@sanity/workflow-cli 0.8.1 → 0.10.0

package/dist/lib/definitions.js

@@ -1,104 +1,40 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { isAbsolute, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { validateDefinition } from '@sanity/workflow-engine';
-import { loadDefinitionsSource } from "./config.js";
+import { WORKFLOW_DEFINITION_TYPE, errorMessage, tagScopeFilter, validateDefinition, } from '@sanity/workflow-engine';
 import { fail } from "./fail.js";
-/**
- * Turn a configured definitions source into a specifier `import()` can
- * load. Path-like values (relative or absolute) resolve against `cwd` and
- * become file URLs so they're imported as files, not bare package names;
- * anything else passes through as a module specifier (e.g. a workspace
- * package such as `@sanity/workflow-examples`).
- */
-export function resolveDefinitionsSpecifier(source, cwd) {
-    if (source.startsWith('.') || isAbsolute(source)) {
-        return pathToFileURL(resolve(cwd, source)).href;
-    }
-    return source;
+export function buildDefinitionShowQuery(flags) {
+    const params = { name: flags.name };
+    const filters = [`_type == "${WORKFLOW_DEFINITION_TYPE}"`, 'name == $name'];
+    if (flags.version !== undefined) {
+        params.version = flags.version;
+        filters.push('version == $version');
+    }
+    if (flags.tag) {
+        params.tag = flags.tag;
+        filters.push(tagScopeFilter());
+    }
+    const groq = `*[${filters.join(' && ')}] | order(version desc) [0]`;
+    return { groq, params };
 }
-/**
- * Pull the `allDefinitions` array out of an imported definitions module,
- * failing hard with a source-specific message when the module doesn't
- * expose it. Per-definition structure is validated downstream by
- * {@link collectValidationErrors}, so this only asserts the array shape.
- */
-export function extractDefinitions(mod, source) {
-    const exported = mod.allDefinitions;
-    if (!Array.isArray(exported)) {
-        fail(`Definitions module "${source}" has no \`allDefinitions\` array export.`, 'Export `allDefinitions: WorkflowDefinition[]` from the module named by WORKFLOW_DEFS.');
-    }
-    return exported;
+export async function fetchDeployedDefinition({ client, name, tag, version, }) {
+    const { groq, params } = buildDefinitionShowQuery({ name, tag, version });
+    const deployed = await client.fetch(groq, params, {
+        tag: 'definition.load',
+    });
+    if (deployed === null && version !== undefined) {
+        fail(`No deployed definition "${name}" v${version}.`);
+    }
+    return deployed ?? undefined;
 }
-/**
- * Resolve the configured definitions module and dynamic-import it. The
- * import is dynamic (not a static top-level import) so a `defineWorkflow`
- * throw inside the module — a missing `version`, a bad schema field —
- * surfaces here as a friendly CLI error rather than an oclif command-load
- * crash with a raw stack trace.
- */
-async function importDefinitions(source) {
-    const specifier = resolveDefinitionsSpecifier(source, process.cwd());
-    let mod;
-    try {
-        mod = await import(__rewriteRelativeImportExtension(specifier, true));
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        fail(`Failed to load definitions from "${source}":`, message);
-    }
-    return extractDefinitions(mod, source);
-}
-/**
- * Narrow the local batch to one definition `name`, failing with the
- * available names when there's no match. With `only` unset the whole batch passes
- * through (a fresh array, so callers can mutate without aliasing).
- */
-export function selectDefinitions(allDefinitions, only) {
-    if (!only)
+export function selectDefinitions(allDefinitions, { only, context = '' }) {
+    if (!only) {
         return [...allDefinitions];
+    }
     const filtered = allDefinitions.filter((d) => d.name === only);
     if (filtered.length === 0) {
         const available = allDefinitions.map((d) => d.name).join(', ');
-        fail(`No definition named "${only}".`, `Available: ${available}`);
+        fail(`${context}No definition named "${only}".`, `Available: ${available}`);
     }
     return filtered;
 }
-/**
- * The full local-definitions pipeline shared by `deploy` and
- * `definition diff`: resolve the `WORKFLOW_DEFS` source, import it,
- * narrow to `only` (when given), and fail on any validation error.
- */
-export async function loadValidatedDefinitions(only) {
-    const allDefinitions = await importDefinitions(loadDefinitionsSource());
-    const selected = selectDefinitions(allDefinitions, only);
-    const errors = collectValidationErrors(selected);
-    if (errors.length > 0) {
-        fail('Validation failed:', errors.join('\n'));
-    }
-    return selected;
-}
-/** {@link loadValidatedDefinitions} narrowed to exactly one definition name. */
-export async function loadValidatedDefinition(name) {
-    const [def] = await loadValidatedDefinitions(name);
-    // selectDefinitions already failed on no match; this narrows the
-    // indexed access for the type checker.
-    if (!def)
-        fail(`No definition named "${name}".`);
-    return def;
-}
-/**
- * Per-definition structural/GROQ checks plus one batch-level check the
- * engine doesn't do for us: duplicate `name` within the local set.
- * Returns the human-readable error lines; empty means the batch is valid.
- */
 export function collectValidationErrors(defs) {
     const errors = [];
     const seen = new Map();
@@ -114,9 +50,14 @@ export function collectValidationErrors(defs) {
             validateDefinition(d);
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            errors.push(`  · ${d.name}: ${message}`);
+            errors.push(`  · ${d.name}: ${errorMessage(err)}`);
         }
     }
     return errors;
 }
+export function validateOrFail(defs, context = '') {
+    const errors = collectValidationErrors(defs);
+    if (errors.length > 0) {
+        fail(`${context}Validation failed:`, errors.join('\n'));
+    }
+}

package/dist/lib/diff.d.ts

@@ -2,7 +2,10 @@ import type { DiffEntry } from '@sanity/workflow-engine';
 /** One summary line per diff entry, tagged create / unchanged. Definitions are
  *  immutable, so a content change is a new version (`create`), never an update. */
 export declare function summaryLines(entries: DiffEntry[]): string[];
-/** Render a JSON diff of `oldObj` → `newObj` as `+`/`-`/context lines. */
+/** Render a JSON diff of `oldObj` → `newObj` as `+`/`-`/context lines, long
+ *  unchanged runs collapsed to a dim `… N unchanged lines` marker. */
 export declare function diffLines(oldObj: object, newObj: object): string[];
-/** The full diff report: the summary block plus a per-change diff. */
+/** The full diff report: the summary block plus a per-change diff of the
+ *  authored content — the deploy envelope is stripped from both sides (the
+ *  version and docId already render on the summary line). */
 export declare function diffReport(entries: DiffEntry[]): string[];

package/dist/lib/diff.js

@@ -2,8 +2,6 @@ import { styleText } from 'node:util';
 import { diffJson } from 'diff';
 import logSymbols from 'log-symbols';
 import { sectionHeader } from "./ui.js";
-/** One summary line per diff entry, tagged create / unchanged. Definitions are
- *  immutable, so a content change is a new version (`create`), never an update. */
 export function summaryLines(entries) {
     const tags = {
         create: styleText('green', '+ create   '),
@@ -13,27 +11,73 @@ export function summaryLines(entries) {
         return `  ${tags[e.status]} ${e.name} v${e.version}  ${styleText('dim', `(${e.docId})`)}`;
     });
 }
-/** Render a JSON diff of `oldObj` → `newObj` as `+`/`-`/context lines. */
-export function diffLines(oldObj, newObj) {
-    const out = [];
-    for (const chunk of diffJson(oldObj, newObj)) {
+const CONTEXT_LINES = 3;
+const DEPLOY_STAMPED_KEYS = new Set(['tag', 'version', 'contentHash']);
+function authoredContent(doc) {
+    return Object.fromEntries(Object.entries(doc).filter(([key]) => !key.startsWith('_') && !DEPLOY_STAMPED_KEYS.has(key)));
+}
+function chunkKind(chunk) {
+    if (chunk.added) {
+        return 'added';
+    }
+    if (chunk.removed) {
+        return 'removed';
+    }
+    return 'context';
+}
+function taggedLines(oldObj, newObj) {
+    return diffJson(oldObj, newObj).flatMap((chunk) => {
         const chunkLines = chunk.value.split('\n');
-        // diffJson appends a trailing empty string when the chunk ends in "\n";
-        // drop it so we don't emit a blank line per chunk boundary.
-        if (chunkLines.at(-1) === '')
+        if (chunkLines.at(-1) === '') {
             chunkLines.pop();
-        for (const line of chunkLines) {
-            if (chunk.added)
-                out.push(styleText('green', `+ ${line}`));
-            else if (chunk.removed)
-                out.push(styleText('red', `- ${line}`));
-            else
-                out.push(styleText('dim', `  ${line}`));
         }
+        return chunkLines.map((text) => ({ kind: chunkKind(chunk), text }));
+    });
+}
+function collapseUnchanged(lines, context) {
+    const changed = lines.flatMap((line, i) => (line.kind === 'context' ? [] : [i]));
+    if (changed.length === 0) {
+        return lines;
     }
+    const keep = lines.map((_, i) => changed.some((c) => Math.abs(c - i) <= context));
+    const out = [];
+    let run = [];
+    const flushRun = () => {
+        if (run.length === 1) {
+            out.push(...run);
+        }
+        else if (run.length > 1) {
+            out.push({ kind: 'elision', count: run.length });
+        }
+        run = [];
+    };
+    lines.forEach((line, i) => {
+        if (keep[i]) {
+            flushRun();
+            out.push(line);
+        }
+        else {
+            run.push(line);
+        }
+    });
+    flushRun();
     return out;
 }
-/** The full diff report: the summary block plus a per-change diff. */
+function renderLine(line) {
+    if (line.kind === 'elision') {
+        return styleText('dim', `  … ${line.count} unchanged lines`);
+    }
+    if (line.kind === 'added') {
+        return styleText('green', `+ ${line.text}`);
+    }
+    if (line.kind === 'removed') {
+        return styleText('red', `- ${line.text}`);
+    }
+    return styleText('dim', `  ${line.text}`);
+}
+export function diffLines(oldObj, newObj) {
+    return collapseUnchanged(taggedLines(oldObj, newObj), CONTEXT_LINES).map(renderLine);
+}
 export function diffReport(entries) {
     const lines = ['', sectionHeader('Summary'), ...summaryLines(entries)];
     const changes = entries.filter((e) => e.status !== 'unchanged');
@@ -42,9 +86,7 @@ export function diffReport(entries) {
         return lines;
     }
     for (const e of changes) {
-        // For net-new docs, existing is undefined — render the whole expected
-        // doc as added lines so the operator sees what would land.
-        lines.push('', styleText('bold', `── ${e.name} v${e.version} ──`), ...diffLines(e.existing ?? {}, e.expected));
+        lines.push('', styleText('bold', `── ${e.name} v${e.version} ──`), ...diffLines(authoredContent(e.existing ?? {}), authoredContent(e.expected)));
     }
     return lines;
 }

package/dist/lib/env.d.ts

@@ -1,10 +1,8 @@
 export declare const ENV: {
-    readonly SANITY_PROJECT_ID: "SANITY_PROJECT_ID";
     readonly SANITY_AUTH_TOKEN: "SANITY_AUTH_TOKEN";
-    readonly SANITY_DATASET: "SANITY_DATASET";
     readonly SANITY_API_HOST: "SANITY_API_HOST";
-    readonly WORKFLOW_RESOURCE_TYPE: "WORKFLOW_RESOURCE_TYPE";
-    readonly WORKFLOW_RESOURCE_ID: "WORKFLOW_RESOURCE_ID";
-    readonly WORKFLOW_TAG: "WORKFLOW_TAG";
-    readonly WORKFLOW_DEFS: "WORKFLOW_DEFS";
 };
+/** The explicit env token, or undefined when unset/blank. The single owner
+ *  of "did the token come from the env?" — token resolution and the auth
+ *  recovery hint must never disagree on it. */
+export declare function envAuthToken(): string | undefined;

package/dist/lib/env.js

@@ -1,13 +1,8 @@
-// Typed env var definitions
 export const ENV = {
-    // Sanity client
-    SANITY_PROJECT_ID: 'SANITY_PROJECT_ID',
     SANITY_AUTH_TOKEN: 'SANITY_AUTH_TOKEN',
-    SANITY_DATASET: 'SANITY_DATASET',
     SANITY_API_HOST: 'SANITY_API_HOST',
-    // Workflow config
-    WORKFLOW_RESOURCE_TYPE: 'WORKFLOW_RESOURCE_TYPE',
-    WORKFLOW_RESOURCE_ID: 'WORKFLOW_RESOURCE_ID',
-    WORKFLOW_TAG: 'WORKFLOW_TAG',
-    WORKFLOW_DEFS: 'WORKFLOW_DEFS',
 };
+export function envAuthToken() {
+    const token = process.env[ENV.SANITY_AUTH_TOKEN]?.trim();
+    return token ? token : undefined;
+}

package/dist/lib/fail.d.ts

@@ -14,3 +14,15 @@ export declare function fail(headline: string, detail?: string): never;
  * helpers pure and unit-testable while giving callers one clean boundary.
  */
 export declare function failOnThrow<T>(headline: string, fn: () => T): T;
+/** An API rejection of the auth token itself — as opposed to a 403, where
+ *  the identity is valid but lacks the role for the operation. Walks the
+ *  `cause` chain because the 401 often arrives wrapped: the engine's
+ *  `/users/me` actor resolution rethrows it inside its own `Error`. */
+export declare function isAuthRejection(err: unknown): boolean;
+/**
+ * The detail block for a command failure: the error's message, plus the
+ * auth recovery hint when the API rejected the token. Every site that
+ * renders a caught command error should build its detail here, so the
+ * hint reaches the user no matter which call the token died at.
+ */
+export declare function failureDetail(err: unknown): string;

package/dist/lib/fail.js

@@ -1,33 +1,42 @@
 import { styleText } from 'node:util';
+import { ClientError } from '@sanity/client';
+import { errorMessage } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
-/**
- * Render a user-facing error and exit non-zero. Writes straight to
- * stderr — no oclif framing, no Node stack — so expected failures
- * (validation, missing input, conflicting flags) read clean.
- *
- * For unexpected failures (network, engine throw) prefer letting the
- * error propagate so the stack is visible for debugging.
- */
+import { envAuthToken } from "./env.js";
 export function fail(headline, detail) {
     process.stderr.write(`${styleText('red', `${logSymbols.error} ${headline}`)}\n`);
     if (detail !== undefined && detail !== '') {
         for (const line of detail.split('\n')) {
-            process.stderr.write(`  ${line}\n`);
+            process.stderr.write(`  ${styleText(['dim', 'red'], line)}\n`);
         }
     }
     process.exit(1);
 }
-/**
- * Run `fn`, funnelling a thrown env/validation error through {@link fail}
- * so an expected, user-fixable failure (missing input, bad value) reads
- * clean instead of as an oclif stack trace. Keeps the throwing `read*`
- * helpers pure and unit-testable while giving callers one clean boundary.
- */
 export function failOnThrow(headline, fn) {
     try {
         return fn();
     }
     catch (err) {
-        fail(headline, err instanceof Error ? err.message : String(err));
+        fail(headline, errorMessage(err));
     }
 }
+export function isAuthRejection(err) {
+    let current = err;
+    for (let depth = 0; depth < 5 && current !== undefined; depth++) {
+        if (current instanceof ClientError && current.statusCode === 401) {
+            return true;
+        }
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    return false;
+}
+function authRecoveryHint() {
+    if (envAuthToken() !== undefined) {
+        return 'The SANITY_AUTH_TOKEN token was rejected — check it is valid and has access to this project.';
+    }
+    return 'Your `sanity login` session may have expired — run `sanity login` and retry.';
+}
+export function failureDetail(err) {
+    const message = errorMessage(err);
+    return isAuthRejection(err) ? `${message}\n${authRecoveryHint()}` : message;
+}

package/dist/lib/flags.d.ts

@@ -1,5 +1,10 @@
-/** Selects the engine environment partition (e.g. prod, test).
- *  Resolved flag → WORKFLOW_TAG (required) in {@link loadWorkflowConfig}. */
+/** The environment tag (e.g. prod, test). For write commands it selects which
+ *  deployment in the discovered `sanity.workflow` config to act on (omittable
+ *  when only one is configured); for read commands it's an optional query
+ *  filter — and the resource disambiguator when a config spans more than one. */
 export declare const tagFlags: {
     tag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
 };
+export declare const jsonFlags: {
+    json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+};

package/dist/lib/flags.js

@@ -1,8 +1,12 @@
 import { Flags } from '@oclif/core';
-/** Selects the engine environment partition (e.g. prod, test).
- *  Resolved flag → WORKFLOW_TAG (required) in {@link loadWorkflowConfig}. */
 export const tagFlags = {
     tag: Flags.string({
-        description: 'Workflow environment tag (e.g. prod, test). Overrides WORKFLOW_TAG.',
+        description: 'Workflow environment tag (e.g. prod, test) — the deployment to target for writes; an optional filter for reads.',
+    }),
+};
+export const jsonFlags = {
+    json: Flags.boolean({
+        description: 'Emit structured JSON instead of rendered output.',
+        default: false,
     }),
 };

package/dist/lib/load-config.d.ts

@@ -0,0 +1,15 @@
+import { type WorkflowConfig } from '@sanity/workflow-engine';
+/**
+ * Discover the `sanity.workflow.{ts,js,mjs}` in `cwd`, import its default
+ * export, and validate it through {@link defineWorkflowConfig}. Any problem —
+ * no file, unloadable module, invalid config — exits through the clean `fail`
+ * path.
+ */
+export declare function loadWorkflowConfig(cwd?: string): Promise<WorkflowConfig>;
+/**
+ * {@link loadWorkflowConfig} for telemetry setup, which must never break (or
+ * exit) a command: `undefined` when the file is absent or unusable. A broken
+ * config is not swallowed for real — the command's own load reports it through
+ * the clean `fail` path; this caller just runs with telemetry off.
+ */
+export declare function loadWorkflowConfigIfPresent(cwd?: string): Promise<WorkflowConfig | undefined>;

package/dist/lib/load-config.js

@@ -0,0 +1,89 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { existsSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { errorMessage } from '@sanity/workflow-engine';
+import { defineWorkflowConfig } from '@sanity/workflow-engine/define';
+import { createJiti } from 'jiti';
+import { fail } from "./fail.js";
+const CONFIG_FILE_NAMES = [
+    'sanity.workflow.ts',
+    'sanity.workflow.js',
+    'sanity.workflow.mjs',
+];
+function findConfigFile(cwd) {
+    for (const name of CONFIG_FILE_NAMES) {
+        const candidate = join(cwd, name);
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+class ConfigLoadError extends Error {
+    headline;
+    detail;
+    constructor(headline, detail) {
+        super(`${headline} ${detail}`);
+        this.headline = headline;
+        this.detail = detail;
+    }
+}
+async function importDefault(filePath) {
+    const url = pathToFileURL(filePath).href;
+    try {
+        if (filePath.endsWith('.ts')) {
+            return await createJiti(dirname(filePath)).import(url, { default: true });
+        }
+        return (await import(__rewriteRelativeImportExtension(url, true))).default;
+    }
+    catch (err) {
+        throw new ConfigLoadError(`Failed to load ${basename(filePath)}:`, errorMessage(err));
+    }
+}
+const parsedConfigs = new Map();
+function parseConfigFile(filePath) {
+    const cached = parsedConfigs.get(filePath);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const parsed = importDefault(filePath).then((exported) => {
+        try {
+            return defineWorkflowConfig(exported);
+        }
+        catch (err) {
+            throw new ConfigLoadError(`Invalid config in ${basename(filePath)}:`, errorMessage(err));
+        }
+    });
+    parsedConfigs.set(filePath, parsed);
+    return parsed;
+}
+export async function loadWorkflowConfig(cwd = process.cwd()) {
+    const filePath = findConfigFile(cwd);
+    if (filePath === undefined) {
+        fail(`No ${CONFIG_FILE_NAMES[0]} found in ${cwd}.`, 'Create one that `export default defineWorkflowConfig({deployments: [...]})`.');
+    }
+    try {
+        return await parseConfigFile(filePath);
+    }
+    catch (err) {
+        if (err instanceof ConfigLoadError) {
+            fail(err.headline, err.detail);
+        }
+        throw err;
+    }
+}
+export async function loadWorkflowConfigIfPresent(cwd = process.cwd()) {
+    const filePath = findConfigFile(cwd);
+    if (filePath === undefined) {
+        return undefined;
+    }
+    return parseConfigFile(filePath).catch(() => undefined);
+}

package/dist/lib/operation-args.d.ts

@@ -1,29 +1,34 @@
-import type { Actor, OperationArgs } from '@sanity/workflow-engine';
-import type { WorkflowConfig } from './config.ts';
+import { type EngineScopeArgs, type OperationArgs, type WorkflowTelemetryLogger } from '@sanity/workflow-engine';
 /**
- * The write-verb arguments every engine operation shares: tag scope,
- * workflow resource, and the CLI's pinned actor ({@link SYSTEM_ACTOR}).
- * Spread by both the instance verbs ({@link buildOperationArgs}) and the
- * definition verbs (e.g. `definition delete`).
+ * The engine-scope a CLI verb needs: which tag partition and which resource
+ * the engine's own data lives in — {@link EngineScopeArgs} minus the client.
+ * A {@link import('@sanity/workflow-engine').WorkflowDeployment} satisfies it,
+ * so commands pass their resolved deployment straight through.
  */
-export declare function baseEngineArgs(config: WorkflowConfig): Pick<OperationArgs, 'tag' | 'workflowResource' | 'access'>;
+export type EngineScope = Pick<EngineScopeArgs, 'tag' | 'workflowResource'>;
 /**
- * Resolve the actor a write is attributed to. With a named user the fire
- * is pinned to it (plus any roles, so role-gated action filters pass);
- * without one the {@link SYSTEM_ACTOR} fallback applies. Roles without a
- * named user throw — they'd silently attach to nothing otherwise.
+ * The engine args every CLI verb shares: tag scope, workflow resource,
+ * the CLI's declared execution context — the advisory "via what" stamped
+ * on history; identity itself is always the token behind the client
+ * (`/users/me`), never injected — and the invocation's telemetry logger,
+ * so the engine's adoption vocabulary flows from CLI-driven operations
+ * (the raw-verb equivalent of `createEngine({telemetry})`). Spread by the
+ * instance verbs ({@link buildOperationArgs}), the definition verbs
+ * (e.g. `definition delete`), and reads like `diagnose`.
  */
-export declare function resolveActor(as: string | undefined, roles: string[]): Actor;
+export declare function baseEngineArgs(scope: EngineScope): EngineScope & Pick<EngineScopeArgs, 'executionContext'> & {
+    telemetry: WorkflowTelemetryLogger;
+};
 /**
  * {@link baseEngineArgs} plus the instance-operation fields (everything
  * but the client and the verb-specific fields). The `reason` is spread
  * conditionally because the engine's optional field rejects an explicit
  * `undefined` under `exactOptionalPropertyTypes`.
  */
-export declare function buildOperationArgs({ config, instanceId, reason, }: {
-    config: WorkflowConfig;
+export declare function buildOperationArgs({ scope, instanceId, reason, }: {
+    scope: EngineScope;
     instanceId: string;
     reason: string | undefined;
-}): Omit<OperationArgs, 'client'> & {
+}): OperationArgs & ReturnType<typeof baseEngineArgs> & {
     reason?: string;
 };

package/dist/lib/operation-args.js

@@ -1,47 +1,16 @@
-/**
- * The synthetic actor a CLI write is attributed to when the operator
- * doesn't name a real user. The engine resolves a real actor from
- * `/users/me`, which a token-only CLI can't reach; until the CLI hooks
- * into Sanity auth proper, writes act as this system identity.
- */
-const SYSTEM_ACTOR = { kind: 'system', id: 'workflow-cli' };
-/**
- * The write-verb arguments every engine operation shares: tag scope,
- * workflow resource, and the CLI's pinned actor ({@link SYSTEM_ACTOR}).
- * Spread by both the instance verbs ({@link buildOperationArgs}) and the
- * definition verbs (e.g. `definition delete`).
- */
-export function baseEngineArgs(config) {
+import { EXECUTION_KINDS, } from '@sanity/workflow-engine';
+import { cliTelemetry } from "./telemetry.js";
+export function baseEngineArgs(scope) {
     return {
-        tag: config.tag,
-        workflowResource: config.workflowResource,
-        access: { actor: SYSTEM_ACTOR },
+        tag: scope.tag,
+        workflowResource: scope.workflowResource,
+        executionContext: { kind: EXECUTION_KINDS.cli, id: 'workflow-cli' },
+        telemetry: cliTelemetry().logger,
     };
 }
-/**
- * Resolve the actor a write is attributed to. With a named user the fire
- * is pinned to it (plus any roles, so role-gated action filters pass);
- * without one the {@link SYSTEM_ACTOR} fallback applies. Roles without a
- * named user throw — they'd silently attach to nothing otherwise.
- */
-export function resolveActor(as, roles) {
-    if (as === undefined) {
-        if (roles.length > 0) {
-            throw new Error('--as-role requires --as <userId>');
-        }
-        return SYSTEM_ACTOR;
-    }
-    return { kind: 'user', id: as, ...(roles.length > 0 ? { roles } : {}) };
-}
-/**
- * {@link baseEngineArgs} plus the instance-operation fields (everything
- * but the client and the verb-specific fields). The `reason` is spread
- * conditionally because the engine's optional field rejects an explicit
- * `undefined` under `exactOptionalPropertyTypes`.
- */
-export function buildOperationArgs({ config, instanceId, reason, }) {
+export function buildOperationArgs({ scope, instanceId, reason, }) {
     return {
-        ...baseEngineArgs(config),
+        ...baseEngineArgs(scope),
         instanceId,
         ...(reason !== undefined ? { reason } : {}),
     };