@sanity/workflow-engine 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @sanity/workflow-engine
 
+## 0.26.0
+
+## 0.25.0
+
+### Minor Changes
+
+- 177d600: Deployed workflow environment tags are now discoverable.
+
+  The engine gains two cross-partition GROQ builders: `deployedTagsGroq()` lists
+  every tag holding a deployed definition in a resource, and
+  `definitionTagsGroq()` narrows that to one definition name via `$definition`.
+  Both deliberately span tag partitions — every other read is tag-scoped, and
+  `workflow.query` refuses GROQ that isn't — so they answer "which environments
+  exist here" for a caller holding a resource but no tag. They report what is
+  _observed_: a tag with nothing deployed does not appear.
+
+  The stdio MCP server adds a `list_workflow_tags` tool taking a
+  `workflow_resource` and no tag. It is registered by the host rather than exported
+  as a tool def, because a def is only ever handed an engine and an engine is
+  pinned to one tag. `LIST_WORKFLOW_TAGS_TOOL_NAME` and
+  `LIST_WORKFLOW_TAGS_DESCRIPTION` are exported so an embedding host registers the
+  same capability under the same name without re-authoring the model-facing
+  wording. The `tag` parameter's description now points an agent at that tool where
+  a server offers it and at the user otherwise, and requires confirmation either
+  way — having the list does not license picking from it.
+
+  Both registration paths share one outcome path, `withToolTelemetry`, so the
+  result envelope, error rendering, and the `Editorial Workflows MCP Tool Called`
+  event cannot diverge between a def-backed tool and a host-registered one. Tag
+  discovery reports its adoption event like every other tool, and because it names
+  a resource it can also initialize the stdio server's deferred telemetry shell —
+  which matters when discovery is an agent's first call.
+
+  The CLI's definition-tags probe runs the engine's builder instead of its own
+  copy of the query, so its `params` key is `definition` rather than `name`, and
+  the tag partitions it names in an ambiguity error arrive sorted from the lake.
+
+### Patch Changes
+
+- fc12989: Fixes actor resolution failing with `principal id "…" is not an account-global
+user id` for a session scoped to a single project, such as a SAML-SSO Studio
+  session.
+
+  `actor.id` is always the account-global user id, and the id's namespace decides
+  which read supplies it rather than the host that answered. Whichever `/users/me`
+  read returns an already-account-global id supplies it; a project-scoped id is
+  bridged to its account-global form first — by string surgery for an
+  `e-<globalId>` principal, otherwise through the project's own user directory
+  (`/projects/<id>/users/<principal>` → `sanityUserId`). A SAML-SSO session
+  resolves through that directory, because the global host holds no
+  account-global record for it.
+
+  A session whose id is already account-global issues no directory request. A
+  project-scoped id that no route can bridge is refused, naming both failed
+  routes.
+
+  The project-user directory admits only a row answering the id it asked for,
+  matching the batched member join: a row for another principal reports
+  inaccessible rather than resolving to that person's identity.
+
 ## 0.24.0
 
 ### Minor Changes

package/dist/_chunks-cjs/invariants.cjs

@@ -1854,6 +1854,18 @@ function classifyPrincipalId(id) {
     };
 }
 
+function directoryBridgeId(sanityUserId) {
+    if (typeof sanityUserId == "string") return classifyPrincipalId(sanityUserId).namespace === "global" ? sanityUserId : void 0;
+}
+
+function firstCarriedGlobalId(candidates) {
+    for (const candidate of candidates) {
+        if (candidate === void 0) continue;
+        const {globalId: globalId} = classifyPrincipalId(candidate);
+        if (globalId !== void 0) return globalId;
+    }
+}
+
 function lakePrincipalId(args) {
     return args.localPrincipalId ?? args.actor.id;
 }
@@ -4172,6 +4184,8 @@ exports.deriveExecutorClassification = deriveExecutorClassification;
 
 exports.desugarWorkflow = desugarWorkflow;
 
+exports.directoryBridgeId = directoryBridgeId;
+
 exports.driverKind = driverKind;
 
 exports.errorMessage = errorMessage;
@@ -4188,6 +4202,8 @@ exports.fieldTreeShape = fieldTreeShape;
 
 exports.fieldValueSchemas = fieldValueSchemas;
 
+exports.firstCarriedGlobalId = firstCarriedGlobalId;
+
 exports.formatIssuePath = formatIssuePath;
 
 exports.formatIssues = formatIssues;

package/dist/_chunks-es/invariants.js

@@ -1840,6 +1840,18 @@ function classifyPrincipalId(id) {
     };
 }
 
+function directoryBridgeId(sanityUserId) {
+    if (typeof sanityUserId == "string") return classifyPrincipalId(sanityUserId).namespace === "global" ? sanityUserId : void 0;
+}
+
+function firstCarriedGlobalId(candidates) {
+    for (const candidate of candidates) {
+        if (candidate === void 0) continue;
+        const {globalId: globalId} = classifyPrincipalId(candidate);
+        if (globalId !== void 0) return globalId;
+    }
+}
+
 function lakePrincipalId(args) {
     return args.localPrincipalId ?? args.actor.id;
 }
@@ -4008,4 +4020,4 @@ function checkWorkflowInvariants(def) {
     checkStoredRolesPlacement(def, issues), checkGroups(def, issues), issues;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_STATUSES, ACTOR_KINDS, ANONYMOUS_IDENTITY, ActorShape, AuthoringActionSchema, AuthoringActivitySchema, AuthoringFieldEntrySchema, AuthoringGuardSchema, AuthoringOpSchema, AuthoringStageSchema, AuthoringTransitionSchema, AuthoringWorkflowSchema, CALLER_BOUND_VARS, CONDITION_VARS, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_TRANSITION_WHEN, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DefinitionInUseError, DefinitionNotFoundError, EFFECTS_READ, EXECUTOR_CLASSIFICATIONS, EffectNotFoundError, EffectSchema, FIELD_READ, FIELD_SCOPES, FIELD_VALUE_KINDS, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GUARD_PREDICATE_VARS, GdrShape, GroupSchema, InstanceNotFoundError, IsoTimestamp, MUTATION_GUARD_ACTIONS, ModelVersionAheadError, NonEmptyString, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, RESOURCE_ALIAS_NAME_SOURCE, ReaderModelAcknowledgementError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StoredFieldOpSchema, VersionSpecificDatasetGdrError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowConfigSchema, WorkflowError, actorFulfillsRole, andConditions, assertReadableModel, assertReaderModelAcknowledgement, checkWorkflowInvariants, choiceValueIssues, classifyPrincipalId, clientConfigFromResource, conditionEffectReads, conditionFieldReadNames, conditionParameterNames, conditionSyntaxIssues, datasetResourceParts, definitionDocId, deriveActivityKind, deriveExecutorClassification, desugarWorkflow, driverKind, errorMessage, evaluateCondition, evaluateConditionOutcome, evaluatePredicates, extractDocumentId, fieldTreeShape, fieldValueSchemas, formatIssuePath, formatIssues, formatValidationError, gdrFromResource, gdrRef, gdrResourcePrefix, gdrUri, groq, groupMembershipNames, isBareSeedId, isCascadeFired, isGdr, isGdrUri, isGuardReadExpr, isInputSourced, isNotesEntry, isParseableInstant, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTerminalActivityStatus, isTodoListEntry, isTodoListItem, isUnevaluable, isUnprimed, labelFor, lakePrincipalId, minReaderModelOf, modelStampFor, modelVersionOf, parentRef, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseFieldValue, parseGdr, parseOrThrow, parsePersistedDoc, parseResourceGdr, parseStoredDefinition, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refTypeIssues, rejectedRefTypes, releaseDocId, releaseRef, requiredModelFeatures, requiredReaderModel, resourceAliasesToMap, resourceFromGdrUri, resourceFromParsed, resourceGdr, rethrowWithContext, runGroq, sameResource, scalarValidationIssues, schemaTreeShape, selfGdr, startKindOf, tagScopeFilter, terminalState, toBareId, toPhysicalGdr, tolerantEntries, tolerantObject, tryParseGdr, validateFieldAppendItem, validateFieldValue, validateResourceAliasName, validateTag };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_STATUSES, ACTOR_KINDS, ANONYMOUS_IDENTITY, ActorShape, AuthoringActionSchema, AuthoringActivitySchema, AuthoringFieldEntrySchema, AuthoringGuardSchema, AuthoringOpSchema, AuthoringStageSchema, AuthoringTransitionSchema, AuthoringWorkflowSchema, CALLER_BOUND_VARS, CONDITION_VARS, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_TRANSITION_WHEN, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DefinitionInUseError, DefinitionNotFoundError, EFFECTS_READ, EXECUTOR_CLASSIFICATIONS, EffectNotFoundError, EffectSchema, FIELD_READ, FIELD_SCOPES, FIELD_VALUE_KINDS, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GUARD_PREDICATE_VARS, GdrShape, GroupSchema, InstanceNotFoundError, IsoTimestamp, MUTATION_GUARD_ACTIONS, ModelVersionAheadError, NonEmptyString, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, RESOURCE_ALIAS_NAME_SOURCE, ReaderModelAcknowledgementError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StoredFieldOpSchema, VersionSpecificDatasetGdrError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowConfigSchema, WorkflowError, actorFulfillsRole, andConditions, assertReadableModel, assertReaderModelAcknowledgement, checkWorkflowInvariants, choiceValueIssues, classifyPrincipalId, clientConfigFromResource, conditionEffectReads, conditionFieldReadNames, conditionParameterNames, conditionSyntaxIssues, datasetResourceParts, definitionDocId, deriveActivityKind, deriveExecutorClassification, desugarWorkflow, directoryBridgeId, driverKind, errorMessage, evaluateCondition, evaluateConditionOutcome, evaluatePredicates, extractDocumentId, fieldTreeShape, fieldValueSchemas, firstCarriedGlobalId, formatIssuePath, formatIssues, formatValidationError, gdrFromResource, gdrRef, gdrResourcePrefix, gdrUri, groq, groupMembershipNames, isBareSeedId, isCascadeFired, isGdr, isGdrUri, isGuardReadExpr, isInputSourced, isNotesEntry, isParseableInstant, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTerminalActivityStatus, isTodoListEntry, isTodoListItem, isUnevaluable, isUnprimed, labelFor, lakePrincipalId, minReaderModelOf, modelStampFor, modelVersionOf, parentRef, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseFieldValue, parseGdr, parseOrThrow, parsePersistedDoc, parseResourceGdr, parseStoredDefinition, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refTypeIssues, rejectedRefTypes, releaseDocId, releaseRef, requiredModelFeatures, requiredReaderModel, resourceAliasesToMap, resourceFromGdrUri, resourceFromParsed, resourceGdr, rethrowWithContext, runGroq, sameResource, scalarValidationIssues, schemaTreeShape, selfGdr, startKindOf, tagScopeFilter, terminalState, toBareId, toPhysicalGdr, tolerantEntries, tolerantObject, tryParseGdr, validateFieldAppendItem, validateFieldValue, validateResourceAliasName, validateTag };

package/dist/index.cjs

@@ -3316,6 +3316,14 @@ function latestDefinitionsGroq() {
     return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
 }
 
+function deployedTagsGroq() {
+    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+}
+
+function definitionTagsGroq() {
+    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+}
+
 function latestDeployedDefinitions(rows) {
     const byName = /* @__PURE__ */ new Map;
     for (const row of rows) {
@@ -4805,8 +4813,11 @@ function cacheFor(client) {
 
 function ingestDirectoryRows(args) {
     const records = Array.isArray(args.response) ? args.response : [ args.response ];
-    for (const row of records) typeof row?.id != "string" || typeof row.sanityUserId != "string" || args.requested.has(row.id) && invariants.classifyPrincipalId(row.sanityUserId).namespace === "global" && (args.cache.set(row.id, row.sanityUserId), 
-    args.out.set(row.id, row.sanityUserId));
+    for (const row of records) {
+        if (typeof row?.id != "string" || !args.requested.has(row.id)) continue;
+        const globalId = invariants.directoryBridgeId(row.sanityUserId);
+        globalId !== void 0 && (args.cache.set(row.id, globalId), args.out.set(row.id, globalId));
+    }
 }
 
 async function getInstanceDocument(client, instanceId) {
@@ -5452,10 +5463,14 @@ async function resolveGlobalProjectUser(args) {
 async function ingestMemberJoin(args) {
     const {request: request, projectId: projectId, cache: cache} = args, memberIds = await projectMemberIds(request, projectId);
     if (memberIds.length === 0) return;
-    const response = await request({
+    const requested = new Set(memberIds), response = await request({
         uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
     });
-    for (const row of Array.isArray(response) ? response : [ response ]) isClientProjectUser(row) && typeof row.sanityUserId == "string" && cache.set(`${projectId}:${row.sanityUserId}`, row);
+    for (const row of Array.isArray(response) ? response : [ response ]) {
+        if (!isClientProjectUser(row) || !requested.has(row.id)) continue;
+        const globalId = invariants.directoryBridgeId(row.sanityUserId);
+        globalId !== void 0 && cache.set(`${projectId}:${globalId}`, row);
+    }
 }
 
 function clientProjectUserDirectory(client, projectId) {
@@ -5477,7 +5492,10 @@ function clientProjectUserDirectory(client, projectId) {
                 }), candidate = Array.isArray(response) ? response[0] : response;
                 return candidate == null ? {
                     status: "missing"
-                } : isClientProjectUser(candidate) ? {
+                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
+                    status: "inaccessible",
+                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
+                } : {
                     status: "resolved",
                     user: candidate
                 } : {
@@ -8439,14 +8457,20 @@ function cachedGrants({client: client, requestFn: requestFn, resourcePath: resou
 }
 
 async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalId = usableId(globalUser.user), id = globalId ?? resourceId;
-    if (id === void 0) return;
-    refuseProjectPrincipalWithoutGlobal({
-        resourceId: resourceId,
-        globalId: globalId,
-        globalUser: globalUser
-    });
-    const roleNames = (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
     return {
         actor: {
             kind: "person",
@@ -8461,13 +8485,62 @@ async function fetchActor(client, requestFn) {
     };
 }
 
-function refuseProjectPrincipalWithoutGlobal(args) {
-    const {resourceId: resourceId, globalId: globalId, globalUser: globalUser} = args;
-    if (globalId !== void 0 || resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project") return;
-    const reason = "reason" in globalUser ? globalUser.reason : "no record";
-    throw new Error(`workflow: the caller's identity on the workflow resource host is project-scoped ("${resourceId}") and the account-global record could not be resolved (${reason}). The engine speaks account-global user ids only and never acts as a project-scoped principal.`, "cause" in globalUser ? {
-        cause: globalUser.cause
-    } : void 0);
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
 }
 
 function usableId(user) {
@@ -13381,6 +13454,8 @@ exports.definitionDeployedData = definitionDeployedData;
 
 exports.definitionLookupGroq = definitionLookupGroq;
 
+exports.definitionTagsGroq = definitionTagsGroq;
+
 exports.definitionsListGroq = definitionsListGroq;
 
 exports.deniedGuardLabels = deniedGuardLabels;
@@ -13391,6 +13466,8 @@ exports.denyingGuards = denyingGuards;
 
 exports.deployStageGuards = deployStageGuards;
 
+exports.deployedTagsGroq = deployedTagsGroq;
+
 exports.deriveWorkflowAutonomy = deriveWorkflowAutonomy;
 
 exports.describeAtom = describeAtom;

package/dist/index.d.cts

@@ -553,14 +553,17 @@ export declare type ActivityStatus = (typeof ACTIVITY_STATUSES)[number];
  * read time, and only the lake's own token identity is authenticated — hard
  * enforcement lives there.
  *
- * `id` is the account-global user id (the global API host's `/users/me`) —
- * the one identity namespace that is stable across projects and org-level
- * resources. Robot tokens carry a single universal id, so for them `id`
- * equals what every host returns. Instances written before ids were
- * namespace-classified carry the workflow resource's local principal id in
- * `id` instead; readers interpret those through the prefix classifier in
- * `core/identity.ts` with the document's home resource as the implied
- * scope.
+ * `id` is the account-global user id — the one identity namespace that is
+ * stable across projects and org-level resources. The engine takes it from the
+ * first route that can answer for the token: an id either host's `/users/me`
+ * already carries in account-global form (the id itself, or the one embedded in
+ * an `e-` principal), and otherwise the project's own user directory
+ * (`sanityUserId`) — the route a session scoped to a single project depends on,
+ * since no global record exists for it. Robot tokens carry a single universal
+ * id, so for them `id` equals what every host returns. Instances written before
+ * ids were namespace-classified carry the workflow resource's local principal id
+ * in `id` instead; readers interpret those through the prefix classifier in
+ * `core/identity.ts` with the document's home resource as the implied scope.
  */
 export declare interface Actor {
   kind: ActorKind;
@@ -1682,7 +1685,8 @@ export declare interface ClientProjectUser {
   readonly [key: string]: unknown;
 }
 
-/** Project-user directory for CLI, MCP, and server runtimes using the engine client. */
+/** Project-user directory served straight from the engine's own client — the
+ *  project API's user endpoints, no host adapter. */
 export declare function clientProjectUserDirectory(
   client: WorkflowClient,
   projectId: string,
@@ -2548,10 +2552,13 @@ export declare class DefinitionInUseError extends WorkflowError<"definition-in-u
 }
 
 /**
- * Pure GROQ builder for resolving a deployed workflow definition. Composes the
- * doc-type constant and the tag-scope predicate so the engine's internal
- * lookups and the CLI share one definition of "tag-scoped, latest-or-pinned
+ * Pure GROQ builders for deployed workflow definitions. Composes the doc-type
+ * constant and the tag-scope predicate so the engine's internal lookups and the
+ * CLI share one definition of "tag-scoped, latest-or-pinned
  * `workflow.definition`" instead of hand-writing the query at each call site.
+ *
+ * The tag enumerations are the deliberate exception: they span partitions, for a
+ * caller holding a resource but no tag yet.
  */
 /**
  * GROQ resolving a single deployed {@link WORKFLOW_DEFINITION_TYPE} visible to
@@ -2610,6 +2617,19 @@ export declare function definitionsListGroq(
   versionOrder: "asc" | "desc",
 ): string;
 
+/**
+ * GROQ listing every tag partition that holds any version of one definition
+ * name — {@link deployedTagsGroq} narrowed from "what exists here" to "where
+ * is this".
+ *
+ * Several hits is ambiguity to refuse, not resolve: version numbers are
+ * per-partition, so the highest one may sit in an environment the caller did
+ * not mean, and the answer would carry no sign of it.
+ *
+ * Params: `$definition`.
+ */
+export declare function definitionTagsGroq(): string;
+
 export declare interface DeleteDefinitionArgs {
   /** The definition's `name` — delete addresses the workflow, not a doc id. */
   definition: string;
@@ -2759,6 +2779,13 @@ export declare type DeployedDefinition = WorkflowDefinition & {
   minReaderModel?: number;
 };
 
+/**
+ * GROQ listing every tag partition holding a deployed
+ * {@link WORKFLOW_DEFINITION_TYPE} in the resource. The un-scoped
+ * inverse of {@link tagScopeFilter}, this deliberately spans partitions.
+ */
+export declare function deployedTagsGroq(): string;
+
 /**
  * Deploy every guard for a stage being entered (idempotent upsert), but only
  * while the instance is still committed to that stage. A deploy that lost the
@@ -4010,7 +4037,7 @@ export declare interface EvaluateArgs {
   instanceId: string;
   /**
    * URL path on the supplied client where the engine should fetch
-   * grants. The actor always token-resolves via `/users/me`; without
+   * grants. The actor always token-resolves from the supplied client; without
    * a grants path the rendered `$can` is undefined, so conditions
    * referencing it fail closed — and the real Sanity write boundary
    * still enforces.
@@ -7719,8 +7746,8 @@ export declare interface StartInstanceArgs {
   instanceId?: string;
   /**
    * URL path on the supplied client where the engine fetches the
-   * caller's ACL grants. Identity is always token-resolved — `actor`
-   * comes from `client.request({ uri: "/users/me" })` — and grants
+   * caller's ACL grants. Identity is always token-resolved — `actor` is
+   * resolved from the supplied client's token, never passed in — and grants
    * feed the advisory `$can.*` params action conditions can read;
    * omitting this leaves the rendered `$can` undefined (conditions
    * referencing it fail closed, nothing else is gated engine-side —
@@ -9365,10 +9392,14 @@ export declare interface WorkflowAutonomy extends AutonomyAnswer {
 
 export declare interface WorkflowClient {
   /**
-   * Read the effective client configuration. The engine probes `apiHost`
-   * before deriving the global `/users/me` sibling because `@sanity/client`
-   * shallow-merges `withConfig` overrides and otherwise preserves an explicit
-   * project host even when `useProjectHostname` is set to `false`.
+   * Read the effective client configuration. The engine reads two fields from
+   * it. `apiHost` is probed before deriving the global `/users/me` sibling,
+   * because `@sanity/client` shallow-merges `withConfig` overrides and
+   * otherwise preserves an explicit project host even when
+   * `useProjectHostname` is set to `false`. `projectId` addresses the project's
+   * user directory when a project-scoped principal has to be bridged to its
+   * account-global id — a client reporting none has no directory to ask, and
+   * such a session is refused rather than stamped locally.
    */
   config?: () => WorkflowClientConfig;
   fetch: <T = unknown>(

package/dist/index.d.ts

@@ -553,14 +553,17 @@ export declare type ActivityStatus = (typeof ACTIVITY_STATUSES)[number];
  * read time, and only the lake's own token identity is authenticated — hard
  * enforcement lives there.
  *
- * `id` is the account-global user id (the global API host's `/users/me`) —
- * the one identity namespace that is stable across projects and org-level
- * resources. Robot tokens carry a single universal id, so for them `id`
- * equals what every host returns. Instances written before ids were
- * namespace-classified carry the workflow resource's local principal id in
- * `id` instead; readers interpret those through the prefix classifier in
- * `core/identity.ts` with the document's home resource as the implied
- * scope.
+ * `id` is the account-global user id — the one identity namespace that is
+ * stable across projects and org-level resources. The engine takes it from the
+ * first route that can answer for the token: an id either host's `/users/me`
+ * already carries in account-global form (the id itself, or the one embedded in
+ * an `e-` principal), and otherwise the project's own user directory
+ * (`sanityUserId`) — the route a session scoped to a single project depends on,
+ * since no global record exists for it. Robot tokens carry a single universal
+ * id, so for them `id` equals what every host returns. Instances written before
+ * ids were namespace-classified carry the workflow resource's local principal id
+ * in `id` instead; readers interpret those through the prefix classifier in
+ * `core/identity.ts` with the document's home resource as the implied scope.
  */
 export declare interface Actor {
   kind: ActorKind;
@@ -1682,7 +1685,8 @@ export declare interface ClientProjectUser {
   readonly [key: string]: unknown;
 }
 
-/** Project-user directory for CLI, MCP, and server runtimes using the engine client. */
+/** Project-user directory served straight from the engine's own client — the
+ *  project API's user endpoints, no host adapter. */
 export declare function clientProjectUserDirectory(
   client: WorkflowClient,
   projectId: string,
@@ -2548,10 +2552,13 @@ export declare class DefinitionInUseError extends WorkflowError<"definition-in-u
 }
 
 /**
- * Pure GROQ builder for resolving a deployed workflow definition. Composes the
- * doc-type constant and the tag-scope predicate so the engine's internal
- * lookups and the CLI share one definition of "tag-scoped, latest-or-pinned
+ * Pure GROQ builders for deployed workflow definitions. Composes the doc-type
+ * constant and the tag-scope predicate so the engine's internal lookups and the
+ * CLI share one definition of "tag-scoped, latest-or-pinned
  * `workflow.definition`" instead of hand-writing the query at each call site.
+ *
+ * The tag enumerations are the deliberate exception: they span partitions, for a
+ * caller holding a resource but no tag yet.
  */
 /**
  * GROQ resolving a single deployed {@link WORKFLOW_DEFINITION_TYPE} visible to
@@ -2610,6 +2617,19 @@ export declare function definitionsListGroq(
   versionOrder: "asc" | "desc",
 ): string;
 
+/**
+ * GROQ listing every tag partition that holds any version of one definition
+ * name — {@link deployedTagsGroq} narrowed from "what exists here" to "where
+ * is this".
+ *
+ * Several hits is ambiguity to refuse, not resolve: version numbers are
+ * per-partition, so the highest one may sit in an environment the caller did
+ * not mean, and the answer would carry no sign of it.
+ *
+ * Params: `$definition`.
+ */
+export declare function definitionTagsGroq(): string;
+
 export declare interface DeleteDefinitionArgs {
   /** The definition's `name` — delete addresses the workflow, not a doc id. */
   definition: string;
@@ -2759,6 +2779,13 @@ export declare type DeployedDefinition = WorkflowDefinition & {
   minReaderModel?: number;
 };
 
+/**
+ * GROQ listing every tag partition holding a deployed
+ * {@link WORKFLOW_DEFINITION_TYPE} in the resource. The un-scoped
+ * inverse of {@link tagScopeFilter}, this deliberately spans partitions.
+ */
+export declare function deployedTagsGroq(): string;
+
 /**
  * Deploy every guard for a stage being entered (idempotent upsert), but only
  * while the instance is still committed to that stage. A deploy that lost the
@@ -4010,7 +4037,7 @@ export declare interface EvaluateArgs {
   instanceId: string;
   /**
    * URL path on the supplied client where the engine should fetch
-   * grants. The actor always token-resolves via `/users/me`; without
+   * grants. The actor always token-resolves from the supplied client; without
    * a grants path the rendered `$can` is undefined, so conditions
    * referencing it fail closed — and the real Sanity write boundary
    * still enforces.
@@ -7719,8 +7746,8 @@ export declare interface StartInstanceArgs {
   instanceId?: string;
   /**
    * URL path on the supplied client where the engine fetches the
-   * caller's ACL grants. Identity is always token-resolved — `actor`
-   * comes from `client.request({ uri: "/users/me" })` — and grants
+   * caller's ACL grants. Identity is always token-resolved — `actor` is
+   * resolved from the supplied client's token, never passed in — and grants
    * feed the advisory `$can.*` params action conditions can read;
    * omitting this leaves the rendered `$can` undefined (conditions
    * referencing it fail closed, nothing else is gated engine-side —
@@ -9365,10 +9392,14 @@ export declare interface WorkflowAutonomy extends AutonomyAnswer {
 
 export declare interface WorkflowClient {
   /**
-   * Read the effective client configuration. The engine probes `apiHost`
-   * before deriving the global `/users/me` sibling because `@sanity/client`
-   * shallow-merges `withConfig` overrides and otherwise preserves an explicit
-   * project host even when `useProjectHostname` is set to `false`.
+   * Read the effective client configuration. The engine reads two fields from
+   * it. `apiHost` is probed before deriving the global `/users/me` sibling,
+   * because `@sanity/client` shallow-merges `withConfig` overrides and
+   * otherwise preserves an explicit project host even when
+   * `useProjectHostname` is set to `false`. `projectId` addresses the project's
+   * user directory when a project-scoped principal has to be bridged to its
+   * account-global id — a client reporting none has no directory to ask, and
+   * such a session is refused rather than stamped locally.
    */
   config?: () => WorkflowClientConfig;
   fetch: <T = unknown>(

package/dist/index.js

@@ -1,4 +1,4 @@
-import { terminalState, andConditions, deriveActivityKind, parseDefinitionSnapshot, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, rethrowWithContext, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, parentRef, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, WORKFLOW_INSTANCE_TYPE, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, assertReadableModel, InstanceNotFoundError, modelStampFor, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, minReaderModelOf, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, isUnprimed, DefinitionInUseError, assertReaderModelAcknowledgement, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { terminalState, andConditions, deriveActivityKind, parseDefinitionSnapshot, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, rethrowWithContext, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, parentRef, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, WORKFLOW_INSTANCE_TYPE, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, assertReadableModel, InstanceNotFoundError, modelStampFor, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, minReaderModelOf, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, driverKind, EffectNotFoundError, firstCarriedGlobalId, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, isUnprimed, DefinitionInUseError, assertReaderModelAcknowledgement, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
 
 import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, ModelVersionAheadError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, SYSTEM_IDENTITY, clientConfigFromResource, fieldTreeShape, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, modelVersionOf, parseDefinitionSnapshotValue, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, requiredModelFeatures, requiredReaderModel, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
@@ -3301,6 +3301,14 @@ function latestDefinitionsGroq() {
     return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
 }
 
+function deployedTagsGroq() {
+    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+}
+
+function definitionTagsGroq() {
+    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+}
+
 function latestDeployedDefinitions(rows) {
     const byName = /* @__PURE__ */ new Map;
     for (const row of rows) {
@@ -4790,8 +4798,11 @@ function cacheFor(client) {
 
 function ingestDirectoryRows(args) {
     const records = Array.isArray(args.response) ? args.response : [ args.response ];
-    for (const row of records) typeof row?.id != "string" || typeof row.sanityUserId != "string" || args.requested.has(row.id) && classifyPrincipalId(row.sanityUserId).namespace === "global" && (args.cache.set(row.id, row.sanityUserId), 
-    args.out.set(row.id, row.sanityUserId));
+    for (const row of records) {
+        if (typeof row?.id != "string" || !args.requested.has(row.id)) continue;
+        const globalId = directoryBridgeId(row.sanityUserId);
+        globalId !== void 0 && (args.cache.set(row.id, globalId), args.out.set(row.id, globalId));
+    }
 }
 
 async function getInstanceDocument(client, instanceId) {
@@ -5437,10 +5448,14 @@ async function resolveGlobalProjectUser(args) {
 async function ingestMemberJoin(args) {
     const {request: request, projectId: projectId, cache: cache} = args, memberIds = await projectMemberIds(request, projectId);
     if (memberIds.length === 0) return;
-    const response = await request({
+    const requested = new Set(memberIds), response = await request({
         uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
     });
-    for (const row of Array.isArray(response) ? response : [ response ]) isClientProjectUser(row) && typeof row.sanityUserId == "string" && cache.set(`${projectId}:${row.sanityUserId}`, row);
+    for (const row of Array.isArray(response) ? response : [ response ]) {
+        if (!isClientProjectUser(row) || !requested.has(row.id)) continue;
+        const globalId = directoryBridgeId(row.sanityUserId);
+        globalId !== void 0 && cache.set(`${projectId}:${globalId}`, row);
+    }
 }
 
 function clientProjectUserDirectory(client, projectId) {
@@ -5462,7 +5477,10 @@ function clientProjectUserDirectory(client, projectId) {
                 }), candidate = Array.isArray(response) ? response[0] : response;
                 return candidate == null ? {
                     status: "missing"
-                } : isClientProjectUser(candidate) ? {
+                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
+                    status: "inaccessible",
+                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
+                } : {
                     status: "resolved",
                     user: candidate
                 } : {
@@ -8423,14 +8441,20 @@ function cachedGrants({client: client, requestFn: requestFn, resourcePath: resou
 }
 
 async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalId = usableId(globalUser.user), id = globalId ?? resourceId;
-    if (id === void 0) return;
-    refuseProjectPrincipalWithoutGlobal({
-        resourceId: resourceId,
-        globalId: globalId,
-        globalUser: globalUser
-    });
-    const roleNames = (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
     return {
         actor: {
             kind: "person",
@@ -8445,13 +8469,62 @@ async function fetchActor(client, requestFn) {
     };
 }
 
-function refuseProjectPrincipalWithoutGlobal(args) {
-    const {resourceId: resourceId, globalId: globalId, globalUser: globalUser} = args;
-    if (globalId !== void 0 || resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project") return;
-    const reason = "reason" in globalUser ? globalUser.reason : "no record";
-    throw new Error(`workflow: the caller's identity on the workflow resource host is project-scoped ("${resourceId}") and the account-global record could not be resolved (${reason}). The engine speaks account-global user ids only and never acts as a project-scoped principal.`, "cause" in globalUser ? {
-        cause: globalUser.cause
-    } : void 0);
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
 }
 
 function usableId(user) {
@@ -12921,4 +12994,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/workflow-engine",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Workflow / BPM engine for Sanity content — define workflows as data, run them as instances against a Sanity client.",
   "keywords": [
     "bpm",