@sanity/workflow-engine 0.14.0 → 0.15.0

package/dist/define.js

@@ -1,965 +1,710 @@
-import * as v from "valibot";
-import { printGuardRead, andConditions, expandRequiredRoles, normalizeRoleAliases, RESERVED_CONDITION_VARS, GROQ_IDENTIFIER, CONDITION_VARS, formatValidationError, issuesFromValibot, AuthoringWorkflowSchema, WorkflowConfigSchema, AuthoringStageSchema, AuthoringActivitySchema, AuthoringActionSchema, AuthoringTransitionSchema, AuthoringFieldEntrySchema, AuthoringOpSchema, AuthoringGuardSchema, EffectSchema } from "./_chunks-es/schema.js";
-import { FILTER_SCOPE_VARS, GUARD_PREDICATE_VARS } from "./_chunks-es/schema.js";
+import { printGuardRead, andConditions, expandRequiredRoles, normalizeRoleAliases, parseOrThrow, checkWorkflowInvariants, formatValidationError, AuthoringWorkflowSchema, labelFor, WorkflowConfigSchema, AuthoringStageSchema, AuthoringActivitySchema, AuthoringActionSchema, AuthoringTransitionSchema, AuthoringFieldEntrySchema, AuthoringOpSchema, GroupSchema, AuthoringGuardSchema, EffectSchema } from "./_chunks-es/invariants.js";
+
+import { CONDITION_VARS, FILTER_SCOPE_VARS, GUARD_PREDICATE_VARS, RESERVED_CONDITION_VARS } from "./_chunks-es/invariants.js";
+
 function groq(strings, ...values) {
-  return strings.reduce((out, part, i) => i === 0 ? part : `${out}${serializeGroqValue(values[i - 1])}${part}`, "");
+    return strings.reduce((out, part, i) => i === 0 ? part : `${out}${serializeGroqValue(values[i - 1])}${part}`, "");
 }
+
 function serializeGroqValue(value) {
-  const serialized = JSON.stringify(value);
-  if (serialized === void 0)
-    throw new Error(
-      `groq tag cannot serialize ${typeof value} \u2014 interpolate JSON-representable values only`
-    );
-  return serialized;
+    const serialized = JSON.stringify(value);
+    if (serialized === void 0) throw new Error(`groq tag cannot serialize ${typeof value} — interpolate JSON-representable values only`);
+    return serialized;
 }
+
 function desugarWorkflow(authoring) {
-  const issues = [];
-  checkReservedRoleAliasKeys(authoring.roleAliases, issues);
-  const roleAliases = normalizeRoleAliases(authoring.roleAliases), ctx = {
-    issues,
-    claimFields: /* @__PURE__ */ new Map(),
-    claimedFields: /* @__PURE__ */ new Set(),
-    roleAliases
-  }, workflowFields = desugarFieldEntries({ entries: authoring.fields, path: ["fields"], ctx }), workflowLayer = layerOf(workflowFields), stages = authoring.stages.map((stage, i) => {
-    const path = ["stages", i], stageFields = desugarFieldEntries({ entries: stage.fields, path: [...path, "fields"], ctx }), stageEnv = {
-      layers: [
-        { scope: "stage", entries: layerOf(stageFields) },
-        { scope: "workflow", entries: workflowLayer }
-      ]
-    }, activities = (stage.activities ?? []).map(
-      (activity, j) => desugarActivity({ activity, path: [...path, "activities", j], stageEnv, ctx })
-    ), transitions = (stage.transitions ?? []).map(
-      (transition, k) => desugarTransition({ transition, path: [...path, "transitions", k], stageEnv, ctx })
-    ), editable = desugarStageEditable({
-      overrides: stage.editable,
-      inScope: editableFieldNames({ workflowFields, stageFields, activities }),
-      path: [...path, "editable"],
-      ctx
+    const issues = [];
+    checkReservedRoleAliasKeys(authoring.roleAliases, issues);
+    const roleAliases = normalizeRoleAliases(authoring.roleAliases), ctx = {
+        issues: issues,
+        claimFields: /* @__PURE__ */ new Map,
+        claimedFields: /* @__PURE__ */ new Set,
+        roleAliases: roleAliases
+    }, workflowFields = desugarFieldEntries({
+        entries: authoring.fields,
+        path: [ "fields" ],
+        ctx: ctx
+    }), workflowLayer = layerOf(workflowFields), stages = authoring.stages.map((stage, i) => {
+        const path = [ "stages", i ], stageFields = desugarFieldEntries({
+            entries: stage.fields,
+            path: [ ...path, "fields" ],
+            ctx: ctx
+        }), stageEnv = {
+            layers: [ {
+                scope: "stage",
+                entries: layerOf(stageFields)
+            }, {
+                scope: "workflow",
+                entries: workflowLayer
+            } ]
+        }, activities = (stage.activities ?? []).map((activity, j) => desugarActivity({
+            activity: activity,
+            path: [ ...path, "activities", j ],
+            stageEnv: stageEnv,
+            ctx: ctx
+        })), transitions = (stage.transitions ?? []).map((transition, k) => desugarTransition({
+            transition: transition,
+            path: [ ...path, "transitions", k ],
+            stageEnv: stageEnv,
+            ctx: ctx
+        })), editable = desugarStageEditable({
+            overrides: stage.editable,
+            inScope: editableFieldNames({
+                workflowFields: workflowFields,
+                stageFields: stageFields,
+                activities: activities
+            }),
+            path: [ ...path, "editable" ],
+            ctx: ctx
+        });
+        return {
+            ...stripUndefined({
+                name: stage.name,
+                title: stage.title,
+                description: stage.description,
+                groups: stage.groups,
+                guards: stage.guards?.map(desugarGuard)
+            }),
+            ...stageFields ? {
+                fields: stageFields
+            } : {},
+            ...activities.length > 0 ? {
+                activities: activities
+            } : {},
+            ...transitions.length > 0 ? {
+                transitions: transitions
+            } : {},
+            ...editable ? {
+                editable: editable
+            } : {}
+        };
     });
-    return {
-      ...stripUndefined({
-        name: stage.name,
-        title: stage.title,
-        description: stage.description,
-        guards: stage.guards?.map(desugarGuard)
-      }),
-      ...stageFields ? { fields: stageFields } : {},
-      ...activities.length > 0 ? { activities } : {},
-      ...transitions.length > 0 ? { transitions } : {},
-      ...editable ? { editable } : {}
+    return checkUnclaimedClaimFields(ctx), {
+        definition: {
+            ...stripUndefined({
+                name: authoring.name,
+                title: authoring.title,
+                description: authoring.description,
+                groups: authoring.groups,
+                lifecycle: authoring.lifecycle,
+                applicableWhen: authoring.applicableWhen,
+                initialStage: authoring.initialStage,
+                predicates: authoring.predicates,
+                roleAliases: roleAliases
+            }),
+            ...workflowFields ? {
+                fields: workflowFields
+            } : {},
+            stages: stages
+        },
+        issues: ctx.issues
     };
-  });
-  return checkUnclaimedClaimFields(ctx), { definition: {
-    ...stripUndefined({
-      name: authoring.name,
-      title: authoring.title,
-      description: authoring.description,
-      lifecycle: authoring.lifecycle,
-      initialStage: authoring.initialStage,
-      predicates: authoring.predicates,
-      roleAliases
-    }),
-    ...workflowFields ? { fields: workflowFields } : {},
-    stages
-  }, issues: ctx.issues };
 }
+
 function checkReservedRoleAliasKeys(aliases, issues) {
-  for (const key of Object.keys(aliases ?? {}))
-    key.startsWith("$") && issues.push({
-      path: ["roleAliases", key],
-      message: `role alias key "${key}" uses the reserved "$" prefix \u2014 that namespace is the engine's stored spelling for the universal fulfiller. Use "*" to mean "fulfills any gate", or rename the role.`
+    for (const key of Object.keys(aliases ?? {})) key.startsWith("$") && issues.push({
+        path: [ "roleAliases", key ],
+        message: `role alias key "${key}" uses the reserved "$" prefix — that namespace is the engine's stored spelling for the universal fulfiller. Use "*" to mean "fulfills any gate", or rename the role.`
     });
 }
-const TODOLIST_OF = [
-  { type: "string", name: "label", title: "Label" },
-  { type: "string", name: "status", title: "Status" },
-  { type: "assignee", name: "assignee", title: "Assignee" },
-  { type: "date", name: "dueDate", title: "Due date" }
-], NOTES_OF = [
-  { type: "text", name: "body", title: "Body" },
-  { type: "actor", name: "actor", title: "Actor" },
-  { type: "datetime", name: "at", title: "At" }
-];
-function desugarFieldEntries({
-  entries,
-  path,
-  ctx
-}) {
-  return !entries || entries.length === 0 ? entries === void 0 ? void 0 : [] : entries.map((entry, i) => desugarFieldEntry({ entry, path: [...path, i], ctx }));
-}
-function desugarFieldEntry({
-  entry,
-  path,
-  ctx
-}) {
-  if (entry.type === "claim") return desugarClaimField({ entry, path, ctx });
-  if (entry.type === "todoList" || entry.type === "notes")
-    return desugarListField({ entry, path, ctx });
-  const editable = normalizeEditable({ editable: entry.editable, path: [...path, "editable"], ctx });
-  return {
-    ...stripUndefined({
-      type: entry.type,
-      name: entry.name,
-      title: entry.title,
-      description: entry.description,
-      required: entry.required,
-      initialValue: entry.initialValue,
-      editable,
-      fields: entry.fields,
-      of: entry.of
-    })
-  };
-}
-function desugarClaimField({
-  entry,
-  path,
-  ctx
-}) {
-  const desugared = {
-    ...stripUndefined({ name: entry.name, title: entry.title, description: entry.description }),
-    type: "actor"
-  };
-  return ctx.claimFields.set(desugared, { name: entry.name, path }), desugared;
-}
-function desugarListField({
-  entry,
-  path,
-  ctx
-}) {
-  const editable = normalizeEditable({ editable: entry.editable, path: [...path, "editable"], ctx });
-  return {
-    ...stripUndefined({
-      name: entry.name,
-      title: entry.title,
-      description: entry.description,
-      required: entry.required,
-      initialValue: entry.initialValue,
-      editable
-    }),
-    type: "array",
-    of: entry.type === "todoList" ? TODOLIST_OF : NOTES_OF
-  };
-}
-function normalizeEditable({
-  editable,
-  path,
-  ctx
-}) {
-  if (editable === void 0 || editable === !0) return editable;
-  if (Array.isArray(editable)) {
-    const condition = rolesCondition(editable, ctx.roleAliases);
-    if (condition === void 0) {
-      ctx.issues.push({
-        path,
-        message: "editable: [] names no roles \u2014 use `true` to open the field to anyone in its scope, or list at least one role"
-      });
-      return;
-    }
-    return condition;
-  }
-  return editable;
-}
-function editableFieldNames({
-  workflowFields,
-  stageFields,
-  activities
-}) {
-  const names = /* @__PURE__ */ new Set(), collect = (entries) => {
-    for (const entry of entries ?? []) entry.editable !== void 0 && names.add(entry.name);
-  };
-  collect(workflowFields), collect(stageFields);
-  for (const activity of activities) collect(activity.fields);
-  return names;
-}
-function desugarStageEditable({
-  overrides,
-  inScope,
-  path,
-  ctx
-}) {
-  if (overrides === void 0) return;
-  const out = {};
-  for (const [name, value] of Object.entries(overrides)) {
-    if (!inScope.has(name)) {
-      ctx.issues.push({
-        path: [...path, name],
-        message: `stage editable override "${name}" does not narrow an editable field in scope \u2014 name a workflow/stage/activity field of this stage that declares \`editable\``
-      });
-      continue;
-    }
-    const normalized = normalizeEditable({ editable: value, path: [...path, name], ctx });
-    normalized !== void 0 && (out[name] = normalized);
-  }
-  return Object.keys(out).length > 0 ? out : void 0;
-}
-function layerOf(entries) {
-  return new Map((entries ?? []).map((entry) => [entry.name, entry]));
-}
-function desugarActivity({
-  activity,
-  path,
-  stageEnv,
-  ctx
-}) {
-  const activityFields = desugarFieldEntries({
-    entries: activity.fields,
-    path: [...path, "fields"],
-    ctx
-  }), env = {
-    layers: [{ scope: "activity", entries: layerOf(activityFields) }, ...stageEnv.layers]
-  }, ops = desugarOps({
-    ops: activity.ops,
-    path: [...path, "ops"],
-    env,
-    firingActivity: activity.name,
-    ctx
-  }), actions = (activity.actions ?? []).map(
-    (action, a) => desugarAction({ action, path: [...path, "actions", a], env, activityName: activity.name, ctx })
-  ), target = desugarTarget({ target: activity.target, env, path: [...path, "target"], ctx });
-  return {
-    ...stripUndefined({
-      name: activity.name,
-      title: activity.title,
-      description: activity.description,
-      kind: activity.kind,
-      filter: activity.filter,
-      requirements: activity.requirements,
-      completeWhen: activity.completeWhen,
-      failWhen: activity.failWhen,
-      effects: activity.effects,
-      subworkflows: activity.subworkflows
-    }),
-    activation: activity.activation ?? "manual",
-    ...target ? { target } : {},
-    ...activityFields ? { fields: activityFields } : {},
-    ...ops ? { ops } : {},
-    ...actions.length > 0 ? { actions } : {}
-  };
-}
-const TARGET_DOC_KINDS = ["doc.ref", "doc.refs", "release.ref"];
-function desugarTarget({
-  target,
-  env,
-  path,
-  ctx
-}) {
-  if (target === void 0 || target.type === "url") return target;
-  const ref = typeof target.field == "string" ? { field: target.field } : target.field, field = resolveRef({ ref, env, path: [...path, "field"], ctx }) ?? fallbackRef(ref), entry = entryAt(env, field);
-  return entry && !TARGET_DOC_KINDS.includes(entry.type) && ctx.issues.push({
-    path: [...path, "field"],
-    message: `manual activity target references "${field.field}" of kind "${entry.type}" \u2014 a deep-link target needs a document-valued entry (${TARGET_DOC_KINDS.join(", ")})`
-  }), { type: "field", field };
-}
-function desugarAction({
-  action,
-  path,
-  env,
-  activityName,
-  ctx
-}) {
-  if ("type" in action)
-    return desugarClaimAction({ action, path, env, ctx });
-  const filter = andConditions([rolesCondition(action.roles, ctx.roleAliases), action.filter]), ops = desugarOps({ ops: action.ops, path: [...path, "ops"], env, firingActivity: activityName, ctx }) ?? [];
-  return action.status !== void 0 && ops.push({ type: "status.set", activity: activityName, status: action.status }), {
-    ...stripUndefined({
-      name: action.name,
-      title: action.title,
-      description: action.description,
-      params: action.params,
-      effects: action.effects
-    }),
-    ...filter ? { filter } : {},
-    ...ops.length > 0 ? { ops } : {}
-  };
-}
-function desugarClaimAction({
-  action,
-  path,
-  env,
-  ctx
-}) {
-  const ref = typeof action.field == "string" ? { field: action.field } : action.field, resolved = resolveRef({ ref, env, path: [...path, "field"], ctx });
-  if (resolved) {
-    const entry = entryAt(env, resolved);
-    entry && entry.type !== "actor" && ctx.issues.push({
-      path: [...path, "field"],
-      message: `claim action "${action.name}" references "${resolved.field}" of kind "${entry.type}" \u2014 a claim pair needs an actor-valued entry (a "claim" or "actor" field declaration)`
-    }), checkShadowedClaimTarget({
-      actionName: action.name,
-      field: ref.field,
-      resolved,
-      env,
-      path: [...path, "field"],
-      ctx
-    }), entry && ctx.claimedFields.add(entry);
-  }
-  const noSteal = `!defined($fields.${ref.field})`, filter = andConditions([
-    noSteal,
-    rolesCondition(action.roles, ctx.roleAliases),
-    action.filter
-  ]), ops = resolved ? [{ type: "field.set", target: resolved, value: { type: "actor" } }] : [];
-  return {
-    ...stripUndefined({
-      name: action.name,
-      title: action.title,
-      description: action.description,
-      params: action.params,
-      effects: action.effects
-    }),
-    filter,
-    ...ops.length > 0 ? { ops } : {}
-  };
-}
-function checkShadowedClaimTarget({
-  actionName,
-  field,
-  resolved,
-  env,
-  path,
-  ctx
-}) {
-  const nearest = env.layers.find((l) => l.entries.has(field));
-  nearest === void 0 || nearest.scope === resolved.scope || ctx.issues.push({
-    path,
-    message: `claim action "${actionName}" targets "${field}" at scope "${resolved.scope}", but a nearer ${nearest.scope}-scope entry of the same name shadows it in $fields \u2014 the no-steal filter would read the shadowing entry while the claim writes the "${resolved.scope}" one. Rename one of the entries or claim the nearer one`
-  });
-}
-function checkUnclaimedClaimFields(ctx) {
-  for (const [entry, { name, path }] of ctx.claimFields)
-    ctx.claimedFields.has(entry) || ctx.issues.push({
-      path,
-      message: `claim field "${name}" is never referenced by a claim action \u2014 you announced the pattern and wrote half of it. Declare a defineAction({ type: "claim", field: "${name}" }) or use a raw actor entry`
+
+const TODOLIST_OF = [ {
+    type: "string",
+    name: "label",
+    title: "Label"
+}, {
+    type: "string",
+    name: "status",
+    title: "Status"
+}, {
+    type: "assignee",
+    name: "assignee",
+    title: "Assignee"
+}, {
+    type: "date",
+    name: "dueDate",
+    title: "Due date"
+} ], NOTES_OF = [ {
+    type: "text",
+    name: "body",
+    title: "Body"
+}, {
+    type: "actor",
+    name: "actor",
+    title: "Actor"
+}, {
+    type: "datetime",
+    name: "at",
+    title: "At"
+} ];
+
+function desugarFieldEntries({entries: entries, path: path, ctx: ctx}) {
+    return !entries || entries.length === 0 ? entries === void 0 ? void 0 : [] : entries.map((entry, i) => desugarFieldEntry({
+        entry: entry,
+        path: [ ...path, i ],
+        ctx: ctx
+    }));
+}
+
+function desugarFieldEntry({entry: entry, path: path, ctx: ctx}) {
+    if (entry.type === "claim") return desugarClaimField({
+        entry: entry,
+        path: path,
+        ctx: ctx
+    });
+    if (entry.type === "todoList" || entry.type === "notes") return desugarListField({
+        entry: entry,
+        path: path,
+        ctx: ctx
     });
+    const editable = normalizeEditable({
+        editable: entry.editable,
+        path: [ ...path, "editable" ],
+        ctx: ctx
+    });
+    return {
+        ...stripUndefined({
+            type: entry.type,
+            name: entry.name,
+            title: entry.title,
+            description: entry.description,
+            group: normalizeGroup(entry.group),
+            required: entry.required,
+            initialValue: entry.initialValue,
+            editable: editable,
+            types: entry.types,
+            fields: entry.fields,
+            of: entry.of
+        })
+    };
 }
-function desugarTransition({
-  transition,
-  path,
-  stageEnv,
-  ctx
-}) {
-  const ops = desugarOps({
-    ops: transition.ops,
-    path: [...path, "ops"],
-    env: stageEnv,
-    firingActivity: void 0,
-    ctx
-  });
-  return {
-    ...stripUndefined({
-      name: transition.name,
-      title: transition.title,
-      description: transition.description,
-      to: transition.to,
-      effects: transition.effects
-    }),
-    filter: transition.filter ?? "$allActivitiesDone",
-    ...ops ? { ops } : {}
-  };
+
+function desugarClaimField({entry: entry, path: path, ctx: ctx}) {
+    const desugared = {
+        ...stripUndefined({
+            name: entry.name,
+            title: entry.title,
+            description: entry.description,
+            group: normalizeGroup(entry.group)
+        }),
+        type: "actor"
+    };
+    return ctx.claimFields.set(desugared, {
+        name: entry.name,
+        path: path
+    }), desugared;
+}
+
+function desugarListField({entry: entry, path: path, ctx: ctx}) {
+    const editable = normalizeEditable({
+        editable: entry.editable,
+        path: [ ...path, "editable" ],
+        ctx: ctx
+    });
+    return {
+        ...stripUndefined({
+            name: entry.name,
+            title: entry.title,
+            description: entry.description,
+            group: normalizeGroup(entry.group),
+            required: entry.required,
+            initialValue: entry.initialValue,
+            editable: editable
+        }),
+        type: "array",
+        of: entry.type === "todoList" ? TODOLIST_OF : NOTES_OF
+    };
 }
-function desugarGuard(guard) {
-  const { match, metadata, ...rest } = guard, { idRefs, ...matchRest } = match;
-  return {
-    ...rest,
-    match: {
-      ...matchRest,
-      ...idRefs !== void 0 ? { idRefs: idRefs.map(printGuardRead) } : {}
-    },
-    ...metadata !== void 0 ? {
-      metadata: Object.fromEntries(
-        Object.entries(metadata).map(([key, read]) => [key, printGuardRead(read)])
-      )
-    } : {}
-  };
-}
-function desugarOps({
-  ops,
-  path,
-  env,
-  firingActivity,
-  ctx
-}) {
-  if (ops)
-    return ops.map((op, i) => desugarOp({ op, path: [...path, i], env, firingActivity, ctx }));
-}
-function desugarOp({
-  op,
-  path,
-  env,
-  firingActivity,
-  ctx
-}) {
-  if (op.type === "status.set") {
-    const activity = op.activity ?? firingActivity;
-    return activity === void 0 && ctx.issues.push({
-      path: [...path, "activity"],
-      message: "status.set outside an action must name its target activity"
-    }), { type: "status.set", activity: activity ?? "", status: op.status };
-  }
-  if (op.type === "audit") return desugarAuditOp({ op, path, env, ctx });
-  const target = resolveRef({ ref: op.target, env, path: [...path, "target"], ctx }) ?? fallbackRef(op.target);
-  return { ...op, target };
-}
-const AUDIT_STAMPS = { actor: { type: "actor" }, at: { type: "now" } };
-function desugarAuditOp({
-  op,
-  path,
-  env,
-  ctx
-}) {
-  const target = resolveRef({ ref: op.target, env, path: [...path, "target"], ctx }) ?? fallbackRef(op.target);
-  if (op.value.type !== "object")
-    return ctx.issues.push({
-      path: [...path, "value"],
-      message: `audit value must be an object source carrying the domain fields (got "${op.value.type}")`
-    }), { type: "field.append", target, value: op.value };
-  const actorField = op.stampFields?.actor ?? "actor", atField = op.stampFields?.at ?? "at", fields = { ...op.value.fields };
-  for (const [stamp, source] of [
-    [actorField, AUDIT_STAMPS.actor],
-    [atField, AUDIT_STAMPS.at]
-  ]) {
-    if (stamp in fields) {
-      ctx.issues.push({
-        path: [...path, "value", "fields", stamp],
-        message: `audit stamp field "${stamp}" collides with an authored domain field \u2014 rename yours or remap the stamp via stampFields`
-      });
-      continue;
+
+function normalizeEditable({editable: editable, path: path, ctx: ctx}) {
+    if (editable === void 0 || editable === !0) return editable;
+    if (Array.isArray(editable)) {
+        const condition = rolesCondition(editable, ctx.roleAliases);
+        if (condition === void 0) {
+            ctx.issues.push({
+                path: path,
+                message: "editable: [] names no roles — use `true` to open the field to anyone in its scope, or list at least one role"
+            });
+            return;
+        }
+        return condition;
     }
-    fields[stamp] = source;
-  }
-  return { type: "field.append", target, value: { type: "object", fields } };
-}
-function resolveRef({
-  ref,
-  env,
-  path,
-  ctx
-}) {
-  const layers = ref.scope === void 0 ? env.layers : env.layers.filter((l) => l.scope === ref.scope);
-  for (const layer of layers)
-    if (layer.entries.has(ref.field)) return { scope: layer.scope, field: ref.field };
-  const reachable = env.layers.flatMap((l) => [...l.entries.keys()].map((n) => `${l.scope}:${n}`));
-  ctx.issues.push({
-    path,
-    message: `field reference "${ref.field}"${ref.scope ? ` (scope "${ref.scope}")` : ""} does not resolve to a declared entry. Reachable: ${reachable.join(", ") || "(none)"}`
-  });
+    return editable;
 }
-function entryAt(env, ref) {
-  return env.layers.find((l) => l.scope === ref.scope)?.entries.get(ref.field);
+
+function editableFieldNames({workflowFields: workflowFields, stageFields: stageFields, activities: activities}) {
+    const names = /* @__PURE__ */ new Set, collect = entries => {
+        for (const entry of entries ?? []) entry.editable !== void 0 && names.add(entry.name);
+    };
+    collect(workflowFields), collect(stageFields);
+    for (const activity of activities) collect(activity.fields);
+    return names;
+}
+
+function desugarStageEditable({overrides: overrides, inScope: inScope, path: path, ctx: ctx}) {
+    if (overrides === void 0) return;
+    const out = {};
+    for (const [name, value] of Object.entries(overrides)) {
+        if (!inScope.has(name)) {
+            ctx.issues.push({
+                path: [ ...path, name ],
+                message: `stage editable override "${name}" does not narrow an editable field in scope — name a workflow/stage/activity field of this stage that declares \`editable\``
+            });
+            continue;
+        }
+        const normalized = normalizeEditable({
+            editable: value,
+            path: [ ...path, name ],
+            ctx: ctx
+        });
+        normalized !== void 0 && (out[name] = normalized);
+    }
+    return Object.keys(out).length > 0 ? out : void 0;
 }
-function fallbackRef(ref) {
-  return { scope: ref.scope ?? "workflow", field: ref.field };
+
+function layerOf(entries) {
+    return new Map((entries ?? []).map(entry => [ entry.name, entry ]));
 }
-function rolesCondition(roles, aliases) {
-  if (!(!roles || roles.length === 0))
-    return groq`count($actor.roles[@ in ${expandRequiredRoles(roles, aliases)}]) > 0`;
+
+function normalizeGroup(group) {
+    return group === void 0 || Array.isArray(group) ? group : [ group ];
 }
-function stripUndefined(obj) {
-  const out = {};
-  for (const [k, value] of Object.entries(obj))
-    value !== void 0 && (out[k] = value);
-  return out;
-}
-const PREDICATE_CALLER_VARS = CONDITION_VARS.filter((v2) => v2.binding === "caller").map(
-  (v2) => v2.name
-);
-function knownList(ids) {
-  return [...ids].map((s) => `"${s}"`).join(", ");
-}
-function checkDuplicates({
-  names,
-  what,
-  issues
-}) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const { name, path } of names)
-    seen.has(name) && issues.push({ path, message: `duplicate ${what} "${name}" (already declared earlier)` }), seen.add(name);
-  return seen;
-}
-function checkStages(def, issues) {
-  const stageNames = checkDuplicates({
-    names: def.stages.map((stage, i) => ({ name: stage.name, path: ["stages", i, "name"] })),
-    what: "stage name",
-    issues
-  });
-  for (const [i, stage] of def.stages.entries()) {
-    const activityNames = checkDuplicates({
-      names: (stage.activities ?? []).map((activity, j) => ({
-        name: activity.name,
-        path: ["stages", i, "activities", j, "name"]
-      })),
-      what: `activity name in stage "${stage.name}"`,
-      issues
-    });
-    checkDuplicates({
-      names: (stage.transitions ?? []).map((t, k) => ({
-        name: t.name,
-        path: ["stages", i, "transitions", k, "name"]
-      })),
-      what: `transition name in stage "${stage.name}"`,
-      issues
-    }), checkActivities({ def, i, activityNames, issues });
-  }
-  return stageNames;
-}
-function checkActivities({
-  def,
-  i,
-  activityNames,
-  issues
-}) {
-  const stage = def.stages[i];
-  for (const [j, activity] of (stage.activities ?? []).entries()) {
-    const path = ["stages", i, "activities", j];
-    checkDuplicates({
-      names: (activity.actions ?? []).map((action, a) => ({
-        name: action.name,
-        path: [...path, "actions", a, "name"]
-      })),
-      what: `action name in activity "${activity.name}"`,
-      issues
-    }), checkStatusSetTargets({ activity, activityNames, path, issues });
-  }
-}
-function checkStatusSetTargets({
-  activity,
-  activityNames,
-  path,
-  issues
-}) {
-  checkStatusSetOps({ ops: activity.ops, activityNames, path: [...path, "ops"], issues });
-  for (const [a, action] of (activity.actions ?? []).entries())
-    checkStatusSetOps({
-      ops: action.ops,
-      activityNames,
-      path: [...path, "actions", a, "ops"],
-      issues
+
+function desugarActivity({activity: activity, path: path, stageEnv: stageEnv, ctx: ctx}) {
+    const activityFields = desugarFieldEntries({
+        entries: activity.fields,
+        path: [ ...path, "fields" ],
+        ctx: ctx
+    }), env = {
+        layers: [ {
+            scope: "activity",
+            entries: layerOf(activityFields)
+        }, ...stageEnv.layers ]
+    }, ops = desugarOps({
+        ops: activity.ops,
+        path: [ ...path, "ops" ],
+        env: env,
+        firingActivity: activity.name,
+        ctx: ctx
+    }), actions = (activity.actions ?? []).map((action, a) => desugarAction({
+        action: action,
+        path: [ ...path, "actions", a ],
+        env: env,
+        activityName: activity.name,
+        ctx: ctx
+    })), target = desugarTarget({
+        target: activity.target,
+        env: env,
+        path: [ ...path, "target" ],
+        ctx: ctx
     });
+    return {
+        ...stripUndefined({
+            name: activity.name,
+            title: activity.title,
+            description: activity.description,
+            groups: activity.groups,
+            group: normalizeGroup(activity.group),
+            kind: activity.kind,
+            filter: activity.filter,
+            requirements: activity.requirements,
+            completeWhen: activity.completeWhen,
+            failWhen: activity.failWhen,
+            effects: activity.effects,
+            subworkflows: activity.subworkflows
+        }),
+        activation: activity.activation ?? "manual",
+        ...target ? {
+            target: target
+        } : {},
+        ...activityFields ? {
+            fields: activityFields
+        } : {},
+        ...ops ? {
+            ops: ops
+        } : {},
+        ...actions.length > 0 ? {
+            actions: actions
+        } : {}
+    };
+}
+
+const TARGET_DOC_KINDS = [ "doc.ref", "doc.refs", "release.ref" ];
+
+function desugarTarget({target: target, env: env, path: path, ctx: ctx}) {
+    if (target === void 0 || target.type === "url") return target;
+    const ref = typeof target.field == "string" ? {
+        field: target.field
+    } : target.field, field = resolveRef({
+        ref: ref,
+        env: env,
+        path: [ ...path, "field" ],
+        ctx: ctx
+    }) ?? fallbackRef(ref), entry = entryAt(env, field);
+    return entry && !TARGET_DOC_KINDS.includes(entry.type) && ctx.issues.push({
+        path: [ ...path, "field" ],
+        message: `manual activity target references "${field.field}" of kind "${entry.type}" — a deep-link target needs a document-valued entry (${TARGET_DOC_KINDS.join(", ")})`
+    }), {
+        type: "field",
+        field: field
+    };
 }
-function checkStatusSetOps({
-  ops,
-  activityNames,
-  path,
-  issues
-}) {
-  for (const [o, op] of (ops ?? []).entries())
-    op.type !== "status.set" || activityNames.has(op.activity) || issues.push({
-      path: [...path, o, "activity"],
-      message: `status.set targets activity "${op.activity}" which is not declared in this stage. Known activities: ${knownList(activityNames)}`
+
+function desugarAction({action: action, path: path, env: env, activityName: activityName, ctx: ctx}) {
+    if ("type" in action) return desugarClaimAction({
+        action: action,
+        path: path,
+        env: env,
+        ctx: ctx
     });
+    const filter = andConditions([ rolesCondition(action.roles, ctx.roleAliases), action.filter ]), ops = desugarOps({
+        ops: action.ops,
+        path: [ ...path, "ops" ],
+        env: env,
+        firingActivity: activityName,
+        ctx: ctx
+    }) ?? [];
+    return action.status !== void 0 && ops.push({
+        type: "status.set",
+        activity: activityName,
+        status: action.status
+    }), {
+        ...stripUndefined({
+            name: action.name,
+            title: action.title,
+            description: action.description,
+            group: normalizeGroup(action.group),
+            params: action.params,
+            effects: action.effects
+        }),
+        ...filter ? {
+            filter: filter
+        } : {},
+        ...ops.length > 0 ? {
+            ops: ops
+        } : {}
+    };
 }
-function checkInitialStage({
-  def,
-  stageNames,
-  issues
-}) {
-  stageNames.has(def.initialStage) || issues.push({
-    path: ["initialStage"],
-    message: `initialStage "${def.initialStage}" is not a declared stage. Known stages: ${knownList(stageNames)}`
-  });
-}
-function checkTransitionTargets({
-  def,
-  stageNames,
-  issues
-}) {
-  for (const [i, stage] of def.stages.entries())
-    for (const [k, t] of (stage.transitions ?? []).entries())
-      stageNames.has(t.to) || issues.push({
-        path: ["stages", i, "transitions", k, "to"],
-        message: `transition target "${t.to}" is not a declared stage. Known stages: ${knownList(stageNames)}`
-      });
-}
-function checkEffectNames(def, issues) {
-  const sites = [];
-  for (const [i, stage] of def.stages.entries()) {
-    for (const [j, activity] of (stage.activities ?? []).entries()) {
-      collectEffects({
-        effects: activity.effects,
-        path: ["stages", i, "activities", j, "effects"],
-        sites
-      });
-      for (const [a, action] of (activity.actions ?? []).entries())
-        collectEffects({
-          effects: action.effects,
-          path: ["stages", i, "activities", j, "actions", a, "effects"],
-          sites
-        });
-    }
-    for (const [k, t] of (stage.transitions ?? []).entries())
-      collectEffects({ effects: t.effects, path: ["stages", i, "transitions", k, "effects"], sites });
-  }
-  checkDuplicates({
-    names: sites,
-    what: "effect name (registry key \u2014 unique per definition)",
-    issues
-  });
-}
-function collectEffects({
-  effects,
-  path,
-  sites
-}) {
-  for (const [e, effect] of (effects ?? []).entries())
-    sites.push({ name: effect.name, path: [...path, e, "name"] });
-}
-function checkGuardNames(def, issues) {
-  const sites = def.stages.flatMap(
-    (stage, i) => (stage.guards ?? []).map((guard, g) => ({
-      name: guard.name,
-      path: ["stages", i, "guards", g, "name"]
-    }))
-  );
-  checkDuplicates({
-    names: sites,
-    what: "guard name (the guard lake _id derives from it \u2014 unique per definition)",
-    issues
-  });
-}
-function fieldScopes(def) {
-  const scopes = [
-    { entries: def.fields, scope: "workflow", path: ["fields"], label: "workflow fields" }
-  ];
-  for (const [i, stage] of def.stages.entries()) {
-    scopes.push({
-      entries: stage.fields,
-      scope: "stage",
-      path: ["stages", i, "fields"],
-      label: `stage "${stage.name}" fields`
+
+function desugarClaimAction({action: action, path: path, env: env, ctx: ctx}) {
+    const ref = typeof action.field == "string" ? {
+        field: action.field
+    } : action.field, resolved = resolveRef({
+        ref: ref,
+        env: env,
+        path: [ ...path, "field" ],
+        ctx: ctx
     });
-    for (const [j, activity] of (stage.activities ?? []).entries())
-      scopes.push({
-        entries: activity.fields,
-        scope: "activity",
-        path: ["stages", i, "activities", j, "fields"],
-        label: `activity "${activity.name}" fields`
-      });
-  }
-  return scopes;
-}
-function checkRequiredField(def, issues) {
-  for (const { entries, scope, path, label } of fieldScopes(def))
-    for (const [n, entry] of (entries ?? []).entries())
-      if (entry.required === !0) {
-        if (scope !== "workflow")
-          issues.push({
-            path: [...path, n, "required"],
-            message: `${label} entry "${entry.name}" is \`required\`, but \`required\` applies only to workflow-scope \`input\` entries \u2014 only those are caller-supplied at start/spawn`
-          });
-        else if (entry.initialValue?.type !== "input") {
-          const seed = entry.initialValue?.type ?? "working memory (no initialValue)";
-          issues.push({
-            path: [...path, n, "required"],
-            message: `field entry "${entry.name}" has initialValue "${seed}" \u2014 \`required\` applies only to \`input\`-sourced entries (the caller fills them at start/spawn)`
-          });
+    if (resolved) {
+        const entry = entryAt(env, resolved);
+        entry && entry.type !== "actor" && ctx.issues.push({
+            path: [ ...path, "field" ],
+            message: `claim action "${action.name}" references "${resolved.field}" of kind "${entry.type}" — a claim pair needs an actor-valued entry (a "claim" or "actor" field declaration)`
+        }), checkShadowedClaimTarget({
+            actionName: action.name,
+            field: ref.field,
+            resolved: resolved,
+            env: env,
+            path: [ ...path, "field" ],
+            ctx: ctx
+        }), entry && ctx.claimedFields.add(entry);
+    }
+    const noSteal = `!defined($fields.${ref.field})`, filter = andConditions([ noSteal, rolesCondition(action.roles, ctx.roleAliases), action.filter ]), ops = resolved ? [ {
+        type: "field.set",
+        target: resolved,
+        value: {
+            type: "actor"
         }
-      }
-}
-function checkFieldEntryNames(def, issues) {
-  for (const { entries, path, label } of fieldScopes(def))
-    checkDuplicates({
-      names: (entries ?? []).map((entry, n) => ({ name: entry.name, path: [...path, n, "name"] })),
-      what: `field entry name in ${label}`,
-      issues
-    });
+    } ] : [];
+    return {
+        ...stripUndefined({
+            name: action.name,
+            title: action.title,
+            description: action.description,
+            group: normalizeGroup(action.group),
+            params: action.params,
+            effects: action.effects
+        }),
+        filter: filter,
+        ...ops.length > 0 ? {
+            ops: ops
+        } : {}
+    };
 }
-function checkPredicates(def, issues) {
-  const reserved = new Set(RESERVED_CONDITION_VARS), names = Object.keys(def.predicates ?? {});
-  for (const name of names)
-    reserved.has(name) && issues.push({
-      path: ["predicates", name],
-      message: `predicate "${name}" shadows the built-in $${name} \u2014 pick another name`
-    });
-  for (const [name, groq2] of Object.entries(def.predicates ?? {}))
-    checkPredicateBody({ name, groq: groq2, names, issues });
-}
-function checkPredicateBody({
-  name,
-  groq: groq2,
-  names,
-  issues
-}) {
-  for (const caller of PREDICATE_CALLER_VARS)
-    referencesVar(groq2, caller) && issues.push({
-      path: ["predicates", name],
-      message: `predicate "${name}" reads $${caller} \u2014 predicates are instance-level (pre-evaluated once, without a caller); compose caller gates at the condition site instead`
+
+function checkShadowedClaimTarget({actionName: actionName, field: field, resolved: resolved, env: env, path: path, ctx: ctx}) {
+    const nearest = env.layers.find(l => l.entries.has(field));
+    nearest === void 0 || nearest.scope === resolved.scope || ctx.issues.push({
+        path: path,
+        message: `claim action "${actionName}" targets "${field}" at scope "${resolved.scope}", but a nearer ${nearest.scope}-scope entry of the same name shadows it in $fields — the no-steal filter would read the shadowing entry while the claim writes the "${resolved.scope}" one. Rename one of the entries or claim the nearer one`
     });
-  for (const other of names)
-    other === name || !referencesVar(groq2, other) || issues.push({
-      path: ["predicates", name],
-      message: `predicate "${name}" references predicate $${other} \u2014 predicates may read built-in vars only (no cross-references; compose at the condition site instead)`
-    });
-}
-function referencesVar(groq2, name) {
-  return GROQ_IDENTIFIER.test(name) ? new RegExp(`\\$${name}\\b`).test(groq2) : !1;
 }
-function checkCanOutsideActionFilters(def, issues) {
-  for (const site of nonActionFilterConditionSites(def))
-    referencesVar(site.groq, "can") && issues.push({
-      path: site.path,
-      message: `${site.label} reads $can \u2014 $can (the caller's grants) is bound only when an action fires, so it may appear in action filters only`
+
+function checkUnclaimedClaimFields(ctx) {
+    for (const [entry, {name: name, path: path}] of ctx.claimFields) ctx.claimedFields.has(entry) || ctx.issues.push({
+        path: path,
+        message: `claim field "${name}" is never referenced by a claim action — you announced the pattern and wrote half of it. Declare a defineAction({ type: "claim", field: "${name}" }) or use a raw actor entry`
     });
 }
-function nonActionFilterConditionSites(def) {
-  const sites = [];
-  for (const [i, stage] of def.stages.entries()) {
-    for (const [k, t] of (stage.transitions ?? []).entries())
-      sites.push({
-        groq: t.filter,
-        path: ["stages", i, "transitions", k, "filter"],
-        label: `transition "${t.name}" filter`
-      }), collectBindingSites({
-        effects: t.effects,
-        path: ["stages", i, "transitions", k, "effects"],
-        label: `transition "${t.name}"`,
-        sites
-      }), collectOpWhereSites({
-        ops: t.ops,
-        path: ["stages", i, "transitions", k, "ops"],
-        label: `transition "${t.name}"`,
-        sites
-      });
-    for (const [j, activity] of (stage.activities ?? []).entries())
-      collectActivityConditionSites({ activity, path: ["stages", i, "activities", j], sites });
-  }
-  return sites;
-}
-function collectOpWhereSites({
-  ops,
-  path,
-  label,
-  sites
-}) {
-  for (const [o, op] of (ops ?? []).entries())
-    op.where !== void 0 && sites.push({
-      groq: op.where,
-      path: [...path, o, "where"],
-      label: `${label} ${op.type} where`
+
+function desugarTransition({transition: transition, path: path, stageEnv: stageEnv, ctx: ctx}) {
+    const ops = desugarOps({
+        ops: transition.ops,
+        path: [ ...path, "ops" ],
+        env: stageEnv,
+        firingActivity: void 0,
+        ctx: ctx
     });
+    return {
+        ...stripUndefined({
+            name: transition.name,
+            title: transition.title,
+            description: transition.description,
+            to: transition.to,
+            effects: transition.effects
+        }),
+        filter: transition.filter ?? "$allActivitiesDone",
+        ...ops ? {
+            ops: ops
+        } : {}
+    };
 }
-function collectActivityConditionSites({
-  activity,
-  path,
-  sites
-}) {
-  for (const field of ["filter", "completeWhen", "failWhen"]) {
-    const groq2 = activity[field];
-    groq2 !== void 0 && sites.push({ groq: groq2, path: [...path, field], label: `activity "${activity.name}".${field}` });
-  }
-  collectBindingSites({
-    effects: activity.effects,
-    path: [...path, "effects"],
-    label: `activity "${activity.name}"`,
-    sites
-  }), collectOpWhereSites({
-    ops: activity.ops,
-    path: [...path, "ops"],
-    label: `activity "${activity.name}"`,
-    sites
-  });
-  for (const [a, action] of (activity.actions ?? []).entries())
-    collectBindingSites({
-      effects: action.effects,
-      path: [...path, "actions", a, "effects"],
-      label: `action "${action.name}"`,
-      sites
-    }), collectOpWhereSites({
-      ops: action.ops,
-      path: [...path, "actions", a, "ops"],
-      label: `action "${action.name}"`,
-      sites
-    });
-  collectSubworkflowSites({ activity, path, sites });
-}
-function collectSubworkflowSites({
-  activity,
-  path,
-  sites
-}) {
-  const sub = activity.subworkflows;
-  if (sub === void 0) return;
-  const subPath = [...path, "subworkflows"];
-  sites.push({
-    groq: sub.forEach,
-    path: [...subPath, "forEach"],
-    label: `activity "${activity.name}".subworkflows.forEach`
-  });
-  for (const [group, record] of [
-    ["with", sub.with],
-    ["context", sub.context]
-  ])
-    for (const [key, groq2] of Object.entries(record ?? {}))
-      sites.push({
-        groq: groq2,
-        path: [...subPath, group, key],
-        label: `activity "${activity.name}".subworkflows.${group} "${key}"`
-      });
-}
-function collectBindingSites({
-  effects,
-  path,
-  label,
-  sites
-}) {
-  for (const [e, effect] of (effects ?? []).entries())
-    for (const [key, groq2] of Object.entries(effect.bindings ?? {}))
-      sites.push({
-        groq: groq2,
-        path: [...path, e, "bindings", key],
-        label: `${label} effect "${effect.name}" binding "${key}"`
-      });
-}
-function checkAssigneesEntries(def, issues) {
-  for (const { entries, path } of fieldScopes(def))
-    (entries ?? []).filter((e) => e.type === "assignees").length <= 1 || issues.push({
-      path,
-      message: "at most one assignees-kind field entry per scope \u2014 the inbox reads it by kind"
+
+function desugarGuard(guard) {
+    const {match: match, metadata: metadata, ...rest} = guard, {idRefs: idRefs, ...matchRest} = match;
+    return {
+        ...rest,
+        match: {
+            ...matchRest,
+            ...idRefs !== void 0 ? {
+                idRefs: idRefs.map(printGuardRead)
+            } : {}
+        },
+        ...metadata !== void 0 ? {
+            metadata: Object.fromEntries(Object.entries(metadata).map(([key, read]) => [ key, printGuardRead(read) ]))
+        } : {}
+    };
+}
+
+function desugarOps({ops: ops, path: path, env: env, firingActivity: firingActivity, ctx: ctx}) {
+    if (ops) return ops.map((op, i) => desugarOp({
+        op: op,
+        path: [ ...path, i ],
+        env: env,
+        firingActivity: firingActivity,
+        ctx: ctx
+    }));
+}
+
+function desugarOp({op: op, path: path, env: env, firingActivity: firingActivity, ctx: ctx}) {
+    if (op.type === "status.set") {
+        const activity = op.activity ?? firingActivity;
+        return activity === void 0 && ctx.issues.push({
+            path: [ ...path, "activity" ],
+            message: "status.set outside an action must name its target activity"
+        }), {
+            type: "status.set",
+            activity: activity ?? "",
+            status: op.status
+        };
+    }
+    if (op.type === "audit") return desugarAuditOp({
+        op: op,
+        path: path,
+        env: env,
+        ctx: ctx
     });
+    const target = resolveRef({
+        ref: op.target,
+        env: env,
+        path: [ ...path, "target" ],
+        ctx: ctx
+    }) ?? fallbackRef(op.target);
+    return {
+        ...op,
+        target: target
+    };
 }
-function activityShape(activity) {
-  return {
-    hasActions: (activity.actions ?? []).length > 0,
-    hasEffects: (activity.effects ?? []).length > 0,
-    hasCompleteWhen: activity.completeWhen !== void 0,
-    hasSubworkflows: activity.subworkflows !== void 0
-  };
-}
-const KIND_SHAPE_RULES = {
-  user: (s) => s.hasActions ? [] : ["needs at least one action for a person to fire"],
-  service: (s) => s.hasEffects ? [] : ["needs at least one effect \u2014 the automated work it performs"],
-  manual: (s) => [
-    s.hasActions || s.hasCompleteWhen ? void 0 : "needs a way to complete \u2014 an action to acknowledge it, or a `completeWhen` predicate to verify it (otherwise it auto-resolves on activation)",
-    s.hasSubworkflows ? "is off-system work, not a fan-out \u2014 drop `subworkflows` or move it to its own activity" : void 0
-  ].filter((m) => m !== void 0),
-  receive: (s) => [
-    s.hasCompleteWhen || s.hasSubworkflows ? void 0 : "needs a `completeWhen` (or `subworkflows`) condition to wait on",
-    s.hasActions ? "has no actor, so it cannot carry actions" : void 0
-  ].filter((m) => m !== void 0),
-  script: (s) => [
-    s.hasActions ? "runs inline with no actor, so it cannot carry actions" : void 0,
-    s.hasCompleteWhen ? "resolves on activation, so it cannot carry a `completeWhen` (that is a `receive`/`service` wait)" : void 0,
-    s.hasSubworkflows ? "resolves on activation, so it cannot fan out with `subworkflows`" : void 0
-  ].filter((m) => m !== void 0)
+
+const AUDIT_STAMPS = {
+    actor: {
+        type: "actor"
+    },
+    at: {
+        type: "now"
+    }
 };
-function checkActivityKinds(def, issues) {
-  for (const [i, stage] of def.stages.entries())
-    for (const [j, activity] of (stage.activities ?? []).entries()) {
-      const path = ["stages", i, "activities", j];
-      if (activity.target !== void 0 && activity.kind !== "manual" && issues.push({
-        path: [...path, "target"],
-        message: `activity "${activity.name}" has a \`target\` but is not \`kind: "manual"\` \u2014 a target is the deep-link for off-system manual work`
-      }), activity.kind !== void 0)
-        for (const fault of KIND_SHAPE_RULES[activity.kind](activityShape(activity)))
-          issues.push({
-            path: [...path, "kind"],
-            message: `activity "${activity.name}" declares kind "${activity.kind}" but ${fault}`
-          });
+
+function desugarAuditOp({op: op, path: path, env: env, ctx: ctx}) {
+    const target = resolveRef({
+        ref: op.target,
+        env: env,
+        path: [ ...path, "target" ],
+        ctx: ctx
+    }) ?? fallbackRef(op.target);
+    if (op.value.type !== "object") return ctx.issues.push({
+        path: [ ...path, "value" ],
+        message: `audit value must be an object source carrying the domain fields (got "${op.value.type}")`
+    }), {
+        type: "field.append",
+        target: target,
+        value: op.value
+    };
+    const actorField = op.stampFields?.actor ?? "actor", atField = op.stampFields?.at ?? "at", fields = {
+        ...op.value.fields
+    };
+    for (const [stamp, source] of [ [ actorField, AUDIT_STAMPS.actor ], [ atField, AUDIT_STAMPS.at ] ]) {
+        if (stamp in fields) {
+            ctx.issues.push({
+                path: [ ...path, "value", "fields", stamp ],
+                message: `audit stamp field "${stamp}" collides with an authored domain field — rename yours or remap the stamp via stampFields`
+            });
+            continue;
+        }
+        fields[stamp] = source;
     }
+    return {
+        type: "field.append",
+        target: target,
+        value: {
+            type: "object",
+            fields: fields
+        }
+    };
 }
-function checkWorkflowInvariants(def) {
-  const issues = [], stageNames = checkStages(def, issues);
-  return checkInitialStage({ def, stageNames, issues }), checkTransitionTargets({ def, stageNames, issues }), checkEffectNames(def, issues), checkGuardNames(def, issues), checkFieldEntryNames(def, issues), checkRequiredField(def, issues), checkPredicates(def, issues), checkCanOutsideActionFilters(def, issues), checkAssigneesEntries(def, issues), checkActivityKinds(def, issues), issues;
+
+function resolveRef({ref: ref, env: env, path: path, ctx: ctx}) {
+    const layers = ref.scope === void 0 ? env.layers : env.layers.filter(l => l.scope === ref.scope);
+    for (const layer of layers) if (layer.entries.has(ref.field)) return {
+        scope: layer.scope,
+        field: ref.field
+    };
+    const reachable = env.layers.flatMap(l => [ ...l.entries.keys() ].map(n => `${l.scope}:${n}`));
+    ctx.issues.push({
+        path: path,
+        message: `field reference "${ref.field}"${ref.scope ? ` (scope "${ref.scope}")` : ""} does not resolve to a declared entry. Reachable: ${reachable.join(", ") || "(none)"}`
+    });
 }
-function defineWorkflow(definition) {
-  const label = labelFor("defineWorkflow", definition), parsed = parseOrThrow({ schema: AuthoringWorkflowSchema, input: definition, label }), { definition: stored, issues: desugarIssues } = desugarWorkflow(parsed), issues = [...desugarIssues, ...checkWorkflowInvariants(stored)];
-  if (issues.length > 0) throw new Error(formatValidationError(label, issues));
-  return stored;
+
+function entryAt(env, ref) {
+    return env.layers.find(l => l.scope === ref.scope)?.entries.get(ref.field);
 }
+
+function fallbackRef(ref) {
+    return {
+        scope: ref.scope ?? "workflow",
+        field: ref.field
+    };
+}
+
+function rolesCondition(roles, aliases) {
+    if (!(!roles || roles.length === 0)) return groq`count($actor.roles[@ in ${expandRequiredRoles(roles, aliases)}]) > 0`;
+}
+
+function stripUndefined(obj) {
+    const out = {};
+    for (const [k, value] of Object.entries(obj)) value !== void 0 && (out[k] = value);
+    return out;
+}
+
+function defineWorkflow(definition) {
+    const label = labelFor("defineWorkflow", definition), parsed = parseOrThrow({
+        schema: AuthoringWorkflowSchema,
+        input: definition,
+        label: label
+    }), {definition: stored, issues: desugarIssues} = desugarWorkflow(parsed), issues = [ ...desugarIssues, ...checkWorkflowInvariants(stored) ];
+    if (issues.length > 0) throw new Error(formatValidationError(label, issues));
+    return stored;
+}
+
 function defineWorkflowConfig(config) {
-  return parseOrThrow({ schema: WorkflowConfigSchema, input: config, label: "defineWorkflowConfig" });
+    return parseOrThrow({
+        schema: WorkflowConfigSchema,
+        input: config,
+        label: "defineWorkflowConfig"
+    });
 }
+
 function defineStage(stage) {
-  return parseOrThrow({
-    schema: AuthoringStageSchema,
-    input: stage,
-    label: labelFor("defineStage", stage)
-  });
+    return parseOrThrow({
+        schema: AuthoringStageSchema,
+        input: stage,
+        label: labelFor("defineStage", stage)
+    });
 }
+
 function defineActivity(activity) {
-  return parseOrThrow({
-    schema: AuthoringActivitySchema,
-    input: activity,
-    label: labelFor("defineActivity", activity)
-  });
+    return parseOrThrow({
+        schema: AuthoringActivitySchema,
+        input: activity,
+        label: labelFor("defineActivity", activity)
+    });
 }
+
 function defineAction(action) {
-  return parseOrThrow({
-    schema: AuthoringActionSchema,
-    input: action,
-    label: labelFor("defineAction", action)
-  });
+    return parseOrThrow({
+        schema: AuthoringActionSchema,
+        input: action,
+        label: labelFor("defineAction", action)
+    });
 }
+
 function defineTransition(transition) {
-  return parseOrThrow({
-    schema: AuthoringTransitionSchema,
-    input: transition,
-    label: transitionLabel(transition)
-  });
+    return parseOrThrow({
+        schema: AuthoringTransitionSchema,
+        input: transition,
+        label: transitionLabel(transition)
+    });
 }
+
 function defineField(entry) {
-  return parseOrThrow({
-    schema: AuthoringFieldEntrySchema,
-    input: entry,
-    label: labelFor("defineField", entry)
-  });
+    return parseOrThrow({
+        schema: AuthoringFieldEntrySchema,
+        input: entry,
+        label: labelFor("defineField", entry)
+    });
 }
+
 function defineOp(op) {
-  return parseOrThrow({ schema: AuthoringOpSchema, input: op, label: "defineOp" });
+    return parseOrThrow({
+        schema: AuthoringOpSchema,
+        input: op,
+        label: "defineOp"
+    });
 }
+
+function defineGroup(group) {
+    return parseOrThrow({
+        schema: GroupSchema,
+        input: group,
+        label: labelFor("defineGroup", group)
+    });
+}
+
 function defineGuard(guard) {
-  return parseOrThrow({
-    schema: AuthoringGuardSchema,
-    input: guard,
-    label: labelFor("defineGuard", guard)
-  });
+    return parseOrThrow({
+        schema: AuthoringGuardSchema,
+        input: guard,
+        label: labelFor("defineGuard", guard)
+    });
 }
+
 function defineEffect(effect) {
-  return parseOrThrow({
-    schema: EffectSchema,
-    input: effect,
-    label: labelFor("defineEffect", effect)
-  });
+    return parseOrThrow({
+        schema: EffectSchema,
+        input: effect,
+        label: labelFor("defineEffect", effect)
+    });
 }
+
 function transitionLabel(transition) {
-  const { name, to } = transition;
-  return typeof name == "string" ? `defineTransition("${name}")` : typeof to == "string" ? `defineTransition(\u2192 "${to}")` : "defineTransition";
+    const {name: name, to: to} = transition;
+    return typeof name == "string" ? `defineTransition("${name}")` : typeof to == "string" ? `defineTransition(→ "${to}")` : "defineTransition";
 }
+
 function defineEffectDescriptor(descriptor) {
-  if (!descriptor.name) throw new Error("EffectDescriptor missing name");
-  return descriptor;
-}
-function parseOrThrow({
-  schema,
-  input,
-  label
-}) {
-  const result = v.safeParse(schema, input);
-  if (!result.success)
-    throw new Error(formatValidationError(label, issuesFromValibot(result.issues)));
-  return result.output;
-}
-function labelFor(fn, value) {
-  if (value && typeof value == "object" && "name" in value) {
-    const raw = value.name;
-    if (typeof raw == "string") return `${fn}("${raw}")`;
-  }
-  return fn;
-}
-export {
-  CONDITION_VARS,
-  FILTER_SCOPE_VARS,
-  GUARD_PREDICATE_VARS,
-  RESERVED_CONDITION_VARS,
-  defineAction,
-  defineActivity,
-  defineEffect,
-  defineEffectDescriptor,
-  defineField,
-  defineGuard,
-  defineOp,
-  defineStage,
-  defineTransition,
-  defineWorkflow,
-  defineWorkflowConfig,
-  groq
-};
-//# sourceMappingURL=define.js.map
+    if (!descriptor.name) throw new Error("EffectDescriptor missing name");
+    return descriptor;
+}
+
+export { CONDITION_VARS, FILTER_SCOPE_VARS, GUARD_PREDICATE_VARS, RESERVED_CONDITION_VARS, defineAction, defineActivity, defineEffect, defineEffectDescriptor, defineField, defineGroup, defineGuard, defineOp, defineStage, defineTransition, defineWorkflow, defineWorkflowConfig, groq };