@sanity/workflow-engine 0.28.0 → 0.30.0

package/dist/index.cjs

@@ -144,6 +144,9 @@ function resolveFieldSite(site, stage) {
         ...site.entry.validation !== void 0 ? {
             validation: site.entry.validation
         } : {},
+        ...site.entry.roles !== void 0 ? {
+            roles: site.entry.roles
+        } : {},
         ref: {
             scope: site.scope,
             field: site.entry.name
@@ -280,58 +283,58 @@ function resolveTelemetry(telemetry) {
 }
 
 const HIGH_FREQUENCY_SAMPLE_MS = 6e4, WorkflowDefinitionDeployed = defineWorkflowEvent({
-    name: "Editorial Workflows Definition Deployed",
+    name: "Workflows Definition Deployed",
     version: 1,
     description: "A definition went through a deploy — status distinguishes a newly minted version from an unchanged redeploy"
 }), WorkflowInstanceStarted = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Started",
+    name: "Workflows Instance Started",
     version: 1,
     description: "A workflow instance was started from a deployed definition"
 }), WorkflowStageTransitioned = defineWorkflowEvent({
-    name: "Editorial Workflows Stage Transitioned",
+    name: "Workflows Stage Transitioned",
     version: 1,
     description: "A committed stage move — one event per hop, cascades included, whichever verb drove it. Unsampled: funnel and dwell reads need complete counts, and volume is bounded by actual movement"
 }), WorkflowActionFired = defineWorkflowEvent({
-    name: "Editorial Workflows Action Fired",
+    name: "Workflows Action Fired",
     version: 1,
     description: "An action was fired against an activity"
 }), WorkflowFieldEdited = defineWorkflowEvent({
-    name: "Editorial Workflows Field Edited",
+    name: "Workflows Field Edited",
     version: 1,
     description: "A declared-editable field was edited through the generic edit seam",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowInstanceTicked = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Ticked",
+    name: "Workflows Instance Ticked",
     version: 1,
     description: "An instance was re-evaluated for auto-transitions and due waits",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowEffectsDrained = defineWorkflowEvent({
-    name: "Editorial Workflows Effects Drained",
+    name: "Workflows Effects Drained",
     version: 1,
     description: "A drain pass ran — drainedCount/drainedEffects report the successful dispatches. Unsampled when non-empty (outcome counts must be complete; volume is bounded by real effect work); empty polls are machine-cadence noise, throttled engine-side to at most one per minute"
 }), WorkflowEffectStateReported = defineWorkflowEvent({
-    name: "Editorial Workflows Effect State Reported",
+    name: "Workflows Effect State Reported",
     version: 1,
     description: "A running effect handler committed mid-dispatch field state through commitEffectOps. Sampled (high-frequency by design — a dispatch may report many times): an adoption and usage signal, not an exact per-run report count",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowEffectCompleted = defineWorkflowEvent({
-    name: "Editorial Workflows Effect Completed",
+    name: "Workflows Effect Completed",
     version: 1,
-    description: "An effect outcome was recorded — reported directly through completeEffect, or cancelled by the abort verb (external runtimes; engine-drained effects surface via Editorial Workflows Effects Drained instead — each outcome counts once)"
+    description: "An effect outcome was recorded — reported directly through completeEffect, or cancelled by the abort verb (external runtimes; engine-drained effects surface via Workflows Effects Drained instead — each outcome counts once)"
 }), WorkflowInstanceAborted = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Aborted",
+    name: "Workflows Instance Aborted",
     version: 1,
     description: "The abort admin override was invoked (changed: false = instance already terminal)"
 }), WorkflowStageSet = defineWorkflowEvent({
-    name: "Editorial Workflows Stage Set",
+    name: "Workflows Stage Set",
     version: 1,
     description: "The set-stage admin override was invoked (changed: false = already at the target stage)"
 }), WorkflowActivityReset = defineWorkflowEvent({
-    name: "Editorial Workflows Activity Reset",
+    name: "Workflows Activity Reset",
     version: 1,
     description: "The reset-activity admin override was invoked (changed: false = already at the target status, or the instance was terminal)"
 }), WorkflowDefinitionDeleted = defineWorkflowEvent({
-    name: "Editorial Workflows Definition Deleted",
+    name: "Workflows Definition Deleted",
     version: 1,
     description: "A deployed definition (or one version of it) was removed via the admin verb"
 });
@@ -449,240 +452,6 @@ function fieldEditedData(args) {
     };
 }
 
-const DATA_MODEL_VERSION = 5, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
-
-class ReaderModelAcknowledgementError extends invariants.WorkflowError {
-    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
-    expectedMinReaderModel;
-    engineMinReaderModel=DATA_MODEL_MIN_READER;
-    engineModelVersion=DATA_MODEL_VERSION;
-    documentationUrl=READER_MODEL_ROLLOUT_URL;
-    constructor(expectedMinReaderModel, context = "Deployment") {
-        const expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
-        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}.\nDo not change the acknowledgement yet: accepting ${DATA_MODEL_MIN_READER} authorizes this engine to write documents that older readers will refuse.\nUpgrade every Studio, CLI, MCP server, Function, and other runtime that reads engine-owned documents; verify that rollout in every environment sharing the workflow resource; then change the literal in deployment configuration and deploy the writer.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
-        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel;
-    }
-}
-
-function assertReaderModelAcknowledgement(expectedMinReaderModel, context) {
-    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel !== DATA_MODEL_MIN_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, context);
-}
-
-const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
-    id: "governed-model-stamps",
-    introducedInModel: 1,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "unconditional",
-    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
-}), Object.freeze({
-    id: "subject-field-kind",
-    introducedInModel: 2,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "A workflow-level subject field identifies the document a workflow is about."
-}), Object.freeze({
-    id: "typed-scalar-choice-lists",
-    introducedInModel: 2,
-    minReaderModel: 2,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "Scalar fields may constrain writes to a persisted typed choice list."
-}), Object.freeze({
-    id: "action-semantics",
-    introducedInModel: 2,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Ordinary actions may carry a closed bag of advisory workflow semantics."
-}), Object.freeze({
-    id: "inclusive-scalar-bounds",
-    introducedInModel: 2,
-    minReaderModel: 2,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "String, text, and number values may carry persisted inclusive bounds."
-}), Object.freeze({
-    id: "progress-field-kind",
-    introducedInModel: 3,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "A progress field kind carries application-defined 0–100 completion."
-}), Object.freeze({
-    id: "effect-claim-tokens",
-    introducedInModel: 3,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
-}), Object.freeze({
-    id: "classified-principal-ids",
-    introducedInModel: 4,
-    minReaderModel: 4,
-    documentTypes: Object.freeze([ "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "unconditional",
-    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
-}), Object.freeze({
-    id: "readiness-requirements",
-    introducedInModel: 4,
-    minReaderModel: 4,
-    documentTypes: Object.freeze([ "definition" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "Start and activity readiness use named polymorphic requirement arrays."
-}), Object.freeze({
-    id: "due-date-field-kinds",
-    introducedInModel: 5,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
-}) ]);
-
-function recordOf(value) {
-    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
-}
-
-function recordsAt(record, key) {
-    const value = record[key];
-    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
-}
-
-function nestedFieldEntries(entries) {
-    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
-}
-
-function parsedDefinitionSnapshot(root) {
-    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
-        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
-        definitionSnapshot: root.definitionSnapshot
-    }));
-}
-
-function persistedFieldEntries(document) {
-    const root = recordOf(document);
-    if (root === void 0) return [];
-    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], stages = roots.flatMap(candidate => recordsAt(candidate, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions")), effects = actions.flatMap(action => recordsAt(action, "effects"));
-    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
-}
-
-function hasChoiceList(document) {
-    return persistedFieldEntries(document).some(entry => {
-        const options = recordOf(entry.options);
-        return options !== void 0 && Array.isArray(options.list);
-    });
-}
-
-function hasFieldKind(document, kind) {
-    return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
-}
-
-function hasActionSemantics(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "stages").flatMap(stage => recordsAt(stage, "activities")).flatMap(activity => recordsAt(activity, "actions")).some(action => Array.isArray(action.semantics));
-}
-
-function hasScalarValidation(document) {
-    return persistedFieldEntries(document).some(entry => {
-        const validation = recordOf(entry.validation);
-        return typeof validation?.min == "number" || typeof validation?.max == "number";
-    });
-}
-
-function hasClaimTokens(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
-        const claim = recordOf(entry.claim);
-        return claim !== void 0 && typeof claim.claimToken == "string";
-    });
-}
-
-function hasReadinessRequirements(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
-}
-
-const featureDetectors = {
-    "governed-model-stamps": () => !0,
-    "subject-field-kind": document => hasFieldKind(document, "subject"),
-    "typed-scalar-choice-lists": hasChoiceList,
-    "action-semantics": hasActionSemantics,
-    "inclusive-scalar-bounds": hasScalarValidation,
-    "progress-field-kind": document => hasFieldKind(document, "progress"),
-    "effect-claim-tokens": hasClaimTokens,
-    "classified-principal-ids": () => !0,
-    "readiness-requirements": hasReadinessRequirements,
-    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime")
-};
-
-function requiredModelFeatures(documentType, document) {
-    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
-}
-
-function requiredReaderModel(documentType, document) {
-    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
-}
-
-function modelStampFor(args) {
-    return {
-        modelVersion: DATA_MODEL_VERSION,
-        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
-    };
-}
-
-function fieldTreeShape(value) {
-    if (Array.isArray(value)) return value.map(fieldTreeShape);
-    if (value === null) return "null";
-    if (typeof value == "object") {
-        const record = value;
-        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
-    }
-    return typeof value;
-}
-
-function modelVersionOf(doc) {
-    const stamp = doc.modelVersion;
-    return typeof stamp == "number" ? stamp : 0;
-}
-
-function minReaderModelOf(doc) {
-    const floor = doc.minReaderModel;
-    return typeof floor == "number" ? floor : modelVersionOf(doc);
-}
-
-class ModelVersionAheadError extends invariants.WorkflowError {
-    documentId;
-    documentModelVersion;
-    requiredReaderModel;
-    engineModelVersion;
-    constructor(args) {
-        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
-        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
-        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
-    }
-}
-
-function assertReadableModel(doc) {
-    const documentReaderModel = minReaderModelOf(doc);
-    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
-        documentId: doc._id,
-        documentModelVersion: modelVersionOf(doc),
-        requiredReaderModel: documentReaderModel
-    });
-    return doc;
-}
-
 function effectSites(def) {
     const sites = [];
     for (const stage of def.stages ?? []) for (const activity of stage.activities ?? []) for (const action of activity.actions ?? []) for (const effect of action.effects ?? []) sites.push({
@@ -1157,12 +926,8 @@ function renderWorkflowRead(read, ctx) {
             text: groqConditionDescribe.guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return groqConditionDescribe.phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return groqConditionDescribe.phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -1184,6 +949,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return groqConditionDescribe.phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return groqConditionDescribe.phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${groqConditionDescribe.guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -2612,7 +2395,7 @@ class CascadeLimitError extends invariants.WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2620,38 +2403,7 @@ function isFieldOp(summary) {
 
 function validateActionParams({action: action, activityName: activityName, callerParams: callerParams}) {
     const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
-    for (const decl of declared) {
-        const value = params[decl.name], present = decl.name in params && value !== void 0 && value !== null;
-        if (decl.required === !0 && !present) {
-            issues.push({
-                param: decl.name,
-                reason: "required but missing"
-            });
-            continue;
-        }
-        if (!present) continue;
-        if (!checkParamType(value, decl)) {
-            issues.push({
-                param: decl.name,
-                reason: `expected type=${decl.type}, got ${typeof value}`
-            });
-            continue;
-        }
-        const choiceIssues = invariants.choiceValueIssues(decl.options, value);
-        choiceIssues !== void 0 && issues.push({
-            param: decl.name,
-            reason: choiceIssues.join("; ")
-        });
-        const validationIssues = invariants.scalarValidationIssues({
-            entryType: decl.type,
-            validation: decl.validation,
-            value: value
-        });
-        validationIssues !== void 0 && issues.push({
-            param: decl.name,
-            reason: validationIssues.join("; ")
-        });
-    }
+    for (const decl of declared) issues.push(...declaredParamIssues(decl, params));
     if (issues.length > 0) throw new ActionParamsInvalidError({
         action: action.name,
         activity: activityName,
@@ -2660,6 +2412,30 @@ function validateActionParams({action: action, activityName: activityName, calle
     return params;
 }
 
+function declaredParamIssues(decl, params) {
+    const value = params[decl.name];
+    if (!(decl.name in params && value !== void 0 && value !== null)) return decl.required === !0 ? [ {
+        param: decl.name,
+        reason: "required but missing"
+    } ] : [];
+    if (!checkParamType(value, decl)) return [ {
+        param: decl.name,
+        reason: `expected type=${decl.type}, got ${typeof value}`
+    } ];
+    const choiceIssues = invariants.choiceValueIssues(decl.options, value), validationIssues = invariants.scalarValidationIssues({
+        entryType: decl.type,
+        validation: decl.validation,
+        value: value
+    });
+    return [ ...choiceIssues === void 0 ? [] : [ {
+        param: decl.name,
+        reason: choiceIssues.join("; ")
+    } ], ...validationIssues === void 0 ? [] : [ {
+        param: decl.name,
+        reason: validationIssues.join("; ")
+    } ] ];
+}
+
 function hasStringField(value, field) {
     return typeof value == "object" && value !== null && field in value && typeof value[field] == "string";
 }
@@ -2711,9 +2487,11 @@ async function runOps(args) {
             now: now,
             snapshot: snapshot,
             refSurface: refSurface,
-            opsFromDefinition: opsFromDefinition
+            opsFromDefinition: opsFromDefinition,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2724,6 +2502,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2795,12 +2577,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2821,7 +2610,12 @@ function applyFieldSet(op, ctx) {
         entryType: entry._type,
         entryName: entry.name,
         value: value,
-        ...entryShape(entry)
+        ...entryShape(entry),
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases,
+        ...entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
+            previousValue: entry.value
+        } : {}
     });
     return assertRuntimeRefsWithinSurface({
         entryType: entry._type,
@@ -2839,6 +2633,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return invariants.isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = invariants.validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new invariants.FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2846,7 +2712,17 @@ function entryShape(entry) {
         of: entry.of
     } : invariants.isSingleDocRefEntry(entry) || entry._type === "doc.refs" ? entry.types !== void 0 ? {
         types: entry.types
-    } : {} : {
+    } : {} : invariants.isAssignmentFieldEntry(entry) ? assignmentEntryShape(entry) : scalarEntryShape(entry);
+}
+
+function assignmentEntryShape(entry) {
+    return entry.roles !== void 0 ? {
+        roles: entry.roles
+    } : {};
+}
+
+function scalarEntryShape(entry) {
+    return {
         ...entry.options !== void 0 ? {
             options: entry.options
         } : {},
@@ -2874,15 +2750,10 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, invariants.isAlwaysArrayFieldKind(entry._type) ? [] : null), 
+    {
         opType: op.type,
         target: op.target
     };
@@ -2900,7 +2771,10 @@ function applyFieldAppend(op, ctx) {
         entryName: entry.name,
         item: item,
         types: entry._type === "doc.refs" ? entry.types : void 0,
-        of: entry._type === "array" ? entry.of : void 0
+        of: entry._type === "array" ? entry.of : void 0,
+        roles: entry._type === "assignees" ? entry.roles : void 0,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     assertRuntimeRefsWithinSurface({
         entryType: entry._type === "doc.refs" ? "doc.ref" : "object",
@@ -2921,7 +2795,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return invariants.isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -2948,6 +2822,13 @@ async function applyFieldUpdateWhere(op, ctx) {
         merge: mergeRecord,
         entry: entry,
         op: op
+    }), invariants.validateFieldValue({
+        entryType: "array",
+        entryName: entry.name,
+        value: [ mergeRecord ],
+        of: entry.of,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     const matches = await rowMatches({
         where: op.where,
@@ -3064,18 +2945,6 @@ function subSlot(target, field) {
 function resolveOpValue(args) {
     const {src: src, ctx: ctx, target: target} = args;
     switch (src.type) {
-      case "literal":
-      case "param":
-      case "actor":
-      case "now":
-        return resolveStaticValueExpr(src, ctx);
-
-      case "self":
-        return ctx.self;
-
-      case "stage":
-        return ctx.stage;
-
       case "fieldRead":
         {
             const entry = readEntryFromMutation(ctx, src);
@@ -3105,6 +2974,25 @@ function resolveOpValue(args) {
             }
             return out;
         }
+
+      default:
+        return resolveAtomicOpValue(src, ctx);
+    }
+}
+
+function resolveAtomicOpValue(src, ctx) {
+    switch (src.type) {
+      case "literal":
+      case "param":
+      case "actor":
+      case "now":
+        return resolveStaticValueExpr(src, ctx);
+
+      case "self":
+        return ctx.self;
+
+      case "stage":
+        return ctx.stage;
     }
 }
 
@@ -3555,75 +3443,424 @@ async function assertInstanceWriteAllowed(args) {
     });
 }
 
-async function renderConditionScope(source, opts) {
-    const {instance: instance, definition: definition, snapshot: snapshot, now: now} = source, base = buildParams({
-        instance: instance,
-        now: now,
-        snapshot: snapshot
-    }), fields = {
-        ...base.fields,
-        ...scopedFieldOverlay({
-            instance: instance,
-            snapshot: snapshot,
-            activityName: opts?.activityName
-        })
-    }, params = {
-        ...base,
-        fields: fields,
-        actor: opts?.actor,
-        assigned: opts?.activityName !== void 0 ? assignedFor({
-            instance: instance,
-            activityName: opts.activityName,
-            actor: opts?.actor,
-            roleAliases: definition.roleAliases
-        }) : !1,
-        ...opts?.vars
-    };
-    return {
-        ...await invariants.evaluatePredicates({
-            predicates: definition.predicates,
-            snapshot: snapshot,
-            params: params
-        }),
-        ...params
-    };
-}
+const DATA_MODEL_VERSION = 8, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 8, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
 
-function definitionLookupGroq(explicit) {
-    const scoped = `_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${invariants.tagScopeFilter()}`;
-    return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
+class ReaderModelAcknowledgementError extends invariants.WorkflowError {
+    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
+    expectedMinReaderModel;
+    requiredMinReaderModel;
+    engineMinReaderModel=DATA_MODEL_MIN_READER;
+    engineMaxReaderModel=DATA_MODEL_MAX_READER;
+    engineModelVersion=DATA_MODEL_VERSION;
+    documentationUrl=READER_MODEL_ROLLOUT_URL;
+    constructor(expectedMinReaderModel, options = {}) {
+        const {context: context = "Deployment", requiredMinReaderModel: requiredMinReaderModel = DATA_MODEL_MIN_READER} = options, expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
+        super("reader-model-acknowledgement", `${context} acknowledges reader model ${expected}; the submitted definitions require at least ${requiredMinReaderModel}, and this writer supports acknowledgements through ${DATA_MODEL_MAX_READER}.\nUse a reviewed numeric literal in that range. Before raising it, ensure every runtime sharing the workflow resource can read the required model.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
+        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel, 
+        this.requiredMinReaderModel = requiredMinReaderModel;
+    }
 }
 
-function definitionsListGroq(versionOrder) {
-    return `*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && ${invariants.tagScopeFilter()}] | order(name asc, version ${versionOrder})`;
+function assertReaderModelAcknowledgement(expectedMinReaderModel, options) {
+    const {context: context, requiredMinReaderModel: requiredMinReaderModel} = options;
+    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel < requiredMinReaderModel || expectedMinReaderModel > DATA_MODEL_MAX_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, {
+        requiredMinReaderModel: requiredMinReaderModel,
+        ...context !== void 0 ? {
+            context: context
+        } : {}
+    });
 }
 
-function latestDefinitionsGroq() {
-    const scoped = `_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && ${invariants.tagScopeFilter()}`;
-    return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
-}
+const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
+    id: "governed-model-stamps",
+    introducedInModel: 1,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
+}), Object.freeze({
+    id: "subject-field-kind",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A workflow-level subject field identifies the document a workflow is about."
+}), Object.freeze({
+    id: "typed-scalar-choice-lists",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Scalar fields may constrain writes to a persisted typed choice list."
+}), Object.freeze({
+    id: "action-semantics",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Ordinary actions may carry advisory workflow semantics."
+}), Object.freeze({
+    id: "inclusive-scalar-bounds",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "String, text, and number values may carry persisted inclusive bounds."
+}), Object.freeze({
+    id: "progress-field-kind",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A progress field kind carries application-defined 0–100 completion."
+}), Object.freeze({
+    id: "effect-claim-tokens",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
+}), Object.freeze({
+    id: "classified-principal-ids",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "unconditional",
+    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
+}), Object.freeze({
+    id: "readiness-requirements",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Start and activity readiness use named polymorphic requirement arrays."
+}), Object.freeze({
+    id: "due-date-field-kinds",
+    introducedInModel: 5,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
+}), Object.freeze({
+    id: "role-constrained-assignment-fields",
+    introducedInModel: 8,
+    minReaderModel: 8,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Assignee fields may restrict newly assigned users and collective roles by role."
+}) ]);
 
-function deployedTagsGroq() {
-    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+function recordOf(value) {
+    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
 }
 
-function definitionTagsGroq() {
-    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+function recordsAt(record, key) {
+    const value = record[key];
+    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
 }
 
-function latestDeployedDefinitions(rows) {
-    const byName = /* @__PURE__ */ new Map;
-    for (const row of rows) {
-        const held = byName.get(row.name);
-        (held === void 0 || row.version > held.version) && byName.set(row.name, row);
-    }
-    return [ ...byName.values() ];
+function nestedFieldEntries(entries) {
+    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
 }
 
-function liveChildrenField(instance) {
-    const live = liveSubworkflows(instance).length;
-    return live > 0 ? {
-        liveChildren: live
+function parsedDefinitionSnapshot(root) {
+    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
+        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
+        definitionSnapshot: root.definitionSnapshot
+    }));
+}
+
+function persistedDefinitionTree(document) {
+    const root = recordOf(document);
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
+    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
+}
+
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function hasChoiceList(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const options = recordOf(entry.options);
+        return options !== void 0 && Array.isArray(options.list);
+    });
+}
+
+function entryHasKind(entry, kind) {
+    return entryKindMatches(entry, candidate => candidate === kind);
+}
+
+function entryKindMatches(entry, accepts) {
+    return [ entry.type, entry._type ].some(kind => typeof kind == "string" && accepts(kind));
+}
+
+function hasFieldKind(document, kind) {
+    return persistedFieldEntries(document).some(entry => entryHasKind(entry, kind));
+}
+
+function definitionNodes(document) {
+    const root = recordOf(document);
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
+}
+
+function hasScalarValidation(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const validation = recordOf(entry.validation);
+        return typeof validation?.min == "number" || typeof validation?.max == "number";
+    });
+}
+
+function hasClaimTokens(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
+        const claim = recordOf(entry.claim);
+        return claim !== void 0 && typeof claim.claimToken == "string";
+    });
+}
+
+function hasReadinessRequirements(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
+}
+
+function hasRoleConstrainedAssignments(document) {
+    return persistedFieldEntries(document).some(entry => entryKindMatches(entry, invariants.assignmentKindAcceptsRoles) && Array.isArray(entry.roles) && entry.roles.length > 0);
+}
+
+const featureDetectors = {
+    "governed-model-stamps": () => !0,
+    "subject-field-kind": document => hasFieldKind(document, "subject"),
+    "typed-scalar-choice-lists": hasChoiceList,
+    "action-semantics": hasActionSemantics,
+    "inclusive-scalar-bounds": hasScalarValidation,
+    "progress-field-kind": document => hasFieldKind(document, "progress"),
+    "effect-claim-tokens": hasClaimTokens,
+    "classified-principal-ids": () => !0,
+    "readiness-requirements": hasReadinessRequirements,
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "role-constrained-assignment-fields": hasRoleConstrainedAssignments,
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
+};
+
+function requiredModelFeatures(documentType, document) {
+    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
+}
+
+function requiredReaderModel(documentType, document) {
+    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
+}
+
+function requiredDefinitionReaderModel(definitions) {
+    return Math.max(DATA_MODEL_MIN_READER, ...definitions.map(definition => requiredReaderModel("definition", definition)));
+}
+
+function modelStampFor(args) {
+    return {
+        modelVersion: DATA_MODEL_VERSION,
+        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
+    };
+}
+
+function fieldTreeShape(value) {
+    if (Array.isArray(value)) return value.map(fieldTreeShape);
+    if (value === null) return "null";
+    if (typeof value == "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
+    }
+    return typeof value;
+}
+
+function modelVersionOf(doc) {
+    const stamp = doc.modelVersion;
+    return typeof stamp == "number" ? stamp : 0;
+}
+
+function minReaderModelOf(doc) {
+    const floor = doc.minReaderModel;
+    return typeof floor == "number" ? floor : modelVersionOf(doc);
+}
+
+class ModelVersionAheadError extends invariants.WorkflowError {
+    documentId;
+    documentModelVersion;
+    requiredReaderModel;
+    engineModelVersion;
+    constructor(args) {
+        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
+        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
+        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
+    }
+}
+
+function assertReadableModel(doc) {
+    const documentReaderModel = minReaderModelOf(doc);
+    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
+        documentId: doc._id,
+        documentModelVersion: modelVersionOf(doc),
+        requiredReaderModel: documentReaderModel
+    });
+    return doc;
+}
+
+async function renderConditionScope(source, opts) {
+    const {instance: instance, definition: definition, snapshot: snapshot, now: now} = source, base = buildParams({
+        instance: instance,
+        now: now,
+        snapshot: snapshot
+    }), fields = {
+        ...base.fields,
+        ...scopedFieldOverlay({
+            instance: instance,
+            snapshot: snapshot,
+            activityName: opts?.activityName
+        })
+    }, params = {
+        ...base,
+        fields: fields,
+        actor: opts?.actor,
+        assigned: opts?.activityName !== void 0 ? assignedFor({
+            instance: instance,
+            activityName: opts.activityName,
+            actor: opts?.actor,
+            roleAliases: definition.roleAliases
+        }) : !1,
+        ...opts?.vars
+    };
+    return {
+        ...await invariants.evaluatePredicates({
+            predicates: definition.predicates,
+            snapshot: snapshot,
+            params: params
+        }),
+        ...params
+    };
+}
+
+function definitionLookupGroq(explicit) {
+    const scoped = `_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${invariants.tagScopeFilter()}`;
+    return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
+}
+
+function definitionsListGroq(versionOrder) {
+    return `*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && ${invariants.tagScopeFilter()}] | order(name asc, version ${versionOrder})`;
+}
+
+function latestDefinitionsGroq() {
+    const scoped = `_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && ${invariants.tagScopeFilter()}`;
+    return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
+}
+
+function deployedTagsGroq() {
+    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+}
+
+function definitionTagsGroq() {
+    return `array::unique(*[_type == "${invariants.WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+}
+
+function latestDeployedDefinitions(rows) {
+    const byName = /* @__PURE__ */ new Map;
+    for (const row of rows) {
+        const held = byName.get(row.name);
+        (held === void 0 || row.version > held.version) && byName.set(row.name, row);
+    }
+    return [ ...byName.values() ];
+}
+
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
+}
+
+function liveChildrenField(instance) {
+    const live = liveSubworkflows(instance).length;
+    return live > 0 ? {
+        liveChildren: live
     } : {};
 }
 
@@ -3708,6 +3945,27 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
     const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
@@ -3726,7 +3984,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -3788,35 +4046,235 @@ function isClaimExpired(claim, now) {
     return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ], EXECUTION_KINDS = {
-    interactive: "interactive",
-    server: "server",
-    cli: "cli",
-    mcp: "mcp",
-    drainer: "drainer",
-    script: "script",
-    test: "test",
-    studio: "studio",
-    sdkApp: "sdk-app"
-};
+const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ];
 
-function detectRuntime() {
-    const g = globalThis;
-    if (g.Deno !== void 0) return "deno";
-    if (g.Bun !== void 0) return "bun";
-    if (g.EdgeRuntime !== void 0) return "edge";
-    if (g.window !== void 0 && g.document !== void 0) return "browser";
-    if (g.WorkerGlobalScope !== void 0 && g.self !== void 0) return "worker";
-    const proc = g.process;
-    return typeof proc == "object" && proc !== null && typeof proc.versions?.node == "string" ? "node" : "unknown";
+function userLoginProvider(user) {
+    return user?.provider ?? user?.loginProvider;
 }
 
-let inferredRuntime;
+function optionalString(value) {
+    return value === void 0 || typeof value == "string";
+}
 
-function resolveExecutionContext(declared) {
-    return inferredRuntime ??= detectRuntime(), {
-        runtime: inferredRuntime,
-        ...declared?.kind !== void 0 ? {
+function isClientProjectUser(value) {
+    return invariants.isRecord(value) && typeof value.id == "string" && optionalString(value.sanityUserId) && optionalString(value.displayName) && optionalString(value.email) && (value.imageUrl === null || optionalString(value.imageUrl)) && optionalString(value.provider) && optionalString(value.loginProvider);
+}
+
+function objectProperty(value, property) {
+    if (!invariants.isRecord(value)) return;
+    const propertyValue = value[property];
+    return typeof propertyValue == "object" && propertyValue !== null ? propertyValue : void 0;
+}
+
+function stringProperty(value, property) {
+    const propertyValue = Reflect.get(value, property);
+    return typeof propertyValue == "string" ? propertyValue : void 0;
+}
+
+function apiErrorType(error) {
+    const response = objectProperty(error, "response"), body = objectProperty(response, "body");
+    if (!body) return;
+    const nestedError = objectProperty(body, "error");
+    return (nestedError ? stringProperty(nestedError, "type") : void 0) ?? stringProperty(body, "type");
+}
+
+function isProjectUserNotFoundError(error) {
+    return apiErrorType(error) === "projectUserNotFoundError";
+}
+
+const memberJoinCache = /* @__PURE__ */ new WeakMap;
+
+function joinCacheFor(client) {
+    let cache = memberJoinCache.get(client);
+    return cache === void 0 && (cache = /* @__PURE__ */ new Map, memberJoinCache.set(client, cache)), 
+    cache;
+}
+
+function isClientProjectMember(value) {
+    return invariants.isRecord(value) && typeof value.id == "string";
+}
+
+async function requestProjectMembers(request, projectId) {
+    const project = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}`
+    }), members = invariants.isRecord(project) ? project.members : void 0;
+    if (!Array.isArray(members) || !members.every(isClientProjectMember)) throw new Error(`Project member directory response is invalid for project "${projectId}"`);
+    return members;
+}
+
+async function requestProjectUsers(args) {
+    const {request: request, projectId: projectId, memberIds: memberIds} = args, response = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
+    }), rows = Array.isArray(response) ? response : [ response ];
+    if (!rows.every(isClientProjectUser)) throw new Error(`Project user directory response is invalid for project "${projectId}"`);
+    const requested = new Set(memberIds);
+    return rows.filter(row => requested.has(row.id));
+}
+
+async function requestProjectMemberDirectory(args) {
+    const {request: request, projectId: projectId} = args, members = await requestProjectMembers(request, projectId), memberIds = members.map(member => member.id).filter(id => invariants.classifyPrincipalId(id).namespace === "project");
+    if (memberIds.length === 0) return {
+        members: members,
+        globalUsers: []
+    };
+    const users = await requestProjectUsers({
+        request: request,
+        projectId: projectId,
+        memberIds: memberIds
+    });
+    return {
+        members: members,
+        globalUsers: users.flatMap(user => {
+            const globalId = invariants.directoryBridgeId(user.sanityUserId);
+            return globalId === void 0 ? [] : [ {
+                memberId: user.id,
+                globalId: globalId,
+                user: user
+            } ];
+        })
+    };
+}
+
+async function resolveGlobalProjectUser(args) {
+    const {client: client, request: request, projectId: projectId, id: id} = args, cache = joinCacheFor(client), key = `${projectId}:${id}`, hit = cache.get(key);
+    if (hit !== void 0) return hit === null ? {
+        status: "missing"
+    } : {
+        status: "resolved",
+        user: hit
+    };
+    try {
+        await ingestMemberJoin({
+            request: request,
+            projectId: projectId,
+            cache: cache
+        });
+        const found = cache.get(key);
+        return found != null ? {
+            status: "resolved",
+            user: found
+        } : (cache.set(key, null), {
+            status: "missing"
+        });
+    } catch (cause) {
+        return {
+            status: "inaccessible",
+            cause: cause
+        };
+    }
+}
+
+async function ingestMemberJoin(args) {
+    const {request: request, projectId: projectId, cache: cache} = args, snapshot = await requestProjectMemberDirectory({
+        request: request,
+        projectId: projectId
+    });
+    for (const {globalId: globalId, user: user} of snapshot.globalUsers) cache.set(`${projectId}:${globalId}`, user);
+}
+
+function clientProjectUserDirectory(client, projectId) {
+    return {
+        findById: async id => {
+            if (!client.request) return {
+                status: "inaccessible",
+                cause: new Error("Project-user resolution requires WorkflowClient.request")
+            };
+            if (invariants.classifyPrincipalId(id).namespace === "global") return resolveGlobalProjectUser({
+                client: client,
+                request: client.request,
+                projectId: projectId,
+                id: id
+            });
+            try {
+                const response = await client.request({
+                    uri: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
+                }), candidate = Array.isArray(response) ? response[0] : response;
+                return candidate == null ? {
+                    status: "missing"
+                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
+                    status: "inaccessible",
+                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
+                } : {
+                    status: "resolved",
+                    user: candidate
+                } : {
+                    status: "inaccessible",
+                    cause: new Error("Project-user response had an invalid shape")
+                };
+            } catch (cause) {
+                return isProjectUserNotFoundError(cause) ? {
+                    status: "missing"
+                } : {
+                    status: "inaccessible",
+                    cause: cause
+                };
+            }
+        }
+    };
+}
+
+function resolveClientActor(client, args) {
+    return resolveActor(clientProjectUserDirectory(client, args.projectId), args.actor);
+}
+
+async function resolveActor(directory, actor) {
+    if (actor.kind !== "person") return {
+        status: "not-person",
+        actor: actor
+    };
+    const personActor = {
+        ...actor,
+        kind: "person"
+    }, lookup = await directory.findById(personActor.id);
+    return lookup.status === "resolved" ? {
+        status: "resolved",
+        actor: personActor,
+        user: lookup.user
+    } : lookup.status === "inaccessible" ? {
+        status: "inaccessible",
+        actor: personActor,
+        ...lookup.cause === void 0 ? {} : {
+            cause: lookup.cause
+        }
+    } : {
+        status: "missing",
+        actor: personActor
+    };
+}
+
+function assertRoleConstrainedAssignmentResource(args) {
+    if (hasRoleConstrainedAssignments(args.definition) && args.workflowResource.type !== "dataset") throw new Error(`${args.context}: definition "${args.definition.name}" uses role-constrained assignment fields, which require a dataset workflow resource; received resource type "${args.workflowResource.type}"`);
+}
+
+const EXECUTION_KINDS = {
+    interactive: "interactive",
+    server: "server",
+    cli: "cli",
+    mcp: "mcp",
+    drainer: "drainer",
+    script: "script",
+    test: "test",
+    studio: "studio",
+    sdkApp: "sdk-app"
+};
+
+function detectRuntime() {
+    const g = globalThis;
+    if (g.Deno !== void 0) return "deno";
+    if (g.Bun !== void 0) return "bun";
+    if (g.EdgeRuntime !== void 0) return "edge";
+    if (g.window !== void 0 && g.document !== void 0) return "browser";
+    if (g.WorkerGlobalScope !== void 0 && g.self !== void 0) return "worker";
+    const proc = g.process;
+    return typeof proc == "object" && proc !== null && typeof proc.versions?.node == "string" ? "node" : "unknown";
+}
+
+let inferredRuntime;
+
+function resolveExecutionContext(declared) {
+    return inferredRuntime ??= detectRuntime(), {
+        runtime: inferredRuntime,
+        ...declared?.kind !== void 0 ? {
             kind: declared.kind
         } : {},
         ...declared?.id !== void 0 ? {
@@ -4105,10 +4563,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return invariants.isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4213,6 +4669,9 @@ function buildResolvedEntry({entry: entry, value: value, _key: _key, now: now})
         ...entry.validation !== void 0 ? {
             validation: entry.validation
         } : {},
+        ...entry.roles !== void 0 ? {
+            roles: entry.roles
+        } : {},
         value: value,
         ...entry.initialValue?.type === "query" ? {
             resolvedAt: now
@@ -4244,7 +4703,10 @@ async function resolveOneEntry({entry: entry, initialFields: initialFields, ctx:
             fields: entry.fields,
             of: entry.of,
             options: entry.options,
-            validation: entry.validation
+            validation: entry.validation,
+            roles: entry.roles,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.roleAliases
         });
         return "issues" in check ? (ctx.recordDiscard?.({
             field: entry.name,
@@ -4269,7 +4731,10 @@ async function resolveOneEntry({entry: entry, initialFields: initialFields, ctx:
         fields: entry.fields,
         of: entry.of,
         options: entry.options,
-        validation: entry.validation
+        validation: entry.validation,
+        roles: entry.roles,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     return entry.initialValue?.type === "input" && ctx.inputProvenance !== "definition" && assertRefsWithinSurface({
         entryType: entry.type,
@@ -4363,7 +4828,7 @@ function coerceToGdr(raw, workflowResource) {
     } : null;
 }
 
-const NonEmpty = invariants.NonEmptyString, UnknownRecord = v__namespace.record(v__namespace.string(), v__namespace.unknown()), PersistedChoiceOptionsSchema = v__namespace.looseObject({
+const NonEmpty = invariants.NonEmptyString, PersistedAssignmentRolesSchema = v__namespace.pipe(v__namespace.array(invariants.NonEmptyString), v__namespace.minLength(1, "assignment roles must not be empty")), UnknownRecord = v__namespace.record(v__namespace.string(), v__namespace.unknown()), PersistedChoiceOptionsSchema = v__namespace.looseObject({
     list: v__namespace.array(v__namespace.looseObject({
         title: v__namespace.string(),
         value: v__namespace.union([ v__namespace.string(), v__namespace.number() ])
@@ -4378,6 +4843,7 @@ const NonEmpty = invariants.NonEmptyString, UnknownRecord = v__namespace.record(
     description: v__namespace.optional(v__namespace.string()),
     options: v__namespace.optional(PersistedChoiceOptionsSchema),
     validation: v__namespace.optional(PersistedScalarValidationSchema),
+    roles: v__namespace.optional(PersistedAssignmentRolesSchema),
     fields: v__namespace.optional(v__namespace.array(PersistedFieldShapeSchema)),
     of: v__namespace.optional(v__namespace.array(PersistedFieldShapeSchema))
 }))), ExecutionContextSchema = invariants.tolerantObject()({
@@ -4423,7 +4889,13 @@ const OptionalRefTypes = v__namespace.exactOptional(v__namespace.array(v__namesp
 })), v__namespace.looseObject(invariants.tolerantEntries()({
     ...fieldArm("subject", invariants.fieldValueSchemas.subject),
     types: OptionalRefTypes
-})), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("release.ref", invariants.fieldValueSchemas["release.ref"]))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("string", invariants.fieldValueSchemas.string))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("text", invariants.fieldValueSchemas.text))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("number", invariants.fieldValueSchemas.number))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("progress", invariants.fieldValueSchemas.progress))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("boolean", invariants.fieldValueSchemas.boolean))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("date", invariants.fieldValueSchemas.date))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("dueDate", invariants.fieldValueSchemas.dueDate))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("datetime", invariants.fieldValueSchemas.datetime))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("dueDatetime", invariants.fieldValueSchemas.dueDatetime))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("url", invariants.fieldValueSchemas.url))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("actor", invariants.fieldValueSchemas.actor))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("assignee", invariants.fieldValueSchemas.assignee))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("assignees", invariants.fieldValueSchemas.assignees))), v__namespace.looseObject(invariants.tolerantEntries()({
+})), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("release.ref", invariants.fieldValueSchemas["release.ref"]))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("string", invariants.fieldValueSchemas.string))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("text", invariants.fieldValueSchemas.text))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("number", invariants.fieldValueSchemas.number))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("progress", invariants.fieldValueSchemas.progress))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("boolean", invariants.fieldValueSchemas.boolean))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("date", invariants.fieldValueSchemas.date))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("dueDate", invariants.fieldValueSchemas.dueDate))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("datetime", invariants.fieldValueSchemas.datetime))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("dueDatetime", invariants.fieldValueSchemas.dueDatetime))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("url", invariants.fieldValueSchemas.url))), v__namespace.looseObject(invariants.tolerantEntries()(fieldArm("actor", invariants.fieldValueSchemas.actor))), v__namespace.looseObject(invariants.tolerantEntries()({
+    ...fieldArm("assignee", invariants.fieldValueSchemas.assignee),
+    roles: v__namespace.exactOptional(PersistedAssignmentRolesSchema)
+})), v__namespace.looseObject(invariants.tolerantEntries()({
+    ...fieldArm("assignees", invariants.fieldValueSchemas.assignees),
+    roles: v__namespace.exactOptional(PersistedAssignmentRolesSchema)
+})), v__namespace.looseObject(invariants.tolerantEntries()({
     ...fieldArm("object", v__namespace.union([ v__namespace.null(), UnknownRecord ])),
     fields: v__namespace.array(PersistedFieldShapeSchema)
 })), v__namespace.looseObject(invariants.tolerantEntries()({
@@ -4674,6 +5146,37 @@ function parseInstanceDocument(doc) {
     });
 }
 
+const WorkflowInstancePreviewEffectSchema = invariants.tolerantObject()({
+    name: NonEmpty,
+    title: v__namespace.exactOptional(v__namespace.string())
+}), WorkflowInstancePreviewSchema = v__namespace.looseObject(invariants.tolerantEntries()({
+    _id: NonEmpty,
+    _type: v__namespace.literal(WORKFLOW_INSTANCE_TYPE),
+    modelVersion: v__namespace.exactOptional(v__namespace.number()),
+    minReaderModel: v__namespace.exactOptional(v__namespace.number()),
+    workflowResource: WorkflowResourceSchema,
+    definition: NonEmpty,
+    pinnedVersion: v__namespace.number(),
+    fields: v__namespace.array(ResolvedFieldEntrySchema),
+    ancestors: v__namespace.array(invariants.GdrShape),
+    perspective: v__namespace.exactOptional(WorkflowPerspectiveSchema),
+    currentStage: NonEmpty,
+    stages: v__namespace.array(StageEntrySchema),
+    claimedEffects: v__namespace.array(WorkflowInstancePreviewEffectSchema),
+    failedEffects: v__namespace.array(WorkflowInstancePreviewEffectSchema),
+    startedAt: invariants.IsoTimestamp,
+    completedAt: v__namespace.exactOptional(invariants.IsoTimestamp),
+    abortedAt: v__namespace.exactOptional(invariants.IsoTimestamp)
+}));
+
+function parseInstancePreviewDocument(doc) {
+    return invariants.parsePersistedDoc({
+        schema: WorkflowInstancePreviewSchema,
+        doc: doc,
+        docType: WORKFLOW_INSTANCE_TYPE
+    });
+}
+
 const SYNC_COMMIT = {
     visibility: "sync"
 }, ENGINE_API_VERSION = "2026-04-29", REQUEST_TAG = {
@@ -4709,7 +5212,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -5119,6 +5624,40 @@ function readInstanceDoc(doc) {
     return parseInstanceDocument(assertReadableModel(doc));
 }
 
+function readInstancePreviewDoc(doc) {
+    return hasDocumentId(doc) ? parseInstancePreviewDocument(withoutProjectedNulls(assertReadableModel(doc))) : parseInstancePreviewDocument(doc);
+}
+
+function hasDocumentId(doc) {
+    return typeof doc == "object" && doc !== null && typeof doc._id == "string";
+}
+
+function withoutProjectedNulls(doc) {
+    const row = withoutNullMembers(doc);
+    if (typeof row != "object" || row === null) return row;
+    const out = {
+        ...row
+    };
+    return Array.isArray(out.stages) && (out.stages = out.stages.map(withoutStageEntryNulls)), 
+    Array.isArray(out.claimedEffects) && (out.claimedEffects = out.claimedEffects.map(withoutNullMembers)), 
+    Array.isArray(out.failedEffects) && (out.failedEffects = out.failedEffects.map(withoutNullMembers)), 
+    out;
+}
+
+function withoutStageEntryNulls(entry) {
+    const stage = withoutNullMembers(entry);
+    if (typeof stage != "object" || stage === null) return stage;
+    const out = {
+        ...stage
+    };
+    return Array.isArray(out.activities) && (out.activities = out.activities.map(withoutNullMembers)), 
+    out;
+}
+
+function withoutNullMembers(value) {
+    return value === null || typeof value != "object" || Array.isArray(value) ? value : Object.fromEntries(Object.entries(value).filter(([, member]) => member !== null));
+}
+
 async function reload({client: client, instanceId: instanceId, tag: tag}) {
     const doc = await getInstanceDocument(client, instanceId);
     if (!doc) throw new invariants.InstanceNotFoundError({
@@ -5365,7 +5904,8 @@ function loadCallContext({client: client, instanceId: instanceId, options: optio
             } : {},
             ...options.telemetry ? {
                 telemetry: options.telemetry
-            } : {}
+            } : {},
+            memberRolesLoader: options.memberRolesLoader
         }
     });
 }
@@ -5410,6 +5950,7 @@ async function loadContext({client: client, instanceId: instanceId, options: opt
         ...options.telemetry !== void 0 ? {
             telemetry: options.telemetry
         } : {},
+        memberRolesLoader: options.memberRolesLoader,
         ...options.overlay !== void 0 ? {
             overlay: options.overlay
         } : {},
@@ -5445,7 +5986,10 @@ async function ctxEvaluateCondition({ctx: ctx, condition: condition, opts: opts}
 }
 
 async function buildEngineContext(args) {
-    const {client: client, clientForGdr: clientForGdr, refSurface: refSurface, instance: instance, definition: definition} = args, clock = args.clock ?? wallClock;
+    const {client: client, clientForGdr: clientForGdr, refSurface: refSurface, instance: instance, definition: definition} = args, clock = args.clock ?? wallClock, memberRolesLoader = args.memberRolesLoader, memberRoles = await memberRolesLoader({
+        workflowResource: instance.workflowResource,
+        definition: definition
+    });
     return {
         client: client,
         clientForGdr: clientForGdr,
@@ -5462,6 +6006,10 @@ async function buildEngineContext(args) {
         } : {},
         instance: instance,
         definition: definition,
+        memberRolesLoader: memberRolesLoader,
+        ...memberRoles !== void 0 ? {
+            memberRoles: memberRoles
+        } : {},
         snapshot: await hydrateSnapshot({
             client: client,
             clientForGdr: clientForGdr,
@@ -5473,6 +6021,62 @@ async function buildEngineContext(args) {
     };
 }
 
+function createAssignmentMemberRolesLoader(client) {
+    const byProjectId = /* @__PURE__ */ new Map;
+    return async ({workflowResource: workflowResource, definition: definition}) => {
+        if (!hasRoleConstrainedAssignments(definition)) return;
+        assertRoleConstrainedAssignmentResource({
+            context: "workflow",
+            definition: definition,
+            workflowResource: workflowResource
+        });
+        const projectId = invariants.datasetResourceParts(workflowResource.id).projectId;
+        let pending = byProjectId.get(projectId);
+        return pending === void 0 && (pending = client.request === void 0 ? Promise.reject(new Error(`Definition "${definition.name}" has role-constrained assignments, which require project-directory access for project "${projectId}"; the client cannot issue requests`)) : loadProjectMemberRoles({
+            request: client.request,
+            projectId: projectId
+        }), byProjectId.set(projectId, pending)), pending;
+    };
+}
+
+async function loadProjectMemberRoles(args) {
+    const {request: request, projectId: projectId} = args, snapshot = await requestProjectMemberDirectory({
+        request: request,
+        projectId: projectId
+    }), rolesByProjectId = projectMemberRoles({
+        members: snapshot.members,
+        projectId: projectId
+    });
+    return globalizeMemberRoles({
+        snapshot: snapshot,
+        rolesByProjectId: rolesByProjectId
+    });
+}
+
+function globalizeMemberRoles(args) {
+    const {snapshot: snapshot, rolesByProjectId: rolesByProjectId} = args, humanIds = [ ...rolesByProjectId.keys() ].filter(id => invariants.classifyPrincipalId(id).namespace === "project");
+    for (const {globalId: globalId, memberId: memberId} of snapshot.globalUsers) {
+        const roles = rolesByProjectId.get(memberId);
+        roles !== void 0 && rolesByProjectId.set(globalId, roles);
+    }
+    for (const id of humanIds) rolesByProjectId.delete(id);
+    return Object.fromEntries(rolesByProjectId);
+}
+
+function projectMemberRoles(args) {
+    const result = /* @__PURE__ */ new Map;
+    for (const member of args.members) {
+        const {id: id, roles: roles} = member;
+        if (!Array.isArray(roles) || !roles.every(isProjectMemberRole)) throw new Error(`Project member role directory response is invalid for project "${args.projectId}" and member "${id}"`);
+        result.set(id, roles.map(role => role.name));
+    }
+    return result;
+}
+
+function isProjectMemberRole(role) {
+    return invariants.isRecord(role) && typeof role.name == "string";
+}
+
 function findStage(definition, stageName) {
     const stage = definition.stages.find(s => s.name === stageName);
     if (stage === void 0) throw new Error(`Stage "${stageName}" not found in definition ${definition.name}`);
@@ -5492,6 +6096,8 @@ async function resolveStageFieldEntries(args) {
             tag: instance.tag,
             stageName: stage.name,
             workflowResource: instance.workflowResource,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases,
             workflowFields: instance.fields ?? [],
             ...instance.perspective !== void 0 ? {
                 perspective: instance.perspective
@@ -5518,6 +6124,8 @@ async function resolveActivityFieldEntries(args) {
             stageName: stage.name,
             workflowResource: instance.workflowResource,
             activityName: activity.name,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases,
             workflowFields: instance.fields ?? [],
             ...instance.perspective !== void 0 ? {
                 perspective: instance.perspective
@@ -5673,172 +6281,7 @@ function resolveMetadata(metadata, ctx) {
     return out;
 }
 
-function userLoginProvider(user) {
-    return user?.provider ?? user?.loginProvider;
-}
-
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
-function optionalString(value) {
-    return value === void 0 || typeof value == "string";
-}
-
-function isClientProjectUser(value) {
-    return isRecord(value) && typeof value.id == "string" && optionalString(value.sanityUserId) && optionalString(value.displayName) && optionalString(value.email) && (value.imageUrl === null || optionalString(value.imageUrl)) && optionalString(value.provider) && optionalString(value.loginProvider);
-}
-
-function objectProperty(value, property) {
-    if (!isRecord(value)) return;
-    const propertyValue = value[property];
-    return typeof propertyValue == "object" && propertyValue !== null ? propertyValue : void 0;
-}
-
-function stringProperty(value, property) {
-    const propertyValue = Reflect.get(value, property);
-    return typeof propertyValue == "string" ? propertyValue : void 0;
-}
-
-function apiErrorType(error) {
-    const response = objectProperty(error, "response"), body = objectProperty(response, "body");
-    if (!body) return;
-    const nestedError = objectProperty(body, "error");
-    return (nestedError ? stringProperty(nestedError, "type") : void 0) ?? stringProperty(body, "type");
-}
-
-function isProjectUserNotFoundError(error) {
-    return apiErrorType(error) === "projectUserNotFoundError";
-}
-
-const memberJoinCache = /* @__PURE__ */ new WeakMap;
-
-function joinCacheFor(client) {
-    let cache = memberJoinCache.get(client);
-    return cache === void 0 && (cache = /* @__PURE__ */ new Map, memberJoinCache.set(client, cache)), 
-    cache;
-}
-
-async function projectMemberIds(request, projectId) {
-    const project = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}`
-    }), members = isRecord(project) ? project.members : void 0;
-    return Array.isArray(members) ? members.map(member => isRecord(member) ? member.id : void 0).filter(id => typeof id == "string") : [];
-}
-
-async function resolveGlobalProjectUser(args) {
-    const {client: client, request: request, projectId: projectId, id: id} = args, cache = joinCacheFor(client), key = `${projectId}:${id}`, hit = cache.get(key);
-    if (hit !== void 0) return hit === null ? {
-        status: "missing"
-    } : {
-        status: "resolved",
-        user: hit
-    };
-    try {
-        await ingestMemberJoin({
-            request: request,
-            projectId: projectId,
-            cache: cache
-        });
-        const found = cache.get(key);
-        return found != null ? {
-            status: "resolved",
-            user: found
-        } : (cache.set(key, null), {
-            status: "missing"
-        });
-    } catch (cause) {
-        return {
-            status: "inaccessible",
-            cause: cause
-        };
-    }
-}
-
-async function ingestMemberJoin(args) {
-    const {request: request, projectId: projectId, cache: cache} = args, memberIds = await projectMemberIds(request, projectId);
-    if (memberIds.length === 0) return;
-    const requested = new Set(memberIds), response = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
-    });
-    for (const row of Array.isArray(response) ? response : [ response ]) {
-        if (!isClientProjectUser(row) || !requested.has(row.id)) continue;
-        const globalId = invariants.directoryBridgeId(row.sanityUserId);
-        globalId !== void 0 && cache.set(`${projectId}:${globalId}`, row);
-    }
-}
-
-function clientProjectUserDirectory(client, projectId) {
-    return {
-        findById: async id => {
-            if (!client.request) return {
-                status: "inaccessible",
-                cause: new Error("Project-user resolution requires WorkflowClient.request")
-            };
-            if (invariants.classifyPrincipalId(id).namespace === "global") return resolveGlobalProjectUser({
-                client: client,
-                request: client.request,
-                projectId: projectId,
-                id: id
-            });
-            try {
-                const response = await client.request({
-                    uri: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
-                }), candidate = Array.isArray(response) ? response[0] : response;
-                return candidate == null ? {
-                    status: "missing"
-                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
-                    status: "inaccessible",
-                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
-                } : {
-                    status: "resolved",
-                    user: candidate
-                } : {
-                    status: "inaccessible",
-                    cause: new Error("Project-user response had an invalid shape")
-                };
-            } catch (cause) {
-                return isProjectUserNotFoundError(cause) ? {
-                    status: "missing"
-                } : {
-                    status: "inaccessible",
-                    cause: cause
-                };
-            }
-        }
-    };
-}
-
-function resolveClientActor(client, args) {
-    return resolveActor(clientProjectUserDirectory(client, args.projectId), args.actor);
-}
-
-async function resolveActor(directory, actor) {
-    if (actor.kind !== "person") return {
-        status: "not-person",
-        actor: actor
-    };
-    const personActor = {
-        ...actor,
-        kind: "person"
-    }, lookup = await directory.findById(personActor.id);
-    return lookup.status === "resolved" ? {
-        status: "resolved",
-        actor: personActor,
-        user: lookup.user
-    } : lookup.status === "inaccessible" ? {
-        status: "inaccessible",
-        actor: personActor,
-        ...lookup.cause === void 0 ? {} : {
-            cause: lookup.cause
-        }
-    } : {
-        status: "missing",
-        actor: personActor
-    };
-}
-
-const IDENTITY_KINDS = /* @__PURE__ */ new Set([ "actor", "assignee", "assignees" ]);
+const IDENTITY_KINDS = /* @__PURE__ */ new Set([ "actor", "assignee", "assignees" ]);
 
 async function localizeGuardMetadata(args) {
     const {doc: doc, guard: guard, client: client, instance: instance, definition: definition} = args;
@@ -6483,6 +6926,8 @@ async function buildActivityEntry({ctx: ctx, stage: stage, activity: activity, r
         activity: activity,
         now: ctx.now,
         refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases,
         ...recordDiscard !== void 0 ? {
             recordDiscard: recordDiscard
         } : {}
@@ -6685,7 +7130,8 @@ async function spawnRow({ctx: ctx, mutation: mutation, activity: activity, actio
         context: context,
         actor: actor,
         now: now,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRolesLoader: ctx.memberRolesLoader
     });
     mutation.pendingCreates.push({
         body: body,
@@ -6908,13 +7354,16 @@ async function resolveDefinitionRef({client: client, ref: ref, tag: tag}) {
 }
 
 async function prepareChildInstance(args) {
-    const {client: client, parent: parent, definition: definition, initialFields: initialFields, context: context, actor: actor, now: now, refSurface: refSurface} = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = {
+    const {client: client, parent: parent, definition: definition, initialFields: initialFields, context: context, actor: actor, now: now, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = {
         id: invariants.gdrFromResource(workflowResource, childDocId),
         type: WORKFLOW_INSTANCE_TYPE
     }, ancestors = [ ...parent.ancestors, {
         id: invariants.selfGdr(parent),
         type: WORKFLOW_INSTANCE_TYPE
-    } ], inheritedPerspective = parent.perspective, fieldDiscards = [], childFields = await resolveDeclaredFields({
+    } ], inheritedPerspective = parent.perspective, fieldDiscards = [], memberRoles = await memberRolesLoader({
+        workflowResource: workflowResource,
+        definition: definition
+    }), childFields = await resolveDeclaredFields({
         entryDefs: definition.fields,
         initialFields: initialFields,
         ctx: {
@@ -6925,6 +7374,8 @@ async function prepareChildInstance(args) {
             workflowResource: workflowResource,
             definitionName: definition.name,
             refSurface: refSurface,
+            memberRoles: memberRoles,
+            roleAliases: definition.roleAliases,
             inputProvenance: "definition",
             ...inheritedPerspective !== void 0 ? {
                 perspective: inheritedPerspective
@@ -6995,6 +7446,8 @@ async function enterStage({ctx: ctx, mutation: mutation, nextStage: nextStage, a
             stage: nextStage,
             now: at,
             refSurface: ctx.refSurface,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.definition.roleAliases,
             recordDiscard: recordFieldDiscards({
                 target: mutation.history,
                 scope: "stage",
@@ -7180,42 +7633,449 @@ function aclPathForResource(res) {
         const {projectId: projectId, dataset: dataset} = invariants.datasetResourceParts(res.id);
         return `/projects/${projectId}/datasets/${dataset}/acl`;
     }
-    if (res.type === "canvas") return `/canvases/${res.id}/acl`;
+    if (res.type === "canvas") return `/canvases/${res.id}/acl`;
+}
+
+async function fetchGrants(args) {
+    const {client: client, resourcePath: resourcePath, signal: signal} = args;
+    return client.request({
+        url: resourcePath,
+        tag: REQUEST_TAG.accessGrants,
+        ...signal ? {
+            signal: signal
+        } : {}
+    });
+}
+
+async function advisoryCanForCall(args) {
+    const actor = args.options?.actor;
+    if (!(args.options?.grants === void 0 || actor === void 0)) return advisoryCan({
+        instance: args.instance,
+        identity: invariants.lakePrincipalId({
+            actor: actor,
+            localPrincipalId: args.options.localPrincipalId
+        }),
+        grants: args.options.grants
+    });
+}
+
+async function advisoryCan({instance: instance, identity: identity, grants: grants}) {
+    if (grants === void 0) return;
+    const can = {};
+    for (const permission of invariants.DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
+        document: instance,
+        grants: grants,
+        permission: permission,
+        userId: identity
+    });
+    return can;
+}
+
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
+
+function attributeEntry(row) {
+    if (!(!invariants.isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
+}
+
+function normalizeUserAttributes(response) {
+    if (!invariants.isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
+    }
+    return out;
+}
+
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
+
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
+    return {
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
+        } : {},
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    };
+}
+
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
+}
+
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
+}
+
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
+}
+
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
+}
+
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
+        client: client,
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
+    });
+}
+
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!invariants.isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${invariants.errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!invariants.isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = invariants.isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${invariants.errorMessage(err)}`, {
+            cause: err
+        });
+    }
 }
 
-async function fetchGrants(args) {
-    const {client: client, resourcePath: resourcePath, signal: signal} = args;
-    return client.request({
-        url: resourcePath,
-        tag: REQUEST_TAG.accessGrants,
-        ...signal ? {
-            signal: signal
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
         } : {}
-    });
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
 }
 
-async function advisoryCanForCall(args) {
-    const actor = args.options?.actor;
-    if (!(args.options?.grants === void 0 || actor === void 0)) return advisoryCan({
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
         instance: args.instance,
-        identity: invariants.lakePrincipalId({
-            actor: actor,
-            localPrincipalId: args.options.localPrincipalId
-        }),
-        grants: args.options.grants
-    });
-}
-
-async function advisoryCan({instance: instance, identity: identity, grants: grants}) {
-    if (grants === void 0) return;
-    const can = {};
-    for (const permission of invariants.DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
-        document: instance,
-        grants: grants,
-        permission: permission,
-        userId: identity
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
     });
-    return can;
 }
 
 function requirementDescriptor(requirement) {
@@ -7338,7 +8198,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7350,10 +8211,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -7426,7 +8285,9 @@ async function applyActionFire({ctx: ctx, mutation: mutation, activity: activity
         self: invariants.selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     });
     if (await queueEffects({
         ctx: ctx,
@@ -7609,6 +8470,8 @@ async function primeInitialStage(args) {
             stage: stage,
             now: now,
             refSurface: refSurface,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.definition.roleAliases,
             recordDiscard: recordFieldDiscards({
                 target: discards,
                 scope: "stage",
@@ -7668,7 +8531,7 @@ async function primeInitialStage(args) {
 
 const CASCADE_LIMIT = 100;
 
-async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts, instance: instance}) {
+async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts, instance: instance}) {
     const contextOptions = {
         clientForGdr: clientForGdr,
         refSurface: refSurface,
@@ -7689,7 +8552,8 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
         } : {},
         ...settlingCohorts ? {
             settlingCohorts: settlingCohorts
-        } : {}
+        } : {},
+        memberRolesLoader: memberRolesLoader
     }, ctx = instance === void 0 ? await loadContext({
         client: client,
         instanceId: instanceId,
@@ -7728,7 +8592,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
     });
 }
 
-async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
+async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
     let count = 0;
     for (;;) {
         const drained = await drainCondemnedChildren({
@@ -7737,6 +8601,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
@@ -7747,6 +8612,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry,
@@ -7763,7 +8629,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
     }
 }
 
-async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set, instance: preloadedInstance}) {
+async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set, instance: preloadedInstance}) {
     if (draining.has(instanceId)) return {
         instance: preloadedInstance,
         drained: !1
@@ -7786,6 +8652,7 @@ async function drainCondemnedChildren({client: client, instanceId: instanceId, a
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         executionContext: executionContext,
         telemetry: telemetry,
@@ -7803,7 +8670,7 @@ async function drainCondemnedChildren({client: client, instanceId: instanceId, a
     };
 }
 
-async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
+async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
     const childId = invariants.toBareId(row.ref.id);
     try {
         const result = await abortInstance({
@@ -7816,6 +8683,7 @@ async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, a
                 } : {},
                 clientForGdr: clientForGdr,
                 refSurface: refSurface,
+                memberRolesLoader: memberRolesLoader,
                 ...clock ? {
                     clock: clock
                 } : {},
@@ -7833,6 +8701,7 @@ async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry,
@@ -7983,7 +8852,8 @@ async function buildCascadeStepContext(args, instance) {
         } : {},
         ...args.settlingCohorts ? {
             settlingCohorts: args.settlingCohorts
-        } : {}
+        } : {},
+        memberRolesLoader: args.memberRolesLoader
     });
 }
 
@@ -8211,6 +9081,7 @@ function spawnStepArgs(ctx, args) {
         actor: args.actor,
         clientForGdr: ctx.clientForGdr,
         refSurface: ctx.refSurface,
+        memberRolesLoader: ctx.memberRolesLoader,
         clock: ctx.clock,
         executionContext: ctx.executionContext,
         telemetry: ctx.telemetry,
@@ -8352,7 +9223,11 @@ function validateEffectOutputs(args) {
             issues.push(`"${key}" is not a declared output`);
             continue;
         }
-        const check = effectOutputCheck(shape, value);
+        const check = effectOutputCheck({
+            shape: shape,
+            value: value,
+            eligibility: args
+        });
         "issues" in check ? issues.push(...check.issues.map(i => `"${key}": ${i}`)) : normalized[key] = check.output;
     }
     if (issues.length > 0) throw new EffectOutputsInvalidError({
@@ -8362,7 +9237,8 @@ function validateEffectOutputs(args) {
     return normalized;
 }
 
-function effectOutputCheck(shape, value) {
+function effectOutputCheck(args) {
+    const {shape: shape, value: value, eligibility: eligibility} = args;
     return invariants.parseFieldValue({
         entryType: shape.type,
         value: value,
@@ -8377,7 +9253,12 @@ function effectOutputCheck(shape, value) {
         } : {},
         ...shape.validation !== void 0 ? {
             validation: shape.validation
-        } : {}
+        } : {},
+        ...shape.roles !== void 0 ? {
+            roles: shape.roles
+        } : {},
+        memberRoles: eligibility.memberRoles,
+        roleAliases: eligibility.roleAliases
     });
 }
 
@@ -8400,7 +9281,7 @@ function requirePendingEffect(instance, effectKey) {
     });
 }
 
-function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs}) {
+function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs, memberRoles: memberRoles, roleAliases: roleAliases}) {
     if (status === "failed" && ops !== void 0 && ops.length > 0) throw new EffectOpsInvalidError({
         effect: pending.name,
         issues: [ "ops cannot accompany a failed completion — field.set the outcome on a done completion instead" ]
@@ -8412,7 +9293,9 @@ function validateCompletionInput({pending: pending, definition: definition, stat
     const normalizedOutputs = outputs !== void 0 ? validateEffectOutputs({
         outputs: outputs,
         declared: findEffect(definition, pending.name)?.outputs ?? [],
-        effectName: pending.name
+        effectName: pending.name,
+        memberRoles: memberRoles,
+        roleAliases: roleAliases
     }) : void 0;
     return {
         ops: ops !== void 0 ? validateEffectOps(ops, pending.name) : [],
@@ -8431,7 +9314,9 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         definition: ctx.definition,
         status: status,
         ops: ops,
-        outputs: outputs
+        outputs: outputs,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), mutation = startMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
@@ -8462,7 +9347,9 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         self: invariants.selfGdr(ctx.instance),
         now: ranAt,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), needsGuardRefresh = wroteEffectOutputs || ranOps.some(isFieldOp);
     return await persistThenMaybeRefresh({
         ctx: ctx,
@@ -8631,7 +9518,9 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         self: invariants.selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), await persistThenMaybeRefresh({
         ctx: ctx,
         mutation: mutation,
@@ -8642,306 +9531,63 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         effect: pending.name
     };
 }
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new invariants.ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new invariants.ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = invariants.firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
-        },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
-    };
-}
-
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
-
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
-}
-
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return invariants.classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || invariants.classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
-        client: client,
-        principalId: resourceId
-    });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = invariants.directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (invariants.classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
-    });
-}
-
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
-
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
+
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
+
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && invariants.classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${invariants.errorMessage(err)}`,
-            cause: err
-        };
-    }
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
+        client: client,
+        instanceId: instanceId,
+        options: options
+    });
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
+    });
 }
 
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!invariants.isTerminalActivityStatus(from)) throw new invariants.ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${invariants.errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -9125,7 +9771,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     invariants.validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -9133,7 +9779,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -9158,6 +9804,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -9172,6 +9821,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9197,7 +9873,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -9214,22 +9890,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = invariants.lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
-        actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -9278,6 +9946,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -9294,6 +9963,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9345,6 +10015,12 @@ async function evaluateEditableFields(args) {
             ...site.validation !== void 0 ? {
                 validation: site.validation
             } : {},
+            ...site.roles !== void 0 ? {
+                roles: site.roles,
+                ...definition.roleAliases !== void 0 ? {
+                    roleAliases: definition.roleAliases
+                } : {}
+            } : {},
             value: value,
             editable: reason === void 0,
             ...reason !== void 0 ? {
@@ -9449,6 +10125,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: invariants.deriveActivityKind(activity),
         classification: invariants.deriveExecutorClassification(activity),
@@ -9619,9 +10296,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -9690,23 +10371,63 @@ function idsArm(filter, params) {
     }
 }
 
-function instancesQuery(args) {
-    const {tag: tag, filter: filter = {}} = args;
-    if (invariants.validateTag(tag), filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new invariants.ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
-    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, invariants.tagScopeFilter() ], params = {
-        tag: tag
-    };
+function beforeArm(filter, params) {
+    const before = filter.before;
+    if (before !== void 0) {
+        if (filter.limit === void 0) throw new invariants.ContractViolationError("instancesQuery: `before` requires `limit` — a cursor pages the newest-first sliced read");
+        if (before.id === "" || before.startedAt === "") throw new invariants.ContractViolationError(`instancesQuery: \`before\` needs a non-empty id and startedAt; got ${JSON.stringify(before)}`);
+        return params.beforeStartedAt = before.startedAt, params.beforeId = before.id, "(startedAt < $beforeStartedAt || (startedAt == $beforeStartedAt && _id > $beforeId))";
+    }
+}
+
+function compiledConditions(filter, params) {
+    if (filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new invariants.ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
+    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, invariants.tagScopeFilter() ];
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
     params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
     params.stage = filter.stage);
+    const cursor = beforeArm(filter, params);
+    cursor !== void 0 && conditions.push(cursor);
     const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
-    arms.length > 0 && conditions.push(`(${arms.join(" || ")})`);
-    const body = `*[${conditions.join(" && ")}]`;
-    return filter.limit !== void 0 ? {
-        query: `${body} | order(startedAt desc) [0...${filter.limit}]`,
+    return arms.length > 0 && conditions.push(`(${arms.join(" || ")})`), conditions;
+}
+
+function orderedSlice(filter) {
+    return filter.limit !== void 0 ? ` | order(startedAt desc, _id asc) [0...${filter.limit}]` : " | order(startedAt asc, _id asc)";
+}
+
+function instancesQuery(args) {
+    const {tag: tag, filter: filter = {}} = args;
+    invariants.validateTag(tag);
+    const params = {
+        tag: tag
+    };
+    return {
+        query: `*[${compiledConditions(filter, params).join(" && ")}]${orderedSlice(filter)}`,
         params: params
-    } : {
-        query: `${body} | order(startedAt asc)`,
+    };
+}
+
+function instanceChangesQuery(args) {
+    return invariants.validateTag(args.tag), {
+        query: `*[_type == "${WORKFLOW_INSTANCE_TYPE}" && ${invariants.tagScopeFilter()}]`,
+        params: {
+            tag: args.tag
+        }
+    };
+}
+
+const PREVIEW_FIELD_TYPES = [ "actor", "assignee", "assignees", "date", "datetime", "doc.ref", "doc.refs", "dueDate", "dueDatetime", "release.ref", "subject" ], PREVIEW_PROJECTION = `{\n  _id, _type, modelVersion, minReaderModel, workflowResource, definition, pinnedVersion,\n  currentStage, startedAt, completedAt, abortedAt, perspective, ancestors,\n  "fields": fields[_type in $previewFieldTypes],\n  "stages": stages[!defined(exitedAt) && name == ^.currentStage]{\n    _key, name, enteredAt,\n    "fields": fields[_type in $previewFieldTypes],\n    "activities": activities[]{\n      _key, name, status, completedBy,\n      "fields": fields[_type in $previewFieldTypes]\n    }\n  },\n  "claimedEffects": pendingEffects[defined(claim)]{name, title},\n  "failedEffects": effectHistory[status == "failed"]{name, title}\n}`.replaceAll(/\s+/g, " ").trim();
+
+function instancePreviewsQuery(args) {
+    const {tag: tag, filter: filter = {}} = args;
+    invariants.validateTag(tag);
+    const params = {
+        tag: tag,
+        previewFieldTypes: PREVIEW_FIELD_TYPES
+    };
+    return {
+        query: `*[${compiledConditions(filter, params).join(" && ")}]${orderedSlice(filter)} ${PREVIEW_PROJECTION}`,
         params: params
     };
 }
@@ -9891,6 +10612,11 @@ function hashDefinitionContent(def) {
 }
 
 function planDefinitionDeploy({def: def, latest: latest, target: target}) {
+    assertRoleConstrainedAssignmentResource({
+        context: "workflow.deployDefinitions",
+        definition: def,
+        workflowResource: target.workflowResource
+    });
     const expanded = expandResourceAliases(def, target.resourceAliases), contentHash = hashDefinitionContent(expanded), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = invariants.definitionDocId({
         tag: target.tag,
         definition: expanded.name,
@@ -10083,7 +10809,9 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
         self: invariants.selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     });
     return await persistThenMaybeRefresh({
         ctx: ctx,
@@ -10100,7 +10828,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -10113,10 +10842,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10183,6 +10910,7 @@ async function resolveOperationContext(args) {
     return {
         access: access,
         actor: access.actor,
+        memberRolesLoader: createAssignmentMemberRolesLoader(args.client),
         clientForGdr: buildClientForGdr({
             client: args.client,
             workflowResource: args.workflowResource,
@@ -10215,6 +10943,7 @@ async function runCommitVerb(params) {
         actor: context.actor,
         clientForGdr: context.clientForGdr,
         refSurface: context.refSurface,
+        memberRolesLoader: context.memberRolesLoader,
         clock: clock,
         executionContext: args.executionContext,
         telemetry: args.telemetry,
@@ -10239,7 +10968,7 @@ function requestRecordFor(args) {
 }
 
 async function runDeduped(args) {
-    const {client: client, tag: tag, instanceId: instanceId, record: record, before: before, now: now, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, run: run} = args, {clock: clock, executionContext: executionContext, telemetry: telemetry} = args, replay = async () => {
+    const {client: client, tag: tag, instanceId: instanceId, record: record, before: before, now: now, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, run: run} = args, {clock: clock, executionContext: executionContext, telemetry: telemetry} = args, replay = async () => {
         const pre = await reload({
             client: client,
             instanceId: instanceId,
@@ -10251,6 +10980,7 @@ async function runDeduped(args) {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
@@ -10274,13 +11004,14 @@ async function runDeduped(args) {
     }
 }
 
-async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
+async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
     const count = await cascadeAutoTransitions({
         client: client,
         instanceId: instanceId,
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -10300,6 +11031,7 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -10313,7 +11045,7 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
 }
 
 async function cascadeAndReload(args) {
-    const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock} = args;
+    const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock} = args;
     return {
         cascaded: await cascade({
             client: client,
@@ -10321,6 +11053,7 @@ async function cascadeAndReload(args) {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             ...args.executionContext !== void 0 ? {
                 executionContext: args.executionContext
@@ -10344,6 +11077,7 @@ async function settleStart(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: args.clock,
         ...args.executionContext !== void 0 ? {
             executionContext: args.executionContext
@@ -10386,31 +11120,20 @@ function resumeMismatch(args) {
 }
 
 async function resumeStart(args) {
-    const {existing: existing} = args, mismatch = resumeMismatch({
+    const {existing: existing, definition: definition, version: version, initialFieldCount: initialFieldCount, ...settlementArgs} = args, mismatch = resumeMismatch({
         existing: existing,
-        definition: args.definition,
-        version: args.version
+        definition: definition,
+        version: version
     });
     if (mismatch !== void 0) throw new invariants.ContractViolationError(`startInstance: instanceId "${existing._id}" already exists and ${mismatch}. A supplied instanceId is start's idempotency key — reuse one only to retry the same start.`);
     if (existing.stages.length === 0 && terminalState(existing) !== "in-flight") throw new invariants.ContractViolationError(`startInstance: instanceId "${existing._id}" belongs to a start that was discarded (aborted before it finished starting) — mint a new id to start again.`);
     const completesStart = isUnprimed(existing), emitStarted = () => resolveTelemetry(args.telemetry).log(WorkflowInstanceStarted, instanceStartedDataFor({
         instance: existing,
-        initialFieldCount: args.initialFieldCount,
+        initialFieldCount: initialFieldCount,
         viaSpawn: !1
     })), cascaded = await settleStart({
-        client: args.client,
-        tag: args.tag,
+        ...settlementArgs,
         instanceId: existing._id,
-        actor: args.actor,
-        clientForGdr: args.clientForGdr,
-        refSurface: args.refSurface,
-        clock: args.clock,
-        ...args.executionContext !== void 0 ? {
-            executionContext: args.executionContext
-        } : {},
-        ...args.telemetry !== void 0 ? {
-            telemetry: args.telemetry
-        } : {},
         ...completesStart ? {
             emitStarted: emitStarted
         } : {}
@@ -10426,7 +11149,7 @@ async function resumeStart(args) {
     };
 }
 
-function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, executionContext: executionContext, telemetry: telemetry}) {
+function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, executionContext: executionContext, telemetry: telemetry}) {
     return {
         ...actor !== void 0 ? {
             actor: actor
@@ -10434,6 +11157,7 @@ function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: client
         clock: clock,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
         } : {},
@@ -10444,7 +11168,7 @@ function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: client
 }
 
 async function abortAndPropagate(args) {
-    const {client: client, instanceId: instanceId, reason: reason, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, requestRecord: requestRecord} = args, result = await abortInstance({
+    const {client: client, instanceId: instanceId, reason: reason, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, requestRecord: requestRecord} = args, result = await abortInstance({
         client: client,
         instanceId: instanceId,
         ...reason !== void 0 ? {
@@ -10458,6 +11182,7 @@ async function abortAndPropagate(args) {
             clock: clock,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             executionContext: executionContext,
             telemetry: telemetry
         })
@@ -10467,6 +11192,7 @@ async function abortAndPropagate(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10484,6 +11210,7 @@ async function abortAndPropagate(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10525,6 +11252,7 @@ async function dispatchGatedWrite(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: args.clock,
         executionContext: args.executionContext,
         telemetry: args.telemetry
@@ -10600,12 +11328,16 @@ function buildEngineCallOptions(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         ...args.localPrincipalId !== void 0 ? {
             localPrincipalId: args.localPrincipalId
         } : {},
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -10636,7 +11368,7 @@ async function applyAction(args) {
 }
 
 async function deleteDefinition(args) {
-    const {client: client, tag: tag, definition: definition, version: version, cascade: cascade2, reason: reason, executionContext: executionContext, telemetry: telemetry} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersionsOrThrow({
+    const {client: client, tag: tag, definition: definition, version: version, cascade: cascade2, reason: reason, executionContext: executionContext, telemetry: telemetry} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersionsOrThrow({
         client: client,
         definition: definition,
         tag: tag
@@ -10675,6 +11407,7 @@ async function deleteDefinition(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         executionContext: executionContext,
         telemetry: telemetry
@@ -10733,6 +11466,7 @@ async function abortInstances(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10765,11 +11499,12 @@ async function fetchStartSlice(args) {
 
 const workflow = {
     deployDefinitions: async rawArgs => {
-        assertReaderModelAcknowledgement(rawArgs.expectedMinReaderModel);
-        const args = taggedScope(rawArgs, REQUEST_TAG.deploy), {client: client, tag: tag, resourceAliases: resourceAliases} = args;
+        const args = taggedScope(rawArgs, REQUEST_TAG.deploy), {client: client, tag: tag, workflowResource: workflowResource, resourceAliases: resourceAliases} = args;
         invariants.validateTag(tag);
         const definitions = args.definitions.map(def => parseDefinitionInput(def, "workflow.deployDefinitions"));
-        definitions.forEach(validateDefinition);
+        definitions.forEach(validateDefinition), assertReaderModelAcknowledgement(args.expectedMinReaderModel, {
+            requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
+        });
         const ordered = await sortByDependencies({
             client: client,
             definitions: definitions,
@@ -10788,6 +11523,7 @@ const workflow = {
                 latest: latest,
                 target: {
                     tag: tag,
+                    workflowResource: workflowResource,
                     ...resourceAliases !== void 0 ? {
                         resourceAliases: resourceAliases
                     } : {}
@@ -10838,7 +11574,7 @@ const workflow = {
         }), result;
     },
     startInstance: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.start), {client: client, tag: tag, definition: definitionName, version: version, initialFields: initialFields, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = operationContext, clock = args.clock ?? wallClock, seedFields = initialFields ?? [], existing = instanceId !== void 0 ? await getInstanceDocument(client, instanceId) : void 0;
+        const args = taggedScope(rawArgs, REQUEST_TAG.start), {client: client, tag: tag, definition: definitionName, version: version, initialFields: initialFields, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = operationContext, clock = args.clock ?? wallClock, seedFields = initialFields ?? [], existing = instanceId !== void 0 ? await getInstanceDocument(client, instanceId) : void 0;
         return existing !== void 0 && existing.tag === tag ? resumeStart({
             client: client,
             tag: tag,
@@ -10849,6 +11585,7 @@ const workflow = {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             ...executionContext !== void 0 ? {
                 executionContext: executionContext
@@ -10868,7 +11605,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "fireAction",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return {
                     instance: before,
                     cascaded: 0,
@@ -10882,6 +11619,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     before: before,
                     ...grantsFromPath !== void 0 ? {
@@ -10915,6 +11653,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         ...executionContext !== void 0 ? {
                             executionContext: executionContext
                         } : {},
@@ -10943,7 +11682,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "editField",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await dispatchGatedWrite({
                     client: client,
                     tag: tag,
@@ -10952,6 +11691,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     before: before,
                     ...grantsFromPath !== void 0 ? {
@@ -10986,6 +11726,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         ...executionContext !== void 0 ? {
                             executionContext: executionContext
                         } : {},
@@ -11006,7 +11747,7 @@ const workflow = {
         });
     },
     completeEffect: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "completeEffect",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11017,9 +11758,7 @@ const workflow = {
             instanceId: instanceId,
             record: record,
             now: clock(),
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry,
@@ -11048,10 +11787,8 @@ const workflow = {
                         requestRecord: record
                     } : {},
                     options: engineOptionsForActor({
-                        actor: actor,
+                        ...operationContext,
                         clock: clock,
-                        clientForGdr: clientForGdr,
-                        refSurface: refSurface,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11059,9 +11796,7 @@ const workflow = {
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
-                    actor: actor,
-                    clientForGdr: clientForGdr,
-                    refSurface: refSurface,
+                    ...operationContext,
                     clock: clock,
                     executionContext: executionContext,
                     telemetry: args.telemetry
@@ -11082,7 +11817,7 @@ const workflow = {
         });
     },
     commitEffectOps: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "commitEffectOps",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11094,9 +11829,7 @@ const workflow = {
             instanceId: instanceId,
             record: record,
             now: clock(),
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry,
@@ -11110,10 +11843,8 @@ const workflow = {
                     requestRecord: record,
                     leaseMs: args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS,
                     options: engineOptionsForActor({
-                        actor: actor,
+                        ...operationContext,
                         clock: clock,
-                        clientForGdr: clientForGdr,
-                        refSurface: refSurface,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11121,9 +11852,7 @@ const workflow = {
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
-                    actor: actor,
-                    clientForGdr: clientForGdr,
-                    refSurface: refSurface,
+                    ...operationContext,
                     clock: clock,
                     executionContext: executionContext,
                     telemetry: args.telemetry
@@ -11142,7 +11871,7 @@ const workflow = {
         });
     },
     tick: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.tick), {client: client, tag: tag, instanceId: instanceId, executionContext: executionContext} = args, {access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload({
+        const args = taggedScope(rawArgs, REQUEST_TAG.tick), {client: client, tag: tag, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {access: access} = operationContext, clock = args.clock ?? wallClock, current = await reload({
             client: client,
             instanceId: instanceId,
             tag: tag
@@ -11156,9 +11885,7 @@ const workflow = {
             client: client,
             tag: tag,
             instanceId: instanceId,
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry
@@ -11178,7 +11905,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "setStage",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await setStage({
                     client: client,
                     instanceId: instanceId,
@@ -11194,6 +11921,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11203,6 +11931,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11232,7 +11961,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "abortInstance",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const changed = await abortAndPropagate({
                     client: client,
                     instanceId: instanceId,
@@ -11240,6 +11969,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11273,7 +12003,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "resetActivity",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await resetActivity({
                     client: client,
                     instanceId: instanceId,
@@ -11287,6 +12017,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11296,6 +12027,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11601,7 +12333,7 @@ async function startRequirementVerdict(args) {
 }
 
 async function startFreshInstance(args) {
-    const {args: startArgs, operationContext: operationContext, clock: clock, seedFields: seedFields} = args, {client: client, tag: tag, workflowResource: workflowResource, definition: definitionName, version: version, ancestors: ancestors, context: context, instanceId: instanceId, perspective: perspective, executionContext: executionContext} = startArgs, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = operationContext, definition = await loadDefinition({
+    const {args: startArgs, operationContext: operationContext, clock: clock, seedFields: seedFields} = args, {client: client, tag: tag, workflowResource: workflowResource, definition: definitionName, version: version, ancestors: ancestors, context: context, instanceId: instanceId, perspective: perspective, executionContext: executionContext} = startArgs, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = operationContext, definition = await loadDefinition({
         client: client,
         definition: definitionName,
         version: version,
@@ -11625,6 +12357,7 @@ async function startFreshInstance(args) {
         id: id,
         now: now,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...perspective !== void 0 ? {
             perspective: perspective
         } : {}
@@ -11656,6 +12389,7 @@ async function startFreshInstance(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -11711,7 +12445,10 @@ async function assertStartInputs(args) {
 }
 
 async function resolveStartFields(args) {
-    const {client: client, tag: tag, workflowResource: workflowResource, definition: definition, initialFields: initialFields, id: id, now: now, refSurface: refSurface, perspective: perspective} = args, fieldDiscards = [];
+    const {client: client, tag: tag, workflowResource: workflowResource, definition: definition, initialFields: initialFields, id: id, now: now, refSurface: refSurface, memberRolesLoader: memberRolesLoader, perspective: perspective} = args, fieldDiscards = [], memberRoles = await memberRolesLoader({
+        workflowResource: workflowResource,
+        definition: definition
+    });
     return {
         resolvedFields: await resolveDeclaredFields({
             entryDefs: definition.fields ?? [],
@@ -11724,6 +12461,8 @@ async function resolveStartFields(args) {
                 workflowResource: workflowResource,
                 definitionName: definition.name,
                 refSurface: refSurface,
+                memberRoles: memberRoles,
+                roleAliases: definition.roleAliases,
                 ...perspective !== void 0 ? {
                     perspective: perspective
                 } : {},
@@ -12364,7 +13103,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12386,13 +13125,17 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
-    }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
+    }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope, memberRolesLoader: memberRolesLoader}) => {
         const cascaded = await cascadeHeld({
             scope: scope,
             actor: actor,
-            held: held
+            held: held,
+            memberRolesLoader: memberRolesLoader
         });
         return instance = await reload({
             client: scope.client,
@@ -12406,12 +13149,13 @@ function createInstanceSession(args) {
                 ranOps: ranOps
             } : {}
         };
-    }, cascadeHeld = ({scope: scope, actor: actor, held: held}) => cascade({
+    }, cascadeHeld = ({scope: scope, actor: actor, held: held, memberRolesLoader: memberRolesLoader}) => cascade({
         client: scope.client,
         instanceId: instance._id,
         actor: actor,
         clientForGdr: scope.clientForGdr,
         refSurface: scope.refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -12508,6 +13252,7 @@ function createInstanceSession(args) {
         },
         tick() {
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(tickScope.client);
                 await assertInstanceWriteAllowed({
                     instance: instance,
                     guards: heldGuards,
@@ -12523,7 +13268,8 @@ function createInstanceSession(args) {
                 }), cascaded = await cascadeHeld({
                     scope: tickScope,
                     actor: actor,
-                    held: held
+                    held: held,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return instance = await reload({
                     client: tickScope.client,
@@ -12542,6 +13288,7 @@ function createInstanceSession(args) {
         },
         fireAction({activity: activity, action: action, params: params}) {
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(fireScope.client);
                 assertActionAllowed({
                     evaluation: await evaluateWith({
                         held: held,
@@ -12562,6 +13309,7 @@ function createInstanceSession(args) {
                     } : {},
                     clientForGdr: fireScope.clientForGdr,
                     refSurface: fireScope.refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     ...grants !== void 0 ? {
                         grants: grants
                     } : {},
@@ -12581,7 +13329,8 @@ function createInstanceSession(args) {
                     actor: actor,
                     held: held,
                     ranOps: ranOps,
-                    scope: fireScope
+                    scope: fireScope,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return telemetry.log(WorkflowActionFired, actionFiredData({
                     instance: preOp,
@@ -12603,6 +13352,7 @@ function createInstanceSession(args) {
                 return Promise.reject(err);
             }
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(editScope.client);
                 assertEditAllowed(await evaluateWith({
                     held: held,
                     guards: heldGuards,
@@ -12624,6 +13374,7 @@ function createInstanceSession(args) {
                     } : {},
                     clientForGdr: editScope.clientForGdr,
                     refSurface: editScope.refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     ...grants !== void 0 ? {
                         grants: grants
                     } : {},
@@ -12640,7 +13391,8 @@ function createInstanceSession(args) {
                     actor: actor,
                     held: held,
                     ranOps: ranOps,
-                    scope: editScope
+                    scope: editScope,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return telemetry.log(WorkflowFieldEdited, fieldEditedData({
                     instance: preOp,
@@ -12959,8 +13711,11 @@ function attributeMember({member: member, group: group, chain: chain}) {
 }
 
 function diffEntry({def: rawDef, latestRaw: latestRaw, target: target}) {
-    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
-    const def = parseDefinitionInput(rawDef, "diffEntry"), plan = planDefinitionDeploy({
+    const def = parseDefinitionInput(rawDef, "diffEntry");
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel, {
+        requiredMinReaderModel: requiredDefinitionReaderModel([ def ])
+    });
+    const plan = planDefinitionDeploy({
         def: def,
         latest: asLatest(latestRaw),
         target: target
@@ -12991,10 +13746,13 @@ function asLatest(raw) {
 }
 
 async function computeDiffEntries({client: client, defs: defs, target: target}) {
-    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
+    const definitions = defs.map(def => parseDefinitionInput(def, "computeDiffEntries"));
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel, {
+        requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
+    });
     const entries = [];
-    for (const rawDef of defs) {
-        const def = parseDefinitionInput(rawDef, "computeDiffEntries"), latest = await loadLatestDeployed({
+    for (const def of definitions) {
+        const latest = await loadLatestDeployed({
             client: client,
             definition: def.name,
             tag: target.tag
@@ -13081,7 +13839,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -13186,6 +13944,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -13194,6 +13956,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -13319,6 +14089,8 @@ exports.CONDITION_VARS = invariants.CONDITION_VARS;
 
 exports.ContractViolationError = invariants.ContractViolationError;
 
+exports.DECISION_SEMANTICS = invariants.DECISION_SEMANTICS;
+
 exports.DEFAULT_TRANSITION_WHEN = invariants.DEFAULT_TRANSITION_WHEN;
 
 exports.DRIVER_KINDS = invariants.DRIVER_KINDS;
@@ -13345,6 +14117,8 @@ exports.PersistedDocShapeError = invariants.PersistedDocShapeError;
 
 exports.RESERVED_CONDITION_VARS = invariants.RESERVED_CONDITION_VARS;
 
+exports.SIGNAL_SEMANTICS = invariants.SIGNAL_SEMANTICS;
+
 exports.START_FILTER_VARS = invariants.START_FILTER_VARS;
 
 exports.START_REQUIREMENT_VARS = invariants.START_REQUIREMENT_VARS;
@@ -13357,6 +14131,8 @@ exports.WORKFLOW_DEFINITION_TYPE = invariants.WORKFLOW_DEFINITION_TYPE;
 
 exports.WorkflowError = invariants.WorkflowError;
 
+exports.actorFulfillsRole = invariants.actorFulfillsRole;
+
 exports.classifyPrincipalId = invariants.classifyPrincipalId;
 
 exports.clientConfigFromResource = invariants.clientConfigFromResource;
@@ -13571,6 +14347,8 @@ exports.ConcurrentFireActionError = ConcurrentFireActionError;
 
 exports.DATA_MODEL_CHANGES = DATA_MODEL_CHANGES;
 
+exports.DATA_MODEL_MAX_READER = DATA_MODEL_MAX_READER;
+
 exports.DATA_MODEL_MIN_READER = DATA_MODEL_MIN_READER;
 
 exports.DATA_MODEL_VERSION = DATA_MODEL_VERSION;
@@ -13663,6 +14441,8 @@ exports.WorkflowFieldEdited = WorkflowFieldEdited;
 
 exports.WorkflowInstanceAborted = WorkflowInstanceAborted;
 
+exports.WorkflowInstancePreviewSchema = WorkflowInstancePreviewSchema;
+
 exports.WorkflowInstanceSchema = WorkflowInstanceSchema;
 
 exports.WorkflowInstanceStarted = WorkflowInstanceStarted;
@@ -13777,6 +14557,8 @@ exports.documentActionDenials = documentActionDenials;
 
 exports.documentPrefilter = documentPrefilter;
 
+exports.documentStuckCause = documentStuckCause;
+
 exports.effectOutputsMap = effectOutputsMap;
 
 exports.entryDocRefs = entryDocRefs;
@@ -13793,10 +14575,14 @@ exports.explainStartRequirement = explainStartRequirement;
 
 exports.fieldTreeShape = fieldTreeShape;
 
+exports.findActivityNode = findActivityNode;
+
 exports.findCurrentActivityEntry = findCurrentActivityEntry;
 
 exports.findOpenStageEntry = findOpenStageEntry;
 
+exports.findStageNode = findStageNode;
+
 exports.groupSitesOf = groupSitesOf;
 
 exports.guardMatches = guardMatches;
@@ -13815,10 +14601,14 @@ exports.inFlightFilter = inFlightFilter;
 
 exports.initialFieldIssues = initialFieldIssues;
 
+exports.instanceChangesQuery = instanceChangesQuery;
+
 exports.instanceDocId = instanceDocId;
 
 exports.instanceGuardQuery = instanceGuardQuery;
 
+exports.instancePreviewsQuery = instancePreviewsQuery;
+
 exports.instanceWatchesDocument = instanceWatchesDocument;
 
 exports.instancesGuardQuery = instancesGuardQuery;
@@ -13873,6 +14663,8 @@ exports.parseGuardDocument = parseGuardDocument;
 
 exports.parseInstanceDocument = parseInstanceDocument;
 
+exports.parseInstancePreviewDocument = parseInstancePreviewDocument;
+
 exports.processShellUserProperties = processShellUserProperties;
 
 exports.projectStartSliceRow = projectStartSliceRow;
@@ -13881,12 +14673,16 @@ exports.projectToWatchRef = projectToWatchRef;
 
 exports.readInstanceDoc = readInstanceDoc;
 
+exports.readInstancePreviewDoc = readInstancePreviewDoc;
+
 exports.readsRaw = readsRaw;
 
 exports.refsOf = refsOf;
 
 exports.remediationsFor = remediationsFor;
 
+exports.requiredDefinitionReaderModel = requiredDefinitionReaderModel;
+
 exports.requiredModelFeatures = requiredModelFeatures;
 
 exports.requiredReaderModel = requiredReaderModel;
@@ -13899,6 +14695,8 @@ exports.resolveClientActor = resolveClientActor;
 
 exports.resolveFieldEntry = resolveFieldEntry$1;
 
+exports.resolveUserAttributes = resolveUserAttributes;
+
 exports.retractStageGuards = retractStageGuards;
 
 exports.silentLogger = silentLogger;