@sanity/workflow-engine 0.30.0 → 0.32.0

package/dist/index.d.ts

@@ -99,6 +99,8 @@ export declare function aclPathForResource(
  * only when cascade-fired (the pin on which identities may execute the
  * trigger); a fireAction-fired action's `roles` folds into `filter` at
  * desugar instead.
+ *
+ * @interface
  */
 export declare type Action = ActionFields<Op, string[]> & {
   roles?: string[] | undefined;
@@ -185,10 +187,15 @@ export declare interface ActionEvaluation {
   /** Derived state of a cascade-fired action's `when` trigger — what would
    *  fire it. Present iff the action declares `when`. */
   whenInsight?: ConditionInsight;
+  /** A canonical `$assigned` filter leg withheld this absent action. The
+   *  action still follows filter-existence semantics; this metadata lets the
+   *  owning activity explain who currently holds the work. */
+  holderGate?: {
+    holders: Assignee[];
+  };
 }
 
-/** Type-mirror of {@link actionFields}, parameterised over the op and
- *  group-membership grammars. */
+/** @inline */
 declare type ActionFields<TOp, TGroup> = {
   name: string;
   semantics?: ActionSemantic[] | undefined;
@@ -210,6 +217,8 @@ export declare type ActionName = string;
  * or queuing effects: a missing required param throws
  * `ActionParamsInvalidError` and the action does not commit. Resolved values
  * feed `ValueExpr.param` lookups.
+ *
+ * @interface
  */
 export declare type ActionParam = v.InferOutput<typeof ActionParamSchema>;
 
@@ -390,6 +399,11 @@ export declare function actionVerdict(
   action: ActionEvaluation,
 ): AvailableAction;
 
+/** The members that own work after direct-user membership shadows every role route. */
+export declare function activeAssignmentMembers(
+  members: readonly Assignee[],
+): readonly Assignee[];
+
 /**
  * A unit of work carrying no payload of its own — every op, effect, and
  * spawn lives on an action; an activity contributes scoped `fields`
@@ -403,6 +417,8 @@ export declare function actionVerdict(
  * `requirements` are readiness gates orthogonal to `filter` — an unmet one
  * keeps the activity visible but disables its actions with a
  * `requirements-unmet` verdict; distinct from ACL and guards.
+ *
+ * @interface
  */
 export declare type Activity = ActivityFields<
   FieldEntry,
@@ -454,19 +470,6 @@ export declare const ACTIVITY_KINDS: readonly [
   "receive",
 ];
 
-/**
- * An activity is `active` from stage entry (or `skipped` when its `filter`
- * excluded it) until a terminal status resolves it — there is no pre-active
- * state. The authored action `status:` sugar (and the `status.set` op it
- * desugars to) is constrained to {@link TerminalActivityStatus}.
- */
-declare const ACTIVITY_STATUSES: readonly [
-  "active",
-  "done",
-  "skipped",
-  "failed",
-];
-
 /** The activity slice of a stage rollup — total by construction, like
  *  {@link stageAutonomyOf}. */
 export declare function activityAutonomyOf(
@@ -564,7 +567,7 @@ export declare interface ActivityEvaluation {
   actions: ActionEvaluation[];
 }
 
-/** Type-mirror of {@link activityFields}, parameterised over field/action/target/group. */
+/** @inline */
 declare type ActivityFields<TField, TAction, TTarget, TGroup> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -583,7 +586,13 @@ export declare type ActivityKind = (typeof ACTIVITY_KINDS)[number];
 
 export declare type ActivityName = string;
 
-export declare type ActivityStatus = (typeof ACTIVITY_STATUSES)[number];
+/**
+ * An activity is `active` from stage entry (or `skipped` when its `filter`
+ * excluded it) until a terminal status resolves it — there is no pre-active
+ * state. The authored action `status:` sugar (and the `status.set` op it
+ * desugars to) is constrained to {@link TerminalActivityStatus}.
+ */
+export declare type ActivityStatus = "active" | "done" | "skipped" | "failed";
 
 /**
  * Who is acting — advisory provenance, not an authenticated principal. The
@@ -633,7 +642,7 @@ export declare interface Actor {
  */
 export declare const ACTOR_KINDS: readonly ["person", "agent", "system"];
 
-/** Runtime counterpart of {@link expandRequiredRoles}; both expand only the required side. */
+/** Runtime role check; like alias expansion, it expands only the required side. */
 export declare function actorFulfillsRole({
   actorRoles,
   required,
@@ -646,6 +655,13 @@ export declare function actorFulfillsRole({
 
 export declare type ActorKind = (typeof ACTOR_KINDS)[number];
 
+/** Assignment ownership for runtime actors, with authorization aliases applied to role members. */
+export declare function actorMatchesAssignment(args: {
+  actor: Actor | undefined;
+  members: readonly Assignee[];
+  roleAliases?: RoleAliases | undefined;
+}): boolean;
+
 export declare type ActorResolution<User> =
   | {
       readonly status: "resolved";
@@ -720,9 +736,8 @@ export declare function assertReaderModelAcknowledgement(
 ): asserts expectedMinReaderModel is number;
 
 /**
- * One member of an `assignees`-kind entry's value — and the value of the
- * singular `assignee` kind. The WHO-FOR spec the inbox reverse-query and the
- * rendered `$assigned` gate match against. A `role` member names a capability
+ * One member of an assignment entry's value, matched by the inbox reverse-query
+ * and rendered `$assigned` gate. A `role` member names a capability
  * (fulfilled by whoever deploys that role), not a concrete principal — which
  * is what distinguishes it from {@link Actor}. `id` here is a SYSTEM
  * identifier (a principal), not authored identity.
@@ -737,6 +752,56 @@ export declare type Assignee =
       role: string;
     };
 
+export declare interface AssignmentIdentity {
+  readonly userId: string;
+  readonly roles: readonly string[];
+}
+
+/** @inline */
+declare type AssignmentInstance = Pick<
+  WorkflowInstance,
+  "currentStage" | "stages"
+>;
+
+export declare type AssignmentMatch = "user" | "role" | undefined;
+
+/** Whether an identity owns the assignment directly or through a literal project role. */
+export declare function assignmentMatch(
+  members: readonly Assignee[],
+  identity: AssignmentIdentity,
+): AssignmentMatch;
+
+/** Every member stored in assignment entries, preserving field and member order. */
+export declare function assignmentMembers(
+  entries: readonly ResolvedFieldEntry[],
+): readonly Assignee[];
+
+export declare function assignmentPrefilter(
+  assignment: NonNullable<InstancesQueryFilter["assignment"]>,
+  params: Record<string, string | string[]>,
+): string;
+
+export declare type AssignmentState = "unrouted" | "routed" | "held";
+
+/** Classify one assignment slot by whether it has no route, role routes, or a user holder. */
+export declare function assignmentState(
+  members: readonly Assignee[],
+): AssignmentState;
+
+export declare interface AssignmentStateCounts {
+  readonly unrouted: number;
+  readonly routed: number;
+  readonly held: number;
+}
+
+/** Viewer-scoped assignment counts at assignment-slot grain. Unrouted work is
+ *  visible to every viewer; routed and held count only work offered to or
+ *  held by the supplied identity. */
+export declare function assignmentStateCounts(
+  assignments: readonly (readonly Assignee[])[],
+  identity: AssignmentIdentity,
+): AssignmentStateCounts;
+
 export { AtomInsight };
 
 export { atomReadsDataset };
@@ -766,8 +831,7 @@ export declare const AUTHORING_DISPLAY: {
 };
 
 /**
- * The stored action fields plus two authoring sugars, or the
- * {@link ClaimAction} pair-half. `roles`: on a fireAction-fired action (no
+ * The stored action fields plus authoring sugar. `roles`: on a fireAction-fired action (no
  * `when`) it desugars into a `count($actor.roles[@ in [...]]) > 0` condition
  * ANDed with `filter`; on a CASCADE-FIRED action it stores VERBATIM instead —
  * the pin on which identities may execute the trigger, since folding it into
@@ -777,8 +841,9 @@ export declare const AUTHORING_DISPLAY: {
  * deliberately never implied, so a forgotten `status` is a visible stall
  * rather than a silently completed action.
  */
-export declare type AuthoringAction = AuthoringRawAction | ClaimAction;
+export declare type AuthoringAction = AuthoringRawAction;
 
+/** @interface */
 export declare type AuthoringActivity = ActivityFields<
   AuthoringFieldEntry,
   AuthoringAction,
@@ -792,41 +857,30 @@ export declare type AuthoringActivity = ActivityFields<
  * predicate `action.roles` produces. `true` opens the field to anyone in its
  * window; a bare string is a raw predicate.
  */
-export declare type AuthoringEditable = v.InferOutput<
-  typeof AuthoringEditableSchema
->;
-
-declare const AuthoringEditableSchema: v.UnionSchema<
-  [
-    v.LiteralSchema<true, undefined>,
-    v.ArraySchema<
-      v.SchemaWithPipe<
-        readonly [
-          v.StringSchema<undefined>,
-          v.MinLengthAction<string, 1, "must be a non-empty string">,
-        ]
-      >,
-      undefined
-    >,
-    v.SchemaWithPipe<
-      readonly [
-        v.StringSchema<undefined>,
-        v.MinLengthAction<string, 1, "must be a non-empty string">,
-      ]
-    >,
-  ],
-  undefined
->;
+export declare type AuthoringEditable = true | string[] | string;
 
+/**
+ * A raw field entry or one of the authoring-only field sugars. `todoList`
+ * expands to an array of objects with `label`, `status`, optional `assignee`,
+ * and optional `dueDate`; that due date remains an ordinary date field.
+ * `notes` expands to an array of audit-shaped objects with `body`, `actor`,
+ * and `at` fields. Sugar type names are compiled away and never become stored
+ * field kinds.
+ */
 export declare type AuthoringFieldEntry =
   | AuthoringRawFieldEntry
-  | ClaimField
   | TodoListField
   | NotesField;
 
-/** A field reference with `scope` optional; desugar resolves it lexically
- *  (activity → stage → workflow) into {@link StoredFieldRef}. */
-declare type AuthoringFieldRef = v.InferOutput<typeof AuthoringFieldRefSchema>;
+/**
+ * A field reference with `scope` optional; desugar resolves it lexically
+ * (activity → stage → workflow) into {@link StoredFieldRef}.
+ *
+ * @interface
+ */
+export declare type AuthoringFieldRef = v.InferOutput<
+  typeof AuthoringFieldRefSchema
+>;
 
 declare const AuthoringFieldRefSchema: v.StrictObjectSchema<
   {
@@ -844,8 +898,12 @@ declare const AuthoringFieldRefSchema: v.StrictObjectSchema<
   undefined
 >;
 
-/** {@link Guard}'s contract as authored: `match.idRefs` and `metadata` carry
- *  typed {@link GuardRead} values that deploy resolves to bare ones. */
+/**
+ * {@link Guard}'s contract as authored: `match.idRefs` and `metadata` carry
+ * typed {@link GuardRead} values that deploy resolves to bare ones.
+ *
+ * @interface
+ */
 export declare type AuthoringGuard = v.InferOutput<typeof AuthoringGuardSchema>;
 
 declare const AuthoringGuardSchema: v.StrictObjectSchema<
@@ -873,105 +931,7 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
           undefined
         >;
         idRefs: v.OptionalSchema<
-          v.ArraySchema<
-            v.VariantSchema<
-              "type",
-              [
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"self", undefined>;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"now", undefined>;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"fieldRead", undefined>;
-                    readonly field: v.SchemaWithPipe<
-                      readonly [
-                        v.StringSchema<undefined>,
-                        v.RegexAction<string, string>,
-                      ]
-                    >;
-                    readonly path: v.OptionalSchema<
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.SchemaWithPipe<
-                            readonly [
-                              v.StringSchema<undefined>,
-                              v.MinLengthAction<
-                                string,
-                                1,
-                                "must be a non-empty string"
-                              >,
-                            ]
-                          >,
-                          v.CheckAction<
-                            string,
-                            "a guard read path cannot contain a line break"
-                          >,
-                        ]
-                      >,
-                      undefined
-                    >;
-                  },
-                  undefined
-                >,
-                v.StrictObjectSchema<
-                  {
-                    readonly type: v.LiteralSchema<"effectsRead", undefined>;
-                    readonly effect: v.SchemaWithPipe<
-                      readonly [
-                        v.SchemaWithPipe<
-                          readonly [
-                            v.StringSchema<undefined>,
-                            v.MinLengthAction<
-                              string,
-                              1,
-                              "must be a non-empty string"
-                            >,
-                          ]
-                        >,
-                        v.CheckAction<
-                          string,
-                          "an effect name cannot contain `'`"
-                        >,
-                      ]
-                    >;
-                    readonly path: v.OptionalSchema<
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.SchemaWithPipe<
-                            readonly [
-                              v.StringSchema<undefined>,
-                              v.MinLengthAction<
-                                string,
-                                1,
-                                "must be a non-empty string"
-                              >,
-                            ]
-                          >,
-                          v.CheckAction<
-                            string,
-                            "a guard read path cannot contain a line break"
-                          >,
-                        ]
-                      >,
-                      undefined
-                    >;
-                  },
-                  undefined
-                >,
-              ],
-              undefined
-            >,
-            undefined
-          >,
+          v.ArraySchema<v.GenericSchema<GuardRead>, undefined>,
           undefined
         >;
         idPatterns: v.OptionalSchema<
@@ -998,492 +958,79 @@ declare const AuthoringGuardSchema: v.StrictObjectSchema<
             v.MinLengthAction<
               ("create" | "update" | "delete" | "publish" | "unpublish")[],
               1,
-              "a guard must match at least one action"
-            >,
-          ]
-        >;
-      },
-      undefined
-    >;
-    predicate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
-    metadata: v.OptionalSchema<
-      v.RecordSchema<
-        v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >,
-        v.VariantSchema<
-          "type",
-          [
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"self", undefined>;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"now", undefined>;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"fieldRead", undefined>;
-                readonly field: v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.RegexAction<string, string>,
-                  ]
-                >;
-                readonly path: v.OptionalSchema<
-                  v.SchemaWithPipe<
-                    readonly [
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.StringSchema<undefined>,
-                          v.MinLengthAction<
-                            string,
-                            1,
-                            "must be a non-empty string"
-                          >,
-                        ]
-                      >,
-                      v.CheckAction<
-                        string,
-                        "a guard read path cannot contain a line break"
-                      >,
-                    ]
-                  >,
-                  undefined
-                >;
-              },
-              undefined
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly type: v.LiteralSchema<"effectsRead", undefined>;
-                readonly effect: v.SchemaWithPipe<
-                  readonly [
-                    v.SchemaWithPipe<
-                      readonly [
-                        v.StringSchema<undefined>,
-                        v.MinLengthAction<
-                          string,
-                          1,
-                          "must be a non-empty string"
-                        >,
-                      ]
-                    >,
-                    v.CheckAction<string, "an effect name cannot contain `'`">,
-                  ]
-                >;
-                readonly path: v.OptionalSchema<
-                  v.SchemaWithPipe<
-                    readonly [
-                      v.SchemaWithPipe<
-                        readonly [
-                          v.StringSchema<undefined>,
-                          v.MinLengthAction<
-                            string,
-                            1,
-                            "must be a non-empty string"
-                          >,
-                        ]
-                      >,
-                      v.CheckAction<
-                        string,
-                        "a guard read path cannot contain a line break"
-                      >,
-                    ]
-                  >,
-                  undefined
-                >;
-              },
-              undefined
-            >,
-          ],
-          undefined
-        >,
-        undefined
-      >,
-      undefined
-    >;
-  },
-  undefined
->;
-
-/** Like {@link ManualTarget}, but the `field` variant also accepts a bare
- *  field name; desugar normalises it into {@link AuthoringFieldRef}. */
-export declare type AuthoringManualTarget = v.InferOutput<
-  typeof AuthoringManualTargetSchema
->;
-
-declare const AuthoringManualTargetSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"url", undefined>;
-        readonly url: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.UrlAction<string, "must be a valid URL">,
-            v.CheckAction<string, "must be an http(s) URL">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field", undefined>;
-        readonly field: v.UnionSchema<
-          [
-            v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >,
-            v.StrictObjectSchema<
-              {
-                readonly scope: v.OptionalSchema<
-                  v.PicklistSchema<
-                    readonly ["workflow", "stage", "activity"],
-                    string
-                  >,
-                  undefined
-                >;
-                readonly field: v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >;
-              },
-              undefined
-            >,
-          ],
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
-
-/** Like {@link Op}, plus: `status.set`'s `activity` is optional (desugar fills
- *  the firing activity), and the `audit` sugar — a stamped append merging
- *  `actor`/`at` {@link ValueExpr} fields into its own value. */
-export declare type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>;
-
-declare const AuthoringOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"status.set", undefined>;
-        readonly activity: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.StringSchema<undefined>,
-              v.MinLengthAction<string, 1, "must be a non-empty string">,
-            ]
-          >,
-          undefined
-        >;
-        readonly status: v.PicklistSchema<
-          readonly ["active", "done", "skipped", "failed"],
-          string
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"audit", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.OptionalSchema<
-              v.PicklistSchema<
-                readonly ["workflow", "stage", "activity"],
-                string
-              >,
-              undefined
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-        readonly stampFields: v.OptionalSchema<
-          v.StrictObjectSchema<
-            {
-              readonly actor: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-              readonly at: v.OptionalSchema<
-                v.SchemaWithPipe<
-                  readonly [
-                    v.StringSchema<undefined>,
-                    v.MinLengthAction<string, 1, "must be a non-empty string">,
-                  ]
-                >,
-                undefined
-              >;
-            },
-            undefined
-          >,
-          undefined
+              "a guard must match at least one action"
+            >,
+          ]
         >;
       },
       undefined
-    >,
-  ],
+    >;
+    predicate: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    metadata: v.OptionalSchema<
+      v.RecordSchema<
+        v.SchemaWithPipe<
+          readonly [
+            v.StringSchema<undefined>,
+            v.MinLengthAction<string, 1, "must be a non-empty string">,
+          ]
+        >,
+        v.GenericSchema<GuardRead>,
+        undefined
+      >,
+      undefined
+    >;
+  },
   undefined
 >;
 
+/** Like {@link ManualTarget}, but the `field` variant also accepts a bare
+ *  field name; desugar normalises it into {@link AuthoringFieldRef}. */
+export declare type AuthoringManualTarget =
+  | {
+      type: "url";
+      url: string;
+    }
+  | {
+      type: "field";
+      field: string | AuthoringFieldRef;
+    };
+
+/** Like {@link Op}, plus: `status.set`'s `activity` is optional (desugar fills
+ *  the firing activity), and the `audit` sugar — a stamped append merging
+ *  `actor`/`at` {@link ValueExpr} fields into its own value.
+ */
+export declare type AuthoringOp =
+  | FieldMutationOp<AuthoringFieldRef>
+  | {
+      type: "status.set";
+      activity?: string | undefined;
+      status: ActivityStatus;
+    }
+  | {
+      type: "audit";
+      target: AuthoringFieldRef;
+      value: ValueExpr;
+      stampFields?:
+        | {
+            actor?: string | undefined;
+            at?: string | undefined;
+          }
+        | undefined;
+    };
+
+/** @inline */
 declare type AuthoringRawAction = ActionFields<AuthoringOp, GroupMembership> & {
   roles?: string[] | undefined;
   status?: TerminalActivityStatus | undefined;
 };
 
+/** @inline */
 declare type AuthoringRawFieldEntry = FieldEntryFields<
   AuthoringEditable,
   GroupMembership
 >;
 
+/** @interface */
 export declare type AuthoringStage = StageFields<
   AuthoringFieldEntry,
   AuthoringActivity,
@@ -1505,7 +1052,11 @@ export declare type AuthoringTransition = TransitionFields & {
   when?: string | undefined;
 };
 
-/** The authoring surface: stored primitives plus the define-time sugar. */
+/**
+ * The authoring surface: stored primitives plus the define-time sugar.
+ *
+ * @interface
+ */
 export declare type AuthoringWorkflow = WorkflowFields<
   AuthoringFieldEntry,
   AuthoringStage,
@@ -1679,31 +1230,6 @@ export declare interface ChoiceOptions {
 
 export declare type ChoiceValue = string | number;
 
-/** The action half of the mirrored claim pair: `field` names the actor-valued entry this action claims, resolved lexically, and the expansion
- *  adds a no-steal `!defined($fields.<field>)` filter ANDed with `roles`/`filter` plus a `field.set` ← actor op. `ops`/`status` are reserved (strictObject rejects them). */
-declare type ClaimAction = {
-  type: "claim";
-  name: string;
-  title?: string | undefined;
-  description?: string | undefined;
-  group?: GroupMembership | undefined;
-  field: string | AuthoringFieldRef;
-  roles?: string[] | undefined;
-  filter?: string | undefined;
-  params?: ActionParam[] | undefined;
-  effects?: Effect[] | undefined;
-};
-
-/** The field half of the mirrored claim pair, expanding strictly within this entry: an `actor`
- *  working-memory field with no `initialValue` — the paired {@link ClaimAction}'s op fills it. */
-declare type ClaimField = {
-  type: "claim";
-  name: string;
-  title?: string | undefined;
-  description?: string | undefined;
-  group?: GroupMembership | undefined;
-};
-
 export declare interface ClassifiedPrincipal {
   namespace: PrincipalNamespace;
   /**
@@ -1744,9 +1270,14 @@ export declare function clientConfigFromResource(res: WorkflowResource):
       resource: WorkflowResource;
     };
 
-/** The router {@link buildClientForGdr} builds — total: every parsed GDR
+/** The total GDR router — every parsed GDR
  *  resolves to a client, or the router throws. */
-declare type ClientForGdr = (parsed: ParsedGdr) => WorkflowClient;
+export declare type ClientForGdr = (parsed: ParsedGdr) => WorkflowClient;
+
+/** Stored-resource dereferencing for write pre-flights and host previews. */
+export declare function clientGuardDereference(
+  client: Pick<WorkflowClient, "getDocument">,
+): GuardDereference;
 
 /** Native project-user response returned by Sanity's project API. */
 export declare interface ClientProjectUser {
@@ -1792,7 +1323,7 @@ export declare function clientProjectUserDirectory(
  * `createEngine({ clock })`, and tests use `@sanity/workflow-engine-test`'s
  * `setNow` / `advance` (the bench wraps the same seam). It is deliberately
  * NOT a field on the public per-verb `*Args` — the raw `workflow.*` verbs
- * accept it only through the internal {@link Clocked} seam, so prod code
+ * accept it only through the {@link Clocked} composition seam, so prod code
  * can't trivially override engine time by accident.
  *
  * `drainEffects` and `sweepStaleClaims` read the same engine clock for
@@ -1802,19 +1333,18 @@ export declare function clientProjectUserDirectory(
 export declare type Clock = () => string;
 
 /**
- * Internal clock-injection seam for the raw `workflow.*` verbs. NOT part
- * of the public per-verb args (it is deliberately not re-exported from the
- * package root) — production injects a clock ONCE via
- * `createEngine({ clock })`, and the test bench via its `setNow` /
- * `advance`. This intersection just lets those two callers thread the
- * clock into a raw verb without `clock` cluttering every documented
- * `*Args` interface as if it were an everyday option.
+ * Optional clock-injection field on the raw `workflow.*` verbs. It is
+ * exported because those verbs expose this composition helper in their
+ * public signatures, but production normally injects a clock once via
+ * `createEngine({ clock })`, and the test bench controls it through
+ * `setNow` / `advance`. The documented `*Args` interfaces omit `clock`
+ * because it is infrastructure context, not an everyday per-call option.
  */
-declare type Clocked<T> = T & {
+export declare type Clocked<T> = T & {
   clock?: Clock;
 };
 
-declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
+export declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
   /** The `_key` of the pending effect being reported on. */
   effectKey: string;
   /**
@@ -1841,7 +1371,7 @@ declare interface CommitEffectOpsArgs extends DedupableOperationArgs {
    */
   ops: FieldOp[];
   /** Lease duration the successful commit renews the claim to — the
-   *  drain's `effectLeaseMs`. Default `DEFAULT_EFFECT_LEASE_MS` (5 min). */
+   *  drain's `effects.leaseMs`. Default `DEFAULT_EFFECT_LEASE_MS` (5 min). */
   leaseMs?: number;
 }
 
@@ -1862,10 +1392,19 @@ export declare interface CompiledQuery {
   params: Record<string, string | string[]>;
 }
 
-/** Deliberately carries NO engine data-model stamp: the guard doc format is the lake's forthcoming contract, not ours to grow fields on (see DATAMODEL.md). */
-export declare function compileGuard(args: CompileGuardArgs): MutationGuardDoc;
+/**
+ * Translate one authored guard into the temporary documents that preview its
+ * eventual Content Lake enforcement.
+ * Content edits target draft ids, instance updates keep the instance id, and
+ * publish or unpublish targets published ids using the Lake operations those
+ * lifecycle writes perform. A mixed guard emits one document per id space so
+ * its action and id facets never form an unintended cross-product.
+ */
+export declare function compileGuards(
+  args: CompileGuardsArgs,
+): [MutationGuardDoc, ...MutationGuardDoc[]];
 
-declare interface CompileGuardArgs extends MutationGuardBody {
+export declare interface CompileGuardsArgs extends MutationGuardBody {
   id: string;
 }
 
@@ -1924,6 +1463,17 @@ export declare function computeDiffEntries<
   target: DeployTarget;
 }): Promise<DiffEntry[]>;
 
+/**
+ * Thrown when one automatic cascade hop loses every optimistic-locking
+ * attempt. An earlier verb commit may already have landed; invoke `tick`
+ * after re-reading the instance to resume convergence when contention subsides.
+ */
+export declare class ConcurrentCascadeError extends WorkflowError<"concurrent-cascade"> {
+  readonly instanceId: string;
+  readonly attempts: number;
+  constructor(args: { instanceId: string; attempts: number });
+}
+
 /** {@link ConcurrentCompleteEffectError}'s mid-dispatch sibling: a
  *  `commitEffectOps` commit lost every optimistic-locking attempt. Nothing
  *  was written; the report may be retried under the same idempotency key. */
@@ -1984,7 +1534,7 @@ export declare class ConcurrentEditFieldError extends WorkflowError<"concurrent-
 
 /**
  * Thrown when a `fireAction` commit loses the optimistic-locking race on
- * all {@link CONCURRENT_COMMIT_MAX_ATTEMPTS} attempts — every reload +
+ * every commit attempt — each reload +
  * `ifRevisionId` retry was beaten by another writer committing first.
  * Surfacing it (rather than silently overwriting) lets the caller decide
  * whether to retry later or report a write storm; nothing was committed
@@ -2011,7 +1561,7 @@ export declare class ConcurrentFireActionError extends WorkflowError<"concurrent
  * never a `_type` scan over the lake (rejected at deploy).
  *
  * There is no `{ref, args}` wrapper: parameterized reuse is a define-time
- * TypeScript function producing a condition string (see the {@link groq} tag).
+ * TypeScript function producing a condition string (see the {@link define.groq | groq} tag).
  */
 export declare type Condition = string;
 
@@ -2063,7 +1613,7 @@ export { ConditionRead };
  * then per stage — transitions, activities (filter, requirements, action
  * filters and `when` triggers), editable gates, tighten-overrides.
  * Editable gates resolve through the same helper the runtime projection uses
- * ({@link editableFieldsInStage}: entry `editable` ANDed with the stage
+ * (entry `editable` ANDed with the stage
  * tighten-override), so every live editable-field address exists here with
  * the same EFFECTIVE predicate the edit insight explains — including
  * override-only gates on `editable: true` entries, and workflow-scope fields
@@ -2098,7 +1648,7 @@ export declare type ConditionVarBinding = "always" | "caller" | "spawn";
 /**
  * The one-doc read a reactive adapter subscribes with to observe a content doc
  * under a perspective stack. It uses the same perspective semantics as
- * {@link hydrateSnapshot}: draft/version content is projected onto the published
+ * `hydrateSnapshot`: draft/version content is projected onto the published
  * id, and a doc that exists only as a draft or release version remains visible.
  */
 export declare function contentDocQuery(documentId: string): CompiledQuery;
@@ -2139,7 +1689,7 @@ export declare function contentDraftFallback(args: {
  * Note: this resolves a **single** release — the documented `instance.perspective`
  * shapes (`[release]` / `[release, "drafts"]`). The stores' per-doc reads take
  * one release, so a multi-release stack can't be observed through them; the
- * engine's own fetch path ({@link hydrateSnapshot}) — and the SDK adapter's
+ * engine's own fetch path (`hydrateSnapshot`) — and the SDK adapter's
  * query-store route for stacks without a `'drafts'` entry — honour the full
  * stack via `client.fetch({perspective})`.
  */
@@ -2250,15 +1800,12 @@ export declare class ContractViolationError extends WorkflowError<"contract-viol
  *   {@link Engine.subscriptionDocumentsForInstance} (need the pinned
  *   binding), {@link Engine.drainEffects} and
  *   {@link Engine.verifyDeployedDefinitions} (need the construction-time
- *   `effectHandlers` / `missingHandler` / `loggerFactory`).
+ *   `effects` / `loggerFactory`).
  * - Namespace-only: `workflow.permissions` — pure grant helpers that need
  *   no engine scope.
  *
- * Effect handlers + missingHandler feed {@link Engine.drainEffects}
- * (dispatch of unclaimed pending effects) and
- * {@link Engine.verifyDeployedDefinitions} (the startup audit of
- * deployed effect names). They don't change `fireAction` / `tick` /
- * `completeEffect` — the runtime still decides when to drain and
+ * The {@link EngineEffectsArgs} group changes nothing about `fireAction` /
+ * `tick` / `completeEffect` — the runtime still decides when to drain, and
  * reports outcomes via `completeEffect`.
  */
 export declare function createEngine<Client extends WorkflowClient>(
@@ -2267,8 +1814,8 @@ export declare function createEngine<Client extends WorkflowClient>(
 
 /**
  * The {@link EngineScopeArgs} scope pinned at construction, plus the
- * engine-only extras (`effectHandlers` / `missingHandler` / `loggerFactory`
- * feed `drainEffects` + `verifyDeployedDefinitions`). The `tag` partition is
+ * engine-only extras (`effects` and `loggerFactory` feed `drainEffects` +
+ * `verifyDeployedDefinitions`). The `tag` partition is
  * required and never defaulted — the engine enforces nothing, so the
  * partition is the only thing keeping reads and writes off the wrong
  * environment.
@@ -2277,18 +1824,8 @@ export declare interface CreateEngineArgs<
   Client extends WorkflowClient = WorkflowClient,
 > extends EngineScopeArgs {
   client: Client;
-  effectHandlers?: Record<string, EffectHandler<Client>>;
-  missingHandler?: MissingHandlerPolicy;
+  effects?: EngineEffectsArgs<Client>;
   loggerFactory?: LoggerFactory;
-  /**
-   * Lease duration `drainEffects` stamps on each pending-effect claim.
-   * Past the lease the claimer is presumed dead: the entry becomes
-   * recoverable by another drain's takeover or by
-   * the standalone `sweepStaleClaims` export. Default 5 minutes — size it well above
-   * the slowest handler's honest runtime, since a live-but-slow dispatch
-   * that outlives its lease can be redispatched (see {@link EffectHandler}).
-   */
-  effectLeaseMs?: number;
   /**
    * Deterministic-time seam, pinned once for this engine and threaded
    * into every verb it drives — `$now`, the `now` op-source, and the
@@ -2459,10 +1996,28 @@ export declare const DATA_MODEL_CHANGES: readonly [
     applicability: "detectable";
     summary: "Assignee fields may restrict newly assigned users and collective roles by role.";
   }>,
+  Readonly<{
+    id: "split-guard-id-spaces";
+    introducedInModel: 9;
+    minReaderModel: 9;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "Guards spanning edit and lifecycle id spaces emit independently retractable documents.";
+  }>,
+  Readonly<{
+    id: "singular-assignee-lists";
+    introducedInModel: 9;
+    minReaderModel: 9;
+    documentTypes: readonly ["definition", "instance"];
+    compatibility: "reader-floor";
+    applicability: "detectable";
+    summary: "Singular assignee fields use member lists with at most one user and any number of roles.";
+  }>,
 ];
 
 /** The maximum reader floor this writer can emit for a detectable feature. */
-export declare const DATA_MODEL_MAX_READER = 8;
+export declare const DATA_MODEL_MAX_READER = 9;
 
 /**
  * The unconditional model-4 reader floor for every engine-owned document.
@@ -2484,7 +2039,7 @@ export declare const DATA_MODEL_MIN_READER = 4;
  * `minReaderModel` floor. Declare every bump in `DATAMODEL.md`; the model-surface snapshot test
  * fails on undeclared drift.
  */
-export declare const DATA_MODEL_VERSION = 8;
+export declare const DATA_MODEL_VERSION = 9;
 
 export declare interface DataModelChange {
   readonly id: string;
@@ -2561,7 +2116,7 @@ export declare interface DedupableOperationArgs extends OperationArgs {
 export declare const DEFAULT_CONTENT_PERSPECTIVE = "drafts";
 
 /** How long a fresh claim's lease runs unless the engine configured
- *  `effectLeaseMs`. */
+ *  `effects.leaseMs`. */
 export declare const DEFAULT_EFFECT_LEASE_MS: number;
 
 /** How long a recorded idempotency key dedupes retries, unless the caller
@@ -2609,7 +2164,7 @@ export declare interface DefinitionGroupSite {
   members: GroupMember[];
 }
 
-declare interface DefinitionGuardsQueryArgs {
+export declare interface DefinitionGuardsQueryArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   workflowResource: WorkflowResource;
@@ -2661,6 +2216,11 @@ export declare class DefinitionNotFoundError extends WorkflowError<"definition-n
   constructor(args: { definition: string; version?: number });
 }
 
+/** Every literal project role a stored definition references, deduplicated in encounter order. */
+export declare function definitionRoleNames(
+  definition: WorkflowDefinition,
+): readonly string[];
+
 export declare interface DefinitionsForDocumentArgs {
   /**
    * The LOADED candidate document — unlike {@link InstancesForDocumentArgs},
@@ -2785,6 +2345,7 @@ export declare function denyingGuards(args: {
     type?: string;
   };
   context: MutationContext;
+  dereference?: GuardDereference;
 }): Promise<MutationGuardDoc[]>;
 
 export declare interface DeployDefinitionResult {
@@ -2842,14 +2403,13 @@ export declare interface DeployDefinitionsResult {
 /** A definition as fetched back from the lake. The document carries `_id` plus
  *  the deploy-stamped envelope the authored {@link WorkflowDefinition} never
  *  had: the assigned `version` and the content fingerprint it was minted from
- *  ({@link hashDefinitionContent}). A pre-fingerprint document may lack
- *  `contentHash` at runtime — see {@link LatestDeployed}. */
+ *  ({@link hashDefinitionContent}). */
 export declare type DeployedDefinition = WorkflowDefinition & {
   _id: string;
   tag?: string;
   version: number;
-  /** Optional: a document deployed before content-addressing has none — see
-   *  {@link LatestDeployed}. Every version this engine deploys carries one. */
+  /** Optional: a document deployed before content-addressing has none. Every
+   *  version this engine deploys carries one. */
   contentHash?: string;
   /** Engine data-model stamp (see {@link DATA_MODEL_VERSION}) — absent on
    *  documents deployed before the stamp existed (model 0). */
@@ -3089,16 +2649,17 @@ export declare interface DiagnoseResult {
 }
 
 /**
- * How an in-flight instance reads right now. `waiting` and `blocked` are both
- * HEALTHY, not stuck: `waiting` means an active activity has an available
- * action and advances when someone acts — how long a workflow is "allowed" to
- * wait is workflow- and team-specific, not this classifier's call — while
- * `blocked` means an active activity's declared requirements aren't all met
+ * How an instance reads right now. `waiting` and `blocked` are both healthy,
+ * not stuck. A `waiting` result says whether the activity awaits an
+ * action available to this caller (`caller`), a manual action that this caller
+ * cannot currently take (`manual-action`), or a cascade-fired action
+ * (`automation`). How long a workflow is "allowed" to wait is workflow- and
+ * team-specific, not this classifier's call. `blocked` means an active
+ * activity's declared requirements aren't all met
  * yet, and flips to `waiting` once they hold (typically a sibling activity
- * completing, or content landing). `completed` and `aborted` carry
- * `liveChildren` when spawned work is still running: a parent finishing while
- * detached children run is legal — detach means detach — but a consumer
- * should surface it loudly.
+ * completing, or content landing). Completed and aborted results include
+ * `liveChildren` while detached spawned work remains active; consumers should
+ * surface it prominently.
  */
 export declare type Diagnosis =
   | {
@@ -3109,6 +2670,7 @@ export declare type Diagnosis =
       activity: string;
       assignees: Assignee[];
       actions: string[];
+      waitingFor: "automation" | "caller" | "manual-action";
     }
   | {
       state: "blocked";
@@ -3148,7 +2710,7 @@ export declare interface DiffEntry {
 
 /**
  * Classifies `def` against the latest deployed version of its name via
- * {@link planDefinitionDeploy} — a content change is always a new version,
+ * the deploy planner — a content change is always a new version,
  * never an in-place update. `def` passes the same boundary parse deploy uses
  * ({@link parseDefinitionInput}), so diff and deploy accept and reject the
  * same input shape.
@@ -3279,26 +2841,25 @@ export declare interface DisplayMetadata {
 export declare function displayTitle(typeKey: string | undefined): string;
 
 /** Document-value permissions. Grants ({@link Grant} in ./authorization.ts) compose most-permissive-wins. */
-declare const DOCUMENT_VALUE_PERMISSIONS: readonly ["create", "read", "update"];
+export declare const DOCUMENT_VALUE_PERMISSIONS: readonly [
+  "create",
+  "manage",
+  "read",
+  "update",
+];
 
 /**
- * The guards that would deny a PROSPECTIVE lake action on a document — the
- * disable-this-button pre-flight, evaluated before any concrete mutation
- * exists. Advisory, like every guard verdict: the check explains and
- * disables, it never enforces.
+ * The guards that deny a concrete Lake mutation image. Advisory, like every
+ * engine-side guard verdict: the check explains and disables, it never
+ * enforces.
  */
 export declare function documentActionDenials(
   args: DocumentActionDenialsArgs,
 ): Promise<MutationGuardDoc[]>;
 
 export declare interface DocumentActionDenialsArgs {
-  /** The document's current value — both `before` and `after` of the
-   *  pre-flighted action (a prospective check has no concrete mutation, so
-   *  delta predicates see "no change"). */
-  doc: {
-    _id: string;
-    _type: string;
-  } & Record<string, unknown>;
+  /** The concrete Lake mutation the action will perform. */
+  mutation: MutationContext;
   /** The datasource the document lives in. A guard applies solely within the
    *  datasource it is registered in, so a same-id match from a foreign
    *  datasource can never gate this action and must not flip verdicts. */
@@ -3306,15 +2867,15 @@ export declare interface DocumentActionDenialsArgs {
     type: string;
     id: string;
   };
-  action: MutationGuardAction;
   guards: readonly MutationGuardDoc[];
   /** The caller's principal id in the guarded resource's own namespace,
    *  resolved as `identity()` in predicates. */
   identity?: string;
+  /** Resource-local stored-document lookup for predicates using `->`. */
+  dereference?: GuardDereference;
 }
 
-/** Compile-time mirror of {@link isDocumentEnvelopeKey}: the keys the
- *  boundary strips rather than rejects. */
+/** @inline */
 declare type DocumentEnvelopeKey =
   | `_${string}`
   | "tag"
@@ -3442,7 +3003,7 @@ export declare function driverKind(actor: Actor): DriverKind;
  * to decide who-may-edit. ADVISORY like every engine gate — it disables the
  * inline field and explains; a {@link Guard} declares the intended write-lock.
  */
-export declare type Editable = v.InferOutput<typeof StoredEditableSchema>;
+export declare type Editable = true | string;
 
 /**
  * One declared-editable field in the current scope, projected for an actor: its
@@ -3586,6 +3147,8 @@ export declare type EditMode = "set" | "append" | "unset";
  * completion and nothing is stored. Omitting `outputs` is an EMPTY allowlist,
  * so ANY returned output is rejected and fails the completion — the bound is
  * universal, not opt-in.
+ *
+ * @interface
  */
 export declare type Effect = v.InferOutput<typeof EffectSchema>;
 
@@ -3599,15 +3162,6 @@ export declare const EFFECT_COMMIT_DISPATCH_CAP = 200;
  *  (its queue depth stays ≤ 1). */
 export declare const EFFECT_COMMIT_QUEUE_DEPTH = 32;
 
-/**
- * Every terminal state an effect run can record. `done` and `failed` are
- * reported through completion ({@link EffectCompletionStatus}); `cancelled`
- * is engine-stamped only — an abort cancelling the entry before dispatch.
- * A cancellation is not a failure: anything counting failures (dashboards,
- * retry tooling) must not count aborted-away effects among them.
- */
-declare const EFFECT_RUN_STATUSES: readonly ["done", "failed", "cancelled"];
-
 /**
  * A `ctx.commitOps` / `ctx.setProgress` call hit one of the dispatch's
  * bounds. Thrown synchronously at the call site, not as a promise rejection:
@@ -3666,7 +3220,7 @@ export declare type EffectHandler<
   } | void>;
 }["bivarianceHack"];
 
-declare type EffectHandlerContext<Client extends WorkflowClient> = {
+export declare type EffectHandlerContext<Client extends WorkflowClient> = {
   /** A concrete sibling of the `createEngine` client, bound to the workflow resource with the
    *  same credentials; untagged handler requests carry the `workflow.effect` tag by default. */
   client: Client;
@@ -3784,7 +3338,14 @@ export declare function effectOutputsMap(
   instance: Pick<WorkflowInstance, "effectHistory">,
 ): Record<string, unknown>;
 
-export declare type EffectRunStatus = (typeof EFFECT_RUN_STATUSES)[number];
+/**
+ * Every terminal state an effect run can record. `done` and `failed` are
+ * reported through completion ({@link EffectCompletionStatus}); `cancelled`
+ * is engine-stamped only — an abort cancelling the entry before dispatch.
+ * A cancellation is not a failure: anything counting failures (dashboards,
+ * retry tooling) must not count aborted-away effects among them.
+ */
+export declare type EffectRunStatus = "done" | "failed" | "cancelled";
 
 declare const EffectSchema: v.StrictObjectSchema<
   {
@@ -3840,8 +3401,7 @@ export declare interface Engine {
   readonly client: WorkflowClient;
   readonly tag: string;
   readonly workflowResource: WorkflowResource;
-  readonly effectHandlers: Readonly<Record<string, EffectHandler>>;
-  readonly missingHandler: MissingHandlerPolicy;
+  readonly effects: ResolvedEngineEffects;
   readonly logger: LoggerFactory;
   /** The resolved telemetry logger ({@link noopTelemetry} unless injected) —
    *  exposed so adapters built on the engine log through the same seam. */
@@ -3979,13 +3539,13 @@ export declare interface Engine {
   drainEffects: (args: DrainEffectsArgs) => Promise<DrainEffectsResult>;
   /**
    * Inspect every deployed definition in the engine's tag and apply
-   * the configured missingHandler policy at `phase: "deploy"` for any
+   * the configured `effects.missingHandler` policy at `phase: "deploy"` for any
    * effect name without a registered handler. Catches "definition
    * shipped, handler removed" misconfigurations at startup instead of
    * three days later when the effect fires.
    *
    * Returns the list of (definitionId, name, locations) tuples it saw.
-   * Throws if missingHandler resolved as "fail" for any of them.
+   * Throws if `effects.missingHandler` resolved as "fail" for any of them.
    */
   verifyDeployedDefinitions: () => Promise<VerifyDeployedDefinitionsResult>;
 }
@@ -4004,6 +3564,31 @@ export declare interface Engine {
  */
 export declare const ENGINE_API_VERSION = "2026-04-29";
 
+/**
+ * Everything this engine needs to run pending effects, in one group.
+ * {@link Engine.drainEffects} dispatches through `handlers` under a
+ * `leaseMs` claim, and both the drain and
+ * {@link Engine.verifyDeployedDefinitions} apply `missingHandler` to an effect
+ * name no handler covers.
+ */
+export declare interface EngineEffectsArgs<
+  Client extends WorkflowClient = WorkflowClient,
+> {
+  /** Effect handlers keyed by the effect name the definition queues. */
+  handlers?: Record<string, EffectHandler<Client>>;
+  /**
+   * Lease duration `drainEffects` stamps on each pending-effect claim.
+   * Past the lease the claimer is presumed dead: the entry becomes
+   * recoverable by another drain's takeover or by
+   * the standalone `sweepStaleClaims` export. Default 5 minutes — size it well above
+   * the slowest handler's honest runtime, since a live-but-slow dispatch
+   * that outlives its lease can be redispatched (see {@link EffectHandler}).
+   */
+  leaseMs?: number;
+  /** What to do with an effect name `handlers` doesn't cover. Default `fail`. */
+  missingHandler?: MissingHandlerPolicy;
+}
+
 export declare interface EngineLogger {
   info: (message: string, extra?: Record<string, unknown>) => void;
   warn: (message: string, extra?: Record<string, unknown>) => void;
@@ -4066,7 +3651,7 @@ export declare interface EngineScopeArgs {
 /**
  * Pull the {@link GlobalDocumentReference} values out of `doc.ref` /
  * `subject` / `doc.refs` (content) field entries. Content only — release
- * field entries come from {@link entryReleaseRefs}, so guard discovery (which
+ * field entries come from the shared release-ref projection, so guard discovery (which
  * reads this via `collectEntryDocUris`) stays scoped to content docs.
  */
 export declare function entryDocRefs(
@@ -4098,12 +3683,14 @@ export declare interface EvaluateArgs {
 }
 
 /**
- * The pure projection at the heart of {@link evaluateInstance}: given an
+ * The pure projection at the heart of runtime evaluation: given an
  * instance, its definition, the resolved actor/grants, and a snapshot,
- * compute "what can this actor do right now, and why not the rest." No
- * I/O — feed it a fresh snapshot (e.g. rebuilt from a live store on
- * change) for reactive re-evaluation. Best-effort by design: verdicts are
- * advisory, not enforcement.
+ * compute "what can this actor do right now, and why not the rest." The
+ * supplied snapshot is never refetched; guards using `->` may call the
+ * supplied {@link EvaluateFromSnapshotArgs.guardDereference} resolver.
+ * Feed it a fresh snapshot (e.g. rebuilt from a live store on change) for
+ * reactive re-evaluation. Best-effort by design: verdicts are advisory,
+ * not enforcement.
  */
 export declare function evaluateFromSnapshot(
   args: EvaluateFromSnapshotArgs,
@@ -4134,7 +3721,7 @@ export declare interface EvaluateFromSnapshotArgs {
   attributes?: UserAttributes;
   /**
    * The in-memory snapshot to evaluate against. The caller assembles it
-   * from whatever source — a fetch (see {@link evaluateInstance}) or a
+   * from whatever source — a fetch-backed evaluation or a
    * live store. The `_id` of every doc must be in GDR-URI form, as
    * {@link buildSnapshot} produces.
    */
@@ -4151,9 +3738,14 @@ export declare interface EvaluateFromSnapshotArgs {
    * doc, so a guard that matches the instance and denies that write disables
    * every action with `mutation-guard-denied`. Omit to skip the gate in this
    * projection — the engine's verb paths load live guards and re-check at
-   * commit time ({@link evaluateInstance} fetches them itself).
+   * commit time (the runtime evaluation path fetches them itself).
    */
   guards?: readonly MutationGuardDoc[];
+  /**
+   * Stored-resource lookup for guard predicates using `->`. Omit when no
+   * guard can dereference; missing lookups resolve `null` and deny fail-closed.
+   */
+  guardDereference?: GuardDereference;
   /**
    * Per-FOREIGN-subject-resource access — the actor's ACL grants PLUS the
    * actor's principal id in that resource's own namespace — keyed by
@@ -4161,20 +3753,22 @@ export declare interface EvaluateFromSnapshotArgs {
    * effects-bearing actions ({@link SubjectPermissionDenial}). A resource
    * appears only when both halves resolved; omit it (or the whole map) to
    * skip that resource's forecast (degrade open — the subject's lake still
-   * enforces). {@link evaluateInstance} resolves this through each
-   * resource's own client via {@link subjectResourceGrants}.
+   * enforces). The runtime evaluation path resolves this through each
+   * resource's own client.
    */
   resourceGrants?: ReadonlyMap<string, SubjectResourceAccess>;
 }
 
 /**
  * Evaluate a guard predicate against a mutation. Returns `true` only when the
- * predicate is strictly `true` (ALLOW). Empty predicate denies. Fail-closed:
- * any thrown error or non-`true` result denies.
+ * predicate is strictly `true` (ALLOW). Empty predicates, parse failures, and
+ * non-`true` results deny. A supplied dereference resolver's failure propagates
+ * so infrastructure errors cannot masquerade as guard verdicts.
  */
 export declare function evaluateMutationGuard(args: {
   guard: MutationGuardDoc;
   context: MutationContext;
+  dereference?: GuardDereference;
 }): Promise<boolean>;
 
 /** Args for `evaluateStart` — the pre-flight read of `startInstance`'s gates
@@ -4297,14 +3891,14 @@ export declare type ExecutorClassification =
  * alias isn't bound: the check that stops a portable definition from deploying
  * against the wrong (or no) resource.
  *
- * Runs at deploy (inside {@link planDefinitionDeploy}), BEFORE the content
+ * Runs during deploy planning, BEFORE the content
  * fingerprint, so a deployed definition never carries a logical alias. The
  * stored references are physical, and a rebind (same source, a different alias
  * map) surfaces as changed content — a new version, never a silent shift in what
  * the workflow reads. A no-op when the definition references no aliases.
  *
- * Rewrites string VALUES only (via the shared {@link mapJsonStrings} deep-walk),
- * skipping the prose fields in {@link PROSE_KEYS}. A reference that stands alone
+ * Rewrites string VALUES only through a shared deep walk, skipping known prose
+ * fields. A reference that stands alone
  * (the whole value is `@<alias>:<id>`, e.g. a literal `doc.ref`) must expand to a
  * well-formed GDR — a malformed one (`@content:a:b`, an empty id) is rejected
  * here rather than failing when an instance later reads it.
@@ -4449,13 +4043,6 @@ export declare const FIELD_KIND_DISPLAY: {
   };
 };
 
-/**
- * The three field scopes a field entry can live in. Also the
- * group-declaration levels: a `groups` array lives at exactly these three
- * nodes, so `DefinitionGroupSite.level` reuses this vocabulary.
- */
-declare const FIELD_SCOPES: readonly ["workflow", "stage", "activity"];
-
 /**
  * The kinds a VALUE can take — scalars aligned to Sanity's names, the
  * reference kinds, the actor/assignee identities, and the two compositional
@@ -4490,8 +4077,7 @@ declare const FIELD_VALUE_KINDS: readonly [
   "array",
 ];
 
-/** Type-mirror of {@link fieldBase}, parameterised over the `editable` and
- *  `group` grammars (stored membership is the canonical list form). */
+/** @inline */
 declare type FieldBase<TEditable, TGroup> = {
   name: string;
   title?: string | undefined;
@@ -4509,11 +4095,14 @@ export declare interface FieldDescription {
   proposals: InsightPhrase[];
 }
 
-/** One declared field entry as authored and stored: name, value kind, and its scope's sourcing and editability. */
+/**
+ * One declared field entry as authored and stored: name, value kind, and its scope's sourcing and editability.
+ *
+ * @interface
+ */
 export declare type FieldEntry = FieldEntryFields<Editable, string[]>;
 
-/** Type-mirror of {@link fieldEntryFields}: a raw field entry of the given
- *  editability and group-membership grammars. */
+/** @inline */
 declare type FieldEntryFields<TEditable, TGroup> = FieldBase<
   TEditable,
   TGroup
@@ -4550,11 +4139,58 @@ export declare interface FieldInsight {
 
 export declare type FieldKind = keyof FieldValueMap;
 
+/** A field mutation targeting the supplied field-reference shape. */
+export declare type FieldMutationOp<
+  TTarget extends {
+    field: string;
+  },
+> =
+  | {
+      type: "field.set";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.setIfMissing";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.unset";
+      target: TTarget;
+    }
+  | {
+      type: "field.append";
+      target: TTarget;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.inc";
+      target: TTarget;
+      value?: ValueExpr | undefined;
+    }
+  | {
+      type: "field.dec";
+      target: TTarget;
+      value?: ValueExpr | undefined;
+    }
+  | {
+      type: "field.updateWhere";
+      target: TTarget;
+      where: Condition;
+      value: ValueExpr;
+    }
+  | {
+      type: "field.removeWhere";
+      target: TTarget;
+      where: Condition;
+    };
+
 /**
  * A stored field mutation. `field.inc` and `field.dec` use the same names as
  * `@sanity/client` patches and default an omitted `value` to a delta of `1`.
  */
-export declare type FieldOp = v.InferOutput<typeof StoredFieldOpSchema>;
+export declare type FieldOp = FieldMutationOp<StoredFieldRef>;
 
 /**
  * A concrete value a blocking atom pins for this field, with the verified
@@ -4568,6 +4204,7 @@ export declare interface FieldProposal {
   consequences: SiteConsequence[];
 }
 
+/** @inline */
 declare type FieldReadExpr = {
   type: "fieldRead";
   scope?: "workflow" | "stage" | undefined;
@@ -4575,7 +4212,12 @@ declare type FieldReadExpr = {
   path?: string | undefined;
 };
 
-export declare type FieldScope = (typeof FIELD_SCOPES)[number];
+/**
+ * The three field scopes a field entry can live in. Also the
+ * group-declaration levels: a `groups` array lives at exactly these three
+ * nodes, so `DefinitionGroupSite.level` reuses this vocabulary.
+ */
+export declare type FieldScope = "workflow" | "stage" | "activity";
 
 /**
  * A sub-field shape used inside an `object`'s `fields` or an `array`'s `of` —
@@ -4607,6 +4249,7 @@ export declare interface FieldShape {
  */
 export declare type FieldSource = FieldSourceInternal;
 
+/** @inline */
 declare type FieldSourceInternal =
   | {
       type: "input";
@@ -4655,8 +4298,8 @@ export declare interface FieldValueMap {
   dueDatetime: string | null;
   url: string | null;
   actor: Actor | null;
-  /** A single {@link Assignee} — the singular of {@link FieldValueMap.assignees}. */
-  assignee: Assignee | null;
+  /** Assignment members with at most one user; role members do not consume that cardinality. */
+  assignee: Assignee[];
   assignees: Assignee[];
   /** An object with named sub-fields; the value is keyed by sub-field name. */
   object: Record<string, unknown> | null;
@@ -5018,33 +4661,15 @@ export declare function groupSitesOf(
 ): DefinitionGroupSite[];
 
 /**
- * A lake mutation guard. A FOREIGN CONTRACT mirrored 1:1: `match`,
- * `predicate`, and `metadata` are the content lake's persisted guard-document
- * API, not engine-invented surface — the stored form keeps the lake's
- * vocabulary verbatim. The engine adds exactly two things: `name` (a
- * lake-id-segment, `^[a-z0-9][a-z0-9-]*$`, unique per definition — the lake
- * `_id` derives from `(instanceId, name)` at stage entry) and the deploy-time
- * read VALUES on `match.idRefs` / `metadata` (a typed {@link GuardRead} when
- * authoring, resolved to bare values at deploy). `match` selects mutations by
- * `types` (empty matches any), `idRefs` (field reads resolved to bare ids),
- * `idPatterns` (bare glob ids), and `actions` (at least one). `predicate` is
- * lake GROQ in a distinct delta-mode eval context (`before()`/`after()`,
- * `mutation`, `guard`, `identity()`, bare ids/fields only): strictly `true`
- * ALLOWS the mutation; anything else — false, null, an evaluation error, or
- * an omitted/empty predicate — DENIES. `metadata` is the only bridge from
- * that eval context (which cannot see `$fields`) to workflow fields, read as
- * `guard.metadata.*` and re-synced by the post-field-op guard refresh. The
- * lake does not enforce the guard document type yet: a deployed guard denies
- * optimistically engine-side, and the lake ACL is the only hard gate until
- * guard enforcement ships.
+ * A stored workflow guard. Its string reads and authored lifecycle actions
+ * remain unresolved until stage entry produces the Lake-shaped documents
+ * deployed for that stage.
+ *
+ * @interface
  */
 export declare type Guard = v.InferOutput<typeof GuardSchema>;
 
 /**
- * The lake document type for a mutation guard. Single source of truth — both
- * the runtime value (id construction, `compileGuard`, queries) and the
- * {@link MutationGuardDoc} `_type` literal derive from here.
- *
  * The enforcement story hangs off this type: the lake does not evaluate
  * this doc type — it is the engine's placeholder for the lake's
  * forthcoming guard primitive (the lake reserves `system.*`). Until that
@@ -5061,21 +4686,21 @@ export declare const GUARD_OWNER = "robot:workflow-engine";
  * The identifiers a lake mutation guard's `predicate` reads — the wire
  * dialect, not the condition scope (so no {@link ConditionVarBinding}: these
  * bind only when a guard evaluates a mutation). `before()`/`after()`/
- * `identity()` are groq-js delta-mode natives on top of these. Bound in one
- * place: `guardPredicateParams` in the guard evaluator.
+ * `identity()` are groq-js delta-mode natives on top of these. The guard
+ * evaluator must bind every entry here at the predicate root.
  */
 export declare const GUARD_PREDICATE_VARS: readonly {
   name: string;
   description: string;
 }[];
 
-export declare type GuardAction = v.InferOutput<typeof GuardActionSchema>;
+export declare type GuardAction = MutationGuardAction;
 
-declare const GuardActionSchema: v.PicklistSchema<
-  readonly ["create", "update", "delete", "publish", "unpublish"],
-  string
->;
+export declare type GuardDereference = (ref: {
+  _ref: string;
+}) => PromiseLike<Record<string, unknown> | null>;
 
+/** The stored document, pattern, type, and authored-action facets a guard matches. */
 export declare type GuardMatch = Guard["match"];
 
 /**
@@ -5106,86 +4731,23 @@ export declare function guardMatches({
  * matched by anchored regexes, so a line break in a path would print an
  * unparseable read.
  */
-export declare type GuardRead = v.InferOutput<typeof GuardReadSchema>;
-
-declare const GuardReadSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"self", undefined>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"now", undefined>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"fieldRead", undefined>;
-        readonly field: v.SchemaWithPipe<
-          readonly [v.StringSchema<undefined>, v.RegexAction<string, string>]
-        >;
-        readonly path: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.SchemaWithPipe<
-                readonly [
-                  v.StringSchema<undefined>,
-                  v.MinLengthAction<string, 1, "must be a non-empty string">,
-                ]
-              >,
-              v.CheckAction<
-                string,
-                "a guard read path cannot contain a line break"
-              >,
-            ]
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"effectsRead", undefined>;
-        readonly effect: v.SchemaWithPipe<
-          readonly [
-            v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >,
-            v.CheckAction<string, "an effect name cannot contain `'`">,
-          ]
-        >;
-        readonly path: v.OptionalSchema<
-          v.SchemaWithPipe<
-            readonly [
-              v.SchemaWithPipe<
-                readonly [
-                  v.StringSchema<undefined>,
-                  v.MinLengthAction<string, 1, "must be a non-empty string">,
-                ]
-              >,
-              v.CheckAction<
-                string,
-                "a guard read path cannot contain a line break"
-              >,
-            ]
-          >,
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+export declare type GuardRead =
+  | {
+      type: "self";
+    }
+  | {
+      type: "now";
+    }
+  | {
+      type: "fieldRead";
+      field: string;
+      path?: string | undefined;
+    }
+  | {
+      type: "effectsRead";
+      effect: string;
+      path?: string | undefined;
+    };
 
 declare const GuardSchema: v.StrictObjectSchema<
   {
@@ -5235,21 +4797,12 @@ declare const GuardSchema: v.StrictObjectSchema<
           >,
           undefined
         >;
-        actions: v.SchemaWithPipe<
-          readonly [
-            v.ArraySchema<
-              v.PicklistSchema<
-                readonly ["create", "update", "delete", "publish", "unpublish"],
-                string
-              >,
-              undefined
-            >,
-            v.MinLengthAction<
-              ("create" | "update" | "delete" | "publish" | "unpublish")[],
-              1,
-              "a guard must match at least one action"
-            >,
-          ]
+        actions: v.ArraySchema<
+          v.PicklistSchema<
+            readonly ["create", "update", "delete", "publish", "unpublish"],
+            string
+          >,
+          undefined
         >;
       },
       undefined
@@ -5282,7 +4835,7 @@ declare const GuardSchema: v.StrictObjectSchema<
  * its guards statically name — no live instance required. Guard docs are
  * stamped with the version-less definition, so this spans the datasources
  * declared across ALL deployed versions
- * ({@link DefinitionGuardsQueryArgs.definitions}), not just the latest.
+ * (`definitions`), not just the latest.
  *
  * A datasource is statically reachable when a guard idRef resolves to a
  * hardcoded GDR literal — directly, or via a `fieldRead` of a field entry whose
@@ -5328,7 +4881,7 @@ export { guillemets };
  * Advisory, like every engine check (the lake is the only enforcement point):
  * FNV-1a is a fast, deterministic, dependency-free, isomorphic digest — enough
  * to detect honest change and drift, not a tamper-proof seal. Kept synchronous
- * so the pure planning path ({@link planDefinitionDeploy}) needs no `await`.
+ * so the pure planning path needs no `await`.
  */
 export declare function hashDefinitionContent(def: WorkflowDefinition): string;
 
@@ -5424,6 +4977,7 @@ export declare type HistoryEntry = HistoryEvent & {
   executionContext?: ExecutionContext;
 };
 
+/** @inline */
 declare type HistoryEvent =
   | {
       _key: string;
@@ -5593,6 +5147,14 @@ export declare interface HydratedSnapshot {
   knownIds: Set<string>;
 }
 
+/** Assignment ownership for list/read surfaces. Role aliases deliberately do
+ *  not apply: aliases widen authorization, not whose inbox a literal pool
+ *  member routes work into. */
+export declare function identityMatchesAssignment(
+  members: readonly Assignee[],
+  identity: AssignmentIdentity,
+): boolean;
+
 /**
  * The in-flight arm — the one spelling of "not completed/aborted" every
  * list surface's `includeCompleted` filter negates (the engine stamps
@@ -5712,6 +5274,12 @@ export declare type InsightSite =
       activity?: string;
     };
 
+/** Viewer-scoped assignment counts across active activities in the open stage. */
+export declare function instanceAssignmentStateCounts(
+  instance: AssignmentInstance,
+  identity: AssignmentIdentity,
+): AssignmentStateCounts;
+
 /**
  * The tag's instance partition as a listen filter — the one shared change
  * feed a preview store keeps itself fresh from (an event names the touched
@@ -5725,9 +5293,9 @@ export declare function instanceChangesQuery(args: {
 
 /**
  * Mint the Sanity document `_id` for a workflow instance — a fresh
- * {@link randomKey} suffix, so every instance (root or spawned child) gets a
+ * random suffix, so every instance (root or spawned child) gets a
  * unique doc id under its tag. Lives in the shell, not `core/`, because it
- * draws randomness; the deterministic {@link definitionDocId} is the pure-core
+ * draws randomness; the deterministic `definitionDocId` is the pure-core
  * counterpart. Bare form — Sanity rejects `:` in document IDs, so this is
  * never a GDR URI.
  */
@@ -5745,7 +5313,7 @@ export declare function instanceDocId(tag: string): string;
  */
 export declare function instanceGuardQuery(instanceId: string): CompiledQuery;
 
-declare interface InstanceGuardsQueryArgs {
+export declare interface InstanceGuardsQueryArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   instance: WorkflowInstance;
@@ -5822,8 +5390,9 @@ export declare interface InstanceSession {
   /** Best-effort projection against the held content + held guards. The first
    *  call resolves the caller's identity/grants from the client's token over
    *  the network (cached per client) — plus each foreign subject resource's
-   *  grants through its own client, for the subject-write forecast;
-   *  evaluation itself runs in-memory on groq-js. */
+   *  grants through its own client, for the subject-write forecast. The held
+   *  snapshot is not refetched; a guard predicate using `->` reads its target
+   *  through the bound engine client. */
   evaluate(): Promise<WorkflowEvaluation>;
   /** Advance the instance against the held content: cascade auto-transitions,
    *  deploy guards, queue effects, commit with `ifRevisionId`. */
@@ -5930,6 +5499,14 @@ export declare interface InstancesQueryFilter {
   definition?: string;
   /** Current stage name. */
   stage?: string;
+  /** Current viewer assignment filter. `unrouted` needs no identity match;
+   *  `routed` matches literal role members only while no user holds the
+   *  activity; `held` matches the direct user and shadows every role. */
+  assignment?: {
+    userId: string;
+    roles?: readonly string[] | undefined;
+    states?: readonly AssignmentState[] | undefined;
+  };
   /** Include completed/aborted instances (default: in-flight only). */
   includeCompleted?: boolean;
   /**
@@ -5957,9 +5534,9 @@ export declare interface InstancesQueryFilter {
 /**
  * Whether {@link document} is in {@link instance}'s reactive watch-set — the
  * reverse of {@link subscriptionDocumentsForInstance}. Both derive from
- * {@link collectWatchRefs}, the single source of truth, so "which docs does
+ * the shared watch-ref collector, the single source of truth, so "which docs does
  * this instance watch" and "which instances watch this doc" stay in lockstep
- * — the same way {@link hydrateSnapshot}'s load-set does. Matching is on the
+ * — the same way `hydrateSnapshot`'s load-set does. Matching is on the
  * resource-qualified GDR URI, so a cross-dataset subject (`dataset:A:ds:doc`)
  * never matches a same-id doc in another resource (`dataset:B:ds:doc`).
  *
@@ -6190,6 +5767,9 @@ export declare function lakeGuardId(args: {
   guardName: string;
 }): string;
 
+/** The write operations Content Lake exposes to mutation guards. */
+export declare type LakeMutationGuardAction = "create" | "update" | "delete";
+
 /**
  * The one rule every lake-facing identity check (guard previews/pre-flights, `$can` grant filters)
  * must resolve through to agree with the lake's own `identity()`; binding `actor.id` directly at a
@@ -6248,6 +5828,7 @@ export declare function lintEffectOutputs(
   definition: WorkflowDefinition,
 ): string[];
 
+/** @inline */
 declare type LiteralExpr = {
   type: "literal";
   value: unknown;
@@ -6275,9 +5856,15 @@ export declare interface LogicalRef {
  * reference whose resolved document the consumer opens; deploy checks the
  * `field` variant points at a doc-valued entry.
  */
-export declare type ManualTarget = v.InferOutput<
-  typeof StoredManualTargetSchema
->;
+export declare type ManualTarget =
+  | {
+      type: "url";
+      url: string;
+    }
+  | {
+      type: "field";
+      field: StoredFieldRef;
+    };
 
 /** Returns true iff `document` survives `filter`'s GROQ predicate under the supplied identity. */
 declare function matchesFilter(args: {
@@ -6314,7 +5901,7 @@ export declare interface MissingHandlerDrainInfo {
 }
 
 /**
- * The `missingHandler: 'fail'` policy tripped: an effect names a handler the
+ * The `effects.missingHandler: 'fail'` policy tripped: an effect names a handler the
  * runtime never registered. `info` carries the phase-specific location
  * (deploy verification vs a drain attempt) so the runtime that opted into
  * failing can report exactly which handler is missing where.
@@ -6339,9 +5926,9 @@ export declare type MissingHandlerPolicy =
  * required when it is `required` AND `input`-sourced (the only combination
  * deploy admits), and as provided when a supplied value matches its name AND
  * kind with a real (non-null) value. Keys on the same name+type as the input
- * read in {@link resolveInputValue}, but is stricter: a present-but-null/
+ * read during input resolution, but is stricter: a present-but-null/
  * undefined value counts as absent here (a required field needs a real
- * value), whereas {@link resolveInputValue} passes a null fill straight
+ * value), whereas input resolution passes a null fill straight
  * through. Exported so pre-flight validators (e.g. mapping validation) share
  * the engine's own rule instead of mirroring it.
  */
@@ -6373,15 +5960,6 @@ export declare class ModelVersionAheadError extends WorkflowError<"model-version
 /** A document with no stamp, or a non-number stamp (foreign data this engine never wrote), reads as model 0. */
 export declare function modelVersionOf(doc: object): number;
 
-/** The lake operations a guard can gate — see the guard types in ./authorization.ts. */
-declare const MUTATION_GUARD_ACTIONS: readonly [
-  "create",
-  "update",
-  "delete",
-  "publish",
-  "unpublish",
-];
-
 /**
  * Inputs to predicate evaluation: the delta-mode natives `before()`/`after()`,
  * the `mutation`, the `guard`, and `identity()`. `before` is null on create,
@@ -6400,7 +5978,7 @@ export declare interface MutationContext {
         _type: string;
       } & Record<string, unknown>)
     | null;
-  action: MutationGuardAction;
+  action: LakeMutationGuardAction;
   /**
    * The caller's principal id in the guarded resource's own namespace
    * (what that lake's `identity()` returns), resolved as `identity()` in
@@ -6410,8 +5988,11 @@ export declare interface MutationContext {
   identity?: string;
 }
 
+/** Lake operations plus the authored lifecycle actions the compiler translates. */
 export declare type MutationGuardAction =
-  (typeof MUTATION_GUARD_ACTIONS)[number];
+  | LakeMutationGuardAction
+  | "publish"
+  | "unpublish";
 
 /**
  * The persisted body of a mutation guard — every field except the lake system
@@ -6444,7 +6025,11 @@ export declare interface MutationGuardBody {
   description?: string;
   /** Bare document ids (resource-local; both published and `drafts.` forms). */
   match: MutationGuardMatch;
-  /** GROQ; empty string = unconditional deny. Bare ids/fields only — no GDRs. */
+  /**
+   * Lake delta-mode GROQ. The root exposes `document.before`,
+   * `document.after`, `mutation`, and `guard`; `identity()` and resource-local
+   * reference dereferencing are available. Empty string is unconditional deny.
+   */
   predicate: string;
   /** Caller-owned projected state the predicate reads as `guard.metadata.*`. */
   metadata: Record<string, unknown>;
@@ -6483,7 +6068,7 @@ export declare class MutationGuardDeniedError extends WorkflowError<"mutation-gu
    */
   static fromGuards(args: {
     documentId: string;
-    action: MutationGuardAction;
+    action: LakeMutationGuardAction;
     guards: readonly MutationGuardDoc[];
   }): MutationGuardDeniedError;
 }
@@ -6541,15 +6126,20 @@ export declare interface NoteItem {
   at?: string | null;
 }
 
-/** An append-only audit/comment log: sugar over `array of object {body, actor, at}` — the `actor`/`at`
- *  names match the `audit` op's stamp fields, so it pairs with it. Never a stored kind. */
+/** @inline */
 declare type NotesField = FieldBase<AuthoringEditable, GroupMembership> & {
   type: "notes";
 };
 
 /** A `field.updateWhere` / `field.removeWhere` op's `where` selects rows to
  *  mutate with rendered-scope GROQ (`$row`, `$params` bound) — row selection, not a gate; an unevaluable row never matches. */
-export declare type Op = v.InferOutput<typeof StoredOpSchema>;
+export declare type Op =
+  | FieldOp
+  | {
+      type: "status.set";
+      activity: string;
+      status: ActivityStatus;
+    };
 
 /**
  * Op `type` discriminators — the stored mutation primitives.
@@ -6602,6 +6192,11 @@ export declare interface OpAppliedSummary {
   resolved?: Record<string, unknown>;
 }
 
+/** Assignment members for each active activity in the instance's open stage. */
+export declare function openActivityAssignments(
+  instance: AssignmentInstance,
+): readonly (readonly Assignee[])[];
+
 export declare interface OperationArgs {
   instanceId: string;
   /**
@@ -6612,9 +6207,10 @@ export declare interface OperationArgs {
 
 /**
  * What a state-changing verb reports back. Every mutating verb —
- * `startInstance`, `fireAction`, `editField`, `completeEffect`, `tick`,
- * `setStage`, `abortInstance` — returns this one shape, on the namespace,
- * the `Engine`, and the reactive session alike.
+ * `startInstance`, `fireAction`, `editField`, `completeEffect`,
+ * `commitEffectOps`, `tick`, `setStage`, `abortInstance`, `resetActivity` —
+ * returns this one shape, on the namespace, the `Engine`, and the reactive
+ * session alike.
  */
 export declare interface OperationResult {
   /** The instance after the operation + all cascading auto-transitions. */
@@ -6634,6 +6230,14 @@ export declare interface OperationResult {
    *  during the action commit. Surfaced for caller-side assertions and
    *  audit. */
   ranOps?: OpAppliedSummary[];
+  /**
+   * The nearest future instant (ISO 8601) at which the clock alone changes what
+   * the instance evaluates to; schedule the next `tick` for it. Derived per
+   * call, never persisted. Absent on a terminal instance, when no site yields a
+   * boundary from the instance's values, and for a gate reading `$now` beside a
+   * caller variable, which {@link WorkflowEvaluation.nextEvaluationAt} carries.
+   */
+  nextEvaluationAt?: string;
 }
 
 export { OUTCOME_MARKS };
@@ -6725,7 +6329,7 @@ export declare function parseResourceGdr(uri: string): WorkflowResource;
 /**
  * A stage's multi-guard deploy failed *after* at least one guard already landed.
  * Those partial locks can't be cleanly undone (guard docs have no transactional
- * deploy). Inside the engine {@link deployOrRollback} rolls the state move back
+ * deploy). Inside the engine `deployOrRollback` rolls the state move back
  * and escalates this to a loud {@link WorkflowStateDivergedError}; a caller that
  * invokes {@link deployStageGuards} directly (without that rollback wrapper) can
  * also see it, so it's exported to be catchable by type.
@@ -6733,7 +6337,14 @@ export declare function parseResourceGdr(uri: string): WorkflowResource;
 export declare class PartialGuardDeployError extends WorkflowError<"partial-guard-deploy"> {
   readonly stageName: string;
   readonly deployed: number;
-  constructor(args: { stageName: string; deployed: number; cause: unknown });
+  /** The cleanup failure, when newly created guards could not be retracted. */
+  readonly rollbackError?: unknown;
+  constructor(args: {
+    stageName: string;
+    deployed: number;
+    cause: unknown;
+    rollbackError?: unknown;
+  });
 }
 
 export declare interface PendingEffect {
@@ -6913,8 +6524,8 @@ export declare function projectStartSliceRow(
  * representation's stored id rides along as `_originalId` — session-side
  * conditions (including the `_originalId in path("versions.**")` shape) then
  * read the same projected identity as the engine's perspective-aware hydration.
- * Strict by construction: only the ids in
- * {@link watchRefRepresentations} are accepted — an id that merely *ends* in
+ * Strict by construction: only a canonical watch-reference representation is
+ * accepted — an id that merely *ends* in
  * the watched id (another doc's dotted id under a version prefix), a release
  * the perspective doesn't read, or a draft the perspective makes invisible is
  * a store routing bug, and projecting it would make content the engine's read
@@ -6956,7 +6567,7 @@ export declare interface QueryInScopeArgs extends InstanceRefArgs, QueryArgs {}
 export { quoted };
 
 export declare const READER_MODEL_ROLLOUT_URL =
-  "https://www.sanity.io/docs/editorial-workflows/prerelease";
+  "https://www.sanity.io/docs/workflows/prerelease";
 
 /** A producer has not acknowledged the floor required by its submitted definitions. */
 export declare class ReaderModelAcknowledgementError extends WorkflowError<"reader-model-acknowledgement"> {
@@ -6964,10 +6575,9 @@ export declare class ReaderModelAcknowledgementError extends WorkflowError<"read
   readonly expectedMinReaderModel: unknown;
   readonly requiredMinReaderModel: number;
   readonly engineMinReaderModel = 4;
-  readonly engineMaxReaderModel = 8;
-  readonly engineModelVersion = 8;
-  readonly documentationUrl =
-    "https://www.sanity.io/docs/editorial-workflows/prerelease";
+  readonly engineMaxReaderModel = 9;
+  readonly engineModelVersion = 9;
+  readonly documentationUrl = "https://www.sanity.io/docs/workflows/prerelease";
   constructor(
     expectedMinReaderModel: unknown,
     options?: {
@@ -6998,7 +6608,7 @@ export declare function readInstancePreviewDoc(
  * perspective; everything else is content and resolves to its
  * version/draft/published form. This is the single encoding of the rule
  * the {@link WatchSet} `perspective` contract describes to consumers, and
- * the rule {@link hydrateSnapshot} applies on the fetch side.
+ * the rule `hydrateSnapshot` applies on the fetch side.
  */
 export declare function readsRaw(ref: { type: string }): boolean;
 
@@ -7123,7 +6733,7 @@ export declare function releaseRef({
  * half. Empty unless the instance is `stuck`: a `waiting` instance advances on
  * its own next action (see `availableActions`), and terminal or `progressing`
  * ones need nothing. Each verb is flagged
- * {@link SuggestedRemediation.available} from {@link RUNNABLE_VERBS}.
+ * {@link SuggestedRemediation.available} from the runnable-verb vocabulary.
  */
 export declare function remediationsFor(
   diagnosis: Diagnosis,
@@ -7181,6 +6791,7 @@ export declare function requiredReaderModel(
   document: unknown,
 ): number;
 
+/** @inline */
 declare type RequirementBase = {
   name: string;
   title?: string | undefined;
@@ -7202,8 +6813,6 @@ export declare interface RequirementDescriptor {
  */
 export declare const RESERVED_CONDITION_VARS: readonly string[];
 
-declare const RESET_ACTIVITY_TARGETS: readonly ["active", "skipped"];
-
 export declare interface ResetActivityArgs extends DedupableOperationArgs {
   /** Name of the activity to reset, within the instance's current stage. */
   activity: string;
@@ -7237,8 +6846,7 @@ export declare type ResetActivityResult =
  * fire). `done` is deliberately absent: a reset is recovery, not a silent
  * declaration that the work succeeded.
  */
-export declare type ResetActivityTarget =
-  (typeof RESET_ACTIVITY_TARGETS)[number];
+export declare type ResetActivityTarget = "active" | "skipped";
 
 /**
  * Resolve the engine's `WorkflowAccess` for a client — actor and grants
@@ -7280,6 +6888,12 @@ export declare interface ResolveClientActorArgs {
   readonly projectId: string;
 }
 
+/** {@link EngineEffectsArgs} after the engine applied its defaults. */
+export declare interface ResolvedEngineEffects {
+  readonly handlers: Readonly<Record<string, EffectHandler>>;
+  readonly missingHandler: MissingHandlerPolicy;
+}
+
 /**
  * A resolved field entry as the engine persists it on an instance.
  * Discriminated by `_type` (bare — unique within this union); the `value`
@@ -7399,7 +7013,7 @@ export declare function resourceFromParsed(parsed: ParsedGdr): WorkflowResource;
 export declare function resourceGdr(res: WorkflowResource): string;
 
 /** Args for the single-resource ref constructors ({@link refCanvas}, {@link refMediaLibrary}, {@link refDashboard}). */
-declare interface ResourceRefArgs<TType extends string> {
+export declare interface ResourceRefArgs<TType extends string> {
   resourceId: string;
   documentId: string;
   type: TType;
@@ -7437,35 +7051,7 @@ export declare function retractStageGuards(args: StageGuardArgs): Promise<void>;
  * literal ownership values and are not widened by this map. The authored `"*"`
  * key lists universal fulfillers and is normalized before persistence.
  */
-export declare type RoleAliases = v.InferOutput<typeof RoleAliasesSchema>;
-
-declare const RoleAliasesSchema: v.RecordSchema<
-  v.SchemaWithPipe<
-    readonly [
-      v.StringSchema<undefined>,
-      v.MinLengthAction<string, 1, "must be a non-empty string">,
-    ]
-  >,
-  v.SchemaWithPipe<
-    readonly [
-      v.ArraySchema<
-        v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >,
-        undefined
-      >,
-      v.MinLengthAction<
-        string[],
-        1,
-        "a role alias must list at least one fulfilling role"
-      >,
-    ]
-  >,
-  undefined
->;
+export declare type RoleAliases = Record<string, string[]>;
 
 /** Whether two workflow resources address the same place. */
 export declare function sameResource(
@@ -7585,6 +7171,12 @@ export declare interface SiteConsequence {
   after: ConditionOutcome;
 }
 
+/** Pure resource-local dereferencing for held snapshot evaluation. */
+export declare function snapshotGuardDereference(args: {
+  snapshot: HydratedSnapshot;
+  resource: WorkflowResource;
+}): GuardDereference;
+
 /** One statically invalid parent-to-child spawn contract found at deploy. */
 export declare type SpawnContractIssue =
   | {
@@ -7617,6 +7209,8 @@ export declare class SpawnContractsInvalidError extends WorkflowError<"spawn-con
  * own `editable` is the ceiling, ANDed with the stage value at runtime, so an
  * override can only NARROW — never open a field the baseline left closed. An
  * unlisted field inherits its baseline.
+ *
+ * @interface
  */
 export declare type Stage = StageFields<
   FieldEntry,
@@ -7663,7 +7257,7 @@ export declare interface StageEvaluation {
   autonomy: StageAutonomy;
 }
 
-/** Type-mirror of {@link stageFields}, parameterised over field/activity/transition/guard/editable. */
+/** @inline */
 declare type StageFields<TField, TActivity, TTransition, TGuard, TEditable> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -7677,7 +7271,7 @@ declare type StageFields<TField, TActivity, TTransition, TGuard, TEditable> = {
   editable?: Record<string, TEditable> | undefined;
 };
 
-declare interface StageGuardArgs {
+export declare interface StageGuardArgs {
   client: WorkflowClient;
   clientForGdr: ClientForGdr;
   instance: WorkflowInstance;
@@ -7738,8 +7332,6 @@ export declare const START_FILTER_VARS: readonly {
   description: string;
 }[];
 
-declare const START_KINDS: readonly ["interactive", "autonomous"];
-
 /**
  * The vars a definition's start GROQ requirements read — the start-time readiness
  * dialect: everything the filter context binds ({@link START_FILTER_VARS})
@@ -7829,6 +7421,7 @@ export declare interface StartEvaluation {
   invalidInitialFields: InitialFieldIssue[];
 }
 
+/** @inline */
 declare type StartFields = {
   filter?: string | undefined;
   requirements?: StartRequirement[] | undefined;
@@ -7837,7 +7430,7 @@ declare type StartFields = {
 /**
  * Project caller-supplied `initialFields` into the `$fields` map the
  * start-requirement context binds: one key per declared `input`-sourced entry,
- * resolved through {@link suppliedFieldFor} — the predicate can only ever see
+ * resolved through the supplied-field lookup — the predicate can only ever see
  * a value the input resolution would persist, and an undeclared supplied name
  * never leaks in. Unsupplied (or null-supplied) entries stay unbound, so a
  * read of one is GROQ null. Document references bind as their GDR envelopes
@@ -7927,7 +7520,7 @@ export declare interface StartInstanceArgs {
  * path for every kind, and an interactive start of an autonomous workflow is
  * legal.
  */
-export declare type StartKind = (typeof START_KINDS)[number];
+export declare type StartKind = "interactive" | "autonomous";
 
 /**
  * The declared {@link StartKind} of a definition, defaulting the absent
@@ -7954,325 +7547,108 @@ export declare function startKindOf(definition: {
  */
 export declare class StartNotAllowedError extends WorkflowError<"start-not-allowed"> {
   readonly definition: string;
-  readonly unmetRequirements: RequirementDescriptor[];
-  constructor(args: {
-    definition: string;
-    unmetRequirements: RequirementDescriptor[];
-  });
-}
-
-/**
- * Thrown when a start fails AFTER its create committed but BEFORE priming:
- * the instance document exists, unprimed (see {@link isUnprimed}) — a
- * genuinely failed start, but a RESUMABLE one. The error names the id so
- * every surface's failure message can point at the retry rail: retrying
- * `startInstance` with this `instanceId` finishes the start instead of
- * creating a duplicate; aborting the instance discards it.
- */
-export declare class StartNotPrimedError extends WorkflowError<"start-not-primed"> {
-  readonly instanceId: string;
-  constructor(args: { instanceId: string; cause: unknown });
-}
-
-/**
- * Thrown when a start's first cascade fails AFTER the instance was created
- * and primed: the run exists — stage entered, activities active, guards
- * deployed — it just hasn't auto-advanced to a stable stage yet. Callers
- * must not present this as a failed start: the workflow IS running, and a
- * `tick` (or retrying `startInstance` with the same `instanceId`) resumes
- * the settling.
- */
-export declare class StartNotSettledError extends WorkflowError<"start-not-settled"> {
-  readonly instanceId: string;
-  /** The primed instance re-read after the cascade failure — absent when
-   *  that best-effort read also failed. */
-  readonly instance?: WorkflowInstance;
-  constructor(args: {
-    instanceId: string;
-    instance?: WorkflowInstance;
-    cause: unknown;
-  });
-}
-
-/** Advisory only, per {@link isStartableDefinition} — a start surface has no parent context to give a spawn-only child, so it rejects fast with this message instead. */
-export declare function startRefusal(definition: {
-  lifecycle?: WorkflowLifecycle | undefined;
-}): string | undefined;
-
-/** Every named readiness requirement accepted by workflow `start.requirements`. */
-export declare type StartRequirement =
-  | GroqRequirement
-  | SingleSubjectRequirement;
-
-export declare interface StartRequirementEvaluation extends RequirementDescriptor {
-  /** Whether this requirement is satisfied, unsatisfied, or not yet decidable. */
-  outcome: ConditionOutcome;
-  /** GROQ explanation; absent for non-GROQ requirement kinds. */
-  insight?: ConditionInsight | undefined;
-}
-
-/**
- * The caller-side half of the start contexts — everything the evaluating
- * surface knows that the definition doesn't. Every member is optional
- * because the surfaces genuinely differ (a pure consumer may hold no clock):
- * An absent binding evaluates each read of it to GROQ null, and where that
- * null lands decides the verdict — a predicate that can't decide without
- * the binding fails closed, while a count-of-matches clause over values
- * every row stores passes vacuously (in GROQ null equals only null, so the
- * unbound read matches no stored value). The vars themselves are
- * inventoried in `START_FILTER_VARS` / `START_REQUIREMENT_VARS`; the caller's
- * `$fields` map is NOT scope — `start.filter` never binds it, and
- * `explainStartRequirement` takes it as its own argument.
- */
-export declare interface StartScope {
-  /** The engine's tag partition — binds `$tag`. */
-  tag?: string | undefined;
-  /** ISO clock reading — binds `$now`. */
-  now?: string | undefined;
-  /** Resource-qualified identity of the prospective subject. Unlike a loaded
-   *  document's bare `_id`, this stays collision-free across resources. */
-  subject?: GdrUri | undefined;
-  /**
-   * The engine-owned start slice, for predicates that read `*[...]` or for a
-   * `singleSubject` requirement — invoked lazily only when evaluation needs it.
-   * Each row exposes exactly `{definition, subject, completedAt}`; completed
-   * rows are included, so authors qualify in-flight
-   * themselves (`!defined(completedAt)`). Absent ⇒ a dataset-reading filter
-   * fails closed (this surface cannot see the dataset, so it cannot decide),
-   * while a dataset-reading requirement THROWS — see
-   * {@link explainStartRequirement}.
-   */
-  fetchDataset?: (() => Promise<unknown[]>) | undefined;
-}
-
-export declare interface StartSliceRow {
-  definition: string;
-  subject: GdrUri | null;
-  completedAt: string | null;
-}
-
-declare const StoredEditableSchema: v.UnionSchema<
-  [
-    v.LiteralSchema<true, undefined>,
-    v.SchemaWithPipe<
-      readonly [
-        v.StringSchema<undefined>,
-        v.MinLengthAction<string, 1, "must be a non-empty string">,
-      ]
-    >,
-  ],
-  undefined
->;
-
-/**
- * The `field.*` subset — every mutation op EXCEPT `status.set`. Shared by the
- * boundaries that write fields but must not set an activity status: a transition
- * (its stage's activities are tearing down, so `status.set` has no coherent
- * target) and an effect's completion (an effect is OUTSIDE the activity's own
- * awaiting — it reports its result through fields, never by flipping a status;
- * the activity/stage gate then reads those fields). The full {@link StoredOpSchema}
- * (these plus `status.set`) is what actions and activity boundaries carry.
- */
-declare const StoredFieldOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
+  readonly unmetRequirements: RequirementDescriptor[];
+  constructor(args: {
+    definition: string;
+    unmetRequirements: RequirementDescriptor[];
+  });
+}
+
+/**
+ * Thrown when a start fails AFTER its create committed but BEFORE priming:
+ * the instance document exists, unprimed (see {@link isUnprimed}) — a
+ * genuinely failed start, but a RESUMABLE one. The error names the id so
+ * every surface's failure message can point at the retry rail: retrying
+ * `startInstance` with this `instanceId` finishes the start instead of
+ * creating a duplicate; aborting the instance discards it.
+ */
+export declare class StartNotPrimedError extends WorkflowError<"start-not-primed"> {
+  readonly instanceId: string;
+  constructor(args: { instanceId: string; cause: unknown });
+}
+
+/**
+ * Thrown when a start's first cascade fails AFTER the instance was created
+ * and primed: the run exists — stage entered, activities active, guards
+ * deployed — it just hasn't auto-advanced to a stable stage yet. Callers
+ * must not present this as a failed start: the workflow IS running, and a
+ * `tick` (or retrying `startInstance` with the same `instanceId`) resumes
+ * the settling.
+ */
+export declare class StartNotSettledError extends WorkflowError<"start-not-settled"> {
+  readonly instanceId: string;
+  /** The primed instance re-read after the cascade failure — absent when
+   *  that best-effort read also failed. */
+  readonly instance?: WorkflowInstance;
+  constructor(args: {
+    instanceId: string;
+    instance?: WorkflowInstance;
+    cause: unknown;
+  });
+}
+
+/** Advisory only, per {@link isStartableDefinition} — a start surface has no parent context to give a spawn-only child, so it rejects fast with this message instead. */
+export declare function startRefusal(definition: {
+  lifecycle?: WorkflowLifecycle | undefined;
+}): string | undefined;
+
+/** Every named readiness requirement accepted by workflow `start.requirements`. */
+export declare type StartRequirement =
+  | GroqRequirement
+  | SingleSubjectRequirement;
+
+export declare interface StartRequirementEvaluation extends RequirementDescriptor {
+  /** Whether this requirement is satisfied, unsatisfied, or not yet decidable. */
+  outcome: ConditionOutcome;
+  /** GROQ explanation; absent for non-GROQ requirement kinds. */
+  insight?: ConditionInsight | undefined;
+}
+
+/**
+ * The caller-side half of the start contexts — everything the evaluating
+ * surface knows that the definition doesn't. Every member is optional
+ * because the surfaces genuinely differ (a pure consumer may hold no clock):
+ * An absent binding evaluates each read of it to GROQ null, and where that
+ * null lands decides the verdict — a predicate that can't decide without
+ * the binding fails closed, while a count-of-matches clause over values
+ * every row stores passes vacuously (in GROQ null equals only null, so the
+ * unbound read matches no stored value). The vars themselves are
+ * inventoried in `START_FILTER_VARS` / `START_REQUIREMENT_VARS`; the caller's
+ * `$fields` map is NOT scope — `start.filter` never binds it, and
+ * `explainStartRequirement` takes it as its own argument.
+ */
+export declare interface StartScope {
+  /** The engine's tag partition — binds `$tag`. */
+  tag?: string | undefined;
+  /** ISO clock reading — binds `$now`. */
+  now?: string | undefined;
+  /** Resource-qualified identity of the prospective subject. Unlike a loaded
+   *  document's bare `_id`, this stays collision-free across resources. */
+  subject?: GdrUri | undefined;
+  /**
+   * The engine-owned start slice, for predicates that read `*[...]` or for a
+   * `singleSubject` requirement — invoked lazily only when evaluation needs it.
+   * Each row exposes exactly `{definition, subject, completedAt}`; completed
+   * rows are included, so authors qualify in-flight
+   * themselves (`!defined(completedAt)`). Absent ⇒ a dataset-reading filter
+   * fails closed (this surface cannot see the dataset, so it cannot decide),
+   * while a dataset-reading requirement THROWS — see
+   * {@link explainStartRequirement}.
+   */
+  fetchDataset?: (() => Promise<unknown[]>) | undefined;
+}
+
+export declare interface StartSliceRow {
+  definition: string;
+  subject: GdrUri | null;
+  completedAt: string | null;
+}
 
-/** A field reference with `scope` already resolved — the form every op target carries. */
+/**
+ * A field reference with `scope` already resolved — the form every op target carries.
+ *
+ * @interface
+ */
 export declare type StoredFieldRef = v.InferOutput<typeof StoredFieldRefSchema>;
 
 declare const StoredFieldRefSchema: v.StrictObjectSchema<
@@ -8291,262 +7667,6 @@ declare const StoredFieldRefSchema: v.StrictObjectSchema<
   undefined
 >;
 
-declare const StoredManualTargetSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"url", undefined>;
-        readonly url: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.UrlAction<string, "must be a valid URL">,
-            v.CheckAction<string, "must be an http(s) URL">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field", undefined>;
-        readonly field: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
-
-declare const StoredOpSchema: v.VariantSchema<
-  "type",
-  [
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.set", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.setIfMissing", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.unset", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.append", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.inc", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.dec", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly value: v.OptionalSchema<
-          v.GenericSchema<ValueExprInternal>,
-          undefined
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.updateWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly value: v.GenericSchema<ValueExprInternal>;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"field.removeWhere", undefined>;
-        readonly target: v.StrictObjectSchema<
-          {
-            readonly scope: v.PicklistSchema<
-              readonly ["workflow", "stage", "activity"],
-              string
-            >;
-            readonly field: v.SchemaWithPipe<
-              readonly [
-                v.StringSchema<undefined>,
-                v.MinLengthAction<string, 1, "must be a non-empty string">,
-              ]
-            >;
-          },
-          undefined
-        >;
-        readonly where: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-      },
-      undefined
-    >,
-    v.StrictObjectSchema<
-      {
-        readonly type: v.LiteralSchema<"status.set", undefined>;
-        readonly activity: v.SchemaWithPipe<
-          readonly [
-            v.StringSchema<undefined>,
-            v.MinLengthAction<string, 1, "must be a non-empty string">,
-          ]
-        >;
-        readonly status: v.PicklistSchema<
-          readonly ["active", "done", "skipped", "failed"],
-          string
-        >;
-      },
-      undefined
-    >,
-  ],
-  undefined
->;
-
 export declare function stripSystemFields(
   doc: Record<string, unknown>,
 ): Record<string, unknown>;
@@ -8610,7 +7730,7 @@ export declare interface SubjectPermissionDenial {
   permission: DocumentValuePermission;
 }
 
-declare interface SubjectResourceAccess {
+export declare interface SubjectResourceAccess {
   grants: Grant[];
   /** The actor's principal id in this resource's own namespace: per-project user id for a dataset resource, account-global id for an org-level one. */
   actorId: string;
@@ -8731,6 +7851,8 @@ export declare interface SubworkflowEntry {
  * (default) lets them run to completion, `'abort'` kills them recursively —
  * always an authored choice, never automatic. Whether the PARENT may move at
  * all is a separate gate over `$subworkflows`.
+ *
+ * @interface
  */
 export declare type Subworkflows = v.InferOutput<typeof SubworkflowsSchema>;
 
@@ -8862,13 +7984,15 @@ export declare const SYSTEM_IDENTITY = "<system>";
 export declare function tagScopeFilter(): string;
 
 /**
- * Internal telemetry-injection seam for the raw `workflow.*` verbs — the
- * telemetry twin of the `Clocked` seam in `clock.ts`, deliberately not
- * re-exported from the package root. Production injects a logger ONCE via
- * `createEngine({ telemetry })`; a raw-namespace caller that omits it
- * emits nothing (the verbs default to {@link noopTelemetry}).
+ * Optional telemetry-injection field on the raw `workflow.*` verbs — the
+ * telemetry twin of the `Clocked` seam in `clock.ts`. It is exported
+ * because those verbs expose this composition helper in their public
+ * signatures, but production normally injects a logger once via
+ * `createEngine({ telemetry })`, not as an everyday per-call option. A
+ * raw-namespace caller that omits it emits nothing (the verbs default to
+ * {@link noopTelemetry}).
  */
-declare type Telemetered<T> = T & {
+export declare type Telemetered<T> = T & {
   telemetry?: WorkflowTelemetryLogger;
 };
 
@@ -8914,14 +8038,7 @@ export declare interface TelemetryIntakeClient {
  * `$allActivitiesDone` — a `failed` activity blocks it permanently, surfacing
  * via `$anyActivityFailed`.
  */
-declare const TERMINAL_ACTIVITY_STATUSES: readonly [
-  "done",
-  "skipped",
-  "failed",
-];
-
-export declare type TerminalActivityStatus =
-  (typeof TERMINAL_ACTIVITY_STATUSES)[number];
+export declare type TerminalActivityStatus = "done" | "skipped" | "failed";
 
 /** See {@link terminalState}. */
 export declare type TerminalState = "aborted" | "completed" | "in-flight";
@@ -8944,8 +8061,7 @@ export declare function terminalState(
  */
 export declare function toBareId(id: string): string;
 
-/** Ad-hoc, status-tracked work items: sugar over `array of object {label, status, assignee?, dueDate?}`; a plain checklist is that with `{label, status}` alone.
- *  Its `dueDate` is a `date` column named `dueDate`, not the elevated `dueDate` kind, which reserves one deadline slot per level. Never a stored kind. */
+/** @inline */
 declare type TodoListField = FieldBase<AuthoringEditable, GroupMembership> & {
   type: "todoList";
 };
@@ -8963,7 +8079,8 @@ export declare interface TodoListItem {
   _key: string;
   label: string;
   status?: string | null;
-  assignee?: Assignee | null;
+  /** Singular assignment slot: any number of routing roles and at most one user. */
+  assignee?: Assignee[];
   dueDate?: string | null;
 }
 
@@ -9004,8 +8121,7 @@ export declare interface TransitionEvaluation {
   insight: ConditionInsight;
 }
 
-/** Type-mirror of {@link transitionFields} minus `when` — stored requires it,
- *  authoring omits it (desugar fills the default), so each variant declares it. */
+/** @inline */
 declare type TransitionFields = {
   name: string;
   title?: string | undefined;
@@ -9095,7 +8211,7 @@ export declare function validateDefinition(
 
 export declare function validateTag(tag: string): void;
 
-declare interface ValidationIssue {
+export declare interface ValidationIssue {
   path: ReadonlyArray<PropertyKey>;
   message: string;
 }
@@ -9108,6 +8224,7 @@ declare interface ValidationIssue {
  */
 export declare type ValueExpr = ValueExprInternal;
 
+/** @inline */
 declare type ValueExprInternal =
   | LiteralExpr
   | FieldReadExpr
@@ -9226,9 +8343,8 @@ export declare const workflow: {
   /**
    * Remove a deployed definition (all versions, or one via `version`). Refuses
    * while non-terminal instances exist unless `cascade` aborts them first —
-   * instances are never deleted, only aborted in place; see
-   * {@link deleteDefinitionInternal} for the full contract (spawn-referrer
-   * check, guard-doc housekeeping).
+   * instances are never deleted, only aborted in place. The operation also
+   * checks spawn referrers and cleans up guard documents.
    */
   deleteDefinition: (
     rawArgs: Clocked<Telemetered<DeleteDefinitionArgs & EngineScopeArgs>>,
@@ -9345,8 +8461,8 @@ export declare const workflow: {
   ) => Promise<OperationResult>;
   /**
    * Admin override — hard-stop an in-flight instance where it stands. No stage
-   * move, no transition effects, pending effects cancelled; see
-   * {@link abortAndPropagate} for the abort + ancestor-propagation contract.
+   * move, no transition effects, pending effects cancelled. The abort
+   * propagates through affected ancestor instances.
    * Propagated, not cascaded — the instance is terminal, so `cascaded` is
    * always `0` and ancestor movement is reported on the ancestors, not here.
    * `changed: false` means the instance was already terminal.
@@ -9535,8 +8651,6 @@ export declare const WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
  */
 export declare const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
 
-declare const WORKFLOW_LIFECYCLES: readonly ["standalone", "child"];
-
 /**
  * The engine's view of "who am I, what can I do?". `actor` is who
  * the engine stamps onto history / `completedBy` / `ValueExpr.actor` —
@@ -9776,6 +8890,8 @@ export declare interface WorkflowCommitOptions {
  * logger unconditionally (CI and `DO_NOT_TRACK` included), and consent,
  * environment suppression, and transport become this implementation's
  * business.
+ *
+ * @interface
  */
 export declare type WorkflowConfig = v.InferOutput<typeof WorkflowConfigSchema>;
 
@@ -10428,6 +9544,8 @@ declare const WorkflowConfigSchema: v.ObjectSchema<
  * conditions — each `name: groq` entry is pre-evaluated and bound as the
  * boolean `$name` var; redefining a built-in var is a deploy error, never a
  * silent shadow.
+ *
+ * @interface
  */
 export declare type WorkflowDefinition = v.InferOutput<
   typeof WorkflowDefinitionSchema
@@ -10483,7 +9601,7 @@ export declare interface WorkflowDefinitionDeployedData {
  * fetch results are typed (`Record<string, unknown>`), which pass through to
  * the runtime boundary parse. Everything precisely typed gets the exact
  * {@link WorkflowDefinition} contract: beyond the document envelope
- * ({@link DocumentEnvelopeKey}, so a typed {@link DeployedDefinition} passes
+ * (the closed system-key union, so a typed {@link DeployedDefinition} passes
  * castless), unknown keys are `never` — a typo'd literal is a compile error,
  * never a silent collapse to the record arm.
  */
@@ -10603,6 +9721,7 @@ export declare type WorkflowErrorKind =
   | "partial-guard-deploy"
   | "start-not-primed"
   | "start-not-settled"
+  | "concurrent-cascade"
   | "concurrent-fire-action"
   | "concurrent-edit-field"
   | "concurrent-complete-effect"
@@ -10630,7 +9749,7 @@ export declare interface WorkflowEvaluation {
   semantics?: Semantic[] | undefined;
   actor: Actor;
   currentStage: StageEvaluation;
-  /** Active activities whose assignees-kind field entry matches the actor. */
+  /** Active activities whose singular or plural assignment entry matches the actor. */
   pendingOnYou: ActivityEvaluation[];
   /** True if at least one action on any active activity is allowed. */
   canInteract: boolean;
@@ -10656,6 +9775,14 @@ export declare interface WorkflowEvaluation {
    * evaluation time, so their legs report `conditional`.
    */
   autonomy: WorkflowAutonomy;
+  /**
+   * The nearest future instant (ISO 8601) at which the clock alone changes this
+   * projection; re-evaluate then. Includes a gate reading `$now` beside
+   * `$actor`, `$assigned`, `$can`, or `$attributes`, evaluated in this actor's
+   * scopes. Derived per call, never persisted. Absent on a terminal instance
+   * and when no site yields a boundary from those scopes.
+   */
+  nextEvaluationAt?: string;
 }
 
 export declare interface WorkflowFetchOptions {
@@ -10683,7 +9810,7 @@ export declare interface WorkflowFieldEditedData extends InstanceScopedEventData
   mode: EditMode;
 }
 
-/** Type-mirror of {@link workflowFields}, parameterised over field/stage/start. */
+/** @inline */
 declare type WorkflowFields<TField, TStage, TStart> = {
   name: string;
   semantics?: Semantic[] | undefined;
@@ -10906,7 +10033,7 @@ export declare interface WorkflowInstanceTickedData extends InstanceScopedEventD
 /** How instances of a definition come to exist: started standalone (the
  *  default) or spawned by a parent. `'child'` is spawn-only — see
  *  {@link isStartableDefinition}. */
-export declare type WorkflowLifecycle = (typeof WORKFLOW_LIFECYCLES)[number];
+export declare type WorkflowLifecycle = "standalone" | "child";
 
 /**
  * The subset of `@sanity/client` the engine actually needs. The