.optional(TerminalActivityStatus)
+})), ClaimActionSchema = pinned()(v__namespace.strictObject({
+    type: v__namespace.literal("claim"),
+    name: NonEmpty,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    group: v__namespace.optional(AuthoringGroupMembershipSchema),
+    field: v__namespace.union([ NonEmpty, AuthoringFieldRefSchema ]),
+    roles: v__namespace.optional(v__namespace.array(NonEmpty)),
+    filter: v__namespace.optional(ConditionSchema),
+    params: v__namespace.optional(v__namespace.array(ActionParamSchema)),
+    effects: v__namespace.optional(v__namespace.array(EffectSchema))
+})), AuthoringActionSchema = pinned()(v__namespace.union([ RawAuthoringActionSchema, ClaimActionSchema ])), DefinitionRefSchema = v__namespace.strictObject({
+    name: NonEmpty,
+    version: v__namespace.optional(v__namespace.union([ PositiveInt, v__namespace.literal("latest") ]))
+}), SubworkflowsSchema = v__namespace.strictObject({
+    forEach: NonEmpty,
+    definition: DefinitionRefSchema,
+    with: v__namespace.optional(v__namespace.record(NonEmpty, ConditionSchema)),
+    context: v__namespace.optional(v__namespace.record(NonEmpty, ConditionSchema)),
+    onExit: v__namespace.optional(picklist([ "detach", "abort" ]))
+});
+
+function activityFields({field: field, action: action, op: op, target: target, group: group}) {
+    return {
+        name: NonEmpty,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        groups: v__namespace.optional(v__namespace.array(GroupSchema)),
+        group: v__namespace.optional(group),
+        kind: v__namespace.optional(picklist(ACTIVITY_KINDS)),
+        target: v__namespace.optional(target),
+        activation: v__namespace.optional(picklist([ "auto", "manual" ])),
+        filter: v__namespace.optional(ConditionSchema),
+        requirements: v__namespace.optional(v__namespace.record(NonEmpty, ConditionSchema)),
+        completeWhen: v__namespace.optional(ConditionSchema),
+        failWhen: v__namespace.optional(ConditionSchema),
+        ops: v__namespace.optional(v__namespace.array(op)),
+        effects: v__namespace.optional(v__namespace.array(EffectSchema)),
+        actions: v__namespace.optional(v__namespace.array(action)),
+        subworkflows: v__namespace.optional(SubworkflowsSchema),
+        fields: v__namespace.optional(v__namespace.array(field))
+    };
+}
+
+const StoredActivitySchema = pinned()(v__namespace.strictObject(activityFields({
+    field: FieldEntrySchema,
+    action: StoredActionSchema,
+    op: StoredOpSchema,
+    target: StoredManualTargetSchema,
+    group: StoredGroupMembershipSchema
+}))), AuthoringActivitySchema = pinned()(v__namespace.strictObject(activityFields({
+    field: AuthoringFieldEntrySchema,
+    action: AuthoringActionSchema,
+    op: AuthoringOpSchema,
+    target: AuthoringManualTargetSchema,
+    group: AuthoringGroupMembershipSchema
+})));
+
+function transitionFields(op, filter) {
+    return {
+        name: NonEmpty,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        to: NonEmpty,
+        filter: filter,
+        ops: v__namespace.optional(v__namespace.array(op)),
+        effects: v__namespace.optional(v__namespace.array(EffectSchema))
+    };
+}
+
+const StoredTransitionSchema = pinned()(v__namespace.strictObject(transitionFields(StoredTransitionOpSchema, ConditionSchema))), AuthoringTransitionOpSchema = v__namespace.variant("type", [ ...opSchemas(AuthoringFieldRefSchema), AuditOpSchema ]), AuthoringTransitionSchema = pinned()(v__namespace.strictObject(transitionFields(AuthoringTransitionOpSchema, v__namespace.optional(ConditionSchema)))), GuardActionSchema = picklist(MUTATION_GUARD_ACTIONS), GuardReadPath = v__namespace.pipe(NonEmpty, v__namespace.check(path => !/[\r\n\u2028\u2029]/.test(path), "a guard read path cannot contain a line break")), GuardReadSchema = v__namespace.variant("type", [ v__namespace.strictObject({
+    type: v__namespace.literal("self")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("now")
+}), v__namespace.strictObject({
+    type: v__namespace.literal("fieldRead"),
+    field: FieldEntryName,
+    path: v__namespace.optional(GuardReadPath)
+}), v__namespace.strictObject({
+    type: v__namespace.literal("effectsRead"),
+    effect: v__namespace.pipe(NonEmpty, v__namespace.check(name => !name.includes("'"), "an effect name cannot contain `'`")),
+    path: v__namespace.optional(GuardReadPath)
+}) ]);
+
+function guardMatchFields(read) {
+    return {
+        types: v__namespace.optional(v__namespace.array(NonEmpty)),
+        idRefs: v__namespace.optional(v__namespace.array(read)),
+        idPatterns: v__namespace.optional(v__namespace.array(NonEmpty)),
+        actions: v__namespace.pipe(v__namespace.array(GuardActionSchema), v__namespace.minLength(1, "a guard must match at least one action"))
+    };
+}
+
+function guardFields(read) {
+    return {
+        name: NonEmpty,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        match: v__namespace.strictObject(guardMatchFields(read)),
+        predicate: v__namespace.optional(v__namespace.string()),
+        metadata: v__namespace.optional(v__namespace.record(NonEmpty, read))
+    };
+}
+
+const GuardSchema = v__namespace.strictObject(guardFields(NonEmpty)), AuthoringGuardSchema = v__namespace.strictObject(guardFields(GuardReadSchema));
+
+function stageFields({field: field, activity: activity, transition: transition, guard: guard, editable: editable}) {
+    return {
+        name: NonEmpty,
+        title: v__namespace.optional(v__namespace.string()),
+        description: v__namespace.optional(v__namespace.string()),
+        groups: v__namespace.optional(v__namespace.array(GroupSchema)),
+        activities: v__namespace.optional(v__namespace.array(activity)),
+        transitions: v__namespace.optional(v__namespace.array(transition)),
+        guards: v__namespace.optional(v__namespace.array(guard)),
+        fields: v__namespace.optional(v__namespace.array(field)),
+        editable: v__namespace.optional(v__namespace.record(FieldEntryName, editable))
+    };
+}
+
+const StoredStageSchema = pinned()(v__namespace.strictObject(stageFields({
+    field: FieldEntrySchema,
+    activity: StoredActivitySchema,
+    transition: StoredTransitionSchema,
+    guard: GuardSchema,
+    editable: StoredEditableSchema
+}))), AuthoringStageSchema = pinned()(v__namespace.strictObject(stageFields({
+    field: AuthoringFieldEntrySchema,
+    activity: AuthoringActivitySchema,
+    transition: AuthoringTransitionSchema,
+    guard: AuthoringGuardSchema,
+    editable: AuthoringEditableSchema
+}))), RoleAliasesSchema = v__namespace.record(NonEmpty, v__namespace.pipe(v__namespace.array(NonEmpty), v__namespace.minLength(1, "a role alias must list at least one fulfilling role"))), WORKFLOW_LIFECYCLES = [ "standalone", "child" ];
+
+function workflowFields(field, stage) {
+    return {
+        name: NonEmpty,
+        title: NonEmpty,
+        description: v__namespace.optional(v__namespace.string()),
+        groups: v__namespace.optional(v__namespace.array(GroupSchema)),
+        lifecycle: v__namespace.optional(picklist(WORKFLOW_LIFECYCLES)),
+        applicableWhen: v__namespace.optional(ConditionSchema),
+        initialStage: NonEmpty,
+        fields: v__namespace.optional(v__namespace.array(field)),
+        stages: v__namespace.pipe(v__namespace.array(stage), v__namespace.minLength(1, "must declare at least one stage")),
+        predicates: v__namespace.optional(v__namespace.record(groqIdentifier("`$<name>`"), ConditionSchema)),
+        roleAliases: v__namespace.optional(RoleAliasesSchema)
+    };
+}
+
+const WorkflowDefinitionSchema = pinned()(v__namespace.strictObject(workflowFields(FieldEntrySchema, StoredStageSchema)));
+
+function parseStoredDefinition(input, label) {
+    return parseOrThrow({
+        schema: WorkflowDefinitionSchema,
+        input: input,
+        label: label
+    });
+}
+
+const AuthoringWorkflowSchema = pinned()(v__namespace.strictObject(workflowFields(AuthoringFieldEntrySchema, AuthoringStageSchema))), WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
+
+function isStartableDefinition(definition) {
+    return definition.lifecycle !== "child";
+}
+
+function formatValidationError(label, issues) {
+    const lines = issues.map(issue => `  - ${issue.path.length === 0 ? "(root)" : formatIssuePath(issue.path)}: ${issue.message}`);
+    return `${label} failed validation (${issues.length} issue${issues.length === 1 ? "" : "s"}):\n${lines.join(`\n`)}`;
+}
+
+function issuesFromValibot(issues) {
+    return issues.map(issue => ({
+        path: issue.path ? issue.path.map(item => item.key) : [],
+        message: issue.message
+    }));
+}
+
+function formatIssuePath(path) {
+    let out = "";
+    for (const seg of path) typeof seg == "number" ? out += `[${seg}]` : out += out.length === 0 ? String(seg) : `.${String(seg)}`;
+    return out;
+}
+
+function parseOrThrow({schema: schema, input: input, label: label}) {
+    const result = v__namespace.safeParse(schema, input);
+    if (!result.success) throw new Error(formatValidationError(label, issuesFromValibot(result.issues)));
+    return result.output;
+}
+
+function labelFor(fn, value) {
+    if (value && typeof value == "object" && "name" in value) {
+        const raw = value.name;
+        if (typeof raw == "string") return `${fn}("${raw}")`;
+    }
+    return fn;
+}
+
+function knownList(ids) {
+    const quoted = [ ...ids ].map(s => `"${s}"`);
+    return quoted.length > 0 ? quoted.join(", ") : "(none)";
+}
+
+function checkDuplicates({names: names, what: what, issues: issues}) {
+    const seen = /* @__PURE__ */ new Set;
+    for (const {name: name, path: path} of names) seen.has(name) && issues.push({
+        path: path,
+        message: `duplicate ${what} "${name}" (already declared earlier)`
+    }), seen.add(name);
+    return seen;
+}
+
+function checkStages(def, issues) {
+    const stageNames = checkDuplicates({
+        names: def.stages.map((stage, i) => ({
+            name: stage.name,
+            path: [ "stages", i, "name" ]
+        })),
+        what: "stage name",
+        issues: issues
+    });
+    for (const [i, stage] of def.stages.entries()) {
+        const activityNames = checkDuplicates({
+            names: (stage.activities ?? []).map((activity, j) => ({
+                name: activity.name,
+                path: [ "stages", i, "activities", j, "name" ]
+            })),
+            what: `activity name in stage "${stage.name}"`,
+            issues: issues
+        });
+        checkDuplicates({
+            names: (stage.transitions ?? []).map((t, k) => ({
+                name: t.name,
+                path: [ "stages", i, "transitions", k, "name" ]
+            })),
+            what: `transition name in stage "${stage.name}"`,
+            issues: issues
+        }), checkActivities({
+            def: def,
+            i: i,
+            activityNames: activityNames,
+            issues: issues
+        });
+    }
+    return stageNames;
+}
+
+function checkActivities({def: def, i: i, activityNames: activityNames, issues: issues}) {
+    const stage = def.stages[i];
+    for (const [j, activity] of (stage.activities ?? []).entries()) {
+        const path = [ "stages", i, "activities", j ];
+        checkDuplicates({
+            names: (activity.actions ?? []).map((action, a) => ({
+                name: action.name,
+                path: [ ...path, "actions", a, "name" ]
+            })),
+            what: `action name in activity "${activity.name}"`,
+            issues: issues
+        }), checkStatusSetTargets({
+            activity: activity,
+            activityNames: activityNames,
+            path: path,
+            issues: issues
+        });
+    }
+}
+
+function checkStatusSetTargets({activity: activity, activityNames: activityNames, path: path, issues: issues}) {
+    checkStatusSetOps({
+        ops: activity.ops,
+        activityNames: activityNames,
+        path: [ ...path, "ops" ],
+        issues: issues
+    });
+    for (const [a, action] of (activity.actions ?? []).entries()) checkStatusSetOps({
+        ops: action.ops,
+        activityNames: activityNames,
+        path: [ ...path, "actions", a, "ops" ],
+        issues: issues
+    });
+}
+
+function checkStatusSetOps({ops: ops, activityNames: activityNames, path: path, issues: issues}) {
+    for (const [o, op] of (ops ?? []).entries()) op.type !== "status.set" || activityNames.has(op.activity) || issues.push({
+        path: [ ...path, o, "activity" ],
+        message: `status.set targets activity "${op.activity}" which is not declared in this stage. Known activities: ${knownList(activityNames)}`
+    });
+}
+
+function checkInitialStage({def: def, stageNames: stageNames, issues: issues}) {
+    stageNames.has(def.initialStage) || issues.push({
+        path: [ "initialStage" ],
+        message: `initialStage "${def.initialStage}" is not a declared stage. Known stages: ${knownList(stageNames)}`
+    });
+}
+
+function checkTransitionTargets({def: def, stageNames: stageNames, issues: issues}) {
+    for (const [i, stage] of def.stages.entries()) for (const [k, t] of (stage.transitions ?? []).entries()) stageNames.has(t.to) || issues.push({
+        path: [ "stages", i, "transitions", k, "to" ],
+        message: `transition target "${t.to}" is not a declared stage. Known stages: ${knownList(stageNames)}`
+    });
+}
+
+function checkStageReachability({def: def, stageNames: stageNames, issues: issues}) {
+    if (!stageNames.has(def.initialStage)) return;
+    const stagesByName = /* @__PURE__ */ new Map;
+    for (const stage of def.stages) stagesByName.has(stage.name) || stagesByName.set(stage.name, stage);
+    const reached = /* @__PURE__ */ new Set([ def.initialStage ]), frontier = [ def.initialStage ];
+    for (;frontier.length > 0; ) {
+        const stage = stagesByName.get(frontier.pop());
+        for (const t of stage?.transitions ?? []) reached.has(t.to) || !stageNames.has(t.to) || (reached.add(t.to), 
+        frontier.push(t.to));
+    }
+    for (const [i, stage] of def.stages.entries()) reached.has(stage.name) || issues.push({
+        path: [ "stages", i, "name" ],
+        message: `stage "${stage.name}" is unreachable — no transition path leads from initialStage "${def.initialStage}" to it, so no instance can ever enter it. Add a transition targeting it, or remove the stage`
+    });
+}
+
+function effectNameSites(def) {
+    const sites = [];
+    for (const [i, stage] of def.stages.entries()) {
+        for (const [j, activity] of (stage.activities ?? []).entries()) {
+            collectEffects({
+                effects: activity.effects,
+                path: [ "stages", i, "activities", j, "effects" ],
+                sites: sites
+            });
+            for (const [a, action] of (activity.actions ?? []).entries()) collectEffects({
+                effects: action.effects,
+                path: [ "stages", i, "activities", j, "actions", a, "effects" ],
+                sites: sites
+            });
+        }
+        for (const [k, t] of (stage.transitions ?? []).entries()) collectEffects({
+            effects: t.effects,
+            path: [ "stages", i, "transitions", k, "effects" ],
+            sites: sites
+        });
+    }
+    return sites;
+}
+
+function checkEffectNames(def, issues) {
+    checkDuplicates({
+        names: effectNameSites(def),
+        what: "effect name (registry key — unique per definition)",
+        issues: issues
+    });
+}
+
+function collectEffects({effects: effects, path: path, sites: sites}) {
+    for (const [e, effect] of (effects ?? []).entries()) sites.push({
+        name: effect.name,
+        path: [ ...path, e, "name" ]
+    });
+}
+
+function checkGuardNames(def, issues) {
+    const sites = def.stages.flatMap((stage, i) => (stage.guards ?? []).map((guard, g) => ({
+        name: guard.name,
+        path: [ "stages", i, "guards", g, "name" ]
+    })));
+    checkDuplicates({
+        names: sites,
+        what: "guard name (the guard lake _id derives from it — unique per definition)",
+        issues: issues
+    });
+}
+
+function fieldScopes(def) {
+    const scopes = [ {
+        entries: def.fields,
+        scope: "workflow",
+        path: [ "fields" ],
+        label: "workflow fields"
+    } ];
+    for (const [i, stage] of def.stages.entries()) {
+        scopes.push({
+            entries: stage.fields,
+            scope: "stage",
+            path: [ "stages", i, "fields" ],
+            label: `stage "${stage.name}" fields`
+        });
+        for (const [j, activity] of (stage.activities ?? []).entries()) scopes.push({
+            entries: activity.fields,
+            scope: "activity",
+            path: [ "stages", i, "activities", j, "fields" ],
+            label: `activity "${activity.name}" fields`
+        });
+    }
+    return scopes;
+}
+
+function checkRequiredField(def, issues) {
+    for (const {entries: entries, scope: scope, path: path, label: label} of fieldScopes(def)) for (const [n, entry] of (entries ?? []).entries()) if (entry.required === !0) {
+        if (scope !== "workflow") issues.push({
+            path: [ ...path, n, "required" ],
+            message: `${label} entry "${entry.name}" is \`required\`, but \`required\` applies only to workflow-scope \`input\` entries — only those are caller-supplied at start/spawn`
+        }); else if (entry.initialValue?.type !== "input") {
+            const seed = entry.initialValue?.type ?? "working memory (no initialValue)";
+            issues.push({
+                path: [ ...path, n, "required" ],
+                message: `field entry "${entry.name}" has initialValue "${seed}" — \`required\` applies only to \`input\`-sourced entries (the caller fills them at start/spawn)`
+            });
+        }
+    }
+}
+
+function checkFieldEntryNames(def, issues) {
+    for (const {entries: entries, path: path, label: label} of fieldScopes(def)) checkDuplicates({
+        names: (entries ?? []).map((entry, n) => ({
+            name: entry.name,
+            path: [ ...path, n, "name" ]
+        })),
+        what: `field entry name in ${label}`,
+        issues: issues
+    });
+}
+
+function checkPredicates(def, issues) {
+    const reserved = new Set(RESERVED_CONDITION_VARS), names = Object.keys(def.predicates ?? {});
+    for (const name of names) reserved.has(name) && issues.push({
+        path: [ "predicates", name ],
+        message: `predicate "${name}" shadows the built-in $${name} — pick another name`
+    });
+    for (const [name, groq] of Object.entries(def.predicates ?? {})) checkPredicateBody({
+        name: name,
+        groq: groq,
+        names: names,
+        issues: issues
+    });
+}
+
+function checkPredicateBody({name: name, groq: groq, names: names, issues: issues}) {
+    const reads = conditionParameterNames(groq);
+    for (const caller of CALLER_BOUND_VARS) reads.has(caller) && issues.push({
+        path: [ "predicates", name ],
+        message: `predicate "${name}" reads $${caller} — predicates are instance-level (pre-evaluated once, without a caller); compose caller gates at the condition site instead`
+    });
+    for (const other of names) other === name || !reads.has(other) || issues.push({
+        path: [ "predicates", name ],
+        message: `predicate "${name}" references predicate $${other} — predicates may read built-in vars only (no cross-references; compose at the condition site instead)`
+    });
+}
+
+function entryNames(entries) {
+    return new Set((entries ?? []).map(entry => entry.name));
+}
+
+function checkUnboundCallerVars(def, issues) {
+    for (const site of conditionSites(def)) {
+        const reads = conditionParameterNames(site.groq);
+        for (const name of unboundCallerVars(site.policy)) reads.has(name) && issues.push({
+            path: site.path,
+            message: callerVarMessage(site, name)
+        });
+    }
+}
+
+function unboundCallerVars(policy) {
+    return policy === "cascade" ? CALLER_BOUND_VARS : policy === "caller-bound" ? [ "params" ] : [ "can" ];
+}
+
+function callerVarMessage(site, name) {
+    return site.policy === "cascade" ? `${site.label} reads $${name} — the cascade evaluates transition filters and activity gates (filter/completeWhen/failWhen) with no caller bound ($assigned is constant false, the other caller vars hold no value); gate on instance state (e.g. a field an action wrote) instead` : site.policy === "caller-bound" ? `${site.label} reads $${name} — $params (the firing action's args) is bound only while the action's effect bindings and where-op \`where\`s evaluate; this site never binds it, so the condition could never pass. Bind $params in an effect binding or a where-op instead, or gate on a field an action wrote` : `${site.label} reads $can — $can (the caller's grants) is bound only in the caller-bound projection (action filters, requirements, editable predicates) and never holds a value in cascade conditions; move the check to one of those sites or drop $can`;
+}
+
+function conditionSites(def) {
+    const sites = [], workflowLayer = {
+        scope: "workflow",
+        names: entryNames(def.fields)
+    };
+    collectEditableSites({
+        entries: def.fields,
+        path: [ "fields" ],
+        labelPrefix: "workflow",
+        fields: "context-dependent",
+        sites: sites
+    });
+    for (const [i, stage] of def.stages.entries()) collectStageConditionSites({
+        stage: stage,
+        i: i,
+        workflowLayer: workflowLayer,
+        sites: sites
+    });
+    return sites;
+}
+
+function collectStageConditionSites({stage: stage, i: i, workflowLayer: workflowLayer, sites: sites}) {
+    const stageLayer = {
+        scope: "stage",
+        names: entryNames(stage.fields)
+    }, stageFields2 = [ stageLayer, workflowLayer ], editableWindow = [ stageLayer, workflowLayer, ...(stage.activities ?? []).map(activity => ({
+        scope: "activity",
+        names: entryNames(activity.fields)
+    })) ];
+    for (const [k, t] of (stage.transitions ?? []).entries()) sites.push({
+        groq: t.filter,
+        path: [ "stages", i, "transitions", k, "filter" ],
+        label: `transition "${t.name}" filter`,
+        policy: "cascade",
+        fields: stageFields2
+    }), collectBindingSites({
+        effects: t.effects,
+        path: [ "stages", i, "transitions", k, "effects" ],
+        label: `transition "${t.name}"`,
+        fields: stageFields2,
+        sites: sites
+    }), collectOpWhereSites({
+        ops: t.ops,
+        path: [ "stages", i, "transitions", k, "ops" ],
+        label: `transition "${t.name}"`,
+        fields: stageFields2,
+        sites: sites
+    });
+    collectEditableSites({
+        entries: stage.fields,
+        path: [ "stages", i, "fields" ],
+        labelPrefix: `stage "${stage.name}"`,
+        fields: editableWindow,
+        sites: sites
+    });
+    for (const [name, editable] of Object.entries(stage.editable ?? {})) typeof editable == "string" && sites.push({
+        groq: editable,
+        path: [ "stages", i, "editable", name ],
+        label: `stage "${stage.name}" editable override "${name}"`,
+        policy: "caller-bound",
+        fields: editableWindow
+    });
+    for (const [j, activity] of (stage.activities ?? []).entries()) collectActivityConditionSites({
+        activity: activity,
+        path: [ "stages", i, "activities", j ],
+        stageFields: stageFields2,
+        sites: sites
+    });
+}
+
+function collectEditableSites({entries: entries, path: path, labelPrefix: labelPrefix, fields: fields, sites: sites}) {
+    for (const [n, entry] of (entries ?? []).entries()) typeof entry.editable == "string" && sites.push({
+        groq: entry.editable,
+        path: [ ...path, n, "editable" ],
+        label: `${labelPrefix} field "${entry.name}" editable`,
+        policy: "caller-bound",
+        fields: fields
+    });
+}
+
+function collectOpWhereSites({ops: ops, path: path, label: label, fields: fields, sites: sites}) {
+    for (const [o, op] of (ops ?? []).entries()) op.where !== void 0 && sites.push({
+        groq: op.where,
+        path: [ ...path, o, "where" ],
+        label: `${label} ${op.type} where`,
+        fields: fields
+    });
+}
+
+function collectActivityConditionSites({activity: activity, path: path, stageFields: stageFields2, sites: sites}) {
+    const fields = [ {
+        scope: "activity",
+        names: entryNames(activity.fields)
+    }, ...stageFields2 ];
+    for (const gate of [ "filter", "completeWhen", "failWhen" ]) {
+        const groq = activity[gate];
+        groq !== void 0 && sites.push({
+            groq: groq,
+            path: [ ...path, gate ],
+            label: `activity "${activity.name}".${gate}`,
+            policy: "cascade",
+            fields: fields
+        });
+    }
+    for (const [name, groq] of Object.entries(activity.requirements ?? {})) sites.push({
+        groq: groq,
+        path: [ ...path, "requirements", name ],
+        label: `activity "${activity.name}" requirement "${name}"`,
+        policy: "caller-bound",
+        fields: fields
+    });
+    collectBindingSites({
+        effects: activity.effects,
+        path: [ ...path, "effects" ],
+        label: `activity "${activity.name}"`,
+        fields: fields,
+        sites: sites
+    }), collectOpWhereSites({
+        ops: activity.ops,
+        path: [ ...path, "ops" ],
+        label: `activity "${activity.name}"`,
+        fields: fields,
+        sites: sites
+    }), collectEditableSites({
+        entries: activity.fields,
+        path: [ ...path, "fields" ],
+        labelPrefix: `activity "${activity.name}"`,
+        fields: fields,
+        sites: sites
+    }), collectActionConditionSites({
+        activity: activity,
+        path: path,
+        fields: fields,
+        sites: sites
+    }), collectSubworkflowSites({
+        activity: activity,
+        path: path,
+        fields: fields,
+        sites: sites
+    });
+}
+
+function collectActionConditionSites({activity: activity, path: path, fields: fields, sites: sites}) {
+    for (const [a, action] of (activity.actions ?? []).entries()) action.filter !== void 0 && sites.push({
+        groq: action.filter,
+        path: [ ...path, "actions", a, "filter" ],
+        label: `action "${action.name}" filter`,
+        policy: "caller-bound",
+        fields: fields
+    }), collectBindingSites({
+        effects: action.effects,
+        path: [ ...path, "actions", a, "effects" ],
+        label: `action "${action.name}"`,
+        fields: fields,
+        sites: sites
+    }), collectOpWhereSites({
+        ops: action.ops,
+        path: [ ...path, "actions", a, "ops" ],
+        label: `action "${action.name}"`,
+        fields: fields,
+        sites: sites
+    });
+}
+
+function collectSubworkflowSites({activity: activity, path: path, fields: fields, sites: sites}) {
+    const sub = activity.subworkflows;
+    if (sub === void 0) return;
+    const subPath = [ ...path, "subworkflows" ];
+    sites.push({
+        groq: sub.forEach,
+        path: [ ...subPath, "forEach" ],
+        label: `activity "${activity.name}".subworkflows.forEach`,
+        fields: fields
+    });
+    for (const [group, record] of [ [ "with", sub.with ], [ "context", sub.context ] ]) for (const [key, groq] of Object.entries(record ?? {})) sites.push({
+        groq: groq,
+        path: [ ...subPath, group, key ],
+        label: `activity "${activity.name}".subworkflows.${group} "${key}"`,
+        fields: fields
+    });
+}
+
+function collectBindingSites({effects: effects, path: path, label: label, fields: fields, sites: sites}) {
+    for (const [e, effect] of (effects ?? []).entries()) for (const [key, groq] of Object.entries(effect.bindings ?? {})) sites.push({
+        groq: groq,
+        path: [ ...path, e, "bindings", key ],
+        label: `${label} effect "${effect.name}" binding "${key}"`,
+        fields: fields
+    });
+}
+
+function checkAssigneesEntries(def, issues) {
+    for (const {entries: entries, path: path} of fieldScopes(def)) (entries ?? []).filter(e => e.type === "assignees").length <= 1 || issues.push({
+        path: path,
+        message: "at most one assignees-kind field entry per scope — the inbox reads it by kind"
+    });
+}
+
+function activityShape(activity) {
+    return {
+        hasActions: (activity.actions ?? []).length > 0,
+        hasEffects: (activity.effects ?? []).length > 0,
+        hasCompleteWhen: activity.completeWhen !== void 0,
+        hasSubworkflows: activity.subworkflows !== void 0
+    };
+}
+
+const KIND_SHAPE_RULES = {
+    user: s => s.hasActions ? [] : [ "needs at least one action for a person to fire" ],
+    service: s => s.hasEffects ? [] : [ "needs at least one effect — the automated work it performs" ],
+    manual: s => [ s.hasActions || s.hasCompleteWhen ? void 0 : "needs a way to complete — an action to acknowledge it, or a `completeWhen` predicate to verify it (otherwise it auto-resolves on activation)", s.hasSubworkflows ? "is off-system work, not a fan-out — drop `subworkflows` or move it to its own activity" : void 0 ].filter(m => m !== void 0),
+    receive: s => [ s.hasCompleteWhen || s.hasSubworkflows ? void 0 : "needs a `completeWhen` (or `subworkflows`) condition to wait on", s.hasActions ? "has no actor, so it cannot carry actions" : void 0 ].filter(m => m !== void 0),
+    script: s => [ s.hasActions ? "runs inline with no actor, so it cannot carry actions" : void 0, s.hasCompleteWhen ? "resolves on activation, so it cannot carry a `completeWhen` (that is a `receive`/`service` wait)" : void 0, s.hasSubworkflows ? "resolves on activation, so it cannot fan out with `subworkflows`" : void 0 ].filter(m => m !== void 0)
+};
+
+function checkActivityKinds(def, issues) {
+    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) {
+        const path = [ "stages", i, "activities", j ];
+        if (activity.target !== void 0 && activity.kind !== "manual" && issues.push({
+            path: [ ...path, "target" ],
+            message: `activity "${activity.name}" has a \`target\` but is not \`kind: "manual"\` — a target is the deep-link for off-system manual work`
+        }), activity.kind !== void 0) for (const fault of KIND_SHAPE_RULES[activity.kind](activityShape(activity))) issues.push({
+            path: [ ...path, "kind" ],
+            message: `activity "${activity.name}" declares kind "${activity.kind}" but ${fault}`
+        });
+    }
+}
+
+function checkGroups(def, issues) {
+    const workflowGroups = checkGroupDeclarations({
+        groups: def.groups,
+        path: [ "groups" ],
+        what: "group name",
+        issues: issues
+    });
+    checkFieldMemberships({
+        entries: def.fields,
+        reachable: [ workflowGroups ],
+        path: [ "fields" ],
+        label: "workflow fields",
+        issues: issues
+    });
+    for (const [i, stage] of def.stages.entries()) checkStageGroups({
+        stage: stage,
+        i: i,
+        workflowGroups: workflowGroups,
+        issues: issues
+    });
+}
+
+function checkGroupDeclarations({groups: groups, path: path, what: what, issues: issues}) {
+    return checkDuplicates({
+        names: (groups ?? []).map((group, n) => ({
+            name: group.name,
+            path: [ ...path, n, "name" ]
+        })),
+        what: what,
+        issues: issues
+    });
+}
+
+function checkStageGroups({stage: stage, i: i, workflowGroups: workflowGroups, issues: issues}) {
+    const path = [ "stages", i ], enclosing = [ checkGroupDeclarations({
+        groups: stage.groups,
+        path: [ ...path, "groups" ],
+        what: `group name in stage "${stage.name}"`,
+        issues: issues
+    }), workflowGroups ];
+    checkFieldMemberships({
+        entries: stage.fields,
+        reachable: enclosing,
+        path: [ ...path, "fields" ],
+        label: `stage "${stage.name}" fields`,
+        issues: issues
+    });
+    for (const [j, activity] of (stage.activities ?? []).entries()) checkActivityGroups({
+        activity: activity,
+        path: [ ...path, "activities", j ],
+        enclosing: enclosing,
+        issues: issues
+    });
+}
+
+function checkActivityGroups({activity: activity, path: path, enclosing: enclosing, issues: issues}) {
+    checkGroupMembership({
+        group: activity.group,
+        reachable: enclosing,
+        path: [ ...path, "group" ],
+        label: `activity "${activity.name}"`,
+        issues: issues
+    });
+    const inner = [ checkGroupDeclarations({
+        groups: activity.groups,
+        path: [ ...path, "groups" ],
+        what: `group name in activity "${activity.name}"`,
+        issues: issues
+    }), ...enclosing ];
+    checkFieldMemberships({
+        entries: activity.fields,
+        reachable: inner,
+        path: [ ...path, "fields" ],
+        label: `activity "${activity.name}" fields`,
+        issues: issues
+    });
+    for (const [a, action] of (activity.actions ?? []).entries()) checkGroupMembership({
+        group: action.group,
+        reachable: inner,
+        path: [ ...path, "actions", a, "group" ],
+        label: `action "${action.name}"`,
+        issues: issues
+    });
+}
+
+function checkFieldMemberships({entries: entries, reachable: reachable, path: path, label: label, issues: issues}) {
+    for (const [n, entry] of (entries ?? []).entries()) checkGroupMembership({
+        group: entry.group,
+        reachable: reachable,
+        path: [ ...path, n, "group" ],
+        label: `${label} entry "${entry.name}"`,
+        issues: issues
+    });
+}
+
+function checkGroupMembership({group: group, reachable: reachable, path: path, label: label, issues: issues}) {
+    for (const name of groupMembershipNames(group)) {
+        if (reachable.some(names => names.has(name))) continue;
+        const declared = new Set(reachable.flatMap(names => [ ...names ]));
+        issues.push({
+            path: path,
+            message: `${label} names group "${name}", which is not declared on its enclosing chain. Declared: ${knownList(declared)}`
+        });
+    }
+}
+
+function checkConditionFieldReads(def, issues) {
+    const everywhere = allDeclaredFieldNames(def);
+    for (const site of conditionSites(def)) for (const name of conditionFieldReadNames(site.groq)) fieldVisibleAtSite({
+        site: site,
+        name: name,
+        everywhere: everywhere
+    }) || issues.push({
+        path: site.path,
+        message: undeclaredFieldReadMessage(site, name)
+    });
+    for (const [name, groq] of Object.entries(def.predicates ?? {})) for (const read of conditionFieldReadNames(groq)) everywhere.has(read) || issues.push({
+        path: [ "predicates", name ],
+        message: noFieldAnywhereMessage(`predicate "${name}"`, read)
+    });
+}
+
+function allDeclaredFieldNames(def) {
+    const names = /* @__PURE__ */ new Set;
+    for (const {entries: entries} of fieldScopes(def)) for (const entry of entries ?? []) names.add(entry.name);
+    return names;
+}
+
+function fieldVisibleAtSite({site: site, name: name, everywhere: everywhere}) {
+    return site.fields === "context-dependent" ? everywhere.has(name) : site.fields.some(layer => layer.names.has(name));
+}
+
+function noFieldAnywhereMessage(label, name) {
+    return `${label} reads $fields.${name}, but no field entry named "${name}" is declared anywhere in the definition — the read evaluates to GROQ null, so the condition silently fails closed`;
+}
+
+function undeclaredFieldReadMessage(site, name) {
+    if (site.fields === "context-dependent") return noFieldAnywhereMessage(site.label, name);
+    const visible = site.fields.flatMap(layer => [ ...layer.names ].map(n => `${layer.scope}:${n}`));
+    return `${site.label} reads $fields.${name}, but no field entry named "${name}" is lexically visible here — the read evaluates to GROQ null, so the condition silently fails closed. Visible: ${visible.join(", ") || "(none)"}`;
+}
+
+function checkFieldReadSeeds(def, issues) {
+    const workflowEntries = def.fields ?? [];
+    for (const {entries: entries, scope: scope, path: path, label: label} of fieldScopes(def)) for (const [n, entry] of (entries ?? []).entries()) {
+        const read = entry.initialValue;
+        read?.type === "fieldRead" && checkSeedRead({
+            read: read,
+            where: `${label} entry "${entry.name}"`,
+            entryName: entry.name,
+            scope: scope,
+            siblings: entries ?? [],
+            index: n,
+            workflowEntries: workflowEntries,
+            path: [ ...path, n, "initialValue" ],
+            issues: issues
+        });
+    }
+}
+
+function checkSeedRead(args) {
+    const {read: read, where: where, path: path, issues: issues} = args, misspelled = seedScopeSpellingIssue(args);
+    if (misspelled !== void 0) {
+        issues.push({
+            path: path,
+            message: `${where} ${misspelled}`
+        });
+        return;
+    }
+    const target = read.scope === "workflow" ? seedWorkflowTarget(args) : seedEarlierSiblingTarget(args);
+    target !== void 0 && pushFieldReadPathIssue({
+        where: where,
+        read: read,
+        target: target,
+        path: path,
+        issues: issues
+    });
+}
+
+function seedScopeSpellingIssue({read: read, scope: scope}) {
+    if (read.scope === "workflow" && scope === "workflow") return 'seeds from a fieldRead with scope "workflow", but workflow-scope seeds resolve against earlier same-scope siblings only (no workflow layer exists yet at start/spawn) — omit `scope`';
+    if (read.scope === "stage") {
+        if (scope === "workflow") return 'seeds from a fieldRead with scope "stage", but a workflow-scope entry has no stage in scope — omit `scope` to read an earlier workflow-scope sibling';
+        if (scope === "activity") return 'seeds from a fieldRead with scope "stage", but a seed resolves non-workflow reads against the scope being seeded, so an activity-scope entry cannot read stage fields — omit `scope` to read an earlier activity-scope sibling, or use scope "workflow"';
+    }
+}
+
+function seedWorkflowTarget({read: read, where: where, workflowEntries: workflowEntries, path: path, issues: issues}) {
+    const target = workflowEntries.find(entry => entry.name === read.field);
+    if (target !== void 0) return target;
+    issues.push({
+        path: path,
+        message: `${where} seeds from workflow-scope field "${read.field}", which is not declared — the read would resolve to the default value. Known workflow fields: ${knownList(workflowEntries.map(entry => entry.name))}`
+    });
+}
+
+function seedEarlierSiblingTarget(args) {
+    const {read: read, where: where, entryName: entryName, scope: scope, siblings: siblings, index: index, workflowEntries: workflowEntries, path: path, issues: issues} = args, targetIndex = siblings.findIndex(entry => entry.name === read.field);
+    if (targetIndex !== -1 && targetIndex < index) return siblings[targetIndex];
+    if (targetIndex === index) {
+        issues.push({
+            path: path,
+            message: `${where} seeds from itself — a fieldRead cannot read the entry it seeds`
+        });
+        return;
+    }
+    if (targetIndex > index) {
+        issues.push({
+            path: path,
+            message: `${where} seeds from "${read.field}", which is declared later in the same scope — entries resolve in declaration order, so the read would see its default. Move "${read.field}" before "${entryName}"`
+        });
+        return;
+    }
+    const workflowHint = scope !== "workflow" && workflowEntries.some(entry => entry.name === read.field) ? ' — a workflow-scope entry of that name exists; add `scope: "workflow"` to read it (an omitted scope reads same-scope siblings only)' : "";
+    issues.push({
+        path: path,
+        message: `${where} seeds from "${read.field}", which is not an earlier ${scope}-scope sibling — the read would resolve to the default value${workflowHint}. Earlier siblings: ${knownList(siblings.slice(0, index).map(entry => entry.name))}`
+    });
+}
+
+function checkFieldReadOpValues(def, issues) {
+    const workflowEntries = def.fields ?? [];
+    for (const [i, stage] of def.stages.entries()) {
+        const shared = {
+            workflowEntries: workflowEntries,
+            stageEntries: stage.fields ?? [],
+            issues: issues
+        };
+        for (const [k, t] of (stage.transitions ?? []).entries()) checkOpsFieldReads({
+            ...shared,
+            ops: t.ops,
+            path: [ "stages", i, "transitions", k, "ops" ],
+            label: `transition "${t.name}"`
+        });
+        for (const [j, activity] of (stage.activities ?? []).entries()) {
+            const activityNames = entryNames(activity.fields), activityPath = [ "stages", i, "activities", j ];
+            checkOpsFieldReads({
+                ...shared,
+                ops: activity.ops,
+                path: [ ...activityPath, "ops" ],
+                label: `activity "${activity.name}"`,
+                activityNames: activityNames
+            });
+            for (const [a, action] of (activity.actions ?? []).entries()) checkOpsFieldReads({
+                ...shared,
+                ops: action.ops,
+                path: [ ...activityPath, "actions", a, "ops" ],
+                label: `action "${action.name}"`,
+                activityNames: activityNames
+            });
+        }
+    }
+}
+
+function checkOpsFieldReads({ops: ops, path: path, label: label, ...ctx}) {
+    for (const [o, op] of (ops ?? []).entries()) if ("value" in op) for (const {read: read, path: readPath} of fieldReadsIn(op.value, [ ...path, o, "value" ])) checkOpFieldRead({
+        ...ctx,
+        read: read,
+        path: readPath,
+        where: `${label} ${op.type} value`
+    });
+}
+
+function fieldReadsIn(value, path) {
+    return value.type === "fieldRead" ? [ {
+        read: value,
+        path: path
+    } ] : value.type !== "object" ? [] : Object.entries(value.fields).flatMap(([key, sub]) => fieldReadsIn(sub, [ ...path, "fields", key ]));
+}
+
+function checkOpFieldRead({read: read, where: where, path: path, workflowEntries: workflowEntries, stageEntries: stageEntries, activityNames: activityNames, issues: issues}) {
+    const hosts = [ {
+        scope: "stage",
+        entries: stageEntries
+    }, {
+        scope: "workflow",
+        entries: workflowEntries
+    } ].filter(host => read.scope === void 0 || host.scope === read.scope), target = hosts.flatMap(host => host.entries).find(entry => entry.name === read.field);
+    if (target === void 0) {
+        issues.push({
+            path: path,
+            message: opFieldReadMissMessage({
+                read: read,
+                where: where,
+                hosts: hosts,
+                activityNames: activityNames
+            })
+        });
+        return;
+    }
+    pushFieldReadPathIssue({
+        where: where,
+        read: read,
+        target: target,
+        path: path,
+        issues: issues
+    });
+}
+
+function opFieldReadMissMessage({read: read, where: where, hosts: hosts, activityNames: activityNames}) {
+    const searched = read.scope === void 0 ? "stage or workflow scope" : `${read.scope} scope`, activityHint = activityNames?.has(read.field) ? ` "${read.field}" is an activity-scope field, and op-time field reads resolve against stage and workflow scopes only — declare it at stage scope to read it from an op.` : "", known = hosts.flatMap(host => host.entries.map(entry => `${host.scope}:${entry.name}`));
+    return `${where} reads field "${read.field}", which is not declared at ${searched} — the read resolves to undefined at op time, so the write silently lands empty.${activityHint} Known: ${known.join(", ") || "(none)"}`;
+}
+
+function checkGuardFieldReads(def, issues) {
+    const reads = {
+        workflowEntries: def.fields ?? [],
+        effectNames: new Set(effectNameSites(def).map(site => site.name)),
+        issues: issues
+    };
+    for (const [i, stage] of def.stages.entries()) for (const [g, guard] of (stage.guards ?? []).entries()) {
+        const where = `stage "${stage.name}" guard "${guard.name}"`, guardPath = [ "stages", i, "guards", g ];
+        for (const [k, expr] of (guard.match.idRefs ?? []).entries()) checkGuardRead({
+            ...reads,
+            expr: expr,
+            where: `${where} match.idRefs`,
+            path: [ ...guardPath, "match", "idRefs", k ]
+        });
+        for (const [key, expr] of Object.entries(guard.metadata ?? {})) checkGuardRead({
+            ...reads,
+            expr: expr,
+            where: `${where} metadata "${key}"`,
+            path: [ ...guardPath, "metadata", key ]
+        });
+    }
+}
+
+function checkGuardRead(args) {
+    const fieldRead = FIELD_READ.exec(args.expr);
+    if (fieldRead !== null) {
+        checkGuardFieldRead({
+            ...args,
+            name: fieldRead[1],
+            valuePath: fieldRead[2]
+        });
+        return;
+    }
+    const effectName = EFFECTS_READ.exec(args.expr)?.[1];
+    effectName === void 0 || args.effectNames.has(effectName) || args.issues.push({
+        path: args.path,
+        message: `${args.where} reads "${args.expr}", but no effect named "${effectName}" is declared — the read resolves to undefined and the guard deploys with a hole. Known effects: ${knownList(args.effectNames)}`
+    });
+}
+
+function checkGuardFieldRead({name: name, valuePath: valuePath, where: where, path: path, workflowEntries: workflowEntries, issues: issues}) {
+    const target = workflowEntries.find(entry => entry.name === name);
+    if (target === void 0) {
+        issues.push({
+            path: path,
+            message: `${where} reads "$fields.${name}", but "${name}" is not a workflow-scope field entry — guard reads resolve against workflow-scope fields only. Known workflow fields: ${knownList(workflowEntries.map(entry => entry.name))}`
+        });
+        return;
+    }
+    pushFieldReadPathIssue({
+        where: where,
+        read: {
+            field: name,
+            path: valuePath
+        },
+        target: target,
+        path: path,
+        issues: issues
+    });
+}
+
+function pushFieldReadPathIssue({where: where, read: read, target: target, path: path, issues: issues}) {
+    if (read.path === void 0) return;
+    const pathIssue = fieldValuePathIssue({
+        target: target,
+        path: read.path
+    });
+    pathIssue !== void 0 && issues.push({
+        path: path,
+        message: `${where} reads "${read.field}" with path "${read.path}", which does not fit the declared shape of "${target.name ?? read.field}" (${target.type}) — ${pathIssue}`
+    });
+}
+
+const SCALAR = {
+    kind: "scalar"
+}, DOC_CONTENT = {
+    kind: "opaque"
+}, GDR_VALUE = {
+    kind: "record",
+    keys: {
+        id: SCALAR,
+        type: SCALAR
+    }
+}, RELEASE_VALUE = {
+    kind: "record",
+    keys: {
+        id: SCALAR,
+        type: SCALAR,
+        releaseName: SCALAR
+    }
+}, ACTOR_VALUE = {
+    kind: "record",
+    keys: {
+        kind: SCALAR,
+        id: SCALAR,
+        roles: {
+            kind: "list",
+            item: SCALAR
+        },
+        onBehalfOf: SCALAR
+    }
+}, ASSIGNEE_VALUE = {
+    kind: "record",
+    keys: {
+        type: SCALAR,
+        id: SCALAR,
+        role: SCALAR
+    }
+}, VALUE_NODES = {
+    "doc.ref": () => DOC_CONTENT,
+    "doc.refs": () => ({
+        kind: "list",
+        item: GDR_VALUE
+    }),
+    "release.ref": () => RELEASE_VALUE,
+    string: () => SCALAR,
+    text: () => SCALAR,
+    number: () => SCALAR,
+    boolean: () => SCALAR,
+    date: () => SCALAR,
+    datetime: () => SCALAR,
+    url: () => SCALAR,
+    actor: () => ACTOR_VALUE,
+    assignee: () => ASSIGNEE_VALUE,
+    assignees: () => ({
+        kind: "list",
+        item: ASSIGNEE_VALUE
+    }),
+    object: shape => ({
+        kind: "object",
+        fields: shape.fields ?? []
+    }),
+    array: shape => ({
+        kind: "rows",
+        of: shape.of ?? []
+    })
+};
+
+function valueNodeFor(shape) {
+    return Object.hasOwn(VALUE_NODES, shape.type) ? VALUE_NODES[shape.type](shape) : void 0;
+}
+
+const INDEX_SEGMENT = /^\d+$/;
+
+function stepIntoValueNode(node, segment) {
+    switch (node.kind) {
+      case "scalar":
+        return "the value is a scalar with no sub-paths";
+
+      case "object":
+        {
+            const sub = node.fields.find(f => f.name === segment), next = sub === void 0 ? void 0 : valueNodeFor(sub);
+            return next !== void 0 ? next : `an object value has sub-fields ${knownList(node.fields.map(f => f.name))} — "${segment}" is not one`;
+        }
+
+      case "rows":
+        return INDEX_SEGMENT.test(segment) ? {
+            kind: "object",
+            fields: node.of
+        } : `an array value is addressed by numeric row index first (e.g. "0.<subField>") — "${segment}" is not an index`;
+
+      case "list":
+        return INDEX_SEGMENT.test(segment) ? node.item : `an array value is addressed by numeric item index (e.g. "0") — "${segment}" is not an index`;
+
+      case "record":
+        return Object.hasOwn(node.keys, segment) ? node.keys[segment] : `the value carries ${knownList(Object.keys(node.keys))} — "${segment}" is not one of them`;
+
+      case "opaque":
+        return node;
+    }
+}
+
+function fieldValuePathIssue({target: target, path: path}) {
+    let node = valueNodeFor(target);
+    if (node === void 0) return `"${String(target.type)}" is not a known field kind`;
+    for (const segment of path.split(".")) {
+        const next = stepIntoValueNode(node, segment);
+        if (typeof next == "string") return `at segment "${segment}": ${next}`;
+        node = next;
+    }
+}
+
+function checkWorkflowInvariants(def) {
+    const issues = [], stageNames = checkStages(def, issues);
+    return checkInitialStage({
+        def: def,
+        stageNames: stageNames,
+        issues: issues
+    }), checkTransitionTargets({
+        def: def,
+        stageNames: stageNames,
+        issues: issues
+    }), checkStageReachability({
+        def: def,
+        stageNames: stageNames,
+        issues: issues
+    }), checkEffectNames(def, issues), checkGuardNames(def, issues), checkFieldEntryNames(def, issues), 
+    checkRequiredField(def, issues), checkPredicates(def, issues), checkUnboundCallerVars(def, issues), 
+    checkConditionFieldReads(def, issues), checkFieldReadSeeds(def, issues), checkFieldReadOpValues(def, issues), 
+    checkGuardFieldReads(def, issues), checkAssigneesEntries(def, issues), checkActivityKinds(def, issues), 
+    checkGroups(def, issues), issues;
+}
+
+exports.ACTIVITY_KINDS = ACTIVITY_KINDS;
+
+exports.ACTOR_KINDS = ACTOR_KINDS;
+
+exports.AuthoringActionSchema = AuthoringActionSchema;
+
+exports.AuthoringActivitySchema = AuthoringActivitySchema;
+
+exports.AuthoringFieldEntrySchema = AuthoringFieldEntrySchema;
+
+exports.AuthoringGuardSchema = AuthoringGuardSchema;
+
+exports.AuthoringOpSchema = AuthoringOpSchema;
+
+exports.AuthoringStageSchema = AuthoringStageSchema;
+
+exports.AuthoringTransitionSchema = AuthoringTransitionSchema;
+
+exports.AuthoringWorkflowSchema = AuthoringWorkflowSchema;
+
+exports.CALLER_BOUND_VARS = CALLER_BOUND_VARS;
+
+exports.CONDITION_VARS = CONDITION_VARS;
+
+exports.ContractViolationError = ContractViolationError;
+
+exports.DOCUMENT_VALUE_PERMISSIONS = DOCUMENT_VALUE_PERMISSIONS;
+
+exports.DRIVER_KINDS = DRIVER_KINDS;
+
+exports.DefinitionInUseError = DefinitionInUseError;
+
+exports.DefinitionNotFoundError = DefinitionNotFoundError;
+
+exports.EFFECTS_READ = EFFECTS_READ;
+
+exports.EffectNotFoundError = EffectNotFoundError;
+
+exports.EffectSchema = EffectSchema;
+
+exports.FIELD_READ = FIELD_READ;
+
+exports.FILTER_SCOPE_VARS = FILTER_SCOPE_VARS;
+
+exports.FieldValueShapeError = FieldValueShapeError;
+
+exports.GROUP_KINDS = GROUP_KINDS;
+
+exports.GUARD_PREDICATE_VARS = GUARD_PREDICATE_VARS;
+
+exports.GroupSchema = GroupSchema;
+
+exports.InstanceNotFoundError = InstanceNotFoundError;
+
+exports.RESERVED_CONDITION_VARS = RESERVED_CONDITION_VARS;
+
+exports.RESOURCE_ALIAS_NAME_SOURCE = RESOURCE_ALIAS_NAME_SOURCE;
+
+exports.StoredFieldOpSchema = StoredFieldOpSchema;
+
+exports.WORKFLOW_DEFINITION_TYPE = WORKFLOW_DEFINITION_TYPE;
+
+exports.WorkflowConfigSchema = WorkflowConfigSchema;
+
+exports.WorkflowError = WorkflowError;
+
+exports.actorFulfillsRole = actorFulfillsRole;
+
+exports.andConditions = andConditions;
+
+exports.checkFieldValue = checkFieldValue;
+
+exports.checkWorkflowInvariants = checkWorkflowInvariants;
+
+exports.clientConfigFromResource = clientConfigFromResource;
+
+exports.conditionEffectReads = conditionEffectReads;
+
+exports.conditionParameterNames = conditionParameterNames;
+
+exports.conditionSyntaxIssues = conditionSyntaxIssues;
+
+exports.datasetResourceParts = datasetResourceParts;
+
+exports.definitionDocId = definitionDocId;
+
+exports.errorMessage = errorMessage;
+
+exports.evaluateCondition = evaluateCondition;
+
+exports.evaluateConditionOutcome = evaluateConditionOutcome;
+
+exports.evaluatePredicates = evaluatePredicates;
+
+exports.expandRequiredRoles = expandRequiredRoles;
+
+exports.extractDocumentId = extractDocumentId;
+
+exports.formatIssuePath = formatIssuePath;
+
+exports.formatIssues = formatIssues;
+
+exports.formatValidationError = formatValidationError;
+
+exports.gdrFromResource = gdrFromResource;
+
+exports.gdrRef = gdrRef;
+
+exports.gdrResourcePrefix = gdrResourcePrefix;
+
+exports.gdrUri = gdrUri;
+
+exports.groupMembershipNames = groupMembershipNames;
+
+exports.isBareSeedId = isBareSeedId;
+
+exports.isGdr = isGdr;
+
+exports.isGdrUri = isGdrUri;
+
+exports.isGuardReadExpr = isGuardReadExpr;
+
+exports.isNotesEntry = isNotesEntry;
+
+exports.isStartableDefinition = isStartableDefinition;
+
+exports.isTerminalActivityStatus = isTerminalActivityStatus;
+
+exports.isTodoListEntry = isTodoListEntry;
+
+exports.isTodoListItem = isTodoListItem;
+
+exports.isUnevaluable = isUnevaluable;
+
+exports.labelFor = labelFor;
+
+exports.normalizeRoleAliases = normalizeRoleAliases;
+
+exports.parseGdr = parseGdr;
+
+exports.parseOrThrow = parseOrThrow;
+
+exports.parseResourceGdr = parseResourceGdr;
+
+exports.parseStoredDefinition = parseStoredDefinition;
+
+exports.printGuardRead = printGuardRead;
+
+exports.refCanvas = refCanvas;
+
+exports.refDashboard = refDashboard;
+
+exports.refDataset = refDataset;
+
+exports.refMediaLibrary = refMediaLibrary;
+
+exports.refTypeIssues = refTypeIssues;
+
+exports.rejectedRefTypes = rejectedRefTypes;
+
+exports.releaseDocId = releaseDocId;
+
+exports.releaseRef = releaseRef;
+
+exports.resourceAliasesToMap = resourceAliasesToMap;
+
+exports.resourceFromGdrUri = resourceFromGdrUri;
+
+exports.resourceFromParsed = resourceFromParsed;
+
+exports.resourceGdr = resourceGdr;
+
+exports.rethrowWithContext = rethrowWithContext;
+
+exports.runGroq = runGroq;
+
+exports.sameResource = sameResource;
+
+exports.selfGdr = selfGdr;
+
+exports.tagScopeFilter = tagScopeFilter;
+
+exports.toBareId = toBareId;
+
+exports.toPhysicalGdr = toPhysicalGdr;
+
+exports.tryParseGdr = tryParseGdr;
+
+exports.validateFieldAppendItem = validateFieldAppendItem;
+
+exports.validateFieldValue = validateFieldValue;
+
+exports.validateResourceAliasName = validateResourceAliasName;
+
+exports.validateTag = validateTag;