@sanity/workflow-engine 0.28.0 → 0.30.0

package/dist/_chunks-es/invariants.js

@@ -41,79 +41,6 @@ function andConditions(parts) {
     if (present.length !== 0) return present.length === 1 ? present[0] : present.map(p => `(${p})`).join(" && ");
 }
 
-class WorkflowError extends Error {
-    kind;
-    constructor(kind, message, options) {
-        super(message, options), this.kind = kind;
-    }
-}
-
-class ContractViolationError extends WorkflowError {
-    constructor(message) {
-        super("contract-violation", message), this.name = "ContractViolationError";
-    }
-}
-
-class InstanceNotFoundError extends WorkflowError {
-    instanceId;
-    constructor(args) {
-        super("instance-not-found", `Workflow instance ${args.instanceId} not found${args.detail ? ` (${args.detail})` : ""}`), 
-        this.name = "InstanceNotFoundError", this.instanceId = args.instanceId;
-    }
-}
-
-class DefinitionNotFoundError extends WorkflowError {
-    definition;
-    version;
-    constructor(args) {
-        super("definition-not-found", args.version !== void 0 ? `Workflow definition ${args.definition} v${args.version} not deployed` : `Workflow definition ${args.definition} has no deployed versions`), 
-        this.name = "DefinitionNotFoundError", this.definition = args.definition, args.version !== void 0 && (this.version = args.version);
-    }
-}
-
-class SpawnContractsInvalidError extends WorkflowError {
-    issues;
-    constructor(args) {
-        super("spawn-contracts-invalid", args.message), this.name = "SpawnContractsInvalidError", 
-        this.issues = args.issues;
-    }
-}
-
-class DefinitionInUseError extends WorkflowError {
-    definition;
-    blockedBy;
-    constructor(args) {
-        super("definition-in-use", definitionInUseMessage(args.definition, args.blockedBy)), 
-        this.name = "DefinitionInUseError", this.definition = args.definition, this.blockedBy = args.blockedBy;
-    }
-}
-
-function definitionInUseMessage(definition, blockedBy) {
-    if (blockedBy.reason === "non-terminal-instances") {
-        const head = blockedBy.instanceIds.slice(0, 3).join(", "), preview = blockedBy.instanceIds.length > 3 ? `${head}, …` : head;
-        return `Cannot delete ${definition}: ${blockedBy.instanceIds.length} non-terminal instance(s) exist (${preview}). Pass cascade to abort them first — instances are aborted in place, never deleted.`;
-    }
-    const names = blockedBy.referrers.map(r => `${r.definition} v${r.version}`).join(", ");
-    return `Cannot delete ${definition}: still spawn-referenced by deployed definition(s) ${names}. Delete or redeploy the referrer(s) first.`;
-}
-
-class EffectNotFoundError extends WorkflowError {
-    instanceId;
-    effectKey;
-    settled;
-    constructor(args) {
-        super("effect-not-found", effectNotFoundMessage(args)), this.name = "EffectNotFoundError", 
-        this.instanceId = args.instanceId, this.effectKey = args.effectKey, args.settled !== void 0 && (this.settled = args.settled);
-    }
-}
-
-function effectNotFoundMessage(args) {
-    const base = `Pending effect "${args.effectKey}" not found on instance ${args.instanceId}`;
-    if (args.settled === void 0) return base;
-    const cause = args.settled.detail !== void 0 ? ` (${args.settled.detail})` : "";
-    return args.settled.status === "cancelled" ? `${base} — it was cancelled at ${args.settled.ranAt}${cause}` : `${base} — it already settled "${args.settled.status}" at ${args.settled.ranAt}${cause}`;
-}
-
 const KNOWN_SCHEMES = /* @__PURE__ */ new Set([ "dataset", "canvas", "media-library", "dashboard" ]), KNOWN_SCHEMES_TEXT = [ ...KNOWN_SCHEMES ].join(", ");
 
 class VersionSpecificDatasetGdrError extends Error {
@@ -329,6 +256,79 @@ function isGdr(value) {
     return typeof value == "object" && value !== null && typeof value.id == "string" && typeof value.type == "string";
 }
 
+class WorkflowError extends Error {
+    kind;
+    constructor(kind, message, options) {
+        super(message, options), this.kind = kind;
+    }
+}
+
+class ContractViolationError extends WorkflowError {
+    constructor(message) {
+        super("contract-violation", message), this.name = "ContractViolationError";
+    }
+}
+
+class InstanceNotFoundError extends WorkflowError {
+    instanceId;
+    constructor(args) {
+        super("instance-not-found", `Workflow instance ${args.instanceId} not found${args.detail ? ` (${args.detail})` : ""}`), 
+        this.name = "InstanceNotFoundError", this.instanceId = args.instanceId;
+    }
+}
+
+class DefinitionNotFoundError extends WorkflowError {
+    definition;
+    version;
+    constructor(args) {
+        super("definition-not-found", args.version !== void 0 ? `Workflow definition ${args.definition} v${args.version} not deployed` : `Workflow definition ${args.definition} has no deployed versions`), 
+        this.name = "DefinitionNotFoundError", this.definition = args.definition, args.version !== void 0 && (this.version = args.version);
+    }
+}
+
+class SpawnContractsInvalidError extends WorkflowError {
+    issues;
+    constructor(args) {
+        super("spawn-contracts-invalid", args.message), this.name = "SpawnContractsInvalidError", 
+        this.issues = args.issues;
+    }
+}
+
+class DefinitionInUseError extends WorkflowError {
+    definition;
+    blockedBy;
+    constructor(args) {
+        super("definition-in-use", definitionInUseMessage(args.definition, args.blockedBy)), 
+        this.name = "DefinitionInUseError", this.definition = args.definition, this.blockedBy = args.blockedBy;
+    }
+}
+
+function definitionInUseMessage(definition, blockedBy) {
+    if (blockedBy.reason === "non-terminal-instances") {
+        const head = blockedBy.instanceIds.slice(0, 3).join(", "), preview = blockedBy.instanceIds.length > 3 ? `${head}, …` : head;
+        return `Cannot delete ${definition}: ${blockedBy.instanceIds.length} non-terminal instance(s) exist (${preview}). Pass cascade to abort them first — instances are aborted in place, never deleted.`;
+    }
+    const names = blockedBy.referrers.map(r => `${r.definition} v${r.version}`).join(", ");
+    return `Cannot delete ${definition}: still spawn-referenced by deployed definition(s) ${names}. Delete or redeploy the referrer(s) first.`;
+}
+
+class EffectNotFoundError extends WorkflowError {
+    instanceId;
+    effectKey;
+    settled;
+    constructor(args) {
+        super("effect-not-found", effectNotFoundMessage(args)), this.name = "EffectNotFoundError", 
+        this.instanceId = args.instanceId, this.effectKey = args.effectKey, args.settled !== void 0 && (this.settled = args.settled);
+    }
+}
+
+function effectNotFoundMessage(args) {
+    const base = `Pending effect "${args.effectKey}" not found on instance ${args.instanceId}`;
+    if (args.settled === void 0) return base;
+    const cause = args.settled.detail !== void 0 ? ` (${args.settled.detail})` : "";
+    return args.settled.status === "cancelled" ? `${base} — it was cancelled at ${args.settled.ranAt}${cause}` : `${base} — it already settled "${args.settled.status}" at ${args.settled.ranAt}${cause}`;
+}
+
 const LAKE_ID_SEGMENT_RE = /^[a-z0-9][a-z0-9-]*$/, LAKE_ID_SEGMENT_GLOSS = "ASCII lowercase + digits + dashes, no leading dash, no dots";
 
 function validateTag(tag) {
@@ -525,6 +525,7 @@ function desugarWorkflow(authoring) {
         return {
             ...stripUndefined({
                 name: stage.name,
+                semantics: stage.semantics,
                 title: stage.title,
                 description: stage.description,
                 groups: stage.groups,
@@ -548,6 +549,7 @@ function desugarWorkflow(authoring) {
         definition: {
             ...stripUndefined({
                 name: authoring.name,
+                semantics: authoring.semantics,
                 title: authoring.title,
                 description: authoring.description,
                 groups: authoring.groups,
@@ -652,6 +654,7 @@ function desugarFieldEntry({entry: entry, path: path, ctx: ctx}) {
             options: entry.options,
             validation: entry.validation,
             types: entry.types,
+            roles: entry.roles,
             fields: entry.fields,
             of: entry.of
         })
@@ -774,6 +777,7 @@ function desugarActivity({activity: activity, path: path, stageEnv: stageEnv, ct
     return {
         ...stripUndefined({
             name: activity.name,
+            semantics: activity.semantics,
             title: activity.title,
             description: activity.description,
             groups: activity.groups,
@@ -1245,7 +1249,66 @@ function isTerminalActivityStatus(status) {
     return TERMINAL_ACTIVITY_STATUSES.includes(status);
 }
 
-const ACTION_SEMANTICS = [ "decision.accept", "decision.decline" ], FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISSIONS = [ "create", "read", "update" ], MUTATION_GUARD_ACTIONS = [ "create", "update", "delete", "publish", "unpublish" ], ACTIVITY_KINDS = [ "user", "service", "script", "manual", "receive" ], EXECUTOR_CLASSIFICATIONS = [ "autonomous", "interactive", "off-system", "hybrid" ], GROUP_KINDS = [ "core", "details" ], DRIVER_KINDS = [ "person", "agent", "service", "engine" ], CONDITION_VARS = [ {
+const SIGNAL_SEMANTICS = [ "signal.positive", "signal.caution", "signal.critical" ], DECISION_SEMANTICS = [ "decision.accept", "decision.decline" ], ACTION_SEMANTICS = [ ...DECISION_SEMANTICS, ...SIGNAL_SEMANTICS ], FIELD_SCOPES = [ "workflow", "stage", "activity" ], DOCUMENT_VALUE_PERMISSIONS = [ "create", "read", "update" ], MUTATION_GUARD_ACTIONS = [ "create", "update", "delete", "publish", "unpublish" ], ACTIVITY_KINDS = [ "user", "service", "script", "manual", "receive" ], EXECUTOR_CLASSIFICATIONS = [ "autonomous", "interactive", "off-system", "hybrid" ], GROUP_KINDS = [ "core", "details" ], DRIVER_KINDS = [ "person", "agent", "service", "engine" ];
+
+function releaseDocId(releaseName) {
+    return `_.releases.${releaseName}`;
+}
+
+function releaseRef({res: res, releaseName: releaseName}) {
+    if (releaseName.length === 0) throw new ContractViolationError("releaseRef: releaseName must be a non-empty release name");
+    return {
+        id: gdrFromResource(res, releaseDocId(releaseName)),
+        type: "system.release",
+        releaseName: releaseName
+    };
+}
+
+function isAlwaysArrayFieldKind(kind) {
+    return kind === "doc.refs" || kind === "assignees" || kind === "array";
+}
+
+function isSingleDocRefKind(kind) {
+    return kind === "doc.ref" || kind === "subject";
+}
+
+function refKindAcceptsTypes(kind) {
+    return isSingleDocRefKind(kind) || kind === "doc.refs";
+}
+
+function assignmentKindAcceptsRoles(kind) {
+    return kind === "assignee" || kind === "assignees";
+}
+
+function isSingleDocRefEntry(entry) {
+    return isSingleDocRefKind(entry._type);
+}
+
+function isAssignmentFieldEntry(entry) {
+    return assignmentKindAcceptsRoles(entry._type);
+}
+
+function isTodoListItem(row) {
+    if (typeof row != "object" || row === null) return !1;
+    const candidate = row, status = candidate.status;
+    return typeof candidate._key == "string" && typeof candidate.label == "string" && (status == null || typeof status == "string");
+}
+
+function declaredRowColumns(entry) {
+    if (("_type" in entry ? entry._type : entry.type) === "array") return new Set((("of" in entry ? entry.of : void 0) ?? []).map(shape => shape.name));
+}
+
+function isTodoListEntry(entry) {
+    const columns = declaredRowColumns(entry);
+    return columns !== void 0 && columns.has("label") && columns.has("status");
+}
+
+function isNotesEntry(entry) {
+    const columns = declaredRowColumns(entry);
+    return columns !== void 0 && columns.has("body") && columns.has("actor") && columns.has("at");
+}
+
+const CONDITION_VARS = [ {
     name: "self",
     binding: "always",
     label: "this workflow instance",
@@ -1320,6 +1383,11 @@ const ACTION_SEMANTICS = [ "decision.accept", "decision.decline" ], FIELD_SCOPES
     binding: "caller",
     label: "your permissions",
     description: "Advisory per-permission booleans computed from the caller's grants; `undefined` without grants. Bound wherever grants ride the evaluation: the projection's rendered scope (fireAction-action filters, activity requirements, editability predicates) and the fireAction/editField commit gates. Deploy rejects it at every site that evaluates without grants: transition `when`s, activity filters, cascade-fired actions' `when`/`filter`, effect bindings, where-op `where`s, and the spawn `forEach`/`with`/`context` sites."
+}, {
+    name: "attributes",
+    binding: "caller",
+    label: "your attributes",
+    description: "Advisory org-level User Attributes for the caller (Enterprise — same values as lake `user::attributes()`), keyed by attribute name with each active scalar or array value. `undefined` on expected HTTP absence; unexpected fetch failures throw; empty page binds `{}`. Bound wherever grants ride the evaluation (same sites as `$can`). Soft-gate paths fetch at most 100 attributes (no further pages) and warn when the envelope reports `hasMore: true` (partial bag still binds). Not a security boundary — the Content Lake remains the only enforcement point."
 }, {
     name: "row",
     binding: "spawn",
@@ -1485,54 +1553,7 @@ function documentIdOf(doc) {
     return "(unknown id)";
 }
 
-const ACTOR_KINDS = [ "person", "agent", "system" ];
-
-function releaseDocId(releaseName) {
-    return `_.releases.${releaseName}`;
-}
-
-function releaseRef({res: res, releaseName: releaseName}) {
-    if (releaseName.length === 0) throw new ContractViolationError("releaseRef: releaseName must be a non-empty release name");
-    return {
-        id: gdrFromResource(res, releaseDocId(releaseName)),
-        type: "system.release",
-        releaseName: releaseName
-    };
-}
-
-function isSingleDocRefKind(kind) {
-    return kind === "doc.ref" || kind === "subject";
-}
-
-function refKindAcceptsTypes(kind) {
-    return isSingleDocRefKind(kind) || kind === "doc.refs";
-}
-
-function isSingleDocRefEntry(entry) {
-    return isSingleDocRefKind(entry._type);
-}
-
-function isTodoListItem(row) {
-    if (typeof row != "object" || row === null) return !1;
-    const candidate = row, status = candidate.status;
-    return typeof candidate._key == "string" && typeof candidate.label == "string" && (status == null || typeof status == "string");
-}
-
-function declaredRowColumns(entry) {
-    if (("_type" in entry ? entry._type : entry.type) === "array") return new Set((("of" in entry ? entry.of : void 0) ?? []).map(shape => shape.name));
-}
-
-function isTodoListEntry(entry) {
-    const columns = declaredRowColumns(entry);
-    return columns !== void 0 && columns.has("label") && columns.has("status");
-}
-
-function isNotesEntry(entry) {
-    const columns = declaredRowColumns(entry);
-    return columns !== void 0 && columns.has("body") && columns.has("actor") && columns.has("at");
-}
-
-const ANONYMOUS_IDENTITY = "<anonymous>", SYSTEM_IDENTITY = "<system>", E_PREFIXED_PROJECT_ID = /^e-(.+)$/;
+const ACTOR_KINDS = [ "person", "agent", "system" ], ANONYMOUS_IDENTITY = "<anonymous>", SYSTEM_IDENTITY = "<system>", E_PREFIXED_PROJECT_ID = /^e-(.+)$/;
 
 function classifyPrincipalId(id) {
     if (id === ANONYMOUS_IDENTITY || id === SYSTEM_IDENTITY) return {
@@ -1575,6 +1596,10 @@ function lakePrincipalId(args) {
     return args.localPrincipalId ?? args.actor.id;
 }
 
+function isRecord(value) {
+    return typeof value == "object" && value !== null && !Array.isArray(value);
+}
+
 class FieldValueShapeError extends WorkflowError {
     entryType;
     entryName;
@@ -1671,9 +1696,16 @@ const fieldValueSchemas = {
     query: v.any()
 };
 
-function shapeValueSchema(shape, leaf) {
-    if (shape.type === "object") return objectSchema(shape.fields ?? [], leaf);
-    if (shape.type === "array") return v.array(objectSchema(shape.of ?? [], leaf));
+function shapeValueSchema(args) {
+    const {shape: shape, leaf: leaf} = args;
+    if (shape.type === "object") return objectSchema({
+        fields: shape.fields ?? [],
+        leaf: leaf
+    });
+    if (shape.type === "array") return v.array(objectSchema({
+        fields: shape.of ?? [],
+        leaf: leaf
+    }));
     const schema = leaf[shape.type] ?? v.any();
     return constrainedScalarSchema({
         schema: schema,
@@ -1724,19 +1756,31 @@ function constrainedScalarSchema(args) {
     }) ?? [] ].join("; ")));
 }
 
-function objectSchema(fields, leaf) {
-    const entries = /* @__PURE__ */ Object.create(null);
-    for (const f of fields) entries[f.name] = v.optional(shapeValueSchema(f, leaf));
+function objectSchema(args) {
+    const {fields: fields, leaf: leaf} = args, entries = /* @__PURE__ */ Object.create(null);
+    for (const f of fields) entries[f.name] = v.optional(shapeValueSchema({
+        shape: f,
+        leaf: leaf
+    }));
     return v.looseObject(entries);
 }
 
 function wholeValueSchema(args) {
     const {entryType: entryType, shape: shape, leaf: leaf} = args;
-    return entryType === "object" ? v.union([ v.null(), objectSchema(shape.fields ?? [], leaf) ]) : entryType === "array" ? v.array(objectSchema(shape.of ?? [], leaf)) : leaf[entryType];
+    return entryType === "object" ? v.union([ v.null(), objectSchema({
+        fields: shape.fields ?? [],
+        leaf: leaf
+    }) ]) : entryType === "array" ? v.array(objectSchema({
+        fields: shape.of ?? [],
+        leaf: leaf
+    })) : leaf[entryType];
 }
 
 function appendItemSchema(entryType, shape) {
-    if (entryType === "array") return objectSchema(shape.of ?? [], valueSchemas);
+    if (entryType === "array") return objectSchema({
+        fields: shape.of ?? [],
+        leaf: valueSchemas
+    });
     if (entryType === "doc.refs") return GdrShape;
     if (entryType === "assignees") return AssigneeWriteShape;
 }
@@ -1788,7 +1832,7 @@ function checkValueAgainst(args, leaf) {
         entryType: args.entryType,
         validation: args.validation,
         value: args.value
-    });
+    }) ?? assignmentValueIssues(args, result.output);
     return postIssues !== void 0 ? {
         issues: postIssues
     } : {
@@ -1796,6 +1840,142 @@ function checkValueAgainst(args, leaf) {
     };
 }
 
+function assignmentIdentity(assignee) {
+    return assignee.type === "user" ? `user:${assignee.id}` : `role:${assignee.role}`;
+}
+
+function assignmentCandidate(value) {
+    const parsed = v.safeParse(AssigneeShape, value);
+    return parsed.success ? parsed.output : void 0;
+}
+
+function assignmentValueIssues(args, value) {
+    const retained = previousAssignmentIdentities(args), issues = [];
+    return visitAssignmentEntries({
+        entryType: args.entryType,
+        value: value,
+        roles: args.roles,
+        fields: args.fields,
+        of: args.of,
+        path: "$"
+    }, ({assignee: assignee, roles: roles, path: path}) => {
+        consumeRetainedAssignment({
+            retained: retained,
+            path: path,
+            identity: assignmentIdentity(assignee)
+        }) || issues.push(...assignmentCandidateIssues({
+            roles: roles,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases
+        }, assignee));
+    }), issues.length === 0 ? void 0 : issues;
+}
+
+function consumeRetainedAssignment(args) {
+    const identities = args.retained.get(args.path), remaining = identities?.get(args.identity) ?? 0;
+    return remaining === 0 || identities === void 0 ? !1 : (remaining === 1 ? identities.delete(args.identity) : identities.set(args.identity, remaining - 1), 
+    !0);
+}
+
+function previousAssignmentIdentities(args) {
+    const retained = /* @__PURE__ */ new Map;
+    if (args.previousValue === void 0 || args.entryType === "assignee") return retained;
+    const schema = wholeValueSchema({
+        entryType: args.entryType,
+        shape: args,
+        leaf: valueSchemas
+    });
+    if (schema === void 0) return retained;
+    const previous = v.safeParse(schema, args.previousValue);
+    return previous.success && visitAssignmentEntries({
+        entryType: args.entryType,
+        value: previous.output,
+        roles: args.roles,
+        fields: args.fields,
+        of: args.of,
+        path: "$"
+    }, ({assignee: assignee, path: path}) => {
+        const identities = retained.get(path) ?? /* @__PURE__ */ new Map, identity = assignmentIdentity(assignee);
+        identities.set(identity, (identities.get(identity) ?? 0) + 1), retained.set(path, identities);
+    }), retained;
+}
+
+function visitAssignmentEntries(args, visit) {
+    if (assignmentKindAcceptsRoles(args.entryType)) {
+        visitAssignmentCandidates(args, visit);
+        return;
+    }
+    if (args.entryType === "object") {
+        visitAssignmentFields({
+            fields: args.fields,
+            value: args.value,
+            path: args.path
+        }, visit);
+        return;
+    }
+    if (!(args.entryType !== "array" || !Array.isArray(args.value))) for (const row of args.value) visitAssignmentFields({
+        fields: args.of,
+        value: row,
+        path: `${args.path}[]`
+    }, visit);
+}
+
+function visitAssignmentCandidates(args, visit) {
+    if (args.roles === void 0) return;
+    const indexedValues = args.entryType === "assignees" && Array.isArray(args.value) ? args.value.map(value => ({
+        value: value,
+        path: args.path
+    })) : [ {
+        value: args.value,
+        path: args.path
+    } ];
+    for (const {value: value, path: path} of indexedValues) {
+        const assignee = assignmentCandidate(value);
+        assignee !== void 0 && visit({
+            assignee: assignee,
+            roles: args.roles,
+            path: path
+        });
+    }
+}
+
+function visitAssignmentFields(args, visit) {
+    if (!(args.fields === void 0 || !isRecord(args.value))) for (const field of args.fields) visitAssignmentShape({
+        shape: field,
+        value: args.value[field.name],
+        path: `${args.path}.${field.name}`
+    }, visit);
+}
+
+function visitAssignmentShape(args, visit) {
+    visitAssignmentEntries({
+        entryType: args.shape.type,
+        value: args.value,
+        roles: args.shape.roles,
+        fields: args.shape.fields,
+        of: args.shape.of,
+        path: args.path
+    }, visit);
+}
+
+function assignmentCandidateIssues(args, assignee) {
+    if (assignee.type === "role") return collectiveRoleIssues(args, assignee.role);
+    const held = args.memberRoles?.[assignee.id];
+    return held === void 0 ? args.memberRoles === void 0 ? [] : [ `user "${assignee.id}" has no available project membership for role eligibility` ] : args.roles.some(required => actorFulfillsRole({
+        actorRoles: held,
+        required: required,
+        aliases: args.roleAliases
+    })) ? [] : [ `user "${assignee.id}" does not fulfill any eligible role: ${formatEligibleRoles(args.roles)}` ];
+}
+
+function collectiveRoleIssues(args, role) {
+    return args.roles.includes(role) ? [] : [ `collective role "${role}" is not eligible — this entry accepts ${formatEligibleRoles(args.roles)}` ];
+}
+
+function formatEligibleRoles(roles) {
+    return roles.map(role => `"${role}"`).join(", ");
+}
+
 function issuesOf(check) {
     return "issues" in check ? check.issues : void 0;
 }
@@ -1855,6 +2035,20 @@ function validateFieldAppendItem(args) {
         issues: formatIssues(result.issues),
         mode: "item"
     });
+    const assignmentArgs = {
+        entryType: appendAssignmentEntryType(args.entryType),
+        value: result.output,
+        roles: args.roles,
+        fields: args.entryType === "array" ? args.of : void 0,
+        memberRoles: args.memberRoles,
+        roleAliases: args.roleAliases
+    }, assignmentIssues = assignmentValueIssues(assignmentArgs, result.output);
+    if (assignmentIssues !== void 0) throw new FieldValueShapeError({
+        entryType: args.entryType,
+        entryName: args.entryName,
+        issues: assignmentIssues,
+        mode: "item"
+    });
     const typeIssues = refTypeIssues({
         entryType: args.entryType,
         types: args.types,
@@ -1869,6 +2063,10 @@ function validateFieldAppendItem(args) {
     return result.output;
 }
 
+function appendAssignmentEntryType(entryType) {
+    return entryType === "assignees" ? "assignee" : entryType === "array" ? "object" : entryType;
+}
+
 function formatIssues(issues, formatMessage = issue => issue.message) {
     const formatOne = (issue, prefix) => {
         const keys = [ ...prefix, ...issue.path?.map(p => p.key) ?? [] ], sub = issue.issues?.filter(candidate => candidate.expected !== "null");
@@ -1961,6 +2159,10 @@ function opSchemas(targetSchema) {
         type: v.literal("field.set"),
         target: targetSchema,
         value: ValueExprSchema
+    }), v.strictObject({
+        type: v.literal("field.setIfMissing"),
+        target: targetSchema,
+        value: ValueExprSchema
     }), v.strictObject({
         type: v.literal("field.unset"),
         target: targetSchema
@@ -1968,6 +2170,14 @@ function opSchemas(targetSchema) {
         type: v.literal("field.append"),
         target: targetSchema,
         value: ValueExprSchema
+    }), v.strictObject({
+        type: v.literal("field.inc"),
+        target: targetSchema,
+        value: v.optional(ValueExprSchema)
+    }), v.strictObject({
+        type: v.literal("field.dec"),
+        target: targetSchema,
+        value: v.optional(ValueExprSchema)
     }), v.strictObject({
         type: v.literal("field.updateWhere"),
         target: targetSchema,
@@ -2049,16 +2259,17 @@ function compositeChecked(entries) {
     return v.pipe(v.strictObject(entries), v.check(input => compositeShapeOk(input), issue => compositeShapeMessage(issue.input)), v.check(input => duplicateSubfieldName(input) === void 0, issue => `duplicate sub-field name "${duplicateSubfieldName(issue.input)}" — sub-field names must be unique within \`fields\` / \`of\``));
 }
 
-const FieldShapeSchema = v.lazy(() => v.pipe(compositeChecked({
+const AssignmentRolesSchema = v.pipe(v.array(NonEmpty), v.minLength(1, "declare at least one eligible role, or omit `roles`")), FieldShapeSchema = v.lazy(() => v.pipe(compositeChecked({
     type: FieldValueKindSchema,
     name: FieldEntryName,
     title: v.optional(v.string()),
     description: v.optional(v.string()),
     options: v.optional(ChoiceOptionsSchema),
     validation: v.optional(ScalarValidationSchema),
+    roles: v.optional(AssignmentRolesSchema),
     fields: v.optional(v.array(FieldShapeSchema)),
     of: v.optional(v.array(FieldShapeSchema))
-}), choiceOptionsCheck(), scalarValidationCheck())), StoredEditableSchema = v.union([ v.literal(!0), NonEmpty ]), AuthoringEditableSchema = v.union([ v.literal(!0), v.array(NonEmpty), NonEmpty ]);
+}), choiceOptionsCheck(), scalarValidationCheck(), assignmentRolesCheck())), StoredEditableSchema = v.union([ v.literal(!0), NonEmpty ]), AuthoringEditableSchema = v.union([ v.literal(!0), v.array(NonEmpty), NonEmpty ]);
 
 function fieldBase(editable, group) {
     return {
@@ -2079,6 +2290,7 @@ function fieldEntryFields({editable: editable, group: group, kind: kind = FieldK
         options: v.optional(ChoiceOptionsSchema),
         validation: v.optional(ScalarValidationSchema),
         types: v.optional(v.pipe(v.array(NonEmpty), v.minLength(1, "declare at least one accepted type, or omit `types` to accept any"))),
+        roles: v.optional(AssignmentRolesSchema),
         fields: v.optional(v.array(FieldShapeSchema)),
         of: v.optional(v.array(FieldShapeSchema))
     };
@@ -2092,7 +2304,8 @@ function literalSeedIssues(entry) {
         fields: entry.fields,
         of: entry.of,
         options: entry.options,
-        validation: entry.validation
+        validation: entry.validation,
+        roles: entry.roles
     });
 }
 
@@ -2104,6 +2317,10 @@ function refTypesCheck() {
     return v.check(entry => entry.types === void 0 || refKindAcceptsTypes(entry.type), issue => `\`types\` is only valid on \`doc.ref\` / \`doc.refs\` / \`subject\` entries, not "${issue.input.type}"`);
 }
 
+function assignmentRolesCheck() {
+    return v.check(entry => entry.roles === void 0 || assignmentKindAcceptsRoles(entry.type), issue => `\`roles\` is only valid on \`assignee\` / \`assignees\` entries, not "${issue.input.type}"`);
+}
+
 function choiceOptionsCheck() {
     return v.check(entry => checkChoiceList({
         entryType: entry.type,
@@ -2138,11 +2355,11 @@ function scalarValidationDeclarationIssues(entry) {
 const FieldEntrySchema = pinned()(v.pipe(compositeChecked(fieldEntryFields({
     editable: StoredEditableSchema,
     group: StoredGroupMembershipSchema
-})), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), RawAuthoringFieldEntrySchema = pinned()(v.pipe(compositeChecked(fieldEntryFields({
+})), refTypesCheck(), assignmentRolesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), RawAuthoringFieldEntrySchema = pinned()(v.pipe(compositeChecked(fieldEntryFields({
     editable: AuthoringEditableSchema,
     group: AuthoringGroupMembershipSchema,
     kind: AuthoringRawFieldKindSchema
-})), refTypesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), ClaimFieldSchema = pinned()(v.strictObject({
+})), refTypesCheck(), assignmentRolesCheck(), choiceOptionsCheck(), scalarValidationCheck(), literalSeedCheck())), ClaimFieldSchema = pinned()(v.strictObject({
     type: v.literal("claim"),
     name: FieldEntryName,
     title: v.optional(v.string()),
@@ -2184,17 +2401,27 @@ const TodoListFieldSchema = pinned()(v.strictObject(listSugarFields("todoList"))
     required: v.optional(v.boolean()),
     options: v.optional(ChoiceOptionsSchema),
     validation: v.optional(ScalarValidationSchema)
-}), choiceOptionsCheck(), scalarValidationCheck());
+}), choiceOptionsCheck(), scalarValidationCheck()), CUSTOM_SEMANTIC_HINT = "`custom.<camelCaseMeaning>`", CustomSemanticSchema = v.custom(input => typeof input == "string" && /^custom\.[a-z][a-zA-Z0-9]*$/.test(input)), SemanticSchema = v.union([ picklist(SIGNAL_SEMANTICS), CustomSemanticSchema ], `expected ${SIGNAL_SEMANTICS.join(", ")}, or ${CUSTOM_SEMANTIC_HINT}`), ActionSemanticSchema = v.union([ picklist(ACTION_SEMANTICS), CustomSemanticSchema ], `expected ${ACTION_SEMANTICS.join(", ")}, or ${CUSTOM_SEMANTIC_HINT}`);
+
+function semanticNamespace(semantic) {
+    return semantic.startsWith("custom.") ? semantic : semantic.split(".", 1)[0] ?? semantic;
+}
 
 function hasUniqueSemanticNamespaces(semantics) {
-    const namespaces = semantics.map(semantic => semantic.split(".", 1)[0]);
+    const namespaces = semantics.map(semanticNamespace);
     return new Set(namespaces).size === namespaces.length;
 }
 
+function semanticsFieldSchema(semantic) {
+    return v.optional(v.pipe(v.array(semantic), v.minLength(1, "declare at least one semantic, or omit `semantics`"), v.check(hasUniqueSemanticNamespaces, "declare at most one semantic from each namespace")));
+}
+
+const SemanticsFieldSchema = semanticsFieldSchema(SemanticSchema), ActionSemanticsFieldSchema = semanticsFieldSchema(ActionSemanticSchema);
+
 function actionFields(op, group) {
     return {
         name: NonEmpty,
-        semantics: v.optional(v.pipe(v.array(picklist(ACTION_SEMANTICS)), v.minLength(1, "declare at least one semantic, or omit `semantics`"), v.check(hasUniqueSemanticNamespaces, "declare at most one semantic from each namespace"))),
+        semantics: ActionSemanticsFieldSchema,
         title: v.optional(v.string()),
         description: v.optional(v.string()),
         group: v.optional(group),
@@ -2241,6 +2468,7 @@ const StoredActionSchema = pinned()(v.strictObject({
 function activityFields({field: field, action: action, target: target, group: group}) {
     return {
         name: NonEmpty,
+        semantics: SemanticsFieldSchema,
         title: v.optional(v.string()),
         description: v.optional(v.string()),
         groups: v.optional(v.array(GroupSchema)),
@@ -2314,6 +2542,7 @@ const GuardSchema = v.strictObject(guardFields(NonEmpty)), AuthoringGuardSchema
 function stageFields({field: field, activity: activity, transition: transition, guard: guard, editable: editable}) {
     return {
         name: NonEmpty,
+        semantics: SemanticsFieldSchema,
         title: v.optional(v.string()),
         description: v.optional(v.string()),
         groups: v.optional(v.array(GroupSchema)),
@@ -2352,6 +2581,7 @@ const StoredStartSchema = pinned()(v.strictObject(startFields(picklist(START_KIN
 function workflowFields({field: field, stage: stage, start: start}) {
     return {
         name: NonEmpty,
+        semantics: SemanticsFieldSchema,
         title: NonEmpty,
         description: v.optional(v.string()),
         groups: v.optional(v.array(GroupSchema)),
@@ -2548,11 +2778,20 @@ function checkStageReachability({def: def, stageNames: stageNames, issues: issue
     });
 }
 
+function actionSites(def) {
+    return def.stages.flatMap((stage, i) => (stage.activities ?? []).flatMap((activity, j) => (activity.actions ?? []).map((action, a) => ({
+        action: action,
+        activity: activity,
+        stage: stage,
+        path: [ "stages", i, "activities", j, "actions", a ]
+    }))));
+}
+
 function effectNameSites(def) {
     const sites = [];
-    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) for (const [a, action] of (activity.actions ?? []).entries()) collectEffects({
+    for (const {action: action, path: path} of actionSites(def)) collectEffects({
         effects: action.effects,
-        path: [ "stages", i, "activities", j, "actions", a, "effects" ],
+        path: [ ...path, "effects" ],
         sites: sites
     });
     return sites;
@@ -2683,13 +2922,22 @@ function checkUnboundConditionVars(def, issues) {
     }
 }
 
+const SOFT_GATE_VARS = {
+    can: {
+        noun: "the caller's grants"
+    },
+    attributes: {
+        noun: "the caller's org-level user attributes"
+    }
+}, SOFT_GATE_VAR_NAMES = Object.keys(SOFT_GATE_VARS);
+
 function unboundVarsAt(site) {
     const callerVars = unboundCallerVars(site.policy);
     return site.bindsRow === !0 ? callerVars : [ ...callerVars, "row" ];
 }
 
 function unboundCallerVars(policy) {
-    return policy === "cascade" ? CALLER_BOUND_VARS : policy === "caller-bound" ? [ "params" ] : policy === "triggered-payload" ? [ "can", "params" ] : [ "can" ];
+    return policy === "cascade" ? CALLER_BOUND_VARS : policy === "caller-bound" ? [ "params" ] : policy === "triggered-payload" ? [ ...SOFT_GATE_VAR_NAMES, "params" ] : SOFT_GATE_VAR_NAMES;
 }
 
 const ROW_BINDING_CLAUSE = "$row (the discovered row in a spawn projection; the stored row under test in a where-op) is bound only while a spawn `with` projection or a where-op `where` evaluates";
@@ -2699,7 +2947,12 @@ function rowVarMessage(site) {
 }
 
 function callerVarMessage(site, name) {
-    return site.policy === "cascade" ? `${site.label} reads $${name} — cascade gates (transition \`when\`s, activity \`filter\`s, a cascade-fired action's \`when\`/\`filter\`) must resolve identically no matter whose token drives the cascade ($assigned is constant false, the other caller vars hold no value); gate on instance state (e.g. a field an action wrote), or pin executing identities with \`roles\`` : site.policy === "caller-bound" ? `${site.label} reads $${name} — $params (the firing action's args) is bound only while the action's effect bindings and where-op \`where\`s evaluate; this site never binds it, so the condition could never pass. Bind $params in an effect binding or a where-op instead, or gate on a field an action wrote` : site.policy === "triggered-payload" && name === "params" ? `${site.label} reads $params — a cascade-fired action has no caller to supply args, so $params never holds a value in its payload; read fields or effect outputs instead` : `${site.label} reads $can — $can (the caller's grants) is bound only in the caller-bound projection (action filters, requirements, editable predicates) and never holds a value in cascade conditions; move the check to one of those sites or drop $can`;
+    if (site.policy === "cascade") return `${site.label} reads $${name} — cascade gates (transition \`when\`s, activity \`filter\`s, a cascade-fired action's \`when\`/\`filter\`) must resolve identically no matter whose token drives the cascade ($assigned is constant false, the other caller vars hold no value); gate on instance state (e.g. a field an action wrote), or pin executing identities with \`roles\``;
+    if (site.policy === "caller-bound") return `${site.label} reads $${name} — $params (the firing action's args) is bound only while the action's effect bindings and where-op \`where\`s evaluate; this site never binds it, so the condition could never pass. Bind $params in an effect binding or a where-op instead, or gate on a field an action wrote`;
+    if (site.policy === "triggered-payload" && name === "params") return `${site.label} reads $params — a cascade-fired action has no caller to supply args, so $params never holds a value in its payload; read fields or effect outputs instead`;
+    const softGate = SOFT_GATE_VARS[name];
+    if (softGate !== void 0) return `${site.label} reads $${name} — $${name} (${softGate.noun}) is bound only in the caller-bound projection (action filters, requirements, editable predicates); this site never binds it. Move the check to one of those sites or drop $${name}`;
+    throw new Error(`callerVarMessage: unreachable for $${name} at ${site.label} (policy ${site.policy})`);
 }
 
 function conditionSites(def) {
@@ -2954,9 +3207,9 @@ function belowScopeNestedSites(args) {
 }
 
 function checkLevelKindEffectOutputs(def, issues) {
-    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) for (const [a, action] of (activity.actions ?? []).entries()) pushOutputIssues({
+    for (const {action: action, path: path} of actionSites(def)) pushOutputIssues({
         action: action,
-        path: [ "stages", i, "activities", j, "actions", a ],
+        path: path,
         issues: issues
     });
 }
@@ -3038,18 +3291,18 @@ function storedRolesIssue(action) {
 }
 
 function checkStoredRolesPlacement(def, issues) {
-    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) for (const [a, action] of (activity.actions ?? []).entries()) {
+    for (const {action: action, path: path} of actionSites(def)) {
         const message = storedRolesIssue(action);
         message !== void 0 && issues.push({
-            path: [ "stages", i, "activities", j, "actions", a, "roles" ],
+            path: [ ...path, "roles" ],
             message: message
         });
     }
 }
 
 function checkTriggeredActionParams(def, issues) {
-    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) for (const [a, action] of (activity.actions ?? []).entries()) action.when === void 0 || (action.params ?? []).length === 0 || issues.push({
-        path: [ "stages", i, "activities", j, "actions", a, "params" ],
+    for (const {action: action, path: path} of actionSites(def)) action.when === void 0 || (action.params ?? []).length === 0 || issues.push({
+        path: [ ...path, "params" ],
         message: `action "${action.name}" declares params but is cascade-fired (\`when\`) — no caller ever supplies args to a trigger. Drop the params, or drop \`when\` to make it a fireAction-fired action`
     });
 }
@@ -3094,13 +3347,20 @@ function checkSingleSubjectRequirements(def, issues) {
 
 function checkStartFilterReads(def, issues) {
     const filter = def.start?.filter;
-    filter !== void 0 && (conditionParameterNames(filter).has("fields") && issues.push({
+    if (filter === void 0) return;
+    const params = conditionParameterNames(filter);
+    params.has("fields") && issues.push({
         path: [ "start", "filter" ],
         message: "start.filter reads $fields, but the filter is browse-time-pure — a start surface evaluates it per document, before any inputs exist, so $fields cannot be bound. Move the input-dependent rule to a start requirement, the start-time readiness predicate that binds $fields and is enforced by startInstance"
-    }), readsRootDocument(filter) && !(def.fields ?? []).some(isSubjectEntry) && issues.push({
+    });
+    for (const name of CALLER_BOUND_VARS) params.has(name) && issues.push({
+        path: [ "start", "filter" ],
+        message: `start.filter reads $${name} — start.filter is a read-side document-visibility rule (definitionsForDocument / start controls); startInstance never evaluates it, and no caller bag binds there, so the read is GROQ null and the filter can never match. Drop $${name} from start.filter. A "who may start" rule belongs in a start requirement, not in the browse-time filter`
+    });
+    readsRootDocument(filter) && !(def.fields ?? []).some(isSubjectEntry) && issues.push({
         path: [ "start", "filter" ],
         message: "start.filter reads the candidate document (its root), but the definition declares no `subject` entry — a read surface would never have a document to bind as root, so every root read is GROQ null and the filter silently misevaluates. Declare a `subject` entry (the document the workflow is about), or gate on the dataset instead"
-    }));
+    });
 }
 
 function checkStartRequirementReads(def, issues) {
@@ -3396,15 +3656,13 @@ function seedEarlierSiblingTarget(args) {
 }
 
 function opSites(def) {
-    const sites = [];
-    for (const [i, stage] of def.stages.entries()) for (const [j, activity] of (stage.activities ?? []).entries()) for (const [a, action] of (activity.actions ?? []).entries()) sites.push({
+    return actionSites(def).map(({action: action, activity: activity, stage: stage, path: path}) => ({
         ops: action.ops,
-        path: [ "stages", i, "activities", j, "actions", a, "ops" ],
+        path: [ ...path, "ops" ],
         label: `action "${action.name}"`,
         stage: stage,
         activity: activity
-    });
-    return sites;
+    }));
 }
 
 function checkFieldReadOpValues(def, issues) {
@@ -3421,7 +3679,7 @@ function checkFieldReadOpValues(def, issues) {
 }
 
 function checkOpsFieldReads({ops: ops, path: path, label: label, ...ctx}) {
-    for (const [o, op] of (ops ?? []).entries()) if ("value" in op) for (const {read: read, path: readPath} of fieldReadsIn(op.value, [ ...path, o, "value" ])) checkOpFieldRead({
+    for (const [o, op] of (ops ?? []).entries()) if (!(!("value" in op) || op.value === void 0)) for (const {read: read, path: readPath} of fieldReadsIn(op.value, [ ...path, o, "value" ])) checkOpFieldRead({
         ...ctx,
         read: read,
         path: readPath,
@@ -3472,35 +3730,55 @@ function opFieldReadMissMessage({read: read, where: where, hosts: hosts}) {
     return `${where} reads field "${read.field}", which is not declared at ${searched} — the read resolves to undefined at op time, so the write silently lands empty. Known: ${known.join(", ") || "(none)"}`;
 }
 
-function checkUpdateWhereOps(def, issues) {
+function checkFieldTargetOps(def, issues) {
     const workflow = def.fields ?? [];
     for (const site of opSites(def)) for (const [o, op] of (site.ops ?? []).entries()) {
-        if (op.type !== "field.updateWhere") continue;
-        const scopes = {
-            workflow: workflow,
-            stage: site.stage.fields ?? [],
-            activity: site.activity.fields ?? []
-        };
-        checkUpdateWhereTargetKind({
+        const path = [ ...site.path, o ], rule = TARGET_KIND_RULES[op.type];
+        rule !== void 0 && "target" in op && checkTargetKind({
             op: op,
-            path: [ ...site.path, o ],
+            path: [ ...path, "target" ],
             label: site.label,
-            scopes: scopes,
+            scopes: opTargetScopes(workflow, site),
+            rule: rule,
             issues: issues
-        }), checkUpdateWhereMergeKeys({
+        }), op.type === "field.updateWhere" && checkUpdateWhereMergeKeys({
             op: op,
-            path: [ ...site.path, o ],
+            path: path,
             label: site.label,
             issues: issues
         });
     }
 }
 
-function checkUpdateWhereTargetKind({op: op, path: path, label: label, scopes: scopes, issues: issues}) {
+const arithmeticTargetRule = {
+    accepts: target => target.type === "number",
+    issue: () => "arithmetic ops target `number` entries only"
+}, TARGET_KIND_RULES = {
+    "field.inc": arithmeticTargetRule,
+    "field.dec": arithmeticTargetRule,
+    "field.setIfMissing": {
+        accepts: target => !isAlwaysArrayFieldKind(target.type),
+        issue: () => "setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    },
+    "field.updateWhere": {
+        accepts: target => target.type === "array",
+        issue: target => "updateWhere merges declared row sub-fields, so its target must be an `array` entry" + rowOpsHint(target.type)
+    }
+};
+
+function opTargetScopes(workflow, site) {
+    return {
+        workflow: workflow,
+        stage: site.stage.fields ?? [],
+        activity: site.activity.fields ?? []
+    };
+}
+
+function checkTargetKind({op: op, path: path, label: label, scopes: scopes, rule: rule, issues: issues}) {
     const target = scopes[op.target.scope]?.find(entry => entry.name === op.target.field);
-    target === void 0 || target.type === "array" || issues.push({
-        path: [ ...path, "target" ],
-        message: `${label} field.updateWhere targets ${op.target.scope}-scope "${op.target.field}" (${target.type}) — updateWhere merges declared row sub-fields, so its target must be an \`array\` entry${rowOpsHint(target.type)}`
+    target === void 0 || rule.accepts(target) || issues.push({
+        path: path,
+        message: `${label} ${op.type} targets ${op.target.scope}-scope "${op.target.field}" (${target.type}) — ${rule.issue(target)}`
     });
 }
 
@@ -3732,11 +4010,11 @@ function checkWorkflowInvariants(def) {
     }), checkEffectNames(def, issues), checkGuardNames(def, issues), checkFieldEntryNames(def, issues), 
     checkRequiredField(def, issues), checkStart(def, issues), checkPredicates(def, issues), 
     checkUnboundConditionVars(def, issues), checkConditionFieldReads(def, issues), checkFieldReadSeeds(def, issues), 
-    checkFieldReadOpValues(def, issues), checkUpdateWhereOps(def, issues), checkGuardFieldReads(def, issues), 
+    checkFieldReadOpValues(def, issues), checkFieldTargetOps(def, issues), checkGuardFieldReads(def, issues), 
     checkAssigneesEntries(def, issues), checkDueDateEntries(def, issues), checkSubjectEntries(def, issues), 
     checkLevelKindEffectOutputs(def, issues), checkActivityTerminalPaths(def, issues), 
     checkTerminalStageActivities(def, issues), checkTriggeredActionParams(def, issues), 
     checkStoredRolesPlacement(def, issues), checkGroups(def, issues), issues;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_STATUSES, ACTOR_KINDS, ANONYMOUS_IDENTITY, ActorShape, AuthoringActionSchema, AuthoringActivitySchema, AuthoringFieldEntrySchema, AuthoringGuardSchema, AuthoringOpSchema, AuthoringStageSchema, AuthoringTransitionSchema, AuthoringWorkflowSchema, CALLER_BOUND_VARS, CONDITION_VARS, ContractViolationError, DEFAULT_TRANSITION_WHEN, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DefinitionInUseError, DefinitionNotFoundError, EFFECTS_READ, EXECUTOR_CLASSIFICATIONS, EffectNotFoundError, EffectSchema, FIELD_READ, FIELD_SCOPES, FIELD_VALUE_KINDS, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GUARD_PREDICATE_VARS, GdrShape, GroupSchema, InstanceNotFoundError, IsoTimestamp, MUTATION_GUARD_ACTIONS, NonEmptyString, PersistedDocShapeError, RESERVED_CONDITION_VARS, RESOURCE_ALIAS_NAME_SOURCE, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StoredFieldOpSchema, VersionSpecificDatasetGdrError, WORKFLOW_DEFINITION_TYPE, WorkflowConfigSchema, WorkflowError, actorFulfillsRole, andConditions, checkWorkflowInvariants, choiceValueIssues, classifyPrincipalId, clientConfigFromResource, conditionEffectReads, conditionFieldReadNames, conditionParameterNames, conditionSyntaxIssues, datasetResourceParts, definitionDocId, deriveActivityKind, deriveExecutorClassification, desugarWorkflow, directoryBridgeId, driverKind, errorMessage, evaluateCondition, evaluateConditionOutcome, evaluatePredicates, extractDocumentId, fieldValueSchemas, firstCarriedGlobalId, formatIssuePath, formatIssues, formatValidationError, gdrFromResource, gdrRef, gdrResourcePrefix, gdrUri, groq, groupMembershipNames, isBareSeedId, isCascadeFired, isGdr, isGdrUri, isGuardReadExpr, isInputSourced, isNotesEntry, isParseableInstant, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTerminalActivityStatus, isTodoListEntry, isTodoListItem, isUnevaluable, labelFor, lakePrincipalId, parseFieldValue, parseGdr, parseOrThrow, parsePersistedDoc, parseResourceGdr, parseStoredDefinition, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refTypeIssues, rejectedRefTypes, releaseDocId, releaseRef, resourceAliasesToMap, resourceFromGdrUri, resourceFromParsed, resourceGdr, rethrowWithContext, runGroq, sameResource, scalarValidationIssues, schemaTreeShape, selfGdr, startKindOf, tagScopeFilter, toBareId, toPhysicalGdr, tolerantEntries, tolerantObject, tryParseGdr, validateFieldAppendItem, validateFieldValue, validateResourceAliasName, validateTag };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_STATUSES, ACTOR_KINDS, ANONYMOUS_IDENTITY, ActorShape, AuthoringActionSchema, AuthoringActivitySchema, AuthoringFieldEntrySchema, AuthoringGuardSchema, AuthoringOpSchema, AuthoringStageSchema, AuthoringTransitionSchema, AuthoringWorkflowSchema, CALLER_BOUND_VARS, CONDITION_VARS, ContractViolationError, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, DOCUMENT_VALUE_PERMISSIONS, DRIVER_KINDS, DefinitionInUseError, DefinitionNotFoundError, EFFECTS_READ, EXECUTOR_CLASSIFICATIONS, EffectNotFoundError, EffectSchema, FIELD_READ, FIELD_SCOPES, FIELD_VALUE_KINDS, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GUARD_PREDICATE_VARS, GdrShape, GroupSchema, InstanceNotFoundError, IsoTimestamp, MUTATION_GUARD_ACTIONS, NonEmptyString, PersistedDocShapeError, RESERVED_CONDITION_VARS, RESOURCE_ALIAS_NAME_SOURCE, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StoredFieldOpSchema, VersionSpecificDatasetGdrError, WORKFLOW_DEFINITION_TYPE, WorkflowConfigSchema, WorkflowError, actorFulfillsRole, andConditions, assignmentKindAcceptsRoles, checkWorkflowInvariants, choiceValueIssues, classifyPrincipalId, clientConfigFromResource, conditionEffectReads, conditionFieldReadNames, conditionParameterNames, conditionSyntaxIssues, datasetResourceParts, definitionDocId, deriveActivityKind, deriveExecutorClassification, desugarWorkflow, directoryBridgeId, driverKind, errorMessage, evaluateCondition, evaluateConditionOutcome, evaluatePredicates, extractDocumentId, fieldValueSchemas, firstCarriedGlobalId, formatIssuePath, formatIssues, formatValidationError, gdrFromResource, gdrRef, gdrResourcePrefix, gdrUri, groq, groupMembershipNames, isAlwaysArrayFieldKind, isAssignmentFieldEntry, isBareSeedId, isCascadeFired, isGdr, isGdrUri, isGuardReadExpr, isInputSourced, isNotesEntry, isParseableInstant, isRecord, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTerminalActivityStatus, isTodoListEntry, isTodoListItem, isUnevaluable, labelFor, lakePrincipalId, parseFieldValue, parseGdr, parseOrThrow, parsePersistedDoc, parseResourceGdr, parseStoredDefinition, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refTypeIssues, rejectedRefTypes, releaseDocId, releaseRef, resourceAliasesToMap, resourceFromGdrUri, resourceFromParsed, resourceGdr, rethrowWithContext, runGroq, sameResource, scalarValidationIssues, schemaTreeShape, selfGdr, startKindOf, tagScopeFilter, toBareId, toPhysicalGdr, tolerantEntries, tolerantObject, tryParseGdr, validateFieldAppendItem, validateFieldValue, validateResourceAliasName, validateTag };