@sanity/workflow-engine 0.16.0 → 0.17.0

package/dist/_chunks-cjs/invariants.cjs

@@ -315,17 +315,17 @@ function effectNotFoundMessage(args) {
     return args.settled.status === "cancelled" ? `${base} — it was cancelled at ${args.settled.ranAt}${cause}` : `${base} — it already settled "${args.settled.status}" at ${args.settled.ranAt}${cause}`;
 }
 
-const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const LAKE_ID_SEGMENT_RE = /^[a-z0-9][a-z0-9-]*$/, LAKE_ID_SEGMENT_GLOSS = "ASCII lowercase + digits + dashes, no leading dash, no dots";
 
 function validateTag(tag) {
-    if (!TAG_RE.test(tag)) throw new ContractViolationError(`tag: invalid tag "${tag}" — must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`);
+    if (!LAKE_ID_SEGMENT_RE.test(tag)) throw new ContractViolationError(`tag: invalid tag "${tag}" — must match ${LAKE_ID_SEGMENT_RE.source} (${LAKE_ID_SEGMENT_GLOSS})`);
 }
 
 function tagScopeFilter() {
     return "tag == $tag";
 }
 
-const NonEmptyString = v__namespace.pipe(v__namespace.string(), v__namespace.nonEmpty("must not be empty"));
+const NonEmptyString$1 = v__namespace.pipe(v__namespace.string(), v__namespace.nonEmpty("must not be empty"));
 
 function asPredicate(validate) {
     return value => {
@@ -339,21 +339,21 @@ function asPredicate(validate) {
 
 const isValidTag = asPredicate(validateTag), isValidAliasName = asPredicate(validateResourceAliasName), isValidDatasetId = asPredicate(datasetResourceParts), WorkflowResourceSchema = v__namespace.variant("type", [ v__namespace.object({
     type: v__namespace.literal("dataset"),
-    id: v__namespace.pipe(NonEmptyString, v__namespace.check(isValidDatasetId, 'invalid dataset resource id — expected "<projectId>.<dataset>"'))
+    id: v__namespace.pipe(NonEmptyString$1, v__namespace.check(isValidDatasetId, 'invalid dataset resource id — expected "<projectId>.<dataset>"'))
 }), v__namespace.object({
     type: v__namespace.literal("canvas"),
-    id: NonEmptyString
+    id: NonEmptyString$1
 }), v__namespace.object({
     type: v__namespace.literal("media-library"),
-    id: NonEmptyString
+    id: NonEmptyString$1
 }), v__namespace.object({
     type: v__namespace.literal("dashboard"),
-    id: NonEmptyString
+    id: NonEmptyString$1
 }) ]), ResourceBindingSchema = v__namespace.object({
-    name: v__namespace.pipe(NonEmptyString, v__namespace.check(isValidAliasName, "invalid resource handle name — lowercase letters, digits and dashes only, no leading dash")),
+    name: v__namespace.pipe(NonEmptyString$1, v__namespace.check(isValidAliasName, "invalid resource handle name — lowercase letters, digits and dashes only, no leading dash")),
     resource: WorkflowResourceSchema
 }), DefinitionSchema = v__namespace.custom(input => typeof input == "object" && input !== null && typeof input.name == "string", "expected a workflow definition (an object with a string `name`)"), DeploymentSchema = v__namespace.object({
-    name: NonEmptyString,
+    name: NonEmptyString$1,
     tag: v__namespace.pipe(v__namespace.string(), v__namespace.nonEmpty(), v__namespace.check(isValidTag, "invalid tag — lowercase letters, digits and dashes only, no leading dash, no dots")),
     workflowResource: WorkflowResourceSchema,
     resourceAliases: v__namespace.optional(v__namespace.pipe(v__namespace.array(ResourceBindingSchema), v__namespace.check(bindings => new Set(bindings.map(binding => binding.name)).size === bindings.length, "duplicate resource handle name — each binding name must be unique within a deployment"))),
@@ -518,6 +518,9 @@ function desugarStart(start) {
         kind: start.kind ?? "interactive",
         ...start.filter !== void 0 ? {
             filter: start.filter
+        } : {},
+        ...start.allowed !== void 0 ? {
+            allowed: start.allowed
         } : {}
     };
 }
@@ -1066,12 +1069,43 @@ function conditionParameterNames(groq2) {
 }
 
 function conditionFieldReadNames(groq2) {
-    const read = /* @__PURE__ */ new Set;
-    return walkAstNodes(tryParseGroq(groq2), node => {
-        if (node.type !== "AccessAttribute" || typeof node.name != "string") return;
-        const base = node.base;
-        base?.type === "Parameter" && base.name === "fields" && read.add(node.name);
-    }), read;
+    return new Set(conditionFieldReads(groq2).map(read => read.name));
+}
+
+function conditionFieldReads(groq2) {
+    const reads = /* @__PURE__ */ new Map;
+    return collectFieldReads(tryParseGroq(groq2), reads), [ ...reads.values() ];
+}
+
+function collectFieldReads(node, reads) {
+    if (Array.isArray(node)) {
+        for (const item of node) collectFieldReads(item, reads);
+        return;
+    }
+    if (typeof node != "object" || node === null) return;
+    const chain = fieldsAttributeChain(node);
+    if (chain !== void 0) {
+        const [name, ...tail] = chain, path = tail.length > 0 ? tail.join(".") : void 0;
+        reads.set(`${name}.${path ?? ""}`, {
+            name: name,
+            path: path
+        });
+        return;
+    }
+    for (const value of Object.values(node)) collectFieldReads(value, reads);
+}
+
+function fieldsAttributeChain(node) {
+    const names = [];
+    let current = node;
+    for (;typeof current == "object" && current !== null; ) {
+        const typed = current;
+        if (typed.type !== "AccessAttribute" || typeof typed.name != "string") return;
+        names.unshift(typed.name);
+        const base = typed.base;
+        if (base?.type === "Parameter" && base.name === "fields") return names;
+        current = base;
+    }
 }
 
 function conditionEffectReads(groq2) {
@@ -1145,7 +1179,7 @@ const FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISS
     name: "fields",
     binding: "always",
     label: "the workflow's fields",
-    description: "Declared field entries rendered by name (`$fields.<name>` is the value, no envelope). Stage/activity scopes overlay lexically; `doc.ref` values render the hydrated document when the snapshot holds it."
+    description: "Declared field entries rendered by name (`$fields.<name>` is the value, no wrapper). Stage/activity scopes overlay lexically. What a read puts in your hand follows the declared kind: a singular `doc.ref` DEREFERENCES into the hydrated document (lake `_id`/`_type` plus content fields — which may themselves be named `id`/`type`), while `doc.refs` elements and `release.ref` stay REFERENCES — `{id, type[, releaseName]}` with `id` a GDR URI — because identity reads (membership, counting, joins) must stay total without hydrating every target, and targets may live in resources the evaluation cannot fetch from. Conditions evaluate against the in-memory snapshot only, so a dereferencing plural kind would silently hole wherever hydration lagged."
 }, {
     name: "parent",
     binding: "always",
@@ -1215,7 +1249,7 @@ const FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISS
     name: "row",
     binding: "spawn",
     label: "the spawned row",
-    description: "One `spawn.forEach` result row, bound while its `with` map evaluates — and the row under test while a where-op `where` evaluates (per row)."
+    description: "One `spawn.forEach` result row, bound while its `with` map evaluates — and the row under test while a where-op `where` evaluates (per row). Deploy rejects a read at every other site (including `spawn.forEach` itself and `spawn.context`), where it is GROQ null."
 }, {
     name: "params",
     binding: "caller",
@@ -1231,20 +1265,148 @@ const FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISS
     description: "The engine's tag partition — scope `*[...]` instance scans with `tag == $tag`."
 }, {
     name: "definition",
-    description: "The `name` of the definition under evaluation (its own start.filter binds it)."
+    description: "The `name` of the definition under evaluation (its own start block binds it)."
 }, {
     name: "now",
     description: "The ISO clock reading of the evaluating engine."
-}, {
+} ], START_ALLOWED_VARS = [ ...START_FILTER_VARS, {
     name: "fields",
-    description: "The candidate initialFields by entry name, when the read surface has them (the Studio start control: yes; a per-doc picker: no). Document references bind as GDR envelopes — `$fields.<entry>.id` is the GDR URI, never a string authors assemble."
+    description: "The caller's input entries by name (`initialFields` — at `startInstance`, the values the start would seed; at a pre-flight, the values gathered so far, so a read of a not-yet-supplied entry is GROQ null). Document references bind as GDR envelopes — `$fields.<entry>.id` is the GDR URI, never a string authors assemble — a singular `doc.ref` included (nothing hydrates at the gate or the pre-flight). Pathed reads are deploy-checked against these envelope shapes."
 } ], GUARD_PREDICATE_VARS = [ {
     name: "guard",
     description: "The guard document itself (its `metadata` carries deploy-time resolved values)."
 }, {
     name: "mutation",
     description: "The attempted mutation — `mutation.action` is the write kind being gated."
-} ], ACTOR_KINDS = [ "person", "agent", "system" ];
+} ], NonEmptyString = v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1, "must be a non-empty string"));
+
+function isParseableInstant(value) {
+    return typeof value == "string" && !Number.isNaN(Date.parse(value));
+}
+
+const IsoTimestamp = v__namespace.pipe(v__namespace.string(), v__namespace.check(s => isParseableInstant(s), "must be an ISO-8601 datetime string"));
+
+function tolerantObject() {
+    return (entries, ..._exact) => v__namespace.looseObject(entries);
+}
+
+function tolerantEntries() {
+    return (entries, ..._exact) => entries;
+}
+
+function schemaTreeShape(schema) {
+    return walkSchemaShape(schema, /* @__PURE__ */ new Set);
+}
+
+function walkSchemaShape(node, path) {
+    if (typeof node != "object" || node === null) return "unknown";
+    if (path.has(node)) return "(circular)";
+    path.add(node);
+    try {
+        const schema = node;
+        return containerShape(schema, path) ?? leafShape(schema);
+    } finally {
+        path.delete(node);
+    }
+}
+
+const objectWalker = (schema, path) => objectEntriesShape(schema.entries, path), unionWalker = (schema, path) => ({
+    union: schema.options.map(option => walkSchemaShape(option, path))
+}), unwrapWalker = (schema, path) => walkSchemaShape(schema.wrapped, path), CONTAINER_WALKERS = {
+    strict_object: objectWalker,
+    loose_object: objectWalker,
+    object: objectWalker,
+    array: (schema, path) => ({
+        array: walkSchemaShape(schema.item, path)
+    }),
+    record: (schema, path) => ({
+        record: walkSchemaShape(schema.value, path)
+    }),
+    union: unionWalker,
+    variant: unionWalker,
+    lazy: (schema, path) => walkSchemaShape(schema.getter(void 0), path),
+    exact_optional: unwrapWalker,
+    optional: unwrapWalker,
+    nullable: unwrapWalker
+};
+
+function containerShape(schema, path) {
+    return CONTAINER_WALKERS[String(schema.type)]?.(schema, path);
+}
+
+function objectEntriesShape(entries, path) {
+    const out = {};
+    for (const [key, entry] of Object.entries(entries)) {
+        const optional = isOptionalEntry(entry), wrapped = optional ? entry.wrapped : entry;
+        out[optional ? `${key}?` : key] = walkSchemaShape(wrapped, path);
+    }
+    return Object.fromEntries(Object.entries(out).sort(([a], [b]) => a < b ? -1 : 1));
+}
+
+function isOptionalEntry(entry) {
+    if (typeof entry != "object" || entry === null) return !1;
+    const kind = entry.type;
+    return kind === "exact_optional" || kind === "optional";
+}
+
+const LEAF_KINDS = /* @__PURE__ */ new Set([ "string", "number", "boolean", "null", "undefined", "unknown", "any" ]);
+
+function leafShape(schema) {
+    if (schema.type === "picklist") return schema.options.join(" | ");
+    if (schema.type === "literal") return `literal ${String(schema.literal)}`;
+    if (schema.type === "custom") return typeof schema.message == "string" ? `custom(${schema.message})` : "custom";
+    if (!LEAF_KINDS.has(String(schema.type))) throw new Error(`schemaTreeShape: unhandled schema kind "${String(schema.type)}" — extend the walker before regenerating the model ledger`);
+    return String(schema.type);
+}
+
+function formatValidationError(label, issues) {
+    const lines = issues.map(issue => `  - ${issue.path.length === 0 ? "(root)" : formatIssuePath(issue.path)}: ${issue.message}`);
+    return `${label} failed validation (${issues.length} issue${issues.length === 1 ? "" : "s"}):\n${lines.join(`\n`)}`;
+}
+
+function issuesFromValibot(issues) {
+    return issues.map(issue => ({
+        path: issue.path ? issue.path.map(item => item.key) : [],
+        message: issue.message
+    }));
+}
+
+function formatIssuePath(path) {
+    let out = "";
+    for (const seg of path) typeof seg == "number" ? out += `[${seg}]` : out += out.length === 0 ? String(seg) : `.${String(seg)}`;
+    return out;
+}
+
+class PersistedDocShapeError extends WorkflowError {
+    documentId;
+    documentType;
+    issues;
+    constructor(args) {
+        super("persisted-doc-shape", formatValidationError(`Persisted ${args.documentType} document "${args.documentId}"`, args.issues)), 
+        this.name = "PersistedDocShapeError", this.documentId = args.documentId, this.documentType = args.documentType, 
+        this.issues = args.issues;
+    }
+}
+
+function parsePersistedDoc(args) {
+    const result = v__namespace.safeParse(args.schema, args.doc);
+    if (!result.success) throw new PersistedDocShapeError({
+        documentId: documentIdOf(args.doc),
+        documentType: args.docType,
+        issues: issuesFromValibot(result.issues)
+    });
+    return result.output;
+}
+
+function documentIdOf(doc) {
+    if (typeof doc == "object" && doc !== null) {
+        const id = doc._id;
+        if (typeof id == "string") return id;
+    }
+    return "(unknown id)";
+}
+
+const ACTOR_KINDS = [ "person", "agent", "system" ];
 
 function releaseDocId(releaseName) {
     return `_.releases.${releaseName}`;
@@ -1291,29 +1453,28 @@ class FieldValueShapeError extends WorkflowError {
     }
 }
 
-const GdrShape = v__namespace.looseObject({
-    id: v__namespace.pipe(v__namespace.string(), v__namespace.check(s => isGdrUri(s), "must be a GDR URI")),
-    type: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
-}), ReleaseRefShape = v__namespace.pipe(v__namespace.looseObject({
-    id: v__namespace.pipe(v__namespace.string(), v__namespace.check(s => isGdrUri(s), "must be a GDR URI")),
+const GdrUriSchema = v__namespace.custom(s => typeof s == "string" && isGdrUri(s), "must be a GDR URI"), GdrShape = tolerantObject()({
+    id: GdrUriSchema,
+    type: NonEmptyString
+}), ReleaseRefShape = v__namespace.pipe(tolerantObject()({
+    id: GdrUriSchema,
     type: v__namespace.literal("system.release"),
-    releaseName: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
-}), v__namespace.check(ref => !isGdrUri(ref.id) || extractDocumentId(ref.id) === releaseDocId(ref.releaseName), "id must point at the `_.releases.<releaseName>` doc named by releaseName")), ActorShape = v__namespace.looseObject({
+    releaseName: NonEmptyString
+}), v__namespace.check(ref => !isGdrUri(ref.id) || extractDocumentId(ref.id) === releaseDocId(ref.releaseName), "id must point at the `_.releases.<releaseName>` doc named by releaseName")), ActorShape = tolerantObject()({
     kind: v__namespace.picklist(ACTOR_KINDS),
-    id: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1)),
-    roles: v__namespace.optional(v__namespace.array(v__namespace.string())),
-    onBehalfOf: v__namespace.optional(v__namespace.string())
-}), AssigneeShape = v__namespace.union([ v__namespace.looseObject({
+    id: NonEmptyString,
+    roles: v__namespace.exactOptional(v__namespace.array(v__namespace.string())),
+    onBehalfOf: v__namespace.exactOptional(v__namespace.string())
+}), AssigneeShape = v__namespace.union([ tolerantObject()({
     type: v__namespace.literal("user"),
-    id: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
-}), v__namespace.looseObject({
+    id: NonEmptyString
+}), tolerantObject()({
     type: v__namespace.literal("role"),
-    role: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
-}) ]), NullableString = v__namespace.union([ v__namespace.null(), v__namespace.string() ]), NullableNumber = v__namespace.union([ v__namespace.null(), v__namespace.number() ]), NullableBoolean = v__namespace.union([ v__namespace.null(), v__namespace.boolean() ]), NullableDateTime = v__namespace.union([ v__namespace.null(), v__namespace.pipe(v__namespace.string(), v__namespace.check(s => !Number.isNaN(Date.parse(s)), "must be an ISO-8601 datetime string")) ]), NullableDate = v__namespace.union([ v__namespace.null(), v__namespace.pipe(v__namespace.string(), v__namespace.regex(/^\d{4}-\d{2}-\d{2}$/, "must be a `YYYY-MM-DD` date")) ]), NullableUrl = NullableString, valueSchemas = {
+    role: NonEmptyString
+}) ]), NullableString = v__namespace.union([ v__namespace.null(), v__namespace.string() ]), NullableNumber = v__namespace.union([ v__namespace.null(), v__namespace.number() ]), NullableBoolean = v__namespace.union([ v__namespace.null(), v__namespace.boolean() ]), NullableDateTime = v__namespace.union([ v__namespace.null(), IsoTimestamp ]), NullableDate = v__namespace.union([ v__namespace.null(), v__namespace.pipe(v__namespace.string(), v__namespace.regex(/^\d{4}-\d{2}-\d{2}$/, "must be a `YYYY-MM-DD` date")) ]), NullableUrl = NullableString, fieldValueSchemas = {
     "doc.ref": v__namespace.union([ v__namespace.null(), GdrShape ]),
     "doc.refs": v__namespace.array(GdrShape),
     "release.ref": v__namespace.union([ v__namespace.null(), ReleaseRefShape ]),
-    query: v__namespace.any(),
     string: NullableString,
     text: NullableString,
     number: NullableNumber,
@@ -1324,6 +1485,9 @@ const GdrShape = v__namespace.looseObject({
     actor: v__namespace.union([ v__namespace.null(), ActorShape ]),
     assignee: v__namespace.union([ v__namespace.null(), AssigneeShape ]),
     assignees: v__namespace.array(AssigneeShape)
+}, valueSchemas = {
+    ...fieldValueSchemas,
+    query: v__namespace.any()
 };
 
 function shapeValueSchema(shape, leaf) {
@@ -1410,7 +1574,7 @@ function isBareSeedId(id) {
 
 const AuthoringRefId = v__namespace.pipe(v__namespace.string(), v__namespace.check(isAuthoringRefId, "must be a bare document id, a GDR URI, or a portable `@<alias>:<id>` reference")), AuthoringGdrShape = v__namespace.looseObject({
     id: AuthoringRefId,
-    type: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+    type: NonEmptyString
 }), seedValueSchemas = {
     ...valueSchemas,
     "doc.ref": v__namespace.union([ v__namespace.null(), AuthoringGdrShape ]),
@@ -1418,7 +1582,7 @@ const AuthoringRefId = v__namespace.pipe(v__namespace.string(), v__namespace.che
     "release.ref": v__namespace.union([ v__namespace.null(), v__namespace.looseObject({
         id: AuthoringRefId,
         type: v__namespace.literal("system.release"),
-        releaseName: v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1))
+        releaseName: NonEmptyString
     }) ])
 };
 
@@ -1461,7 +1625,7 @@ function formatIssues(issues) {
     });
 }
 
-const NonEmpty = v__namespace.pipe(v__namespace.string(), v__namespace.minLength(1, "must be a non-empty string")), PositiveInt = v__namespace.pipe(v__namespace.number(), v__namespace.integer(), v__namespace.minValue(1)), GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const NonEmpty = NonEmptyString, PositiveInt = v__namespace.pipe(v__namespace.number(), v__namespace.integer(), v__namespace.minValue(1)), GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 function groqIdentifier(referencedAs) {
     return v__namespace.pipe(v__namespace.string(), v__namespace.regex(GROQ_IDENTIFIER, `must be a GROQ-safe identifier (letters, digits, underscore; not starting with a digit) because it is referenced as ${referencedAs} in GROQ conditions`));
@@ -1844,7 +2008,8 @@ const StoredStageSchema = pinned()(v__namespace.strictObject(stageFields({
 function startFields(kind) {
     return {
         kind: kind,
-        filter: v__namespace.optional(ConditionSchema)
+        filter: v__namespace.optional(ConditionSchema),
+        allowed: v__namespace.optional(ConditionSchema)
     };
 }
 
@@ -1902,24 +2067,6 @@ function isInputSourced(entry) {
     return entry.initialValue?.type === "input";
 }
 
-function formatValidationError(label, issues) {
-    const lines = issues.map(issue => `  - ${issue.path.length === 0 ? "(root)" : formatIssuePath(issue.path)}: ${issue.message}`);
-    return `${label} failed validation (${issues.length} issue${issues.length === 1 ? "" : "s"}):\n${lines.join(`\n`)}`;
-}
-
-function issuesFromValibot(issues) {
-    return issues.map(issue => ({
-        path: issue.path ? issue.path.map(item => item.key) : [],
-        message: issue.message
-    }));
-}
-
-function formatIssuePath(path) {
-    let out = "";
-    for (const seg of path) typeof seg == "number" ? out += `[${seg}]` : out += out.length === 0 ? String(seg) : `.${String(seg)}`;
-    return out;
-}
-
 function parseOrThrow({schema: schema, input: input, label: label}) {
     const result = v__namespace.safeParse(schema, input);
     if (!result.success) throw new Error(formatValidationError(label, issuesFromValibot(result.issues)));
@@ -1948,6 +2095,13 @@ function checkDuplicates({names: names, what: what, issues: issues}) {
     return seen;
 }
 
+function checkDefinitionName(def, issues) {
+    LAKE_ID_SEGMENT_RE.test(def.name) || issues.push({
+        path: [ "name" ],
+        message: `definition name "${def.name}" does not match the definition-name grammar ${LAKE_ID_SEGMENT_RE.source} (${LAKE_ID_SEGMENT_GLOSS}) — the name is interpolated into every deployed document id (\`<tag>.<name>.v<version>\`), which the engine keeps to the same segment grammar as the tag`
+    });
+}
+
 function checkStages(def, issues) {
     const stageNames = checkDuplicates({
         names: def.stages.map((stage, i) => ({
@@ -2084,6 +2238,10 @@ function checkGuardNames(def, issues) {
         what: "guard name (the guard lake _id derives from it — unique per definition)",
         issues: issues
     });
+    for (const {name: name, path: path} of sites) LAKE_ID_SEGMENT_RE.test(name) || issues.push({
+        path: path,
+        message: `guard name "${name}" does not match the guard-name grammar ${LAKE_ID_SEGMENT_RE.source} (${LAKE_ID_SEGMENT_GLOSS}) — the guard's lake _id derives from it at stage entry, so an invalid name would wedge the entering commit with an opaque lake error instead of failing here`
+    });
 }
 
 function fieldScopes(def) {
@@ -2154,7 +2312,11 @@ function checkPredicateBody({name: name, groq: groq2, names: names, issues: issu
     const reads = conditionParameterNames(groq2);
     for (const caller of CALLER_BOUND_VARS) reads.has(caller) && issues.push({
         path: [ "predicates", name ],
-        message: `predicate "${name}" reads $${caller} — predicates are instance-level (pre-evaluated once, without a caller); compose caller gates at the condition site instead`
+        message: `predicate "${name}" reads $${caller} — predicates pre-evaluate caller-free; compose caller gates at the condition site instead`
+    });
+    reads.has("row") && issues.push({
+        path: [ "predicates", name ],
+        message: `predicate "${name}" reads $row — ${ROW_BINDING_CLAUSE}; predicates pre-evaluate once per instance, so the read is GROQ null and the predicate can never hold`
     });
     for (const other of names) other === name || !reads.has(other) || issues.push({
         path: [ "predicates", name ],
@@ -2162,24 +2324,35 @@ function checkPredicateBody({name: name, groq: groq2, names: names, issues: issu
     });
 }
 
-function entryNames(entries) {
-    return new Set((entries ?? []).map(entry => entry.name));
+function entryMap(entries) {
+    return new Map((entries ?? []).map(entry => [ entry.name, entry ]));
 }
 
-function checkUnboundCallerVars(def, issues) {
+function checkUnboundConditionVars(def, issues) {
     for (const site of conditionSites(def)) {
         const reads = conditionParameterNames(site.groq);
-        for (const name of unboundCallerVars(site.policy)) reads.has(name) && issues.push({
+        for (const name of unboundVarsAt(site)) reads.has(name) && issues.push({
             path: site.path,
-            message: callerVarMessage(site, name)
+            message: name === "row" ? rowVarMessage(site) : callerVarMessage(site, name)
         });
     }
 }
 
+function unboundVarsAt(site) {
+    const callerVars = unboundCallerVars(site.policy);
+    return site.bindsRow === !0 ? callerVars : [ ...callerVars, "row" ];
+}
+
 function unboundCallerVars(policy) {
     return policy === "cascade" ? CALLER_BOUND_VARS : policy === "caller-bound" ? [ "params" ] : policy === "triggered-payload" ? [ "can", "params" ] : [ "can" ];
 }
 
+const ROW_BINDING_CLAUSE = "$row (the discovered row in a spawn projection; the stored row under test in a where-op) is bound only while a spawn `with` projection or a where-op `where` evaluates";
+
+function rowVarMessage(site) {
+    return `${site.label} reads $row — ${ROW_BINDING_CLAUSE}; this site never binds it, so the read is GROQ null and the condition can never resolve. Move the per-row read into \`spawn.with\` or a where-op, or gate on instance state instead`;
+}
+
 function callerVarMessage(site, name) {
     return site.policy === "cascade" ? `${site.label} reads $${name} — cascade gates (transition \`when\`s, activity \`filter\`s, a cascade-fired action's \`when\`/\`filter\`) must resolve identically no matter whose token drives the cascade ($assigned is constant false, the other caller vars hold no value); gate on instance state (e.g. a field an action wrote), or pin executing identities with \`roles\`` : site.policy === "caller-bound" ? `${site.label} reads $${name} — $params (the firing action's args) is bound only while the action's effect bindings and where-op \`where\`s evaluate; this site never binds it, so the condition could never pass. Bind $params in an effect binding or a where-op instead, or gate on a field an action wrote` : site.policy === "triggered-payload" && name === "params" ? `${site.label} reads $params — a cascade-fired action has no caller to supply args, so $params never holds a value in its payload; read fields or effect outputs instead` : `${site.label} reads $can — $can (the caller's grants) is bound only in the caller-bound projection (action filters, requirements, editable predicates) and never holds a value in cascade conditions; move the check to one of those sites or drop $can`;
 }
@@ -2187,7 +2360,7 @@ function callerVarMessage(site, name) {
 function conditionSites(def) {
     const sites = [], workflowLayer = {
         scope: "workflow",
-        names: entryNames(def.fields)
+        entries: entryMap(def.fields)
     };
     collectEditableSites({
         entries: def.fields,
@@ -2208,10 +2381,10 @@ function conditionSites(def) {
 function collectStageConditionSites({stage: stage, i: i, workflowLayer: workflowLayer, sites: sites}) {
     const stageLayer = {
         scope: "stage",
-        names: entryNames(stage.fields)
+        entries: entryMap(stage.fields)
     }, stageFields2 = [ stageLayer, workflowLayer ], editableWindow = [ stageLayer, workflowLayer, ...(stage.activities ?? []).map(activity => ({
         scope: "activity",
-        names: entryNames(activity.fields)
+        entries: entryMap(activity.fields)
     })) ];
     for (const [k, t] of (stage.transitions ?? []).entries()) sites.push({
         groq: t.when,
@@ -2225,6 +2398,7 @@ function collectStageConditionSites({stage: stage, i: i, workflowLayer: workflow
         path: [ "stages", i, "fields" ],
         labelPrefix: `stage "${stage.name}"`,
         fields: editableWindow,
+        unionWindow: !0,
         sites: sites
     });
     for (const [name, editable] of Object.entries(stage.editable ?? {})) typeof editable == "string" && sites.push({
@@ -2232,23 +2406,28 @@ function collectStageConditionSites({stage: stage, i: i, workflowLayer: workflow
         path: [ "stages", i, "editable", name ],
         label: `stage "${stage.name}" editable override "${name}"`,
         policy: "caller-bound",
-        fields: editableWindow
+        fields: editableWindow,
+        unionWindow: !0
     });
     for (const [j, activity] of (stage.activities ?? []).entries()) collectActivityConditionSites({
         activity: activity,
         path: [ "stages", i, "activities", j ],
         stageFields: stageFields2,
+        workflowLayer: workflowLayer,
         sites: sites
     });
 }
 
-function collectEditableSites({entries: entries, path: path, labelPrefix: labelPrefix, fields: fields, sites: sites}) {
+function collectEditableSites({entries: entries, path: path, labelPrefix: labelPrefix, fields: fields, unionWindow: unionWindow, sites: sites}) {
     for (const [n, entry] of (entries ?? []).entries()) typeof entry.editable == "string" && sites.push({
         groq: entry.editable,
         path: [ ...path, n, "editable" ],
         label: `${labelPrefix} field "${entry.name}" editable`,
         policy: "caller-bound",
-        fields: fields
+        fields: fields,
+        ...unionWindow === !0 ? {
+            unionWindow: !0
+        } : {}
     });
 }
 
@@ -2260,14 +2439,15 @@ function collectOpWhereSites({ops: ops, path: path, label: label, policy: policy
         ...policy !== void 0 ? {
             policy: policy
         } : {},
+        bindsRow: !0,
         fields: fields
     });
 }
 
-function collectActivityConditionSites({activity: activity, path: path, stageFields: stageFields2, sites: sites}) {
+function collectActivityConditionSites({activity: activity, path: path, stageFields: stageFields2, workflowLayer: workflowLayer, sites: sites}) {
     const fields = [ {
         scope: "activity",
-        names: entryNames(activity.fields)
+        entries: entryMap(activity.fields)
     }, ...stageFields2 ];
     activity.filter !== void 0 && sites.push({
         groq: activity.filter,
@@ -2293,11 +2473,12 @@ function collectActivityConditionSites({activity: activity, path: path, stageFie
         activity: activity,
         path: path,
         fields: fields,
+        workflowLayer: workflowLayer,
         sites: sites
     });
 }
 
-function collectActionConditionSites({activity: activity, path: path, fields: fields, sites: sites}) {
+function collectActionConditionSites({activity: activity, path: path, fields: fields, workflowLayer: workflowLayer, sites: sites}) {
     for (const [a, action] of (activity.actions ?? []).entries()) {
         const actionPath = [ ...path, "actions", a ], cascadeFired = action.when !== void 0;
         action.when !== void 0 && sites.push({
@@ -2332,12 +2513,13 @@ function collectActionConditionSites({activity: activity, path: path, fields: fi
             action: action,
             path: actionPath,
             fields: fields,
+            workflowLayer: workflowLayer,
             sites: sites
         });
     }
 }
 
-function collectSpawnSites({action: action, path: path, fields: fields, sites: sites}) {
+function collectSpawnSites({action: action, path: path, fields: fields, workflowLayer: workflowLayer, sites: sites}) {
     const spawn = action.spawn;
     if (spawn === void 0) return;
     const spawnPath = [ ...path, "spawn" ];
@@ -2346,13 +2528,17 @@ function collectSpawnSites({action: action, path: path, fields: fields, sites: s
         path: [ ...spawnPath, "forEach" ],
         label: `action "${action.name}".spawn.forEach`,
         policy: "cascade",
-        fields: fields
+        fields: [ workflowLayer ],
+        windowNote: "spawn.forEach evaluates against workflow-scope $fields only — stage/activity fields are never bound at discovery time"
     });
-    for (const [group, record] of [ [ "with", spawn.with ], [ "context", spawn.context ] ]) for (const [key, groq2] of Object.entries(record ?? {})) sites.push({
+    for (const [group, record, bindsRow] of [ [ "with", spawn.with, !0 ], [ "context", spawn.context, !1 ] ]) for (const [key, groq2] of Object.entries(record ?? {})) sites.push({
         groq: groq2,
         path: [ ...spawnPath, group, key ],
         label: `action "${action.name}".spawn.${group} "${key}"`,
         policy: "triggered-payload",
+        ...bindsRow ? {
+            bindsRow: !0
+        } : {},
         fields: fields
     });
 }
@@ -2426,7 +2612,7 @@ function checkStart(def, issues) {
     if (def.start !== void 0 && (def.lifecycle === "child" && issues.push({
         path: [ "start" ],
         message: "a spawn-only (lifecycle 'child') definition declares `start` — children are instantiated by a parent's `spawn`, never started standalone, so the block would never apply. Remove `start`, or drop `lifecycle: 'child'`"
-    }), checkStartFilterReads(def, issues), def.start.kind === "autonomous")) for (const [n, entry] of (def.fields ?? []).entries()) entry.required !== !0 || isSubjectEntry(entry) || issues.push({
+    }), checkStartFilterReads(def, issues), checkStartAllowedReads(def, issues), def.start.kind === "autonomous")) for (const [n, entry] of (def.fields ?? []).entries()) entry.required !== !0 || isSubjectEntry(entry) || issues.push({
         path: [ "fields", n, "required" ],
         message: `start.kind 'autonomous' means runs are initiated by a system reacting to a document, so every required input must be derivable from that triggering document — required entry "${entry.name}" (kind "${entry.type}") is not a document reference. Make it optional, seed it another way (query/literal), or declare it doc.ref / doc.refs`
     });
@@ -2434,15 +2620,43 @@ function checkStart(def, issues) {
 
 function checkStartFilterReads(def, issues) {
     const filter = def.start?.filter;
-    if (filter === void 0) return;
-    const bindable = new Set((def.fields ?? []).filter(isInputSourced).map(entry => entry.name)), declared = new Set((def.fields ?? []).map(entry => entry.name));
-    for (const name of conditionFieldReadNames(filter)) bindable.has(name) || issues.push({
+    filter !== void 0 && (conditionParameterNames(filter).has("fields") && issues.push({
         path: [ "start", "filter" ],
-        message: declared.has(name) ? `start.filter reads $fields.${name}, but "${name}" is not an \`input\`-sourced entry — $fields binds only the caller's input entries (query/literal/fieldRead entries resolve at materialisation, after any read-side evaluation), so the read is GROQ null and the filter silently never passes. Bindable (input) fields: ${knownList(bindable)}` : `start.filter reads $fields.${name}, but no workflow-scope field entry named "${name}" is declared — $fields binds only the caller's input entries, so the read is GROQ null and the filter silently never passes. Bindable (input) fields: ${knownList(bindable)}`
-    });
-    readsRootDocument(filter) && !(def.fields ?? []).some(isSubjectEntry) && issues.push({
+        message: "start.filter reads $fields, but the filter is browse-time-pure — a start surface evaluates it per document, before any inputs exist, so $fields cannot be bound. Move the input-dependent rule to start.allowed, the start-time permission predicate that binds $fields and is enforced by startInstance"
+    }), readsRootDocument(filter) && !(def.fields ?? []).some(isSubjectEntry) && issues.push({
         path: [ "start", "filter" ],
-        message: "start.filter reads the candidate document (its root), but the definition declares no required subject entry (a required doc.ref / doc.refs input) — a read surface would never have a document to bind as root, so the filter could never pass. Declare a required subject entry, or gate on $fields / the dataset instead"
+        message: "start.filter reads the candidate document (its root), but the definition declares no required subject entry (a required doc.ref / doc.refs input) — a read surface would never have a document to bind as root, so every root read is GROQ null and the filter silently misevaluates. Declare a required subject entry, or gate on the dataset instead"
+    }));
+}
+
+function checkStartAllowedReads(def, issues) {
+    const allowed = def.start?.allowed;
+    if (allowed === void 0) return;
+    const bindable = new Map((def.fields ?? []).filter(isInputSourced).map(entry => [ entry.name, entry ])), declared = new Set((def.fields ?? []).map(entry => entry.name)), nullVerdict = `so the read is GROQ null and null semantics decide the verdict (refuse-all or vacuously-allow, by the expression's shape), never the caller's real input. Bindable (input) fields: ${knownList(bindable.keys())}`;
+    for (const read of conditionFieldReads(allowed)) {
+        const entry = bindable.get(read.name);
+        if (entry === void 0) {
+            issues.push({
+                path: [ "start", "allowed" ],
+                message: declared.has(read.name) ? `start.allowed reads $fields.${read.name}, but "${read.name}" is not an \`input\`-sourced entry — $fields binds only the caller's input entries (query/literal/fieldRead entries resolve at materialisation, after the start gate), ${nullVerdict}` : `start.allowed reads $fields.${read.name}, but no workflow-scope field entry named "${read.name}" is declared — $fields binds only the caller's input entries, ${nullVerdict}`
+            });
+            continue;
+        }
+        pushFieldReadPathIssue({
+            where: "start.allowed",
+            read: {
+                field: read.name,
+                path: read.path
+            },
+            target: entry,
+            path: [ "start", "allowed" ],
+            issues: issues,
+            nodes: START_ALLOWED_VALUE_NODES
+        });
+    }
+    readsRootDocument(allowed) && issues.push({
+        path: [ "start", "allowed" ],
+        message: "start.allowed reads the candidate document as its root, but no root ever binds in the start-allowed context — startInstance holds inputs, not a loaded document, so the read is GROQ null and null semantics decide the verdict, never the workflow's real state. Read the subject as $fields.<entry> (its GDR URI is $fields.<entry>.id); a per-document visibility rule belongs in start.filter"
     });
 }
 
@@ -2553,39 +2767,80 @@ function checkGroupMembership({group: group, reachable: reachable, path: path, l
 }
 
 function checkConditionFieldReads(def, issues) {
-    const everywhere = allDeclaredFieldNames(def);
-    for (const site of conditionSites(def)) for (const name of conditionFieldReadNames(site.groq)) fieldVisibleAtSite({
+    const everywhere = allDeclaredFieldEntries(def);
+    for (const site of conditionSites(def)) checkSiteFieldReads({
         site: site,
-        name: name,
-        everywhere: everywhere
-    }) || issues.push({
-        path: site.path,
-        message: undeclaredFieldReadMessage(site, name)
+        everywhere: everywhere,
+        issues: issues
     });
-    for (const [name, groq2] of Object.entries(def.predicates ?? {})) for (const read of conditionFieldReadNames(groq2)) everywhere.has(read) || issues.push({
-        path: [ "predicates", name ],
-        message: noFieldAnywhereMessage(`predicate "${name}"`, read)
+    for (const [name, groq2] of Object.entries(def.predicates ?? {})) checkSiteFieldReads({
+        site: {
+            groq: groq2,
+            path: [ "predicates", name ],
+            label: `predicate "${name}"`,
+            fields: "context-dependent"
+        },
+        everywhere: everywhere,
+        issues: issues
     });
 }
 
-function allDeclaredFieldNames(def) {
-    const names = /* @__PURE__ */ new Set;
-    for (const {entries: entries} of fieldScopes(def)) for (const entry of entries ?? []) names.add(entry.name);
-    return names;
+function checkSiteFieldReads({site: site, everywhere: everywhere, issues: issues}) {
+    for (const read of conditionFieldReads(site.groq)) {
+        const targets = readTargets({
+            site: site,
+            read: read,
+            everywhere: everywhere
+        });
+        if (targets === "undeclared") {
+            issues.push({
+                path: site.path,
+                message: undeclaredFieldReadMessage(site, read.name)
+            });
+            continue;
+        }
+        const path = read.path;
+        path !== void 0 && (targets.some(target => fieldValuePathIssue({
+            target: target,
+            path: path
+        }) === void 0) || pushFieldReadPathIssue({
+            where: site.label,
+            read: {
+                field: read.name,
+                path: path
+            },
+            target: targets[0],
+            path: site.path,
+            issues: issues
+        }));
+    }
+}
+
+function readTargets({site: site, read: read, everywhere: everywhere}) {
+    if (site.fields === "context-dependent") return everywhere.get(read.name) ?? "undeclared";
+    const layers = site.fields.filter(layer => layer.entries.has(read.name));
+    if (layers.length === 0) return "undeclared";
+    const entries = layers.map(layer => layer.entries.get(read.name));
+    return site.unionWindow === !0 ? entries : [ entries[0] ];
 }
 
-function fieldVisibleAtSite({site: site, name: name, everywhere: everywhere}) {
-    return site.fields === "context-dependent" ? everywhere.has(name) : site.fields.some(layer => layer.names.has(name));
+function allDeclaredFieldEntries(def) {
+    const declared = /* @__PURE__ */ new Map;
+    for (const {entries: entries} of fieldScopes(def)) for (const entry of entries ?? []) {
+        const list = declared.get(entry.name);
+        list === void 0 ? declared.set(entry.name, [ entry ]) : list.push(entry);
+    }
+    return declared;
 }
 
 function noFieldAnywhereMessage(label, name) {
-    return `${label} reads $fields.${name}, but no field entry named "${name}" is declared anywhere in the definition — the read evaluates to GROQ null, so the condition silently fails closed`;
+    return `${label} reads $fields.${name}, but no field entry named "${name}" is declared anywhere in the definition — the read evaluates to GROQ null, so the condition silently misevaluates`;
 }
 
 function undeclaredFieldReadMessage(site, name) {
     if (site.fields === "context-dependent") return noFieldAnywhereMessage(site.label, name);
-    const visible = site.fields.flatMap(layer => [ ...layer.names ].map(n => `${layer.scope}:${n}`));
-    return `${site.label} reads $fields.${name}, but no field entry named "${name}" is lexically visible here — the read evaluates to GROQ null, so the condition silently fails closed. Visible: ${visible.join(", ") || "(none)"}`;
+    const visible = site.fields.flatMap(layer => [ ...layer.entries.keys() ].map(n => `${layer.scope}:${n}`)), window = site.windowNote === void 0 ? `no field entry named "${name}" is lexically visible here` : `"${name}" is not in this site's window (${site.windowNote})`;
+    return `${site.label} reads $fields.${name}, but ${window} — the read evaluates to GROQ null, so the condition silently misevaluates. Visible: ${visible.join(", ") || "(none)"}`;
 }
 
 function checkFieldReadSeeds(def, issues) {
@@ -2687,7 +2942,7 @@ function checkFieldReadOpValues(def, issues) {
         ops: site.ops,
         path: site.path,
         label: site.label,
-        activityNames: entryNames(site.activity.fields)
+        activityEntries: entryMap(site.activity.fields)
     });
 }
 
@@ -2707,7 +2962,7 @@ function fieldReadsIn(value, path) {
     } ] : value.type !== "object" ? [] : Object.entries(value.fields).flatMap(([key, sub]) => fieldReadsIn(sub, [ ...path, "fields", key ]));
 }
 
-function checkOpFieldRead({read: read, where: where, path: path, workflowEntries: workflowEntries, stageEntries: stageEntries, activityNames: activityNames, issues: issues}) {
+function checkOpFieldRead({read: read, where: where, path: path, workflowEntries: workflowEntries, stageEntries: stageEntries, activityEntries: activityEntries, issues: issues}) {
     const hosts = [ {
         scope: "stage",
         entries: stageEntries
@@ -2722,7 +2977,7 @@ function checkOpFieldRead({read: read, where: where, path: path, workflowEntries
                 read: read,
                 where: where,
                 hosts: hosts,
-                activityNames: activityNames
+                activityEntries: activityEntries
             })
         });
         return;
@@ -2736,8 +2991,8 @@ function checkOpFieldRead({read: read, where: where, path: path, workflowEntries
     });
 }
 
-function opFieldReadMissMessage({read: read, where: where, hosts: hosts, activityNames: activityNames}) {
-    const searched = read.scope === void 0 ? "stage or workflow scope" : `${read.scope} scope`, activityHint = activityNames?.has(read.field) ? ` "${read.field}" is an activity-scope field, and op-time field reads resolve against stage and workflow scopes only — declare it at stage scope to read it from an op.` : "", known = hosts.flatMap(host => host.entries.map(entry => `${host.scope}:${entry.name}`));
+function opFieldReadMissMessage({read: read, where: where, hosts: hosts, activityEntries: activityEntries}) {
+    const searched = read.scope === void 0 ? "stage or workflow scope" : `${read.scope} scope`, activityHint = activityEntries?.has(read.field) ? ` "${read.field}" is an activity-scope field, and op-time field reads resolve against stage and workflow scopes only — declare it at stage scope to read it from an op.` : "", known = hosts.flatMap(host => host.entries.map(entry => `${host.scope}:${entry.name}`));
     return `${where} reads field "${read.field}", which is not declared at ${searched} — the read resolves to undefined at op time, so the write silently lands empty.${activityHint} Known: ${known.join(", ") || "(none)"}`;
 }
 
@@ -2845,11 +3100,14 @@ function checkGuardFieldRead({name: name, valuePath: valuePath, where: where, pa
     });
 }
 
-function pushFieldReadPathIssue({where: where, read: read, target: target, path: path, issues: issues}) {
+function pushFieldReadPathIssue({where: where, read: read, target: target, path: path, issues: issues, nodes: nodes}) {
     if (read.path === void 0) return;
     const pathIssue = fieldValuePathIssue({
         target: target,
-        path: read.path
+        path: read.path,
+        ...nodes ? {
+            nodes: nodes
+        } : {}
     });
     pathIssue !== void 0 && issues.push({
         path: path,
@@ -2920,22 +3178,26 @@ const SCALAR = {
         kind: "rows",
         of: shape.of ?? []
     })
+}, START_ALLOWED_VALUE_NODES = {
+    ...VALUE_NODES,
+    "doc.ref": () => GDR_VALUE
 };
 
-function valueNodeFor(shape) {
-    return Object.hasOwn(VALUE_NODES, shape.type) ? VALUE_NODES[shape.type](shape) : void 0;
+function valueNodeFor(shape, nodes) {
+    return Object.hasOwn(nodes, shape.type) ? nodes[shape.type](shape) : void 0;
 }
 
 const INDEX_SEGMENT = /^\d+$/;
 
-function stepIntoValueNode(node, segment) {
+function stepIntoValueNode(args) {
+    const {node: node, segment: segment, nodes: nodes} = args;
     switch (node.kind) {
       case "scalar":
         return "the value is a scalar with no sub-paths";
 
       case "object":
         {
-            const sub = node.fields.find(f => f.name === segment), next = sub === void 0 ? void 0 : valueNodeFor(sub);
+            const sub = node.fields.find(f => f.name === segment), next = sub === void 0 ? void 0 : valueNodeFor(sub, nodes);
             return next !== void 0 ? next : `an object value has sub-fields ${knownList(node.fields.map(f => f.name))} — "${segment}" is not one`;
         }
 
@@ -2956,18 +3218,24 @@ function stepIntoValueNode(node, segment) {
     }
 }
 
-function fieldValuePathIssue({target: target, path: path}) {
-    let node = valueNodeFor(target);
+function fieldValuePathIssue({target: target, path: path, nodes: nodes = VALUE_NODES}) {
+    let node = valueNodeFor(target, nodes);
     if (node === void 0) return `"${String(target.type)}" is not a known field kind`;
     for (const segment of path.split(".")) {
-        const next = stepIntoValueNode(node, segment);
+        const next = stepIntoValueNode({
+            node: node,
+            segment: segment,
+            nodes: nodes
+        });
         if (typeof next == "string") return `at segment "${segment}": ${next}`;
         node = next;
     }
 }
 
 function checkWorkflowInvariants(def) {
-    const issues = [], stageNames = checkStages(def, issues);
+    const issues = [];
+    checkDefinitionName(def, issues);
+    const stageNames = checkStages(def, issues);
     return checkInitialStage({
         def: def,
         stageNames: stageNames,
@@ -2982,7 +3250,7 @@ function checkWorkflowInvariants(def) {
         issues: issues
     }), checkEffectNames(def, issues), checkGuardNames(def, issues), checkFieldEntryNames(def, issues), 
     checkRequiredField(def, issues), checkStart(def, issues), checkPredicates(def, issues), 
-    checkUnboundCallerVars(def, issues), checkConditionFieldReads(def, issues), checkFieldReadSeeds(def, issues), 
+    checkUnboundConditionVars(def, issues), checkConditionFieldReads(def, issues), checkFieldReadSeeds(def, issues), 
     checkFieldReadOpValues(def, issues), checkUpdateWhereOps(def, issues), checkGuardFieldReads(def, issues), 
     checkAssigneesEntries(def, issues), checkActivityTerminalPaths(def, issues), checkTerminalStageActivities(def, issues), 
     checkTriggeredActionParams(def, issues), checkStoredRolesPlacement(def, issues), 
@@ -2991,8 +3259,12 @@ function checkWorkflowInvariants(def) {
 
 exports.ACTIVITY_KINDS = ACTIVITY_KINDS;
 
+exports.ACTIVITY_STATUSES = ACTIVITY_STATUSES;
+
 exports.ACTOR_KINDS = ACTOR_KINDS;
 
+exports.ActorShape = ActorShape;
+
 exports.AuthoringActionSchema = AuthoringActionSchema;
 
 exports.AuthoringActivitySchema = AuthoringActivitySchema;
@@ -3035,6 +3307,10 @@ exports.EffectSchema = EffectSchema;
 
 exports.FIELD_READ = FIELD_READ;
 
+exports.FIELD_SCOPES = FIELD_SCOPES;
+
+exports.FIELD_VALUE_KINDS = FIELD_VALUE_KINDS;
+
 exports.FILTER_SCOPE_VARS = FILTER_SCOPE_VARS;
 
 exports.FieldValueShapeError = FieldValueShapeError;
@@ -3043,14 +3319,26 @@ exports.GROUP_KINDS = GROUP_KINDS;
 
 exports.GUARD_PREDICATE_VARS = GUARD_PREDICATE_VARS;
 
+exports.GdrShape = GdrShape;
+
 exports.GroupSchema = GroupSchema;
 
 exports.InstanceNotFoundError = InstanceNotFoundError;
 
+exports.IsoTimestamp = IsoTimestamp;
+
+exports.MUTATION_GUARD_ACTIONS = MUTATION_GUARD_ACTIONS;
+
+exports.NonEmptyString = NonEmptyString;
+
+exports.PersistedDocShapeError = PersistedDocShapeError;
+
 exports.RESERVED_CONDITION_VARS = RESERVED_CONDITION_VARS;
 
 exports.RESOURCE_ALIAS_NAME_SOURCE = RESOURCE_ALIAS_NAME_SOURCE;
 
+exports.START_ALLOWED_VARS = START_ALLOWED_VARS;
+
 exports.START_FILTER_VARS = START_FILTER_VARS;
 
 exports.StoredFieldOpSchema = StoredFieldOpSchema;
@@ -3101,6 +3389,8 @@ exports.evaluatePredicates = evaluatePredicates;
 
 exports.extractDocumentId = extractDocumentId;
 
+exports.fieldValueSchemas = fieldValueSchemas;
+
 exports.formatIssuePath = formatIssuePath;
 
 exports.formatIssues = formatIssues;
@@ -3133,6 +3423,8 @@ exports.isInputSourced = isInputSourced;
 
 exports.isNotesEntry = isNotesEntry;
 
+exports.isParseableInstant = isParseableInstant;
+
 exports.isStartableDefinition = isStartableDefinition;
 
 exports.isSubjectEntry = isSubjectEntry;
@@ -3151,6 +3443,8 @@ exports.parseGdr = parseGdr;
 
 exports.parseOrThrow = parseOrThrow;
 
+exports.parsePersistedDoc = parsePersistedDoc;
+
 exports.parseResourceGdr = parseResourceGdr;
 
 exports.parseStoredDefinition = parseStoredDefinition;
@@ -3187,6 +3481,8 @@ exports.runGroq = runGroq;
 
 exports.sameResource = sameResource;
 
+exports.schemaTreeShape = schemaTreeShape;
+
 exports.selfGdr = selfGdr;
 
 exports.startKindOf = startKindOf;
@@ -3197,6 +3493,10 @@ exports.toBareId = toBareId;
 
 exports.toPhysicalGdr = toPhysicalGdr;
 
+exports.tolerantEntries = tolerantEntries;
+
+exports.tolerantObject = tolerantObject;
+
 exports.tryParseGdr = tryParseGdr;
 
 exports.validateFieldAppendItem = validateFieldAppendItem;