@sanity/workflow-engine 0.28.0 → 0.29.0

package/dist/index.cjs

@@ -449,7 +449,7 @@ function fieldEditedData(args) {
     };
 }
 
-const DATA_MODEL_VERSION = 5, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
+const DATA_MODEL_VERSION = 7, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
 
 class ReaderModelAcknowledgementError extends invariants.WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -499,7 +499,7 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     documentTypes: Object.freeze([ "definition" ]),
     compatibility: "additive",
     applicability: "detectable",
-    summary: "Ordinary actions may carry a closed bag of advisory workflow semantics."
+    summary: "Ordinary actions may carry advisory workflow semantics."
 }), Object.freeze({
     id: "inclusive-scalar-bounds",
     introducedInModel: 2,
@@ -548,6 +548,30 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "additive",
     applicability: "detectable",
     summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
 }) ]);
 
 function recordOf(value) {
@@ -570,13 +594,34 @@ function parsedDefinitionSnapshot(root) {
     }));
 }
 
-function persistedFieldEntries(document) {
+function persistedDefinitionTree(document) {
     const root = recordOf(document);
-    if (root === void 0) return [];
-    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], stages = roots.flatMap(candidate => recordsAt(candidate, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions")), effects = actions.flatMap(action => recordsAt(action, "effects"));
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
     return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
 }
 
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
 function hasChoiceList(document) {
     return persistedFieldEntries(document).some(entry => {
         const options = recordOf(entry.options);
@@ -588,9 +633,34 @@ function hasFieldKind(document, kind) {
     return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
 }
 
-function hasActionSemantics(document) {
+function definitionNodes(document) {
     const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "stages").flatMap(stage => recordsAt(stage, "activities")).flatMap(activity => recordsAt(activity, "actions")).some(action => Array.isArray(action.semantics));
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
 }
 
 function hasScalarValidation(document) {
@@ -623,7 +693,10 @@ const featureDetectors = {
     "effect-claim-tokens": hasClaimTokens,
     "classified-principal-ids": () => !0,
     "readiness-requirements": hasReadinessRequirements,
-    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime")
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
 };
 
 function requiredModelFeatures(documentType, document) {
@@ -1157,12 +1230,8 @@ function renderWorkflowRead(read, ctx) {
             text: groqConditionDescribe.guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return groqConditionDescribe.phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return groqConditionDescribe.phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -1184,6 +1253,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return groqConditionDescribe.phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return groqConditionDescribe.phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${groqConditionDescribe.guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -2084,6 +2171,10 @@ function derefBase(ref, snapshot) {
     };
 }
 
+function isRecord(value) {
+    return typeof value == "object" && value !== null && !Array.isArray(value);
+}
+
 function buildParams(args) {
     const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
     return {
@@ -2612,7 +2703,7 @@ class CascadeLimitError extends invariants.WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2713,7 +2804,7 @@ async function runOps(args) {
             refSurface: refSurface,
             opsFromDefinition: opsFromDefinition
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2724,6 +2815,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2795,12 +2890,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2839,6 +2941,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return invariants.isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = invariants.validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2874,15 +3048,10 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, invariants.isAlwaysArrayFieldKind(entry._type) ? [] : null), 
+    {
         opType: op.type,
         target: op.target
     };
@@ -2921,7 +3090,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -3620,6 +3789,14 @@ function latestDeployedDefinitions(rows) {
     return [ ...byName.values() ];
 }
 
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
 function liveChildrenField(instance) {
     const live = liveSubworkflows(instance).length;
     return live > 0 ? {
@@ -3708,6 +3885,27 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
     const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
@@ -3726,7 +3924,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -4105,10 +4303,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return invariants.isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4709,7 +4905,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -5677,10 +5875,6 @@ function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
 }
 
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
 function optionalString(value) {
     return value === void 0 || typeof value == "string";
 }
@@ -7218,116 +7412,523 @@ async function advisoryCan({instance: instance, identity: identity, grants: gran
     return can;
 }
 
-function requirementDescriptor(requirement) {
-    return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
-        } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
-        } : {}
-    };
-}
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
 
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+function attributeEntry(row) {
+    if (!(!isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
 }
 
-class ActionDisabledError extends invariants.WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
+function normalizeUserAttributes(response) {
+    if (!isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
     }
+    return out;
 }
 
-class StartNotAllowedError extends invariants.WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
-}
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
 
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
+    return {
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
+        } : {},
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    };
 }
 
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
 }
 
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
 }
 
-class EditFieldDeniedError extends invariants.WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
 }
 
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
 }
 
-async function fireAction(args) {
-    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
-    return retryOnRevisionConflict({
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
         client: client,
-        instanceId: instanceId,
-        options: options,
-        commit: ctx => commitAction({
-            ctx: ctx,
-            activityName: activity,
-            actionName: action,
-            callerParams: params,
-            requestRecord: requestRecord,
-            options: options
-        }),
-        onExhausted: () => new ConcurrentFireActionError({
-            instanceId: instanceId,
-            activity: activity,
-            action: action,
-            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
-        })
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
     });
 }
 
-async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
-    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${invariants.errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${invariants.errorMessage(err)}`, {
+            cause: err
+        });
+    }
+}
+
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
+}
+
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
+        instance: args.instance,
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
+    });
+}
+
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends invariants.WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends invariants.WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
+
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
+}
+
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+}
+
+class EditFieldDeniedError extends invariants.WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
+    }
+}
+
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
+
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+}
+
+async function fireAction(args) {
+    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
+    return retryOnRevisionConflict({
+        client: client,
+        instanceId: instanceId,
+        options: options,
+        commit: ctx => commitAction({
+            ctx: ctx,
+            activityName: activity,
+            actionName: action,
+            callerParams: params,
+            requestRecord: requestRecord,
+            options: options
+        }),
+        onExhausted: () => new ConcurrentFireActionError({
+            instanceId: instanceId,
+            activity: activity,
+            action: action,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
+    });
+}
+
+async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
+    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
     if (action === void 0) throw new invariants.ContractViolationError(`Action "${actionName}" not declared on activity "${activityName}"`);
     if (action.when !== void 0) throw new ActionDisabledError({
         activity: activityName,
@@ -7338,7 +7939,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7350,10 +7952,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -8614,334 +9214,91 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         mutation: mutation,
         record: requestRecord,
         now: ctx.now
-    }), renewClaimLease({
-        mutation: mutation,
-        effectKey: effectKey,
-        now: ctx.now,
-        leaseMs: leaseMs
-    }), await runOps({
-        ops: validatedOps,
-        mutation: mutation,
-        stage: ctx.instance.currentStage,
-        origin: {
-            effect: pending.name
-        },
-        params: pending.params,
-        actor: ctx.actor,
-        self: invariants.selfGdr(ctx.instance),
-        now: ctx.now,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
-    }), await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: ctx.instance.currentStage,
-        didChangeState: !0
-    }), {
-        effectKey: effectKey,
-        effect: pending.name
-    };
-}
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
+    }), renewClaimLease({
+        mutation: mutation,
+        effectKey: effectKey,
+        now: ctx.now,
+        leaseMs: leaseMs
+    }), await runOps({
+        ops: validatedOps,
+        mutation: mutation,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
         },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
+        params: pending.params,
+        actor: ctx.actor,
+        self: invariants.selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: ctx.instance.currentStage,
+        didChangeState: !0
+    }), {
+        effectKey: effectKey,
+        effect: pending.name
     };
 }
 
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
 
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
         client: client,
-        principalId: resourceId
+        instanceId: instanceId,
+        options: options
     });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
     });
 }
 
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
-
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
-}
-
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
-}
-
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -9125,7 +9482,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     invariants.validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -9133,7 +9490,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -9158,6 +9515,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -9172,6 +9532,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9197,7 +9584,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -9214,22 +9601,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = invariants.lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
-        actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -9278,6 +9657,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -9294,6 +9674,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9449,6 +9830,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: invariants.deriveActivityKind(activity),
         classification: invariants.deriveExecutorClassification(activity),
@@ -9619,9 +10001,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -10100,7 +10486,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -10113,10 +10500,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10606,6 +10991,9 @@ function buildEngineCallOptions(args) {
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -12364,7 +12752,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12386,6 +12774,9 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
@@ -13081,7 +13472,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -13186,6 +13577,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -13194,6 +13589,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -13319,6 +13722,8 @@ exports.CONDITION_VARS = invariants.CONDITION_VARS;
 
 exports.ContractViolationError = invariants.ContractViolationError;
 
+exports.DECISION_SEMANTICS = invariants.DECISION_SEMANTICS;
+
 exports.DEFAULT_TRANSITION_WHEN = invariants.DEFAULT_TRANSITION_WHEN;
 
 exports.DRIVER_KINDS = invariants.DRIVER_KINDS;
@@ -13345,6 +13750,8 @@ exports.PersistedDocShapeError = invariants.PersistedDocShapeError;
 
 exports.RESERVED_CONDITION_VARS = invariants.RESERVED_CONDITION_VARS;
 
+exports.SIGNAL_SEMANTICS = invariants.SIGNAL_SEMANTICS;
+
 exports.START_FILTER_VARS = invariants.START_FILTER_VARS;
 
 exports.START_REQUIREMENT_VARS = invariants.START_REQUIREMENT_VARS;
@@ -13777,6 +14184,8 @@ exports.documentActionDenials = documentActionDenials;
 
 exports.documentPrefilter = documentPrefilter;
 
+exports.documentStuckCause = documentStuckCause;
+
 exports.effectOutputsMap = effectOutputsMap;
 
 exports.entryDocRefs = entryDocRefs;
@@ -13793,10 +14202,14 @@ exports.explainStartRequirement = explainStartRequirement;
 
 exports.fieldTreeShape = fieldTreeShape;
 
+exports.findActivityNode = findActivityNode;
+
 exports.findCurrentActivityEntry = findCurrentActivityEntry;
 
 exports.findOpenStageEntry = findOpenStageEntry;
 
+exports.findStageNode = findStageNode;
+
 exports.groupSitesOf = groupSitesOf;
 
 exports.guardMatches = guardMatches;
@@ -13899,6 +14312,8 @@ exports.resolveClientActor = resolveClientActor;
 
 exports.resolveFieldEntry = resolveFieldEntry$1;
 
+exports.resolveUserAttributes = resolveUserAttributes;
+
 exports.retractStageGuards = retractStageGuards;
 
 exports.silentLogger = silentLogger;