@sanity/workflow-engine 0.28.0 → 0.29.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { rethrowWithContext, andConditions, deriveActivityKind, WorkflowError, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, driverKind, EffectNotFoundError, firstCarriedGlobalId, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { rethrowWithContext, andConditions, deriveActivityKind, WorkflowError, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAlwaysArrayFieldKind, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
 
-import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
+import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
 import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, dedupeReads, whatIfCondition, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
 
@@ -435,7 +435,7 @@ function fieldEditedData(args) {
     };
 }
 
-const DATA_MODEL_VERSION = 5, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
+const DATA_MODEL_VERSION = 7, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
 
 class ReaderModelAcknowledgementError extends WorkflowError {
     code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
@@ -485,7 +485,7 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     documentTypes: Object.freeze([ "definition" ]),
     compatibility: "additive",
     applicability: "detectable",
-    summary: "Ordinary actions may carry a closed bag of advisory workflow semantics."
+    summary: "Ordinary actions may carry advisory workflow semantics."
 }), Object.freeze({
     id: "inclusive-scalar-bounds",
     introducedInModel: 2,
@@ -534,6 +534,30 @@ const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
     compatibility: "additive",
     applicability: "detectable",
     summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
 }) ]);
 
 function recordOf(value) {
@@ -556,13 +580,34 @@ function parsedDefinitionSnapshot(root) {
     }));
 }
 
-function persistedFieldEntries(document) {
+function persistedDefinitionTree(document) {
     const root = recordOf(document);
-    if (root === void 0) return [];
-    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], stages = roots.flatMap(candidate => recordsAt(candidate, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions")), effects = actions.flatMap(action => recordsAt(action, "effects"));
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
     return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
 }
 
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
 function hasChoiceList(document) {
     return persistedFieldEntries(document).some(entry => {
         const options = recordOf(entry.options);
@@ -574,9 +619,34 @@ function hasFieldKind(document, kind) {
     return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
 }
 
-function hasActionSemantics(document) {
+function definitionNodes(document) {
     const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "stages").flatMap(stage => recordsAt(stage, "activities")).flatMap(activity => recordsAt(activity, "actions")).some(action => Array.isArray(action.semantics));
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
 }
 
 function hasScalarValidation(document) {
@@ -609,7 +679,10 @@ const featureDetectors = {
     "effect-claim-tokens": hasClaimTokens,
     "classified-principal-ids": () => !0,
     "readiness-requirements": hasReadinessRequirements,
-    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime")
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
 };
 
 function requiredModelFeatures(documentType, document) {
@@ -1143,12 +1216,8 @@ function renderWorkflowRead(read, ctx) {
             text: guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -1170,6 +1239,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -2070,6 +2157,10 @@ function derefBase(ref, snapshot) {
     };
 }
 
+function isRecord(value) {
+    return typeof value == "object" && value !== null && !Array.isArray(value);
+}
+
 function buildParams(args) {
     const {instance: instance, now: now, snapshot: snapshot, extra: extra} = args, currentActivities2 = findOpenStageEntry(instance)?.activities ?? [];
     return {
@@ -2597,7 +2688,7 @@ class CascadeLimitError extends WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2698,7 +2789,7 @@ async function runOps(args) {
             refSurface: refSurface,
             opsFromDefinition: opsFromDefinition
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2709,6 +2800,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2780,12 +2875,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2824,6 +2926,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2859,15 +3033,9 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, isAlwaysArrayFieldKind(entry._type) ? [] : null), {
         opType: op.type,
         target: op.target
     };
@@ -2906,7 +3074,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -3605,6 +3773,14 @@ function latestDeployedDefinitions(rows) {
     return [ ...byName.values() ];
 }
 
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
 function liveChildrenField(instance) {
     const live = liveSubworkflows(instance).length;
     return live > 0 ? {
@@ -3693,6 +3869,27 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
     const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
@@ -3711,7 +3908,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -4090,10 +4287,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4694,7 +4889,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -5662,10 +5859,6 @@ function userLoginProvider(user) {
     return user?.provider ?? user?.loginProvider;
 }
 
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
 function optionalString(value) {
     return value === void 0 || typeof value == "string";
 }
@@ -7202,117 +7395,524 @@ async function advisoryCan({instance: instance, identity: identity, grants: gran
     return can;
 }
 
-function requirementDescriptor(requirement) {
-    return {
-        name: requirement.name,
-        ...requirement.title !== void 0 ? {
-            title: requirement.title
-        } : {},
-        ...requirement.description !== void 0 ? {
-            description: requirement.description
-        } : {}
-    };
-}
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
 
-function subjectDenialLabels(denied) {
-    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+function attributeEntry(row) {
+    if (!(!isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
 }
 
-class ActionDisabledError extends WorkflowError {
-    reason;
-    activity;
-    action;
-    constructor(args) {
-        super("action-disabled", formatDisabledReason({
-            activity: args.activity,
-            action: args.action,
-            reason: args.reason
-        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
-        this.action = args.action;
+function normalizeUserAttributes(response) {
+    if (!isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
     }
+    return out;
 }
 
-class StartNotAllowedError extends WorkflowError {
-    definition;
-    unmetRequirements;
-    constructor(args) {
-        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
-        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
-    }
-}
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
 
-function actionRendering(action) {
-    const kind = action.disabledReason?.kind;
-    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
+    return {
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
+        } : {},
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    };
 }
 
-const disabledReasonDetail = {
-    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
-    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
-    "activity-not-active": r => `activity status is "${r.status}"`,
-    "stage-terminal": r => `stage "${r.stage}" is terminal`,
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
-    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
-};
-
-function actionDisabledDetail(reason) {
-    return disabledReasonDetail[reason.kind](reason);
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
 }
 
-function formatDisabledReason({activity: activity, action: action, reason: reason}) {
-    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
 }
 
-class EditFieldDeniedError extends WorkflowError {
-    reason;
-    target;
-    constructor(args) {
-        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
-        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
-    }
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
 }
 
-const editDisabledReasonDetail = {
-    "not-editable": () => "field is not declared editable",
-    "instance-completed": r => `instance completed at ${r.completedAt}`,
-    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
-    "edit-window-closed": r => `edit window closed (${r.detail})`,
-    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
-};
-
-function formatEditDisabledReason(target, reason) {
-    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
-    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
 }
 
-async function fireAction(args) {
-    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
-    return retryOnRevisionConflict({
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
         client: client,
-        instanceId: instanceId,
-        options: options,
-        commit: ctx => commitAction({
-            ctx: ctx,
-            activityName: activity,
-            actionName: action,
-            callerParams: params,
-            requestRecord: requestRecord,
-            options: options
-        }),
-        onExhausted: () => new ConcurrentFireActionError({
-            instanceId: instanceId,
-            activity: activity,
-            action: action,
-            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
-        })
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
     });
 }
 
-async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
-    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
-    if (action === void 0) throw new ContractViolationError(`Action "${actionName}" not declared on activity "${activityName}"`);
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${errorMessage(err)}`, {
+            cause: err
+        });
+    }
+}
+
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
+}
+
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
+        instance: args.instance,
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
+    });
+}
+
+function requirementDescriptor(requirement) {
+    return {
+        name: requirement.name,
+        ...requirement.title !== void 0 ? {
+            title: requirement.title
+        } : {},
+        ...requirement.description !== void 0 ? {
+            description: requirement.description
+        } : {}
+    };
+}
+
+function subjectDenialLabels(denied) {
+    return denied.map(d => `${d.permission} on ${d.subject} (${d.resource})`);
+}
+
+class ActionDisabledError extends WorkflowError {
+    reason;
+    activity;
+    action;
+    constructor(args) {
+        super("action-disabled", formatDisabledReason({
+            activity: args.activity,
+            action: args.action,
+            reason: args.reason
+        })), this.name = "ActionDisabledError", this.reason = args.reason, this.activity = args.activity, 
+        this.action = args.action;
+    }
+}
+
+class StartNotAllowedError extends WorkflowError {
+    definition;
+    unmetRequirements;
+    constructor(args) {
+        super("start-not-allowed", `startInstance refused definition "${args.definition}": ${args.unmetRequirements.map(requirement => requirement.title ?? requirement.name).join(", ")}. Pre-flight the verdict with evaluateStart.`), 
+        this.name = "StartNotAllowedError", this.definition = args.definition, this.unmetRequirements = args.unmetRequirements;
+    }
+}
+
+function actionRendering(action) {
+    const kind = action.disabledReason?.kind;
+    return kind === "filter-failed" ? "absent" : action.triggered === !0 || kind === "cascade-fired" ? "automation" : "button";
+}
+
+const disabledReasonDetail = {
+    "filter-failed": r => `action filter returned false${r.detail ? ` (${r.detail})` : ""}`,
+    "cascade-fired": r => `the action is cascade-fired (when: ${JSON.stringify(r.when)}) — the engine fires it on truth; it cannot be invoked via fireAction`,
+    "activity-not-active": r => `activity status is "${r.status}"`,
+    "stage-terminal": r => `stage "${r.stage}" is terminal`,
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "requirements-unmet": r => `unmet requirement(s): ${r.unmetRequirements.map(requirement => requirement.name).join(", ")}`,
+    "subject-permission-denied": r => `missing subject permission(s): ${subjectDenialLabels(r.denied).join(", ")}`
+};
+
+function actionDisabledDetail(reason) {
+    return disabledReasonDetail[reason.kind](reason);
+}
+
+function formatDisabledReason({activity: activity, action: action, reason: reason}) {
+    return `Action "${activity}:${action}" is not allowed: ${actionDisabledDetail(reason)}`;
+}
+
+class EditFieldDeniedError extends WorkflowError {
+    reason;
+    target;
+    constructor(args) {
+        super("edit-field-denied", formatEditDisabledReason(args.target, args.reason)), 
+        this.name = "EditFieldDeniedError", this.reason = args.reason, this.target = args.target;
+    }
+}
+
+const editDisabledReasonDetail = {
+    "not-editable": () => "field is not declared editable",
+    "instance-completed": r => `instance completed at ${r.completedAt}`,
+    "instance-aborted": r => `instance aborted at ${r.abortedAt}`,
+    "edit-window-closed": r => `edit window closed (${r.detail})`,
+    "editor-not-permitted": r => `editor not permitted (${r.predicate})`
+};
+
+function formatEditDisabledReason(target, reason) {
+    const detail = editDisabledReasonDetail[reason.kind](reason), where = target.activity !== void 0 ? `${target.activity}.${target.field}` : target.field;
+    return `Field "${target.scope}:${where}" is not editable: ${detail}`;
+}
+
+async function fireAction(args) {
+    const {client: client, instanceId: instanceId, activity: activity, action: action, params: params, requestRecord: requestRecord, options: options} = args;
+    return retryOnRevisionConflict({
+        client: client,
+        instanceId: instanceId,
+        options: options,
+        commit: ctx => commitAction({
+            ctx: ctx,
+            activityName: activity,
+            actionName: action,
+            callerParams: params,
+            requestRecord: requestRecord,
+            options: options
+        }),
+        onExhausted: () => new ConcurrentFireActionError({
+            instanceId: instanceId,
+            activity: activity,
+            action: action,
+            attempts: CONCURRENT_COMMIT_MAX_ATTEMPTS
+        })
+    });
+}
+
+async function resolveActionCommit({ctx: ctx, activityName: activityName, actionName: actionName, callerParams: callerParams, options: options}) {
+    const actor = options?.actor, {stage: stage, activity: activity} = findActivityInCurrentStage(ctx, activityName), action = (activity.actions ?? []).find(a => a.name === actionName);
+    if (action === void 0) throw new ContractViolationError(`Action "${actionName}" not declared on activity "${activityName}"`);
     if (action.when !== void 0) throw new ActionDisabledError({
         activity: activityName,
         action: actionName,
@@ -7322,7 +7922,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7334,10 +7935,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -8592,340 +9191,97 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
     if (validatedOps.length === 0) throw new EffectOpsInvalidError({
         effect: pending.name,
         issues: [ "a mid-dispatch report must carry at least one field op — there is nothing to commit" ]
-    });
-    const mutation = startMutation(ctx.instance);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), renewClaimLease({
-        mutation: mutation,
-        effectKey: effectKey,
-        now: ctx.now,
-        leaseMs: leaseMs
-    }), await runOps({
-        ops: validatedOps,
-        mutation: mutation,
-        stage: ctx.instance.currentStage,
-        origin: {
-            effect: pending.name
-        },
-        params: pending.params,
-        actor: ctx.actor,
-        self: selfGdr(ctx.instance),
-        now: ctx.now,
-        snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
-    }), await persistThenMaybeRefresh({
-        ctx: ctx,
-        mutation: mutation,
-        stageName: ctx.instance.currentStage,
-        didChangeState: !0
-    }), {
-        effectKey: effectKey,
-        effect: pending.name
-    };
-}
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
+    });
+    const mutation = startMutation(ctx.instance);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), renewClaimLease({
+        mutation: mutation,
+        effectKey: effectKey,
+        now: ctx.now,
+        leaseMs: leaseMs
+    }), await runOps({
+        ops: validatedOps,
+        mutation: mutation,
+        stage: ctx.instance.currentStage,
+        origin: {
+            effect: pending.name
         },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
+        params: pending.params,
+        actor: ctx.actor,
+        self: selfGdr(ctx.instance),
+        now: ctx.now,
+        snapshot: ctx.snapshot,
+        refSurface: ctx.refSurface
+    }), await persistThenMaybeRefresh({
+        ctx: ctx,
+        mutation: mutation,
+        stageName: ctx.instance.currentStage,
+        didChangeState: !0
+    }), {
+        effectKey: effectKey,
+        effect: pending.name
     };
 }
 
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
 
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
         client: client,
-        principalId: resourceId
+        instanceId: instanceId,
+        options: options
     });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
     });
 }
 
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
-
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
-}
-
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
-}
-
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -9109,7 +9465,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -9117,7 +9473,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -9142,6 +9498,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -9156,6 +9515,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9181,7 +9567,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -9198,22 +9584,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
-        actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -9262,6 +9640,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -9278,6 +9657,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9433,6 +9813,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: deriveActivityKind(activity),
         classification: deriveExecutorClassification(activity),
@@ -9603,9 +9984,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -10084,7 +10469,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -10097,10 +10483,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10590,6 +10974,9 @@ function buildEngineCallOptions(args) {
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -12348,7 +12735,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12370,6 +12757,9 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
     }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
@@ -13065,7 +13455,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -13170,6 +13560,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -13178,6 +13572,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -13291,4 +13693,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };