@sanity/workflow-engine 0.7.0 → 0.9.0

package/dist/_chunks-cjs/schema.cjs

@@ -16,6 +16,26 @@ function _interopNamespaceCompat(e) {
   }), n.default = e, Object.freeze(n);
 }
 var v__namespace = /* @__PURE__ */ _interopNamespaceCompat(v);
+function andConditions(parts) {
+  const present = parts.filter((p) => p !== void 0);
+  if (present.length !== 0)
+    return present.length === 1 ? present[0] : present.map((p) => `(${p})`).join(" && ");
+}
+function expandRequiredRoles(required, aliases) {
+  if (aliases === void 0) return [...required];
+  const out = /* @__PURE__ */ new Set();
+  for (const role of required) {
+    out.add(role);
+    for (const fulfiller of aliases[role] ?? []) out.add(fulfiller);
+  }
+  for (const fulfiller of aliases["*"] ?? []) out.add(fulfiller);
+  return [...out];
+}
+function actorFulfillsRole(actorRoles, required, aliases) {
+  if (actorRoles === void 0 || actorRoles.length === 0) return !1;
+  const accepted = new Set(expandRequiredRoles([required], aliases));
+  return actorRoles.some((role) => accepted.has(role));
+}
 const TASK_STATUSES = ["pending", "active", "done", "skipped", "failed"], TERMINAL_TASK_STATUSES = ["done", "skipped", "failed"];
 function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUSES.includes(status);
@@ -159,18 +179,32 @@ const StoredOpSchema = v__namespace.variant("type", [
   // The WHO-FOR entry: the inbox reverse-query reads it by kind, and the
   // rendered `$assigned` gate matches the caller against it.
   "assignees"
-]), StateEntryName = groqIdentifier("`$state.<name>`"), StateEntrySchema = v__namespace.strictObject({
-  type: StateKindSchema,
-  name: StateEntryName,
-  title: v__namespace.optional(v__namespace.string()),
-  description: v__namespace.optional(v__namespace.string()),
-  source: SourceSchema
-}), ClaimStateSchema = v__namespace.strictObject({
+]), StateEntryName = groqIdentifier("`$state.<name>`"), StoredEditableSchema = v__namespace.union([v__namespace.literal(!0), NonEmpty]), AuthoringEditableSchema = v__namespace.union([v__namespace.literal(!0), v__namespace.array(NonEmpty), NonEmpty]);
+function stateEntryFields(editable) {
+  return {
+    type: StateKindSchema,
+    name: StateEntryName,
+    title: v__namespace.optional(v__namespace.string()),
+    description: v__namespace.optional(v__namespace.string()),
+    /**
+     * When true, the caller MUST supply this entry at start (via
+     * `initialState`) or spawn (via the parent's `subworkflows.with`). A
+     * missing required entry throws rather than silently defaulting to
+     * `null`/`[]` — the same fail-fast an action's `required` param gets.
+     * Valid only on a workflow-scope `init`-sourced entry (deploy invariant).
+     */
+    required: v__namespace.optional(v__namespace.boolean()),
+    source: SourceSchema,
+    /** Who-may-edit this slot via the edit seam — see {@link StoredEditableSchema}. */
+    editable: v__namespace.optional(editable)
+  };
+}
+const StateEntrySchema = v__namespace.strictObject(stateEntryFields(StoredEditableSchema)), RawAuthoringStateEntrySchema = v__namespace.strictObject(stateEntryFields(AuthoringEditableSchema)), ClaimStateSchema = v__namespace.strictObject({
   type: v__namespace.literal("claim"),
   name: StateEntryName,
   title: v__namespace.optional(v__namespace.string()),
   description: v__namespace.optional(v__namespace.string())
-}), AuthoringStateEntrySchema = v__namespace.union([StateEntrySchema, ClaimStateSchema]), ConditionSchema = NonEmpty, EffectSchema = v__namespace.strictObject({
+}), AuthoringStateEntrySchema = v__namespace.union([RawAuthoringStateEntrySchema, ClaimStateSchema]), ConditionSchema = NonEmpty, EffectSchema = v__namespace.strictObject({
   name: NonEmpty,
   title: v__namespace.optional(v__namespace.string()),
   description: v__namespace.optional(v__namespace.string()),
@@ -335,7 +369,7 @@ const StoredTransitionSchema = v__namespace.strictObject(
    */
   metadata: v__namespace.optional(v__namespace.record(NonEmpty, NonEmpty))
 });
-function stageFields(state, task, transition) {
+function stageFields(state, task, transition, editable) {
   return {
     name: NonEmpty,
     title: v__namespace.optional(v__namespace.string()),
@@ -348,20 +382,46 @@ function stageFields(state, task, transition) {
      */
     guards: v__namespace.optional(v__namespace.array(GuardSchema)),
     /** Stage-scoped state entries. Resolved at stage entry. */
-    state: v__namespace.optional(v__namespace.array(state))
+    state: v__namespace.optional(v__namespace.array(state)),
+    /**
+     * Tighten-only editability overrides for the time this stage holds, keyed
+     * by an in-scope slot name. The slot's own `editable` is the ceiling; a
+     * stage value is ANDed with it at runtime, so an override can only NARROW
+     * (never open a slot the baseline left closed). An unlisted slot inherits
+     * its baseline.
+     */
+    editable: v__namespace.optional(v__namespace.record(StateEntryName, editable))
   };
 }
 const StoredStageSchema = v__namespace.strictObject(
-  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema)
+  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema, StoredEditableSchema)
 ), AuthoringStageSchema = v__namespace.strictObject(
-  stageFields(AuthoringStateEntrySchema, AuthoringTaskSchema, AuthoringTransitionSchema)
-);
+  stageFields(
+    AuthoringStateEntrySchema,
+    AuthoringTaskSchema,
+    AuthoringTransitionSchema,
+    AuthoringEditableSchema
+  )
+), RoleAliasesSchema = v__namespace.record(
+  NonEmpty,
+  v__namespace.pipe(v__namespace.array(NonEmpty), v__namespace.minLength(1, "a role alias must list at least one fulfilling role"))
+), WORKFLOW_ROLES = ["workflow", "child"];
 function workflowFields(state, stage) {
   return {
     name: NonEmpty,
     version: PositiveInt,
     title: NonEmpty,
     description: v__namespace.optional(v__namespace.string()),
+    /**
+     * Whether a human may start this workflow standalone. `'child'` marks a
+     * spawn-only definition — instantiated by a parent via `task.subworkflows`,
+     * never started cold from a picker. Omitted ⇒ `'workflow'` (startable).
+     * Advisory: consumers filter their start pickers on it (see
+     * {@link isStartableDefinition}); the engine does NOT refuse a
+     * `startInstance` on a `'child'` def — load-bearing `required` state is the
+     * runtime backstop.
+     */
+    role: v__namespace.optional(picklist(WORKFLOW_ROLES)),
     /** Reference field: named for the target, holds the stage's `name`. */
     initialStage: NonEmpty,
     /** Workflow-scope state entries. Persist for the instance lifetime. */
@@ -372,13 +432,18 @@ function workflowFields(state, stage) {
      * and bound as the boolean `$name` var, composable with native GROQ.
      * Redefining a built-in var is a deploy error (never silently shadow).
      */
-    predicates: v__namespace.optional(v__namespace.record(groqIdentifier("`$<name>`"), ConditionSchema))
+    predicates: v__namespace.optional(v__namespace.record(groqIdentifier("`$<name>`"), ConditionSchema)),
+    /** Role aliasing for this definition — see {@link RoleAliasesSchema}. */
+    roleAliases: v__namespace.optional(RoleAliasesSchema)
   };
 }
 v__namespace.strictObject(workflowFields(StateEntrySchema, StoredStageSchema));
 const AuthoringWorkflowSchema = v__namespace.strictObject(
   workflowFields(AuthoringStateEntrySchema, AuthoringStageSchema)
 ), WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
+function isStartableDefinition(definition) {
+  return definition.role !== "child";
+}
 function formatValidationError(label, issues) {
   const lines = issues.map((issue) => `  - ${issue.path.length === 0 ? "(root)" : formatPath(issue.path)}: ${issue.message}`);
   return `${label} failed validation (${issues.length} issue${issues.length === 1 ? "" : "s"}):
@@ -409,7 +474,11 @@ exports.EffectSchema = EffectSchema;
 exports.GROQ_IDENTIFIER = GROQ_IDENTIFIER;
 exports.GuardSchema = GuardSchema;
 exports.WORKFLOW_DEFINITION_TYPE = WORKFLOW_DEFINITION_TYPE;
+exports.actorFulfillsRole = actorFulfillsRole;
+exports.andConditions = andConditions;
+exports.expandRequiredRoles = expandRequiredRoles;
 exports.formatValidationError = formatValidationError;
+exports.isStartableDefinition = isStartableDefinition;
 exports.isTerminalTaskStatus = isTerminalTaskStatus;
 exports.issuesFromValibot = issuesFromValibot;
 //# sourceMappingURL=schema.cjs.map

package/dist/_chunks-cjs/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.cjs","sources":["../../src/types/enums.ts","../../src/define/schema.ts"],"sourcesContent":["/**\n * Leaf enums — the const arrays (and their derived union types) that both\n * the authoring schema and the engine address by name.\n *\n * This module imports nothing. It is the schema-free foundation that\n * `../define/schema.ts` reads its value constants from, which is what keeps\n * the type model and the valibot schema free of an import cycle: the value edge\n * `schema.ts → enums.ts` terminates here.\n */\n\n// Task status — used by instance state. The authored action `status:` sugar\n// (and the `status.set` op it desugars to) is constrained to the terminal\n// subset below.\nexport const TASK_STATUSES = ['pending', 'active', 'done', 'skipped', 'failed'] as const\nexport type TaskStatus = (typeof TASK_STATUSES)[number]\n\n// The statuses a task can be resolved INTO — what `status.set` accepts and\n// what stops blocking the `$allTasksDone` gate family.\nexport const TERMINAL_TASK_STATUSES = ['done', 'skipped', 'failed'] as const\nexport type TerminalTaskStatus = (typeof TERMINAL_TASK_STATUSES)[number]\n\nexport function isTerminalTaskStatus(status: TaskStatus): status is TerminalTaskStatus {\n  return (TERMINAL_TASK_STATUSES as readonly TaskStatus[]).includes(status)\n}\n\n// The three state scopes a state entry can live in. Authoring (`ScopeKey`,\n// `stateRead` sources) and the engine both address state entries by scope.\nexport const STATE_SCOPES = ['workflow', 'stage', 'task'] as const\nexport type StateScope = (typeof STATE_SCOPES)[number]\n\n// Document-value permissions. Grants (`Grant` in ./authorization.ts) compose\n// most-permissive-wins.\nexport const DOCUMENT_VALUE_PERMISSIONS = ['create', 'read', 'update'] as const\nexport type DocumentValuePermission = (typeof DOCUMENT_VALUE_PERMISSIONS)[number]\n\n// Mutation-guard actions — the lake operations a guard can gate. See the\n// guard types in ./authorization.ts.\nexport const MUTATION_GUARD_ACTIONS = [\n  'create',\n  'update',\n  'delete',\n  'publish',\n  'unpublish',\n] as const\nexport type MutationGuardAction = (typeof MUTATION_GUARD_ACTIONS)[number]\n","/**\n * Valibot schemas for the workflow authoring surface — the things a workflow\n * author writes by hand and feeds to `defineWorkflow`. Types in this\n * file are the **canonical** authoring types: they are inferred from\n * the schemas, so the runtime schema and the compile-time type cannot\n * drift.\n *\n * Two layers live here, mirroring the design model (generic stored data,\n * sugar that compiles away):\n *\n *   - **Stored** schemas (`WorkflowDefinitionSchema`, `OpSchema`, …) describe\n *     the primitives the engine persists. No sugar variants, every state\n *     reference carries an explicit resolved `scope`.\n *   - **Authoring** schemas (`AuthoringWorkflowSchema`, …) accept the same\n *     primitives **plus** define-time sugar: the `claim` state/action pair,\n *     the `audit` op, the `roles` and `status` action fields, omitted\n *     transition filters, omitted reference scopes. `desugar.ts` expands\n *     authoring input into the stored shape.\n *\n * Strictness: every object schema is `v.strictObject` so unknown keys\n * produce a parse error. That catches typos like `verison: 1` at deploy\n * time — and it is also what enforces each sugar contract's *reserved*\n * fields (an `ops:` on a `claim` action is an unknown key, fail loud).\n */\n\nimport * as v from 'valibot'\n\nimport {\n  MUTATION_GUARD_ACTIONS,\n  STATE_SCOPES,\n  TASK_STATUSES,\n  TERMINAL_TASK_STATUSES,\n} from '../types/enums.ts'\n\nconst NonEmpty = v.pipe(v.string(), v.minLength(1, 'must be a non-empty string'))\n\nconst PositiveInt = v.pipe(v.number(), v.integer(), v.minValue(1))\n\n/**\n * Names that get spliced into GROQ — state entries (`$state.<name>` in the\n * claim no-steal filter and every condition) and predicate keys (`$<name>`).\n * A name like `review-owner` would parse as subtraction inside GROQ and\n * silently change the expression's meaning, so these are constrained to\n * GROQ-identifier-safe names. See {@link GROQ_IDENTIFIER}.\n */\nexport const GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/\n\nfunction groqIdentifier(referencedAs: string) {\n  return v.pipe(\n    v.string(),\n    v.regex(\n      GROQ_IDENTIFIER,\n      `must be a GROQ-safe identifier (letters, digits, underscore; not starting with a digit) ` +\n        `because it is referenced as ${referencedAs} in GROQ conditions`,\n    ),\n  )\n}\n\n/**\n * Picklist with a zod-compatible \"Invalid option\" message that lists every\n * allowed value, so a typo'd discriminator or enum lands with a message an\n * author can act on (e.g. `Invalid option: expected one of \"done\"|\"skipped\"`).\n */\nfunction picklist<const TOptions extends readonly [string, ...string[]]>(options: TOptions) {\n  return v.picklist(\n    options,\n    `Invalid option: expected one of ${options.map((o) => `\"${o}\"`).join('|')}`,\n  )\n}\n\n// Source — the single \"where a value comes from\" union, shared by state-entry\n// origins and op payloads. Conditions and effect bindings are NOT Sources —\n// they are GROQ strings over the rendered scope ($state, $actor, $row, …).\n// Each value variant has a rendered $-twin (actor ↔ $actor, now ↔ $now) so\n// learning one side teaches the other.\n\ntype SourceInternal =\n  | {type: 'init'}\n  | {type: 'write'}\n  | {type: 'query'; query: string}\n  | {type: 'literal'; value: unknown}\n  | {type: 'param'; param: string}\n  | {type: 'actor'}\n  | {type: 'now'}\n  | {type: 'self'}\n  | {type: 'stage'}\n  | {\n      type: 'stateRead'\n      scope?: 'workflow' | 'stage' | undefined\n      state: string\n      path?: string | undefined\n    }\n  | {type: 'object'; fields: Record<string, SourceInternal>}\n\nconst SourceSchema: v.GenericSchema<SourceInternal> = v.lazy(() =>\n  v.union([\n    // State-entry origins: who fills the entry, and when.\n    v.strictObject({type: v.literal('init')}),\n    v.strictObject({type: v.literal('write')}),\n    v.strictObject({\n      type: v.literal('query'),\n      query: NonEmpty,\n    }),\n    // Value sources: resolved to concrete JSON when an op or seed applies.\n    v.strictObject({type: v.literal('literal'), value: v.unknown()}),\n    v.strictObject({type: v.literal('param'), param: NonEmpty}),\n    v.strictObject({type: v.literal('actor')}),\n    v.strictObject({type: v.literal('now')}),\n    v.strictObject({type: v.literal('self')}),\n    v.strictObject({type: v.literal('stage')}),\n    v.strictObject({\n      type: v.literal('stateRead'),\n      scope: v.optional(v.union([v.literal('workflow'), v.literal('stage')])),\n      state: NonEmpty,\n      path: v.optional(v.string()),\n    }),\n    v.strictObject({\n      type: v.literal('object'),\n      fields: v.record(NonEmpty, SourceSchema),\n    }),\n  ]),\n)\nexport type Source = SourceInternal\n\n// State references — `{ scope?, state }` addressing a state entry by name.\n// Authoring may omit `scope`; desugar resolves it lexically (task → stage →\n// workflow), so the STORED form always carries an explicit scope.\n\nconst StoredStateRefSchema = v.strictObject({\n  scope: picklist(STATE_SCOPES),\n  state: NonEmpty,\n})\nexport type StoredStateRef = v.InferOutput<typeof StoredStateRefSchema>\n\nconst AuthoringStateRefSchema = v.strictObject({\n  scope: v.optional(picklist(STATE_SCOPES)),\n  state: NonEmpty,\n})\nexport type AuthoringStateRef = v.InferOutput<typeof AuthoringStateRefSchema>\n\n// Op predicates — small typed predicate for state.updateWhere /\n// state.removeWhere. Runs in the pure in-memory op path, so it stays a\n// typed structure rather than GROQ. Discriminated by `type` like every union.\n\ntype OpPredicateInternal =\n  | {type: 'field'; field: string; equals: Source}\n  | {type: 'all'; of: OpPredicateInternal[]}\n  | {type: 'any'; of: OpPredicateInternal[]}\n\nconst OpPredicateSchema: v.GenericSchema<OpPredicateInternal> = v.lazy(() =>\n  v.union([\n    v.strictObject({\n      type: v.literal('field'),\n      field: NonEmpty,\n      equals: SourceSchema,\n    }),\n    v.strictObject({type: v.literal('all'), of: v.array(OpPredicateSchema)}),\n    v.strictObject({type: v.literal('any'), of: v.array(OpPredicateSchema)}),\n  ]),\n)\nexport type OpPredicate = OpPredicateInternal\n\n// Ops — the six stored mutation primitives. `value` is the one payload key.\n// `status.set` may name a sibling task; desugar fills the firing task when\n// authoring omitted it, so the stored op always carries `task`.\n\nfunction opSchemas<T extends v.GenericSchema>(targetSchema: T) {\n  return [\n    v.strictObject({\n      type: v.literal('state.set'),\n      target: targetSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.unset'),\n      target: targetSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.append'),\n      target: targetSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.updateWhere'),\n      target: targetSchema,\n      where: OpPredicateSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.removeWhere'),\n      target: targetSchema,\n      where: OpPredicateSchema,\n    }),\n  ] as const\n}\n\nconst StoredOpSchema = v.variant('type', [\n  ...opSchemas(StoredStateRefSchema),\n  v.strictObject({\n    type: v.literal('status.set'),\n    task: NonEmpty,\n    status: picklist(TASK_STATUSES),\n  }),\n])\nexport type Op = v.InferOutput<typeof StoredOpSchema>\n\n/**\n * The `state.*` subset a transition may carry — `status.set` has no coherent\n * task target while the stage's tasks tear down, so the engine rejects it\n * at parse time rather than dropping it silently.\n */\nconst StoredTransitionOpSchema = v.variant('type', [...opSchemas(StoredStateRefSchema)])\nexport type TransitionOp = v.InferOutput<typeof StoredTransitionOpSchema>\n\n// Authoring ops: scope optional on targets, `task` optional on status.set\n// (defaults to the firing task), plus the `audit` sugar type — a stamped\n// append whose expansion merges `actor`/`at` Source fields into its own value.\n\nconst AuditOpSchema = v.strictObject({\n  type: v.literal('audit'),\n  target: AuthoringStateRefSchema,\n  value: SourceSchema,\n  stampFields: v.optional(\n    v.strictObject({\n      actor: v.optional(NonEmpty),\n      at: v.optional(NonEmpty),\n    }),\n  ),\n})\n\nexport const AuthoringOpSchema = v.variant('type', [\n  ...opSchemas(AuthoringStateRefSchema),\n  v.strictObject({\n    type: v.literal('status.set'),\n    task: v.optional(NonEmpty),\n    status: picklist(TASK_STATUSES),\n  }),\n  AuditOpSchema,\n])\nexport type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>\n\n// State entries — the generic stored data. Kinds are bare: a discriminator is\n// unique within its union; namespaces live only on engine-owned lake document\n// `_type`s ({@link WORKFLOW_DEFINITION_TYPE}, the instance type).\n\nconst StateKindSchema = picklist([\n  'doc.ref',\n  'doc.refs',\n  // Release reference. A workflow declares this entry to say \"I target a\n  // Content Release\"; the runtime fills it at start time and auto-derives\n  // the instance's read perspective from it.\n  'release.ref',\n  'query',\n  'value.string',\n  'value.url',\n  'value.number',\n  'value.boolean',\n  'value.dateTime',\n  'value.actor',\n  'checklist',\n  'notes',\n  // The WHO-FOR entry: the inbox reverse-query reads it by kind, and the\n  // rendered `$assigned` gate matches the caller against it.\n  'assignees',\n])\n\nconst StateEntryName = groqIdentifier('`$state.<name>`')\n\nconst StateEntrySchema = v.strictObject({\n  type: StateKindSchema,\n  name: StateEntryName,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  source: SourceSchema,\n})\nexport type StateEntry = v.InferOutput<typeof StateEntrySchema>\n\n/**\n * Authoring state accepts the raw entries plus the `claim` sugar type — the\n * state half of the mirrored claim pair. Expansion: `value.actor` with an\n * implied `write` source, strictly within this entry.\n */\nconst ClaimStateSchema = v.strictObject({\n  type: v.literal('claim'),\n  name: StateEntryName,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n})\n\nexport const AuthoringStateEntrySchema = v.union([StateEntrySchema, ClaimStateSchema])\nexport type AuthoringStateEntry = v.InferOutput<typeof AuthoringStateEntrySchema>\n\n// Conditions are raw GROQ strings over the rendered scope — built-in vars\n// ($state, $actor, $assigned, $can, $row, $effects, $subworkflows, $tasks,\n// $now, $allTasksDone, $anyTaskFailed) plus the author's nullary predicates.\n// There is no {ref, args} wrapper; parameterized reuse is a define-time\n// TypeScript function (see the `groq` tag in ./groq.ts).\n\nconst ConditionSchema = NonEmpty\nexport type Condition = string\n\n// Effects — the registry model. `name` is the effect's only identity; the\n// host app registers a handler against it (1:1) and the stored definition\n// never references code. Names are unique per definition (invariant) so\n// `$effects.<name>` is unambiguous.\n\nexport const EffectSchema = v.strictObject({\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  /** GROQ reads over the rendered scope, resolved to concrete JSON at queue time. */\n  bindings: v.optional(v.record(v.string(), ConditionSchema)),\n  /** Static config, passed through to the handler verbatim. */\n  input: v.optional(v.record(v.string(), v.unknown())),\n})\nexport type Effect = v.InferOutput<typeof EffectSchema>\n\n// Actions\n\n/**\n * Caller-supplied params declared on an action. The engine validates\n * incoming `params` against this list before running ops or queuing\n * effects: missing required params → ActionParamsInvalidError, action\n * does not commit. Resolved values feed `Source.param` lookups.\n */\nconst ActionParamSchema = v.strictObject({\n  type: picklist([\n    'string',\n    'number',\n    'boolean',\n    'url',\n    'dateTime',\n    'actor',\n    'doc.ref',\n    'doc.refs',\n    'json',\n  ]),\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  required: v.optional(v.boolean()),\n})\nexport type ActionParam = v.InferOutput<typeof ActionParamSchema>\n\n/** Fields shared by the stored and authoring action shapes, parameterised\n *  over the op schema (stored ops are fully resolved; authoring ops keep\n *  their sugar). */\nfunction actionFields<TOp extends v.GenericSchema>(op: TOp) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    /**\n     * The one gate mechanism: a condition over the rendered scope. Hard\n     * enforcement lives outside the engine entirely (the lake ACL on the\n     * documents, and guards) — every engine-evaluated gate is authoring/UX.\n     */\n    filter: v.optional(ConditionSchema),\n    params: v.optional(v.array(ActionParamSchema)),\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n  }\n}\n\nconst StoredActionSchema = v.strictObject(actionFields(StoredOpSchema))\nexport type Action = v.InferOutput<typeof StoredActionSchema>\n\nconst TerminalTaskStatus = picklist(TERMINAL_TASK_STATUSES)\n\n/**\n * Authoring action — the stored fields plus two field sugars with one\n * defined expansion each:\n *\n *   - `roles` → a `count($actor.roles[@ in [...]]) > 0` membership condition\n *     ANDed with the authored `filter`.\n *   - `status` → a `status.set` op on the firing task, appended **after**\n *     the authored ops (deliberately never implied: a forgotten explicit\n *     `status` is a visible stall, an implied default silently completes\n *     claim-like actions).\n */\nconst RawAuthoringActionSchema = v.strictObject({\n  ...actionFields(AuthoringOpSchema),\n  roles: v.optional(v.array(NonEmpty)),\n  status: v.optional(TerminalTaskStatus),\n})\n\n/**\n * The action half of the mirrored claim pair. `state` references an\n * author-declared actor-valued entry (the pair's other half), resolved\n * lexically. Expansion, strictly within this action: a no-steal\n * `!defined($state.<state>)` filter ANDed with `roles`/`filter`, plus a\n * `state.set` ← actor op. `ops` and `status` are reserved (the expansion\n * owns them) — strictObject rejects them as unknown keys.\n */\nconst ClaimActionSchema = v.strictObject({\n  type: v.literal('claim'),\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  state: v.union([NonEmpty, AuthoringStateRefSchema]),\n  roles: v.optional(v.array(NonEmpty)),\n  filter: v.optional(ConditionSchema),\n  params: v.optional(v.array(ActionParamSchema)),\n  effects: v.optional(v.array(EffectSchema)),\n})\n\nexport const AuthoringActionSchema = v.union([RawAuthoringActionSchema, ClaimActionSchema])\nexport type AuthoringAction = v.InferOutput<typeof AuthoringActionSchema>\n\n// Subworkflows — declare `subworkflows`, read `$subworkflows`. The spawning\n// task resolves like any task: `completeWhen` / `failWhen` over the rendered\n// `$subworkflows`; no `completeWhen` means all subworkflows done.\n\n/**\n * Logical reference to a deployed workflow definition, by its `name` (the\n * stable contract — the tag can be renamed, workflows redeployed). The engine\n * resolves it at spawn time, ordering by `version desc` unless an explicit\n * `version` pins one.\n */\nconst DefinitionRefSchema = v.strictObject({\n  name: NonEmpty,\n  version: v.optional(v.union([PositiveInt, v.literal('latest')])),\n})\n\nconst SubworkflowsSchema = v.strictObject({\n  /** GROQ producing one row per subworkflow; each row binds as `$row`. */\n  forEach: NonEmpty,\n  definition: DefinitionRefSchema,\n  /** Initial state for each subworkflow — entry name → GROQ over `$row` + the parent scope. */\n  with: v.optional(v.record(NonEmpty, ConditionSchema)),\n  /**\n   * Extra values evaluated in the parent's rendered scope at spawn time and\n   * delivered into each subworkflow's `$effects` bag — the parent→child\n   * handoff, read exactly like an effect output.\n   */\n  context: v.optional(v.record(NonEmpty, ConditionSchema)),\n})\nexport type Subworkflows = v.InferOutput<typeof SubworkflowsSchema>\n\n// Tasks — tasks own the ENTER moment: `ops` + `effects` run at activation,\n// `filter` makes activation conditional on the stage's entry state, and\n// `activation` switches the stage-enter flip (default `manual`: a task never\n// activates silently; \"auto\" is the explicit opt-in). A task with no actions\n// and no `completeWhen` is a machine step — it runs its activation payload\n// and resolves `done` immediately, leaving an audit row.\n\nfunction taskFields<\n  TState extends v.GenericSchema,\n  TAction extends v.GenericSchema,\n  TOp extends v.GenericSchema,\n>(state: TState, action: TAction, op: TOp) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    activation: v.optional(picklist(['auto', 'manual'])),\n    filter: v.optional(ConditionSchema),\n    /**\n     * Readiness gates, by name — conditions over the rendered scope that must\n     * hold for the task to be *executable*, orthogonal to `filter`\n     * (visibility). An unmet requirement keeps the task visible but disables\n     * its actions with a `requirements-unmet` verdict naming the unmet keys;\n     * all must hold (any-of lives inside one condition). Advisory like every\n     * engine gate — the lake still enforces. Distinct from ACL (authorization)\n     * and guards (content-write locks).\n     */\n    requirements: v.optional(v.record(NonEmpty, ConditionSchema)),\n    /**\n     * Auto-completion condition — evaluated at activation and on every\n     * cascade; truthy flips the task to `done` with a system actor. On a\n     * spawning task it typically reads `$subworkflows`.\n     */\n    completeWhen: v.optional(ConditionSchema),\n    /**\n     * Auto-failure condition — symmetric to `completeWhen`, flips to\n     * `failed`. When both are truthy on the same evaluation, `failWhen`\n     * wins — failure is the more notable signal.\n     */\n    failWhen: v.optional(ConditionSchema),\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n    actions: v.optional(v.array(action)),\n    subworkflows: v.optional(SubworkflowsSchema),\n    /** Task-scoped state entries. Resolved at task activation time. */\n    state: v.optional(v.array(state)),\n  }\n}\n\nconst StoredTaskSchema = v.strictObject(\n  taskFields(StateEntrySchema, StoredActionSchema, StoredOpSchema),\n)\nexport type Task = v.InferOutput<typeof StoredTaskSchema>\n\nexport const AuthoringTaskSchema = v.strictObject(\n  taskFields(AuthoringStateEntrySchema, AuthoringActionSchema, AuthoringOpSchema),\n)\nexport type AuthoringTask = v.InferOutput<typeof AuthoringTaskSchema>\n\n// Transitions — purely a condition over the rendered scope. Selection rule:\n// every transition is evaluated on every commit and cascade; the first truthy\n// `filter` in declaration order fires. No action coupling: a routing\n// difference is written into state by the action and read by the filter.\n\nfunction transitionFields<TOp extends v.GenericSchema, TFilter extends v.GenericSchema>(\n  op: TOp,\n  filter: TFilter,\n) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    to: NonEmpty,\n    filter,\n    /** The `state.*` subset — state-write-on-move, the stage's EXIT/ARRIVAL payload. */\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n  }\n}\n\nconst StoredTransitionSchema = v.strictObject(\n  transitionFields(StoredTransitionOpSchema, ConditionSchema),\n)\nexport type Transition = v.InferOutput<typeof StoredTransitionSchema>\n\n/**\n * Authoring transitions may omit `filter`; desugar fills the safe,\n * overwhelmingly-common gate `\"$allTasksDone\"`. \"Fire unconditionally\"\n * stays spellable as an explicit `filter: \"true\"`.\n */\nconst AuthoringTransitionOpSchema = v.variant('type', [\n  ...opSchemas(AuthoringStateRefSchema),\n  AuditOpSchema,\n])\nexport const AuthoringTransitionSchema = v.strictObject(\n  transitionFields(AuthoringTransitionOpSchema, v.optional(ConditionSchema)),\n)\nexport type AuthoringTransition = v.InferOutput<typeof AuthoringTransitionSchema>\n\n// Guards — lake mutation guards. A FOREIGN CONTRACT mirrored 1:1: the\n// `temp.system.guard` doc's `match` / `predicate` / `metadata` fields are the\n// content lake's API, not engine surface, so authoring keeps the lake's\n// vocabulary verbatim. The engine adds exactly two things: `name` (authoring\n// identity — the lake `_id` derives from (instanceId, guard.name)) and\n// `$state`-read VALUES (`idRefs: [\"$state.subject\"]`, `metadata.outcome:\n// \"$state.outcome\"`), resolved at deploy into the bare values the contract\n// expects. Guards + the lake ACL are the only HARD gates in the system.\n\nconst GuardActionSchema = picklist(MUTATION_GUARD_ACTIONS)\nexport type GuardAction = v.InferOutput<typeof GuardActionSchema>\n\nconst GuardMatchSchema = v.strictObject({\n  /** Subject `_type`(s); empty matches any type. */\n  types: v.optional(v.array(NonEmpty)),\n  /** Target docs as `$state` reads (or `\"$self\"`), resolved at deploy to bare ids + the resource. */\n  idRefs: v.optional(v.array(NonEmpty)),\n  /** Glob id patterns (bare, resource-local). */\n  idPatterns: v.optional(v.array(NonEmpty)),\n  actions: v.pipe(\n    v.array(GuardActionSchema),\n    v.minLength(1, 'a guard must match at least one action'),\n  ),\n})\nexport type GuardMatch = v.InferOutput<typeof GuardMatchSchema>\n\nexport const GuardSchema = v.strictObject({\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  match: GuardMatchSchema,\n  /**\n   * Lake GROQ predicate — a distinct eval context reading\n   * `document.before`/`document.after`, `mutation`, `guard`, and\n   * `identity()`. Bare ids/fields only. Omitted or empty means\n   * UNCONDITIONAL DENY.\n   */\n  predicate: v.optional(v.string()),\n  /**\n   * Projected workflow state the predicate reads as `guard.metadata.*` —\n   * the only bridge from the lake eval context (which cannot see `$state`)\n   * to workflow state. Values are NOT GROQ: each is a deploy-time read in\n   * the guard mini-language — `\"$self\"`, `\"$now\"`, or\n   * `\"$state.<name>[.path]\"` — resolved into a bare value at deploy and\n   * re-synced by the post-state-op guard refresh.\n   */\n  metadata: v.optional(v.record(NonEmpty, NonEmpty)),\n})\nexport type Guard = v.InferOutput<typeof GuardSchema>\n\n// Stages — pure containers: name / state / guards / tasks / transitions, no\n// behaviour of their own. Tasks own enter, transitions own exit and arrival.\n// `initial` is whatever `initialStage` names; a stage with no transitions IS\n// terminal (structural, nothing to declare or mis-declare).\n\nfunction stageFields<\n  TState extends v.GenericSchema,\n  TTask extends v.GenericSchema,\n  TTransition extends v.GenericSchema,\n>(state: TState, task: TTask, transition: TTransition) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    tasks: v.optional(v.array(task)),\n    transitions: v.optional(v.array(transition)),\n    /**\n     * Lake mutation guards active while this stage holds. Each compiles to a\n     * `temp.system.guard` doc deployed on stage entry and retracted on exit.\n     */\n    guards: v.optional(v.array(GuardSchema)),\n    /** Stage-scoped state entries. Resolved at stage entry. */\n    state: v.optional(v.array(state)),\n  }\n}\n\nconst StoredStageSchema = v.strictObject(\n  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema),\n)\nexport type Stage = v.InferOutput<typeof StoredStageSchema>\n\nexport const AuthoringStageSchema = v.strictObject(\n  stageFields(AuthoringStateEntrySchema, AuthoringTaskSchema, AuthoringTransitionSchema),\n)\nexport type AuthoringStage = v.InferOutput<typeof AuthoringStageSchema>\n\n// Workflow definition (the root)\n\nfunction workflowFields<TState extends v.GenericSchema, TStage extends v.GenericSchema>(\n  state: TState,\n  stage: TStage,\n) {\n  return {\n    name: NonEmpty,\n    version: PositiveInt,\n    title: NonEmpty,\n    description: v.optional(v.string()),\n    /** Reference field: named for the target, holds the stage's `name`. */\n    initialStage: NonEmpty,\n    /** Workflow-scope state entries. Persist for the instance lifetime. */\n    state: v.optional(v.array(state)),\n    stages: v.pipe(v.array(stage), v.minLength(1, 'must declare at least one stage')),\n    /**\n     * Nullary named conditions — each `name: groq` entry is pre-evaluated\n     * and bound as the boolean `$name` var, composable with native GROQ.\n     * Redefining a built-in var is a deploy error (never silently shadow).\n     */\n    predicates: v.optional(v.record(groqIdentifier('`$<name>`'), ConditionSchema)),\n  }\n}\n\n/**\n * Structural schema for a STORED workflow definition — primitives only,\n * every reference scope resolved. Cross-field invariants (unique names,\n * transition targets, effect-name uniqueness, predicate shadowing) are\n * checked by `checkWorkflowInvariants` after desugar — see `defineWorkflow`.\n */\nconst WorkflowDefinitionSchema = v.strictObject(workflowFields(StateEntrySchema, StoredStageSchema))\nexport type WorkflowDefinition = v.InferOutput<typeof WorkflowDefinitionSchema>\n\n/** The authoring surface: stored primitives plus the define-time sugar. */\nexport const AuthoringWorkflowSchema = v.strictObject(\n  workflowFields(AuthoringStateEntrySchema, AuthoringStageSchema),\n)\nexport type AuthoringWorkflow = v.InferOutput<typeof AuthoringWorkflowSchema>\n\n/**\n * The lake document type for a deployed workflow definition. Engine-owned\n * standalone documents carry the platform namespace; in-array discriminators\n * stay bare. Mirrors {@link WORKFLOW_INSTANCE_TYPE}.\n */\nexport const WORKFLOW_DEFINITION_TYPE = 'sanity.workflow.definition'\n\n// Error formatting — turn validation issues into a multi-line,\n// path-prefixed message that points at the exact field the author got\n// wrong. Shared by structural parse errors (via {@link issuesFromValibot})\n// and cross-field invariant issues.\n\nexport interface ValidationIssue {\n  path: ReadonlyArray<PropertyKey>\n  message: string\n}\n\n/** The buildable path form desugar and the invariants accumulate issues under. */\nexport type IssuePath = (string | number)[]\n\nexport function formatValidationError(label: string, issues: readonly ValidationIssue[]): string {\n  const lines = issues.map((issue) => {\n    const path = issue.path.length === 0 ? '(root)' : formatPath(issue.path)\n    return `  - ${path}: ${issue.message}`\n  })\n  return `${label} failed validation (${issues.length} issue${\n    issues.length === 1 ? '' : 's'\n  }):\\n${lines.join('\\n')}`\n}\n\nexport function issuesFromValibot(issues: readonly v.BaseIssue<unknown>[]): ValidationIssue[] {\n  return issues.map((issue) => ({\n    path: issue.path ? issue.path.map((item) => item.key as PropertyKey) : [],\n    message: issue.message,\n  }))\n}\n\nfunction formatPath(path: ReadonlyArray<PropertyKey>): string {\n  let out = ''\n  for (const seg of path) {\n    if (typeof seg === 'number') out += `[${seg}]`\n    else out += out.length === 0 ? String(seg) : `.${String(seg)}`\n  }\n  return out\n}\n"],"names":["v"],"mappings":";;;;;;;;;;;;;;;;;;AAaO,MAAM,gBAAgB,CAAC,WAAW,UAAU,QAAQ,WAAW,QAAQ,GAKjE,yBAAyB,CAAC,QAAQ,WAAW,QAAQ;AAG3D,SAAS,qBAAqB,QAAkD;AACrF,SAAQ,uBAAiD,SAAS,MAAM;AAC1E;AAIO,MAAM,eAAe,CAAC,YAAY,SAAS,MAAM,GAK3C,6BAA6B,CAAC,UAAU,QAAQ,QAAQ,GAKxD,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GCTM,WAAWA,aAAE,KAAKA,aAAE,UAAUA,aAAE,UAAU,GAAG,4BAA4B,CAAC,GAE1E,cAAcA,aAAE,KAAKA,aAAE,UAAUA,aAAE,WAAWA,aAAE,SAAS,CAAC,CAAC,GASpD,kBAAkB;AAE/B,SAAS,eAAe,cAAsB;AAC5C,SAAOA,aAAE;AAAA,IACPA,aAAE,OAAA;AAAA,IACFA,aAAE;AAAA,MACA;AAAA,MACA,uHACiC,YAAY;AAAA,IAAA;AAAA,EAC/C;AAEJ;AAOA,SAAS,SAAgE,SAAmB;AAC1F,SAAOA,aAAE;AAAA,IACP;AAAA,IACA,mCAAmC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,EAAA;AAE7E;AA0BA,MAAM,eAAgDA,aAAE;AAAA,EAAK,MAC3DA,aAAE,MAAM;AAAA;AAAA,IAENA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,MAAM,GAAE;AAAA,IACxCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,OAAO;AAAA,MACvB,OAAO;AAAA,IAAA,CACR;AAAA;AAAA,IAEDA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,SAAS,GAAG,OAAOA,aAAE,QAAA,EAAQ,CAAE;AAAA,IAC/DA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAG,OAAO,UAAS;AAAA,IAC1DA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAE;AAAA,IACvCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,MAAM,GAAE;AAAA,IACxCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,WAAW;AAAA,MAC3B,OAAOA,aAAE,SAASA,aAAE,MAAM,CAACA,aAAE,QAAQ,UAAU,GAAGA,aAAE,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,MACtE,OAAO;AAAA,MACP,MAAMA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAAA,CAC5B;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,QAAQ;AAAA,MACxB,QAAQA,aAAE,OAAO,UAAU,YAAY;AAAA,IAAA,CACxC;AAAA,EAAA,CACF;AACH,GAOM,uBAAuBA,aAAE,aAAa;AAAA,EAC1C,OAAO,SAAS,YAAY;AAAA,EAC5B,OAAO;AACT,CAAC,GAGK,0BAA0BA,aAAE,aAAa;AAAA,EAC7C,OAAOA,aAAE,SAAS,SAAS,YAAY,CAAC;AAAA,EACxC,OAAO;AACT,CAAC,GAYK,oBAA0DA,aAAE;AAAA,EAAK,MACrEA,aAAE,MAAM;AAAA,IACNA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,OAAO;AAAA,MACvB,OAAO;AAAA,MACP,QAAQ;AAAA,IAAA,CACT;AAAA,IACDA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAG,IAAIA,aAAE,MAAM,iBAAiB,GAAE;AAAA,IACvEA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAG,IAAIA,aAAE,MAAM,iBAAiB,GAAE;AAAA,EAAA,CACxE;AACH;AAOA,SAAS,UAAqC,cAAiB;AAC7D,SAAO;AAAA,IACLA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,WAAW;AAAA,MAC3B,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,aAAa;AAAA,MAC7B,QAAQ;AAAA,IAAA,CACT;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,cAAc;AAAA,MAC9B,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,mBAAmB;AAAA,MACnC,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,mBAAmB;AAAA,MACnC,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,EAAA;AAEL;AAEA,MAAM,iBAAiBA,aAAE,QAAQ,QAAQ;AAAA,EACvC,GAAG,UAAU,oBAAoB;AAAA,EACjCA,aAAE,aAAa;AAAA,IACb,MAAMA,aAAE,QAAQ,YAAY;AAAA,IAC5B,MAAM;AAAA,IACN,QAAQ,SAAS,aAAa;AAAA,EAAA,CAC/B;AACH,CAAC,GAQK,2BAA2BA,aAAE,QAAQ,QAAQ,CAAC,GAAG,UAAU,oBAAoB,CAAC,CAAC,GAOjF,gBAAgBA,aAAE,aAAa;AAAA,EACnC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,aAAaA,aAAE;AAAA,IACbA,aAAE,aAAa;AAAA,MACb,OAAOA,aAAE,SAAS,QAAQ;AAAA,MAC1B,IAAIA,aAAE,SAAS,QAAQ;AAAA,IAAA,CACxB;AAAA,EAAA;AAEL,CAAC,GAEY,oBAAoBA,aAAE,QAAQ,QAAQ;AAAA,EACjD,GAAG,UAAU,uBAAuB;AAAA,EACpCA,aAAE,aAAa;AAAA,IACb,MAAMA,aAAE,QAAQ,YAAY;AAAA,IAC5B,MAAMA,aAAE,SAAS,QAAQ;AAAA,IACzB,QAAQ,SAAS,aAAa;AAAA,EAAA,CAC/B;AAAA,EACD;AACF,CAAC,GAOK,kBAAkB,SAAS;AAAA,EAC/B;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF,CAAC,GAEK,iBAAiB,eAAe,iBAAiB,GAEjD,mBAAmBA,aAAE,aAAa;AAAA,EACtC,MAAM;AAAA,EACN,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,QAAQ;AACV,CAAC,GAQK,mBAAmBA,aAAE,aAAa;AAAA,EACtC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AACpC,CAAC,GAEY,4BAA4BA,aAAE,MAAM,CAAC,kBAAkB,gBAAgB,CAAC,GAS/E,kBAAkB,UAQX,eAAeA,aAAE,aAAa;AAAA,EACzC,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA,EAElC,UAAUA,aAAE,SAASA,aAAE,OAAOA,aAAE,UAAU,eAAe,CAAC;AAAA;AAAA,EAE1D,OAAOA,aAAE,SAASA,aAAE,OAAOA,aAAE,OAAA,GAAUA,aAAE,SAAS,CAAC;AACrD,CAAC,GAWK,oBAAoBA,aAAE,aAAa;AAAA,EACvC,MAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACD;AAAA,EACD,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,UAAUA,aAAE,SAASA,aAAE,SAAS;AAClC,CAAC;AAMD,SAAS,aAA0C,IAAS;AAC1D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlC,QAAQA,aAAE,SAAS,eAAe;AAAA,IAClC,QAAQA,aAAE,SAASA,aAAE,MAAM,iBAAiB,CAAC;AAAA,IAC7C,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,EAAA;AAE7C;AAEA,MAAM,qBAAqBA,aAAE,aAAa,aAAa,cAAc,CAAC,GAGhE,qBAAqB,SAAS,sBAAsB,GAapD,2BAA2BA,aAAE,aAAa;AAAA,EAC9C,GAAG,aAAa,iBAAiB;AAAA,EACjC,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACnC,QAAQA,aAAE,SAAS,kBAAkB;AACvC,CAAC,GAUK,oBAAoBA,aAAE,aAAa;AAAA,EACvC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,OAAOA,aAAE,MAAM,CAAC,UAAU,uBAAuB,CAAC;AAAA,EAClD,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACnC,QAAQA,aAAE,SAAS,eAAe;AAAA,EAClC,QAAQA,aAAE,SAASA,aAAE,MAAM,iBAAiB,CAAC;AAAA,EAC7C,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAC3C,CAAC,GAEY,wBAAwBA,aAAE,MAAM,CAAC,0BAA0B,iBAAiB,CAAC,GAapF,sBAAsBA,aAAE,aAAa;AAAA,EACzC,MAAM;AAAA,EACN,SAASA,aAAE,SAASA,aAAE,MAAM,CAAC,aAAaA,aAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC,GAEK,qBAAqBA,aAAE,aAAa;AAAA;AAAA,EAExC,SAAS;AAAA,EACT,YAAY;AAAA;AAAA,EAEZ,MAAMA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,SAASA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AACzD,CAAC;AAUD,SAAS,WAIP,OAAe,QAAiB,IAAS;AACzC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,YAAYA,aAAE,SAAS,SAAS,CAAC,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACnD,QAAQA,aAAE,SAAS,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlC,cAAcA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM5D,cAAcA,aAAE,SAAS,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMxC,UAAUA,aAAE,SAAS,eAAe;AAAA,IACpC,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,IACzC,SAASA,aAAE,SAASA,aAAE,MAAM,MAAM,CAAC;AAAA,IACnC,cAAcA,aAAE,SAAS,kBAAkB;AAAA;AAAA,IAE3C,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA,EAAA;AAEpC;AAEA,MAAM,mBAAmBA,aAAE;AAAA,EACzB,WAAW,kBAAkB,oBAAoB,cAAc;AACjE,GAGa,sBAAsBA,aAAE;AAAA,EACnC,WAAW,2BAA2B,uBAAuB,iBAAiB;AAChF;AAQA,SAAS,iBACP,IACA,QACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,IAAI;AAAA,IACJ;AAAA;AAAA,IAEA,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,EAAA;AAE7C;AAEA,MAAM,yBAAyBA,aAAE;AAAA,EAC/B,iBAAiB,0BAA0B,eAAe;AAC5D,GAQM,8BAA8BA,aAAE,QAAQ,QAAQ;AAAA,EACpD,GAAG,UAAU,uBAAuB;AAAA,EACpC;AACF,CAAC,GACY,4BAA4BA,aAAE;AAAA,EACzC,iBAAiB,6BAA6BA,aAAE,SAAS,eAAe,CAAC;AAC3E,GAYM,oBAAoB,SAAS,sBAAsB,GAGnD,mBAAmBA,aAAE,aAAa;AAAA;AAAA,EAEtC,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA;AAAA,EAEnC,QAAQA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA;AAAA,EAEpC,YAAYA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACxC,SAASA,aAAE;AAAA,IACTA,aAAE,MAAM,iBAAiB;AAAA,IACzBA,aAAE,UAAU,GAAG,wCAAwC;AAAA,EAAA;AAE3D,CAAC,GAGY,cAAcA,aAAE,aAAa;AAAA,EACxC,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,WAAWA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAShC,UAAUA,aAAE,SAASA,aAAE,OAAO,UAAU,QAAQ,CAAC;AACnD,CAAC;AAQD,SAAS,YAIP,OAAe,MAAa,YAAyB;AACrD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,OAAOA,aAAE,SAASA,aAAE,MAAM,IAAI,CAAC;AAAA,IAC/B,aAAaA,aAAE,SAASA,aAAE,MAAM,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK3C,QAAQA,aAAE,SAASA,aAAE,MAAM,WAAW,CAAC;AAAA;AAAA,IAEvC,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA,EAAA;AAEpC;AAEA,MAAM,oBAAoBA,aAAE;AAAA,EAC1B,YAAY,kBAAkB,kBAAkB,sBAAsB;AACxE,GAGa,uBAAuBA,aAAE;AAAA,EACpC,YAAY,2BAA2B,qBAAqB,yBAAyB;AACvF;AAKA,SAAS,eACP,OACA,OACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA,IAElC,cAAc;AAAA;AAAA,IAEd,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA,IAChC,QAAQA,aAAE,KAAKA,aAAE,MAAM,KAAK,GAAGA,aAAE,UAAU,GAAG,iCAAiC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMhF,YAAYA,aAAE,SAASA,aAAE,OAAO,eAAe,WAAW,GAAG,eAAe,CAAC;AAAA,EAAA;AAEjF;AAQiCA,aAAE,aAAa,eAAe,kBAAkB,iBAAiB,CAAC;AAI5F,MAAM,0BAA0BA,aAAE;AAAA,EACvC,eAAe,2BAA2B,oBAAoB;AAChE,GAQa,2BAA2B;AAejC,SAAS,sBAAsB,OAAe,QAA4C;AAC/F,QAAM,QAAQ,OAAO,IAAI,CAAC,UAEjB,OADM,MAAM,KAAK,WAAW,IAAI,WAAW,WAAW,MAAM,IAAI,CACrD,KAAK,MAAM,OAAO,EACrC;AACD,SAAO,GAAG,KAAK,uBAAuB,OAAO,MAAM,SACjD,OAAO,WAAW,IAAI,KAAK,GAC7B;AAAA,EAAO,MAAM,KAAK;AAAA,CAAI,CAAC;AACzB;AAEO,SAAS,kBAAkB,QAA4D;AAC5F,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,CAAC,SAAS,KAAK,GAAkB,IAAI,CAAA;AAAA,IACvE,SAAS,MAAM;AAAA,EAAA,EACf;AACJ;AAEA,SAAS,WAAW,MAA0C;AAC5D,MAAI,MAAM;AACV,aAAW,OAAO;AACZ,WAAO,OAAQ,WAAU,OAAO,IAAI,GAAG,MACtC,OAAO,IAAI,WAAW,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,GAAG,CAAC;AAE9D,SAAO;AACT;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"schema.cjs","sources":["../../src/core/conditions.ts","../../src/core/roles.ts","../../src/types/enums.ts","../../src/define/schema.ts"],"sourcesContent":["/**\n * Shared GROQ condition composition. The one place that knows how the engine\n * ANDs partial conditions into a single predicate string — reused by the\n * define-time filter desugar (`roles` + `filter` + claim no-steal) and the\n * runtime editability resolution (slot baseline AND stage tighten-override).\n * Keeping it in one spot means the parenthesisation can't drift between the two.\n */\n\n/**\n * AND the supplied conditions into one GROQ predicate, dropping `undefined`\n * parts. Returns `undefined` when nothing remains (vacuously satisfied — the\n * caller's \"no gate\" case), the lone part verbatim when only one survives, and\n * each part parenthesised + `&&`-joined otherwise so operator precedence can't\n * change a part's meaning.\n */\nexport function andConditions(parts: readonly (string | undefined)[]): string | undefined {\n  const present = parts.filter((p): p is string => p !== undefined)\n  if (present.length === 0) return undefined\n  if (present.length === 1) return present[0]\n  return present.map((p) => `(${p})`).join(' && ')\n}\n","/**\n * Role-alias expansion — the pure rule behind the \"can be fulfilled by\" map.\n * One definition of \"which roles satisfy a required role\", shared by the two\n * sites that match an actor against required roles: the `roles` gate (baked\n * into GROQ at desugar) and `$assigned` (resolved at runtime). Keeping it in\n * one place is what lets the baked gate and the runtime check agree.\n */\n\nimport type {RoleAliases} from '../define/schema.ts'\n\n/**\n * Widen a set of REQUIRED roles to every role that fulfills them: each\n * required role itself, plus its declared fulfillers, plus the universal\n * fulfillers under the reserved `\"*\"` key. The actor's own roles are never\n * touched — only the accepted set grows.\n *\n * Deterministic (declaration order, first occurrence wins) so the baked gate\n * and golden snapshots stay stable. Expansion is one level, not transitive: a\n * fulfiller that is itself an alias key is not followed.\n */\nexport function expandRequiredRoles(\n  required: readonly string[],\n  aliases: RoleAliases | undefined,\n): string[] {\n  if (aliases === undefined) return [...required]\n  const out = new Set<string>()\n  for (const role of required) {\n    out.add(role)\n    for (const fulfiller of aliases[role] ?? []) out.add(fulfiller)\n  }\n  for (const fulfiller of aliases['*'] ?? []) out.add(fulfiller)\n  return [...out]\n}\n\n/**\n * Does the actor hold a role that fulfills `required` (a single required\n * role, e.g. an `assignees` entry's role)? The runtime twin of the baked\n * {@link expandRequiredRoles} gate, for `$assigned`.\n */\nexport function actorFulfillsRole(\n  actorRoles: readonly string[] | undefined,\n  required: string,\n  aliases: RoleAliases | undefined,\n): boolean {\n  if (actorRoles === undefined || actorRoles.length === 0) return false\n  const accepted = new Set(expandRequiredRoles([required], aliases))\n  return actorRoles.some((role) => accepted.has(role))\n}\n","/**\n * Leaf enums — the const arrays (and their derived union types) that both\n * the authoring schema and the engine address by name.\n *\n * This module imports nothing. It is the schema-free foundation that\n * `../define/schema.ts` reads its value constants from, which is what keeps\n * the type model and the valibot schema free of an import cycle: the value edge\n * `schema.ts → enums.ts` terminates here.\n */\n\n// Task status — used by instance state. The authored action `status:` sugar\n// (and the `status.set` op it desugars to) is constrained to the terminal\n// subset below.\nexport const TASK_STATUSES = ['pending', 'active', 'done', 'skipped', 'failed'] as const\nexport type TaskStatus = (typeof TASK_STATUSES)[number]\n\n// The statuses a task can be resolved INTO — what `status.set` accepts and\n// what stops blocking the `$allTasksDone` gate family.\nexport const TERMINAL_TASK_STATUSES = ['done', 'skipped', 'failed'] as const\nexport type TerminalTaskStatus = (typeof TERMINAL_TASK_STATUSES)[number]\n\nexport function isTerminalTaskStatus(status: TaskStatus): status is TerminalTaskStatus {\n  return (TERMINAL_TASK_STATUSES as readonly TaskStatus[]).includes(status)\n}\n\n// The three state scopes a state entry can live in. Authoring (`ScopeKey`,\n// `stateRead` sources) and the engine both address state entries by scope.\nexport const STATE_SCOPES = ['workflow', 'stage', 'task'] as const\nexport type StateScope = (typeof STATE_SCOPES)[number]\n\n// Document-value permissions. Grants (`Grant` in ./authorization.ts) compose\n// most-permissive-wins.\nexport const DOCUMENT_VALUE_PERMISSIONS = ['create', 'read', 'update'] as const\nexport type DocumentValuePermission = (typeof DOCUMENT_VALUE_PERMISSIONS)[number]\n\n// Mutation-guard actions — the lake operations a guard can gate. See the\n// guard types in ./authorization.ts.\nexport const MUTATION_GUARD_ACTIONS = [\n  'create',\n  'update',\n  'delete',\n  'publish',\n  'unpublish',\n] as const\nexport type MutationGuardAction = (typeof MUTATION_GUARD_ACTIONS)[number]\n","/**\n * Valibot schemas for the workflow authoring surface — the things a workflow\n * author writes by hand and feeds to `defineWorkflow`. Types in this\n * file are the **canonical** authoring types: they are inferred from\n * the schemas, so the runtime schema and the compile-time type cannot\n * drift.\n *\n * Two layers live here, mirroring the design model (generic stored data,\n * sugar that compiles away):\n *\n *   - **Stored** schemas (`WorkflowDefinitionSchema`, `OpSchema`, …) describe\n *     the primitives the engine persists. No sugar variants, every state\n *     reference carries an explicit resolved `scope`.\n *   - **Authoring** schemas (`AuthoringWorkflowSchema`, …) accept the same\n *     primitives **plus** define-time sugar: the `claim` state/action pair,\n *     the `audit` op, the `roles` and `status` action fields, omitted\n *     transition filters, omitted reference scopes. `desugar.ts` expands\n *     authoring input into the stored shape.\n *\n * Strictness: every object schema is `v.strictObject` so unknown keys\n * produce a parse error. That catches typos like `verison: 1` at deploy\n * time — and it is also what enforces each sugar contract's *reserved*\n * fields (an `ops:` on a `claim` action is an unknown key, fail loud).\n */\n\nimport * as v from 'valibot'\n\nimport {\n  MUTATION_GUARD_ACTIONS,\n  STATE_SCOPES,\n  TASK_STATUSES,\n  TERMINAL_TASK_STATUSES,\n} from '../types/enums.ts'\n\nconst NonEmpty = v.pipe(v.string(), v.minLength(1, 'must be a non-empty string'))\n\nconst PositiveInt = v.pipe(v.number(), v.integer(), v.minValue(1))\n\n/**\n * Names that get spliced into GROQ — state entries (`$state.<name>` in the\n * claim no-steal filter and every condition) and predicate keys (`$<name>`).\n * A name like `review-owner` would parse as subtraction inside GROQ and\n * silently change the expression's meaning, so these are constrained to\n * GROQ-identifier-safe names. See {@link GROQ_IDENTIFIER}.\n */\nexport const GROQ_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/\n\nfunction groqIdentifier(referencedAs: string) {\n  return v.pipe(\n    v.string(),\n    v.regex(\n      GROQ_IDENTIFIER,\n      `must be a GROQ-safe identifier (letters, digits, underscore; not starting with a digit) ` +\n        `because it is referenced as ${referencedAs} in GROQ conditions`,\n    ),\n  )\n}\n\n/**\n * Picklist with a zod-compatible \"Invalid option\" message that lists every\n * allowed value, so a typo'd discriminator or enum lands with a message an\n * author can act on (e.g. `Invalid option: expected one of \"done\"|\"skipped\"`).\n */\nfunction picklist<const TOptions extends readonly [string, ...string[]]>(options: TOptions) {\n  return v.picklist(\n    options,\n    `Invalid option: expected one of ${options.map((o) => `\"${o}\"`).join('|')}`,\n  )\n}\n\n// Source — the single \"where a value comes from\" union, shared by state-entry\n// origins and op payloads. Conditions and effect bindings are NOT Sources —\n// they are GROQ strings over the rendered scope ($state, $actor, $row, …).\n// Each value variant has a rendered $-twin (actor ↔ $actor, now ↔ $now) so\n// learning one side teaches the other.\n\ntype SourceInternal =\n  | {type: 'init'}\n  | {type: 'write'}\n  | {type: 'query'; query: string}\n  | {type: 'literal'; value: unknown}\n  | {type: 'param'; param: string}\n  | {type: 'actor'}\n  | {type: 'now'}\n  | {type: 'self'}\n  | {type: 'stage'}\n  | {\n      type: 'stateRead'\n      scope?: 'workflow' | 'stage' | undefined\n      state: string\n      path?: string | undefined\n    }\n  | {type: 'object'; fields: Record<string, SourceInternal>}\n\nconst SourceSchema: v.GenericSchema<SourceInternal> = v.lazy(() =>\n  v.union([\n    // State-entry origins: who fills the entry, and when.\n    v.strictObject({type: v.literal('init')}),\n    v.strictObject({type: v.literal('write')}),\n    v.strictObject({\n      type: v.literal('query'),\n      query: NonEmpty,\n    }),\n    // Value sources: resolved to concrete JSON when an op or seed applies.\n    v.strictObject({type: v.literal('literal'), value: v.unknown()}),\n    v.strictObject({type: v.literal('param'), param: NonEmpty}),\n    v.strictObject({type: v.literal('actor')}),\n    v.strictObject({type: v.literal('now')}),\n    v.strictObject({type: v.literal('self')}),\n    v.strictObject({type: v.literal('stage')}),\n    v.strictObject({\n      type: v.literal('stateRead'),\n      scope: v.optional(v.union([v.literal('workflow'), v.literal('stage')])),\n      state: NonEmpty,\n      path: v.optional(v.string()),\n    }),\n    v.strictObject({\n      type: v.literal('object'),\n      fields: v.record(NonEmpty, SourceSchema),\n    }),\n  ]),\n)\nexport type Source = SourceInternal\n\n// State references — `{ scope?, state }` addressing a state entry by name.\n// Authoring may omit `scope`; desugar resolves it lexically (task → stage →\n// workflow), so the STORED form always carries an explicit scope.\n\nconst StoredStateRefSchema = v.strictObject({\n  scope: picklist(STATE_SCOPES),\n  state: NonEmpty,\n})\nexport type StoredStateRef = v.InferOutput<typeof StoredStateRefSchema>\n\nconst AuthoringStateRefSchema = v.strictObject({\n  scope: v.optional(picklist(STATE_SCOPES)),\n  state: NonEmpty,\n})\nexport type AuthoringStateRef = v.InferOutput<typeof AuthoringStateRefSchema>\n\n// Op predicates — small typed predicate for state.updateWhere /\n// state.removeWhere. Runs in the pure in-memory op path, so it stays a\n// typed structure rather than GROQ. Discriminated by `type` like every union.\n\ntype OpPredicateInternal =\n  | {type: 'field'; field: string; equals: Source}\n  | {type: 'all'; of: OpPredicateInternal[]}\n  | {type: 'any'; of: OpPredicateInternal[]}\n\nconst OpPredicateSchema: v.GenericSchema<OpPredicateInternal> = v.lazy(() =>\n  v.union([\n    v.strictObject({\n      type: v.literal('field'),\n      field: NonEmpty,\n      equals: SourceSchema,\n    }),\n    v.strictObject({type: v.literal('all'), of: v.array(OpPredicateSchema)}),\n    v.strictObject({type: v.literal('any'), of: v.array(OpPredicateSchema)}),\n  ]),\n)\nexport type OpPredicate = OpPredicateInternal\n\n// Ops — the six stored mutation primitives. `value` is the one payload key.\n// `status.set` may name a sibling task; desugar fills the firing task when\n// authoring omitted it, so the stored op always carries `task`.\n\nfunction opSchemas<T extends v.GenericSchema>(targetSchema: T) {\n  return [\n    v.strictObject({\n      type: v.literal('state.set'),\n      target: targetSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.unset'),\n      target: targetSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.append'),\n      target: targetSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.updateWhere'),\n      target: targetSchema,\n      where: OpPredicateSchema,\n      value: SourceSchema,\n    }),\n    v.strictObject({\n      type: v.literal('state.removeWhere'),\n      target: targetSchema,\n      where: OpPredicateSchema,\n    }),\n  ] as const\n}\n\nconst StoredOpSchema = v.variant('type', [\n  ...opSchemas(StoredStateRefSchema),\n  v.strictObject({\n    type: v.literal('status.set'),\n    task: NonEmpty,\n    status: picklist(TASK_STATUSES),\n  }),\n])\nexport type Op = v.InferOutput<typeof StoredOpSchema>\n\n/**\n * The `state.*` subset a transition may carry — `status.set` has no coherent\n * task target while the stage's tasks tear down, so the engine rejects it\n * at parse time rather than dropping it silently.\n */\nconst StoredTransitionOpSchema = v.variant('type', [...opSchemas(StoredStateRefSchema)])\nexport type TransitionOp = v.InferOutput<typeof StoredTransitionOpSchema>\n\n// Authoring ops: scope optional on targets, `task` optional on status.set\n// (defaults to the firing task), plus the `audit` sugar type — a stamped\n// append whose expansion merges `actor`/`at` Source fields into its own value.\n\nconst AuditOpSchema = v.strictObject({\n  type: v.literal('audit'),\n  target: AuthoringStateRefSchema,\n  value: SourceSchema,\n  stampFields: v.optional(\n    v.strictObject({\n      actor: v.optional(NonEmpty),\n      at: v.optional(NonEmpty),\n    }),\n  ),\n})\n\nexport const AuthoringOpSchema = v.variant('type', [\n  ...opSchemas(AuthoringStateRefSchema),\n  v.strictObject({\n    type: v.literal('status.set'),\n    task: v.optional(NonEmpty),\n    status: picklist(TASK_STATUSES),\n  }),\n  AuditOpSchema,\n])\nexport type AuthoringOp = v.InferOutput<typeof AuthoringOpSchema>\n\n// State entries — the generic stored data. Kinds are bare: a discriminator is\n// unique within its union; namespaces live only on engine-owned lake document\n// `_type`s ({@link WORKFLOW_DEFINITION_TYPE}, the instance type).\n\nconst StateKindSchema = picklist([\n  'doc.ref',\n  'doc.refs',\n  // Release reference. A workflow declares this entry to say \"I target a\n  // Content Release\"; the runtime fills it at start time and auto-derives\n  // the instance's read perspective from it.\n  'release.ref',\n  'query',\n  'value.string',\n  'value.url',\n  'value.number',\n  'value.boolean',\n  'value.dateTime',\n  'value.actor',\n  'checklist',\n  'notes',\n  // The WHO-FOR entry: the inbox reverse-query reads it by kind, and the\n  // rendered `$assigned` gate matches the caller against it.\n  'assignees',\n])\n\nconst StateEntryName = groqIdentifier('`$state.<name>`')\n\n/**\n * Declared editability of a state slot — the generic edit seam's gate. Default\n * (absent) is NOT editable: a slot is op-only engine working memory unless the\n * modeler opens it. The stored form is `true` (editable by anyone within the\n * slot's scope window) or a GROQ predicate over the rendered scope (`$actor`,\n * `$can`, `$state`, `$assigned`), checked like an action filter to decide\n * who-may-edit. ADVISORY like every engine gate — it disables the inline field\n * and explains; real immutability needs a lake {@link Guard}.\n */\nconst StoredEditableSchema = v.union([v.literal(true), NonEmpty])\nexport type Editable = v.InferOutput<typeof StoredEditableSchema>\n\n/**\n * Authoring editability adds the `role[]` convenience: a non-empty role list\n * desugars to the same `count($actor.roles[@ in [...]]) > 0` membership\n * predicate `action.roles` produces. `true` opens the slot to anyone in its\n * window; a bare string is a raw predicate.\n */\nconst AuthoringEditableSchema = v.union([v.literal(true), v.array(NonEmpty), NonEmpty])\nexport type AuthoringEditable = v.InferOutput<typeof AuthoringEditableSchema>\n\n/** State-entry fields shared by the stored and authoring shapes, parameterised\n *  over the `editable` grammar (stored is normalised; authoring keeps `role[]`). */\nfunction stateEntryFields<TEditable extends v.GenericSchema>(editable: TEditable) {\n  return {\n    type: StateKindSchema,\n    name: StateEntryName,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    /**\n     * When true, the caller MUST supply this entry at start (via\n     * `initialState`) or spawn (via the parent's `subworkflows.with`). A\n     * missing required entry throws rather than silently defaulting to\n     * `null`/`[]` — the same fail-fast an action's `required` param gets.\n     * Valid only on a workflow-scope `init`-sourced entry (deploy invariant).\n     */\n    required: v.optional(v.boolean()),\n    source: SourceSchema,\n    /** Who-may-edit this slot via the edit seam — see {@link StoredEditableSchema}. */\n    editable: v.optional(editable),\n  }\n}\n\nconst StateEntrySchema = v.strictObject(stateEntryFields(StoredEditableSchema))\nexport type StateEntry = v.InferOutput<typeof StateEntrySchema>\n\nconst RawAuthoringStateEntrySchema = v.strictObject(stateEntryFields(AuthoringEditableSchema))\n\n/**\n * Authoring state accepts the raw entries plus the `claim` sugar type — the\n * state half of the mirrored claim pair. Expansion: `value.actor` with an\n * implied `write` source, strictly within this entry.\n */\nconst ClaimStateSchema = v.strictObject({\n  type: v.literal('claim'),\n  name: StateEntryName,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n})\n\nexport const AuthoringStateEntrySchema = v.union([RawAuthoringStateEntrySchema, ClaimStateSchema])\nexport type AuthoringStateEntry = v.InferOutput<typeof AuthoringStateEntrySchema>\n\n// Conditions are raw GROQ strings over the rendered scope — built-in vars\n// ($state, $actor, $assigned, $can, $row, $effects, $subworkflows, $tasks,\n// $now, $allTasksDone, $anyTaskFailed) plus the author's nullary predicates.\n// There is no {ref, args} wrapper; parameterized reuse is a define-time\n// TypeScript function (see the `groq` tag in ./groq.ts).\n\nconst ConditionSchema = NonEmpty\nexport type Condition = string\n\n// Effects — the registry model. `name` is the effect's only identity; the\n// host app registers a handler against it (1:1) and the stored definition\n// never references code. Names are unique per definition (invariant) so\n// `$effects.<name>` is unambiguous.\n\nexport const EffectSchema = v.strictObject({\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  /** GROQ reads over the rendered scope, resolved to concrete JSON at queue time. */\n  bindings: v.optional(v.record(v.string(), ConditionSchema)),\n  /** Static config, passed through to the handler verbatim. */\n  input: v.optional(v.record(v.string(), v.unknown())),\n})\nexport type Effect = v.InferOutput<typeof EffectSchema>\n\n// Actions\n\n/**\n * Caller-supplied params declared on an action. The engine validates\n * incoming `params` against this list before running ops or queuing\n * effects: missing required params → ActionParamsInvalidError, action\n * does not commit. Resolved values feed `Source.param` lookups.\n */\nconst ActionParamSchema = v.strictObject({\n  type: picklist([\n    'string',\n    'number',\n    'boolean',\n    'url',\n    'dateTime',\n    'actor',\n    'doc.ref',\n    'doc.refs',\n    'json',\n  ]),\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  required: v.optional(v.boolean()),\n})\nexport type ActionParam = v.InferOutput<typeof ActionParamSchema>\n\n/** Fields shared by the stored and authoring action shapes, parameterised\n *  over the op schema (stored ops are fully resolved; authoring ops keep\n *  their sugar). */\nfunction actionFields<TOp extends v.GenericSchema>(op: TOp) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    /**\n     * The one gate mechanism: a condition over the rendered scope. Hard\n     * enforcement lives outside the engine entirely (the lake ACL on the\n     * documents, and guards) — every engine-evaluated gate is authoring/UX.\n     */\n    filter: v.optional(ConditionSchema),\n    params: v.optional(v.array(ActionParamSchema)),\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n  }\n}\n\nconst StoredActionSchema = v.strictObject(actionFields(StoredOpSchema))\nexport type Action = v.InferOutput<typeof StoredActionSchema>\n\nconst TerminalTaskStatus = picklist(TERMINAL_TASK_STATUSES)\n\n/**\n * Authoring action — the stored fields plus two field sugars with one\n * defined expansion each:\n *\n *   - `roles` → a `count($actor.roles[@ in [...]]) > 0` membership condition\n *     ANDed with the authored `filter`. The definition's `roleAliases`\n *     ({@link RoleAliasesSchema}) widen that membership at desugar time.\n *   - `status` → a `status.set` op on the firing task, appended **after**\n *     the authored ops (deliberately never implied: a forgotten explicit\n *     `status` is a visible stall, an implied default silently completes\n *     claim-like actions).\n */\nconst RawAuthoringActionSchema = v.strictObject({\n  ...actionFields(AuthoringOpSchema),\n  roles: v.optional(v.array(NonEmpty)),\n  status: v.optional(TerminalTaskStatus),\n})\n\n/**\n * The action half of the mirrored claim pair. `state` references an\n * author-declared actor-valued entry (the pair's other half), resolved\n * lexically. Expansion, strictly within this action: a no-steal\n * `!defined($state.<state>)` filter ANDed with `roles`/`filter`, plus a\n * `state.set` ← actor op. `ops` and `status` are reserved (the expansion\n * owns them) — strictObject rejects them as unknown keys.\n */\nconst ClaimActionSchema = v.strictObject({\n  type: v.literal('claim'),\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  state: v.union([NonEmpty, AuthoringStateRefSchema]),\n  roles: v.optional(v.array(NonEmpty)),\n  filter: v.optional(ConditionSchema),\n  params: v.optional(v.array(ActionParamSchema)),\n  effects: v.optional(v.array(EffectSchema)),\n})\n\nexport const AuthoringActionSchema = v.union([RawAuthoringActionSchema, ClaimActionSchema])\nexport type AuthoringAction = v.InferOutput<typeof AuthoringActionSchema>\n\n// Subworkflows — declare `subworkflows`, read `$subworkflows`. The spawning\n// task resolves like any task: `completeWhen` / `failWhen` over the rendered\n// `$subworkflows`; no `completeWhen` means all subworkflows done.\n\n/**\n * Logical reference to a deployed workflow definition, by its `name` (the\n * stable contract — the tag can be renamed, workflows redeployed). The engine\n * resolves it at spawn time, ordering by `version desc` unless an explicit\n * `version` pins one.\n */\nconst DefinitionRefSchema = v.strictObject({\n  name: NonEmpty,\n  version: v.optional(v.union([PositiveInt, v.literal('latest')])),\n})\n\nconst SubworkflowsSchema = v.strictObject({\n  /** GROQ producing one row per subworkflow; each row binds as `$row`. */\n  forEach: NonEmpty,\n  definition: DefinitionRefSchema,\n  /** Initial state for each subworkflow — entry name → GROQ over `$row` + the parent scope. */\n  with: v.optional(v.record(NonEmpty, ConditionSchema)),\n  /**\n   * Extra values evaluated in the parent's rendered scope at spawn time and\n   * delivered into each subworkflow's `$effects` bag — the parent→child\n   * handoff, read exactly like an effect output.\n   */\n  context: v.optional(v.record(NonEmpty, ConditionSchema)),\n})\nexport type Subworkflows = v.InferOutput<typeof SubworkflowsSchema>\n\n// Tasks — tasks own the ENTER moment: `ops` + `effects` run at activation,\n// `filter` makes activation conditional on the stage's entry state, and\n// `activation` switches the stage-enter flip (default `manual`: a task never\n// activates silently; \"auto\" is the explicit opt-in). A task with no actions\n// and no `completeWhen` is a machine step — it runs its activation payload\n// and resolves `done` immediately, leaving an audit row.\n\nfunction taskFields<\n  TState extends v.GenericSchema,\n  TAction extends v.GenericSchema,\n  TOp extends v.GenericSchema,\n>(state: TState, action: TAction, op: TOp) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    activation: v.optional(picklist(['auto', 'manual'])),\n    filter: v.optional(ConditionSchema),\n    /**\n     * Readiness gates, by name — conditions over the rendered scope that must\n     * hold for the task to be *executable*, orthogonal to `filter`\n     * (visibility). An unmet requirement keeps the task visible but disables\n     * its actions with a `requirements-unmet` verdict naming the unmet keys;\n     * all must hold (any-of lives inside one condition). Advisory like every\n     * engine gate — the lake still enforces. Distinct from ACL (authorization)\n     * and guards (content-write locks).\n     */\n    requirements: v.optional(v.record(NonEmpty, ConditionSchema)),\n    /**\n     * Auto-completion condition — evaluated at activation and on every\n     * cascade; truthy flips the task to `done` with a system actor. On a\n     * spawning task it typically reads `$subworkflows`.\n     */\n    completeWhen: v.optional(ConditionSchema),\n    /**\n     * Auto-failure condition — symmetric to `completeWhen`, flips to\n     * `failed`. When both are truthy on the same evaluation, `failWhen`\n     * wins — failure is the more notable signal.\n     */\n    failWhen: v.optional(ConditionSchema),\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n    actions: v.optional(v.array(action)),\n    subworkflows: v.optional(SubworkflowsSchema),\n    /** Task-scoped state entries. Resolved at task activation time. */\n    state: v.optional(v.array(state)),\n  }\n}\n\nconst StoredTaskSchema = v.strictObject(\n  taskFields(StateEntrySchema, StoredActionSchema, StoredOpSchema),\n)\nexport type Task = v.InferOutput<typeof StoredTaskSchema>\n\nexport const AuthoringTaskSchema = v.strictObject(\n  taskFields(AuthoringStateEntrySchema, AuthoringActionSchema, AuthoringOpSchema),\n)\nexport type AuthoringTask = v.InferOutput<typeof AuthoringTaskSchema>\n\n// Transitions — purely a condition over the rendered scope. Selection rule:\n// every transition is evaluated on every commit and cascade; the first truthy\n// `filter` in declaration order fires. No action coupling: a routing\n// difference is written into state by the action and read by the filter.\n\nfunction transitionFields<TOp extends v.GenericSchema, TFilter extends v.GenericSchema>(\n  op: TOp,\n  filter: TFilter,\n) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    to: NonEmpty,\n    filter,\n    /** The `state.*` subset — state-write-on-move, the stage's EXIT/ARRIVAL payload. */\n    ops: v.optional(v.array(op)),\n    effects: v.optional(v.array(EffectSchema)),\n  }\n}\n\nconst StoredTransitionSchema = v.strictObject(\n  transitionFields(StoredTransitionOpSchema, ConditionSchema),\n)\nexport type Transition = v.InferOutput<typeof StoredTransitionSchema>\n\n/**\n * Authoring transitions may omit `filter`; desugar fills the safe,\n * overwhelmingly-common gate `\"$allTasksDone\"`. \"Fire unconditionally\"\n * stays spellable as an explicit `filter: \"true\"`.\n */\nconst AuthoringTransitionOpSchema = v.variant('type', [\n  ...opSchemas(AuthoringStateRefSchema),\n  AuditOpSchema,\n])\nexport const AuthoringTransitionSchema = v.strictObject(\n  transitionFields(AuthoringTransitionOpSchema, v.optional(ConditionSchema)),\n)\nexport type AuthoringTransition = v.InferOutput<typeof AuthoringTransitionSchema>\n\n// Guards — lake mutation guards. A FOREIGN CONTRACT mirrored 1:1: the\n// `temp.system.guard` doc's `match` / `predicate` / `metadata` fields are the\n// content lake's API, not engine surface, so authoring keeps the lake's\n// vocabulary verbatim. The engine adds exactly two things: `name` (authoring\n// identity — the lake `_id` derives from (instanceId, guard.name)) and\n// `$state`-read VALUES (`idRefs: [\"$state.subject\"]`, `metadata.outcome:\n// \"$state.outcome\"`), resolved at deploy into the bare values the contract\n// expects. Guards + the lake ACL are the only HARD gates in the system.\n\nconst GuardActionSchema = picklist(MUTATION_GUARD_ACTIONS)\nexport type GuardAction = v.InferOutput<typeof GuardActionSchema>\n\nconst GuardMatchSchema = v.strictObject({\n  /** Subject `_type`(s); empty matches any type. */\n  types: v.optional(v.array(NonEmpty)),\n  /** Target docs as `$state` reads (or `\"$self\"`), resolved at deploy to bare ids + the resource. */\n  idRefs: v.optional(v.array(NonEmpty)),\n  /** Glob id patterns (bare, resource-local). */\n  idPatterns: v.optional(v.array(NonEmpty)),\n  actions: v.pipe(\n    v.array(GuardActionSchema),\n    v.minLength(1, 'a guard must match at least one action'),\n  ),\n})\nexport type GuardMatch = v.InferOutput<typeof GuardMatchSchema>\n\nexport const GuardSchema = v.strictObject({\n  name: NonEmpty,\n  title: v.optional(v.string()),\n  description: v.optional(v.string()),\n  match: GuardMatchSchema,\n  /**\n   * Lake GROQ predicate — a distinct eval context reading\n   * `document.before`/`document.after`, `mutation`, `guard`, and\n   * `identity()`. Bare ids/fields only. Omitted or empty means\n   * UNCONDITIONAL DENY.\n   */\n  predicate: v.optional(v.string()),\n  /**\n   * Projected workflow state the predicate reads as `guard.metadata.*` —\n   * the only bridge from the lake eval context (which cannot see `$state`)\n   * to workflow state. Values are NOT GROQ: each is a deploy-time read in\n   * the guard mini-language — `\"$self\"`, `\"$now\"`, or\n   * `\"$state.<name>[.path]\"` — resolved into a bare value at deploy and\n   * re-synced by the post-state-op guard refresh.\n   */\n  metadata: v.optional(v.record(NonEmpty, NonEmpty)),\n})\nexport type Guard = v.InferOutput<typeof GuardSchema>\n\n// Stages — pure containers: name / state / guards / tasks / transitions, no\n// behaviour of their own. Tasks own enter, transitions own exit and arrival.\n// `initial` is whatever `initialStage` names; a stage with no transitions IS\n// terminal (structural, nothing to declare or mis-declare).\n\nfunction stageFields<\n  TState extends v.GenericSchema,\n  TTask extends v.GenericSchema,\n  TTransition extends v.GenericSchema,\n  TEditable extends v.GenericSchema,\n>(state: TState, task: TTask, transition: TTransition, editable: TEditable) {\n  return {\n    name: NonEmpty,\n    title: v.optional(v.string()),\n    description: v.optional(v.string()),\n    tasks: v.optional(v.array(task)),\n    transitions: v.optional(v.array(transition)),\n    /**\n     * Lake mutation guards active while this stage holds. Each compiles to a\n     * `temp.system.guard` doc deployed on stage entry and retracted on exit.\n     */\n    guards: v.optional(v.array(GuardSchema)),\n    /** Stage-scoped state entries. Resolved at stage entry. */\n    state: v.optional(v.array(state)),\n    /**\n     * Tighten-only editability overrides for the time this stage holds, keyed\n     * by an in-scope slot name. The slot's own `editable` is the ceiling; a\n     * stage value is ANDed with it at runtime, so an override can only NARROW\n     * (never open a slot the baseline left closed). An unlisted slot inherits\n     * its baseline.\n     */\n    editable: v.optional(v.record(StateEntryName, editable)),\n  }\n}\n\nconst StoredStageSchema = v.strictObject(\n  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema, StoredEditableSchema),\n)\nexport type Stage = v.InferOutput<typeof StoredStageSchema>\n\nexport const AuthoringStageSchema = v.strictObject(\n  stageFields(\n    AuthoringStateEntrySchema,\n    AuthoringTaskSchema,\n    AuthoringTransitionSchema,\n    AuthoringEditableSchema,\n  ),\n)\nexport type AuthoringStage = v.InferOutput<typeof AuthoringStageSchema>\n\n// Workflow definition (the root)\n\n/**\n * Role aliasing — the \"can be fulfilled by\" map, an authoring convenience.\n * A `roles` gate (or an `assignees` entry) names the role the author writes;\n * but the SAME capability is often carried by different role names depending\n * on how a given project deploys its Content Lake roles, and several roles may\n * legitimately do the job. Rather than enumerate every equivalent role inline\n * in each gate — or fork the definition per deployment — declare once here\n * which other roles also fulfill it.\n *\n * Each key is a role a gate/assignee names; its value lists the roles that\n * also satisfy it. The reserved key `\"*\"` lists roles that fulfill ANY gate\n * (e.g. `\"*\": [\"administrator\"]` — whatever this deployment's broad role is).\n *\n * Applied as an in-place expansion of the REQUIRED side, never the actor's\n * roles: the `roles` gate bakes the expanded membership into its desugared\n * GROQ at define time; `$assigned` expands the assignee's role at match time\n * (see {@link expandRequiredRoles}). Carried into the stored definition for\n * that runtime half.\n *\n * Advisory, like every engine gate — an alias only predicts what the\n * deployment's Content Lake ACLs already allow, it never grants access. An\n * alias the lake won't honor makes the gate predict \"allowed\" for a write the\n * lake then rejects, so keep it true to what's actually deployed.\n */\nconst RoleAliasesSchema = v.record(\n  NonEmpty,\n  v.pipe(v.array(NonEmpty), v.minLength(1, 'a role alias must list at least one fulfilling role')),\n)\nexport type RoleAliases = v.InferOutput<typeof RoleAliasesSchema>\n\nconst WORKFLOW_ROLES = ['workflow', 'child'] as const\n/** A definition's lifecycle role. `'child'` is spawn-only — see {@link isStartableDefinition}. */\nexport type WorkflowRole = (typeof WORKFLOW_ROLES)[number]\n\nfunction workflowFields<TState extends v.GenericSchema, TStage extends v.GenericSchema>(\n  state: TState,\n  stage: TStage,\n) {\n  return {\n    name: NonEmpty,\n    version: PositiveInt,\n    title: NonEmpty,\n    description: v.optional(v.string()),\n    /**\n     * Whether a human may start this workflow standalone. `'child'` marks a\n     * spawn-only definition — instantiated by a parent via `task.subworkflows`,\n     * never started cold from a picker. Omitted ⇒ `'workflow'` (startable).\n     * Advisory: consumers filter their start pickers on it (see\n     * {@link isStartableDefinition}); the engine does NOT refuse a\n     * `startInstance` on a `'child'` def — load-bearing `required` state is the\n     * runtime backstop.\n     */\n    role: v.optional(picklist(WORKFLOW_ROLES)),\n    /** Reference field: named for the target, holds the stage's `name`. */\n    initialStage: NonEmpty,\n    /** Workflow-scope state entries. Persist for the instance lifetime. */\n    state: v.optional(v.array(state)),\n    stages: v.pipe(v.array(stage), v.minLength(1, 'must declare at least one stage')),\n    /**\n     * Nullary named conditions — each `name: groq` entry is pre-evaluated\n     * and bound as the boolean `$name` var, composable with native GROQ.\n     * Redefining a built-in var is a deploy error (never silently shadow).\n     */\n    predicates: v.optional(v.record(groqIdentifier('`$<name>`'), ConditionSchema)),\n    /** Role aliasing for this definition — see {@link RoleAliasesSchema}. */\n    roleAliases: v.optional(RoleAliasesSchema),\n  }\n}\n\n/**\n * Structural schema for a STORED workflow definition — primitives only,\n * every reference scope resolved. Cross-field invariants (unique names,\n * transition targets, effect-name uniqueness, predicate shadowing) are\n * checked by `checkWorkflowInvariants` after desugar — see `defineWorkflow`.\n */\nconst WorkflowDefinitionSchema = v.strictObject(workflowFields(StateEntrySchema, StoredStageSchema))\nexport type WorkflowDefinition = v.InferOutput<typeof WorkflowDefinitionSchema>\n\n/** The authoring surface: stored primitives plus the define-time sugar. */\nexport const AuthoringWorkflowSchema = v.strictObject(\n  workflowFields(AuthoringStateEntrySchema, AuthoringStageSchema),\n)\nexport type AuthoringWorkflow = v.InferOutput<typeof AuthoringWorkflowSchema>\n\n/**\n * The lake document type for a deployed workflow definition. Engine-owned\n * standalone documents carry the platform namespace; in-array discriminators\n * stay bare. Mirrors {@link WORKFLOW_INSTANCE_TYPE}.\n */\nexport const WORKFLOW_DEFINITION_TYPE = 'sanity.workflow.definition'\n\n/**\n * Whether a human may start this definition standalone (the default). A\n * `role: 'child'` definition is spawn-only — instantiated by a parent via\n * `task.subworkflows`, so consumers exclude it from top-level start pickers.\n * Advisory: the engine does not enforce it (see the `required`-state backstop\n * for load-bearing init slots). Accepts any definition-shaped value (authored,\n * stored, deployed, or a projected list row).\n */\nexport function isStartableDefinition(definition: {role?: WorkflowRole | undefined}): boolean {\n  return definition.role !== 'child'\n}\n\n// Error formatting — turn validation issues into a multi-line,\n// path-prefixed message that points at the exact field the author got\n// wrong. Shared by structural parse errors (via {@link issuesFromValibot})\n// and cross-field invariant issues.\n\nexport interface ValidationIssue {\n  path: ReadonlyArray<PropertyKey>\n  message: string\n}\n\n/** The buildable path form desugar and the invariants accumulate issues under. */\nexport type IssuePath = (string | number)[]\n\nexport function formatValidationError(label: string, issues: readonly ValidationIssue[]): string {\n  const lines = issues.map((issue) => {\n    const path = issue.path.length === 0 ? '(root)' : formatPath(issue.path)\n    return `  - ${path}: ${issue.message}`\n  })\n  return `${label} failed validation (${issues.length} issue${\n    issues.length === 1 ? '' : 's'\n  }):\\n${lines.join('\\n')}`\n}\n\nexport function issuesFromValibot(issues: readonly v.BaseIssue<unknown>[]): ValidationIssue[] {\n  return issues.map((issue) => ({\n    path: issue.path ? issue.path.map((item) => item.key as PropertyKey) : [],\n    message: issue.message,\n  }))\n}\n\nfunction formatPath(path: ReadonlyArray<PropertyKey>): string {\n  let out = ''\n  for (const seg of path) {\n    if (typeof seg === 'number') out += `[${seg}]`\n    else out += out.length === 0 ? String(seg) : `.${String(seg)}`\n  }\n  return out\n}\n"],"names":["v"],"mappings":";;;;;;;;;;;;;;;;;;AAeO,SAAS,cAAc,OAA4D;AACxF,QAAM,UAAU,MAAM,OAAO,CAAC,MAAmB,MAAM,MAAS;AAChE,MAAI,QAAQ,WAAW;AACvB,WAAI,QAAQ,WAAW,IAAU,QAAQ,CAAC,IACnC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,MAAM;AACjD;ACAO,SAAS,oBACd,UACA,SACU;AACV,MAAI,YAAY,OAAW,QAAO,CAAC,GAAG,QAAQ;AAC9C,QAAM,0BAAU,IAAA;AAChB,aAAW,QAAQ,UAAU;AAC3B,QAAI,IAAI,IAAI;AACZ,eAAW,aAAa,QAAQ,IAAI,KAAK,CAAA,EAAI,KAAI,IAAI,SAAS;AAAA,EAChE;AACA,aAAW,aAAa,QAAQ,GAAG,KAAK,CAAA,EAAI,KAAI,IAAI,SAAS;AAC7D,SAAO,CAAC,GAAG,GAAG;AAChB;AAOO,SAAS,kBACd,YACA,UACA,SACS;AACT,MAAI,eAAe,UAAa,WAAW,WAAW,EAAG,QAAO;AAChE,QAAM,WAAW,IAAI,IAAI,oBAAoB,CAAC,QAAQ,GAAG,OAAO,CAAC;AACjE,SAAO,WAAW,KAAK,CAAC,SAAS,SAAS,IAAI,IAAI,CAAC;AACrD;AClCO,MAAM,gBAAgB,CAAC,WAAW,UAAU,QAAQ,WAAW,QAAQ,GAKjE,yBAAyB,CAAC,QAAQ,WAAW,QAAQ;AAG3D,SAAS,qBAAqB,QAAkD;AACrF,SAAQ,uBAAiD,SAAS,MAAM;AAC1E;AAIO,MAAM,eAAe,CAAC,YAAY,SAAS,MAAM,GAK3C,6BAA6B,CAAC,UAAU,QAAQ,QAAQ,GAKxD,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GCTM,WAAWA,aAAE,KAAKA,aAAE,UAAUA,aAAE,UAAU,GAAG,4BAA4B,CAAC,GAE1E,cAAcA,aAAE,KAAKA,aAAE,UAAUA,aAAE,WAAWA,aAAE,SAAS,CAAC,CAAC,GASpD,kBAAkB;AAE/B,SAAS,eAAe,cAAsB;AAC5C,SAAOA,aAAE;AAAA,IACPA,aAAE,OAAA;AAAA,IACFA,aAAE;AAAA,MACA;AAAA,MACA,uHACiC,YAAY;AAAA,IAAA;AAAA,EAC/C;AAEJ;AAOA,SAAS,SAAgE,SAAmB;AAC1F,SAAOA,aAAE;AAAA,IACP;AAAA,IACA,mCAAmC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC;AAAA,EAAA;AAE7E;AA0BA,MAAM,eAAgDA,aAAE;AAAA,EAAK,MAC3DA,aAAE,MAAM;AAAA;AAAA,IAENA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,MAAM,GAAE;AAAA,IACxCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,OAAO;AAAA,MACvB,OAAO;AAAA,IAAA,CACR;AAAA;AAAA,IAEDA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,SAAS,GAAG,OAAOA,aAAE,QAAA,EAAQ,CAAE;AAAA,IAC/DA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAG,OAAO,UAAS;AAAA,IAC1DA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAE;AAAA,IACvCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,MAAM,GAAE;AAAA,IACxCA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,OAAO,GAAE;AAAA,IACzCA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,WAAW;AAAA,MAC3B,OAAOA,aAAE,SAASA,aAAE,MAAM,CAACA,aAAE,QAAQ,UAAU,GAAGA,aAAE,QAAQ,OAAO,CAAC,CAAC,CAAC;AAAA,MACtE,OAAO;AAAA,MACP,MAAMA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAAA,CAC5B;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,QAAQ;AAAA,MACxB,QAAQA,aAAE,OAAO,UAAU,YAAY;AAAA,IAAA,CACxC;AAAA,EAAA,CACF;AACH,GAOM,uBAAuBA,aAAE,aAAa;AAAA,EAC1C,OAAO,SAAS,YAAY;AAAA,EAC5B,OAAO;AACT,CAAC,GAGK,0BAA0BA,aAAE,aAAa;AAAA,EAC7C,OAAOA,aAAE,SAAS,SAAS,YAAY,CAAC;AAAA,EACxC,OAAO;AACT,CAAC,GAYK,oBAA0DA,aAAE;AAAA,EAAK,MACrEA,aAAE,MAAM;AAAA,IACNA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,OAAO;AAAA,MACvB,OAAO;AAAA,MACP,QAAQ;AAAA,IAAA,CACT;AAAA,IACDA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAG,IAAIA,aAAE,MAAM,iBAAiB,GAAE;AAAA,IACvEA,aAAE,aAAa,EAAC,MAAMA,aAAE,QAAQ,KAAK,GAAG,IAAIA,aAAE,MAAM,iBAAiB,GAAE;AAAA,EAAA,CACxE;AACH;AAOA,SAAS,UAAqC,cAAiB;AAC7D,SAAO;AAAA,IACLA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,WAAW;AAAA,MAC3B,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,aAAa;AAAA,MAC7B,QAAQ;AAAA,IAAA,CACT;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,cAAc;AAAA,MAC9B,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,mBAAmB;AAAA,MACnC,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,IAAA,CACR;AAAA,IACDA,aAAE,aAAa;AAAA,MACb,MAAMA,aAAE,QAAQ,mBAAmB;AAAA,MACnC,QAAQ;AAAA,MACR,OAAO;AAAA,IAAA,CACR;AAAA,EAAA;AAEL;AAEA,MAAM,iBAAiBA,aAAE,QAAQ,QAAQ;AAAA,EACvC,GAAG,UAAU,oBAAoB;AAAA,EACjCA,aAAE,aAAa;AAAA,IACb,MAAMA,aAAE,QAAQ,YAAY;AAAA,IAC5B,MAAM;AAAA,IACN,QAAQ,SAAS,aAAa;AAAA,EAAA,CAC/B;AACH,CAAC,GAQK,2BAA2BA,aAAE,QAAQ,QAAQ,CAAC,GAAG,UAAU,oBAAoB,CAAC,CAAC,GAOjF,gBAAgBA,aAAE,aAAa;AAAA,EACnC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,aAAaA,aAAE;AAAA,IACbA,aAAE,aAAa;AAAA,MACb,OAAOA,aAAE,SAAS,QAAQ;AAAA,MAC1B,IAAIA,aAAE,SAAS,QAAQ;AAAA,IAAA,CACxB;AAAA,EAAA;AAEL,CAAC,GAEY,oBAAoBA,aAAE,QAAQ,QAAQ;AAAA,EACjD,GAAG,UAAU,uBAAuB;AAAA,EACpCA,aAAE,aAAa;AAAA,IACb,MAAMA,aAAE,QAAQ,YAAY;AAAA,IAC5B,MAAMA,aAAE,SAAS,QAAQ;AAAA,IACzB,QAAQ,SAAS,aAAa;AAAA,EAAA,CAC/B;AAAA,EACD;AACF,CAAC,GAOK,kBAAkB,SAAS;AAAA,EAC/B;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF,CAAC,GAEK,iBAAiB,eAAe,iBAAiB,GAWjD,uBAAuBA,aAAE,MAAM,CAACA,aAAE,QAAQ,EAAI,GAAG,QAAQ,CAAC,GAS1D,0BAA0BA,aAAE,MAAM,CAACA,aAAE,QAAQ,EAAI,GAAGA,aAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAKtF,SAAS,iBAAoD,UAAqB;AAChF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQlC,UAAUA,aAAE,SAASA,aAAE,SAAS;AAAA,IAChC,QAAQ;AAAA;AAAA,IAER,UAAUA,aAAE,SAAS,QAAQ;AAAA,EAAA;AAEjC;AAEA,MAAM,mBAAmBA,aAAE,aAAa,iBAAiB,oBAAoB,CAAC,GAGxE,+BAA+BA,aAAE,aAAa,iBAAiB,uBAAuB,CAAC,GAOvF,mBAAmBA,aAAE,aAAa;AAAA,EACtC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AACpC,CAAC,GAEY,4BAA4BA,aAAE,MAAM,CAAC,8BAA8B,gBAAgB,CAAC,GAS3F,kBAAkB,UAQX,eAAeA,aAAE,aAAa;AAAA,EACzC,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA,EAElC,UAAUA,aAAE,SAASA,aAAE,OAAOA,aAAE,UAAU,eAAe,CAAC;AAAA;AAAA,EAE1D,OAAOA,aAAE,SAASA,aAAE,OAAOA,aAAE,OAAA,GAAUA,aAAE,SAAS,CAAC;AACrD,CAAC,GAWK,oBAAoBA,aAAE,aAAa;AAAA,EACvC,MAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACD;AAAA,EACD,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,UAAUA,aAAE,SAASA,aAAE,SAAS;AAClC,CAAC;AAMD,SAAS,aAA0C,IAAS;AAC1D,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMlC,QAAQA,aAAE,SAAS,eAAe;AAAA,IAClC,QAAQA,aAAE,SAASA,aAAE,MAAM,iBAAiB,CAAC;AAAA,IAC7C,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,EAAA;AAE7C;AAEA,MAAM,qBAAqBA,aAAE,aAAa,aAAa,cAAc,CAAC,GAGhE,qBAAqB,SAAS,sBAAsB,GAcpD,2BAA2BA,aAAE,aAAa;AAAA,EAC9C,GAAG,aAAa,iBAAiB;AAAA,EACjC,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACnC,QAAQA,aAAE,SAAS,kBAAkB;AACvC,CAAC,GAUK,oBAAoBA,aAAE,aAAa;AAAA,EACvC,MAAMA,aAAE,QAAQ,OAAO;AAAA,EACvB,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,OAAOA,aAAE,MAAM,CAAC,UAAU,uBAAuB,CAAC;AAAA,EAClD,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACnC,QAAQA,aAAE,SAAS,eAAe;AAAA,EAClC,QAAQA,aAAE,SAASA,aAAE,MAAM,iBAAiB,CAAC;AAAA,EAC7C,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAC3C,CAAC,GAEY,wBAAwBA,aAAE,MAAM,CAAC,0BAA0B,iBAAiB,CAAC,GAapF,sBAAsBA,aAAE,aAAa;AAAA,EACzC,MAAM;AAAA,EACN,SAASA,aAAE,SAASA,aAAE,MAAM,CAAC,aAAaA,aAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC;AACjE,CAAC,GAEK,qBAAqBA,aAAE,aAAa;AAAA;AAAA,EAExC,SAAS;AAAA,EACT,YAAY;AAAA;AAAA,EAEZ,MAAMA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMpD,SAASA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AACzD,CAAC;AAUD,SAAS,WAIP,OAAe,QAAiB,IAAS;AACzC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,YAAYA,aAAE,SAAS,SAAS,CAAC,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACnD,QAAQA,aAAE,SAAS,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlC,cAAcA,aAAE,SAASA,aAAE,OAAO,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAM5D,cAAcA,aAAE,SAAS,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMxC,UAAUA,aAAE,SAAS,eAAe;AAAA,IACpC,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,IACzC,SAASA,aAAE,SAASA,aAAE,MAAM,MAAM,CAAC;AAAA,IACnC,cAAcA,aAAE,SAAS,kBAAkB;AAAA;AAAA,IAE3C,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA,EAAA;AAEpC;AAEA,MAAM,mBAAmBA,aAAE;AAAA,EACzB,WAAW,kBAAkB,oBAAoB,cAAc;AACjE,GAGa,sBAAsBA,aAAE;AAAA,EACnC,WAAW,2BAA2B,uBAAuB,iBAAiB;AAChF;AAQA,SAAS,iBACP,IACA,QACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,IAAI;AAAA,IACJ;AAAA;AAAA,IAEA,KAAKA,aAAE,SAASA,aAAE,MAAM,EAAE,CAAC;AAAA,IAC3B,SAASA,aAAE,SAASA,aAAE,MAAM,YAAY,CAAC;AAAA,EAAA;AAE7C;AAEA,MAAM,yBAAyBA,aAAE;AAAA,EAC/B,iBAAiB,0BAA0B,eAAe;AAC5D,GAQM,8BAA8BA,aAAE,QAAQ,QAAQ;AAAA,EACpD,GAAG,UAAU,uBAAuB;AAAA,EACpC;AACF,CAAC,GACY,4BAA4BA,aAAE;AAAA,EACzC,iBAAiB,6BAA6BA,aAAE,SAAS,eAAe,CAAC;AAC3E,GAYM,oBAAoB,SAAS,sBAAsB,GAGnD,mBAAmBA,aAAE,aAAa;AAAA;AAAA,EAEtC,OAAOA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA;AAAA,EAEnC,QAAQA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA;AAAA,EAEpC,YAAYA,aAAE,SAASA,aAAE,MAAM,QAAQ,CAAC;AAAA,EACxC,SAASA,aAAE;AAAA,IACTA,aAAE,MAAM,iBAAiB;AAAA,IACzBA,aAAE,UAAU,GAAG,wCAAwC;AAAA,EAAA;AAE3D,CAAC,GAGY,cAAcA,aAAE,aAAa;AAAA,EACxC,MAAM;AAAA,EACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,EAClC,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOP,WAAWA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAShC,UAAUA,aAAE,SAASA,aAAE,OAAO,UAAU,QAAQ,CAAC;AACnD,CAAC;AAQD,SAAS,YAKP,OAAe,MAAa,YAAyB,UAAqB;AAC1E,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAOA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAC5B,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA,IAClC,OAAOA,aAAE,SAASA,aAAE,MAAM,IAAI,CAAC;AAAA,IAC/B,aAAaA,aAAE,SAASA,aAAE,MAAM,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,IAK3C,QAAQA,aAAE,SAASA,aAAE,MAAM,WAAW,CAAC;AAAA;AAAA,IAEvC,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQhC,UAAUA,aAAE,SAASA,aAAE,OAAO,gBAAgB,QAAQ,CAAC;AAAA,EAAA;AAE3D;AAEA,MAAM,oBAAoBA,aAAE;AAAA,EAC1B,YAAY,kBAAkB,kBAAkB,wBAAwB,oBAAoB;AAC9F,GAGa,uBAAuBA,aAAE;AAAA,EACpC;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAEJ,GA6BM,oBAAoBA,aAAE;AAAA,EAC1B;AAAA,EACAA,aAAE,KAAKA,aAAE,MAAM,QAAQ,GAAGA,aAAE,UAAU,GAAG,qDAAqD,CAAC;AACjG,GAGM,iBAAiB,CAAC,YAAY,OAAO;AAI3C,SAAS,eACP,OACA,OACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,aAAaA,aAAE,SAASA,aAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUlC,MAAMA,aAAE,SAAS,SAAS,cAAc,CAAC;AAAA;AAAA,IAEzC,cAAc;AAAA;AAAA,IAEd,OAAOA,aAAE,SAASA,aAAE,MAAM,KAAK,CAAC;AAAA,IAChC,QAAQA,aAAE,KAAKA,aAAE,MAAM,KAAK,GAAGA,aAAE,UAAU,GAAG,iCAAiC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMhF,YAAYA,aAAE,SAASA,aAAE,OAAO,eAAe,WAAW,GAAG,eAAe,CAAC;AAAA;AAAA,IAE7E,aAAaA,aAAE,SAAS,iBAAiB;AAAA,EAAA;AAE7C;AAQiCA,aAAE,aAAa,eAAe,kBAAkB,iBAAiB,CAAC;AAI5F,MAAM,0BAA0BA,aAAE;AAAA,EACvC,eAAe,2BAA2B,oBAAoB;AAChE,GAQa,2BAA2B;AAUjC,SAAS,sBAAsB,YAAwD;AAC5F,SAAO,WAAW,SAAS;AAC7B;AAeO,SAAS,sBAAsB,OAAe,QAA4C;AAC/F,QAAM,QAAQ,OAAO,IAAI,CAAC,UAEjB,OADM,MAAM,KAAK,WAAW,IAAI,WAAW,WAAW,MAAM,IAAI,CACrD,KAAK,MAAM,OAAO,EACrC;AACD,SAAO,GAAG,KAAK,uBAAuB,OAAO,MAAM,SACjD,OAAO,WAAW,IAAI,KAAK,GAC7B;AAAA,EAAO,MAAM,KAAK;AAAA,CAAI,CAAC;AACzB;AAEO,SAAS,kBAAkB,QAA4D;AAC5F,SAAO,OAAO,IAAI,CAAC,WAAW;AAAA,IAC5B,MAAM,MAAM,OAAO,MAAM,KAAK,IAAI,CAAC,SAAS,KAAK,GAAkB,IAAI,CAAA;AAAA,IACvE,SAAS,MAAM;AAAA,EAAA,EACf;AACJ;AAEA,SAAS,WAAW,MAA0C;AAC5D,MAAI,MAAM;AACV,aAAW,OAAO;AACZ,WAAO,OAAQ,WAAU,OAAO,IAAI,GAAG,MACtC,OAAO,IAAI,WAAW,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,GAAG,CAAC;AAE9D,SAAO;AACT;;;;;;;;;;;;;;;;;;;;"}

package/dist/_chunks-es/schema.js

@@ -1,4 +1,24 @@
 import * as v from "valibot";
+function andConditions(parts) {
+  const present = parts.filter((p) => p !== void 0);
+  if (present.length !== 0)
+    return present.length === 1 ? present[0] : present.map((p) => `(${p})`).join(" && ");
+}
+function expandRequiredRoles(required, aliases) {
+  if (aliases === void 0) return [...required];
+  const out = /* @__PURE__ */ new Set();
+  for (const role of required) {
+    out.add(role);
+    for (const fulfiller of aliases[role] ?? []) out.add(fulfiller);
+  }
+  for (const fulfiller of aliases["*"] ?? []) out.add(fulfiller);
+  return [...out];
+}
+function actorFulfillsRole(actorRoles, required, aliases) {
+  if (actorRoles === void 0 || actorRoles.length === 0) return !1;
+  const accepted = new Set(expandRequiredRoles([required], aliases));
+  return actorRoles.some((role) => accepted.has(role));
+}
 const TASK_STATUSES = ["pending", "active", "done", "skipped", "failed"], TERMINAL_TASK_STATUSES = ["done", "skipped", "failed"];
 function isTerminalTaskStatus(status) {
   return TERMINAL_TASK_STATUSES.includes(status);
@@ -142,18 +162,32 @@ const StoredOpSchema = v.variant("type", [
   // The WHO-FOR entry: the inbox reverse-query reads it by kind, and the
   // rendered `$assigned` gate matches the caller against it.
   "assignees"
-]), StateEntryName = groqIdentifier("`$state.<name>`"), StateEntrySchema = v.strictObject({
-  type: StateKindSchema,
-  name: StateEntryName,
-  title: v.optional(v.string()),
-  description: v.optional(v.string()),
-  source: SourceSchema
-}), ClaimStateSchema = v.strictObject({
+]), StateEntryName = groqIdentifier("`$state.<name>`"), StoredEditableSchema = v.union([v.literal(!0), NonEmpty]), AuthoringEditableSchema = v.union([v.literal(!0), v.array(NonEmpty), NonEmpty]);
+function stateEntryFields(editable) {
+  return {
+    type: StateKindSchema,
+    name: StateEntryName,
+    title: v.optional(v.string()),
+    description: v.optional(v.string()),
+    /**
+     * When true, the caller MUST supply this entry at start (via
+     * `initialState`) or spawn (via the parent's `subworkflows.with`). A
+     * missing required entry throws rather than silently defaulting to
+     * `null`/`[]` — the same fail-fast an action's `required` param gets.
+     * Valid only on a workflow-scope `init`-sourced entry (deploy invariant).
+     */
+    required: v.optional(v.boolean()),
+    source: SourceSchema,
+    /** Who-may-edit this slot via the edit seam — see {@link StoredEditableSchema}. */
+    editable: v.optional(editable)
+  };
+}
+const StateEntrySchema = v.strictObject(stateEntryFields(StoredEditableSchema)), RawAuthoringStateEntrySchema = v.strictObject(stateEntryFields(AuthoringEditableSchema)), ClaimStateSchema = v.strictObject({
   type: v.literal("claim"),
   name: StateEntryName,
   title: v.optional(v.string()),
   description: v.optional(v.string())
-}), AuthoringStateEntrySchema = v.union([StateEntrySchema, ClaimStateSchema]), ConditionSchema = NonEmpty, EffectSchema = v.strictObject({
+}), AuthoringStateEntrySchema = v.union([RawAuthoringStateEntrySchema, ClaimStateSchema]), ConditionSchema = NonEmpty, EffectSchema = v.strictObject({
   name: NonEmpty,
   title: v.optional(v.string()),
   description: v.optional(v.string()),
@@ -318,7 +352,7 @@ const StoredTransitionSchema = v.strictObject(
    */
   metadata: v.optional(v.record(NonEmpty, NonEmpty))
 });
-function stageFields(state, task, transition) {
+function stageFields(state, task, transition, editable) {
   return {
     name: NonEmpty,
     title: v.optional(v.string()),
@@ -331,20 +365,46 @@ function stageFields(state, task, transition) {
      */
     guards: v.optional(v.array(GuardSchema)),
     /** Stage-scoped state entries. Resolved at stage entry. */
-    state: v.optional(v.array(state))
+    state: v.optional(v.array(state)),
+    /**
+     * Tighten-only editability overrides for the time this stage holds, keyed
+     * by an in-scope slot name. The slot's own `editable` is the ceiling; a
+     * stage value is ANDed with it at runtime, so an override can only NARROW
+     * (never open a slot the baseline left closed). An unlisted slot inherits
+     * its baseline.
+     */
+    editable: v.optional(v.record(StateEntryName, editable))
   };
 }
 const StoredStageSchema = v.strictObject(
-  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema)
+  stageFields(StateEntrySchema, StoredTaskSchema, StoredTransitionSchema, StoredEditableSchema)
 ), AuthoringStageSchema = v.strictObject(
-  stageFields(AuthoringStateEntrySchema, AuthoringTaskSchema, AuthoringTransitionSchema)
-);
+  stageFields(
+    AuthoringStateEntrySchema,
+    AuthoringTaskSchema,
+    AuthoringTransitionSchema,
+    AuthoringEditableSchema
+  )
+), RoleAliasesSchema = v.record(
+  NonEmpty,
+  v.pipe(v.array(NonEmpty), v.minLength(1, "a role alias must list at least one fulfilling role"))
+), WORKFLOW_ROLES = ["workflow", "child"];
 function workflowFields(state, stage) {
   return {
     name: NonEmpty,
     version: PositiveInt,
     title: NonEmpty,
     description: v.optional(v.string()),
+    /**
+     * Whether a human may start this workflow standalone. `'child'` marks a
+     * spawn-only definition — instantiated by a parent via `task.subworkflows`,
+     * never started cold from a picker. Omitted ⇒ `'workflow'` (startable).
+     * Advisory: consumers filter their start pickers on it (see
+     * {@link isStartableDefinition}); the engine does NOT refuse a
+     * `startInstance` on a `'child'` def — load-bearing `required` state is the
+     * runtime backstop.
+     */
+    role: v.optional(picklist(WORKFLOW_ROLES)),
     /** Reference field: named for the target, holds the stage's `name`. */
     initialStage: NonEmpty,
     /** Workflow-scope state entries. Persist for the instance lifetime. */
@@ -355,13 +415,18 @@ function workflowFields(state, stage) {
      * and bound as the boolean `$name` var, composable with native GROQ.
      * Redefining a built-in var is a deploy error (never silently shadow).
      */
-    predicates: v.optional(v.record(groqIdentifier("`$<name>`"), ConditionSchema))
+    predicates: v.optional(v.record(groqIdentifier("`$<name>`"), ConditionSchema)),
+    /** Role aliasing for this definition — see {@link RoleAliasesSchema}. */
+    roleAliases: v.optional(RoleAliasesSchema)
   };
 }
 v.strictObject(workflowFields(StateEntrySchema, StoredStageSchema));
 const AuthoringWorkflowSchema = v.strictObject(
   workflowFields(AuthoringStateEntrySchema, AuthoringStageSchema)
 ), WORKFLOW_DEFINITION_TYPE = "sanity.workflow.definition";
+function isStartableDefinition(definition) {
+  return definition.role !== "child";
+}
 function formatValidationError(label, issues) {
   const lines = issues.map((issue) => `  - ${issue.path.length === 0 ? "(root)" : formatPath(issue.path)}: ${issue.message}`);
   return `${label} failed validation (${issues.length} issue${issues.length === 1 ? "" : "s"}):
@@ -393,7 +458,11 @@ export {
   GROQ_IDENTIFIER,
   GuardSchema,
   WORKFLOW_DEFINITION_TYPE,
+  actorFulfillsRole,
+  andConditions,
+  expandRequiredRoles,
   formatValidationError,
+  isStartableDefinition,
   isTerminalTaskStatus,
   issuesFromValibot
 };