@sanity/workflow-engine 0.27.0 → 0.29.0

package/dist/index.cjs

@@ -55,6 +55,53 @@ function findCurrentActivityEntry(host, activityName) {
     return findOpenStageEntry(host)?.activities.find(a => a.name === activityName);
 }
 
+const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
+
+function terminalState(instance) {
+    return instance.abortedAt !== void 0 ? "aborted" : instance.completedAt !== void 0 ? "completed" : "in-flight";
+}
+
+function isUnprimed(instance) {
+    return instance.stages.length === 0 && terminalState(instance) === "in-flight";
+}
+
+function parseDefinitionSnapshotValue(instance) {
+    try {
+        return normalizeLegacyActivityRequirements(JSON.parse(instance.definitionSnapshot));
+    } catch (err) {
+        invariants.rethrowWithContext(err, `Failed to parse definitionSnapshot on instance "${instance._id}"`);
+    }
+}
+
+function normalizeLegacyActivityRequirements(value) {
+    for (const stage of arrayMember(value, "stages")) for (const activity of arrayMember(stage, "activities")) normalizeLegacyRequirementMap(activity);
+    return value;
+}
+
+function arrayMember(value, key) {
+    if (typeof value != "object" || value === null) return [];
+    const member = value[key];
+    return Array.isArray(member) ? member : [];
+}
+
+function normalizeLegacyRequirementMap(value) {
+    if (typeof value != "object" || value === null) return;
+    const activity = value, requirements = activity.requirements;
+    typeof requirements != "object" || requirements === null || Array.isArray(requirements) || (activity.requirements = Object.entries(requirements).map(([name, query]) => ({
+        type: "groq",
+        name: name,
+        query: query
+    })));
+}
+
+function parseDefinitionSnapshot(instance) {
+    return parseDefinitionSnapshotValue(instance);
+}
+
+function parentRef(instance) {
+    return instance.ancestors.at(-1);
+}
+
 function effectiveEditable(baseline, override) {
     if (baseline === void 0) return;
     if (override === void 0) return baseline;
@@ -131,7 +178,7 @@ function resolveEditTarget(args) {
 }
 
 function fieldWindowOpen(instance, site) {
-    const terminal = invariants.terminalState(instance);
+    const terminal = terminalState(instance);
     if (terminal !== "in-flight") return {
         open: !1,
         detail: `instance ${terminal}`
@@ -198,7 +245,7 @@ function editDisabledReason(args) {
 }
 
 function instanceTerminalReason(instance) {
-    const terminal = invariants.terminalState(instance);
+    const terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) return {
         kind: "instance-aborted",
         abortedAt: instance.abortedAt
@@ -328,7 +375,7 @@ function instanceStartedData(args) {
 function instanceStartedDataFor(args) {
     return instanceStartedData({
         definition: {
-            ...invariants.parseDefinitionSnapshot(args.instance),
+            ...parseDefinitionSnapshot(args.instance),
             ...args.instance.pinnedContentHash !== void 0 ? {
                 contentHash: args.instance.pinnedContentHash
             } : {}
@@ -356,7 +403,7 @@ function stageTransitionedData(args) {
 }
 
 function openStage$1(instance) {
-    const definition = invariants.parseDefinitionSnapshot(instance);
+    const definition = parseDefinitionSnapshot(instance);
     return {
         definition: definition,
         stage: definition.stages.find(s => s.name === instance.currentStage)
@@ -402,6 +449,313 @@ function fieldEditedData(args) {
     };
 }
 
+const DATA_MODEL_VERSION = 7, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
+
+class ReaderModelAcknowledgementError extends invariants.WorkflowError {
+    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
+    expectedMinReaderModel;
+    engineMinReaderModel=DATA_MODEL_MIN_READER;
+    engineModelVersion=DATA_MODEL_VERSION;
+    documentationUrl=READER_MODEL_ROLLOUT_URL;
+    constructor(expectedMinReaderModel, context = "Deployment") {
+        const expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
+        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}.\nDo not change the acknowledgement yet: accepting ${DATA_MODEL_MIN_READER} authorizes this engine to write documents that older readers will refuse.\nUpgrade every Studio, CLI, MCP server, Function, and other runtime that reads engine-owned documents; verify that rollout in every environment sharing the workflow resource; then change the literal in deployment configuration and deploy the writer.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
+        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel;
+    }
+}
+
+function assertReaderModelAcknowledgement(expectedMinReaderModel, context) {
+    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel !== DATA_MODEL_MIN_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, context);
+}
+
+const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
+    id: "governed-model-stamps",
+    introducedInModel: 1,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
+}), Object.freeze({
+    id: "subject-field-kind",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A workflow-level subject field identifies the document a workflow is about."
+}), Object.freeze({
+    id: "typed-scalar-choice-lists",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Scalar fields may constrain writes to a persisted typed choice list."
+}), Object.freeze({
+    id: "action-semantics",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Ordinary actions may carry advisory workflow semantics."
+}), Object.freeze({
+    id: "inclusive-scalar-bounds",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "String, text, and number values may carry persisted inclusive bounds."
+}), Object.freeze({
+    id: "progress-field-kind",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A progress field kind carries application-defined 0–100 completion."
+}), Object.freeze({
+    id: "effect-claim-tokens",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
+}), Object.freeze({
+    id: "classified-principal-ids",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "unconditional",
+    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
+}), Object.freeze({
+    id: "readiness-requirements",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Start and activity readiness use named polymorphic requirement arrays."
+}), Object.freeze({
+    id: "due-date-field-kinds",
+    introducedInModel: 5,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
+}) ]);
+
+function recordOf(value) {
+    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
+}
+
+function recordsAt(record, key) {
+    const value = record[key];
+    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
+}
+
+function nestedFieldEntries(entries) {
+    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
+}
+
+function parsedDefinitionSnapshot(root) {
+    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
+        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
+        definitionSnapshot: root.definitionSnapshot
+    }));
+}
+
+function persistedDefinitionTree(document) {
+    const root = recordOf(document);
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
+    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
+}
+
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function hasChoiceList(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const options = recordOf(entry.options);
+        return options !== void 0 && Array.isArray(options.list);
+    });
+}
+
+function hasFieldKind(document, kind) {
+    return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
+}
+
+function definitionNodes(document) {
+    const root = recordOf(document);
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
+}
+
+function hasScalarValidation(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const validation = recordOf(entry.validation);
+        return typeof validation?.min == "number" || typeof validation?.max == "number";
+    });
+}
+
+function hasClaimTokens(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
+        const claim = recordOf(entry.claim);
+        return claim !== void 0 && typeof claim.claimToken == "string";
+    });
+}
+
+function hasReadinessRequirements(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
+}
+
+const featureDetectors = {
+    "governed-model-stamps": () => !0,
+    "subject-field-kind": document => hasFieldKind(document, "subject"),
+    "typed-scalar-choice-lists": hasChoiceList,
+    "action-semantics": hasActionSemantics,
+    "inclusive-scalar-bounds": hasScalarValidation,
+    "progress-field-kind": document => hasFieldKind(document, "progress"),
+    "effect-claim-tokens": hasClaimTokens,
+    "classified-principal-ids": () => !0,
+    "readiness-requirements": hasReadinessRequirements,
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
+};
+
+function requiredModelFeatures(documentType, document) {
+    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
+}
+
+function requiredReaderModel(documentType, document) {
+    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
+}
+
+function modelStampFor(args) {
+    return {
+        modelVersion: DATA_MODEL_VERSION,
+        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
+    };
+}
+
+function fieldTreeShape(value) {
+    if (Array.isArray(value)) return value.map(fieldTreeShape);
+    if (value === null) return "null";
+    if (typeof value == "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
+    }
+    return typeof value;
+}
+
+function modelVersionOf(doc) {
+    const stamp = doc.modelVersion;
+    return typeof stamp == "number" ? stamp : 0;
+}
+
+function minReaderModelOf(doc) {
+    const floor = doc.minReaderModel;
+    return typeof floor == "number" ? floor : modelVersionOf(doc);
+}
+
+class ModelVersionAheadError extends invariants.WorkflowError {
+    documentId;
+    documentModelVersion;
+    requiredReaderModel;
+    engineModelVersion;
+    constructor(args) {
+        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
+        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
+        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
+    }
+}
+
+function assertReadableModel(doc) {
+    const documentReaderModel = minReaderModelOf(doc);
+    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
+        documentId: doc._id,
+        documentModelVersion: modelVersionOf(doc),
+        requiredReaderModel: documentReaderModel
+    });
+    return doc;
+}
+
 function effectSites(def) {
     const sites = [];
     for (const stage of def.stages ?? []) for (const activity of stage.activities ?? []) for (const action of activity.actions ?? []) for (const effect of action.effects ?? []) sites.push({
@@ -876,12 +1230,8 @@ function renderWorkflowRead(read, ctx) {
             text: groqConditionDescribe.guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return groqConditionDescribe.phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return groqConditionDescribe.phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -903,6 +1253,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return groqConditionDescribe.phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return groqConditionDescribe.phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${groqConditionDescribe.guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -1803,12 +2171,16 @@ function derefBase(ref, snapshot) {
     };
 }
 
+function isRecord(value) {
+    return typeof value == "object" && value !== null && !Array.isArray(value);
+}
+
 function buildParams(args) {
     const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
     return {
         self: invariants.selfGdr(instance),
         fields: renderedFields(instance.fields ?? [], snapshot),
-        parent: invariants.parentRef(instance)?.id ?? null,
+        parent: parentRef(instance)?.id ?? null,
         ancestors: instance.ancestors.map(a => a.id),
         stage: instance.currentStage,
         now: now,
@@ -2273,6 +2645,12 @@ function isRevisionConflict(error) {
     return statusCode === 409 ? !0 : typeof message == "string" && message.includes("ifRevisionId check failed");
 }
 
+function isCreateIdCollision(error) {
+    if (typeof error != "object" || error === null) return !1;
+    const {message: message, responseBody: responseBody} = error;
+    return typeof message == "string" && message.includes("already exists") && (message.includes("Document by ID") || message.includes("create() failed")) ? !0 : typeof responseBody == "string" && responseBody.includes("documentAlreadyExistsError");
+}
+
 class ConcurrentEditFieldError extends invariants.WorkflowError {
     instanceId;
     target;
@@ -2325,7 +2703,7 @@ class CascadeLimitError extends invariants.WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2426,7 +2804,7 @@ async function runOps(args) {
             refSurface: refSurface,
             opsFromDefinition: opsFromDefinition
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2437,6 +2815,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2508,12 +2890,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2552,6 +2941,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return invariants.isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = invariants.validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2587,15 +3048,10 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, invariants.isAlwaysArrayFieldKind(entry._type) ? [] : null), 
+    {
         opType: op.type,
         target: op.target
     };
@@ -2634,7 +3090,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -3333,6 +3789,14 @@ function latestDeployedDefinitions(rows) {
     return [ ...byName.values() ];
 }
 
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
 function liveChildrenField(instance) {
     const live = liveSubworkflows(instance).length;
     return live > 0 ? {
@@ -3421,8 +3885,29 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
-    const {instance: instance} = input, terminal = invariants.terminalState(instance);
+    const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
         const reason = abortReason(instance);
         return {
@@ -3439,7 +3924,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -3576,7 +4061,7 @@ function liveSubworkflowRefs(instance) {
 }
 
 function readsRaw(ref) {
-    return ref.type === invariants.WORKFLOW_INSTANCE_TYPE || ref.type === "system.release";
+    return ref.type === WORKFLOW_INSTANCE_TYPE || ref.type === "system.release";
 }
 
 const DEFAULT_CONTENT_PERSPECTIVE = "drafts";
@@ -3818,10 +4303,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return invariants.isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4350,7 +4833,7 @@ const TransitionVia = v__namespace.exactOptional(v__namespace.picklist([ "transi
     _type: v__namespace.pipe(v__namespace.string(), v__namespace.check(t => !knownHistoryTypes.has(t), "must not shadow a known history variant"))
 }), HistoryEntrySchema = v__namespace.union([ v__namespace.variant("_type", HISTORY_ARMS), UnknownHistoryEntry ]), WorkflowInstanceSchema = v__namespace.looseObject(invariants.tolerantEntries()({
     _id: NonEmpty,
-    _type: v__namespace.literal(invariants.WORKFLOW_INSTANCE_TYPE),
+    _type: v__namespace.literal(WORKFLOW_INSTANCE_TYPE),
     _rev: v__namespace.string(),
     _createdAt: invariants.IsoTimestamp,
     _updatedAt: invariants.IsoTimestamp,
@@ -4383,7 +4866,7 @@ function parseInstanceDocument(doc) {
     return invariants.parsePersistedDoc({
         schema: WorkflowInstanceSchema,
         doc: doc,
-        docType: invariants.WORKFLOW_INSTANCE_TYPE
+        docType: WORKFLOW_INSTANCE_TYPE
     });
 }
 
@@ -4422,7 +4905,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -4829,7 +5314,7 @@ async function getInstanceDocument(client, instanceId) {
 }
 
 function readInstanceDoc(doc) {
-    return parseInstanceDocument(invariants.assertReadableModel(doc));
+    return parseInstanceDocument(assertReadableModel(doc));
 }
 
 async function reload({client: client, instanceId: instanceId, tag: tag}) {
@@ -4900,7 +5385,7 @@ function buildInstanceBase(args) {
         } : {}
     }, ...args.extraHistory ?? [] ], history = executionContext !== void 0 ? stampHistoryEntries(entries, executionContext) : entries, body = {
         _id: id,
-        _type: invariants.WORKFLOW_INSTANCE_TYPE,
+        _type: WORKFLOW_INSTANCE_TYPE,
         _rev: "",
         _createdAt: now,
         _updatedAt: now,
@@ -4929,7 +5414,7 @@ function buildInstanceBase(args) {
     };
     return {
         ...body,
-        ...invariants.modelStampFor({
+        ...modelStampFor({
             documentType: "instance",
             document: body
         })
@@ -5027,7 +5512,7 @@ async function readBatch(args) {
 }
 
 function validateRawDoc(doc, perspective) {
-    return perspective !== "raw" ? doc : doc._type === invariants.WORKFLOW_INSTANCE_TYPE ? readInstanceDoc(doc) : invariants.assertReadableModel(doc);
+    return perspective !== "raw" ? doc : doc._type === WORKFLOW_INSTANCE_TYPE ? readInstanceDoc(doc) : assertReadableModel(doc);
 }
 
 function groupReads(reads) {
@@ -5110,7 +5595,7 @@ async function loadContext({client: client, instanceId: instanceId, options: opt
         clientForGdr: options.clientForGdr,
         refSurface: options.refSurface,
         instance: instance,
-        definition: invariants.parseDefinitionSnapshot(instance),
+        definition: parseDefinitionSnapshot(instance),
         ...options.actor !== void 0 ? {
             actor: options.actor
         } : {},
@@ -5390,10 +5875,6 @@ function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
 }
 
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
 function optionalString(value) {
     return value === void 0 || typeof value == "string";
 }
@@ -5898,12 +6379,14 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
 
 async function upsertGuard(args) {
     const {client: client, doc: doc, exists: exists} = args;
-    if (!exists) {
+    if (!exists) try {
         await client.create(doc, {
             ...SYNC_COMMIT,
             tag: REQUEST_TAG.guardDeploy
         });
         return;
+    } catch (error) {
+        if (!isCreateIdCollision(error)) throw error;
     }
     const {_id: _id, _type: _type, _rev: _rev, _createdAt: _createdAt, _updatedAt: _updatedAt, ...body} = doc;
     await client.patch(doc._id).set(body).commit({
@@ -6249,7 +6732,7 @@ async function persistThenDeploy({ctx: ctx, mutation: mutation, deploy: deploy})
         committedRev: committed._rev,
         restore: instanceStateFields({
             ...ctx.instance,
-            minReaderModel: invariants.minReaderModelOf(ctx.instance)
+            minReaderModel: minReaderModelOf(ctx.instance)
         }),
         unset: ctx.instance.completedAt === void 0 ? [ "completedAt" ] : [],
         reversible: !spawned,
@@ -6615,16 +7098,16 @@ async function resolveDefinitionRef({client: client, ref: ref, tag: tag}) {
     };
     wantsExplicit && (params.version = ref.version);
     const result = await client.fetch(definitionLookupGroq(wantsExplicit), params);
-    return result ? invariants.assertReadableModel(result) : null;
+    return result ? assertReadableModel(result) : null;
 }
 
 async function prepareChildInstance(args) {
     const {client: client, parent: parent, definition: definition, initialFields: initialFields, context: context, actor: actor, now: now, refSurface: refSurface} = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = {
         id: invariants.gdrFromResource(workflowResource, childDocId),
-        type: invariants.WORKFLOW_INSTANCE_TYPE
+        type: WORKFLOW_INSTANCE_TYPE
     }, ancestors = [ ...parent.ancestors, {
         id: invariants.selfGdr(parent),
-        type: invariants.WORKFLOW_INSTANCE_TYPE
+        type: WORKFLOW_INSTANCE_TYPE
     } ], inheritedPerspective = parent.perspective, fieldDiscards = [], childFields = await resolveDeclaredFields({
         entryDefs: definition.fields,
         initialFields: initialFields,
@@ -6929,53 +7412,460 @@ async function advisoryCan({instance: instance, identity: identity, grants: gran
     return can;
 }
 
-function requirementDescriptor(requirement) {
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
+
+function attributeEntry(row) {
+    if (!(!isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
+}
+
+function normalizeUserAttributes(response) {
+    if (!isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
+    }
+    return out;
+}
+
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
+
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
     return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
         } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
+        ...grants !== void 0 ? {
+            grants: grants
         } : {}
     };
 }
 
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
 }
 
-class ActionDisabledError extends invariants.WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
 }
 
-class StartNotAllowedError extends invariants.WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
 }
 
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
 }
 
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
+        client: client,
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
+    });
+}
+
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${invariants.errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${invariants.errorMessage(err)}`, {
+            cause: err
+        });
+    }
+}
+
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
+}
+
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
+        instance: args.instance,
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
+    });
+}
+
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends invariants.WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends invariants.WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
     "activity-not-active": r => `activity status is "${r.status}"`,
     "stage-terminal": r => `stage "${r.stage}" is terminal`,
     "instance-completed": r => `instance completed at ${r.completedAt}`,
@@ -7049,7 +7939,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7061,10 +7952,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -7408,7 +8297,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
     }) : await buildEngineContext({
         client: client,
         instance: instance,
-        definition: invariants.parseDefinitionSnapshot(instance),
+        definition: parseDefinitionSnapshot(instance),
         ...contextOptions
     });
     if (isTerminal(ctx)) return {
@@ -7589,7 +8478,7 @@ async function loadInstancesById(client, ids) {
     const children = await client.fetch("*[_id in $ids]", {
         ids: ids
     });
-    return new Map(children.filter(child => child._type === invariants.WORKFLOW_INSTANCE_TYPE).map(child => {
+    return new Map(children.filter(child => child._type === WORKFLOW_INSTANCE_TYPE).map(child => {
         const instance = readInstanceDoc(child);
         return [ instance._id, instance ];
     }));
@@ -7649,10 +8538,10 @@ async function propagateToAncestors(args) {
 async function loadPropagationPair({client: client, instanceId: instanceId, instance: instance}) {
     const child = instance ?? await getInstanceDocument(client, instanceId);
     if (!child) return;
-    const parentGdr = invariants.parentRef(child);
+    const parentGdr = parentRef(child);
     if (parentGdr === void 0) return;
     const parentDoc = await client.getDocument(invariants.toBareId(parentGdr.id));
-    if (!(!parentDoc || parentDoc._type !== invariants.WORKFLOW_INSTANCE_TYPE)) return {
+    if (!(!parentDoc || parentDoc._type !== WORKFLOW_INSTANCE_TYPE)) return {
         child: child,
         parent: readInstanceDoc(parentDoc)
     };
@@ -7679,7 +8568,7 @@ async function buildCascadeStepContext(args, instance) {
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
         instance: instance,
-        definition: invariants.parseDefinitionSnapshot(instance),
+        definition: parseDefinitionSnapshot(instance),
         ...args.clock ? {
             clock: args.clock
         } : {},
@@ -7730,7 +8619,7 @@ function stampSpawnBatch({mutation: mutation, parent: parent, children: children
 function requireSpawnBatchChild({parent: parent, children: children, childId: childId}) {
     const child = children.get(childId);
     if (child === void 0) throw new Error(`Spawn batch child ${childId} disappeared`);
-    const expectedParent = invariants.parentRef(child);
+    const expectedParent = parentRef(child);
     if (expectedParent === void 0 || invariants.toBareId(expectedParent.id) !== parent._id) throw new Error(`Spawn batch child ${childId} does not belong to parent ${parent._id}`);
     return child;
 }
@@ -7753,7 +8642,7 @@ async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: c
         at: ctx.now,
         instanceRef: {
             id: childUri,
-            type: invariants.WORKFLOW_INSTANCE_TYPE
+            type: WORKFLOW_INSTANCE_TYPE
         },
         detail: `Instance "${child._id}" names this instance as its parent but no subworkflow-registry row matches it, so its state cannot drive any gate here.`
     }), await persist(ctx, mutation));
@@ -7761,7 +8650,7 @@ async function recordOrphanedPropagation({ctx: ctx, mutation: mutation, child: c
 
 function startMutation(instance) {
     return {
-        minReaderModel: invariants.minReaderModelOf(instance),
+        minReaderModel: minReaderModelOf(instance),
         currentStage: instance.currentStage,
         fields: (instance.fields ?? []).map(s => ({
             ...s
@@ -7828,7 +8717,7 @@ function instanceStateFields(src) {
         } : {}
     };
     return {
-        ...invariants.modelStampFor({
+        ...modelStampFor({
             documentType: "instance",
             document: state,
             storedMinReaderModel: src.minReaderModel
@@ -8307,352 +9196,109 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     });
     const pending = requirePendingEffect(ctx.instance, effectKey), reason = staleClaimReason({
         pending: pending,
-        claimToken: claimToken,
-        now: ctx.now
-    });
-    if (reason !== void 0) throw new StaleEffectClaimError({
-        instanceId: ctx.instance._id,
-        effectKey: effectKey,
-        reason: reason
-    });
-    const validatedOps = validateEffectOps(ops, pending.name);
-    if (validatedOps.length === 0) throw new EffectOpsInvalidError({
-        effect: pending.name,
-        issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
-    });
-    const mutation = startMutation(ctx.instance);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), renewClaimLease({
-        mutation: mutation,
-        effectKey: effectKey,
-        now: ctx.now,
-        leaseMs: leaseMs
-    }), await runOps({
-        ops: validatedOps,
-        mutation: mutation,
-        stage: ctx.instance.currentStage,
-        origin: {
-            effect: pending.name
-        },
-        params: pending.params,
-        actor: ctx.actor,
-        self: invariants.selfGdr(ctx.instance),
-        now: ctx.now,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
-    }), await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: ctx.instance.currentStage,
-        didChangeState: !0
-    }), {
-        effectKey: effectKey,
-        effect: pending.name
-    };
-}
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
-        },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
-    };
-}
-
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
-
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
-}
-
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
-        client: client,
-        principalId: resourceId
-    });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
+        claimToken: claimToken,
+        now: ctx.now
+    });
+    if (reason !== void 0) throw new StaleEffectClaimError({
+        instanceId: ctx.instance._id,
+        effectKey: effectKey,
+        reason: reason
+    });
+    const validatedOps = validateEffectOps(ops, pending.name);
+    if (validatedOps.length === 0) throw new EffectOpsInvalidError({
+        effect: pending.name,
+        issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
     });
+    const mutation = startMutation(ctx.instance);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), renewClaimLease({
+        mutation: mutation,
+        effectKey: effectKey,
+        now: ctx.now,
+        leaseMs: leaseMs
+    }), await runOps({
+        ops: validatedOps,
+        mutation: mutation,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
+        },
+        params: pending.params,
+        actor: ctx.actor,
+        self: invariants.selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: ctx.instance.currentStage,
+        didChangeState: !0
+    }), {
+        effectKey: effectKey,
+        effect: pending.name
+    };
 }
 
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
 
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
+        client: client,
+        instanceId: instanceId,
+        options: options
+    });
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
+    });
 }
 
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -8704,7 +9350,7 @@ async function whatIfFireAction(args) {
 
 function replayable(args) {
     const {instance: instance, stage: stage, action: action} = args;
-    if (invariants.terminalState(instance) !== "in-flight" || (action.params ?? []).length > 0 || action.spawn !== void 0) return !1;
+    if (terminalState(instance) !== "in-flight" || (action.params ?? []).length > 0 || action.spawn !== void 0) return !1;
     const primed = new Set((findOpenStageEntry(instance)?.activities ?? []).map(e => e.name));
     return (stage.activities ?? []).every(declared => primed.has(declared.name)) ? !(stage.activities ?? []).flatMap(declared => declared.actions ?? []).some(sibling => invariants.isCascadeFired(sibling) && sibling.spawn !== void 0) : !1;
 }
@@ -8836,7 +9482,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     invariants.validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -8844,7 +9490,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = invariants.parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -8869,6 +9515,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -8883,6 +9532,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -8908,7 +9584,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -8925,22 +9601,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = invariants.lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
-        actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -8989,6 +9657,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -9005,6 +9674,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9160,6 +9830,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: invariants.deriveActivityKind(activity),
         classification: invariants.deriveExecutorClassification(activity),
@@ -9330,9 +10001,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -9404,7 +10079,7 @@ function idsArm(filter, params) {
 function instancesQuery(args) {
     const {tag: tag, filter: filter = {}} = args;
     if (invariants.validateTag(tag), filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new invariants.ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
-    const conditions = [ `_type == "${invariants.WORKFLOW_INSTANCE_TYPE}"`, invariants.tagScopeFilter() ], params = {
+    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, invariants.tagScopeFilter() ], params = {
         tag: tag
     };
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
@@ -9613,7 +10288,7 @@ function planDefinitionDeploy({def: def, latest: latest, target: target}) {
         tag: target.tag,
         version: version,
         contentHash: contentHash,
-        ...invariants.modelStampFor({
+        ...modelStampFor({
             documentType: "definition",
             document: expanded
         })
@@ -9690,7 +10365,7 @@ async function loadDefinition({client: client, definition: definition, version:
             definition: definition,
             version: version
         });
-        return invariants.assertReadableModel(doc);
+        return assertReadableModel(doc);
     }
     const latest = await loadLatestDeployed({
         client: client,
@@ -9708,14 +10383,14 @@ async function loadLatestDeployed({client: client, definition: definition, tag:
         definition: definition,
         tag: tag
     });
-    return doc ? invariants.assertReadableModel(doc) : void 0;
+    return doc ? assertReadableModel(doc) : void 0;
 }
 
 async function loadDefinitionVersions({client: client, definition: definition, tag: tag}) {
     return (await client.fetch(`*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${invariants.tagScopeFilter()}] | order(version desc)`, {
         definition: definition,
         tag: tag
-    })).map(invariants.assertReadableModel);
+    })).map(assertReadableModel);
 }
 
 async function loadDefinitionVersionsOrThrow({client: client, definition: definition, tag: tag}) {
@@ -9811,7 +10486,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -9824,10 +10500,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10103,8 +10777,8 @@ async function resumeStart(args) {
         version: args.version
     });
     if (mismatch !== void 0) throw new invariants.ContractViolationError(`startInstance: instanceId "${existing._id}" already exists and ${mismatch}. A supplied instanceId is start's idempotency key — reuse one only to retry the same start.`);
-    if (existing.stages.length === 0 && invariants.terminalState(existing) !== "in-flight") throw new invariants.ContractViolationError(`startInstance: instanceId "${existing._id}" belongs to a start that was discarded (aborted before it finished starting) — mint a new id to start again.`);
-    const completesStart = invariants.isUnprimed(existing), emitStarted = () => resolveTelemetry(args.telemetry).log(WorkflowInstanceStarted, instanceStartedDataFor({
+    if (existing.stages.length === 0 && terminalState(existing) !== "in-flight") throw new invariants.ContractViolationError(`startInstance: instanceId "${existing._id}" belongs to a start that was discarded (aborted before it finished starting) — mint a new id to start again.`);
+    const completesStart = isUnprimed(existing), emitStarted = () => resolveTelemetry(args.telemetry).log(WorkflowInstanceStarted, instanceStartedDataFor({
         instance: existing,
         initialFieldCount: args.initialFieldCount,
         viaSpawn: !1
@@ -10317,6 +10991,9 @@ function buildEngineCallOptions(args) {
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -10411,7 +11088,7 @@ async function deleteDefinition(args) {
 async function assertNoSpawnReferrers({client: client, tag: tag, definition: definition, targets: targets, lastVersionGoes: lastVersionGoes}) {
     const deployed = (await client.fetch(`*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && ${invariants.tagScopeFilter()}]`, {
         tag: tag
-    })).map(invariants.assertReadableModel), targetIds = new Set(targets.map(d => d._id)), targetVersions = new Set(targets.map(d => d.version)), referrers = deployed.filter(d => !targetIds.has(d._id)).filter(d => refsOf(d).some(ref => ref.name === definition && (typeof ref.version == "number" ? targetVersions.has(ref.version) : lastVersionGoes)));
+    })).map(assertReadableModel), targetIds = new Set(targets.map(d => d._id)), targetVersions = new Set(targets.map(d => d.version)), referrers = deployed.filter(d => !targetIds.has(d._id)).filter(d => refsOf(d).some(ref => ref.name === definition && (typeof ref.version == "number" ? targetVersions.has(ref.version) : lastVersionGoes)));
     if (referrers.length > 0) throw new invariants.DefinitionInUseError({
         definition: definition,
         blockedBy: {
@@ -10426,7 +11103,7 @@ async function assertNoSpawnReferrers({client: client, tag: tag, definition: def
 
 async function nonTerminalInstanceIds({client: client, tag: tag, definition: definition, version: version}) {
     const versionFilter = version === void 0 ? "" : " && pinnedVersion == $version";
-    return (await client.fetch(`*[_type == "${invariants.WORKFLOW_INSTANCE_TYPE}" && definition == $definition && ${invariants.tagScopeFilter()} && ${inFlightFilter()}${versionFilter}] | order(_id asc){_id}`, {
+    return (await client.fetch(`*[_type == "${WORKFLOW_INSTANCE_TYPE}" && definition == $definition && ${invariants.tagScopeFilter()} && ${inFlightFilter()}${versionFilter}] | order(_id asc){_id}`, {
         definition: definition,
         tag: tag,
         ...version !== void 0 ? {
@@ -10471,12 +11148,12 @@ async function fetchStartSlice(args) {
             includeCompleted: !0
         }
     });
-    return (await client.fetch(query, params)).map(invariants.assertReadableModel).map(projectStartSliceRow);
+    return (await client.fetch(query, params)).map(assertReadableModel).map(projectStartSliceRow);
 }
 
 const workflow = {
     deployDefinitions: async rawArgs => {
-        invariants.assertReaderModelAcknowledgement(rawArgs.expectedMinReaderModel);
+        assertReaderModelAcknowledgement(rawArgs.expectedMinReaderModel);
         const args = taggedScope(rawArgs, REQUEST_TAG.deploy), {client: client, tag: tag, resourceAliases: resourceAliases} = args;
         invariants.validateTag(tag);
         const definitions = args.definitions.map(def => parseDefinitionInput(def, "workflow.deployDefinitions"));
@@ -11102,7 +11779,7 @@ const workflow = {
             instance: instance
         }), reserved = await renderConditionScope({
             instance: instance,
-            definition: invariants.parseDefinitionSnapshot(instance),
+            definition: parseDefinitionSnapshot(instance),
             snapshot: snapshot,
             now: clock()
         }), tree = groqJs.parse(groq, {
@@ -11181,7 +11858,7 @@ const workflow = {
         invariants.validateTag(tag);
         const clock = args.clock ?? wallClock, deployed = (await client.fetch(latestDefinitionsGroq(), {
             tag: tag
-        })).map(invariants.assertReadableModel);
+        })).map(assertReadableModel);
         let slice;
         return applicableDefinitions({
             definitions: deployed,
@@ -11563,7 +12240,7 @@ async function verifyDeployedDefinitionsInternal(args) {
     invariants.validateTag(tag);
     const log = logger("verifyDeployedDefinitions"), definitions = (await client.fetch(definitionsListGroq("asc"), {
         tag: tag
-    })).map(invariants.assertReadableModel), seen = [], missingByName = /* @__PURE__ */ new Map;
+    })).map(assertReadableModel), seen = [], missingByName = /* @__PURE__ */ new Map;
     for (const def of definitions) seen.push({
         name: def.name,
         version: def.version,
@@ -12008,7 +12685,7 @@ function createInstanceSession(args) {
         }, uri = invariants.gdrFromResource(owned.resource, owned.doc._id);
         if (uri === selfUri()) {
             const rawStamp = owned.doc._updatedAt;
-            !invariants.isParseableInstant(rawStamp) || owned.doc._type !== invariants.WORKFLOW_INSTANCE_TYPE ? asHeldInstance(owned.doc) : Date.parse(rawStamp) > Date.parse(instance._updatedAt) && (instance = asHeldInstance(owned.doc));
+            !invariants.isParseableInstant(rawStamp) || owned.doc._type !== WORKFLOW_INSTANCE_TYPE ? asHeldInstance(owned.doc) : Date.parse(rawStamp) > Date.parse(instance._updatedAt) && (instance = asHeldInstance(owned.doc));
             return;
         }
         target.set(uri, owned);
@@ -12031,7 +12708,7 @@ function createInstanceSession(args) {
     let parsedDefinition;
     const definitionOf = () => (parsedDefinition?.source !== instance && (parsedDefinition = {
         source: instance,
-        definition: invariants.parseDefinitionSnapshot(instance)
+        definition: parseDefinitionSnapshot(instance)
     }), parsedDefinition.definition), siteKey = site => JSON.stringify([ site.scope, site.activity ?? null, site.name ]), stagePreview = ({target: target, mode: mode, value: value}) => {
         const site = previewSiteOf({
             instance: instance,
@@ -12075,7 +12752,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12097,6 +12774,9 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
@@ -12670,7 +13350,7 @@ function attributeMember({member: member, group: group, chain: chain}) {
 }
 
 function diffEntry({def: rawDef, latestRaw: latestRaw, target: target}) {
-    invariants.assertReaderModelAcknowledgement(target.expectedMinReaderModel);
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
     const def = parseDefinitionInput(rawDef, "diffEntry"), plan = planDefinitionDeploy({
         def: def,
         latest: asLatest(latestRaw),
@@ -12702,7 +13382,7 @@ function asLatest(raw) {
 }
 
 async function computeDiffEntries({client: client, defs: defs, target: target}) {
-    invariants.assertReaderModelAcknowledgement(target.expectedMinReaderModel);
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
     const entries = [];
     for (const rawDef of defs) {
         const def = parseDefinitionInput(rawDef, "computeDiffEntries"), latest = await loadLatestDeployed({
@@ -12792,7 +13472,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -12897,6 +13577,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -12905,6 +13589,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -12951,7 +13643,7 @@ const HISTORY_DISPLAY = {
         title: "Workflow definition",
         description: "An immutable workflow blueprint, addressed by `name` + `version`."
     },
-    [invariants.WORKFLOW_INSTANCE_TYPE]: {
+    [WORKFLOW_INSTANCE_TYPE]: {
         title: "Workflow instance",
         description: "A running (or finished) workflow against its declared fields."
     }
@@ -13030,11 +13722,7 @@ exports.CONDITION_VARS = invariants.CONDITION_VARS;
 
 exports.ContractViolationError = invariants.ContractViolationError;
 
-exports.DATA_MODEL_CHANGES = invariants.DATA_MODEL_CHANGES;
-
-exports.DATA_MODEL_MIN_READER = invariants.DATA_MODEL_MIN_READER;
-
-exports.DATA_MODEL_VERSION = invariants.DATA_MODEL_VERSION;
+exports.DECISION_SEMANTICS = invariants.DECISION_SEMANTICS;
 
 exports.DEFAULT_TRANSITION_WHEN = invariants.DEFAULT_TRANSITION_WHEN;
 
@@ -13058,15 +13746,11 @@ exports.GUARD_PREDICATE_VARS = invariants.GUARD_PREDICATE_VARS;
 
 exports.InstanceNotFoundError = invariants.InstanceNotFoundError;
 
-exports.ModelVersionAheadError = invariants.ModelVersionAheadError;
-
 exports.PersistedDocShapeError = invariants.PersistedDocShapeError;
 
-exports.READER_MODEL_ROLLOUT_URL = invariants.READER_MODEL_ROLLOUT_URL;
-
 exports.RESERVED_CONDITION_VARS = invariants.RESERVED_CONDITION_VARS;
 
-exports.ReaderModelAcknowledgementError = invariants.ReaderModelAcknowledgementError;
+exports.SIGNAL_SEMANTICS = invariants.SIGNAL_SEMANTICS;
 
 exports.START_FILTER_VARS = invariants.START_FILTER_VARS;
 
@@ -13078,14 +13762,8 @@ exports.SpawnContractsInvalidError = invariants.SpawnContractsInvalidError;
 
 exports.WORKFLOW_DEFINITION_TYPE = invariants.WORKFLOW_DEFINITION_TYPE;
 
-exports.WORKFLOW_INSTANCE_TYPE = invariants.WORKFLOW_INSTANCE_TYPE;
-
 exports.WorkflowError = invariants.WorkflowError;
 
-exports.assertReadableModel = invariants.assertReadableModel;
-
-exports.assertReaderModelAcknowledgement = invariants.assertReaderModelAcknowledgement;
-
 exports.classifyPrincipalId = invariants.classifyPrincipalId;
 
 exports.clientConfigFromResource = invariants.clientConfigFromResource;
@@ -13104,8 +13782,6 @@ exports.errorMessage = invariants.errorMessage;
 
 exports.extractDocumentId = invariants.extractDocumentId;
 
-exports.fieldTreeShape = invariants.fieldTreeShape;
-
 exports.gdrFromResource = invariants.gdrFromResource;
 
 exports.gdrRef = invariants.gdrRef;
@@ -13136,20 +13812,8 @@ exports.isTodoListEntry = invariants.isTodoListEntry;
 
 exports.isTodoListItem = invariants.isTodoListItem;
 
-exports.isUnprimed = invariants.isUnprimed;
-
 exports.lakePrincipalId = invariants.lakePrincipalId;
 
-exports.minReaderModelOf = invariants.minReaderModelOf;
-
-exports.modelVersionOf = invariants.modelVersionOf;
-
-exports.parentRef = invariants.parentRef;
-
-exports.parseDefinitionSnapshot = invariants.parseDefinitionSnapshot;
-
-exports.parseDefinitionSnapshotValue = invariants.parseDefinitionSnapshotValue;
-
 exports.parseGdr = invariants.parseGdr;
 
 exports.parseResourceGdr = invariants.parseResourceGdr;
@@ -13172,10 +13836,6 @@ exports.releaseDocId = invariants.releaseDocId;
 
 exports.releaseRef = invariants.releaseRef;
 
-exports.requiredModelFeatures = invariants.requiredModelFeatures;
-
-exports.requiredReaderModel = invariants.requiredReaderModel;
-
 exports.resourceAliasesToMap = invariants.resourceAliasesToMap;
 
 exports.resourceFromParsed = invariants.resourceFromParsed;
@@ -13192,8 +13852,6 @@ exports.startKindOf = invariants.startKindOf;
 
 exports.tagScopeFilter = invariants.tagScopeFilter;
 
-exports.terminalState = invariants.terminalState;
-
 exports.toBareId = invariants.toBareId;
 
 exports.tryParseGdr = invariants.tryParseGdr;
@@ -13318,6 +13976,12 @@ exports.ConcurrentEditFieldError = ConcurrentEditFieldError;
 
 exports.ConcurrentFireActionError = ConcurrentFireActionError;
 
+exports.DATA_MODEL_CHANGES = DATA_MODEL_CHANGES;
+
+exports.DATA_MODEL_MIN_READER = DATA_MODEL_MIN_READER;
+
+exports.DATA_MODEL_VERSION = DATA_MODEL_VERSION;
+
 exports.DEFAULT_CONTENT_PERSPECTIVE = DEFAULT_CONTENT_PERSPECTIVE;
 
 exports.DEFAULT_EFFECT_LEASE_MS = DEFAULT_EFFECT_LEASE_MS;
@@ -13360,6 +14024,8 @@ exports.InitialFieldsInvalidError = InitialFieldsInvalidError;
 
 exports.MissingHandlerError = MissingHandlerError;
 
+exports.ModelVersionAheadError = ModelVersionAheadError;
+
 exports.MutationGuardDeniedError = MutationGuardDeniedError;
 
 exports.MutationGuardDocSchema = MutationGuardDocSchema;
@@ -13368,6 +14034,10 @@ exports.OP_DISPLAY = OP_DISPLAY;
 
 exports.PartialGuardDeployError = PartialGuardDeployError;
 
+exports.READER_MODEL_ROLLOUT_URL = READER_MODEL_ROLLOUT_URL;
+
+exports.ReaderModelAcknowledgementError = ReaderModelAcknowledgementError;
+
 exports.RefResourceUndeclaredError = RefResourceUndeclaredError;
 
 exports.RequiredFieldNotProvidedError = RequiredFieldNotProvidedError;
@@ -13380,6 +14050,8 @@ exports.StartNotPrimedError = StartNotPrimedError;
 
 exports.StartNotSettledError = StartNotSettledError;
 
+exports.WORKFLOW_INSTANCE_TYPE = WORKFLOW_INSTANCE_TYPE;
+
 exports.WorkflowActionFired = WorkflowActionFired;
 
 exports.WorkflowActivityReset = WorkflowActivityReset;
@@ -13426,6 +14098,10 @@ exports.activityAutonomyOf = activityAutonomyOf;
 
 exports.applicableDefinitions = applicableDefinitions;
 
+exports.assertReadableModel = assertReadableModel;
+
+exports.assertReaderModelAcknowledgement = assertReaderModelAcknowledgement;
+
 exports.autonomySummary = autonomySummary;
 
 exports.availableActions = availableActions;
@@ -13508,6 +14184,8 @@ exports.documentActionDenials = documentActionDenials;
 
 exports.documentPrefilter = documentPrefilter;
 
+exports.documentStuckCause = documentStuckCause;
+
 exports.effectOutputsMap = effectOutputsMap;
 
 exports.entryDocRefs = entryDocRefs;
@@ -13522,10 +14200,16 @@ exports.expandResourceAliases = expandResourceAliases;
 
 exports.explainStartRequirement = explainStartRequirement;
 
+exports.fieldTreeShape = fieldTreeShape;
+
+exports.findActivityNode = findActivityNode;
+
 exports.findCurrentActivityEntry = findCurrentActivityEntry;
 
 exports.findOpenStageEntry = findOpenStageEntry;
 
+exports.findStageNode = findStageNode;
+
 exports.groupSitesOf = groupSitesOf;
 
 exports.guardMatches = guardMatches;
@@ -13564,10 +14248,14 @@ exports.isFilterScopedOut = isFilterScopedOut;
 
 exports.isProjectUserNotFoundError = isProjectUserNotFoundError;
 
+exports.isRevisionConflict = isRevisionConflict;
+
 exports.isTelemetryEnvDenied = isTelemetryEnvDenied;
 
 exports.isTerminalStage = isTerminalStage;
 
+exports.isUnprimed = isUnprimed;
+
 exports.lakeGuardId = lakeGuardId;
 
 exports.latestDefinitionsGroq = latestDefinitionsGroq;
@@ -13576,14 +14264,24 @@ exports.latestDeployedDefinitions = latestDeployedDefinitions;
 
 exports.lintEffectOutputs = lintEffectOutputs;
 
+exports.minReaderModelOf = minReaderModelOf;
+
 exports.missingRequiredInputs = missingRequiredInputs;
 
+exports.modelVersionOf = modelVersionOf;
+
 exports.narrateAutonomyWaits = narrateAutonomyWaits;
 
 exports.noopTelemetry = noopTelemetry;
 
+exports.parentRef = parentRef;
+
 exports.parseDefinitionInput = parseDefinitionInput;
 
+exports.parseDefinitionSnapshot = parseDefinitionSnapshot;
+
+exports.parseDefinitionSnapshotValue = parseDefinitionSnapshotValue;
+
 exports.parseGuardDocument = parseGuardDocument;
 
 exports.parseInstanceDocument = parseInstanceDocument;
@@ -13602,6 +14300,10 @@ exports.refsOf = refsOf;
 
 exports.remediationsFor = remediationsFor;
 
+exports.requiredModelFeatures = requiredModelFeatures;
+
+exports.requiredReaderModel = requiredReaderModel;
+
 exports.resolveAccess = resolveAccess;
 
 exports.resolveActor = resolveActor;
@@ -13610,6 +14312,8 @@ exports.resolveClientActor = resolveClientActor;
 
 exports.resolveFieldEntry = resolveFieldEntry$1;
 
+exports.resolveUserAttributes = resolveUserAttributes;
+
 exports.retractStageGuards = retractStageGuards;
 
 exports.silentLogger = silentLogger;
@@ -13632,6 +14336,8 @@ exports.subscriptionDocumentsForInstance = subscriptionDocumentsForInstance;
 
 exports.sweepStaleClaims = sweepStaleClaims;
 
+exports.terminalState = terminalState;
+
 exports.unboundRequirementReads = unboundRequirementReads;
 
 exports.unsatisfiedTransitionSummaries = unsatisfiedTransitionSummaries;