@sanity/workflow-engine 0.27.0 → 0.29.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { terminalState, andConditions, deriveActivityKind, parseDefinitionSnapshot, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, rethrowWithContext, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, parentRef, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, WORKFLOW_INSTANCE_TYPE, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, assertReadableModel, InstanceNotFoundError, modelStampFor, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, minReaderModelOf, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, driverKind, EffectNotFoundError, firstCarriedGlobalId, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, isUnprimed, DefinitionInUseError, assertReaderModelAcknowledgement, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { rethrowWithContext, andConditions, deriveActivityKind, WorkflowError, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAlwaysArrayFieldKind, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
 
-import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, ModelVersionAheadError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, SYSTEM_IDENTITY, clientConfigFromResource, fieldTreeShape, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, modelVersionOf, parseDefinitionSnapshotValue, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, requiredModelFeatures, requiredReaderModel, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
+import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
 import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, dedupeReads, whatIfCondition, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
 
@@ -41,6 +41,53 @@ function findCurrentActivityEntry(host, activityName) {
     return findOpenStageEntry(host)?.activities.find(a => a.name === activityName);
 }
 
+const WORKFLOW_INSTANCE_TYPE = "sanity.workflow.instance";
+
+function terminalState(instance) {
+    return instance.abortedAt !== void 0 ? "aborted" : instance.completedAt !== void 0 ? "completed" : "in-flight";
+}
+
+function isUnprimed(instance) {
+    return instance.stages.length === 0 && terminalState(instance) === "in-flight";
+}
+
+function parseDefinitionSnapshotValue(instance) {
+    try {
+        return normalizeLegacyActivityRequirements(JSON.parse(instance.definitionSnapshot));
+    } catch (err) {
+        rethrowWithContext(err, `Failed to parse definitionSnapshot on instance "${instance._id}"`);
+    }
+}
+
+function normalizeLegacyActivityRequirements(value) {
+    for (const stage of arrayMember(value, "stages")) for (const activity of arrayMember(stage, "activities")) normalizeLegacyRequirementMap(activity);
+    return value;
+}
+
+function arrayMember(value, key) {
+    if (typeof value != "object" || value === null) return [];
+    const member = value[key];
+    return Array.isArray(member) ? member : [];
+}
+
+function normalizeLegacyRequirementMap(value) {
+    if (typeof value != "object" || value === null) return;
+    const activity = value, requirements = activity.requirements;
+    typeof requirements != "object" || requirements === null || Array.isArray(requirements) || (activity.requirements = Object.entries(requirements).map(([name, query]) => ({
+        type: "groq",
+        name: name,
+        query: query
+    })));
+}
+
+function parseDefinitionSnapshot(instance) {
+    return parseDefinitionSnapshotValue(instance);
+}
+
+function parentRef(instance) {
+    return instance.ancestors.at(-1);
+}
+
 function effectiveEditable(baseline, override) {
     if (baseline === void 0) return;
     if (override === void 0) return baseline;
@@ -388,6 +435,313 @@ function fieldEditedData(args) {
     };
 }
 
+const DATA_MODEL_VERSION = 7, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
+
+class ReaderModelAcknowledgementError extends WorkflowError {
+    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
+    expectedMinReaderModel;
+    engineMinReaderModel=DATA_MODEL_MIN_READER;
+    engineModelVersion=DATA_MODEL_VERSION;
+    documentationUrl=READER_MODEL_ROLLOUT_URL;
+    constructor(expectedMinReaderModel, context = "Deployment") {
+        const expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
+        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}.\nDo not change the acknowledgement yet: accepting ${DATA_MODEL_MIN_READER} authorizes this engine to write documents that older readers will refuse.\nUpgrade every Studio, CLI, MCP server, Function, and other runtime that reads engine-owned documents; verify that rollout in every environment sharing the workflow resource; then change the literal in deployment configuration and deploy the writer.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
+        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel;
+    }
+}
+
+function assertReaderModelAcknowledgement(expectedMinReaderModel, context) {
+    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel !== DATA_MODEL_MIN_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, context);
+}
+
+const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
+    id: "governed-model-stamps",
+    introducedInModel: 1,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
+}), Object.freeze({
+    id: "subject-field-kind",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A workflow-level subject field identifies the document a workflow is about."
+}), Object.freeze({
+    id: "typed-scalar-choice-lists",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Scalar fields may constrain writes to a persisted typed choice list."
+}), Object.freeze({
+    id: "action-semantics",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Ordinary actions may carry advisory workflow semantics."
+}), Object.freeze({
+    id: "inclusive-scalar-bounds",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "String, text, and number values may carry persisted inclusive bounds."
+}), Object.freeze({
+    id: "progress-field-kind",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A progress field kind carries application-defined 0–100 completion."
+}), Object.freeze({
+    id: "effect-claim-tokens",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
+}), Object.freeze({
+    id: "classified-principal-ids",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "unconditional",
+    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
+}), Object.freeze({
+    id: "readiness-requirements",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Start and activity readiness use named polymorphic requirement arrays."
+}), Object.freeze({
+    id: "due-date-field-kinds",
+    introducedInModel: 5,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
+}) ]);
+
+function recordOf(value) {
+    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
+}
+
+function recordsAt(record, key) {
+    const value = record[key];
+    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
+}
+
+function nestedFieldEntries(entries) {
+    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
+}
+
+function parsedDefinitionSnapshot(root) {
+    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
+        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
+        definitionSnapshot: root.definitionSnapshot
+    }));
+}
+
+function persistedDefinitionTree(document) {
+    const root = recordOf(document);
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
+    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
+}
+
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function hasChoiceList(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const options = recordOf(entry.options);
+        return options !== void 0 && Array.isArray(options.list);
+    });
+}
+
+function hasFieldKind(document, kind) {
+    return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
+}
+
+function definitionNodes(document) {
+    const root = recordOf(document);
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
+}
+
+function hasScalarValidation(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const validation = recordOf(entry.validation);
+        return typeof validation?.min == "number" || typeof validation?.max == "number";
+    });
+}
+
+function hasClaimTokens(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
+        const claim = recordOf(entry.claim);
+        return claim !== void 0 && typeof claim.claimToken == "string";
+    });
+}
+
+function hasReadinessRequirements(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
+}
+
+const featureDetectors = {
+    "governed-model-stamps": () => !0,
+    "subject-field-kind": document => hasFieldKind(document, "subject"),
+    "typed-scalar-choice-lists": hasChoiceList,
+    "action-semantics": hasActionSemantics,
+    "inclusive-scalar-bounds": hasScalarValidation,
+    "progress-field-kind": document => hasFieldKind(document, "progress"),
+    "effect-claim-tokens": hasClaimTokens,
+    "classified-principal-ids": () => !0,
+    "readiness-requirements": hasReadinessRequirements,
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
+};
+
+function requiredModelFeatures(documentType, document) {
+    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
+}
+
+function requiredReaderModel(documentType, document) {
+    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
+}
+
+function modelStampFor(args) {
+    return {
+        modelVersion: DATA_MODEL_VERSION,
+        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
+    };
+}
+
+function fieldTreeShape(value) {
+    if (Array.isArray(value)) return value.map(fieldTreeShape);
+    if (value === null) return "null";
+    if (typeof value == "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
+    }
+    return typeof value;
+}
+
+function modelVersionOf(doc) {
+    const stamp = doc.modelVersion;
+    return typeof stamp == "number" ? stamp : 0;
+}
+
+function minReaderModelOf(doc) {
+    const floor = doc.minReaderModel;
+    return typeof floor == "number" ? floor : modelVersionOf(doc);
+}
+
+class ModelVersionAheadError extends WorkflowError {
+    documentId;
+    documentModelVersion;
+    requiredReaderModel;
+    engineModelVersion;
+    constructor(args) {
+        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
+        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
+        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
+    }
+}
+
+function assertReadableModel(doc) {
+    const documentReaderModel = minReaderModelOf(doc);
+    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
+        documentId: doc._id,
+        documentModelVersion: modelVersionOf(doc),
+        requiredReaderModel: documentReaderModel
+    });
+    return doc;
+}
+
 function effectSites(def) {
     const sites = [];
     for (const stage of def.stages ?? []) for (const activity of stage.activities ?? []) for (const action of activity.actions ?? []) for (const effect of action.effects ?? []) sites.push({
@@ -862,12 +1216,8 @@ function renderWorkflowRead(read, ctx) {
             text: guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -889,6 +1239,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -1789,6 +2157,10 @@ function derefBase(ref, snapshot) {
     };
 }
 
+function isRecord(value) {
+    return typeof value == "object" && value !== null && !Array.isArray(value);
+}
+
 function buildParams(args) {
     const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
     return {
@@ -2258,6 +2630,12 @@ function isRevisionConflict(error) {
     return statusCode === 409 ? !0 : typeof message == "string" && message.includes("ifRevisionId check failed");
 }
 
+function isCreateIdCollision(error) {
+    if (typeof error != "object" || error === null) return !1;
+    const {message: message, responseBody: responseBody} = error;
+    return typeof message == "string" && message.includes("already exists") && (message.includes("Document by ID") || message.includes("create() failed")) ? !0 : typeof responseBody == "string" && responseBody.includes("documentAlreadyExistsError");
+}
+
 class ConcurrentEditFieldError extends WorkflowError {
     instanceId;
     target;
@@ -2310,7 +2688,7 @@ class CascadeLimitError extends WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2411,7 +2789,7 @@ async function runOps(args) {
             refSurface: refSurface,
             opsFromDefinition: opsFromDefinition
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2422,6 +2800,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2493,12 +2875,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2537,6 +2926,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2572,15 +3033,9 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, isAlwaysArrayFieldKind(entry._type) ? [] : null), {
         opType: op.type,
         target: op.target
     };
@@ -2619,7 +3074,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -3318,6 +3773,14 @@ function latestDeployedDefinitions(rows) {
     return [ ...byName.values() ];
 }
 
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
 function liveChildrenField(instance) {
     const live = liveSubworkflows(instance).length;
     return live > 0 ? {
@@ -3406,6 +3869,27 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
     const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
@@ -3424,7 +3908,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -3803,10 +4287,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4407,7 +4889,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -5375,10 +5859,6 @@ function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
 }
 
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
 function optionalString(value) {
     return value === void 0 || typeof value == "string";
 }
@@ -5883,12 +6363,14 @@ function resolveGuard({guard: guard, instance: instance, stageName: stageName, n
 
 async function upsertGuard(args) {
     const {client: client, doc: doc, exists: exists} = args;
-    if (!exists) {
+    if (!exists) try {
         await client.create(doc, {
             ...SYNC_COMMIT,
             tag: REQUEST_TAG.guardDeploy
         });
         return;
+    } catch (error) {
+        if (!isCreateIdCollision(error)) throw error;
     }
     const {_id: _id, _type: _type, _rev: _rev, _createdAt: _createdAt, _updatedAt: _updatedAt, ...body} = doc;
     await client.patch(doc._id).set(body).commit({
@@ -6913,54 +7395,461 @@ async function advisoryCan({instance: instance, identity: identity, grants: gran
     return can;
 }
 
-function requirementDescriptor(requirement) {
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
+
+function attributeEntry(row) {
+    if (!(!isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
+}
+
+function normalizeUserAttributes(response) {
+    if (!isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
+    }
+    return out;
+}
+
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
+
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
     return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
         } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
+        ...grants !== void 0 ? {
+            grants: grants
         } : {}
     };
 }
 
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
 }
 
-class ActionDisabledError extends WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
-    }
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
 }
 
-class StartNotAllowedError extends WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
 }
 
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
 }
 
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
+        client: client,
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
+    });
+}
+
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${errorMessage(err)}`, {
+            cause: err
+        });
+    }
+}
+
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
+}
+
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
+        instance: args.instance,
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
+    });
+}
+
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
     "stage-terminal": r => `stage "${r.stage}" is terminal`,
     "instance-completed": r => `instance completed at ${r.completedAt}`,
     "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
@@ -7033,7 +7922,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7045,10 +7935,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -8303,340 +9191,97 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     if (validatedOps.length === 0) throw new EffectOpsInvalidError({
         effect: pending.name,
         issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
-    });
-    const mutation = startMutation(ctx.instance);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), renewClaimLease({
-        mutation: mutation,
-        effectKey: effectKey,
-        now: ctx.now,
-        leaseMs: leaseMs
-    }), await runOps({
-        ops: validatedOps,
-        mutation: mutation,
-        stage: ctx.instance.currentStage,
-        origin: {
-            effect: pending.name
-        },
-        params: pending.params,
-        actor: ctx.actor,
-        self: selfGdr(ctx.instance),
-        now: ctx.now,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
-    }), await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: ctx.instance.currentStage,
-        didChangeState: !0
-    }), {
-        effectKey: effectKey,
-        effect: pending.name
-    };
-}
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
+    });
+    const mutation = startMutation(ctx.instance);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), renewClaimLease({
+        mutation: mutation,
+        effectKey: effectKey,
+        now: ctx.now,
+        leaseMs: leaseMs
+    }), await runOps({
+        ops: validatedOps,
+        mutation: mutation,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
         },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
+        params: pending.params,
+        actor: ctx.actor,
+        self: selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: ctx.instance.currentStage,
+        didChangeState: !0
+    }), {
+        effectKey: effectKey,
+        effect: pending.name
     };
 }
 
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
 
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
         client: client,
-        principalId: resourceId
+        instanceId: instanceId,
+        options: options
     });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
     });
 }
 
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
-
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
-}
-
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
-}
-
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -8820,7 +9465,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -8828,7 +9473,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -8853,6 +9498,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -8867,6 +9515,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -8892,7 +9567,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -8909,22 +9584,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
-        actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -8973,6 +9640,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -8989,6 +9657,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9144,6 +9813,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: deriveActivityKind(activity),
         classification: deriveExecutorClassification(activity),
@@ -9314,9 +9984,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -9795,7 +10469,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -9808,10 +10483,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10301,6 +10974,9 @@ function buildEngineCallOptions(args) {
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -12059,7 +12735,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12081,6 +12757,9 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
@@ -12776,7 +13455,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -12881,6 +13560,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -12889,6 +13572,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -13002,4 +13693,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };