@sanity/workflow-engine 0.4.0 → 0.6.0

package/dist/index.js

@@ -246,6 +246,20 @@ function effectBindings(effects) {
     (e) => Object.entries(e.bindings ?? {}).map(([k, groq]) => [`${e.name}.${k}`, groq])
   );
 }
+function actionVerdict(task, action) {
+  return {
+    task: task.task.name,
+    taskStatus: task.status,
+    action: action.action.name,
+    title: action.action.title,
+    allowed: action.allowed,
+    disabledReason: action.disabledReason,
+    params: action.action.params ?? []
+  };
+}
+function availableActions(tasks) {
+  return tasks.flatMap((t) => t.actions.map((a) => actionVerdict(t, a)));
+}
 const wallClock = () => (/* @__PURE__ */ new Date()).toISOString(), GUARD_DOC_TYPE = "temp.system.guard";
 class MutationGuardDeniedError extends Error {
   denied;
@@ -440,79 +454,63 @@ function stripStateForLake(value) {
 function bareId(id) {
   return isGdrUri(id) ? extractDocumentId(id) : id;
 }
-const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
-function resolveGuard(guard, instance, stageName, now) {
-  const ctx = { instance, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
-  if (targets === null) return null;
-  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
-  return { doc: compileGuard({
-    id: lakeGuardId({ instanceDocId: instance._id, guardName: guard.name }),
-    resourceType: resource.type,
-    resourceId: resource.id,
-    owner: GUARD_OWNER,
-    sourceInstanceId: instance._id,
-    sourceDefinition: instance.definition,
-    sourceStage: stageName,
-    name: guard.name,
-    ...guard.description !== void 0 ? { description: guard.description } : {},
-    match: {
-      ...types !== void 0 ? { types } : {},
-      idRefs: bareIdRefs(targets),
-      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
-      actions: guard.match.actions
-    },
-    predicate: guard.predicate ?? "",
-    metadata: resolveMetadata(guard.metadata, ctx)
-  }), routeGdr: targets[0].parsed };
+function abortReason(instance) {
+  return instance.history.find(
+    (h) => h._type === "aborted"
+  )?.reason;
 }
-async function upsertGuard(client, doc) {
-  if (!await client.getDocument(doc._id)) {
-    await client.create(doc);
-    return;
-  }
-  const { _id, _type, _rev, _createdAt, _updatedAt, ...body } = doc;
-  await client.patch(doc._id).set(body).commit();
+function diagnoseInputFromEvaluation(evaluation) {
+  return {
+    instance: evaluation.instance,
+    tasks: evaluation.currentStage.tasks,
+    transitions: evaluation.currentStage.transitions
+  };
 }
-function resolvedStageGuards(args) {
-  const stage = args.definition.stages.find((s) => s.name === args.stageName), out = [];
-  for (const guard of stage?.guards ?? []) {
-    const resolved = resolveGuard(guard, args.instance, args.stageName, args.now);
-    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
-  }
-  return out;
+function openStage(instance) {
+  return findOpenStageEntry(instance);
 }
-async function committedInstance(args) {
-  return await args.client.getDocument(args.instance._id) ?? void 0;
+function assigneesOf(stage, taskName) {
+  return (stage?.tasks.find((t) => t.name === taskName)?.state ?? []).filter((s) => s._type === "assignees").flatMap((s) => s.value);
 }
-async function deployStageGuards(args) {
-  const live = await committedInstance(args);
-  if (!(live === void 0 || live.currentStage !== args.stageName) && live.abortedAt === void 0)
-    for (const { client, doc } of resolvedStageGuards(args))
-      await upsertGuard(client, doc);
+function isResolved(status) {
+  return status === "done" || status === "skipped";
 }
-async function retractStageGuards(args) {
-  const live = await committedInstance(args);
-  if (live !== void 0 && !(live.currentStage === args.stageName && live.abortedAt === void 0))
-    for (const { client, doc } of resolvedStageGuards(args))
-      await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
+function failedEffectCause(input) {
+  const stalled = new Set(input.tasks.filter((t) => !isResolved(t.status)).map((t) => t.task.name)), effect = [...input.instance.effectHistory].reverse().find((e) => e.status === "failed" && e.origin.kind === "task" && stalled.has(e.origin.name));
+  return effect ? { kind: "failed-effect", effect } : void 0;
 }
-function randomKey(length = 12) {
-  const bytes = new Uint8Array(length);
-  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+function hungEffectCause(input) {
+  const effect = input.instance.pendingEffects.find((e) => e.claim !== void 0);
+  return effect ? { kind: "hung-effect", effect } : void 0;
 }
-async function evaluateCondition(args) {
-  const { condition, snapshot, params } = args;
-  return condition === void 0 ? !0 : !!await runGroq(condition, params, snapshot);
+function failedTaskCause(input) {
+  const failed = input.tasks.find((t) => t.status === "failed");
+  return failed ? { kind: "failed-task", task: failed.task.name } : void 0;
 }
-async function evaluatePredicates(args) {
-  const out = {};
-  for (const [name, groq] of Object.entries(args.predicates ?? {}))
-    out[name] = !!await runGroq(groq, args.params, args.snapshot);
-  return out;
+function waitingState(input) {
+  const active = input.tasks.find((t) => t.status === "active" && (t.task.actions ?? []).length > 0);
+  if (active !== void 0)
+    return {
+      state: "waiting",
+      task: active.task.name,
+      assignees: assigneesOf(openStage(input.instance), active.task.name),
+      actions: (active.task.actions ?? []).map((a) => a.name)
+    };
 }
-async function runGroq(groq, params, snapshot) {
-  const tree = parse(groq, { params });
-  return (await evaluate(tree, { dataset: snapshot.docs, params })).get();
+function noTransitionFiresCause(input) {
+  if (input.transitions.length !== 0 && !input.transitions.some((t) => t.filterSatisfied) && input.tasks.every((t) => isResolved(t.status)))
+    return { kind: "no-transition-fires" };
+}
+function diagnoseInstance(input) {
+  const { instance } = input;
+  if (instance.abortedAt !== void 0) {
+    const reason = abortReason(instance);
+    return { state: "aborted", at: instance.abortedAt, ...reason !== void 0 ? { reason } : {} };
+  }
+  if (instance.completedAt !== void 0)
+    return { state: "completed", at: instance.completedAt };
+  const cause = failedEffectCause(input) ?? failedTaskCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+  return cause !== void 0 ? { state: "stuck", cause } : waitingState(input) ?? { state: "progressing" };
 }
 function buildSnapshot(args) {
   const docs = [], knownIds = /* @__PURE__ */ new Set();
@@ -631,6 +629,191 @@ function resourceFromParsed(parsed) {
 function collectEntryDocUris(resolvedStateEntries) {
   return entryDocRefs(resolvedStateEntries).map((ref) => ref.id);
 }
+const resourceKey = (r) => `${r.type}.${r.id}`;
+function guardsForResource(client) {
+  return client.fetch("*[_type == $t] | order(_id asc)", { t: GUARD_DOC_TYPE });
+}
+function instanceGuardQuery(instanceId) {
+  return {
+    query: "*[_type == $guardType && sourceInstanceId == $instanceId]",
+    params: { guardType: GUARD_DOC_TYPE, instanceId }
+  };
+}
+function verdictGuardsForInstance(client, instanceId) {
+  const { query, params } = instanceGuardQuery(instanceId);
+  return client.fetch(query, params);
+}
+async function guardsForInstance(args) {
+  const { client, clientForGdr, instance } = args, stateUris = [
+    ...collectEntryDocUris(instance.state),
+    ...instance.stages.flatMap((stage) => collectEntryDocUris(stage.state))
+  ], clients = resourceClientMap(
+    instance.workflowResource,
+    client,
+    clientForGdr,
+    stateUris.map((uri) => tryParseGdr(uri))
+  ), { query, params } = instanceGuardQuery(instance._id);
+  return queryGuardsAcross(clients.values(), query, params);
+}
+async function guardsForDefinition(args) {
+  const perClient = await guardsForDefinitionByClient(args);
+  return dedupById(perClient.flatMap((entry) => entry.guards));
+}
+async function guardsForDefinitionByClient(args) {
+  const { client, clientForGdr, workflowResource, definition, definitions } = args, gdrs = definitions.flatMap(
+    (def) => guardIdRefs(def).map(({ idRef, stage }) => staticIdRefGdr(idRef, stage, def))
+  ), clients = resourceClientMap(workflowResource, client, clientForGdr, gdrs), query = "*[_type == $t && sourceDefinition == $definition]", params = { t: GUARD_DOC_TYPE, definition };
+  return Promise.all(
+    [...clients.values()].map(async (resourceClient) => ({
+      client: resourceClient,
+      guards: await resourceClient.fetch(query, params)
+    }))
+  );
+}
+function guardIdRefs(definition) {
+  return definition.stages.flatMap(
+    (stage) => (stage.guards ?? []).flatMap(
+      (guard) => (guard.match.idRefs ?? []).map((idRef) => ({ idRef, stage }))
+    )
+  );
+}
+function staticIdRefGdr(idRef, stage, definition) {
+  const read = /^\$state\.([\w-]+)/.exec(idRef);
+  if (read === null) return;
+  const source = entriesInScope(stage, definition).find((e) => e.name === read[1])?.source;
+  return source?.type === "literal" ? gdrFromValue(source.value) : void 0;
+}
+function entriesInScope(stage, definition) {
+  return [
+    ...definition.state ?? [],
+    ...stage.state ?? [],
+    ...(stage.tasks ?? []).flatMap((task) => task.state ?? [])
+  ];
+}
+function gdrFromValue(value) {
+  if (typeof value == "string") return tryParseGdr(value);
+  if (typeof value == "object" && value !== null && "id" in value) {
+    const id = value.id;
+    return typeof id == "string" ? tryParseGdr(id) : void 0;
+  }
+}
+function tryParseGdr(uri) {
+  try {
+    return parseGdr(uri);
+  } catch {
+    return;
+  }
+}
+function resourceClientMap(base, baseClient, clientForGdr, gdrs) {
+  const map = /* @__PURE__ */ new Map([[resourceKey(base), baseClient]]);
+  for (const parsed of gdrs) {
+    if (parsed === void 0) continue;
+    const key = resourceKey(resourceFromParsed(parsed));
+    map.has(key) || map.set(key, clientForGdr(parsed));
+  }
+  return map;
+}
+async function queryGuardsAcross(clients, query, params) {
+  const perResource = await Promise.all(
+    [...clients].map((c) => c.fetch(query, params))
+  );
+  return dedupById(perResource.flat());
+}
+function dedupById(guards) {
+  return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
+}
+const GUARD_OWNER = "robot:workflow-engine", GUARD_LIFTED_PREDICATE = "true";
+function resolveGuard(guard, instance, stageName, now) {
+  const ctx = { instance, now }, targets = resolveIdRefTargets(guard.match.idRefs, ctx);
+  if (targets === null) return null;
+  const resource = assertSingleResource(targets), types = resolveMatchTypes(targets, guard.match.types);
+  return { doc: compileGuard({
+    id: lakeGuardId({ instanceDocId: instance._id, guardName: guard.name }),
+    resourceType: resource.type,
+    resourceId: resource.id,
+    owner: GUARD_OWNER,
+    sourceInstanceId: instance._id,
+    sourceDefinition: instance.definition,
+    sourceStage: stageName,
+    name: guard.name,
+    ...guard.description !== void 0 ? { description: guard.description } : {},
+    match: {
+      ...types !== void 0 ? { types } : {},
+      idRefs: bareIdRefs(targets),
+      ...guard.match.idPatterns !== void 0 ? { idPatterns: guard.match.idPatterns } : {},
+      actions: guard.match.actions
+    },
+    predicate: guard.predicate ?? "",
+    metadata: resolveMetadata(guard.metadata, ctx)
+  }), routeGdr: targets[0].parsed };
+}
+async function upsertGuard(client, doc) {
+  if (!await client.getDocument(doc._id)) {
+    await client.create(doc);
+    return;
+  }
+  const { _id, _type, _rev, _createdAt, _updatedAt, ...body } = doc;
+  await client.patch(doc._id).set(body).commit();
+}
+function resolvedStageGuards(args) {
+  const stage = args.definition.stages.find((s) => s.name === args.stageName), out = [];
+  for (const guard of stage?.guards ?? []) {
+    const resolved = resolveGuard(guard, args.instance, args.stageName, args.now);
+    resolved !== null && out.push({ client: args.clientForGdr(resolved.routeGdr), doc: resolved.doc });
+  }
+  return out;
+}
+async function committedInstance(args) {
+  return await args.client.getDocument(args.instance._id) ?? void 0;
+}
+async function deployStageGuards(args) {
+  const live = await committedInstance(args);
+  if (!(live === void 0 || live.currentStage !== args.stageName) && live.abortedAt === void 0)
+    for (const { client, doc } of resolvedStageGuards(args))
+      await upsertGuard(client, doc);
+}
+async function retractStageGuards(args) {
+  const live = await committedInstance(args);
+  if (live !== void 0 && !(live.currentStage === args.stageName && live.abortedAt === void 0))
+    for (const { client, doc } of resolvedStageGuards(args))
+      await client.getDocument(doc._id) && await client.patch(doc._id).set({ predicate: GUARD_LIFTED_PREDICATE }).commit();
+}
+async function deleteOrphanedDefinitionGuards(args) {
+  const { client, clientForGdr, workflowResource, definition, definitions, tag } = args, perClient = await guardsForDefinitionByClient({
+    client,
+    clientForGdr,
+    workflowResource,
+    definition,
+    definitions
+  }), ownPartitionPrefix = `${tag}.`;
+  let count = 0;
+  for (const { client: resourceClient, guards } of perClient) {
+    const own = guards.filter((guard) => guard.sourceInstanceId.startsWith(ownPartitionPrefix));
+    if (own.length === 0) continue;
+    const tx = resourceClient.transaction();
+    for (const guard of own) tx.delete(guard._id);
+    await tx.commit(), count += own.length;
+  }
+  return count;
+}
+function randomKey(length = 12) {
+  const bytes = new Uint8Array(length);
+  return globalThis.crypto.getRandomValues(bytes), [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, length);
+}
+async function evaluateCondition(args) {
+  const { condition, snapshot, params } = args;
+  return condition === void 0 ? !0 : !!await runGroq(condition, params, snapshot);
+}
+async function evaluatePredicates(args) {
+  const out = {};
+  for (const [name, groq] of Object.entries(args.predicates ?? {}))
+    out[name] = !!await runGroq(groq, args.params, args.snapshot);
+  return out;
+}
+async function runGroq(groq, params, snapshot) {
+  const tree = parse(groq, { params });
+  return (await evaluate(tree, { dataset: snapshot.docs, params })).get();
+}
 class StateValueShapeError extends Error {
   entryType;
   entryName;
@@ -791,7 +974,7 @@ async function resolveQueryValue(entry, source, ctx, client, defaultValue) {
     stage: ctx.stageName ?? null,
     task: ctx.taskName ?? null,
     now: ctx.now,
-    engineTags: ctx.tags ?? []
+    tag: ctx.tag
   });
   try {
     const fetchOptions = ctx.perspective !== void 0 ? { perspective: ctx.perspective } : void 0, result = await client.fetch(source.query, params, fetchOptions);
@@ -958,7 +1141,7 @@ async function resolveStageStateEntries(args) {
       client,
       now,
       selfId: instance._id,
-      tags: instance.tags ?? [],
+      tag: instance.tag,
       stageName: stage.name,
       workflowResource: instance.workflowResource,
       // Allow stage-scope entries' `source: { type: "stateRead", scope:
@@ -978,7 +1161,7 @@ async function resolveTaskStateEntries(args) {
       client,
       now,
       selfId: instance._id,
-      tags: instance.tags ?? [],
+      tag: instance.tag,
       stageName: stage.name,
       workflowResource: instance.workflowResource,
       taskName: task.name,
@@ -988,53 +1171,6 @@ async function resolveTaskStateEntries(args) {
     randomKey
   });
 }
-async function resolveBindings(args) {
-  const resolved = {};
-  for (const [key, groq] of Object.entries(args.bindings ?? {}))
-    resolved[key] = await runGroq(groq, args.params, args.snapshot);
-  return { ...resolved, ...args.staticInput };
-}
-function effectsContextEntry(name, value) {
-  const _key = randomKey();
-  return typeof value == "string" ? { _key, _type: "effectsContext.string", name, value } : typeof value == "number" ? { _key, _type: "effectsContext.number", name, value } : typeof value == "boolean" ? { _key, _type: "effectsContext.boolean", name, value } : { _key, _type: "effectsContext.ref", name, value };
-}
-function effectsContextJsonEntry(name, value) {
-  return { _key: randomKey(), _type: "effectsContext.json", name, value: JSON.stringify(value) };
-}
-function buildInstanceBase(args) {
-  const { id, now, actor, perspective } = args;
-  return {
-    _id: id,
-    _type: WORKFLOW_INSTANCE_TYPE,
-    _rev: "",
-    _createdAt: now,
-    _updatedAt: now,
-    tags: args.tags,
-    workflowResource: args.workflowResource,
-    definition: args.definitionName,
-    pinnedVersion: args.pinnedVersion,
-    definitionSnapshot: JSON.stringify(args.definition),
-    state: args.state,
-    effectsContext: args.effectsContext,
-    ancestors: args.ancestors,
-    ...perspective !== void 0 ? { perspective } : {},
-    currentStage: args.initialStage,
-    stages: [],
-    pendingEffects: [],
-    effectHistory: [],
-    history: [
-      {
-        _key: randomKey(),
-        _type: "stageEntered",
-        at: now,
-        stage: args.initialStage,
-        ...actor !== void 0 ? { actor } : {}
-      }
-    ],
-    startedAt: now,
-    lastChangedAt: now
-  };
-}
 class ActionParamsInvalidError extends Error {
   action;
   task;
@@ -1154,21 +1290,108 @@ function stageTransitionHistory(args) {
     }
   ];
 }
-const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
-function validateTags(tags) {
-  if (tags.length === 0)
-    throw new Error("tags: must be a non-empty array");
-  for (const tag of tags)
-    if (!TAG_RE.test(tag))
-      throw new Error(
-        `tags: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
-      );
+function startMutation(instance) {
+  return {
+    currentStage: instance.currentStage,
+    // Deep-ish copy. Per-scope state entry arrays need their own copies
+    // so ops can mutate without leaking into the source.
+    state: (instance.state ?? []).map((s) => ({ ...s })),
+    stages: instance.stages.map((s) => ({
+      ...s,
+      state: (s.state ?? []).map((entry) => ({ ...entry })),
+      tasks: s.tasks.map((t) => ({
+        ...t,
+        ...t.state !== void 0 ? { state: t.state.map((entry) => ({ ...entry })) } : {}
+      }))
+    })),
+    pendingEffects: [...instance.pendingEffects],
+    effectHistory: [...instance.effectHistory],
+    effectsContext: [...instance.effectsContext],
+    history: [...instance.history],
+    lastChangedAt: instance.lastChangedAt,
+    ...instance.completedAt !== void 0 ? { completedAt: instance.completedAt } : {},
+    ...instance.abortedAt !== void 0 ? { abortedAt: instance.abortedAt } : {},
+    pendingCreates: []
+  };
 }
-function canonicalTag(tags) {
-  return tags[0];
+function instanceStateFields(src) {
+  const fields = {
+    currentStage: src.currentStage,
+    state: src.state,
+    stages: src.stages,
+    pendingEffects: src.pendingEffects,
+    effectHistory: src.effectHistory,
+    effectsContext: src.effectsContext,
+    history: src.history
+  };
+  return src.completedAt !== void 0 && (fields.completedAt = src.completedAt), src.abortedAt !== void 0 && (fields.abortedAt = src.abortedAt), fields;
 }
-function tagScopeFilter(param = "engineTags") {
-  return `count(tags[@ in $${param}]) > 0`;
+function materializeInstance(base, mutation) {
+  return {
+    ...base,
+    currentStage: mutation.currentStage,
+    state: mutation.state,
+    stages: mutation.stages
+  };
+}
+async function persist(ctx, mutation) {
+  const set = {
+    ...instanceStateFields(mutation),
+    lastChangedAt: ctx.now
+  }, pendingCreates = mutation.pendingCreates;
+  if (pendingCreates.length === 0)
+    return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit();
+  const tx = ctx.client.transaction();
+  for (const body of pendingCreates) tx.create(body);
+  tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), await tx.commit(), mutation.pendingCreates = [];
+  const actorForPriming = void 0;
+  for (const body of pendingCreates)
+    await primeInitialStage(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await cascadeAutoTransitions(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await propagateToAncestors(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock);
+  const reloaded = await ctx.client.getDocument(ctx.instance._id);
+  if (!reloaded)
+    throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
+  return reloaded;
+}
+function currentStageEntry(mutation) {
+  const entry = findOpenStageEntry(mutation);
+  if (entry === void 0)
+    throw new Error(
+      `Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`
+    );
+  return entry;
+}
+function currentTasks(mutation) {
+  return currentStageEntry(mutation).tasks;
+}
+function findTaskInCurrentStage(ctx, taskName) {
+  const stage = findStage(ctx.definition, ctx.instance.currentStage), task = (stage.tasks ?? []).find((t) => t.name === taskName);
+  if (task === void 0)
+    throw new Error(
+      `Task "${taskName}" not found in current stage "${stage.name}" of ${ctx.definition.name}`
+    );
+  return { stage, task };
+}
+function requireMutationTaskEntry(mutation, task) {
+  const mutEntry = currentTasks(mutation).find((t) => t.name === task);
+  if (mutEntry === void 0)
+    throw new Error(`Task "${task}" disappeared from mutation copy \u2014 invariant broken`);
+  return mutEntry;
+}
+function findCurrentStageEntry(instance) {
+  return findOpenStageEntry(instance);
+}
+function findCurrentTasks(instance) {
+  return findCurrentStageEntry(instance)?.tasks ?? [];
+}
+const TAG_RE = /^[a-z0-9][a-z0-9-]*$/;
+function validateTag(tag) {
+  if (!TAG_RE.test(tag))
+    throw new Error(
+      `tag: invalid tag "${tag}" \u2014 must match ${TAG_RE.source} (ASCII lowercase + digits + dashes, no leading dash, no dots)`
+    );
+}
+function tagScopeFilter() {
+  return "tag == $tag";
 }
 function definitionLookupGroq(explicit) {
   const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}`;
@@ -1186,6 +1409,55 @@ function clientForDiscovery(defaultClient, clientForGdr, subjectGdrUri) {
     return defaultClient;
   }
 }
+async function reload(client, instanceId, tag) {
+  const doc = await client.getDocument(instanceId);
+  if (!doc)
+    throw new Error(`Workflow instance ${instanceId} not found`);
+  if (doc.tag !== tag)
+    throw new Error(`Workflow instance ${instanceId} not visible to this engine (tag mismatch)`);
+  return doc;
+}
+function effectsContextEntry(name, value) {
+  const _key = randomKey();
+  return typeof value == "string" ? { _key, _type: "effectsContext.string", name, value } : typeof value == "number" ? { _key, _type: "effectsContext.number", name, value } : typeof value == "boolean" ? { _key, _type: "effectsContext.boolean", name, value } : { _key, _type: "effectsContext.ref", name, value };
+}
+function effectsContextJsonEntry(name, value) {
+  return { _key: randomKey(), _type: "effectsContext.json", name, value: JSON.stringify(value) };
+}
+function buildInstanceBase(args) {
+  const { id, now, actor, perspective } = args;
+  return {
+    _id: id,
+    _type: WORKFLOW_INSTANCE_TYPE,
+    _rev: "",
+    _createdAt: now,
+    _updatedAt: now,
+    tag: args.tag,
+    workflowResource: args.workflowResource,
+    definition: args.definitionName,
+    pinnedVersion: args.pinnedVersion,
+    definitionSnapshot: JSON.stringify(args.definition),
+    state: args.state,
+    effectsContext: args.effectsContext,
+    ancestors: args.ancestors,
+    ...perspective !== void 0 ? { perspective } : {},
+    currentStage: args.initialStage,
+    stages: [],
+    pendingEffects: [],
+    effectHistory: [],
+    history: [
+      {
+        _key: randomKey(),
+        _type: "stageEntered",
+        at: now,
+        stage: args.initialStage,
+        ...actor !== void 0 ? { actor } : {}
+      }
+    ],
+    startedAt: now,
+    lastChangedAt: now
+  };
+}
 const MAX_SPAWN_DEPTH = 6, SUBWORKFLOWS_ALL_DONE = "count($subworkflows[status != 'done']) == 0", FAIL_WHEN_SYSTEM_ID = "engine.failWhen", COMPLETE_WHEN_SYSTEM_ID = "engine.completeWhen";
 function gateActor(outcome) {
   return {
@@ -1211,7 +1483,7 @@ async function spawnSubworkflows(ctx, mutation, task, sub, actor) {
       `Subworkflow depth limit (${MAX_SPAWN_DEPTH}) exceeded on task "${task.name}" of ${ctx.instance._id}. Ancestor chain: ${chain}`
     );
   }
-  const now = ctx.now, definition = await resolveDefinitionRef(ctx.client, sub.definition, ctx.instance.tags ?? []);
+  const now = ctx.now, definition = await resolveDefinitionRef(ctx.client, sub.definition, ctx.instance.tag);
   if (definition === null) {
     const versionLabel = sub.definition.version === void 0 || sub.definition.version === "latest" ? "latest" : `v${sub.definition.version}`;
     throw new Error(
@@ -1301,15 +1573,15 @@ function coerceSpawnGdr(raw, workflowResource) {
   }
   return typeof raw == "string" && raw.length > 0 ? { id: toUri(raw), type: "document" } : null;
 }
-async function resolveDefinitionRef(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, engineTags: tags };
+async function resolveDefinitionRef(client, ref, tag) {
+  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, tag };
   return wantsExplicit && (params.version = ref.version), await client.fetch(
     definitionLookupGroq(wantsExplicit),
     params
   ) ?? null;
 }
 async function prepareChildInstance(args) {
-  const { client, parent, definition, initialState, effectsContext, actor, now } = args, childTags = parent.tags ?? [], childPrefix = childTags[0] ?? "wf", workflowResource = parent.workflowResource, childDocId = `${childPrefix}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
+  const { client, parent, definition, initialState, effectsContext, actor, now } = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = `${childTag}.wf-instance.${randomKey()}`, childRef = { id: gdrFromResource(workflowResource, childDocId), type: WORKFLOW_INSTANCE_TYPE }, ancestors = [
     ...parent.ancestors,
     {
       id: selfGdr(parent),
@@ -1322,7 +1594,7 @@ async function prepareChildInstance(args) {
       client,
       now,
       selfId: childDocId,
-      tags: childTags,
+      tag: childTag,
       workflowResource,
       ...inheritedPerspective !== void 0 ? { perspective: inheritedPerspective } : {}
     },
@@ -1341,7 +1613,7 @@ async function prepareChildInstance(args) {
   ), base = buildInstanceBase({
     id: childDocId,
     now,
-    tags: childTags,
+    tag: childTag,
     workflowResource,
     definitionName: definition.name,
     pinnedVersion: definition.version,
@@ -1353,16 +1625,121 @@ async function prepareChildInstance(args) {
     initialStage: definition.initialStage,
     actor
   });
-  return { ref: childRef, body: base };
-}
-async function subworkflowRows(ctx, refs) {
-  if (refs.length === 0) return [];
-  const ids = refs.map((r) => gdrToBareId(r.id));
-  return (await ctx.client.fetch("*[_id in $ids]{_id, currentStage, completedAt}", { ids })).map((c) => ({
-    _id: c._id,
-    stage: c.currentStage,
-    status: c.completedAt !== void 0 && c.completedAt !== null ? "done" : "active"
-  }));
+  return { ref: childRef, body: base };
+}
+async function subworkflowRows(ctx, refs) {
+  if (refs.length === 0) return [];
+  const ids = refs.map((r) => gdrToBareId(r.id));
+  return (await ctx.client.fetch("*[_id in $ids]{_id, currentStage, completedAt}", { ids })).map((c) => ({
+    _id: c._id,
+    stage: c.currentStage,
+    status: c.completedAt !== void 0 && c.completedAt !== null ? "done" : "active"
+  }));
+}
+async function resolveBindings(args) {
+  const resolved = {};
+  for (const [key, groq] of Object.entries(args.bindings ?? {}))
+    resolved[key] = await runGroq(groq, args.params, args.snapshot);
+  return { ...resolved, ...args.staticInput };
+}
+async function completeEffect(args) {
+  const { client, instanceId, effectKey, status, outputs, detail, error, durationMs, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {},
+    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
+  });
+  return commitCompleteEffect(
+    ctx,
+    effectKey,
+    status,
+    outputs,
+    detail,
+    error,
+    durationMs,
+    options?.actor
+  );
+}
+function buildEffectHistoryEntry(pending, outcome) {
+  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
+  return {
+    _key: pending._key,
+    name: pending.name,
+    ...pending.title !== void 0 ? { title: pending.title } : {},
+    ...pending.description !== void 0 ? { description: pending.description } : {},
+    params: pending.params,
+    origin: pending.origin,
+    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
+    ranAt,
+    ...durationMs !== void 0 ? { durationMs } : {},
+    status,
+    ...detail !== void 0 ? { detail } : {},
+    ...error !== void 0 ? { error } : {},
+    ...outputs !== void 0 ? { outputs } : {}
+  };
+}
+function upsertEffectsContext(mutation, effectName, outputs) {
+  const existingIndex = mutation.effectsContext.findIndex((e) => e.name === effectName), entry = effectsContextJsonEntry(effectName, outputs);
+  existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
+}
+async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
+  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
+  if (pending === void 0)
+    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
+  const mutation = startMutation(ctx.instance);
+  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
+  const ranAt = ctx.now;
+  return mutation.effectHistory.push(
+    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
+  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, pending.name, outputs), mutation.history.push({
+    _key: randomKey(),
+    _type: "effectCompleted",
+    at: ranAt,
+    effectKey,
+    effect: pending.name,
+    status,
+    ...outputs !== void 0 ? { outputs } : {},
+    ...detail !== void 0 ? { detail } : {},
+    ...actor !== void 0 ? { actor } : {}
+  }), await persist(ctx, mutation), { effectKey, status };
+}
+function buildQueuedEffect(effect, origin, params, actor, now) {
+  const key = randomKey(), pending = {
+    _key: key,
+    _type: "pendingEffect",
+    name: effect.name,
+    ...effect.title !== void 0 ? { title: effect.title } : {},
+    ...effect.description !== void 0 ? { description: effect.description } : {},
+    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
+    params,
+    origin,
+    ...actor !== void 0 ? { actor } : {},
+    queuedAt: now
+  }, history = {
+    _key: randomKey(),
+    _type: "effectQueued",
+    at: now,
+    effectKey: key,
+    effect: effect.name,
+    origin
+  };
+  return { pending, history };
+}
+async function queueEffects(ctx, mutation, effects, origin, actor, opts) {
+  if (!effects || effects.length === 0) return;
+  const now = ctx.now, liveCtx = { ...ctx, instance: materializeInstance(ctx.instance, mutation) }, params = await ctxConditionParams(liveCtx, {
+    ...opts?.taskName !== void 0 ? { taskName: opts.taskName } : {},
+    ...actor !== void 0 ? { actor } : {},
+    // Caller-supplied action params, readable in bindings as `$params.<name>`.
+    vars: { params: opts?.callerParams ?? {} }
+  });
+  for (const effect of effects) {
+    const resolved = await resolveBindings({
+      bindings: effect.bindings,
+      staticInput: effect.input,
+      snapshot: ctx.snapshot,
+      params
+    }), { pending, history } = buildQueuedEffect(effect, origin, resolved, actor, now);
+    mutation.pendingEffects.push(pending), mutation.history.push(history);
+  }
 }
 function resolveStaticSource(src, ctx) {
   switch (src.type) {
@@ -1593,7 +1970,8 @@ function evalOpPredicate(p, row, ctx) {
 }
 async function invokeTask(args) {
   const { client, instanceId, task: taskName, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {}
+    ...options?.clock ? { clock: options.clock } : {},
+    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
   });
   return commitInvoke(ctx, taskName, options?.actor);
 }
@@ -1701,7 +2079,8 @@ function isTerminalStage(stage) {
 }
 async function setStage(args) {
   const { client, instanceId, targetStage, reason, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {}
+    ...options?.clock ? { clock: options.clock } : {},
+    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
   });
   return commitSetStage(ctx, targetStage, reason, options?.actor);
 }
@@ -1957,282 +2336,53 @@ async function cascadeAutoTransitions(client, instanceId, actor, clientForGdr, c
       ...actor !== void 0 ? { options: { actor } } : {},
       ...clientForGdr ? { clientForGdr } : {},
       ...clock ? { clock } : {},
-      ...overlay ? { overlay } : {}
-    })).fired) return count;
-    if (count++, count >= CASCADE_LIMIT)
-      throw new CascadeLimitError({ instanceId, limit: CASCADE_LIMIT });
-  }
-}
-async function findResolvedParentSpawn(client, child, clientForGdr, clock) {
-  const parentRef = child.ancestors.at(-1);
-  if (parentRef === void 0) return;
-  const parent = await client.getDocument(gdrToBareId(parentRef.id));
-  if (!parent || parent._type !== WORKFLOW_INSTANCE_TYPE || typeof parent.definitionSnapshot != "string") return;
-  const definition = parseDefinitionSnapshot(parent), stage = definition.stages.find((s) => s.name === parent.currentStage);
-  if (stage === void 0) return;
-  const parentCurrentTasks = findCurrentTasks(parent), task = (stage.tasks ?? []).find((t) => t.subworkflows === void 0 ? !1 : parentCurrentTasks.find((e) => e.name === t.name)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
-  if (task?.subworkflows === void 0) return;
-  const entry = parentCurrentTasks.find((e) => e.name === task.name);
-  if (entry === void 0 || entry.status !== "active") return;
-  const ctx = await buildEngineContext({
-    client,
-    clientForGdr,
-    instance: parent,
-    definition,
-    ...clock ? { clock } : {}
-  }), outcome = await evaluateResolutionGate(ctx, task, await taskConditionVars(ctx, entry));
-  if (outcome !== void 0)
-    return { parent, definition, stage, task, outcome };
-}
-async function propagateToAncestors(client, instanceId, actor, clientForGdr, clock) {
-  const instance = await client.getDocument(instanceId);
-  if (!instance) return;
-  const resolvedClientForGdr = clientForGdr ?? (() => client), found = await findResolvedParentSpawn(client, instance, resolvedClientForGdr, clock);
-  if (found === void 0) return;
-  const { parent, definition, stage, task, outcome } = found, ctx = await buildEngineContext({
-    client,
-    clientForGdr: resolvedClientForGdr,
-    instance: parent,
-    definition,
-    ...clock ? { clock } : {}
-  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.name === task.name);
-  mutEntry !== void 0 && (applyTaskStatusChange({
-    entry: mutEntry,
-    history: mutation.history,
-    stage: stage.name,
-    to: outcome,
-    at: ctx.now,
-    actor: gateActor(outcome)
-  }), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock));
-}
-function startMutation(instance) {
-  return {
-    currentStage: instance.currentStage,
-    // Deep-ish copy. Per-scope state entry arrays need their own copies
-    // so ops can mutate without leaking into the source.
-    state: (instance.state ?? []).map((s) => ({ ...s })),
-    stages: instance.stages.map((s) => ({
-      ...s,
-      state: (s.state ?? []).map((entry) => ({ ...entry })),
-      tasks: s.tasks.map((t) => ({
-        ...t,
-        ...t.state !== void 0 ? { state: t.state.map((entry) => ({ ...entry })) } : {}
-      }))
-    })),
-    pendingEffects: [...instance.pendingEffects],
-    effectHistory: [...instance.effectHistory],
-    effectsContext: [...instance.effectsContext],
-    history: [...instance.history],
-    lastChangedAt: instance.lastChangedAt,
-    ...instance.completedAt !== void 0 ? { completedAt: instance.completedAt } : {},
-    ...instance.abortedAt !== void 0 ? { abortedAt: instance.abortedAt } : {},
-    pendingCreates: []
-  };
-}
-function instanceStateFields(src) {
-  const fields = {
-    currentStage: src.currentStage,
-    state: src.state,
-    stages: src.stages,
-    pendingEffects: src.pendingEffects,
-    effectHistory: src.effectHistory,
-    effectsContext: src.effectsContext,
-    history: src.history
-  };
-  return src.completedAt !== void 0 && (fields.completedAt = src.completedAt), src.abortedAt !== void 0 && (fields.abortedAt = src.abortedAt), fields;
-}
-function materializeInstance(base, mutation) {
-  return {
-    ...base,
-    currentStage: mutation.currentStage,
-    state: mutation.state,
-    stages: mutation.stages
-  };
-}
-async function persist(ctx, mutation) {
-  const set = {
-    ...instanceStateFields(mutation),
-    lastChangedAt: ctx.now
-  }, pendingCreates = mutation.pendingCreates;
-  if (pendingCreates.length === 0)
-    return ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev).commit();
-  const tx = ctx.client.transaction();
-  for (const body of pendingCreates) tx.create(body);
-  tx.patch(ctx.client.patch(ctx.instance._id).set(set).ifRevisionId(ctx.instance._rev)), await tx.commit(), mutation.pendingCreates = [];
-  const actorForPriming = void 0;
-  for (const body of pendingCreates)
-    await primeInitialStage(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await cascadeAutoTransitions(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock), await propagateToAncestors(ctx.client, body._id, actorForPriming, ctx.clientForGdr, ctx.clock);
-  const reloaded = await ctx.client.getDocument(ctx.instance._id);
-  if (!reloaded)
-    throw new Error(`Instance ${ctx.instance._id} disappeared after transaction commit`);
-  return reloaded;
-}
-function currentStageEntry(mutation) {
-  const entry = findOpenStageEntry(mutation);
-  if (entry === void 0)
-    throw new Error(
-      `Mutation invariant broken: no current (un-exited) StageEntry for currentStage "${mutation.currentStage}"`
-    );
-  return entry;
-}
-function currentTasks(mutation) {
-  return currentStageEntry(mutation).tasks;
-}
-function findTaskInCurrentStage(ctx, taskName) {
-  const stage = findStage(ctx.definition, ctx.instance.currentStage), task = (stage.tasks ?? []).find((t) => t.name === taskName);
-  if (task === void 0)
-    throw new Error(
-      `Task "${taskName}" not found in current stage "${stage.name}" of ${ctx.definition.name}`
-    );
-  return { stage, task };
-}
-function requireMutationTaskEntry(mutation, task) {
-  const mutEntry = currentTasks(mutation).find((t) => t.name === task);
-  if (mutEntry === void 0)
-    throw new Error(`Task "${task}" disappeared from mutation copy \u2014 invariant broken`);
-  return mutEntry;
-}
-function findCurrentStageEntry(instance) {
-  return findOpenStageEntry(instance);
-}
-function findCurrentTasks(instance) {
-  return findCurrentStageEntry(instance)?.tasks ?? [];
-}
-async function completeEffect(args) {
-  const { client, instanceId, effectKey, status, outputs, detail, error, durationMs, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {}
-  });
-  return commitCompleteEffect(
-    ctx,
-    effectKey,
-    status,
-    outputs,
-    detail,
-    error,
-    durationMs,
-    options?.actor
-  );
-}
-function buildEffectHistoryEntry(pending, outcome) {
-  const { status, ranAt, actor, detail, error, durationMs, outputs } = outcome, resolvedActor = actor ?? pending.actor;
-  return {
-    _key: pending._key,
-    name: pending.name,
-    ...pending.title !== void 0 ? { title: pending.title } : {},
-    ...pending.description !== void 0 ? { description: pending.description } : {},
-    params: pending.params,
-    origin: pending.origin,
-    ...resolvedActor !== void 0 ? { actor: resolvedActor } : {},
-    ranAt,
-    ...durationMs !== void 0 ? { durationMs } : {},
-    status,
-    ...detail !== void 0 ? { detail } : {},
-    ...error !== void 0 ? { error } : {},
-    ...outputs !== void 0 ? { outputs } : {}
-  };
-}
-function upsertEffectsContext(mutation, effectName, outputs) {
-  const existingIndex = mutation.effectsContext.findIndex((e) => e.name === effectName), entry = effectsContextJsonEntry(effectName, outputs);
-  existingIndex >= 0 ? mutation.effectsContext[existingIndex] = entry : mutation.effectsContext.push(entry);
-}
-async function commitCompleteEffect(ctx, effectKey, status, outputs, detail, error, durationMs, actor) {
-  const pending = ctx.instance.pendingEffects.find((e) => e._key === effectKey);
-  if (pending === void 0)
-    throw new Error(`Pending effect "${effectKey}" not found on instance ${ctx.instance._id}`);
-  const mutation = startMutation(ctx.instance);
-  mutation.pendingEffects = mutation.pendingEffects.filter((e) => e._key !== effectKey);
-  const ranAt = ctx.now;
-  return mutation.effectHistory.push(
-    buildEffectHistoryEntry(pending, { status, ranAt, actor, detail, error, durationMs, outputs })
-  ), status === "done" && outputs !== void 0 && upsertEffectsContext(mutation, pending.name, outputs), mutation.history.push({
-    _key: randomKey(),
-    _type: "effectCompleted",
-    at: ranAt,
-    effectKey,
-    effect: pending.name,
-    status,
-    ...outputs !== void 0 ? { outputs } : {},
-    ...detail !== void 0 ? { detail } : {},
-    ...actor !== void 0 ? { actor } : {}
-  }), await persist(ctx, mutation), { effectKey, status };
-}
-function buildQueuedEffect(effect, origin, params, actor, now) {
-  const key = randomKey(), pending = {
-    _key: key,
-    _type: "pendingEffect",
-    name: effect.name,
-    ...effect.title !== void 0 ? { title: effect.title } : {},
-    ...effect.description !== void 0 ? { description: effect.description } : {},
-    ...effect.bindings !== void 0 ? { bindings: effect.bindings } : {},
-    params,
-    origin,
-    ...actor !== void 0 ? { actor } : {},
-    queuedAt: now
-  }, history = {
-    _key: randomKey(),
-    _type: "effectQueued",
-    at: now,
-    effectKey: key,
-    effect: effect.name,
-    origin
-  };
-  return { pending, history };
-}
-async function queueEffects(ctx, mutation, effects, origin, actor, opts) {
-  if (!effects || effects.length === 0) return;
-  const now = ctx.now, liveCtx = { ...ctx, instance: materializeInstance(ctx.instance, mutation) }, params = await ctxConditionParams(liveCtx, {
-    ...opts?.taskName !== void 0 ? { taskName: opts.taskName } : {},
-    ...actor !== void 0 ? { actor } : {},
-    // Caller-supplied action params, readable in bindings as `$params.<name>`.
-    vars: { params: opts?.callerParams ?? {} }
-  });
-  for (const effect of effects) {
-    const resolved = await resolveBindings({
-      bindings: effect.bindings,
-      staticInput: effect.input,
-      snapshot: ctx.snapshot,
-      params
-    }), { pending, history } = buildQueuedEffect(effect, origin, resolved, actor, now);
-    mutation.pendingEffects.push(pending), mutation.history.push(history);
+      ...overlay ? { overlay } : {}
+    })).fired) return count;
+    if (count++, count >= CASCADE_LIMIT)
+      throw new CascadeLimitError({ instanceId, limit: CASCADE_LIMIT });
   }
 }
-async function abortInstance(args) {
-  const { client, instanceId, reason, options } = args, ctx = await loadContext(client, instanceId, {
-    ...options?.clock ? { clock: options.clock } : {}
-  });
-  return commitAbort(ctx, reason, options?.actor);
+async function findResolvedParentSpawn(client, child, clientForGdr, clock) {
+  const parentRef = child.ancestors.at(-1);
+  if (parentRef === void 0) return;
+  const parent = await client.getDocument(gdrToBareId(parentRef.id));
+  if (!parent || parent._type !== WORKFLOW_INSTANCE_TYPE || typeof parent.definitionSnapshot != "string") return;
+  const definition = parseDefinitionSnapshot(parent), stage = definition.stages.find((s) => s.name === parent.currentStage);
+  if (stage === void 0) return;
+  const parentCurrentTasks = findCurrentTasks(parent), task = (stage.tasks ?? []).find((t) => t.subworkflows === void 0 ? !1 : parentCurrentTasks.find((e) => e.name === t.name)?.spawnedInstances?.some((r) => gdrToBareId(r.id) === child._id) ?? !1);
+  if (task?.subworkflows === void 0) return;
+  const entry = parentCurrentTasks.find((e) => e.name === task.name);
+  if (entry === void 0 || entry.status !== "active") return;
+  const ctx = await buildEngineContext({
+    client,
+    clientForGdr,
+    instance: parent,
+    definition,
+    ...clock ? { clock } : {}
+  }), outcome = await evaluateResolutionGate(ctx, task, await taskConditionVars(ctx, entry));
+  if (outcome !== void 0)
+    return { parent, definition, stage, task, outcome };
 }
-async function commitAbort(ctx, reason, actor) {
-  if (ctx.instance.completedAt !== void 0)
-    return { fired: !1 };
-  const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), at = ctx.now, openEntry = findOpenStageEntry(mutation);
-  return openEntry !== void 0 && (openEntry.exitedAt = at), mutation.effectHistory.push(
-    ...mutation.pendingEffects.map(
-      (pending) => buildEffectHistoryEntry(pending, {
-        status: "failed",
-        ranAt: at,
-        actor,
-        detail: "instance aborted before dispatch",
-        error: void 0,
-        durationMs: void 0,
-        outputs: void 0
-      })
-    )
-  ), mutation.pendingEffects = [], mutation.history.push({
-    _key: randomKey(),
-    _type: "aborted",
-    at,
+async function propagateToAncestors(client, instanceId, actor, clientForGdr, clock) {
+  const instance = await client.getDocument(instanceId);
+  if (!instance) return;
+  const resolvedClientForGdr = clientForGdr ?? (() => client), found = await findResolvedParentSpawn(client, instance, resolvedClientForGdr, clock);
+  if (found === void 0) return;
+  const { parent, definition, stage, task, outcome } = found, ctx = await buildEngineContext({
+    client,
+    clientForGdr: resolvedClientForGdr,
+    instance: parent,
+    definition,
+    ...clock ? { clock } : {}
+  }), mutation = startMutation(parent), mutEntry = currentTasks(mutation).find((e) => e.name === task.name);
+  mutEntry !== void 0 && (applyTaskStatusChange({
+    entry: mutEntry,
+    history: mutation.history,
     stage: stage.name,
-    ...reason !== void 0 ? { reason } : {},
-    ...actor !== void 0 ? { actor } : {}
-  }), mutation.completedAt = at, mutation.abortedAt = at, await persist(ctx, mutation), await retractStageGuards({
-    client: ctx.client,
-    clientForGdr: ctx.clientForGdr,
-    instance: ctx.instance,
-    definition: ctx.definition,
-    stageName: stage.name,
-    now: ctx.now
-  }), { fired: !0, stage: stage.name };
+    to: outcome,
+    at: ctx.now,
+    actor: gateActor(outcome)
+  }), await persist(ctx, mutation), await cascadeAutoTransitions(client, parent._id, actor, clientForGdr, clock), await propagateToAncestors(client, parent._id, actor, clientForGdr, clock));
 }
 const parsedFilters = /* @__PURE__ */ new Map();
 async function matchesFilter(args) {
@@ -2328,105 +2478,13 @@ async function fetchGrantsCached(requestFn, resourcePath) {
     return;
   }
 }
-const resourceKey = (r) => `${r.type}.${r.id}`;
-function guardsForResource(client) {
-  return client.fetch("*[_type == $t] | order(_id asc)", { t: GUARD_DOC_TYPE });
-}
-function instanceGuardQuery(instanceId) {
-  return {
-    query: "*[_type == $guardType && sourceInstanceId == $instanceId]",
-    params: { guardType: GUARD_DOC_TYPE, instanceId }
-  };
-}
-function verdictGuardsForInstance(client, instanceId) {
-  const { query, params } = instanceGuardQuery(instanceId);
-  return client.fetch(query, params);
-}
-async function guardsForInstance(args) {
-  const { client, clientForGdr, instance } = args, stateUris = [
-    ...collectEntryDocUris(instance.state),
-    ...instance.stages.flatMap((stage) => collectEntryDocUris(stage.state))
-  ], clients = resourceClientMap(
-    instance.workflowResource,
-    client,
-    clientForGdr,
-    stateUris.map((uri) => tryParseGdr(uri))
-  ), { query, params } = instanceGuardQuery(instance._id);
-  return queryGuardsAcross(clients.values(), query, params);
-}
-async function guardsForDefinition(args) {
-  const { client, clientForGdr, workflowResource, definition, definitions } = args, gdrs = definitions.flatMap(
-    (def) => guardIdRefs(def).map(({ idRef, stage }) => staticIdRefGdr(idRef, stage, def))
-  ), clients = resourceClientMap(workflowResource, client, clientForGdr, gdrs);
-  return queryGuardsAcross(clients.values(), "*[_type == $t && sourceDefinition == $definition]", {
-    t: GUARD_DOC_TYPE,
-    definition
-  });
-}
-function guardIdRefs(definition) {
-  return definition.stages.flatMap(
-    (stage) => (stage.guards ?? []).flatMap(
-      (guard) => (guard.match.idRefs ?? []).map((idRef) => ({ idRef, stage }))
-    )
-  );
-}
-function staticIdRefGdr(idRef, stage, definition) {
-  const read = /^\$state\.([\w-]+)/.exec(idRef);
-  if (read === null) return;
-  const source = entriesInScope(stage, definition).find((e) => e.name === read[1])?.source;
-  return source?.type === "literal" ? gdrFromValue(source.value) : void 0;
-}
-function entriesInScope(stage, definition) {
-  return [
-    ...definition.state ?? [],
-    ...stage.state ?? [],
-    ...(stage.tasks ?? []).flatMap((task) => task.state ?? [])
-  ];
-}
-function gdrFromValue(value) {
-  if (typeof value == "string") return tryParseGdr(value);
-  if (typeof value == "object" && value !== null && "id" in value) {
-    const id = value.id;
-    return typeof id == "string" ? tryParseGdr(id) : void 0;
-  }
-}
-function tryParseGdr(uri) {
-  try {
-    return parseGdr(uri);
-  } catch {
-    return;
-  }
-}
-function resourceClientMap(base, baseClient, clientForGdr, gdrs) {
-  const map = /* @__PURE__ */ new Map([[resourceKey(base), baseClient]]);
-  for (const parsed of gdrs) {
-    if (parsed === void 0) continue;
-    const key = resourceKey(resourceFromParsed(parsed));
-    map.has(key) || map.set(key, clientForGdr(parsed));
-  }
-  return map;
-}
-async function queryGuardsAcross(clients, query, params) {
-  const perResource = await Promise.all(
-    [...clients].map((c) => c.fetch(query, params))
-  );
-  return dedupById(perResource.flat());
-}
-function dedupById(guards) {
-  return [...new Map(guards.map((g) => [g._id, g])).values()].sort((a, b) => a._id.localeCompare(b._id));
-}
 async function evaluateInstance(args) {
-  const { client, tags, instanceId, resourceClients } = args, now = (args.clock ?? wallClock)();
-  validateTags(tags);
+  const { client, tag, instanceId, resourceClients } = args, now = (args.clock ?? wallClock)();
+  validateTag(tag);
   const { actor, grants } = await resolveAccess(client, {
     ...args.access !== void 0 ? { override: args.access } : {},
     ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
-  }), instance = await client.getDocument(instanceId);
-  if (!instance)
-    throw new Error(`Workflow instance "${instanceId}" not found`);
-  if (!tags.some((t) => instance.tags?.includes(t)))
-    throw new Error(`Workflow instance "${instanceId}" not visible to this engine (tag mismatch)`);
-  const definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance }), guards = await verdictGuardsForInstance(client, instance._id);
+  }), instance = await reload(client, instanceId, tag), definition = parseDefinitionSnapshot(instance), snapshot = await hydrateSnapshot({ client, clientForGdr: resourceClients !== void 0 ? (parsed) => resourceClients(parsed) ?? client : () => client, instance }), guards = await verdictGuardsForInstance(client, instance._id);
   return evaluateFromSnapshot({
     instance,
     definition,
@@ -2567,22 +2625,21 @@ function lifecycleReason(instance, status, stageHasExits) {
 function disabled(action, reason) {
   return { action, allowed: !1, disabledReason: reason };
 }
-function definitionDocId(_workflowResource, prefix, definition, version) {
-  return `${prefix}.${definition}.v${version}`;
+function definitionDocId(_workflowResource, tag, definition, version) {
+  return `${tag}.${definition}.v${version}`;
 }
-async function sortByDependencies(client, definitions, tags, workflowResource) {
-  const prefix = canonicalTag(tags), byName = /* @__PURE__ */ new Map();
+async function sortByDependencies(client, definitions, tag, workflowResource) {
+  const byName = /* @__PURE__ */ new Map();
   for (const def of definitions) {
     const list = byName.get(def.name) ?? [];
     list.push(def), byName.set(def.name, list);
   }
   const findInBatch = (ref) => findRefInBatch(byName, ref);
   return await assertCrossBatchRefsDeployed(client, definitions, {
-    tags,
+    tag,
     workflowResource,
-    prefix,
     findInBatch
-  }), topoSortDefinitions(definitions, { workflowResource, prefix, findInBatch });
+  }), topoSortDefinitions(definitions, { workflowResource, tag, findInBatch });
 }
 function findRefInBatch(byName, ref) {
   const candidates = byName.get(ref.name);
@@ -2595,10 +2652,10 @@ function findRefInBatch(byName, ref) {
 async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
   const missing = [];
   for (const def of definitions) {
-    const fromId = definitionDocId(ctx.workflowResource, ctx.prefix, def.name, def.version);
+    const fromId = definitionDocId(ctx.workflowResource, ctx.tag, def.name, def.version);
     for (const ref of refsOf(def)) {
       if (ctx.findInBatch(ref) !== void 0) continue;
-      const label = await resolveDeployedRefLabel(client, ref, ctx.tags);
+      const label = await resolveDeployedRefLabel(client, ref, ctx.tag);
       label !== void 0 && missing.push({ from: fromId, ref: label });
     }
   }
@@ -2610,8 +2667,8 @@ async function assertCrossBatchRefsDeployed(client, definitions, ctx) {
 `)
   );
 }
-async function resolveDeployedRefLabel(client, ref, tags) {
-  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, engineTags: tags };
+async function resolveDeployedRefLabel(client, ref, tag) {
+  const wantsExplicit = typeof ref.version == "number", params = { definition: ref.name, tag };
   if (wantsExplicit && (params.version = ref.version), !await client.fetch(
     definitionLookupGroq(wantsExplicit),
     params
@@ -2620,7 +2677,7 @@ async function resolveDeployedRefLabel(client, ref, tags) {
 }
 function topoSortDefinitions(definitions, ctx) {
   const visited = /* @__PURE__ */ new Set(), visiting = /* @__PURE__ */ new Set(), ordered = [], visit = (def) => {
-    const id = definitionDocId(ctx.workflowResource, ctx.prefix, def.name, def.version);
+    const id = definitionDocId(ctx.workflowResource, ctx.tag, def.name, def.version);
     if (!visited.has(id)) {
       if (visiting.has(id))
         throw new Error(`workflow.deployDefinitions: dependency cycle involving "${id}"`);
@@ -2661,11 +2718,11 @@ function stableStringify(value) {
     ([a], [b]) => a.localeCompare(b)
   ).map(([k, v2]) => `${JSON.stringify(k)}:${stableStringify(v2)}`).join(",")}}`;
 }
-async function loadDefinition(client, definition, version, tags) {
+async function loadDefinition(client, definition, version, tag) {
   if (version !== void 0) {
     const doc = await client.fetch(
       definitionLookupGroq(!0),
-      { definition, version, engineTags: tags }
+      { definition, version, tag }
     );
     if (!doc)
       throw new Error(`Workflow definition ${definition} v${version} not deployed`);
@@ -2673,23 +2730,63 @@ async function loadDefinition(client, definition, version, tags) {
   }
   const latest = await client.fetch(definitionLookupGroq(!1), {
     definition,
-    engineTags: tags
+    tag
   });
   if (!latest)
     throw new Error(`No deployed definition for workflow ${definition}`);
   return latest;
 }
-async function loadDefinitionVersions(client, definition, tags) {
+async function loadDefinitionVersions(client, definition, tag) {
   return client.fetch(
-    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && count(tags[@ in $engineTags]) > 0] | order(version desc)`,
-    { definition, engineTags: tags }
+    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}] | order(version desc)`,
+    { definition, tag }
   );
 }
+async function abortInstance(args) {
+  const { client, instanceId, reason, options } = args, ctx = await loadContext(client, instanceId, {
+    ...options?.clock ? { clock: options.clock } : {},
+    ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
+  });
+  return commitAbort(ctx, reason, options?.actor);
+}
+async function commitAbort(ctx, reason, actor) {
+  if (ctx.instance.completedAt !== void 0)
+    return { fired: !1 };
+  const stage = findStage(ctx.definition, ctx.instance.currentStage), mutation = startMutation(ctx.instance), at = ctx.now, openEntry = findOpenStageEntry(mutation);
+  return openEntry !== void 0 && (openEntry.exitedAt = at), mutation.effectHistory.push(
+    ...mutation.pendingEffects.map(
+      (pending) => buildEffectHistoryEntry(pending, {
+        status: "failed",
+        ranAt: at,
+        actor,
+        detail: "instance aborted before dispatch",
+        error: void 0,
+        durationMs: void 0,
+        outputs: void 0
+      })
+    )
+  ), mutation.pendingEffects = [], mutation.history.push({
+    _key: randomKey(),
+    _type: "aborted",
+    at,
+    stage: stage.name,
+    ...reason !== void 0 ? { reason } : {},
+    ...actor !== void 0 ? { actor } : {}
+  }), mutation.completedAt = at, mutation.abortedAt = at, await persist(ctx, mutation), await retractStageGuards({
+    client: ctx.client,
+    clientForGdr: ctx.clientForGdr,
+    instance: ctx.instance,
+    definition: ctx.definition,
+    stageName: stage.name,
+    now: ctx.now
+  }), { fired: !0, stage: stage.name };
+}
 async function fireAction(args) {
   const { client, instanceId, task, action, params, options } = args;
   for (let attempt = 1; attempt <= CONCURRENT_FIRE_ACTION_MAX_ATTEMPTS; attempt++) {
     const ctx = await loadContext(client, instanceId, {
-      ...options?.clock ? { clock: options.clock } : {}
+      ...options?.clock ? { clock: options.clock } : {},
+      ...options?.clientForGdr ? { clientForGdr: options.clientForGdr } : {}
     });
     try {
       return await commitAction(ctx, task, action, params, options);
@@ -2793,7 +2890,7 @@ function bareIdFromSpawnRef(uri) {
   }
 }
 async function resolveOperationContext(args) {
-  validateTags(args.tags);
+  validateTag(args.tag);
   const access = await resolveAccess(args.client, {
     ...args.access !== void 0 ? { override: args.access } : {},
     ...args.grantsFromPath !== void 0 ? { grantsFromPath: args.grantsFromPath } : {}
@@ -2815,19 +2912,18 @@ async function cascade(client, instanceId, actor, clientForGdr, clock, overlay)
   );
   return await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), count;
 }
+async function abortAndPropagate(args) {
+  const { client, instanceId, reason, actor, clientForGdr, clock } = args, result = await abortInstance({
+    client,
+    instanceId,
+    ...reason !== void 0 ? { reason } : {},
+    options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
+  });
+  return result.fired && await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), result.fired;
+}
 function buildClientForGdr(defaultClient, resolver) {
   return resolver === void 0 ? () => defaultClient : (parsed) => resolver(parsed) ?? defaultClient;
 }
-async function reload(client, instanceId, tags) {
-  const doc = await client.getDocument(instanceId);
-  if (!doc) throw new Error(`Workflow instance ${instanceId} not found`);
-  if (!intersectsTags(doc.tags, tags))
-    throw new Error(`Workflow instance ${instanceId} not visible to this engine (tag mismatch)`);
-  return doc;
-}
-function intersectsTags(docTags, engineTags) {
-  return !docTags || docTags.length === 0 ? !1 : engineTags.some((t) => docTags.includes(t));
-}
 function toEffectsContextEntries(ctx) {
   return Object.entries(ctx).map(([id, value]) => effectsContextEntry(id, value));
 }
@@ -2837,10 +2933,11 @@ function assertActionAllowed(evaluation, task, action) {
     throw new ActionDisabledError({ task, action, reason: actionEval.disabledReason });
 }
 async function applyAction(args) {
-  const { client, instance, task, action, params, actor, grants, clock } = args, options = {
+  const { client, instance, task, action, params, actor, grants, clock, clientForGdr } = args, options = {
     actor,
     ...grants !== void 0 ? { grants } : {},
-    ...clock !== void 0 ? { clock } : {}
+    ...clock !== void 0 ? { clock } : {},
+    ...clientForGdr !== void 0 ? { clientForGdr } : {}
   };
   return findOpenStageEntry(instance)?.tasks.find((t) => t.name === task)?.status === "pending" && await invokeTask({ client, instanceId: instance._id, task, options }), (await fireAction({
     client,
@@ -2851,6 +2948,78 @@ async function applyAction(args) {
     options
   })).ranOps;
 }
+async function deleteDefinition(args) {
+  const { client, tag, definition, version, cascade: cascade2, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersions(client, definition, tag);
+  if (versions.length === 0)
+    throw new Error(`No deployed definition for workflow ${definition}`);
+  const targets = version === void 0 ? versions : versions.filter((d) => d.version === version);
+  if (targets.length === 0)
+    throw new Error(`Workflow definition ${definition} v${version} not deployed`);
+  const lastVersionGoes = targets.length === versions.length;
+  await assertNoSpawnReferrers(client, tag, definition, targets, lastVersionGoes);
+  const instanceIds = await nonTerminalInstanceIds(client, tag, definition, version);
+  if (instanceIds.length > 0 && cascade2 !== !0)
+    throw new Error(
+      `Cannot delete ${definition}: ${instanceIds.length} non-terminal instance(s) exist (${previewIds(instanceIds)}). Pass cascade to abort them first \u2014 instances are aborted in place, never deleted.`
+    );
+  const abortedInstanceIds = await abortInstances({
+    client,
+    instanceIds,
+    reason,
+    actor,
+    clientForGdr,
+    clock
+  }), tx = client.transaction();
+  for (const target of targets) tx.delete(target._id);
+  await tx.commit();
+  const deletedGuardCount = lastVersionGoes ? await deleteOrphanedDefinitionGuards({
+    client,
+    clientForGdr,
+    workflowResource: args.workflowResource,
+    definition,
+    definitions: versions,
+    tag
+  }) : 0;
+  return {
+    name: definition,
+    deletedVersions: targets.map((d) => d.version),
+    abortedInstanceIds,
+    deletedGuardCount
+  };
+}
+async function assertNoSpawnReferrers(client, tag, definition, targets, lastVersionGoes) {
+  const deployed = await client.fetch(
+    `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}]`,
+    { tag }
+  ), targetIds = new Set(targets.map((d) => d._id)), targetVersions = new Set(targets.map((d) => d.version)), referrers = deployed.filter((d) => !targetIds.has(d._id)).filter(
+    (d) => refsOf(d).some(
+      (ref) => ref.name === definition && (typeof ref.version == "number" ? targetVersions.has(ref.version) : lastVersionGoes)
+    )
+  );
+  if (referrers.length > 0) {
+    const names = referrers.map((d) => `${d.name} v${d.version}`).join(", ");
+    throw new Error(
+      `Cannot delete ${definition}: still spawn-referenced by deployed definition(s) ${names}. Delete or redeploy the referrer(s) first.`
+    );
+  }
+}
+async function nonTerminalInstanceIds(client, tag, definition, version) {
+  const versionFilter = version === void 0 ? "" : " && pinnedVersion == $version";
+  return (await client.fetch(
+    `*[_type == "${WORKFLOW_INSTANCE_TYPE}" && definition == $definition && ${tagScopeFilter()} && !defined(completedAt)${versionFilter}] | order(_id asc){_id}`,
+    { definition, tag, ...version !== void 0 ? { version } : {} }
+  )).map((doc) => doc._id);
+}
+async function abortInstances(args) {
+  const { client, instanceIds, reason, actor, clientForGdr, clock } = args, aborted = [];
+  for (const instanceId of instanceIds)
+    await abortAndPropagate({ client, instanceId, reason, actor, clientForGdr, clock }) && aborted.push(instanceId);
+  return aborted;
+}
+function previewIds(ids) {
+  const head = ids.slice(0, 3).join(", ");
+  return ids.length > 3 ? `${head}, \u2026` : head;
+}
 const workflow = {
   /**
    * Deploy a set of workflow definitions as one call. Each lands as a
@@ -2869,20 +3038,20 @@ const workflow = {
    * Cycles in the dependency graph error before any write happens.
    */
   deployDefinitions: async (args) => {
-    const { client, tags, workflowResource, definitions } = args;
-    validateTags(tags);
+    const { client, tag, workflowResource, definitions } = args;
+    validateTag(tag);
     for (const def of definitions)
       validateDefinition(def);
-    const ordered = await sortByDependencies(client, definitions, tags, workflowResource), results = [], prefix = canonicalTag(tags), tx = client.transaction();
+    const ordered = await sortByDependencies(client, definitions, tag, workflowResource), results = [], tx = client.transaction();
     let hasWrites = !1;
     for (const def of ordered) {
-      const id = definitionDocId(workflowResource, prefix, def.name, def.version), expected = {
+      const id = definitionDocId(workflowResource, tag, def.name, def.version), expected = {
         ...def,
         _id: id,
         _type: WORKFLOW_DEFINITION_TYPE,
-        tags
+        tag
       }, existing = await client.getDocument(id);
-      if (existing && intersectsTags(existing.tags, tags) && isDefinitionUnchanged(existing, expected)) {
+      if (existing && existing.tag === tag && isDefinitionUnchanged(existing, expected)) {
         results.push({ definition: def.name, version: def.version, status: "unchanged" });
         continue;
       }
@@ -2901,6 +3070,14 @@ const workflow = {
     }
     return hasWrites && await tx.commit(), { results };
   },
+  /**
+   * Remove a deployed workflow definition (all versions, or one via
+   * `version`). Refuses while non-terminal instances exist unless
+   * `cascade` aborts them first — instances are never deleted, only
+   * aborted in place; see {@link deleteDefinitionInternal} for the
+   * full contract (spawn-referrer check, guard-doc housekeeping).
+   */
+  deleteDefinition: async (args) => deleteDefinition(args),
   /**
    * Spawn a new workflow instance from a deployed definition.
    *
@@ -2912,7 +3089,7 @@ const workflow = {
   startInstance: async (args) => {
     const {
       client,
-      tags,
+      tag,
       workflowResource,
       definition: definitionName,
       version,
@@ -2921,7 +3098,7 @@ const workflow = {
       effectsContext,
       instanceId,
       perspective
-    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, definitionName, version, tags), id = instanceId ?? `${canonicalTag(tags)}.wf-instance.${randomKey()}`;
+    } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, definition = await loadDefinition(client, definitionName, version, tag), id = instanceId ?? `${tag}.wf-instance.${randomKey()}`;
     if (definition.stages.find((s) => s.name === definition.initialStage) === void 0)
       throw new Error(
         `Initial stage "${definition.initialStage}" missing in ${definitionName} v${definition.version}`
@@ -2933,7 +3110,7 @@ const workflow = {
         client,
         now,
         selfId: id,
-        tags,
+        tag,
         workflowResource,
         ...perspective !== void 0 ? { perspective } : {}
       },
@@ -2941,7 +3118,7 @@ const workflow = {
     }), effectivePerspective = perspective ?? derivePerspectiveFromState(resolvedState), base = buildInstanceBase({
       id,
       now,
-      tags,
+      tag,
       workflowResource,
       definitionName: definition.name,
       pinnedVersion: definition.version,
@@ -2953,7 +3130,7 @@ const workflow = {
       initialStage: definition.initialStage,
       actor
     });
-    return await client.create(base), await primeInitialStage(client, id, actor, clientForGdr, clock), await cascade(client, id, actor, clientForGdr, clock), reload(client, id, tags);
+    return await client.create(base), await primeInitialStage(client, id, actor, clientForGdr, clock), await cascade(client, id, actor, clientForGdr, clock), reload(client, id, tag);
   },
   /**
    * Fire an action against a task. If the task is pending, it is
@@ -2968,19 +3145,19 @@ const workflow = {
   fireAction: async (args) => {
     const {
       client,
-      tags,
+      tag,
       instanceId,
       task,
       action,
       params,
       idempotent,
       resourceClients
-    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tags);
+    } = args, { access, actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, before = await reload(client, instanceId, tag);
     if (findOpenStageEntry(before)?.tasks.find((t) => t.name === task) === void 0 && idempotent === !0)
       return { instance: before, cascaded: 0, fired: !1 };
     const evaluation = await evaluateInstance({
       client,
-      tags,
+      tag,
       instanceId,
       access,
       clock,
@@ -2995,10 +3172,11 @@ const workflow = {
       actor,
       ...access.grants !== void 0 ? { grants: access.grants } : {},
       clock,
+      clientForGdr,
       ...params !== void 0 ? { params } : {}
     }), cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
-      instance: await reload(client, instanceId, tags),
+      instance: await reload(client, instanceId, tag),
       cascaded,
       fired: !0,
       ...ranOps !== void 0 ? { ranOps } : {}
@@ -3012,7 +3190,7 @@ const workflow = {
    * reference them. Cascades after.
    */
   completeEffect: async (args) => {
-    const { client, tags, instanceId, effectKey, status, outputs, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    const { client, tag, instanceId, effectKey, status, outputs, detail, error, durationMs } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
     await completeEffect({
       client,
       instanceId,
@@ -3022,11 +3200,11 @@ const workflow = {
       ...detail !== void 0 ? { detail } : {},
       ...error !== void 0 ? { error } : {},
       ...durationMs !== void 0 ? { durationMs } : {},
-      options: { ...actor !== void 0 ? { actor } : {}, clock }
+      options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
     });
     const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
-      instance: await reload(client, instanceId, tags),
+      instance: await reload(client, instanceId, tag),
       cascaded,
       fired: !0
     };
@@ -3041,11 +3219,11 @@ const workflow = {
    * affected instances and the engine re-evaluates.
    */
   tick: async (args) => {
-    const { client, tags, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload(client, instanceId, tags), guards = await verdictGuardsForInstance(client, current._id);
+    const { client, tag, instanceId } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload(client, instanceId, tag), guards = await verdictGuardsForInstance(client, current._id);
     await assertInstanceWriteAllowed({ instance: current, guards, identity: actor.id });
     const cascaded = await cascade(client, instanceId, actor, clientForGdr, clock);
     return {
-      instance: await reload(client, instanceId, tags),
+      instance: await reload(client, instanceId, tag),
       cascaded,
       fired: cascaded > 0
     };
@@ -3056,56 +3234,50 @@ const workflow = {
    * upstream; this verb performs the mechanical move.
    */
   setStage: async (args) => {
-    const { client, tags, instanceId, targetStage, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
-    await reload(client, instanceId, tags);
+    const { client, tag, instanceId, targetStage, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    await reload(client, instanceId, tag);
     const result = await setStage({
       client,
       instanceId,
       targetStage,
       ...reason !== void 0 ? { reason } : {},
-      options: { ...actor !== void 0 ? { actor } : {}, clock }
+      options: { ...actor !== void 0 ? { actor } : {}, clock, clientForGdr }
     }), cascaded = result.fired ? await cascade(client, instanceId, actor, clientForGdr, clock) : 0;
     return {
-      instance: await reload(client, instanceId, tags),
+      instance: await reload(client, instanceId, tag),
       cascaded,
       fired: result.fired
     };
   },
   /**
    * Admin override — hard-stop an in-flight instance where it stands.
-   * No stage move, no transition effects, pending effects cancelled; see
-   * the engine-level {@link engineAbortInstance} for the full contract.
-   * Ancestors are propagated (not cascaded — the instance is terminal)
-   * so a parent gate waiting on this child re-evaluates.
+   * No stage move, no transition effects, pending effects cancelled;
+   * see {@link abortAndPropagate} for the abort + ancestor-propagation
+   * contract (propagated, not cascaded — the instance is terminal).
    */
   abortInstance: async (args) => {
-    const { client, tags, instanceId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
-    await reload(client, instanceId, tags);
-    const result = await abortInstance({
-      client,
-      instanceId,
-      ...reason !== void 0 ? { reason } : {},
-      options: { ...actor !== void 0 ? { actor } : {}, clock }
-    });
-    return result.fired && await propagateToAncestors(client, instanceId, actor, clientForGdr, clock), {
-      instance: await reload(client, instanceId, tags),
+    const { client, tag, instanceId, reason } = args, { actor, clientForGdr } = await resolveOperationContext(args), clock = args.clock ?? wallClock;
+    await reload(client, instanceId, tag);
+    const fired = await abortAndPropagate({ client, instanceId, reason, actor, clientForGdr, clock });
+    return {
+      instance: await reload(client, instanceId, tag),
       cascaded: 0,
-      fired: result.fired
+      fired
     };
   },
   /**
-   * Fetch a workflow instance by id, scoped to the engine's tags.
+   * Fetch a workflow instance by id, scoped to the engine's tag.
    * Throws when the instance doesn't exist or isn't visible to this
    * engine.
    */
   getInstance: async (args) => {
-    const { client, tags, instanceId } = args;
-    return validateTags(tags), reload(client, instanceId, tags);
+    const { client, tag, instanceId } = args;
+    return validateTag(tag), reload(client, instanceId, tag);
   },
   guardsForInstance: async (args) => {
-    const { client, tags, instanceId, resourceClients } = args;
-    validateTags(tags);
-    const instance = await reload(client, instanceId, tags);
+    const { client, tag, instanceId, resourceClients } = args;
+    validateTag(tag);
+    const instance = await reload(client, instanceId, tag);
     return guardsForInstance({
       client,
       clientForGdr: buildClientForGdr(client, resourceClients),
@@ -3113,9 +3285,9 @@ const workflow = {
     });
   },
   guardsForDefinition: async (args) => {
-    const { client, tags, workflowResource, definition, resourceClients } = args;
-    validateTags(tags);
-    const definitions = await loadDefinitionVersions(client, definition, tags);
+    const { client, tag, workflowResource, definition, resourceClients } = args;
+    validateTag(tag);
+    const definitions = await loadDefinitionVersions(client, definition, tag);
     if (definitions.length === 0)
       throw new Error(`No deployed definition for workflow ${definition}`);
     return guardsForDefinition({
@@ -3127,22 +3299,21 @@ const workflow = {
     });
   },
   /**
-   * Run a caller-supplied GROQ query with the engine's tags bound as
-   * `$engineTags`. This does NOT rewrite the query — arbitrary GROQ
+   * Run a caller-supplied GROQ query with the engine's tag bound as
+   * `$tag`. This does NOT rewrite the query — arbitrary GROQ
    * can't be safely tag-scoped after the fact — so the CALLER MUST
-   * filter on `$engineTags` (e.g.
-   * `count(tags[@ in $engineTags]) > 0`). To guard against accidental
-   * cross-tenant reads, a query that never references `$engineTags` is
+   * filter on `$tag` (e.g. `tag == $tag`). To guard against accidental
+   * cross-partition reads, a query that never references `$tag` is
    * rejected before it reaches the lake. Caller is responsible for type
    * narrowing the result.
    */
   query: async (args) => {
-    const { client, tags, groq, params } = args;
-    if (validateTags(tags), !groq.includes("$engineTags"))
+    const { client, tag, groq, params } = args;
+    if (validateTag(tag), !/\$tag\b/.test(groq))
       throw new Error(
-        `workflow.query: query must filter on $engineTags to stay tag-scoped (e.g. "count(tags[@ in $engineTags]) > 0"); got: ${groq}`
+        `workflow.query: query must filter on $tag to stay tag-scoped (e.g. "tag == $tag"); got: ${groq}`
       );
-    return client.fetch(groq, { ...params, engineTags: tags });
+    return client.fetch(groq, { ...params, tag });
   },
   /**
    * Snapshot-aware GROQ — runs against the same in-memory view that
@@ -3161,9 +3332,9 @@ const workflow = {
    * without re-implementing hydration. Pure read — never writes.
    */
   queryInScope: async (args) => {
-    const { client, tags, instanceId, groq, params, resourceClients } = args, clock = args.clock ?? wallClock;
-    validateTags(tags);
-    const instance = await reload(client, instanceId, tags), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams({ instance, now: clock(), snapshot }), tree = parse(groq, { params: { ...reserved, ...params } });
+    const { client, tag, instanceId, groq, params, resourceClients } = args, clock = args.clock ?? wallClock;
+    validateTag(tag);
+    const instance = await reload(client, instanceId, tag), clientForGdr = buildClientForGdr(client, resourceClients), snapshot = await hydrateSnapshot({ client, clientForGdr, instance }), reserved = buildParams({ instance, now: clock(), snapshot }), tree = parse(groq, { params: { ...reserved, ...params } });
     return await (await evaluate(tree, {
       dataset: snapshot.docs,
       params: { ...reserved, ...params }
@@ -3173,13 +3344,13 @@ const workflow = {
    * List every pending effect on the instance. Returns the same entries
    * the runtime would see — claimed and unclaimed alike.
    */
-  listPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tags)).pendingEffects,
+  listPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tag)).pendingEffects,
   /**
    * Filter pending effects on the instance by criteria. `claimed`
    * filters on claim presence; `names` restricts to specific effect
    * names. Both filters compose (AND).
    */
-  findPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tags)).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.name))),
+  findPendingEffects: async (args) => (await reload(args.client, args.instanceId, args.tag)).pendingEffects.filter((e) => !(args.claimed === !0 && e.claim === void 0 || args.claimed === !1 && e.claim !== void 0 || args.names !== void 0 && !args.names.includes(e.name))),
   /**
    * Project the instance from a given actor's perspective. Returns a
    * `WorkflowEvaluation` with per-action verdicts (`allowed` + a
@@ -3189,6 +3360,30 @@ const workflow = {
    * `fireAction` to gate writes via the same logic.
    */
   evaluate: async (args) => evaluateInstance(args),
+  /**
+   * Diagnose why an instance is or isn't progressing. Projects the
+   * instance (the same read as `evaluate`) and classifies it — terminal,
+   * `progressing`, `waiting` (an action is available — healthy), or `stuck`
+   * with a structured cause — returning that verdict as a
+   * {@link DiagnoseResult} alongside the evaluation it came from, so a
+   * consumer can render the supporting evidence without a second projection.
+   * Pure read.
+   */
+  diagnose: async (args) => {
+    const evaluation = await evaluateInstance(args);
+    return { evaluation, diagnosis: diagnoseInstance(diagnoseInputFromEvaluation(evaluation)) };
+  },
+  /**
+   * List the actions an actor could fire on an instance's current stage,
+   * each flagged `allowed` (with a structured `disabledReason` when not).
+   * Projects the instance from the actor's perspective and flattens its
+   * tasks' actions. Returns the evaluation alongside the actions so a
+   * consumer can read the instance/stage context. Pure read.
+   */
+  availableActions: async (args) => {
+    const evaluation = await evaluateInstance(args);
+    return { evaluation, actions: availableActions(evaluation.currentStage.tasks) };
+  },
   /**
    * Materialised spawned children of a parent instance.
    *
@@ -3196,18 +3391,18 @@ const workflow = {
    * record. (The per-task `spawnedInstances` field on the active stage
    * only exists while that stage is current; history survives.) Strips
    * the GDR URI on each `instanceRef` to a bare `_id`, fetches the
-   * instances, drops any that aren't visible to this engine's tags, and
+   * instances, drops any that aren't visible to this engine's tag, and
    * returns them sorted by `startedAt` ascending.
    *
    * Pass `task` to restrict to a single spawning task on the parent.
    */
   children: async (args) => {
-    const { client, tags, instanceId, task } = args;
-    validateTags(tags);
-    const parent = await reload(client, instanceId, tags), isSpawned = (h) => h._type === "spawned", ids = parent.history.filter(isSpawned).filter((h) => task === void 0 || h.task === task).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
+    const { client, tag, instanceId, task } = args;
+    validateTag(tag);
+    const parent = await reload(client, instanceId, tag), isSpawned = (h) => h._type === "spawned", ids = parent.history.filter(isSpawned).filter((h) => task === void 0 || h.task === task).flatMap((h) => bareIdFromSpawnRef(h.instanceRef.id));
     return ids.length === 0 ? [] : client.fetch(
       `*[_id in $ids && ${tagScopeFilter()}] | order(startedAt asc)`,
-      { ids, engineTags: tags }
+      { ids, tag }
     );
   },
   /**
@@ -3222,11 +3417,11 @@ const workflow = {
   }
 };
 async function verifyDeployedDefinitionsInternal(args) {
-  const { client, tags, effectHandlers, missingHandler, logger } = args;
-  validateTags(tags);
+  const { client, tag, effectHandlers, missingHandler, logger } = args;
+  validateTag(tag);
   const log = logger("verifyDeployedDefinitions"), definitions = await client.fetch(
     `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}] | order(name asc, version asc)`,
-    { engineTags: tags }
+    { tag }
   ), seen = [], missingByName = /* @__PURE__ */ new Map();
   for (const def of definitions)
     seen.push({ name: def.name, version: def.version, _id: def._id }), walkEffectNames(def, (name, location) => {
@@ -3275,7 +3470,7 @@ function walkEffectNames(def, visit) {
 async function drainEffectsInternal(args) {
   const {
     client,
-    tags,
+    tag,
     workflowResource,
     resourceClients,
     instanceId,
@@ -3286,10 +3481,10 @@ async function drainEffectsInternal(args) {
     actor: drainerActor,
     ...args.access?.grants !== void 0 ? { grants: args.access.grants } : {}
   };
-  validateTags(tags);
+  validateTag(tag);
   const log = logger("drainEffects"), drained = [], failed = [], skipped = [], skippedKeys = /* @__PURE__ */ new Set();
   for (; ; ) {
-    const before = await reload(client, instanceId, tags), candidate = before.pendingEffects.find(
+    const before = await reload(client, instanceId, tag), candidate = before.pendingEffects.find(
       (e) => e.claim === void 0 && !skippedKeys.has(e._key)
     );
     if (candidate === void 0) break;
@@ -3306,7 +3501,7 @@ async function drainEffectsInternal(args) {
     });
     await reportEffectOutcome({
       client,
-      tags,
+      tag,
       workflowResource,
       ...resourceClients !== void 0 ? { resourceClients } : {},
       instanceId,
@@ -3376,7 +3571,7 @@ async function applyMissingHandler(policy, info, log) {
   }
 }
 function createInstanceSession(args) {
-  const { client, tags, clock } = args, clientForGdr = buildClientForGdr(client, args.resourceClients);
+  const { client, tag, clock } = args, clientForGdr = buildClientForGdr(client, args.resourceClients);
   let instance = asHeldInstance(args.instance), overlay = /* @__PURE__ */ new Map(), heldGuards = [], committing = !1, buffered;
   const selfUri = () => gdrFromResource(instance.workflowResource, instance._id), applyUpdate = (docs) => {
     const next = /* @__PURE__ */ new Map();
@@ -3437,7 +3632,7 @@ function createInstanceSession(args) {
       return commit(async (actor, held) => {
         await assertInstanceWriteAllowed({ instance, guards: heldGuards, identity: actor.id });
         const cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
-        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: cascaded > 0 };
+        return instance = await reload(client, instance._id, tag), { instance, cascaded, fired: cascaded > 0 };
       });
     },
     fireAction({ task, action, params }) {
@@ -3449,11 +3644,12 @@ function createInstanceSession(args) {
           task,
           action,
           actor,
+          clientForGdr,
           ...grants !== void 0 ? { grants } : {},
           ...clock !== void 0 ? { clock } : {},
           ...params !== void 0 ? { params } : {}
         }), cascaded = await cascade(client, instance._id, actor, clientForGdr, clock, held);
-        return instance = await reload(client, instance._id, tags), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
+        return instance = await reload(client, instance._id, tag), { instance, cascaded, fired: !0, ...ranOps !== void 0 ? { ranOps } : {} };
       });
     }
   };
@@ -3481,11 +3677,11 @@ const defaultLoggerFactory = (name) => ({
   }
 };
 function createEngine(args) {
-  const { client, workflowResource, tags, resourceClients, clock } = args;
-  validateTags(tags);
+  const { client, workflowResource, resourceClients, clock, tag } = args;
+  validateTag(tag);
   const effectHandlers = args.effectHandlers ?? {}, missingHandler = args.missingHandler ?? "fail", logger = args.loggerFactory ?? defaultLoggerFactory, bind = (rest) => ({
     client,
-    tags,
+    tag,
     workflowResource,
     ...resourceClients !== void 0 ? { resourceClients } : {},
     ...clock !== void 0 ? { clock } : {},
@@ -3493,7 +3689,7 @@ function createEngine(args) {
   });
   return {
     client,
-    tags,
+    tag,
     workflowResource,
     effectHandlers,
     missingHandler,
@@ -3504,13 +3700,16 @@ function createEngine(args) {
     completeEffect: (rest) => workflow.completeEffect(bind(rest)),
     tick: (rest) => workflow.tick(bind(rest)),
     evaluateInstance: (rest) => evaluateInstance(bind(rest)),
+    diagnose: (rest) => workflow.diagnose(bind(rest)),
+    availableActions: (rest) => workflow.availableActions(bind(rest)),
     setStage: (rest) => workflow.setStage(bind(rest)),
     abortInstance: (rest) => workflow.abortInstance(bind(rest)),
-    getInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }),
-    subscriptionDocumentsForInstance: ({ instanceId }) => workflow.getInstance({ client, tags, workflowResource, instanceId }).then(subscriptionDocumentsForInstance),
+    deleteDefinition: (rest) => workflow.deleteDefinition(bind(rest)),
+    getInstance: ({ instanceId }) => workflow.getInstance({ client, tag, workflowResource, instanceId }),
+    subscriptionDocumentsForInstance: ({ instanceId }) => workflow.getInstance({ client, tag, workflowResource, instanceId }).then(subscriptionDocumentsForInstance),
     instance: (instanceDoc, opts) => createInstanceSession({
       client,
-      tags,
+      tag,
       instance: instanceDoc,
       ...resourceClients !== void 0 ? { resourceClients } : {},
       ...clock !== void 0 ? { clock } : {},
@@ -3519,45 +3718,45 @@ function createEngine(args) {
     }),
     guardsForInstance: ({ instanceId }) => workflow.guardsForInstance({
       client,
-      tags,
+      tag,
       workflowResource,
       instanceId,
       ...resourceClients !== void 0 ? { resourceClients } : {}
     }),
     guardsForDefinition: ({ definition }) => workflow.guardsForDefinition({
       client,
-      tags,
+      tag,
       workflowResource,
       definition,
       ...resourceClients !== void 0 ? { resourceClients } : {}
     }),
     children: ({ instanceId, task }) => workflow.children({
       client,
-      tags,
+      tag,
       workflowResource,
       instanceId,
       ...task !== void 0 ? { task } : {}
     }),
     query: ({ groq, params }) => workflow.query({
       client,
-      tags,
+      tag,
       workflowResource,
       groq,
       ...params !== void 0 ? { params } : {}
     }),
     queryInScope: ({ instanceId, groq, params }) => workflow.queryInScope({
       client,
-      tags,
+      tag,
       workflowResource,
       instanceId,
       groq,
       ...params !== void 0 ? { params } : {},
       ...clock !== void 0 ? { clock } : {}
     }),
-    listPendingEffects: ({ instanceId }) => workflow.listPendingEffects({ client, tags, workflowResource, instanceId }),
+    listPendingEffects: ({ instanceId }) => workflow.listPendingEffects({ client, tag, workflowResource, instanceId }),
     findPendingEffects: ({ instanceId, claimed, names }) => workflow.findPendingEffects({
       client,
-      tags,
+      tag,
       workflowResource,
       instanceId,
       ...claimed !== void 0 ? { claimed } : {},
@@ -3565,7 +3764,7 @@ function createEngine(args) {
     }),
     drainEffects: ({ instanceId, access }) => drainEffectsInternal({
       client,
-      tags,
+      tag,
       workflowResource,
       ...resourceClients !== void 0 ? { resourceClients } : {},
       instanceId,
@@ -3576,13 +3775,43 @@ function createEngine(args) {
     }),
     verifyDeployedDefinitions: () => verifyDeployedDefinitionsInternal({
       client,
-      tags,
+      tag,
       effectHandlers,
       missingHandler,
       logger
     })
   };
 }
+function docIdFor(def, target) {
+  return definitionDocId(target.workflowResource, target.tag, def.name, def.version);
+}
+function diffStatus(existing, expected) {
+  return existing === void 0 ? "create" : isDefinitionUnchanged(existing, expected) ? "unchanged" : "update";
+}
+function diffEntry(def, existingRaw, target) {
+  const docId = docIdFor(def, target), expected = {
+    ...def,
+    _id: docId,
+    _type: WORKFLOW_DEFINITION_TYPE,
+    tag: target.tag
+  }, status = diffStatus(existingRaw, expected), existing = existingRaw ? stripSystemFields(existingRaw) : void 0;
+  return {
+    name: def.name,
+    version: def.version,
+    status,
+    docId,
+    expected,
+    ...existing !== void 0 ? { existing } : {}
+  };
+}
+async function computeDiffEntries(client, defs, target) {
+  const entries = [];
+  for (const def of defs) {
+    const existingRaw = await client.getDocument(docIdFor(def, target)) ?? void 0;
+    entries.push(diffEntry(def, existingRaw, target));
+  }
+  return entries;
+}
 const HISTORY_DISPLAY = {
   stageEntered: {
     title: "Stage entered",
@@ -3776,15 +4005,22 @@ export {
   WORKFLOW_DEFINITION_TYPE,
   WORKFLOW_INSTANCE_TYPE,
   WorkflowStateDivergedError,
+  abortReason,
+  actionVerdict,
+  assigneesOf,
+  availableActions,
   buildSnapshot,
-  canonicalTag,
   compileGuard,
+  computeDiffEntries,
   contentReleaseName,
   createEngine,
   datasetResourceParts,
   defaultLoggerFactory,
   denyingGuards,
   deployStageGuards,
+  diagnoseInputFromEvaluation,
+  diagnoseInstance,
+  diffEntry,
   displayDescription,
   displayTitle,
   effectsContextMap,
@@ -3803,6 +4039,7 @@ export {
   isGdr,
   isTerminalStage,
   lakeGuardId,
+  openStage,
   parseGdr,
   readsRaw,
   refCanvas,
@@ -3818,7 +4055,7 @@ export {
   subscriptionDocumentsForInstance,
   tagScopeFilter,
   validateDefinition,
-  validateTags,
+  validateTag,
   verdictGuardsForInstance,
   wallClock,
   workflow