@sanity/workflow-engine 0.19.0 → 0.21.0

package/dist/_chunks-cjs/invariants.cjs

@@ -1,6 +1,6 @@
 "use strict";
 
-var v = require("valibot"), groqConditionDescribe = require("@sanity/groq-condition-describe"), groqJs = require("groq-js");
+var v = require("valibot"), groqConditionDescribe = require("@sanity/groq-condition-describe"), groqJs = require("groq-js"), idUtils = require("@sanity/id-utils");
 
 function _interopNamespaceCompat(e) {
     if (e && typeof e == "object" && "default" in e) return e;
@@ -115,12 +115,33 @@ function isUnprimed(instance) {
 
 function parseDefinitionSnapshotValue(instance) {
     try {
-        return JSON.parse(instance.definitionSnapshot);
+        return normalizeLegacyActivityRequirements(JSON.parse(instance.definitionSnapshot));
     } catch (err) {
         rethrowWithContext(err, `Failed to parse definitionSnapshot on instance "${instance._id}"`);
     }
 }
 
+function normalizeLegacyActivityRequirements(value) {
+    for (const stage of arrayMember(value, "stages")) for (const activity of arrayMember(stage, "activities")) normalizeLegacyRequirementMap(activity);
+    return value;
+}
+
+function arrayMember(value, key) {
+    if (typeof value != "object" || value === null) return [];
+    const member = value[key];
+    return Array.isArray(member) ? member : [];
+}
+
+function normalizeLegacyRequirementMap(value) {
+    if (typeof value != "object" || value === null) return;
+    const activity = value, requirements = activity.requirements;
+    typeof requirements != "object" || requirements === null || Array.isArray(requirements) || (activity.requirements = Object.entries(requirements).map(([name, query]) => ({
+        type: "groq",
+        name: name,
+        query: query
+    })));
+}
+
 function parseDefinitionSnapshot(instance) {
     return parseDefinitionSnapshotValue(instance);
 }
@@ -129,7 +150,7 @@ function parentRef(instance) {
     return instance.ancestors.at(-1);
 }
 
-const DATA_MODEL_VERSION = 3, DATA_MODEL_MIN_READER = 2, READER_MODEL_ROLLOUT_URL = "https://github.com/sanity-io/workflows/blob/main/docs/reader-model-rollout.md";
+const DATA_MODEL_VERSION = 4, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://github.com/sanity-io/workflows/blob/main/docs/reader-model-rollout.md";
 
 class ReaderModelAcknowledgementError extends WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -139,7 +160,7 @@ class ReaderModelAcknowledgementError extends WorkflowError {
     documentationUrl=READER_MODEL_ROLLOUT_URL;
     constructor(expectedMinReaderModel, context = "Deployment") {
         const expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
-        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}. Dependency upgrades can change writer compatibility. Upgrade all readers and Functions before accepting a higher floor; after verifying the rollout, change the literal in deployment configuration. ${READER_MODEL_ROLLOUT_URL}`), 
+        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}. Dependency upgrades can change writer compatibility. Upgrade all readers and Functions before accepting a higher floor; after verifying the rollout, change the literal in deployment configuration. Instances written before the new floor may stop matching user-identity queries, and older readers refuse documents this engine touches — a prerelease deployment with no data worth migrating can reset every engine-owned document with \`sanity-workflows nuke\` and start fresh. ${READER_MODEL_ROLLOUT_URL}`), 
         this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel;
     }
 }
@@ -204,6 +225,22 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "additive",
     applicability: "detectable",
     summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
+}), Object.freeze({
+    id: "classified-principal-ids",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "unconditional",
+    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
+}), Object.freeze({
+    id: "readiness-requirements",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Start and activity readiness use named polymorphic requirement arrays."
 }) ]);
 
 function recordOf(value) {
@@ -264,6 +301,11 @@ function hasClaimTokens(document) {
     });
 }
 
+function hasReadinessRequirements(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
+}
+
 const featureDetectors = {
     "governed-model-stamps": () => !0,
     "subject-field-kind": document => hasFieldKind(document, "subject"),
@@ -271,7 +313,9 @@ const featureDetectors = {
     "action-semantics": hasActionSemantics,
     "inclusive-scalar-bounds": hasScalarValidation,
     "progress-field-kind": document => hasFieldKind(document, "progress"),
-    "effect-claim-tokens": hasClaimTokens
+    "effect-claim-tokens": hasClaimTokens,
+    "classified-principal-ids": () => !0,
+    "readiness-requirements": hasReadinessRequirements
 };
 
 function requiredModelFeatures(documentType, document) {
@@ -285,7 +329,7 @@ function requiredReaderModel(documentType, document) {
 function modelStampFor(args) {
     return {
         modelVersion: DATA_MODEL_VERSION,
-        minReaderModel: Math.max(args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
+        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
     };
 }
 
@@ -358,6 +402,21 @@ function andConditions(parts) {
 
 const KNOWN_SCHEMES = /* @__PURE__ */ new Set([ "dataset", "canvas", "media-library", "dashboard" ]), KNOWN_SCHEMES_TEXT = [ ...KNOWN_SCHEMES ].join(", ");
 
+class VersionSpecificDatasetGdrError extends Error {
+    documentId;
+    stableDocumentId;
+    constructor(documentId, uri) {
+        const stableDocumentId = idUtils.getPublishedId(documentId);
+        super(`Invalid GDR "${uri}": dataset document ID "${documentId}" identifies a stored draft or release version. Use the stable document ID "${stableDocumentId}" and select drafts/releases through the workflow perspective.`), 
+        this.name = "VersionSpecificDatasetGdrError", this.documentId = documentId, this.stableDocumentId = stableDocumentId;
+    }
+}
+
+function assertStableDatasetDocumentId(documentId, uri) {
+    const sanityId = documentId;
+    if (!(!idUtils.isDraftId(sanityId) && !idUtils.isVersionId(sanityId))) throw new VersionSpecificDatasetGdrError(documentId, uri);
+}
+
 function parseGdr(uri) {
     const colon = uri.indexOf(":");
     if (colon < 0) throw new Error(`Invalid GDR "${uri}": must be a URI of form "<scheme>:<...id-parts>". Known schemes: ${KNOWN_SCHEMES_TEXT}.`);
@@ -367,11 +426,12 @@ function parseGdr(uri) {
     if (parts.some(part => part.length === 0)) throw new Error(`Invalid GDR "${uri}": id parts must be non-empty (no leading, trailing, or doubled ":").`);
     if (scheme === "dataset") {
         if (parts.length !== 3) throw new Error(`Invalid GDR "${uri}": dataset scheme requires <projectId>:<dataset>:<documentId> (3 parts after scheme); got ${parts.length}.`);
-        return {
+        const documentId = parts[2];
+        return assertStableDatasetDocumentId(documentId, uri), {
             scheme: "dataset",
             projectId: parts[0],
             dataset: parts[1],
-            documentId: parts[2]
+            documentId: documentId
         };
     }
     if (parts.length !== 2) throw new Error(`Invalid GDR "${uri}": ${scheme} scheme requires <resourceId>:<documentId> (2 parts after scheme); got ${parts.length}.`);
@@ -391,7 +451,11 @@ function tryParseGdr(uri) {
 }
 
 function gdrUri(parts) {
-    return parts.scheme === "dataset" ? `dataset:${parts.projectId}:${parts.dataset}:${parts.documentId}` : `${parts.scheme}:${parts.resourceId}:${parts.documentId}`;
+    if (parts.scheme === "dataset") {
+        const uri = `dataset:${parts.projectId}:${parts.dataset}:${parts.documentId}`;
+        return assertStableDatasetDocumentId(parts.documentId, uri), uri;
+    }
+    return `${parts.scheme}:${parts.resourceId}:${parts.documentId}`;
 }
 
 function extractDocumentId(gdrUriString) {
@@ -794,8 +858,8 @@ function desugarStart(start) {
         ...start.filter !== void 0 ? {
             filter: start.filter
         } : {},
-        ...start.allowed !== void 0 ? {
-            allowed: start.allowed
+        ...start.requirements !== void 0 ? {
+            requirements: start.requirements
         } : {}
     };
 }
@@ -1557,7 +1621,7 @@ const ACTION_SEMANTICS = [ "decision.accept", "decision.decline" ], FIELD_SCOPES
     binding: "always",
     label: "the spawned subworkflows",
     description: "Every row of the instance's subworkflow registry, faceted by `activity`/`action`/`definition`/`rowKey`/`status` (`'active'|'done'|'aborted'`) with `current` marking the open stage entry's cohort and `stage` the child's current stage. Usable anywhere — transition `when`s, requirements, any stage's gates; the settled gate is `count($subworkflows[activity == <name> && current && status == 'active']) == 0`."
-} ], SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR = "subjectHasInFlightInstance", RESERVED_CONDITION_VARS = [ ...CONDITION_VARS.map(v2 => v2.name), SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR ], FILTER_SCOPE_VARS = CONDITION_VARS.filter(v2 => v2.binding === "always").map(v2 => v2.name), CALLER_BOUND_VARS = CONDITION_VARS.filter(v2 => v2.binding === "caller").map(v2 => v2.name), START_FILTER_VARS = [ {
+} ], RESERVED_CONDITION_VARS = CONDITION_VARS.map(v2 => v2.name), FILTER_SCOPE_VARS = CONDITION_VARS.filter(v2 => v2.binding === "always").map(v2 => v2.name), CALLER_BOUND_VARS = CONDITION_VARS.filter(v2 => v2.binding === "caller").map(v2 => v2.name), START_FILTER_VARS = [ {
     name: "tag",
     label: "this engine tag",
     description: "The engine's tag partition — scope `*[...]` instance scans with `tag == $tag`."
@@ -1569,11 +1633,7 @@ const ACTION_SEMANTICS = [ "decision.accept", "decision.decline" ], FIELD_SCOPES
     name: "now",
     label: "the current time",
     description: "The ISO clock reading of the evaluating engine."
-}, {
-    name: SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR,
-    label: "the subject already has an in-flight workflow",
-    description: "Whether any instance in this engine tag, across all definitions, has the same resource-qualified subject and no `completedAt`. Advisory under concurrent starts."
-} ], START_ALLOWED_VARS = [ ...START_FILTER_VARS, {
+} ], START_REQUIREMENT_VARS = [ ...START_FILTER_VARS, {
     name: "fields",
     label: "the start's input fields",
     description: "The caller's input entries by name (`initialFields` — at `startInstance`, the values the start would seed; at a pre-flight, the values gathered so far, so a read of a not-yet-supplied entry is GROQ null). Document references bind as GDR envelopes — `$fields.<entry>.id` is the GDR URI, never a string authors assemble — a singular `doc.ref` or `subject` included (nothing hydrates at the gate or the pre-flight). Pathed reads are deploy-checked against these envelope shapes."
@@ -1758,6 +1818,37 @@ function isNotesEntry(entry) {
     return columns !== void 0 && columns.has("body") && columns.has("actor") && columns.has("at");
 }
 
+const ANONYMOUS_IDENTITY = "<anonymous>", SYSTEM_IDENTITY = "<system>", E_PREFIXED_PROJECT_ID = /^e-(.+)$/;
+
+function classifyPrincipalId(id) {
+    if (id === ANONYMOUS_IDENTITY || id === SYSTEM_IDENTITY) return {
+        namespace: "sentinel"
+    };
+    if (id.startsWith("g")) return {
+        namespace: "global",
+        globalId: id
+    };
+    if (id.startsWith("p-")) return {
+        namespace: "robot",
+        globalId: id
+    };
+    const embeddedGlobal = E_PREFIXED_PROJECT_ID.exec(id)?.[1];
+    return embeddedGlobal !== void 0 ? embeddedGlobal.startsWith("g") ? {
+        namespace: "project",
+        globalId: embeddedGlobal
+    } : {
+        namespace: "unknown"
+    } : id.startsWith("p") ? {
+        namespace: "project"
+    } : {
+        namespace: "unknown"
+    };
+}
+
+function lakePrincipalId(args) {
+    return args.localPrincipalId ?? args.actor.id;
+}
+
 class FieldValueShapeError extends WorkflowError {
     entryType;
     entryName;
@@ -1798,11 +1889,11 @@ function checkChoiceList(args) {
     const {entryType: entryType, options: options, validation: validation} = args;
     if (options === void 0) return;
     if (!CHOICE_KINDS.has(entryType)) return [ `\`options\` is not valid on "${entryType}" values` ];
-    const kind = normalizedChoiceKind(entryType), issues = options.list.flatMap((option, index) => checkValueAgainst({
+    const kind = normalizedChoiceKind(entryType), issues = options.list.flatMap((option, index) => issuesOf(checkValueAgainst({
         entryType: kind,
         value: option.value,
         validation: validation
-    }, valueSchemas)?.map(issue => `at options.list.${index}.value: ${issue}`) ?? []), seen = /* @__PURE__ */ new Set;
+    }, valueSchemas))?.map(issue => `at options.list.${index}.value: ${issue}`) ?? []), seen = /* @__PURE__ */ new Set;
     for (const option of options.list) seen.has(option.value) && issues.push(`duplicate option value ${JSON.stringify(option.value)}`), 
     seen.add(option.value);
     return issues.length === 0 ? void 0 : issues;
@@ -1828,8 +1919,27 @@ const fieldValueSchemas = {
     actor: v__namespace.union([ v__namespace.null(), ActorShape ]),
     assignee: v__namespace.union([ v__namespace.null(), AssigneeShape ]),
     assignees: v__namespace.array(AssigneeShape)
-}, valueSchemas = {
+}, WritePrincipalId = v__namespace.pipe(NonEmptyString, v__namespace.rawTransform(({dataset: dataset, addIssue: addIssue}) => {
+    const classified = classifyPrincipalId(dataset.value);
+    return classified.namespace === "global" || classified.namespace === "robot" ? dataset.value : classified.namespace === "project" && classified.globalId !== void 0 ? classified.globalId : (addIssue({
+        message: `principal id "${dataset.value}" is not an account-global user id. Workflow user ids are the global \`sanityUserId\` (or a robot token's id). Resolve project members through your surface's member hook, or /projects/<projectId>/users/<id> → sanityUserId.`
+    }), dataset.value);
+})), ActorWriteShape = tolerantObject()({
+    kind: v__namespace.picklist(ACTOR_KINDS),
+    id: WritePrincipalId,
+    roles: v__namespace.exactOptional(v__namespace.array(v__namespace.string())),
+    onBehalfOf: v__namespace.exactOptional(v__namespace.string())
+}), AssigneeWriteShape = v__namespace.union([ tolerantObject()({
+    type: v__namespace.literal("user"),
+    id: WritePrincipalId
+}), tolerantObject()({
+    type: v__namespace.literal("role"),
+    role: NonEmptyString
+}) ]), valueSchemas = {
     ...fieldValueSchemas,
+    actor: v__namespace.nullable(ActorWriteShape),
+    assignee: v__namespace.nullable(AssigneeWriteShape),
+    assignees: v__namespace.array(AssigneeWriteShape),
     query: v__namespace.any()
 };
 
@@ -1900,7 +2010,7 @@ function wholeValueSchema(args) {
 function appendItemSchema(entryType, shape) {
     if (entryType === "array") return objectSchema(shape.of ?? [], valueSchemas);
     if (entryType === "doc.refs") return GdrShape;
-    if (entryType === "assignees") return AssigneeShape;
+    if (entryType === "assignees") return AssigneeWriteShape;
 }
 
 function rejectedRefTypes(args) {
@@ -1925,7 +2035,7 @@ function gdrTypeOf(item) {
     return typeof t == "string" ? t : void 0;
 }
 
-function checkFieldValue(args) {
+function parseFieldValue(args) {
     return checkValueAgainst(args, valueSchemas);
 }
 
@@ -1935,9 +2045,14 @@ function checkValueAgainst(args, leaf) {
         shape: args,
         leaf: leaf
     });
-    if (schema === void 0) return [ `unknown field entry type ${args.entryType}` ];
+    if (schema === void 0) return {
+        issues: [ `unknown field entry type ${args.entryType}` ]
+    };
     const result = v__namespace.safeParse(schema, args.value);
-    return result.success ? refTypeIssues({
+    if (!result.success) return {
+        issues: formatIssues(result.issues)
+    };
+    const postIssues = refTypeIssues({
         entryType: args.entryType,
         types: args.types,
         value: args.value
@@ -1945,17 +2060,27 @@ function checkValueAgainst(args, leaf) {
         entryType: args.entryType,
         validation: args.validation,
         value: args.value
-    }) : formatIssues(result.issues);
+    });
+    return postIssues !== void 0 ? {
+        issues: postIssues
+    } : {
+        output: result.output
+    };
+}
+
+function issuesOf(check) {
+    return "issues" in check ? check.issues : void 0;
 }
 
 function validateFieldValue(args) {
-    const issues = checkFieldValue(args);
-    if (issues !== void 0) throw new FieldValueShapeError({
+    const check = checkValueAgainst(args, valueSchemas);
+    if ("issues" in check) throw new FieldValueShapeError({
         entryType: args.entryType,
         entryName: args.entryName,
-        issues: issues,
+        issues: check.issues,
         mode: "value"
     });
+    return check.output;
 }
 
 const BARE_ID_SOURCE = "[A-Za-z0-9_][A-Za-z0-9._-]*", BARE_ID_RE = new RegExp(`^${BARE_ID_SOURCE}$`), ALIAS_REF_RE = new RegExp(`^@${RESOURCE_ALIAS_NAME_SOURCE}:${BARE_ID_SOURCE}$`);
@@ -1984,7 +2109,7 @@ const AuthoringRefId = v__namespace.pipe(v__namespace.string(), v__namespace.che
 };
 
 function checkLiteralSeed(args) {
-    return args.value === null ? [ "a literal seed cannot be null — omit `initialValue` to start the field empty" ] : checkValueAgainst(args, seedValueSchemas);
+    return args.value === null ? [ "a literal seed cannot be null — omit `initialValue` to start the field empty" ] : issuesOf(checkValueAgainst(args, seedValueSchemas));
 }
 
 function validateFieldAppendItem(args) {
@@ -2013,13 +2138,15 @@ function validateFieldAppendItem(args) {
         issues: typeIssues,
         mode: "item"
     });
+    return result.output;
 }
 
 function formatIssues(issues, formatMessage = issue => issue.message) {
-    return issues.map(i => {
-        const keys = i.path?.map(p => p.key) ?? [];
-        return `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${formatMessage(i)}`;
-    });
+    const formatOne = (issue, prefix) => {
+        const keys = [ ...prefix, ...issue.path?.map(p => p.key) ?? [] ], sub = issue.issues?.filter(candidate => candidate.expected !== "null");
+        return sub !== void 0 && sub.length > 0 ? sub.flatMap(candidate => formatOne(candidate, keys)) : [ `${keys.length > 0 ? `at ${keys.join(".")}: ` : ""}${formatMessage(issue)}` ];
+    };
+    return issues.flatMap(issue => formatOne(issue, []));
 }
 
 const NonEmpty = NonEmptyString, PositiveInt = v__namespace.pipe(v__namespace.number(), v__namespace.integer(), v__namespace.minValue(1)), GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -2029,7 +2156,15 @@ function groqIdentifier(referencedAs) {
 }
 
 function picklist(options) {
-    return v__namespace.picklist(options, `Invalid option: expected one of ${options.map(o => `"${o}"`).join("|")}`);
+    return v__namespace.picklist(options, invalidOptionMessage(options));
+}
+
+function invalidOptionMessage(options) {
+    return `Invalid option: expected one of ${options.map(option => `"${option}"`).join("|")}`;
+}
+
+function exhaustiveOptions() {
+    return options => options;
 }
 
 function pinned() {
@@ -2044,12 +2179,12 @@ const LiteralSchema = v__namespace.strictObject({
     scope: v__namespace.optional(v__namespace.union([ v__namespace.literal("workflow"), v__namespace.literal("stage") ])),
     field: NonEmpty,
     path: v__namespace.optional(v__namespace.string())
-}), FieldSourceSchema = v__namespace.union([ v__namespace.strictObject({
+}), FieldSourceSchema = v__namespace.variant("type", [ v__namespace.strictObject({
     type: v__namespace.literal("input")
 }), v__namespace.strictObject({
     type: v__namespace.literal("query"),
     query: NonEmpty
-}), LiteralSchema, FieldReadSchema ]), ValueExprSchema = v__namespace.lazy(() => v__namespace.union([ LiteralSchema, FieldReadSchema, v__namespace.strictObject({
+}), LiteralSchema, FieldReadSchema ]), ValueExprSchema = v__namespace.lazy(() => v__namespace.variant("type", [ LiteralSchema, FieldReadSchema, v__namespace.strictObject({
     type: v__namespace.literal("param"),
     param: NonEmpty
 }), v__namespace.strictObject({
@@ -2144,7 +2279,7 @@ function groupMembershipNames(group) {
     return group === void 0 ? [] : typeof group == "string" ? [ group ] : [ ...group ];
 }
 
-const FIELD_VALUE_KINDS = [ "doc.ref", "doc.refs", "subject", "release.ref", "string", "text", "number", "progress", "boolean", "date", "datetime", "url", "actor", "assignee", "assignees", "object", "array" ], FieldValueKindSchema = picklist(FIELD_VALUE_KINDS), FieldKindSchema = picklist(FIELD_VALUE_KINDS), FieldEntryName = groqIdentifier("`$fields.<name>`"), FiniteNumber = v__namespace.pipe(v__namespace.number(), v__namespace.finite("must be finite")), ScalarValidationSchema = v__namespace.pipe(v__namespace.strictObject({
+const FIELD_VALUE_KINDS = [ "doc.ref", "doc.refs", "subject", "release.ref", "string", "text", "number", "progress", "boolean", "date", "datetime", "url", "actor", "assignee", "assignees", "object", "array" ], FieldValueKindSchema = picklist(FIELD_VALUE_KINDS), FieldKindSchema = picklist(FIELD_VALUE_KINDS), AUTHORING_FIELD_SUGAR_KINDS = exhaustiveOptions()([ "claim", "todoList", "notes" ]), AUTHORING_FIELD_KINDS = [ ...FIELD_VALUE_KINDS, ...AUTHORING_FIELD_SUGAR_KINDS ], AuthoringRawFieldKindSchema = v__namespace.picklist(FIELD_VALUE_KINDS, issue => `${invalidOptionMessage(AUTHORING_FIELD_KINDS)} but received ${JSON.stringify(issue.input)}`), FieldEntryName = groqIdentifier("`$fields.<name>`"), FiniteNumber = v__namespace.pipe(v__namespace.number(), v__namespace.finite("must be finite")), ScalarValidationSchema = v__namespace.pipe(v__namespace.strictObject({
     min: v__namespace.optional(FiniteNumber),
     max: v__namespace.optional(FiniteNumber)
 }), v__namespace.check(validation => validation.min !== void 0 || validation.max !== void 0, "declare at least one bound, or omit `validation`"), v__namespace.check(validation => validation.min === void 0 || validation.max === void 0 || validation.min <= validation.max, "`min` must be less than or equal to `max`")), ChoiceOptionsSchema = v__namespace.strictObject({
@@ -2209,9 +2344,9 @@ function fieldBase(editable, group) {
     };
 }
 
-function fieldEntryFields(editable, group) {
+function fieldEntryFields({editable: editable, group: group, kind: kind = FieldKindSchema}) {
     return {
-        type: FieldKindSchema,
+        type: kind,
         ...fieldBase(editable, group),
         options: v__namespace.optional(ChoiceOptionsSchema),
         validation: v__namespace.optional(ScalarValidationSchema),
@@ -2272,7 +2407,14 @@ function scalarValidationDeclarationIssues(entry) {
     return issues.length === 0 ? void 0 : issues;
 }
 
-const FieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields(StoredEditableSchema, StoredGroupMembershipSchema)), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), RawAuthoringFieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields(AuthoringEditableSchema, AuthoringGroupMembershipSchema)), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), ClaimFieldSchema = pinned()(v__namespace.strictObject({
+const FieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields({
+    editable: StoredEditableSchema,
+    group: StoredGroupMembershipSchema
+})), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), RawAuthoringFieldEntrySchema = pinned()(v__namespace.pipe(compositeChecked(fieldEntryFields({
+    editable: AuthoringEditableSchema,
+    group: AuthoringGroupMembershipSchema,
+    kind: AuthoringRawFieldKindSchema
+})), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), ClaimFieldSchema = pinned()(v__namespace.strictObject({
     type: v__namespace.literal("claim"),
     name: FieldEntryName,
     title: v__namespace.optional(v__namespace.string()),
@@ -2287,7 +2429,10 @@ function listSugarFields(type) {
     };
 }
 
-const TodoListFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("todoList"))), NotesFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("notes"))), AuthoringFieldEntrySchema = pinned()(v__namespace.union([ RawAuthoringFieldEntrySchema, ClaimFieldSchema, TodoListFieldSchema, NotesFieldSchema ])), EffectSchema = v__namespace.strictObject({
+const TodoListFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("todoList"))), NotesFieldSchema = pinned()(v__namespace.strictObject(listSugarFields("notes"))), AuthoringFieldEntrySchema = pinned()(v__namespace.lazy(input => {
+    const type = asShape(input).type;
+    return type === "claim" ? ClaimFieldSchema : type === "todoList" ? TodoListFieldSchema : type === "notes" ? NotesFieldSchema : RawAuthoringFieldEntrySchema;
+})), EffectSchema = v__namespace.strictObject({
     name: NonEmpty,
     title: v__namespace.optional(v__namespace.string()),
     description: v__namespace.optional(v__namespace.string()),
@@ -2352,7 +2497,18 @@ const StoredActionSchema = pinned()(v__namespace.strictObject({
     filter: v__namespace.optional(ConditionSchema),
     params: v__namespace.optional(v__namespace.array(ActionParamSchema)),
     effects: v__namespace.optional(v__namespace.array(EffectSchema))
-})), AuthoringActionSchema = pinned()(v__namespace.lazy(input => typeof input == "object" && input !== null && "type" in input ? ClaimActionSchema : RawAuthoringActionSchema));
+})), AuthoringActionSchema = pinned()(v__namespace.lazy(input => typeof input == "object" && input !== null && "type" in input ? ClaimActionSchema : RawAuthoringActionSchema)), requirementBase = {
+    name: NonEmpty,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string())
+}, GroqRequirementSchemaRaw = v__namespace.strictObject({
+    ...requirementBase,
+    type: v__namespace.literal("groq"),
+    query: ConditionSchema
+}), SingleSubjectRequirementSchemaRaw = v__namespace.strictObject({
+    ...requirementBase,
+    type: v__namespace.literal("singleSubject")
+}), GroqRequirementSchema = pinned()(GroqRequirementSchemaRaw), StartRequirementSchema = pinned()(v__namespace.variant("type", [ GroqRequirementSchemaRaw, SingleSubjectRequirementSchemaRaw ]));
 
 function activityFields({field: field, action: action, target: target, group: group}) {
     return {
@@ -2363,7 +2519,7 @@ function activityFields({field: field, action: action, target: target, group: gr
         group: v__namespace.optional(group),
         target: v__namespace.optional(target),
         filter: v__namespace.optional(ConditionSchema),
-        requirements: v__namespace.optional(v__namespace.record(NonEmpty, ConditionSchema)),
+        requirements: v__namespace.optional(v__namespace.array(GroqRequirementSchema)),
         actions: v__namespace.optional(v__namespace.array(action)),
         fields: v__namespace.optional(v__namespace.array(field))
     };
@@ -2459,7 +2615,7 @@ function startFields(kind) {
     return {
         kind: kind,
         filter: v__namespace.optional(ConditionSchema),
-        allowed: v__namespace.optional(ConditionSchema)
+        requirements: v__namespace.optional(v__namespace.array(StartRequirementSchema))
     };
 }
 
@@ -2598,6 +2754,13 @@ function checkActivities({def: def, i: i, activityNames: activityNames, issues:
             })),
             what: `action name in activity "${activity.name}"`,
             issues: issues
+        }), checkDuplicates({
+            names: (activity.requirements ?? []).map((requirement, r) => ({
+                name: requirement.name,
+                path: [ ...path, "requirements", r, "name" ]
+            })),
+            what: `requirement name in activity "${activity.name}"`,
+            issues: issues
         }), checkStatusSetTargets({
             activity: activity,
             activityNames: activityNames,
@@ -2906,10 +3069,10 @@ function collectActivityConditionSites({activity: activity, path: path, stageFie
         policy: "cascade",
         fields: fields
     });
-    for (const [name, groq2] of Object.entries(activity.requirements ?? {})) sites.push({
-        groq: groq2,
-        path: [ ...path, "requirements", name ],
-        label: `activity "${activity.name}" requirement "${name}"`,
+    for (const [index, requirement] of (activity.requirements ?? []).entries()) sites.push({
+        groq: requirement.query,
+        path: [ ...path, "requirements", index, "query" ],
+        label: `activity "${activity.name}" requirement "${requirement.name}"`,
         policy: "caller-bound",
         fields: fields
     });
@@ -3105,73 +3268,83 @@ function checkTriggeredActionParams(def, issues) {
 }
 
 function checkStart(def, issues) {
-    if (def.start !== void 0 && (def.lifecycle === "child" && issues.push({
+    if (def.start !== void 0 && (checkDuplicates({
+        names: (def.start.requirements ?? []).map((requirement, index) => ({
+            name: requirement.name,
+            path: [ "start", "requirements", index, "name" ]
+        })),
+        what: "start requirement name",
+        issues: issues
+    }), def.lifecycle === "child" && issues.push({
         path: [ "start" ],
         message: "a spawn-only (lifecycle 'child') definition declares `start` — children are instantiated by a parent's `spawn`, never started standalone, so the block would never apply. Remove `start`, or drop `lifecycle: 'child'`"
-    }), checkStartFilterReads(def, issues), checkStartAllowedReads(def, issues), checkStartSubjectVariable(def, issues), 
-    def.start.kind === "autonomous")) for (const [n, entry] of (def.fields ?? []).entries()) entry.required !== !0 || isSubjectEntry(entry) || issues.push({
+    }), checkStartFilterReads(def, issues), checkStartRequirementReads(def, issues), 
+    checkSingleSubjectRequirements(def, issues), def.start.kind === "autonomous")) for (const [n, entry] of (def.fields ?? []).entries()) entry.required !== !0 || isSubjectEntry(entry) || issues.push({
         path: [ "fields", n, "required" ],
         message: `start.kind 'autonomous' means runs are initiated by a system reacting to a document, so every required input must be derivable from that triggering document — required entry "${entry.name}" (kind "${entry.type}") is not the workflow's subject. Make it optional, seed it another way (query/literal), or declare it the \`subject\` entry (the document the run is about)`
     });
 }
 
-function checkStartSubjectVariable(def, issues) {
+function checkSingleSubjectRequirements(def, issues) {
+    const indexes = (def.start?.requirements ?? []).map((requirement, index) => ({
+        requirement: requirement,
+        index: index
+    })).filter(({requirement: requirement}) => requirement.type === "singleSubject"), [first] = indexes;
+    if (first === void 0) return;
     const subject = (def.fields ?? []).find(isSubjectEntry);
-    for (const [key, condition] of [ [ "filter", def.start?.filter ], [ "allowed", def.start?.allowed ] ]) if (condition !== void 0 && conditionParameterNames(condition).has(SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR)) {
-        if (subject === void 0) {
-            issues.push({
-                path: [ "start", key ],
-                message: `start.${key} reads $${SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR}, but the definition declares no \`subject\` entry — the engine has no prospective subject identity to match. Declare a \`subject\` entry (the document the workflow is about), or remove the variable`
-            });
-            continue;
-        }
-        key === "allowed" && !isInputSourced(subject) && issues.push({
-            path: [ "start", key ],
-            message: `start.allowed reads $${SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR}, but the definition's subject entry "${subject.name}" is not \`input\`-sourced — the start gate cannot bind its prospective subject. Make the subject input-sourced, or remove the variable`
+    if (subject === void 0) {
+        issues.push({
+            path: [ "start", "requirements", first.index ],
+            message: "a singleSubject start requirement caps the definition at one in-flight run per subject, but the definition declares no `subject` entry — there is no subject identity to dedupe on, so the rule could never apply. Declare a `subject` entry (the document the workflow is about), or remove the requirement"
         });
+        return;
     }
+    isInputSourced(subject) || issues.push({
+        path: [ "start", "requirements", first.index ],
+        message: `a singleSubject start requirement matches the prospective subject against in-flight runs, but the definition's subject entry "${subject.name}" is not \`input\`-sourced — the start gate cannot bind a prospective subject. Make the subject input-sourced, or remove the requirement`
+    });
 }
 
 function checkStartFilterReads(def, issues) {
     const filter = def.start?.filter;
     filter !== void 0 && (conditionParameterNames(filter).has("fields") && issues.push({
         path: [ "start", "filter" ],
-        message: "start.filter reads $fields, but the filter is browse-time-pure — a start surface evaluates it per document, before any inputs exist, so $fields cannot be bound. Move the input-dependent rule to start.allowed, the start-time permission predicate that binds $fields and is enforced by startInstance"
+        message: "start.filter reads $fields, but the filter is browse-time-pure — a start surface evaluates it per document, before any inputs exist, so $fields cannot be bound. Move the input-dependent rule to a start requirement, the start-time readiness predicate that binds $fields and is enforced by startInstance"
     }), readsRootDocument(filter) && !(def.fields ?? []).some(isSubjectEntry) && issues.push({
         path: [ "start", "filter" ],
         message: "start.filter reads the candidate document (its root), but the definition declares no `subject` entry — a read surface would never have a document to bind as root, so every root read is GROQ null and the filter silently misevaluates. Declare a `subject` entry (the document the workflow is about), or gate on the dataset instead"
     }));
 }
 
-function checkStartAllowedReads(def, issues) {
-    const allowed = def.start?.allowed;
-    if (allowed === void 0) return;
+function checkStartRequirementReads(def, issues) {
     const bindable = new Map((def.fields ?? []).filter(isInputSourced).map(entry => [ entry.name, entry ])), declared = new Set((def.fields ?? []).map(entry => entry.name)), nullVerdict = `so the read is GROQ null and null semantics decide the verdict (refuse-all or vacuously-allow, by the expression's shape), never the caller's real input. Bindable (input) fields: ${knownList(bindable.keys())}`;
-    for (const read of conditionFieldReads(allowed)) {
-        const entry = bindable.get(read.name);
-        if (entry === void 0) {
-            issues.push({
-                path: [ "start", "allowed" ],
-                message: declared.has(read.name) ? `start.allowed reads $fields.${read.name}, but "${read.name}" is not an \`input\`-sourced entry — $fields binds only the caller's input entries (query/literal/fieldRead entries resolve at materialisation, after the start gate), ${nullVerdict}` : `start.allowed reads $fields.${read.name}, but no workflow-scope field entry named "${read.name}" is declared — $fields binds only the caller's input entries, ${nullVerdict}`
+    for (const [index, requirement] of (def.start?.requirements ?? []).entries()) if (requirement.type === "groq") {
+        for (const read of conditionFieldReads(requirement.query)) {
+            const entry = bindable.get(read.name);
+            if (entry === void 0) {
+                issues.push({
+                    path: [ "start", "requirements", index, "query" ],
+                    message: declared.has(read.name) ? `start requirement reads $fields.${read.name}, but "${read.name}" is not an \`input\`-sourced entry — $fields binds only the caller's input entries (query/literal/fieldRead entries resolve at materialisation, after the start gate), ${nullVerdict}` : `start requirement reads $fields.${read.name}, but no workflow-scope field entry named "${read.name}" is declared — $fields binds only the caller's input entries, ${nullVerdict}`
+                });
+                continue;
+            }
+            pushFieldReadPathIssue({
+                where: "start requirement",
+                read: {
+                    field: read.name,
+                    path: read.path
+                },
+                target: entry,
+                path: [ "start", "requirements", index, "query" ],
+                issues: issues,
+                nodes: START_REQUIREMENT_VALUE_NODES
             });
-            continue;
         }
-        pushFieldReadPathIssue({
-            where: "start.allowed",
-            read: {
-                field: read.name,
-                path: read.path
-            },
-            target: entry,
-            path: [ "start", "allowed" ],
-            issues: issues,
-            nodes: START_ALLOWED_VALUE_NODES
+        readsRootDocument(requirement.query) && issues.push({
+            path: [ "start", "requirements", index, "query" ],
+            message: "start requirement reads the candidate document as its root, but no root ever binds in the start-requirement context — startInstance holds inputs, not a loaded document, so the read is GROQ null and null semantics decide the verdict, never the workflow's real state. Read the subject as $fields.<entry> (its GDR URI is $fields.<entry>.id); a per-document visibility rule belongs in start.filter"
         });
     }
-    readsRootDocument(allowed) && issues.push({
-        path: [ "start", "allowed" ],
-        message: "start.allowed reads the candidate document as its root, but no root ever binds in the start-allowed context — startInstance holds inputs, not a loaded document, so the read is GROQ null and null semantics decide the verdict, never the workflow's real state. Read the subject as $fields.<entry> (its GDR URI is $fields.<entry>.id); a per-document visibility rule belongs in start.filter"
-    });
 }
 
 function checkGroups(def, issues) {
@@ -3696,7 +3869,7 @@ const SCALAR = {
         kind: "rows",
         of: shape.of ?? []
     })
-}, START_ALLOWED_VALUE_NODES = {
+}, START_REQUIREMENT_VALUE_NODES = {
     ...VALUE_NODES,
     "doc.ref": () => GDR_VALUE,
     subject: () => GDR_VALUE
@@ -3785,6 +3958,8 @@ exports.ACTIVITY_STATUSES = ACTIVITY_STATUSES;
 
 exports.ACTOR_KINDS = ACTOR_KINDS;
 
+exports.ANONYMOUS_IDENTITY = ANONYMOUS_IDENTITY;
+
 exports.ActorShape = ActorShape;
 
 exports.AuthoringActionSchema = AuthoringActionSchema;
@@ -3871,16 +4046,18 @@ exports.RESOURCE_ALIAS_NAME_SOURCE = RESOURCE_ALIAS_NAME_SOURCE;
 
 exports.ReaderModelAcknowledgementError = ReaderModelAcknowledgementError;
 
-exports.START_ALLOWED_VARS = START_ALLOWED_VARS;
-
 exports.START_FILTER_VARS = START_FILTER_VARS;
 
-exports.SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR = SUBJECT_HAS_IN_FLIGHT_INSTANCE_VAR;
+exports.START_REQUIREMENT_VARS = START_REQUIREMENT_VARS;
+
+exports.SYSTEM_IDENTITY = SYSTEM_IDENTITY;
 
 exports.SpawnContractsInvalidError = SpawnContractsInvalidError;
 
 exports.StoredFieldOpSchema = StoredFieldOpSchema;
 
+exports.VersionSpecificDatasetGdrError = VersionSpecificDatasetGdrError;
+
 exports.WORKFLOW_DEFINITION_TYPE = WORKFLOW_DEFINITION_TYPE;
 
 exports.WORKFLOW_INSTANCE_TYPE = WORKFLOW_INSTANCE_TYPE;
@@ -3897,12 +4074,12 @@ exports.assertReadableModel = assertReadableModel;
 
 exports.assertReaderModelAcknowledgement = assertReaderModelAcknowledgement;
 
-exports.checkFieldValue = checkFieldValue;
-
 exports.checkWorkflowInvariants = checkWorkflowInvariants;
 
 exports.choiceValueIssues = choiceValueIssues;
 
+exports.classifyPrincipalId = classifyPrincipalId;
+
 exports.clientConfigFromResource = clientConfigFromResource;
 
 exports.conditionEffectReads = conditionEffectReads;
@@ -3993,6 +4170,8 @@ exports.isUnprimed = isUnprimed;
 
 exports.labelFor = labelFor;
 
+exports.lakePrincipalId = lakePrincipalId;
+
 exports.minReaderModelOf = minReaderModelOf;
 
 exports.modelStampFor = modelStampFor;
@@ -4003,6 +4182,8 @@ exports.parentRef = parentRef;
 
 exports.parseDefinitionSnapshot = parseDefinitionSnapshot;
 
+exports.parseFieldValue = parseFieldValue;
+
 exports.parseGdr = parseGdr;
 
 exports.parseOrThrow = parseOrThrow;