@sanity/workflow-engine 0.28.0 → 0.30.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { rethrowWithContext, andConditions, deriveActivityKind, WorkflowError, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, evaluateCondition, isSingleDocRefEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, tolerantEntries, NonEmptyString, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, classifyPrincipalId, directoryBridgeId, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, driverKind, EffectNotFoundError, firstCarriedGlobalId, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
+import { rethrowWithContext, andConditions, deriveActivityKind, CALLER_BOUND_VARS, START_REQUIREMENT_VARS, CONDITION_VARS, isSubjectEntry, isUnevaluable, ContractViolationError, isStartableDefinition, conditionFieldReadNames, isGdr, errorMessage, conditionParameterNames, START_FILTER_VARS, gdrFromResource, selfGdr, isSingleDocRefKind, actorFulfillsRole, toBareId, WorkflowError, sameResource, resourceFromParsed, tryParseGdr, isTerminalActivityStatus, FieldValueShapeError, validateFieldValue, validateFieldAppendItem, isAlwaysArrayFieldKind, evaluateCondition, isRecord, isSingleDocRefEntry, isAssignmentFieldEntry, choiceValueIssues, scalarValidationIssues, StoredFieldOpSchema, formatIssues, conditionSyntaxIssues, checkWorkflowInvariants, formatIssuePath, isGuardReadExpr, conditionEffectReads, EFFECTS_READ, datasetResourceParts, assignmentKindAcceptsRoles, evaluatePredicates, WORKFLOW_DEFINITION_TYPE, tagScopeFilter, isCascadeFired, classifyPrincipalId, directoryBridgeId, parseGdr, isGdrUri, gdrRef, isInputSourced, parseFieldValue, VersionSpecificDatasetGdrError, toPhysicalGdr, isBareSeedId, NonEmptyString, tolerantEntries, FIELD_VALUE_KINDS, tolerantObject, ActorShape, IsoTimestamp, ACTIVITY_STATUSES, GdrShape, DRIVER_KINDS, FIELD_SCOPES, fieldValueSchemas, parsePersistedDoc, ACTOR_KINDS, InstanceNotFoundError, evaluateConditionOutcome, runGroq, FIELD_READ, MUTATION_GUARD_ACTIONS, resourceGdr, resourceFromGdrUri, refTypeIssues, rejectedRefTypes, DOCUMENT_VALUE_PERMISSIONS, lakePrincipalId, firstCarriedGlobalId, driverKind, EffectNotFoundError, deriveExecutorClassification, validateTag, extractDocumentId, parseStoredDefinition, validateResourceAliasName, labelFor, DefinitionNotFoundError, definitionDocId, SpawnContractsInvalidError, gdrResourcePrefix, RESOURCE_ALIAS_NAME_SOURCE, DefinitionInUseError, isParseableInstant, groupMembershipNames } from "./_chunks-es/invariants.js";
 
-import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
+import { ACTION_SEMANTICS, ACTIVITY_KINDS, ANONYMOUS_IDENTITY, DECISION_SEMANTICS, DEFAULT_TRANSITION_WHEN, EXECUTOR_CLASSIFICATIONS, FILTER_SCOPE_VARS, GROUP_KINDS, GUARD_PREDICATE_VARS, PersistedDocShapeError, RESERVED_CONDITION_VARS, SIGNAL_SEMANTICS, SYSTEM_IDENTITY, clientConfigFromResource, gdrUri, isNotesEntry, isTodoListEntry, isTodoListItem, parseResourceGdr, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, releaseDocId, releaseRef, resourceAliasesToMap, schemaTreeShape, startKindOf } from "./_chunks-es/invariants.js";
 
 import { atomNode, dedupeBy, analyzeCondition, atomReadsDataset, checklistLines as checklistLines$1, phrase, quoted, listAnd, describeAtom as describeAtom$1, describeCondition as describeCondition$1, guillemets, formatValue, humanize, listOr, scopeReadOf, describeRead, explainCondition, dedupeReads, whatIfCondition, MAX_COUNTERFACTUAL_INDEX } from "@sanity/groq-condition-describe";
 
@@ -130,6 +130,9 @@ function resolveFieldSite(site, stage) {
         ...site.entry.validation !== void 0 ? {
             validation: site.entry.validation
         } : {},
+        ...site.entry.roles !== void 0 ? {
+            roles: site.entry.roles
+        } : {},
         ref: {
             scope: site.scope,
             field: site.entry.name
@@ -266,58 +269,58 @@ function resolveTelemetry(telemetry) {
 }
 
 const HIGH_FREQUENCY_SAMPLE_MS = 6e4, WorkflowDefinitionDeployed = defineWorkflowEvent({
-    name: "Editorial Workflows Definition Deployed",
+    name: "Workflows Definition Deployed",
     version: 1,
     description: "A definition went through a deploy — status distinguishes a newly minted version from an unchanged redeploy"
 }), WorkflowInstanceStarted = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Started",
+    name: "Workflows Instance Started",
     version: 1,
     description: "A workflow instance was started from a deployed definition"
 }), WorkflowStageTransitioned = defineWorkflowEvent({
-    name: "Editorial Workflows Stage Transitioned",
+    name: "Workflows Stage Transitioned",
     version: 1,
     description: "A committed stage move — one event per hop, cascades included, whichever verb drove it. Unsampled: funnel and dwell reads need complete counts, and volume is bounded by actual movement"
 }), WorkflowActionFired = defineWorkflowEvent({
-    name: "Editorial Workflows Action Fired",
+    name: "Workflows Action Fired",
     version: 1,
     description: "An action was fired against an activity"
 }), WorkflowFieldEdited = defineWorkflowEvent({
-    name: "Editorial Workflows Field Edited",
+    name: "Workflows Field Edited",
     version: 1,
     description: "A declared-editable field was edited through the generic edit seam",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowInstanceTicked = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Ticked",
+    name: "Workflows Instance Ticked",
     version: 1,
     description: "An instance was re-evaluated for auto-transitions and due waits",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowEffectsDrained = defineWorkflowEvent({
-    name: "Editorial Workflows Effects Drained",
+    name: "Workflows Effects Drained",
     version: 1,
     description: "A drain pass ran — drainedCount/drainedEffects report the successful dispatches. Unsampled when non-empty (outcome counts must be complete; volume is bounded by real effect work); empty polls are machine-cadence noise, throttled engine-side to at most one per minute"
 }), WorkflowEffectStateReported = defineWorkflowEvent({
-    name: "Editorial Workflows Effect State Reported",
+    name: "Workflows Effect State Reported",
     version: 1,
     description: "A running effect handler committed mid-dispatch field state through commitEffectOps. Sampled (high-frequency by design — a dispatch may report many times): an adoption and usage signal, not an exact per-run report count",
     maxSampleRate: HIGH_FREQUENCY_SAMPLE_MS
 }), WorkflowEffectCompleted = defineWorkflowEvent({
-    name: "Editorial Workflows Effect Completed",
+    name: "Workflows Effect Completed",
     version: 1,
-    description: "An effect outcome was recorded — reported directly through completeEffect, or cancelled by the abort verb (external runtimes; engine-drained effects surface via Editorial Workflows Effects Drained instead — each outcome counts once)"
+    description: "An effect outcome was recorded — reported directly through completeEffect, or cancelled by the abort verb (external runtimes; engine-drained effects surface via Workflows Effects Drained instead — each outcome counts once)"
 }), WorkflowInstanceAborted = defineWorkflowEvent({
-    name: "Editorial Workflows Instance Aborted",
+    name: "Workflows Instance Aborted",
     version: 1,
     description: "The abort admin override was invoked (changed: false = instance already terminal)"
 }), WorkflowStageSet = defineWorkflowEvent({
-    name: "Editorial Workflows Stage Set",
+    name: "Workflows Stage Set",
     version: 1,
     description: "The set-stage admin override was invoked (changed: false = already at the target stage)"
 }), WorkflowActivityReset = defineWorkflowEvent({
-    name: "Editorial Workflows Activity Reset",
+    name: "Workflows Activity Reset",
     version: 1,
     description: "The reset-activity admin override was invoked (changed: false = already at the target status, or the instance was terminal)"
 }), WorkflowDefinitionDeleted = defineWorkflowEvent({
-    name: "Editorial Workflows Definition Deleted",
+    name: "Workflows Definition Deleted",
     version: 1,
     description: "A deployed definition (or one version of it) was removed via the admin verb"
 });
@@ -435,240 +438,6 @@ function fieldEditedData(args) {
     };
 }
 
-const DATA_MODEL_VERSION = 5, DATA_MODEL_MIN_READER = 4, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
-
-class ReaderModelAcknowledgementError extends WorkflowError {
-    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
-    expectedMinReaderModel;
-    engineMinReaderModel=DATA_MODEL_MIN_READER;
-    engineModelVersion=DATA_MODEL_VERSION;
-    documentationUrl=READER_MODEL_ROLLOUT_URL;
-    constructor(expectedMinReaderModel, context = "Deployment") {
-        const expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
-        super("reader-model-acknowledgement", `${context} expected reader floor ${expected}; the installed engine requires acknowledgement ${DATA_MODEL_MIN_READER}.\nDo not change the acknowledgement yet: accepting ${DATA_MODEL_MIN_READER} authorizes this engine to write documents that older readers will refuse.\nUpgrade every Studio, CLI, MCP server, Function, and other runtime that reads engine-owned documents; verify that rollout in every environment sharing the workflow resource; then change the literal in deployment configuration and deploy the writer.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
-        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel;
-    }
-}
-
-function assertReaderModelAcknowledgement(expectedMinReaderModel, context) {
-    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel !== DATA_MODEL_MIN_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, context);
-}
-
-const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
-    id: "governed-model-stamps",
-    introducedInModel: 1,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "unconditional",
-    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
-}), Object.freeze({
-    id: "subject-field-kind",
-    introducedInModel: 2,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "A workflow-level subject field identifies the document a workflow is about."
-}), Object.freeze({
-    id: "typed-scalar-choice-lists",
-    introducedInModel: 2,
-    minReaderModel: 2,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "Scalar fields may constrain writes to a persisted typed choice list."
-}), Object.freeze({
-    id: "action-semantics",
-    introducedInModel: 2,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Ordinary actions may carry a closed bag of advisory workflow semantics."
-}), Object.freeze({
-    id: "inclusive-scalar-bounds",
-    introducedInModel: 2,
-    minReaderModel: 2,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "String, text, and number values may carry persisted inclusive bounds."
-}), Object.freeze({
-    id: "progress-field-kind",
-    introducedInModel: 3,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "A progress field kind carries application-defined 0–100 completion."
-}), Object.freeze({
-    id: "effect-claim-tokens",
-    introducedInModel: 3,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
-}), Object.freeze({
-    id: "classified-principal-ids",
-    introducedInModel: 4,
-    minReaderModel: 4,
-    documentTypes: Object.freeze([ "instance" ]),
-    compatibility: "reader-floor",
-    applicability: "unconditional",
-    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
-}), Object.freeze({
-    id: "readiness-requirements",
-    introducedInModel: 4,
-    minReaderModel: 4,
-    documentTypes: Object.freeze([ "definition" ]),
-    compatibility: "reader-floor",
-    applicability: "detectable",
-    summary: "Start and activity readiness use named polymorphic requirement arrays."
-}), Object.freeze({
-    id: "due-date-field-kinds",
-    introducedInModel: 5,
-    minReaderModel: 0,
-    documentTypes: Object.freeze([ "definition", "instance" ]),
-    compatibility: "additive",
-    applicability: "detectable",
-    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
-}) ]);
-
-function recordOf(value) {
-    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
-}
-
-function recordsAt(record, key) {
-    const value = record[key];
-    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
-}
-
-function nestedFieldEntries(entries) {
-    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
-}
-
-function parsedDefinitionSnapshot(root) {
-    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
-        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
-        definitionSnapshot: root.definitionSnapshot
-    }));
-}
-
-function persistedFieldEntries(document) {
-    const root = recordOf(document);
-    if (root === void 0) return [];
-    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], stages = roots.flatMap(candidate => recordsAt(candidate, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions")), effects = actions.flatMap(action => recordsAt(action, "effects"));
-    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
-}
-
-function hasChoiceList(document) {
-    return persistedFieldEntries(document).some(entry => {
-        const options = recordOf(entry.options);
-        return options !== void 0 && Array.isArray(options.list);
-    });
-}
-
-function hasFieldKind(document, kind) {
-    return persistedFieldEntries(document).some(entry => entry.type === kind || entry._type === kind);
-}
-
-function hasActionSemantics(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "stages").flatMap(stage => recordsAt(stage, "activities")).flatMap(activity => recordsAt(activity, "actions")).some(action => Array.isArray(action.semantics));
-}
-
-function hasScalarValidation(document) {
-    return persistedFieldEntries(document).some(entry => {
-        const validation = recordOf(entry.validation);
-        return typeof validation?.min == "number" || typeof validation?.max == "number";
-    });
-}
-
-function hasClaimTokens(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
-        const claim = recordOf(entry.claim);
-        return claim !== void 0 && typeof claim.claimToken == "string";
-    });
-}
-
-function hasReadinessRequirements(document) {
-    const root = recordOf(document);
-    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
-}
-
-const featureDetectors = {
-    "governed-model-stamps": () => !0,
-    "subject-field-kind": document => hasFieldKind(document, "subject"),
-    "typed-scalar-choice-lists": hasChoiceList,
-    "action-semantics": hasActionSemantics,
-    "inclusive-scalar-bounds": hasScalarValidation,
-    "progress-field-kind": document => hasFieldKind(document, "progress"),
-    "effect-claim-tokens": hasClaimTokens,
-    "classified-principal-ids": () => !0,
-    "readiness-requirements": hasReadinessRequirements,
-    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime")
-};
-
-function requiredModelFeatures(documentType, document) {
-    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
-}
-
-function requiredReaderModel(documentType, document) {
-    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
-}
-
-function modelStampFor(args) {
-    return {
-        modelVersion: DATA_MODEL_VERSION,
-        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
-    };
-}
-
-function fieldTreeShape(value) {
-    if (Array.isArray(value)) return value.map(fieldTreeShape);
-    if (value === null) return "null";
-    if (typeof value == "object") {
-        const record = value;
-        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
-    }
-    return typeof value;
-}
-
-function modelVersionOf(doc) {
-    const stamp = doc.modelVersion;
-    return typeof stamp == "number" ? stamp : 0;
-}
-
-function minReaderModelOf(doc) {
-    const floor = doc.minReaderModel;
-    return typeof floor == "number" ? floor : modelVersionOf(doc);
-}
-
-class ModelVersionAheadError extends WorkflowError {
-    documentId;
-    documentModelVersion;
-    requiredReaderModel;
-    engineModelVersion;
-    constructor(args) {
-        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
-        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
-        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
-    }
-}
-
-function assertReadableModel(doc) {
-    const documentReaderModel = minReaderModelOf(doc);
-    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
-        documentId: doc._id,
-        documentModelVersion: modelVersionOf(doc),
-        requiredReaderModel: documentReaderModel
-    });
-    return doc;
-}
-
 function effectSites(def) {
     const sites = [];
     for (const stage of def.stages ?? []) for (const activity of stage.activities ?? []) for (const action of activity.actions ?? []) for (const effect of action.effects ?? []) sites.push({
@@ -1143,12 +912,8 @@ function renderWorkflowRead(read, ctx) {
             text: guillemets(title)
         });
     }
-    if (read.variable === "can" && typeof read.path[0] == "string") return phrase("read.permission", {
-        params: {
-            permission: read.path[0]
-        },
-        text: `your ${read.path[0]} permission`
-    });
+    const keyed = keyedCallerRead(read);
+    if (keyed !== void 0) return keyed;
     if (read.variable === "actor" && read.path.length === 1 && read.path[0] === "id") return phrase("read.actor-id", {
         params: {},
         text: "your id"
@@ -1170,6 +935,24 @@ function renderWorkflowRead(read, ctx) {
     });
 }
 
+function keyedCallerRead(read) {
+    const key = read.path[0];
+    if (typeof key == "string") {
+        if (read.variable === "can") return phrase("read.permission", {
+            params: {
+                permission: key
+            },
+            text: `your ${key} permission`
+        });
+        if (read.variable === "attributes") return phrase("read.attribute", {
+            params: {
+                attribute: key
+            },
+            text: `your ${guillemets(key)} attribute`
+        });
+    }
+}
+
 function workflowRequirement(requirement, ctx) {
     const {target: target} = requirement, clause = clauseVarRequirement(requirement);
     if (clause !== void 0) return clause;
@@ -2597,7 +2380,7 @@ class CascadeLimitError extends WorkflowError {
     }
 }
 
-const FIELD_OP_TYPES = [ "field.set", "field.unset", "field.append", "field.updateWhere", "field.removeWhere" ];
+const FIELD_OP_TYPES = [ "field.set", "field.setIfMissing", "field.unset", "field.append", "field.inc", "field.dec", "field.updateWhere", "field.removeWhere" ];
 
 function isFieldOp(summary) {
     return FIELD_OP_TYPES.includes(summary.opType);
@@ -2605,38 +2388,7 @@ function isFieldOp(summary) {
 
 function validateActionParams({action: action, activityName: activityName, callerParams: callerParams}) {
     const declared = action.params ?? [], params = callerParams ?? {}, issues = [];
-    for (const decl of declared) {
-        const value = params[decl.name], present = decl.name in params && value !== void 0 && value !== null;
-        if (decl.required === !0 && !present) {
-            issues.push({
-                param: decl.name,
-                reason: "required but missing"
-            });
-            continue;
-        }
-        if (!present) continue;
-        if (!checkParamType(value, decl)) {
-            issues.push({
-                param: decl.name,
-                reason: `expected type=${decl.type}, got ${typeof value}`
-            });
-            continue;
-        }
-        const choiceIssues = choiceValueIssues(decl.options, value);
-        choiceIssues !== void 0 && issues.push({
-            param: decl.name,
-            reason: choiceIssues.join("; ")
-        });
-        const validationIssues = scalarValidationIssues({
-            entryType: decl.type,
-            validation: decl.validation,
-            value: value
-        });
-        validationIssues !== void 0 && issues.push({
-            param: decl.name,
-            reason: validationIssues.join("; ")
-        });
-    }
+    for (const decl of declared) issues.push(...declaredParamIssues(decl, params));
     if (issues.length > 0) throw new ActionParamsInvalidError({
         action: action.name,
         activity: activityName,
@@ -2645,6 +2397,30 @@ function validateActionParams({action: action, activityName: activityName, calle
     return params;
 }
 
+function declaredParamIssues(decl, params) {
+    const value = params[decl.name];
+    if (!(decl.name in params && value !== void 0 && value !== null)) return decl.required === !0 ? [ {
+        param: decl.name,
+        reason: "required but missing"
+    } ] : [];
+    if (!checkParamType(value, decl)) return [ {
+        param: decl.name,
+        reason: `expected type=${decl.type}, got ${typeof value}`
+    } ];
+    const choiceIssues = choiceValueIssues(decl.options, value), validationIssues = scalarValidationIssues({
+        entryType: decl.type,
+        validation: decl.validation,
+        value: value
+    });
+    return [ ...choiceIssues === void 0 ? [] : [ {
+        param: decl.name,
+        reason: choiceIssues.join("; ")
+    } ], ...validationIssues === void 0 ? [] : [ {
+        param: decl.name,
+        reason: validationIssues.join("; ")
+    } ] ];
+}
+
 function hasStringField(value, field) {
     return typeof value == "object" && value !== null && field in value && typeof value[field] == "string";
 }
@@ -2696,9 +2472,11 @@ async function runOps(args) {
             now: now,
             snapshot: snapshot,
             refSurface: refSurface,
-            opsFromDefinition: opsFromDefinition
+            opsFromDefinition: opsFromDefinition,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases
         });
-        summaries.push(summary), mutation.history.push(opAppliedEntry({
+        summaries.push(summary), shouldRecordOpApplied(summary) && mutation.history.push(opAppliedEntry({
             origin: origin,
             summary: summary,
             stage: stage,
@@ -2709,6 +2487,10 @@ async function runOps(args) {
     return summaries;
 }
 
+function shouldRecordOpApplied(summary) {
+    return summary.opType !== "field.setIfMissing" || summary.resolved !== void 0;
+}
+
 function opAppliedEntry(args) {
     const {origin: origin, summary: summary, stage: stage, actor: actor, now: now} = args;
     return {
@@ -2780,12 +2562,19 @@ async function applyOp(op, ctx) {
       case "field.set":
         return applyFieldSet(op, ctx);
 
+      case "field.setIfMissing":
+        return applyFieldSetIfMissing(op, ctx);
+
       case "field.unset":
         return applyFieldUnset(op, ctx);
 
       case "field.append":
         return applyFieldAppend(op, ctx);
 
+      case "field.inc":
+      case "field.dec":
+        return applyFieldArithmetic(op, ctx);
+
       case "field.updateWhere":
         return applyFieldUpdateWhere(op, ctx);
 
@@ -2806,7 +2595,12 @@ function applyFieldSet(op, ctx) {
         entryType: entry._type,
         entryName: entry.name,
         value: value,
-        ...entryShape(entry)
+        ...entryShape(entry),
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases,
+        ...entry._type === "assignees" || entry._type === "object" || entry._type === "array" ? {
+            previousValue: entry.value
+        } : {}
     });
     return assertRuntimeRefsWithinSurface({
         entryType: entry._type,
@@ -2824,6 +2618,78 @@ function applyFieldSet(op, ctx) {
     };
 }
 
+function applyFieldSetIfMissing(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    return isAlwaysArrayFieldKind(entry._type) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "is always array-valued — setIfMissing applies to nullable entries only; an empty array entry already holds []"
+    }), entry.value !== null && entry.value !== void 0 ? {
+        opType: op.type,
+        target: op.target
+    } : {
+        ...applyFieldSet({
+            ...op,
+            type: "field.set"
+        }, ctx),
+        opType: op.type
+    };
+}
+
+function applyFieldArithmetic(op, ctx) {
+    const entry = locateEntry(ctx, op.target);
+    entry._type !== "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: `is a ${entry._type} entry — arithmetic ops target \`number\` entries only`
+    }), typeof entry.value != "number" && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "has no numeric value — initialize it before applying arithmetic"
+    });
+    const resolvedDelta = op.value === void 0 ? 1 : resolveOpValue({
+        src: op.value,
+        ctx: ctx,
+        target: {
+            kind: "number"
+        }
+    });
+    (typeof resolvedDelta != "number" || !Number.isFinite(resolvedDelta)) && rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "value must resolve to a finite number"
+    });
+    const nextValue = entry.value + (op.type === "field.inc" ? resolvedDelta : -resolvedDelta);
+    Number.isFinite(nextValue) || rejectFieldOpTarget({
+        entry: entry,
+        op: op,
+        issue: "result must be a finite number"
+    });
+    const value = validateFieldValue({
+        entryType: entry._type,
+        entryName: entry.name,
+        value: nextValue,
+        ...entryShape(entry)
+    });
+    return setEntryValue(entry, value), {
+        opType: op.type,
+        target: op.target,
+        resolved: {
+            value: value
+        }
+    };
+}
+
+function rejectFieldOpTarget(args) {
+    const {entry: entry, op: op, issue: issue} = args;
+    throw new FieldValueShapeError({
+        entryType: entry._type,
+        entryName: entry.name,
+        mode: "value",
+        issues: [ `${op.type} target ${op.target.scope}:"${op.target.field}" ${issue}` ]
+    });
+}
+
 function entryShape(entry) {
     return entry._type === "object" ? {
         fields: entry.fields
@@ -2831,7 +2697,17 @@ function entryShape(entry) {
         of: entry.of
     } : isSingleDocRefEntry(entry) || entry._type === "doc.refs" ? entry.types !== void 0 ? {
         types: entry.types
-    } : {} : {
+    } : {} : isAssignmentFieldEntry(entry) ? assignmentEntryShape(entry) : scalarEntryShape(entry);
+}
+
+function assignmentEntryShape(entry) {
+    return entry.roles !== void 0 ? {
+        roles: entry.roles
+    } : {};
+}
+
+function scalarEntryShape(entry) {
+    return {
         ...entry.options !== void 0 ? {
             options: entry.options
         } : {},
@@ -2859,15 +2735,9 @@ function appendItemSlot(entry) {
     };
 }
 
-const EMPTY_BY_KIND = {
-    "doc.refs": [],
-    array: [],
-    assignees: []
-};
-
 function applyFieldUnset(op, ctx) {
     const entry = locateEntry(ctx, op.target);
-    return setEntryValue(entry, EMPTY_BY_KIND[entry._type] ?? null), {
+    return setEntryValue(entry, isAlwaysArrayFieldKind(entry._type) ? [] : null), {
         opType: op.type,
         target: op.target
     };
@@ -2885,7 +2755,10 @@ function applyFieldAppend(op, ctx) {
         entryName: entry.name,
         item: item,
         types: entry._type === "doc.refs" ? entry.types : void 0,
-        of: entry._type === "array" ? entry.of : void 0
+        of: entry._type === "array" ? entry.of : void 0,
+        roles: entry._type === "assignees" ? entry.roles : void 0,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     assertRuntimeRefsWithinSurface({
         entryType: entry._type === "doc.refs" ? "doc.ref" : "object",
@@ -2906,7 +2779,7 @@ function applyFieldAppend(op, ctx) {
 }
 
 function withRowKey(item) {
-    return typeof item == "object" && item !== null && !Array.isArray(item) && !("_key" in item) ? {
+    return isRecord(item) && !("_key" in item) ? {
         _key: randomKey(),
         ...item
     } : item;
@@ -2933,6 +2806,13 @@ async function applyFieldUpdateWhere(op, ctx) {
         merge: mergeRecord,
         entry: entry,
         op: op
+    }), validateFieldValue({
+        entryType: "array",
+        entryName: entry.name,
+        value: [ mergeRecord ],
+        of: entry.of,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     const matches = await rowMatches({
         where: op.where,
@@ -3049,18 +2929,6 @@ function subSlot(target, field) {
 function resolveOpValue(args) {
     const {src: src, ctx: ctx, target: target} = args;
     switch (src.type) {
-      case "literal":
-      case "param":
-      case "actor":
-      case "now":
-        return resolveStaticValueExpr(src, ctx);
-
-      case "self":
-        return ctx.self;
-
-      case "stage":
-        return ctx.stage;
-
       case "fieldRead":
         {
             const entry = readEntryFromMutation(ctx, src);
@@ -3090,6 +2958,25 @@ function resolveOpValue(args) {
             }
             return out;
         }
+
+      default:
+        return resolveAtomicOpValue(src, ctx);
+    }
+}
+
+function resolveAtomicOpValue(src, ctx) {
+    switch (src.type) {
+      case "literal":
+      case "param":
+      case "actor":
+      case "now":
+        return resolveStaticValueExpr(src, ctx);
+
+      case "self":
+        return ctx.self;
+
+      case "stage":
+        return ctx.stage;
     }
 }
 
@@ -3540,69 +3427,418 @@ async function assertInstanceWriteAllowed(args) {
     });
 }
 
-async function renderConditionScope(source, opts) {
-    const {instance: instance, definition: definition, snapshot: snapshot, now: now} = source, base = buildParams({
-        instance: instance,
-        now: now,
-        snapshot: snapshot
-    }), fields = {
-        ...base.fields,
-        ...scopedFieldOverlay({
-            instance: instance,
-            snapshot: snapshot,
-            activityName: opts?.activityName
-        })
-    }, params = {
-        ...base,
-        fields: fields,
-        actor: opts?.actor,
-        assigned: opts?.activityName !== void 0 ? assignedFor({
-            instance: instance,
-            activityName: opts.activityName,
-            actor: opts?.actor,
-            roleAliases: definition.roleAliases
-        }) : !1,
-        ...opts?.vars
-    };
-    return {
-        ...await evaluatePredicates({
-            predicates: definition.predicates,
-            snapshot: snapshot,
-            params: params
-        }),
-        ...params
-    };
-}
+const DATA_MODEL_VERSION = 8, DATA_MODEL_MIN_READER = 4, DATA_MODEL_MAX_READER = 8, READER_MODEL_ROLLOUT_URL = "https://www.sanity.io/docs/editorial-workflows/prerelease";
 
-function definitionLookupGroq(explicit) {
-    const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}`;
-    return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
+class ReaderModelAcknowledgementError extends WorkflowError {
+    code="WORKFLOW_READER_MODEL_ACKNOWLEDGEMENT_MISMATCH";
+    expectedMinReaderModel;
+    requiredMinReaderModel;
+    engineMinReaderModel=DATA_MODEL_MIN_READER;
+    engineMaxReaderModel=DATA_MODEL_MAX_READER;
+    engineModelVersion=DATA_MODEL_VERSION;
+    documentationUrl=READER_MODEL_ROLLOUT_URL;
+    constructor(expectedMinReaderModel, options = {}) {
+        const {context: context = "Deployment", requiredMinReaderModel: requiredMinReaderModel = DATA_MODEL_MIN_READER} = options, expected = expectedMinReaderModel === void 0 ? "missing" : String(expectedMinReaderModel);
+        super("reader-model-acknowledgement", `${context} acknowledges reader model ${expected}; the submitted definitions require at least ${requiredMinReaderModel}, and this writer supports acknowledgements through ${DATA_MODEL_MAX_READER}.\nUse a reviewed numeric literal in that range. Before raising it, ensure every runtime sharing the workflow resource can read the required model.\nRollout guide: ${READER_MODEL_ROLLOUT_URL}`), 
+        this.name = "ReaderModelAcknowledgementError", this.expectedMinReaderModel = expectedMinReaderModel, 
+        this.requiredMinReaderModel = requiredMinReaderModel;
+    }
 }
 
-function definitionsListGroq(versionOrder) {
-    return `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}] | order(name asc, version ${versionOrder})`;
+function assertReaderModelAcknowledgement(expectedMinReaderModel, options) {
+    const {context: context, requiredMinReaderModel: requiredMinReaderModel} = options;
+    if (typeof expectedMinReaderModel != "number" || !Number.isFinite(expectedMinReaderModel) || !Number.isInteger(expectedMinReaderModel) || expectedMinReaderModel < 0 || expectedMinReaderModel < requiredMinReaderModel || expectedMinReaderModel > DATA_MODEL_MAX_READER) throw new ReaderModelAcknowledgementError(expectedMinReaderModel, {
+        requiredMinReaderModel: requiredMinReaderModel,
+        ...context !== void 0 ? {
+            context: context
+        } : {}
+    });
 }
 
-function latestDefinitionsGroq() {
-    const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}`;
-    return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
+const DATA_MODEL_CHANGES = Object.freeze([ Object.freeze({
+    id: "governed-model-stamps",
+    introducedInModel: 1,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Definition and instance documents carry model provenance and reader-floor stamps."
+}), Object.freeze({
+    id: "subject-field-kind",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A workflow-level subject field identifies the document a workflow is about."
+}), Object.freeze({
+    id: "typed-scalar-choice-lists",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Scalar fields may constrain writes to a persisted typed choice list."
+}), Object.freeze({
+    id: "action-semantics",
+    introducedInModel: 2,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Ordinary actions may carry advisory workflow semantics."
+}), Object.freeze({
+    id: "inclusive-scalar-bounds",
+    introducedInModel: 2,
+    minReaderModel: 2,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "String, text, and number values may carry persisted inclusive bounds."
+}), Object.freeze({
+    id: "progress-field-kind",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "A progress field kind carries application-defined 0–100 completion."
+}), Object.freeze({
+    id: "effect-claim-tokens",
+    introducedInModel: 3,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Pending-effect claims carry an exact-claim token gating mid-dispatch state reports."
+}), Object.freeze({
+    id: "classified-principal-ids",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "unconditional",
+    summary: "Principal ids are namespace-classified: actor and assignee writes carry the account-global user id only, and readers resolve legacy project-scoped ids through the prefix classifier at the instance read funnel."
+}), Object.freeze({
+    id: "readiness-requirements",
+    introducedInModel: 4,
+    minReaderModel: 4,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Start and activity readiness use named polymorphic requirement arrays."
+}), Object.freeze({
+    id: "due-date-field-kinds",
+    introducedInModel: 5,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Due-date field kinds (dueDate, dueDatetime) mark a level deadline, elevated aliases of date/datetime carrying the same stored value."
+}), Object.freeze({
+    id: "node-semantics",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Workflow, stage, activity, and action nodes may carry signal or custom advisory semantics."
+}), Object.freeze({
+    id: "field-patch-ops",
+    introducedInModel: 6,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "additive",
+    applicability: "detectable",
+    summary: "Field ops may increment, decrement, or initialize a missing field value."
+}), Object.freeze({
+    id: "attributes-condition-var",
+    introducedInModel: 7,
+    minReaderModel: 0,
+    documentTypes: Object.freeze([ "definition" ]),
+    compatibility: "additive",
+    applicability: "unconditional",
+    summary: "Caller-bound $attributes condition variable binds the acting token's org-level User Attributes (advisory; absent when unavailable)."
+}), Object.freeze({
+    id: "role-constrained-assignment-fields",
+    introducedInModel: 8,
+    minReaderModel: 8,
+    documentTypes: Object.freeze([ "definition", "instance" ]),
+    compatibility: "reader-floor",
+    applicability: "detectable",
+    summary: "Assignee fields may restrict newly assigned users and collective roles by role."
+}) ]);
+
+function recordOf(value) {
+    return value !== null && typeof value == "object" && !Array.isArray(value) ? value : void 0;
 }
 
-function deployedTagsGroq() {
-    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+function recordsAt(record, key) {
+    const value = record[key];
+    return Array.isArray(value) ? value.map(recordOf).filter(item => item !== void 0) : [];
 }
 
-function definitionTagsGroq() {
-    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+function nestedFieldEntries(entries) {
+    return entries.flatMap(entry => [ entry, ...nestedFieldEntries(recordsAt(entry, "fields")), ...nestedFieldEntries(recordsAt(entry, "of")) ]);
 }
 
-function latestDeployedDefinitions(rows) {
-    const byName = /* @__PURE__ */ new Map;
-    for (const row of rows) {
-        const held = byName.get(row.name);
-        (held === void 0 || row.version > held.version) && byName.set(row.name, row);
-    }
-    return [ ...byName.values() ];
+function parsedDefinitionSnapshot(root) {
+    if (typeof root.definitionSnapshot == "string") return recordOf(parseDefinitionSnapshotValue({
+        _id: typeof root._id == "string" ? root._id : "<unknown instance>",
+        definitionSnapshot: root.definitionSnapshot
+    }));
+}
+
+function persistedDefinitionTree(document) {
+    const root = recordOf(document);
+    if (root === void 0) return;
+    const snapshot = parsedDefinitionSnapshot(root), roots = snapshot === void 0 ? [ root ] : [ root, snapshot ], {stages: stages, activities: activities, actions: actions} = definitionDescendants(roots);
+    return {
+        roots: roots,
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function persistedFieldEntries(document) {
+    const tree = persistedDefinitionTree(document);
+    if (tree === void 0) return [];
+    const {roots: roots, stages: stages, activities: activities, actions: actions} = tree, effects = actions.flatMap(action => recordsAt(action, "effects"));
+    return nestedFieldEntries([ ...roots.flatMap(candidate => recordsAt(candidate, "fields")), ...stages.flatMap(stage => recordsAt(stage, "fields")), ...activities.flatMap(activity => recordsAt(activity, "fields")), ...actions.flatMap(action => recordsAt(action, "params")), ...effects.flatMap(effect => recordsAt(effect, "outputs")) ]);
+}
+
+function definitionDescendants(roots) {
+    const stages = roots.flatMap(root => recordsAt(root, "stages")), activities = stages.flatMap(stage => recordsAt(stage, "activities")), actions = activities.flatMap(activity => recordsAt(activity, "actions"));
+    return {
+        stages: stages,
+        activities: activities,
+        actions: actions
+    };
+}
+
+function hasChoiceList(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const options = recordOf(entry.options);
+        return options !== void 0 && Array.isArray(options.list);
+    });
+}
+
+function entryHasKind(entry, kind) {
+    return entryKindMatches(entry, candidate => candidate === kind);
+}
+
+function entryKindMatches(entry, accepts) {
+    return [ entry.type, entry._type ].some(kind => typeof kind == "string" && accepts(kind));
+}
+
+function hasFieldKind(document, kind) {
+    return persistedFieldEntries(document).some(entry => entryHasKind(entry, kind));
+}
+
+function definitionNodes(document) {
+    const root = recordOf(document);
+    if (root !== void 0) return {
+        root: root,
+        ...definitionDescendants([ root ])
+    };
+}
+
+function hasActionSemantics(document) {
+    return definitionNodes(document)?.actions.some(hasSemantics) ?? !1;
+}
+
+function hasNodeSemantics(document) {
+    const nodes = definitionNodes(document);
+    return nodes === void 0 ? !1 : [ nodes.root, ...nodes.stages, ...nodes.activities ].some(hasSemantics) ? !0 : nodes.actions.some(action => hasSemantics(action) && action.semantics.some(isNodeSemanticValue));
+}
+
+function isNodeSemanticValue(semantic) {
+    return typeof semantic == "string" && (semantic.startsWith("signal.") || semantic.startsWith("custom."));
+}
+
+function hasSemantics(node) {
+    return Array.isArray(node.semantics);
+}
+
+function hasPersistedOpType(document, types) {
+    const tree = persistedDefinitionTree(document);
+    return tree === void 0 ? !1 : tree.actions.flatMap(action => recordsAt(action, "ops")).some(op => typeof op.type == "string" && types.includes(op.type)) ? !0 : tree.roots.some(root => recordsAt(root, "history").some(entry => entry._type === "opApplied" && typeof entry.opType == "string" && types.includes(entry.opType)));
+}
+
+function hasScalarValidation(document) {
+    return persistedFieldEntries(document).some(entry => {
+        const validation = recordOf(entry.validation);
+        return typeof validation?.min == "number" || typeof validation?.max == "number";
+    });
+}
+
+function hasClaimTokens(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : recordsAt(root, "pendingEffects").some(entry => {
+        const claim = recordOf(entry.claim);
+        return claim !== void 0 && typeof claim.claimToken == "string";
+    });
+}
+
+function hasReadinessRequirements(document) {
+    const root = recordOf(document);
+    return root === void 0 ? !1 : Array.isArray(recordOf(root.start)?.requirements) ? !0 : recordsAt(root, "stages").some(stage => recordsAt(stage, "activities").some(activity => Array.isArray(activity.requirements)));
+}
+
+function hasRoleConstrainedAssignments(document) {
+    return persistedFieldEntries(document).some(entry => entryKindMatches(entry, assignmentKindAcceptsRoles) && Array.isArray(entry.roles) && entry.roles.length > 0);
+}
+
+const featureDetectors = {
+    "governed-model-stamps": () => !0,
+    "subject-field-kind": document => hasFieldKind(document, "subject"),
+    "typed-scalar-choice-lists": hasChoiceList,
+    "action-semantics": hasActionSemantics,
+    "inclusive-scalar-bounds": hasScalarValidation,
+    "progress-field-kind": document => hasFieldKind(document, "progress"),
+    "effect-claim-tokens": hasClaimTokens,
+    "classified-principal-ids": () => !0,
+    "readiness-requirements": hasReadinessRequirements,
+    "due-date-field-kinds": document => hasFieldKind(document, "dueDate") || hasFieldKind(document, "dueDatetime"),
+    "role-constrained-assignment-fields": hasRoleConstrainedAssignments,
+    "node-semantics": hasNodeSemantics,
+    "field-patch-ops": document => hasPersistedOpType(document, [ "field.inc", "field.dec", "field.setIfMissing" ]),
+    "attributes-condition-var": () => !0
+};
+
+function requiredModelFeatures(documentType, document) {
+    return DATA_MODEL_CHANGES.filter(change => change.documentTypes.some(candidate => candidate === documentType) && featureDetectors[change.id](document));
+}
+
+function requiredReaderModel(documentType, document) {
+    return Math.max(0, ...requiredModelFeatures(documentType, document).map(change => change.minReaderModel));
+}
+
+function requiredDefinitionReaderModel(definitions) {
+    return Math.max(DATA_MODEL_MIN_READER, ...definitions.map(definition => requiredReaderModel("definition", definition)));
+}
+
+function modelStampFor(args) {
+    return {
+        modelVersion: DATA_MODEL_VERSION,
+        minReaderModel: Math.max(DATA_MODEL_MIN_READER, args.storedMinReaderModel ?? 0, requiredReaderModel(args.documentType, args.document))
+    };
+}
+
+function fieldTreeShape(value) {
+    if (Array.isArray(value)) return value.map(fieldTreeShape);
+    if (value === null) return "null";
+    if (typeof value == "object") {
+        const record = value;
+        return Object.fromEntries(Object.keys(record).toSorted().map(key => [ key, fieldTreeShape(record[key]) ]));
+    }
+    return typeof value;
+}
+
+function modelVersionOf(doc) {
+    const stamp = doc.modelVersion;
+    return typeof stamp == "number" ? stamp : 0;
+}
+
+function minReaderModelOf(doc) {
+    const floor = doc.minReaderModel;
+    return typeof floor == "number" ? floor : modelVersionOf(doc);
+}
+
+class ModelVersionAheadError extends WorkflowError {
+    documentId;
+    documentModelVersion;
+    requiredReaderModel;
+    engineModelVersion;
+    constructor(args) {
+        super("model-version-ahead", `Document "${args.documentId}" was written by engine data model ${args.documentModelVersion} and requires a reader at model ${args.requiredReaderModel} or newer; this engine reads up to model ${DATA_MODEL_VERSION}. Upgrade @sanity/workflow-engine to a version that understands it.`), 
+        this.name = "ModelVersionAheadError", this.documentId = args.documentId, this.documentModelVersion = args.documentModelVersion, 
+        this.requiredReaderModel = args.requiredReaderModel, this.engineModelVersion = DATA_MODEL_VERSION;
+    }
+}
+
+function assertReadableModel(doc) {
+    const documentReaderModel = minReaderModelOf(doc);
+    if (documentReaderModel > DATA_MODEL_VERSION) throw new ModelVersionAheadError({
+        documentId: doc._id,
+        documentModelVersion: modelVersionOf(doc),
+        requiredReaderModel: documentReaderModel
+    });
+    return doc;
+}
+
+async function renderConditionScope(source, opts) {
+    const {instance: instance, definition: definition, snapshot: snapshot, now: now} = source, base = buildParams({
+        instance: instance,
+        now: now,
+        snapshot: snapshot
+    }), fields = {
+        ...base.fields,
+        ...scopedFieldOverlay({
+            instance: instance,
+            snapshot: snapshot,
+            activityName: opts?.activityName
+        })
+    }, params = {
+        ...base,
+        fields: fields,
+        actor: opts?.actor,
+        assigned: opts?.activityName !== void 0 ? assignedFor({
+            instance: instance,
+            activityName: opts.activityName,
+            actor: opts?.actor,
+            roleAliases: definition.roleAliases
+        }) : !1,
+        ...opts?.vars
+    };
+    return {
+        ...await evaluatePredicates({
+            predicates: definition.predicates,
+            snapshot: snapshot,
+            params: params
+        }),
+        ...params
+    };
+}
+
+function definitionLookupGroq(explicit) {
+    const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition && ${tagScopeFilter()}`;
+    return explicit ? `*[${scoped} && version == $version][0]` : `*[${scoped}] | order(version desc)[0]`;
+}
+
+function definitionsListGroq(versionOrder) {
+    return `*[_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}] | order(name asc, version ${versionOrder})`;
+}
+
+function latestDefinitionsGroq() {
+    const scoped = `_type == "${WORKFLOW_DEFINITION_TYPE}" && ${tagScopeFilter()}`;
+    return `*[${scoped} && version == math::max(*[${scoped} && name == ^.name].version)] | order(name asc)`;
+}
+
+function deployedTagsGroq() {
+    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}"].tag) | order(@ asc)`;
+}
+
+function definitionTagsGroq() {
+    return `array::unique(*[_type == "${WORKFLOW_DEFINITION_TYPE}" && name == $definition].tag) | order(@ asc)`;
+}
+
+function latestDeployedDefinitions(rows) {
+    const byName = /* @__PURE__ */ new Map;
+    for (const row of rows) {
+        const held = byName.get(row.name);
+        (held === void 0 || row.version > held.version) && byName.set(row.name, row);
+    }
+    return [ ...byName.values() ];
+}
+
+function findStageNode(args) {
+    return args.definition?.stages.find(entry => entry.name === args.stageName);
+}
+
+function findActivityNode(args) {
+    return findStageNode(args)?.activities?.find(entry => entry.name === args.activityName);
 }
 
 function liveChildrenField(instance) {
@@ -3693,6 +3929,27 @@ function noTransitionFiresCause(input) {
     };
 }
 
+function stuckFromDocumentState(input) {
+    return failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input);
+}
+
+function documentStuckCause(args) {
+    const stage = findOpenStageEntry(args.instance);
+    if (stage !== void 0) return stuckFromDocumentState({
+        instance: args.instance,
+        activities: stage.activities.map(entry => ({
+            status: entry.status,
+            activity: findActivityNode({
+                activityName: entry.name,
+                definition: args.definition,
+                stageName: stage.name
+            }) ?? {
+                name: entry.name
+            }
+        }))
+    });
+}
+
 function diagnoseInstance(input) {
     const {instance: instance} = input, terminal = terminalState(instance);
     if (terminal === "aborted" && instance.abortedAt !== void 0) {
@@ -3711,7 +3968,7 @@ function diagnoseInstance(input) {
         at: instance.completedAt,
         ...liveChildrenField(instance)
     };
-    const cause = failedEffectCause(input) ?? failedActivityCause(input) ?? hungEffectCause(input) ?? noTransitionFiresCause(input);
+    const cause = stuckFromDocumentState(input) ?? noTransitionFiresCause(input);
     return cause !== void 0 ? {
         state: "stuck",
         cause: cause
@@ -3773,46 +4030,246 @@ function isClaimExpired(claim, now) {
     return claim.leaseExpiresAt === void 0 || hasPassed(claim.leaseExpiresAt, now);
 }
 
-const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ], EXECUTION_KINDS = {
-    interactive: "interactive",
-    server: "server",
-    cli: "cli",
-    mcp: "mcp",
-    drainer: "drainer",
-    script: "script",
-    test: "test",
-    studio: "studio",
-    sdkApp: "sdk-app"
-};
+const EFFECT_RUN_STATUSES = [ "done", "failed", "cancelled" ];
 
-function detectRuntime() {
-    const g = globalThis;
-    if (g.Deno !== void 0) return "deno";
-    if (g.Bun !== void 0) return "bun";
-    if (g.EdgeRuntime !== void 0) return "edge";
-    if (g.window !== void 0 && g.document !== void 0) return "browser";
-    if (g.WorkerGlobalScope !== void 0 && g.self !== void 0) return "worker";
-    const proc = g.process;
-    return typeof proc == "object" && proc !== null && typeof proc.versions?.node == "string" ? "node" : "unknown";
+function userLoginProvider(user) {
+    return user?.provider ?? user?.loginProvider;
 }
 
-let inferredRuntime;
+function optionalString(value) {
+    return value === void 0 || typeof value == "string";
+}
 
-function resolveExecutionContext(declared) {
-    return inferredRuntime ??= detectRuntime(), {
-        runtime: inferredRuntime,
-        ...declared?.kind !== void 0 ? {
-            kind: declared.kind
-        } : {},
-        ...declared?.id !== void 0 ? {
-            id: declared.id
-        } : {}
-    };
+function isClientProjectUser(value) {
+    return isRecord(value) && typeof value.id == "string" && optionalString(value.sanityUserId) && optionalString(value.displayName) && optionalString(value.email) && (value.imageUrl === null || optionalString(value.imageUrl)) && optionalString(value.provider) && optionalString(value.loginProvider);
 }
 
-function stampHistoryEntries(entries, stamp) {
-    return entries.map(entry => ({
-        ...entry,
+function objectProperty(value, property) {
+    if (!isRecord(value)) return;
+    const propertyValue = value[property];
+    return typeof propertyValue == "object" && propertyValue !== null ? propertyValue : void 0;
+}
+
+function stringProperty(value, property) {
+    const propertyValue = Reflect.get(value, property);
+    return typeof propertyValue == "string" ? propertyValue : void 0;
+}
+
+function apiErrorType(error) {
+    const response = objectProperty(error, "response"), body = objectProperty(response, "body");
+    if (!body) return;
+    const nestedError = objectProperty(body, "error");
+    return (nestedError ? stringProperty(nestedError, "type") : void 0) ?? stringProperty(body, "type");
+}
+
+function isProjectUserNotFoundError(error) {
+    return apiErrorType(error) === "projectUserNotFoundError";
+}
+
+const memberJoinCache = /* @__PURE__ */ new WeakMap;
+
+function joinCacheFor(client) {
+    let cache = memberJoinCache.get(client);
+    return cache === void 0 && (cache = /* @__PURE__ */ new Map, memberJoinCache.set(client, cache)), 
+    cache;
+}
+
+function isClientProjectMember(value) {
+    return isRecord(value) && typeof value.id == "string";
+}
+
+async function requestProjectMembers(request, projectId) {
+    const project = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}`
+    }), members = isRecord(project) ? project.members : void 0;
+    if (!Array.isArray(members) || !members.every(isClientProjectMember)) throw new Error(`Project member directory response is invalid for project "${projectId}"`);
+    return members;
+}
+
+async function requestProjectUsers(args) {
+    const {request: request, projectId: projectId, memberIds: memberIds} = args, response = await request({
+        uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
+    }), rows = Array.isArray(response) ? response : [ response ];
+    if (!rows.every(isClientProjectUser)) throw new Error(`Project user directory response is invalid for project "${projectId}"`);
+    const requested = new Set(memberIds);
+    return rows.filter(row => requested.has(row.id));
+}
+
+async function requestProjectMemberDirectory(args) {
+    const {request: request, projectId: projectId} = args, members = await requestProjectMembers(request, projectId), memberIds = members.map(member => member.id).filter(id => classifyPrincipalId(id).namespace === "project");
+    if (memberIds.length === 0) return {
+        members: members,
+        globalUsers: []
+    };
+    const users = await requestProjectUsers({
+        request: request,
+        projectId: projectId,
+        memberIds: memberIds
+    });
+    return {
+        members: members,
+        globalUsers: users.flatMap(user => {
+            const globalId = directoryBridgeId(user.sanityUserId);
+            return globalId === void 0 ? [] : [ {
+                memberId: user.id,
+                globalId: globalId,
+                user: user
+            } ];
+        })
+    };
+}
+
+async function resolveGlobalProjectUser(args) {
+    const {client: client, request: request, projectId: projectId, id: id} = args, cache = joinCacheFor(client), key = `${projectId}:${id}`, hit = cache.get(key);
+    if (hit !== void 0) return hit === null ? {
+        status: "missing"
+    } : {
+        status: "resolved",
+        user: hit
+    };
+    try {
+        await ingestMemberJoin({
+            request: request,
+            projectId: projectId,
+            cache: cache
+        });
+        const found = cache.get(key);
+        return found != null ? {
+            status: "resolved",
+            user: found
+        } : (cache.set(key, null), {
+            status: "missing"
+        });
+    } catch (cause) {
+        return {
+            status: "inaccessible",
+            cause: cause
+        };
+    }
+}
+
+async function ingestMemberJoin(args) {
+    const {request: request, projectId: projectId, cache: cache} = args, snapshot = await requestProjectMemberDirectory({
+        request: request,
+        projectId: projectId
+    });
+    for (const {globalId: globalId, user: user} of snapshot.globalUsers) cache.set(`${projectId}:${globalId}`, user);
+}
+
+function clientProjectUserDirectory(client, projectId) {
+    return {
+        findById: async id => {
+            if (!client.request) return {
+                status: "inaccessible",
+                cause: new Error("Project-user resolution requires WorkflowClient.request")
+            };
+            if (classifyPrincipalId(id).namespace === "global") return resolveGlobalProjectUser({
+                client: client,
+                request: client.request,
+                projectId: projectId,
+                id: id
+            });
+            try {
+                const response = await client.request({
+                    uri: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
+                }), candidate = Array.isArray(response) ? response[0] : response;
+                return candidate == null ? {
+                    status: "missing"
+                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
+                    status: "inaccessible",
+                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
+                } : {
+                    status: "resolved",
+                    user: candidate
+                } : {
+                    status: "inaccessible",
+                    cause: new Error("Project-user response had an invalid shape")
+                };
+            } catch (cause) {
+                return isProjectUserNotFoundError(cause) ? {
+                    status: "missing"
+                } : {
+                    status: "inaccessible",
+                    cause: cause
+                };
+            }
+        }
+    };
+}
+
+function resolveClientActor(client, args) {
+    return resolveActor(clientProjectUserDirectory(client, args.projectId), args.actor);
+}
+
+async function resolveActor(directory, actor) {
+    if (actor.kind !== "person") return {
+        status: "not-person",
+        actor: actor
+    };
+    const personActor = {
+        ...actor,
+        kind: "person"
+    }, lookup = await directory.findById(personActor.id);
+    return lookup.status === "resolved" ? {
+        status: "resolved",
+        actor: personActor,
+        user: lookup.user
+    } : lookup.status === "inaccessible" ? {
+        status: "inaccessible",
+        actor: personActor,
+        ...lookup.cause === void 0 ? {} : {
+            cause: lookup.cause
+        }
+    } : {
+        status: "missing",
+        actor: personActor
+    };
+}
+
+function assertRoleConstrainedAssignmentResource(args) {
+    if (hasRoleConstrainedAssignments(args.definition) && args.workflowResource.type !== "dataset") throw new Error(`${args.context}: definition "${args.definition.name}" uses role-constrained assignment fields, which require a dataset workflow resource; received resource type "${args.workflowResource.type}"`);
+}
+
+const EXECUTION_KINDS = {
+    interactive: "interactive",
+    server: "server",
+    cli: "cli",
+    mcp: "mcp",
+    drainer: "drainer",
+    script: "script",
+    test: "test",
+    studio: "studio",
+    sdkApp: "sdk-app"
+};
+
+function detectRuntime() {
+    const g = globalThis;
+    if (g.Deno !== void 0) return "deno";
+    if (g.Bun !== void 0) return "bun";
+    if (g.EdgeRuntime !== void 0) return "edge";
+    if (g.window !== void 0 && g.document !== void 0) return "browser";
+    if (g.WorkerGlobalScope !== void 0 && g.self !== void 0) return "worker";
+    const proc = g.process;
+    return typeof proc == "object" && proc !== null && typeof proc.versions?.node == "string" ? "node" : "unknown";
+}
+
+let inferredRuntime;
+
+function resolveExecutionContext(declared) {
+    return inferredRuntime ??= detectRuntime(), {
+        runtime: inferredRuntime,
+        ...declared?.kind !== void 0 ? {
+            kind: declared.kind
+        } : {},
+        ...declared?.id !== void 0 ? {
+            id: declared.id
+        } : {}
+    };
+}
+
+function stampHistoryEntries(entries, stamp) {
+    return entries.map(entry => ({
+        ...entry,
         executionContext: stamp
     }));
 }
@@ -4090,10 +4547,8 @@ function assertRequiredInputProvided({entryDefs: entryDefs, initialFields: initi
     });
 }
 
-const ARRAY_FIELD_TYPES = /* @__PURE__ */ new Set([ "doc.refs", "array", "assignees" ]);
-
 function defaultEntryValue(entryType) {
-    return ARRAY_FIELD_TYPES.has(entryType) ? [] : null;
+    return isAlwaysArrayFieldKind(entryType) ? [] : null;
 }
 
 function resolveInputValue({entry: entry, initialFields: initialFields, defaultValue: defaultValue}) {
@@ -4198,6 +4653,9 @@ function buildResolvedEntry({entry: entry, value: value, _key: _key, now: now})
         ...entry.validation !== void 0 ? {
             validation: entry.validation
         } : {},
+        ...entry.roles !== void 0 ? {
+            roles: entry.roles
+        } : {},
         value: value,
         ...entry.initialValue?.type === "query" ? {
             resolvedAt: now
@@ -4229,7 +4687,10 @@ async function resolveOneEntry({entry: entry, initialFields: initialFields, ctx:
             fields: entry.fields,
             of: entry.of,
             options: entry.options,
-            validation: entry.validation
+            validation: entry.validation,
+            roles: entry.roles,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.roleAliases
         });
         return "issues" in check ? (ctx.recordDiscard?.({
             field: entry.name,
@@ -4254,7 +4715,10 @@ async function resolveOneEntry({entry: entry, initialFields: initialFields, ctx:
         fields: entry.fields,
         of: entry.of,
         options: entry.options,
-        validation: entry.validation
+        validation: entry.validation,
+        roles: entry.roles,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.roleAliases
     });
     return entry.initialValue?.type === "input" && ctx.inputProvenance !== "definition" && assertRefsWithinSurface({
         entryType: entry.type,
@@ -4348,7 +4812,7 @@ function coerceToGdr(raw, workflowResource) {
     } : null;
 }
 
-const NonEmpty = NonEmptyString, UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
+const NonEmpty = NonEmptyString, PersistedAssignmentRolesSchema = v.pipe(v.array(NonEmptyString), v.minLength(1, "assignment roles must not be empty")), UnknownRecord = v.record(v.string(), v.unknown()), PersistedChoiceOptionsSchema = v.looseObject({
     list: v.array(v.looseObject({
         title: v.string(),
         value: v.union([ v.string(), v.number() ])
@@ -4363,6 +4827,7 @@ const NonEmpty = NonEmptyString, UnknownRecord = v.record(v.string(), v.unknown(
     description: v.optional(v.string()),
     options: v.optional(PersistedChoiceOptionsSchema),
     validation: v.optional(PersistedScalarValidationSchema),
+    roles: v.optional(PersistedAssignmentRolesSchema),
     fields: v.optional(v.array(PersistedFieldShapeSchema)),
     of: v.optional(v.array(PersistedFieldShapeSchema))
 }))), ExecutionContextSchema = tolerantObject()({
@@ -4408,7 +4873,13 @@ const OptionalRefTypes = v.exactOptional(v.array(v.string())), ResolvedFieldEntr
 })), v.looseObject(tolerantEntries()({
     ...fieldArm("subject", fieldValueSchemas.subject),
     types: OptionalRefTypes
-})), v.looseObject(tolerantEntries()(fieldArm("release.ref", fieldValueSchemas["release.ref"]))), v.looseObject(tolerantEntries()(fieldArm("string", fieldValueSchemas.string))), v.looseObject(tolerantEntries()(fieldArm("text", fieldValueSchemas.text))), v.looseObject(tolerantEntries()(fieldArm("number", fieldValueSchemas.number))), v.looseObject(tolerantEntries()(fieldArm("progress", fieldValueSchemas.progress))), v.looseObject(tolerantEntries()(fieldArm("boolean", fieldValueSchemas.boolean))), v.looseObject(tolerantEntries()(fieldArm("date", fieldValueSchemas.date))), v.looseObject(tolerantEntries()(fieldArm("dueDate", fieldValueSchemas.dueDate))), v.looseObject(tolerantEntries()(fieldArm("datetime", fieldValueSchemas.datetime))), v.looseObject(tolerantEntries()(fieldArm("dueDatetime", fieldValueSchemas.dueDatetime))), v.looseObject(tolerantEntries()(fieldArm("url", fieldValueSchemas.url))), v.looseObject(tolerantEntries()(fieldArm("actor", fieldValueSchemas.actor))), v.looseObject(tolerantEntries()(fieldArm("assignee", fieldValueSchemas.assignee))), v.looseObject(tolerantEntries()(fieldArm("assignees", fieldValueSchemas.assignees))), v.looseObject(tolerantEntries()({
+})), v.looseObject(tolerantEntries()(fieldArm("release.ref", fieldValueSchemas["release.ref"]))), v.looseObject(tolerantEntries()(fieldArm("string", fieldValueSchemas.string))), v.looseObject(tolerantEntries()(fieldArm("text", fieldValueSchemas.text))), v.looseObject(tolerantEntries()(fieldArm("number", fieldValueSchemas.number))), v.looseObject(tolerantEntries()(fieldArm("progress", fieldValueSchemas.progress))), v.looseObject(tolerantEntries()(fieldArm("boolean", fieldValueSchemas.boolean))), v.looseObject(tolerantEntries()(fieldArm("date", fieldValueSchemas.date))), v.looseObject(tolerantEntries()(fieldArm("dueDate", fieldValueSchemas.dueDate))), v.looseObject(tolerantEntries()(fieldArm("datetime", fieldValueSchemas.datetime))), v.looseObject(tolerantEntries()(fieldArm("dueDatetime", fieldValueSchemas.dueDatetime))), v.looseObject(tolerantEntries()(fieldArm("url", fieldValueSchemas.url))), v.looseObject(tolerantEntries()(fieldArm("actor", fieldValueSchemas.actor))), v.looseObject(tolerantEntries()({
+    ...fieldArm("assignee", fieldValueSchemas.assignee),
+    roles: v.exactOptional(PersistedAssignmentRolesSchema)
+})), v.looseObject(tolerantEntries()({
+    ...fieldArm("assignees", fieldValueSchemas.assignees),
+    roles: v.exactOptional(PersistedAssignmentRolesSchema)
+})), v.looseObject(tolerantEntries()({
     ...fieldArm("object", v.union([ v.null(), UnknownRecord ])),
     fields: v.array(PersistedFieldShapeSchema)
 })), v.looseObject(tolerantEntries()({
@@ -4659,6 +5130,37 @@ function parseInstanceDocument(doc) {
     });
 }
 
+const WorkflowInstancePreviewEffectSchema = tolerantObject()({
+    name: NonEmpty,
+    title: v.exactOptional(v.string())
+}), WorkflowInstancePreviewSchema = v.looseObject(tolerantEntries()({
+    _id: NonEmpty,
+    _type: v.literal(WORKFLOW_INSTANCE_TYPE),
+    modelVersion: v.exactOptional(v.number()),
+    minReaderModel: v.exactOptional(v.number()),
+    workflowResource: WorkflowResourceSchema,
+    definition: NonEmpty,
+    pinnedVersion: v.number(),
+    fields: v.array(ResolvedFieldEntrySchema),
+    ancestors: v.array(GdrShape),
+    perspective: v.exactOptional(WorkflowPerspectiveSchema),
+    currentStage: NonEmpty,
+    stages: v.array(StageEntrySchema),
+    claimedEffects: v.array(WorkflowInstancePreviewEffectSchema),
+    failedEffects: v.array(WorkflowInstancePreviewEffectSchema),
+    startedAt: IsoTimestamp,
+    completedAt: v.exactOptional(IsoTimestamp),
+    abortedAt: v.exactOptional(IsoTimestamp)
+}));
+
+function parseInstancePreviewDocument(doc) {
+    return parsePersistedDoc({
+        schema: WorkflowInstancePreviewSchema,
+        doc: doc,
+        docType: WORKFLOW_INSTANCE_TYPE
+    });
+}
+
 const SYNC_COMMIT = {
     visibility: "sync"
 }, ENGINE_API_VERSION = "2026-04-29", REQUEST_TAG = {
@@ -4694,7 +5196,9 @@ const SYNC_COMMIT = {
     effect: "workflow.effect",
     verifyDefinitions: "workflow.verify-definitions",
     accessResolveActor: "workflow.access.resolve-actor",
-    accessGrants: "workflow.access.grants"
+    accessGrants: "workflow.access.grants",
+    accessResolveOrg: "workflow.access.resolve-org",
+    accessAttributes: "workflow.access.attributes"
 }, RAW_PATCH = /* @__PURE__ */ Symbol("workflow-engine.raw-patch");
 
 function unwrapPatch(patch) {
@@ -5104,6 +5608,40 @@ function readInstanceDoc(doc) {
     return parseInstanceDocument(assertReadableModel(doc));
 }
 
+function readInstancePreviewDoc(doc) {
+    return hasDocumentId(doc) ? parseInstancePreviewDocument(withoutProjectedNulls(assertReadableModel(doc))) : parseInstancePreviewDocument(doc);
+}
+
+function hasDocumentId(doc) {
+    return typeof doc == "object" && doc !== null && typeof doc._id == "string";
+}
+
+function withoutProjectedNulls(doc) {
+    const row = withoutNullMembers(doc);
+    if (typeof row != "object" || row === null) return row;
+    const out = {
+        ...row
+    };
+    return Array.isArray(out.stages) && (out.stages = out.stages.map(withoutStageEntryNulls)), 
+    Array.isArray(out.claimedEffects) && (out.claimedEffects = out.claimedEffects.map(withoutNullMembers)), 
+    Array.isArray(out.failedEffects) && (out.failedEffects = out.failedEffects.map(withoutNullMembers)), 
+    out;
+}
+
+function withoutStageEntryNulls(entry) {
+    const stage = withoutNullMembers(entry);
+    if (typeof stage != "object" || stage === null) return stage;
+    const out = {
+        ...stage
+    };
+    return Array.isArray(out.activities) && (out.activities = out.activities.map(withoutNullMembers)), 
+    out;
+}
+
+function withoutNullMembers(value) {
+    return value === null || typeof value != "object" || Array.isArray(value) ? value : Object.fromEntries(Object.entries(value).filter(([, member]) => member !== null));
+}
+
 async function reload({client: client, instanceId: instanceId, tag: tag}) {
     const doc = await getInstanceDocument(client, instanceId);
     if (!doc) throw new InstanceNotFoundError({
@@ -5350,7 +5888,8 @@ function loadCallContext({client: client, instanceId: instanceId, options: optio
             } : {},
             ...options.telemetry ? {
                 telemetry: options.telemetry
-            } : {}
+            } : {},
+            memberRolesLoader: options.memberRolesLoader
         }
     });
 }
@@ -5395,6 +5934,7 @@ async function loadContext({client: client, instanceId: instanceId, options: opt
         ...options.telemetry !== void 0 ? {
             telemetry: options.telemetry
         } : {},
+        memberRolesLoader: options.memberRolesLoader,
         ...options.overlay !== void 0 ? {
             overlay: options.overlay
         } : {},
@@ -5430,7 +5970,10 @@ async function ctxEvaluateCondition({ctx: ctx, condition: condition, opts: opts}
 }
 
 async function buildEngineContext(args) {
-    const {client: client, clientForGdr: clientForGdr, refSurface: refSurface, instance: instance, definition: definition} = args, clock = args.clock ?? wallClock;
+    const {client: client, clientForGdr: clientForGdr, refSurface: refSurface, instance: instance, definition: definition} = args, clock = args.clock ?? wallClock, memberRolesLoader = args.memberRolesLoader, memberRoles = await memberRolesLoader({
+        workflowResource: instance.workflowResource,
+        definition: definition
+    });
     return {
         client: client,
         clientForGdr: clientForGdr,
@@ -5447,6 +5990,10 @@ async function buildEngineContext(args) {
         } : {},
         instance: instance,
         definition: definition,
+        memberRolesLoader: memberRolesLoader,
+        ...memberRoles !== void 0 ? {
+            memberRoles: memberRoles
+        } : {},
         snapshot: await hydrateSnapshot({
             client: client,
             clientForGdr: clientForGdr,
@@ -5458,25 +6005,83 @@ async function buildEngineContext(args) {
     };
 }
 
-function findStage(definition, stageName) {
-    const stage = definition.stages.find(s => s.name === stageName);
-    if (stage === void 0) throw new Error(`Stage "${stageName}" not found in definition ${definition.name}`);
-    return stage;
+function createAssignmentMemberRolesLoader(client) {
+    const byProjectId = /* @__PURE__ */ new Map;
+    return async ({workflowResource: workflowResource, definition: definition}) => {
+        if (!hasRoleConstrainedAssignments(definition)) return;
+        assertRoleConstrainedAssignmentResource({
+            context: "workflow",
+            definition: definition,
+            workflowResource: workflowResource
+        });
+        const projectId = datasetResourceParts(workflowResource.id).projectId;
+        let pending = byProjectId.get(projectId);
+        return pending === void 0 && (pending = client.request === void 0 ? Promise.reject(new Error(`Definition "${definition.name}" has role-constrained assignments, which require project-directory access for project "${projectId}"; the client cannot issue requests`)) : loadProjectMemberRoles({
+            request: client.request,
+            projectId: projectId
+        }), byProjectId.set(projectId, pending)), pending;
+    };
 }
 
-async function resolveStageFieldEntries(args) {
-    const {client: client, instance: instance, stage: stage, now: now, refSurface: refSurface, initialFields: initialFields, recordDiscard: recordDiscard} = args;
-    return resolveDeclaredFields({
-        entryDefs: stage.fields,
-        initialFields: initialFields ?? [],
-        ctx: {
-            client: client,
-            now: now,
-            refSurface: refSurface,
+async function loadProjectMemberRoles(args) {
+    const {request: request, projectId: projectId} = args, snapshot = await requestProjectMemberDirectory({
+        request: request,
+        projectId: projectId
+    }), rolesByProjectId = projectMemberRoles({
+        members: snapshot.members,
+        projectId: projectId
+    });
+    return globalizeMemberRoles({
+        snapshot: snapshot,
+        rolesByProjectId: rolesByProjectId
+    });
+}
+
+function globalizeMemberRoles(args) {
+    const {snapshot: snapshot, rolesByProjectId: rolesByProjectId} = args, humanIds = [ ...rolesByProjectId.keys() ].filter(id => classifyPrincipalId(id).namespace === "project");
+    for (const {globalId: globalId, memberId: memberId} of snapshot.globalUsers) {
+        const roles = rolesByProjectId.get(memberId);
+        roles !== void 0 && rolesByProjectId.set(globalId, roles);
+    }
+    for (const id of humanIds) rolesByProjectId.delete(id);
+    return Object.fromEntries(rolesByProjectId);
+}
+
+function projectMemberRoles(args) {
+    const result = /* @__PURE__ */ new Map;
+    for (const member of args.members) {
+        const {id: id, roles: roles} = member;
+        if (!Array.isArray(roles) || !roles.every(isProjectMemberRole)) throw new Error(`Project member role directory response is invalid for project "${args.projectId}" and member "${id}"`);
+        result.set(id, roles.map(role => role.name));
+    }
+    return result;
+}
+
+function isProjectMemberRole(role) {
+    return isRecord(role) && typeof role.name == "string";
+}
+
+function findStage(definition, stageName) {
+    const stage = definition.stages.find(s => s.name === stageName);
+    if (stage === void 0) throw new Error(`Stage "${stageName}" not found in definition ${definition.name}`);
+    return stage;
+}
+
+async function resolveStageFieldEntries(args) {
+    const {client: client, instance: instance, stage: stage, now: now, refSurface: refSurface, initialFields: initialFields, recordDiscard: recordDiscard} = args;
+    return resolveDeclaredFields({
+        entryDefs: stage.fields,
+        initialFields: initialFields ?? [],
+        ctx: {
+            client: client,
+            now: now,
+            refSurface: refSurface,
             selfId: instance._id,
             tag: instance.tag,
             stageName: stage.name,
             workflowResource: instance.workflowResource,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases,
             workflowFields: instance.fields ?? [],
             ...instance.perspective !== void 0 ? {
                 perspective: instance.perspective
@@ -5503,6 +6108,8 @@ async function resolveActivityFieldEntries(args) {
             stageName: stage.name,
             workflowResource: instance.workflowResource,
             activityName: activity.name,
+            memberRoles: args.memberRoles,
+            roleAliases: args.roleAliases,
             workflowFields: instance.fields ?? [],
             ...instance.perspective !== void 0 ? {
                 perspective: instance.perspective
@@ -5658,171 +6265,6 @@ function resolveMetadata(metadata, ctx) {
     return out;
 }
 
-function userLoginProvider(user) {
-    return user?.provider ?? user?.loginProvider;
-}
-
-function isRecord(value) {
-    return typeof value == "object" && value !== null && !Array.isArray(value);
-}
-
-function optionalString(value) {
-    return value === void 0 || typeof value == "string";
-}
-
-function isClientProjectUser(value) {
-    return isRecord(value) && typeof value.id == "string" && optionalString(value.sanityUserId) && optionalString(value.displayName) && optionalString(value.email) && (value.imageUrl === null || optionalString(value.imageUrl)) && optionalString(value.provider) && optionalString(value.loginProvider);
-}
-
-function objectProperty(value, property) {
-    if (!isRecord(value)) return;
-    const propertyValue = value[property];
-    return typeof propertyValue == "object" && propertyValue !== null ? propertyValue : void 0;
-}
-
-function stringProperty(value, property) {
-    const propertyValue = Reflect.get(value, property);
-    return typeof propertyValue == "string" ? propertyValue : void 0;
-}
-
-function apiErrorType(error) {
-    const response = objectProperty(error, "response"), body = objectProperty(response, "body");
-    if (!body) return;
-    const nestedError = objectProperty(body, "error");
-    return (nestedError ? stringProperty(nestedError, "type") : void 0) ?? stringProperty(body, "type");
-}
-
-function isProjectUserNotFoundError(error) {
-    return apiErrorType(error) === "projectUserNotFoundError";
-}
-
-const memberJoinCache = /* @__PURE__ */ new WeakMap;
-
-function joinCacheFor(client) {
-    let cache = memberJoinCache.get(client);
-    return cache === void 0 && (cache = /* @__PURE__ */ new Map, memberJoinCache.set(client, cache)), 
-    cache;
-}
-
-async function projectMemberIds(request, projectId) {
-    const project = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}`
-    }), members = isRecord(project) ? project.members : void 0;
-    return Array.isArray(members) ? members.map(member => isRecord(member) ? member.id : void 0).filter(id => typeof id == "string") : [];
-}
-
-async function resolveGlobalProjectUser(args) {
-    const {client: client, request: request, projectId: projectId, id: id} = args, cache = joinCacheFor(client), key = `${projectId}:${id}`, hit = cache.get(key);
-    if (hit !== void 0) return hit === null ? {
-        status: "missing"
-    } : {
-        status: "resolved",
-        user: hit
-    };
-    try {
-        await ingestMemberJoin({
-            request: request,
-            projectId: projectId,
-            cache: cache
-        });
-        const found = cache.get(key);
-        return found != null ? {
-            status: "resolved",
-            user: found
-        } : (cache.set(key, null), {
-            status: "missing"
-        });
-    } catch (cause) {
-        return {
-            status: "inaccessible",
-            cause: cause
-        };
-    }
-}
-
-async function ingestMemberJoin(args) {
-    const {request: request, projectId: projectId, cache: cache} = args, memberIds = await projectMemberIds(request, projectId);
-    if (memberIds.length === 0) return;
-    const requested = new Set(memberIds), response = await request({
-        uri: `/projects/${encodeURIComponent(projectId)}/users/${memberIds.map(encodeURIComponent).join(",")}`
-    });
-    for (const row of Array.isArray(response) ? response : [ response ]) {
-        if (!isClientProjectUser(row) || !requested.has(row.id)) continue;
-        const globalId = directoryBridgeId(row.sanityUserId);
-        globalId !== void 0 && cache.set(`${projectId}:${globalId}`, row);
-    }
-}
-
-function clientProjectUserDirectory(client, projectId) {
-    return {
-        findById: async id => {
-            if (!client.request) return {
-                status: "inaccessible",
-                cause: new Error("Project-user resolution requires WorkflowClient.request")
-            };
-            if (classifyPrincipalId(id).namespace === "global") return resolveGlobalProjectUser({
-                client: client,
-                request: client.request,
-                projectId: projectId,
-                id: id
-            });
-            try {
-                const response = await client.request({
-                    uri: `/projects/${encodeURIComponent(projectId)}/users/${encodeURIComponent(id)}`
-                }), candidate = Array.isArray(response) ? response[0] : response;
-                return candidate == null ? {
-                    status: "missing"
-                } : isClientProjectUser(candidate) ? candidate.id !== id ? {
-                    status: "inaccessible",
-                    cause: new Error(`Project-user response answered id "${candidate.id}", not the requested "${id}"`)
-                } : {
-                    status: "resolved",
-                    user: candidate
-                } : {
-                    status: "inaccessible",
-                    cause: new Error("Project-user response had an invalid shape")
-                };
-            } catch (cause) {
-                return isProjectUserNotFoundError(cause) ? {
-                    status: "missing"
-                } : {
-                    status: "inaccessible",
-                    cause: cause
-                };
-            }
-        }
-    };
-}
-
-function resolveClientActor(client, args) {
-    return resolveActor(clientProjectUserDirectory(client, args.projectId), args.actor);
-}
-
-async function resolveActor(directory, actor) {
-    if (actor.kind !== "person") return {
-        status: "not-person",
-        actor: actor
-    };
-    const personActor = {
-        ...actor,
-        kind: "person"
-    }, lookup = await directory.findById(personActor.id);
-    return lookup.status === "resolved" ? {
-        status: "resolved",
-        actor: personActor,
-        user: lookup.user
-    } : lookup.status === "inaccessible" ? {
-        status: "inaccessible",
-        actor: personActor,
-        ...lookup.cause === void 0 ? {} : {
-            cause: lookup.cause
-        }
-    } : {
-        status: "missing",
-        actor: personActor
-    };
-}
-
 const IDENTITY_KINDS = /* @__PURE__ */ new Set([ "actor", "assignee", "assignees" ]);
 
 async function localizeGuardMetadata(args) {
@@ -6468,6 +6910,8 @@ async function buildActivityEntry({ctx: ctx, stage: stage, activity: activity, r
         activity: activity,
         now: ctx.now,
         refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases,
         ...recordDiscard !== void 0 ? {
             recordDiscard: recordDiscard
         } : {}
@@ -6670,7 +7114,8 @@ async function spawnRow({ctx: ctx, mutation: mutation, activity: activity, actio
         context: context,
         actor: actor,
         now: now,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRolesLoader: ctx.memberRolesLoader
     });
     mutation.pendingCreates.push({
         body: body,
@@ -6892,13 +7337,16 @@ async function resolveDefinitionRef({client: client, ref: ref, tag: tag}) {
 }
 
 async function prepareChildInstance(args) {
-    const {client: client, parent: parent, definition: definition, initialFields: initialFields, context: context, actor: actor, now: now, refSurface: refSurface} = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = {
+    const {client: client, parent: parent, definition: definition, initialFields: initialFields, context: context, actor: actor, now: now, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = args, childTag = parent.tag, workflowResource = parent.workflowResource, childDocId = instanceDocId(childTag), childRef = {
         id: gdrFromResource(workflowResource, childDocId),
         type: WORKFLOW_INSTANCE_TYPE
     }, ancestors = [ ...parent.ancestors, {
         id: selfGdr(parent),
         type: WORKFLOW_INSTANCE_TYPE
-    } ], inheritedPerspective = parent.perspective, fieldDiscards = [], childFields = await resolveDeclaredFields({
+    } ], inheritedPerspective = parent.perspective, fieldDiscards = [], memberRoles = await memberRolesLoader({
+        workflowResource: workflowResource,
+        definition: definition
+    }), childFields = await resolveDeclaredFields({
         entryDefs: definition.fields,
         initialFields: initialFields,
         ctx: {
@@ -6909,6 +7357,8 @@ async function prepareChildInstance(args) {
             workflowResource: workflowResource,
             definitionName: definition.name,
             refSurface: refSurface,
+            memberRoles: memberRoles,
+            roleAliases: definition.roleAliases,
             inputProvenance: "definition",
             ...inheritedPerspective !== void 0 ? {
                 perspective: inheritedPerspective
@@ -6979,6 +7429,8 @@ async function enterStage({ctx: ctx, mutation: mutation, nextStage: nextStage, a
             stage: nextStage,
             now: at,
             refSurface: ctx.refSurface,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.definition.roleAliases,
             recordDiscard: recordFieldDiscards({
                 target: mutation.history,
                 scope: "stage",
@@ -7159,47 +7611,454 @@ async function grantsPermissionOn(args) {
     return !1;
 }
 
-function aclPathForResource(res) {
-    if (res.type === "dataset") {
-        const {projectId: projectId, dataset: dataset} = datasetResourceParts(res.id);
-        return `/projects/${projectId}/datasets/${dataset}/acl`;
+function aclPathForResource(res) {
+    if (res.type === "dataset") {
+        const {projectId: projectId, dataset: dataset} = datasetResourceParts(res.id);
+        return `/projects/${projectId}/datasets/${dataset}/acl`;
+    }
+    if (res.type === "canvas") return `/canvases/${res.id}/acl`;
+}
+
+async function fetchGrants(args) {
+    const {client: client, resourcePath: resourcePath, signal: signal} = args;
+    return client.request({
+        url: resourcePath,
+        tag: REQUEST_TAG.accessGrants,
+        ...signal ? {
+            signal: signal
+        } : {}
+    });
+}
+
+async function advisoryCanForCall(args) {
+    const actor = args.options?.actor;
+    if (!(args.options?.grants === void 0 || actor === void 0)) return advisoryCan({
+        instance: args.instance,
+        identity: lakePrincipalId({
+            actor: actor,
+            localPrincipalId: args.options.localPrincipalId
+        }),
+        grants: args.options.grants
+    });
+}
+
+async function advisoryCan({instance: instance, identity: identity, grants: grants}) {
+    if (grants === void 0) return;
+    const can = {};
+    for (const permission of DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
+        document: instance,
+        grants: grants,
+        permission: permission,
+        userId: identity
+    });
+    return can;
+}
+
+const DANGEROUS_ATTRIBUTE_KEYS = /* @__PURE__ */ new Set([ "__proto__", "constructor", "prototype" ]);
+
+function attributeEntry(row) {
+    if (!(!isRecord(row) || typeof row.key != "string" || row.key.length === 0) && !DANGEROUS_ATTRIBUTE_KEYS.has(row.key) && !(!("activeValue" in row) || row.activeValue === void 0)) return [ row.key, row.activeValue ];
+}
+
+function normalizeUserAttributes(response) {
+    if (!isRecord(response)) return;
+    const rows = response.attributes;
+    if (!Array.isArray(rows)) return;
+    const out = {};
+    for (const row of rows) {
+        const entry = attributeEntry(row);
+        entry !== void 0 && (out[entry[0]] = entry[1]);
+    }
+    return out;
+}
+
+const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap, orgIdCache = /* @__PURE__ */ new WeakMap, attributesCache = /* @__PURE__ */ new WeakMap;
+
+async function resolveAccess(taggedClient, args = {}) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
+    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: args.grantsFromPath
+    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
+    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
+    return {
+        actor: identity.actor,
+        ...identity.localPrincipalId !== void 0 ? {
+            localPrincipalId: identity.localPrincipalId
+        } : {},
+        ...grants !== void 0 ? {
+            grants: grants
+        } : {}
+    };
+}
+
+async function resolveUserAttributes(taggedClient) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    if (requestFn !== void 0) return cachedAttributes({
+        client: client,
+        requestFn: requestFn
+    });
+}
+
+function cachedActor(client, requestFn) {
+    const cached = actorCache.get(client);
+    if (cached !== void 0) return cached;
+    const pending = fetchActor(client, requestFn).catch(err => {
+        throw actorCache.get(client) === pending && actorCache.delete(client), err;
+    });
+    return actorCache.set(client, pending), pending;
+}
+
+function grantsForClientPath(taggedClient, resourcePath) {
+    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
+    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
+        client: client,
+        requestFn: requestFn,
+        resourcePath: resourcePath
+    });
+}
+
+function lazyRequest(client) {
+    return client.request === void 0 ? void 0 : opts => client.request(opts);
+}
+
+function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
+    return cachedByKey({
+        store: grantsCache,
+        client: client,
+        key: resourcePath,
+        load: () => fetchGrantsCached(requestFn, resourcePath)
+    });
+}
+
+function cachedByKey(args) {
+    let byKey = args.store.get(args.client);
+    byKey === void 0 && (byKey = /* @__PURE__ */ new Map, args.store.set(args.client, byKey));
+    const cached = byKey.get(args.key);
+    if (cached !== void 0) return cached;
+    const pending = args.evictOnRejection ? args.load().catch(err => {
+        throw byKey.get(args.key) === pending && byKey.delete(args.key), err;
+    }) : args.load();
+    return byKey.set(args.key, pending), pending;
+}
+
+async function fetchActor(client, requestFn) {
+    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
+    if (sessionId === void 0) return;
+    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
+        client: client,
+        sessionId: sessionId,
+        resourceId: resourceId
+    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
+    refuseProjectScopedActor({
+        id: id,
+        globalUser: globalUser,
+        globalHostId: globalHostId,
+        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
+    });
+    const roleNames = roleNamesFor(resourceUser, globalUser);
+    return {
+        actor: {
+            kind: "person",
+            id: id,
+            ...roleNames.length > 0 ? {
+                roles: roleNames
+            } : {}
+        },
+        ...resourceId !== void 0 && resourceId !== id ? {
+            localPrincipalId: resourceId
+        } : {}
+    };
+}
+
+function roleNamesFor(resourceUser, globalUser) {
+    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
+}
+
+const NO_BRIDGE = {
+    status: "not-applicable"
+};
+
+function globalRouteReason(globalUser, globalHostId) {
+    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
+}
+
+async function bridgeProjectPrincipal(args) {
+    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
+    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
+        status: "unavailable",
+        reason: "no project-scoped principal from the resource host to address the directory with"
+    } : directoryGlobalId({
+        client: client,
+        principalId: resourceId
+    });
+}
+
+async function directoryGlobalId(args) {
+    const {client: client, principalId: principalId} = args, projectId = projectIdOf(client);
+    if (projectId === void 0) return {
+        status: "unavailable",
+        reason: "the client reports no projectId, so its user directory has no address"
+    };
+    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
+    if (lookup.status !== "resolved") return {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
+        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
+            cause: lookup.cause
+        } : {}
+    };
+    const globalId = directoryBridgeId(lookup.user.sanityUserId);
+    return globalId === void 0 ? {
+        status: "unavailable",
+        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
+    } : {
+        status: "resolved",
+        globalId: globalId
+    };
+}
+
+function refuseProjectScopedActor(args) {
+    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
+    if (classifyPrincipalId(id).namespace !== "project") return;
+    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
+    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
+    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
+    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
+        cause: cause
+    });
+}
+
+function usableId(user) {
+    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
+}
+
+async function fetchCurrentUser(requestFn, hostDescription) {
+    try {
+        return await requestFn({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        });
+    } catch (err) {
+        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
+            cause: err
+        });
+    }
+}
+
+async function fetchGlobalUser(client) {
+    const sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) return {
+        user: void 0,
+        reason: sibling.reason,
+        ...sibling.cause !== void 0 ? {
+            cause: sibling.cause
+        } : {}
+    };
+    try {
+        const user = await sibling.request({
+            uri: "/users/me",
+            tag: REQUEST_TAG.accessResolveActor
+        }), id = usableId(user);
+        return sibling.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
+            user: void 0,
+            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
+        } : {
+            user: user
+        };
+    } catch (err) {
+        return {
+            user: void 0,
+            reason: `global-host /users/me failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function globalHostRequestOf(client) {
+    if (typeof client.withConfig != "function") return {
+        reason: "the client cannot reach the global API host (no withConfig)"
+    };
+    const hostResolution = resolveGlobalApiHost(client);
+    try {
+        const globalClient = client.withConfig({
+            useProjectHostname: !1,
+            apiVersion: ENGINE_API_VERSION,
+            ...hostResolution.apiHost === void 0 ? {} : {
+                apiHost: hostResolution.apiHost
+            }
+        }), request = lazyRequest(globalClient);
+        return request === void 0 ? {
+            reason: "the global-host sibling client cannot issue requests"
+        } : {
+            request: request,
+            requireGlobalPrincipal: hostResolution.requireGlobalPrincipal
+        };
+    } catch (err) {
+        return {
+            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
+            cause: err
+        };
+    }
+}
+
+function resolveGlobalApiHost(client) {
+    if (typeof client.config != "function") return {
+        requireGlobalPrincipal: !1
+    };
+    const apiHost = client.config().apiHost;
+    if (apiHost === void 0) return {
+        requireGlobalPrincipal: !1
+    };
+    let parsed;
+    try {
+        parsed = new URL(apiHost);
+    } catch {
+        return {
+            requireGlobalPrincipal: !0
+        };
+    }
+    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
+        requireGlobalPrincipal: !1
+    };
+    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
+    return match === null ? {
+        requireGlobalPrincipal: !0
+    } : (parsed.hostname = `api.sanity.${match[1]}`, {
+        apiHost: parsed.origin,
+        requireGlobalPrincipal: !0
+    });
+}
+
+async function fetchGrantsCached(requestFn, resourcePath) {
+    try {
+        return await fetchGrants({
+            client: {
+                request: requestFn
+            },
+            resourcePath: resourcePath
+        });
+    } catch (err) {
+        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
+        return;
+    }
+}
+
+function projectIdOf(client) {
+    if (typeof client.config != "function") return;
+    const projectId = client.config().projectId;
+    return typeof projectId == "string" && projectId.length > 0 ? projectId : void 0;
+}
+
+function cachedAttributes(args) {
+    const projectId = projectIdOf(args.client);
+    return projectId === void 0 ? Promise.resolve(void 0) : resolveOrganizationId({
+        client: args.client,
+        requestFn: args.requestFn,
+        projectId: projectId
+    }).then(orgId => {
+        if (orgId !== void 0) return cachedByKey({
+            store: attributesCache,
+            client: args.client,
+            key: orgId,
+            evictOnRejection: !0,
+            load: () => fetchAttributesCached({
+                client: args.client,
+                orgId: orgId
+            })
+        });
+    });
+}
+
+async function resolveOrganizationId(args) {
+    const {client: client, requestFn: requestFn, projectId: projectId} = args;
+    return cachedByKey({
+        store: orgIdCache,
+        client: client,
+        key: projectId,
+        evictOnRejection: !0,
+        load: async () => {
+            try {
+                const project = await requestFn({
+                    uri: `/projects/${encodeURIComponent(projectId)}`,
+                    tag: REQUEST_TAG.accessResolveOrg
+                });
+                if (!isRecord(project)) return;
+                const orgId = project.organizationId;
+                return typeof orgId == "string" && orgId.length > 0 ? orgId : void 0;
+            } catch (err) {
+                const status = httpStatusOf(err);
+                if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+                throw new Error(`workflow: failed to resolve organizationId for project "${projectId}"; advisory $attributes cannot be bound. Original error: ${errorMessage(err)}`, {
+                    cause: err
+                });
+            }
+        }
+    });
+}
+
+const ATTRIBUTES_FETCH_LIMIT = 100, EXPECTED_ATTRIBUTES_ABSENCE = /* @__PURE__ */ new Set([ 401, 402, 403, 404 ]);
+
+function httpStatusOf(err) {
+    if (!isRecord(err)) return;
+    const status = err.statusCode;
+    return typeof status == "number" ? status : void 0;
+}
+
+async function fetchAttributesCached(args) {
+    const {client: client, orgId: orgId} = args, sibling = globalHostRequestOf(client);
+    if ("reason" in sibling) {
+        console.warn(`workflow: skipped org attributes fetch (${sibling.reason}); advisory $attributes stays undefined (conditions referencing it fail closed).`);
+        return;
+    }
+    try {
+        const response = await sibling.request({
+            uri: `/organizations/${encodeURIComponent(orgId)}/users/me/attributes?limit=${ATTRIBUTES_FETCH_LIMIT}`,
+            tag: REQUEST_TAG.accessAttributes
+        }), envelope = isRecord(response) ? response : void 0;
+        if (envelope?.hasMore === !0) {
+            const page = Array.isArray(envelope.attributes) ? envelope.attributes : [];
+            console.warn(`workflow: org attributes for organization "${orgId}" report hasMore=true (bound ${page.length} of the requested limit ${ATTRIBUTES_FETCH_LIMIT}); advisory $attributes may be incomplete — the engine fetches no further pages. Conditions that read missing keys fail closed.`);
+        }
+        const normalized = normalizeUserAttributes(response);
+        return normalized === void 0 && console.warn(`workflow: org attributes response for organization "${orgId}" was unusable; advisory $attributes stays undefined (conditions referencing it fail closed).`), 
+        normalized;
+    } catch (err) {
+        const status = httpStatusOf(err);
+        if (status !== void 0 && EXPECTED_ATTRIBUTES_ABSENCE.has(status)) return;
+        throw new Error(`workflow: failed to fetch org attributes for organization "${orgId}". Original error: ${errorMessage(err)}`, {
+            cause: err
+        });
     }
-    if (res.type === "canvas") return `/canvases/${res.id}/acl`;
 }
 
-async function fetchGrants(args) {
-    const {client: client, resourcePath: resourcePath, signal: signal} = args;
-    return client.request({
-        url: resourcePath,
-        tag: REQUEST_TAG.accessGrants,
-        ...signal ? {
-            signal: signal
+function callerBoundVars(args) {
+    const vars = {
+        ...args.can !== void 0 ? {
+            can: args.can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
         } : {}
-    });
+    };
+    return Object.keys(vars).length > 0 ? vars : void 0;
 }
 
-async function advisoryCanForCall(args) {
-    const actor = args.options?.actor;
-    if (!(args.options?.grants === void 0 || actor === void 0)) return advisoryCan({
+async function callerBoundVarsForCall(args) {
+    const can = await advisoryCanForCall({
         instance: args.instance,
-        identity: lakePrincipalId({
-            actor: actor,
-            localPrincipalId: args.options.localPrincipalId
-        }),
-        grants: args.options.grants
-    });
-}
-
-async function advisoryCan({instance: instance, identity: identity, grants: grants}) {
-    if (grants === void 0) return;
-    const can = {};
-    for (const permission of DOCUMENT_VALUE_PERMISSIONS) can[permission] = await grantsPermissionOn({
-        document: instance,
-        grants: grants,
-        permission: permission,
-        userId: identity
+        options: args.options
+    }), attributes = args.options?.attributes !== void 0 ? args.options.attributes : await resolveUserAttributes(args.client);
+    return callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
+        } : {}
     });
-    return can;
 }
 
 function requirementDescriptor(requirement) {
@@ -7322,7 +8181,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
         }
     });
     if (action.filter !== void 0) {
-        const can = await advisoryCanForCall({
+        const vars = await callerBoundVarsForCall({
+            client: ctx.client,
             instance: ctx.instance,
             options: options
         });
@@ -7334,10 +8194,8 @@ async function resolveActionCommit({ctx: ctx, activityName: activityName, action
                 ...actor !== void 0 ? {
                     actor: actor
                 } : {},
-                ...can !== void 0 ? {
-                    vars: {
-                        can: can
-                    }
+                ...vars !== void 0 ? {
+                    vars: vars
                 } : {}
             }
         })) throw new ActionDisabledError({
@@ -7410,7 +8268,9 @@ async function applyActionFire({ctx: ctx, mutation: mutation, activity: activity
         self: selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     });
     if (await queueEffects({
         ctx: ctx,
@@ -7593,6 +8453,8 @@ async function primeInitialStage(args) {
             stage: stage,
             now: now,
             refSurface: refSurface,
+            memberRoles: ctx.memberRoles,
+            roleAliases: ctx.definition.roleAliases,
             recordDiscard: recordFieldDiscards({
                 target: discards,
                 scope: "stage",
@@ -7652,7 +8514,7 @@ async function primeInitialStage(args) {
 
 const CASCADE_LIMIT = 100;
 
-async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts, instance: instance}) {
+async function runCascadeHop({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts, instance: instance}) {
     const contextOptions = {
         clientForGdr: clientForGdr,
         refSurface: refSurface,
@@ -7673,7 +8535,8 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
         } : {},
         ...settlingCohorts ? {
             settlingCohorts: settlingCohorts
-        } : {}
+        } : {},
+        memberRolesLoader: memberRolesLoader
     }, ctx = instance === void 0 ? await loadContext({
         client: client,
         instanceId: instanceId,
@@ -7712,7 +8575,7 @@ async function runCascadeHop({client: client, instanceId: instanceId, actor: act
     });
 }
 
-async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
+async function cascadeAutoTransitions({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay, settlingCohorts: settlingCohorts}) {
     let count = 0;
     for (;;) {
         const drained = await drainCondemnedChildren({
@@ -7721,6 +8584,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
@@ -7731,6 +8595,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry,
@@ -7747,7 +8612,7 @@ async function cascadeAutoTransitions({client: client, instanceId: instanceId, a
     }
 }
 
-async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set, instance: preloadedInstance}) {
+async function drainCondemnedChildren({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining = /* @__PURE__ */ new Set, instance: preloadedInstance}) {
     if (draining.has(instanceId)) return {
         instance: preloadedInstance,
         drained: !1
@@ -7770,6 +8635,7 @@ async function drainCondemnedChildren({client: client, instanceId: instanceId, a
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         executionContext: executionContext,
         telemetry: telemetry,
@@ -7787,7 +8653,7 @@ async function drainCondemnedChildren({client: client, instanceId: instanceId, a
     };
 }
 
-async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
+async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, draining: draining}) {
     const childId = toBareId(row.ref.id);
     try {
         const result = await abortInstance({
@@ -7800,6 +8666,7 @@ async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, a
                 } : {},
                 clientForGdr: clientForGdr,
                 refSurface: refSurface,
+                memberRolesLoader: memberRolesLoader,
                 ...clock ? {
                     clock: clock
                 } : {},
@@ -7817,6 +8684,7 @@ async function settleCondemnedRow({client: client, ownerId: ownerId, row: row, a
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry,
@@ -7967,7 +8835,8 @@ async function buildCascadeStepContext(args, instance) {
         } : {},
         ...args.settlingCohorts ? {
             settlingCohorts: args.settlingCohorts
-        } : {}
+        } : {},
+        memberRolesLoader: args.memberRolesLoader
     });
 }
 
@@ -8195,6 +9064,7 @@ function spawnStepArgs(ctx, args) {
         actor: args.actor,
         clientForGdr: ctx.clientForGdr,
         refSurface: ctx.refSurface,
+        memberRolesLoader: ctx.memberRolesLoader,
         clock: ctx.clock,
         executionContext: ctx.executionContext,
         telemetry: ctx.telemetry,
@@ -8336,7 +9206,11 @@ function validateEffectOutputs(args) {
             issues.push(`"${key}" is not a declared output`);
             continue;
         }
-        const check = effectOutputCheck(shape, value);
+        const check = effectOutputCheck({
+            shape: shape,
+            value: value,
+            eligibility: args
+        });
         "issues" in check ? issues.push(...check.issues.map(i => `"${key}": ${i}`)) : normalized[key] = check.output;
     }
     if (issues.length > 0) throw new EffectOutputsInvalidError({
@@ -8346,7 +9220,8 @@ function validateEffectOutputs(args) {
     return normalized;
 }
 
-function effectOutputCheck(shape, value) {
+function effectOutputCheck(args) {
+    const {shape: shape, value: value, eligibility: eligibility} = args;
     return parseFieldValue({
         entryType: shape.type,
         value: value,
@@ -8361,7 +9236,12 @@ function effectOutputCheck(shape, value) {
         } : {},
         ...shape.validation !== void 0 ? {
             validation: shape.validation
-        } : {}
+        } : {},
+        ...shape.roles !== void 0 ? {
+            roles: shape.roles
+        } : {},
+        memberRoles: eligibility.memberRoles,
+        roleAliases: eligibility.roleAliases
     });
 }
 
@@ -8384,7 +9264,7 @@ function requirePendingEffect(instance, effectKey) {
     });
 }
 
-function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs}) {
+function validateCompletionInput({pending: pending, definition: definition, status: status, ops: ops, outputs: outputs, memberRoles: memberRoles, roleAliases: roleAliases}) {
     if (status === "failed" && ops !== void 0 && ops.length > 0) throw new EffectOpsInvalidError({
         effect: pending.name,
         issues: [ "ops cannot accompany a failed completion — field.set the outcome on a done completion instead" ]
@@ -8396,7 +9276,9 @@ function validateCompletionInput({pending: pending, definition: definition, stat
     const normalizedOutputs = outputs !== void 0 ? validateEffectOutputs({
         outputs: outputs,
         declared: findEffect(definition, pending.name)?.outputs ?? [],
-        effectName: pending.name
+        effectName: pending.name,
+        memberRoles: memberRoles,
+        roleAliases: roleAliases
     }) : void 0;
     return {
         ops: ops !== void 0 ? validateEffectOps(ops, pending.name) : [],
@@ -8415,7 +9297,9 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         definition: ctx.definition,
         status: status,
         ops: ops,
-        outputs: outputs
+        outputs: outputs,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), mutation = startMutation(ctx.instance);
     recordProcessedRequest({
         mutation: mutation,
@@ -8446,7 +9330,9 @@ async function commitCompleteEffect({ctx: ctx, effectKey: effectKey, status: sta
         self: selfGdr(ctx.instance),
         now: ranAt,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), needsGuardRefresh = wroteEffectOutputs || ranOps.some(isFieldOp);
     return await persistThenMaybeRefresh({
         ctx: ctx,
@@ -8615,7 +9501,9 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         self: selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     }), await persistThenMaybeRefresh({
         ctx: ctx,
         mutation: mutation,
@@ -8623,309 +9511,66 @@ async function commitReport({ctx: ctx, effectKey: effectKey, claimToken: claimTo
         didChangeState: !0
     }), {
         effectKey: effectKey,
-        effect: pending.name
-    };
-}
-
-const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
-
-function isResetActivityTarget(value) {
-    return RESET_ACTIVITY_TARGETS.includes(value);
-}
-
-async function resetActivity(args) {
-    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
-        client: client,
-        instanceId: instanceId,
-        options: options
-    });
-    return commitResetActivity({
-        ctx: ctx,
-        activity: activity,
-        to: to,
-        requestRecord: requestRecord,
-        actor: options?.actor
-    });
-}
-
-async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
-    if (assertRequestUnprocessed({
-        instance: ctx.instance,
-        record: requestRecord,
-        now: ctx.now
-    }), isTerminal(ctx)) return {
-        fired: !1
-    };
-    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
-    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
-    const from = entry.status;
-    if (from === to) return {
-        fired: !1
-    };
-    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
-    return recordProcessedRequest({
-        mutation: mutation,
-        record: requestRecord,
-        now: ctx.now
-    }), applyActivityStatusChange({
-        entry: entry,
-        history: mutation.history,
-        stage: openStage2.name,
-        to: to,
-        at: ctx.now,
-        ...actor !== void 0 ? {
-            actor: actor
-        } : {}
-    }), await persist(ctx, mutation), {
-        fired: !0,
-        stage: openStage2.name,
-        activity: activity,
-        from: from,
-        to: to
-    };
-}
-
-const actorCache = /* @__PURE__ */ new WeakMap, grantsCache = /* @__PURE__ */ new WeakMap;
-
-async function resolveAccess(taggedClient, args = {}) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    if (requestFn === void 0) throw new ContractViolationError("workflow: no actor available. The engine resolves the actor from the client's token via `client.request({ uri: '/users/me' })`. Supply a real `@sanity/client` configured with a token (the test bench serves these endpoints per registered token).");
-    const grantsPromise = args.grantsFromPath !== void 0 ? cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: args.grantsFromPath
-    }) : Promise.resolve(void 0), [identity, grants] = await Promise.all([ cachedActor(client, requestFn), grantsPromise ]);
-    if (identity === void 0) throw new ContractViolationError("workflow: failed to resolve actor from `/users/me`. The client is configured but the endpoint returned no usable identity — check the token.");
-    return {
-        actor: identity.actor,
-        ...identity.localPrincipalId !== void 0 ? {
-            localPrincipalId: identity.localPrincipalId
-        } : {},
-        ...grants !== void 0 ? {
-            grants: grants
-        } : {}
-    };
-}
-
-function cachedActor(client, requestFn) {
-    const cached = actorCache.get(client);
-    if (cached !== void 0) return cached;
-    const pending = fetchActor(client, requestFn).catch(err => {
-        throw actorCache.get(client) === pending && actorCache.delete(client), err;
-    });
-    return actorCache.set(client, pending), pending;
-}
-
-function grantsForClientPath(taggedClient, resourcePath) {
-    const client = unwrapRequestTag(taggedClient), requestFn = lazyRequest(client);
-    return requestFn === void 0 ? Promise.resolve(void 0) : cachedGrants({
-        client: client,
-        requestFn: requestFn,
-        resourcePath: resourcePath
-    });
-}
-
-function lazyRequest(client) {
-    return client.request === void 0 ? void 0 : opts => client.request(opts);
-}
-
-function cachedGrants({client: client, requestFn: requestFn, resourcePath: resourcePath}) {
-    let byPath = grantsCache.get(client);
-    byPath === void 0 && (byPath = /* @__PURE__ */ new Map, grantsCache.set(client, byPath));
-    let cached = byPath.get(resourcePath);
-    return cached === void 0 && (cached = fetchGrantsCached(requestFn, resourcePath), 
-    byPath.set(resourcePath, cached)), cached;
-}
-
-async function fetchActor(client, requestFn) {
-    const [resourceUser, globalUser] = await Promise.all([ fetchCurrentUser(requestFn, "the workflow resource host"), fetchGlobalUser(client) ]), resourceId = usableId(resourceUser), globalHostId = usableId(globalUser.user), carriedId = firstCarriedGlobalId([ globalHostId, resourceId ]), sessionId = carriedId ?? globalHostId ?? resourceId;
-    if (sessionId === void 0) return;
-    const bridge = carriedId === void 0 ? await bridgeProjectPrincipal({
-        client: client,
-        sessionId: sessionId,
-        resourceId: resourceId
-    }) : NO_BRIDGE, id = bridge.status === "resolved" ? bridge.globalId : sessionId;
-    refuseProjectScopedActor({
-        id: id,
-        globalUser: globalUser,
-        globalHostId: globalHostId,
-        bridgeFailure: bridge.status === "unavailable" ? bridge : void 0
-    });
-    const roleNames = roleNamesFor(resourceUser, globalUser);
-    return {
-        actor: {
-            kind: "person",
-            id: id,
-            ...roleNames.length > 0 ? {
-                roles: roleNames
-            } : {}
-        },
-        ...resourceId !== void 0 && resourceId !== id ? {
-            localPrincipalId: resourceId
-        } : {}
-    };
-}
-
-function roleNamesFor(resourceUser, globalUser) {
-    return (resourceUser?.roles?.length ? resourceUser : globalUser.user)?.roles?.map(r => r.name).filter(n => !!n) ?? [];
-}
-
-const NO_BRIDGE = {
-    status: "not-applicable"
-};
-
-function globalRouteReason(globalUser, globalHostId) {
-    return "reason" in globalUser ? globalUser.reason : globalHostId === void 0 ? "no record" : `the global host answered with project-scoped principal "${globalHostId}"`;
-}
-
-async function bridgeProjectPrincipal(args) {
-    const {client: client, sessionId: sessionId, resourceId: resourceId} = args;
-    return classifyPrincipalId(sessionId).namespace !== "project" ? NO_BRIDGE : resourceId === void 0 || classifyPrincipalId(resourceId).namespace !== "project" ? {
-        status: "unavailable",
-        reason: "no project-scoped principal from the resource host to address the directory with"
-    } : directoryGlobalId({
-        client: client,
-        principalId: resourceId
-    });
-}
-
-async function directoryGlobalId(args) {
-    const {client: client, principalId: principalId} = args, projectId = typeof client.config == "function" ? client.config().projectId : void 0;
-    if (projectId === void 0) return {
-        status: "unavailable",
-        reason: "the client reports no projectId, so its user directory has no address"
-    };
-    const lookup = await clientProjectUserDirectory(withRequestTag(client, REQUEST_TAG.accessResolveActor), projectId).findById(principalId);
-    if (lookup.status !== "resolved") return {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory reported the principal ${lookup.status}`,
-        ...lookup.status === "inaccessible" && lookup.cause !== void 0 ? {
-            cause: lookup.cause
-        } : {}
-    };
-    const globalId = directoryBridgeId(lookup.user.sanityUserId);
-    return globalId === void 0 ? {
-        status: "unavailable",
-        reason: `project "${projectId}"'s user directory row for the principal carries no account-global sanityUserId`
-    } : {
-        status: "resolved",
-        globalId: globalId
-    };
-}
-
-function refuseProjectScopedActor(args) {
-    const {id: id, globalUser: globalUser, globalHostId: globalHostId, bridgeFailure: bridgeFailure} = args;
-    if (classifyPrincipalId(id).namespace !== "project") return;
-    const routes = [ `The account-global record: ${globalRouteReason(globalUser, globalHostId)}.` ];
-    bridgeFailure !== void 0 && routes.push(`The project user directory: ${bridgeFailure.reason}.`);
-    const cause = bridgeFailure?.cause ?? ("cause" in globalUser ? globalUser.cause : void 0);
-    throw new Error(`workflow: the caller's identity resolves to the project-scoped principal "${id}" and its account-global id could not be resolved. ${routes.join(" ")} The engine speaks account-global user ids only and never acts as a project-scoped principal.`, cause === void 0 ? void 0 : {
-        cause: cause
-    });
+        effect: pending.name
+    };
 }
 
-function usableId(user) {
-    if (!(!user || typeof user.id != "string" || user.id.length === 0)) return user.id;
-}
+const RESET_ACTIVITY_TARGETS = [ "active", "skipped" ];
 
-async function fetchCurrentUser(requestFn, hostDescription) {
-    try {
-        return await requestFn({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        });
-    } catch (err) {
-        throw new Error(`workflow: /users/me request against ${hostDescription} failed. The engine resolves the actor from the client's token via \`client.request({ uri: '/users/me' })\`. Check the token/connectivity.`, {
-            cause: err
-        });
-    }
+function isResetActivityTarget(value) {
+    return RESET_ACTIVITY_TARGETS.includes(value);
 }
 
-async function fetchGlobalUser(client) {
-    if (typeof client.withConfig != "function") return {
-        user: void 0,
-        reason: "the client cannot reach the global API host (no withConfig)"
-    };
-    let globalRequest, globalClient;
-    const hostResolution = resolveGlobalApiHost(client);
-    try {
-        globalClient = client.withConfig({
-            useProjectHostname: !1,
-            ...hostResolution.apiHost === void 0 ? {} : {
-                apiHost: hostResolution.apiHost
-            }
-        }), globalRequest = lazyRequest(globalClient);
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `building the global-host sibling client failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
-    if (globalRequest === void 0) return {
-        user: void 0,
-        reason: "the global-host sibling client cannot issue requests"
-    };
-    try {
-        const user = await globalRequest({
-            uri: "/users/me",
-            tag: REQUEST_TAG.accessResolveActor
-        }), id = usableId(user);
-        return hostResolution.requireGlobalPrincipal && id !== void 0 && classifyPrincipalId(id).namespace === "project" ? {
-            user: void 0,
-            reason: `global-host /users/me returned project-scoped principal "${id}"; the sibling client is still bound to a project API host`
-        } : {
-            user: user
-        };
-    } catch (err) {
-        return {
-            user: void 0,
-            reason: `global-host /users/me failed: ${errorMessage(err)}`,
-            cause: err
-        };
-    }
+async function resetActivity(args) {
+    const {client: client, instanceId: instanceId, activity: activity, to: to, requestRecord: requestRecord, options: options} = args, ctx = await loadCallContext({
+        client: client,
+        instanceId: instanceId,
+        options: options
+    });
+    return commitResetActivity({
+        ctx: ctx,
+        activity: activity,
+        to: to,
+        requestRecord: requestRecord,
+        actor: options?.actor
+    });
 }
 
-function resolveGlobalApiHost(client) {
-    if (typeof client.config != "function") return {
-        requireGlobalPrincipal: !1
+async function commitResetActivity({ctx: ctx, activity: activity, to: to, requestRecord: requestRecord, actor: actor}) {
+    if (assertRequestUnprocessed({
+        instance: ctx.instance,
+        record: requestRecord,
+        now: ctx.now
+    }), isTerminal(ctx)) return {
+        fired: !1
     };
-    const apiHost = client.config().apiHost;
-    if (apiHost === void 0) return {
-        requireGlobalPrincipal: !1
+    const mutation = startMutation(ctx.instance), openStage2 = findOpenStageEntry(mutation), entry = findCurrentActivityEntry(mutation, activity);
+    if (openStage2 === void 0 || entry === void 0) throw new ContractViolationError(`resetActivity: activity "${activity}" is not in the current stage of instance "${ctx.instance._id}"`);
+    const from = entry.status;
+    if (from === to) return {
+        fired: !1
     };
-    let parsed;
-    try {
-        parsed = new URL(apiHost);
-    } catch {
-        return {
-            requireGlobalPrincipal: !0
-        };
-    }
-    if (/^api\.sanity\.(io|work)$/.test(parsed.hostname)) return {
-        requireGlobalPrincipal: !1
+    if (!isTerminalActivityStatus(from)) throw new ContractViolationError(`resetActivity: activity "${activity}" is "${from}", not a terminal status — a reset only recovers a resolved (typically failed) activity. Use setStage to force past a live stage.`);
+    return recordProcessedRequest({
+        mutation: mutation,
+        record: requestRecord,
+        now: ctx.now
+    }), applyActivityStatusChange({
+        entry: entry,
+        history: mutation.history,
+        stage: openStage2.name,
+        to: to,
+        at: ctx.now,
+        ...actor !== void 0 ? {
+            actor: actor
+        } : {}
+    }), await persist(ctx, mutation), {
+        fired: !0,
+        stage: openStage2.name,
+        activity: activity,
+        from: from,
+        to: to
     };
-    const match = /^[^.]+\.api\.sanity\.(io|work)$/.exec(parsed.hostname);
-    return match === null ? {
-        requireGlobalPrincipal: !0
-    } : (parsed.hostname = `api.sanity.${match[1]}`, {
-        apiHost: parsed.origin,
-        requireGlobalPrincipal: !0
-    });
-}
-
-async function fetchGrantsCached(requestFn, resourcePath) {
-    try {
-        return await fetchGrants({
-            client: {
-                request: requestFn
-            },
-            resourcePath: resourcePath
-        });
-    } catch (err) {
-        console.warn(`workflow: failed to fetch grants from "${resourcePath}"; advisory permission reads that depend on them are skipped — a rendered $can stays undefined (conditions referencing it fail closed) and the subject-write forecast omits this resource. The lake still enforces writes. Original error: ${errorMessage(err)}`);
-        return;
-    }
 }
 
 const REPLAY_SURFACE = {
@@ -9109,7 +9754,7 @@ async function resourceActorId(client) {
 async function evaluateInstance(args) {
     const {client: client, tag: tag, workflowResource: workflowResource, instanceId: instanceId, resourceClients: resourceClients} = args, now = (args.clock ?? wallClock)();
     validateTag(tag);
-    const [access, instance] = await Promise.all([ resolveAccess(client, {
+    const [access, instance, attributes] = await Promise.all([ resolveAccess(client, {
         ...args.grantsFromPath !== void 0 ? {
             grantsFromPath: args.grantsFromPath
         } : {}
@@ -9117,7 +9762,7 @@ async function evaluateInstance(args) {
         client: client,
         instanceId: instanceId,
         tag: tag
-    }) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
+    }), resolveUserAttributes(client) ]), {actor: actor, grants: grants, localPrincipalId: localPrincipalId} = access, definition = parseDefinitionSnapshot(instance), clientForGdr = buildClientForGdr({
         client: client,
         workflowResource: workflowResource,
         resourceClients: resourceClients
@@ -9142,6 +9787,9 @@ async function evaluateInstance(args) {
         } : {},
         ...grants !== void 0 ? {
             grants: grants
+        } : {},
+        ...attributes !== void 0 ? {
+            attributes: attributes
         } : {}
     });
 }
@@ -9156,6 +9804,33 @@ function memoizedByName(render) {
     };
 }
 
+async function callerBoundProjectionScopes(args) {
+    const can = await advisoryCan({
+        instance: args.instance,
+        identity: args.identity,
+        grants: args.grants
+    }), vars = callerBoundVars({
+        ...can !== void 0 ? {
+            can: can
+        } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {}
+    }), opts = {
+        actor: args.actor,
+        ...vars !== void 0 ? {
+            vars: vars
+        } : {}
+    };
+    return {
+        scope: await renderConditionScope(args.scopeSource, opts),
+        scopeForActivity: memoizedByName(activityName => renderConditionScope(args.scopeSource, {
+            activityName: activityName,
+            ...opts
+        }))
+    };
+}
+
 function currentStageOf(instance, definition) {
     try {
         return findStage(definition, instance.currentStage);
@@ -9181,7 +9856,7 @@ async function explainSite(args) {
 }
 
 async function evaluateFromSnapshot(args) {
-    const {instance: instance, definition: definition, actor: actor, grants: grants, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
+    const {instance: instance, definition: definition, actor: actor, grants: grants, attributes: attributes, snapshot: snapshot} = args, now = args.now ?? wallClock(), stage = currentStageOf(instance, definition), autonomy = autonomyOf(definition), stageAutonomy2 = stageAutonomyOf(autonomy, stage.name), fireConsequence = (activity, action) => whatIfFireAction({
         instance: instance,
         definition: definition,
         snapshot: snapshot,
@@ -9198,22 +9873,14 @@ async function evaluateFromSnapshot(args) {
     }, anchorIdentity = lakePrincipalId({
         actor: actor,
         localPrincipalId: args.localPrincipalId
-    }), can = await advisoryCan({
-        instance: instance,
-        identity: anchorIdentity,
-        grants: grants
-    }), scope = await renderConditionScope(scopeSource, {
+    }), {scope: scope, scopeForActivity: scopeForActivity} = await callerBoundProjectionScopes({
+        scopeSource: scopeSource,
         actor: actor,
-        vars: {
-            can: can
-        }
-    }), scopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
-        activityName: activityName,
-        actor: actor,
-        vars: {
-            can: can
-        }
-    })), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
+        instance: instance,
+        grants: grants,
+        attributes: attributes,
+        identity: anchorIdentity
+    }), cascadeScopeForActivity = memoizedByName(activityName => renderConditionScope(scopeSource, {
         activityName: activityName
     })), currentActivityEntries = findOpenStageEntry(instance)?.activities ?? [], guardDenial = await instanceGuardReason({
         instance: instance,
@@ -9262,6 +9929,7 @@ async function evaluateFromSnapshot(args) {
     }
     const currentStage = {
         stage: stage,
+        ...semanticsOf(stage),
         activities: activityEvaluations,
         transitions: transitionEvaluations,
         autonomy: stageAutonomy2
@@ -9278,6 +9946,7 @@ async function evaluateFromSnapshot(args) {
     return {
         instance: instance,
         definition: definition,
+        ...semanticsOf(definition),
         actor: actor,
         currentStage: currentStage,
         pendingOnYou: pendingOnYou,
@@ -9329,6 +9998,12 @@ async function evaluateEditableFields(args) {
             ...site.validation !== void 0 ? {
                 validation: site.validation
             } : {},
+            ...site.roles !== void 0 ? {
+                roles: site.roles,
+                ...definition.roleAliases !== void 0 ? {
+                    roleAliases: definition.roleAliases
+                } : {}
+            } : {},
             value: value,
             editable: reason === void 0,
             ...reason !== void 0 ? {
@@ -9433,6 +10108,7 @@ async function evaluateActivity(args) {
     }));
     return {
         activity: activity,
+        ...semanticsOf(activity),
         status: status,
         kind: deriveActivityKind(activity),
         classification: deriveExecutorClassification(activity),
@@ -9603,9 +10279,13 @@ function fireableActionVerdict({args: args, insights: insights}) {
 function actionEvaluationIdentity(action) {
     return {
         action: action,
-        ...action.semantics !== void 0 ? {
-            semantics: action.semantics
-        } : {}
+        ...semanticsOf(action)
+    };
+}
+
+function semanticsOf(node) {
+    return node.semantics === void 0 ? {} : {
+        semantics: node.semantics
     };
 }
 
@@ -9674,23 +10354,63 @@ function idsArm(filter, params) {
     }
 }
 
-function instancesQuery(args) {
-    const {tag: tag, filter: filter = {}} = args;
-    if (validateTag(tag), filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
-    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ], params = {
-        tag: tag
-    };
+function beforeArm(filter, params) {
+    const before = filter.before;
+    if (before !== void 0) {
+        if (filter.limit === void 0) throw new ContractViolationError("instancesQuery: `before` requires `limit` — a cursor pages the newest-first sliced read");
+        if (before.id === "" || before.startedAt === "") throw new ContractViolationError(`instancesQuery: \`before\` needs a non-empty id and startedAt; got ${JSON.stringify(before)}`);
+        return params.beforeStartedAt = before.startedAt, params.beforeId = before.id, "(startedAt < $beforeStartedAt || (startedAt == $beforeStartedAt && _id > $beforeId))";
+    }
+}
+
+function compiledConditions(filter, params) {
+    if (filter.limit !== void 0 && (!Number.isInteger(filter.limit) || filter.limit <= 0)) throw new ContractViolationError(`instancesQuery: limit must be a positive integer; got ${JSON.stringify(filter.limit)}`);
+    const conditions = [ `_type == "${WORKFLOW_INSTANCE_TYPE}"`, tagScopeFilter() ];
     filter.includeCompleted !== !0 && conditions.push(inFlightFilter()), filter.definition !== void 0 && (conditions.push("definition == $definition"), 
     params.definition = filter.definition), filter.stage !== void 0 && (conditions.push("currentStage == $stage"), 
     params.stage = filter.stage);
+    const cursor = beforeArm(filter, params);
+    cursor !== void 0 && conditions.push(cursor);
     const arms = [ documentArm(filter, params), idsArm(filter, params) ].filter(arm => arm !== void 0);
-    arms.length > 0 && conditions.push(`(${arms.join(" || ")})`);
-    const body = `*[${conditions.join(" && ")}]`;
-    return filter.limit !== void 0 ? {
-        query: `${body} | order(startedAt desc) [0...${filter.limit}]`,
+    return arms.length > 0 && conditions.push(`(${arms.join(" || ")})`), conditions;
+}
+
+function orderedSlice(filter) {
+    return filter.limit !== void 0 ? ` | order(startedAt desc, _id asc) [0...${filter.limit}]` : " | order(startedAt asc, _id asc)";
+}
+
+function instancesQuery(args) {
+    const {tag: tag, filter: filter = {}} = args;
+    validateTag(tag);
+    const params = {
+        tag: tag
+    };
+    return {
+        query: `*[${compiledConditions(filter, params).join(" && ")}]${orderedSlice(filter)}`,
         params: params
-    } : {
-        query: `${body} | order(startedAt asc)`,
+    };
+}
+
+function instanceChangesQuery(args) {
+    return validateTag(args.tag), {
+        query: `*[_type == "${WORKFLOW_INSTANCE_TYPE}" && ${tagScopeFilter()}]`,
+        params: {
+            tag: args.tag
+        }
+    };
+}
+
+const PREVIEW_FIELD_TYPES = [ "actor", "assignee", "assignees", "date", "datetime", "doc.ref", "doc.refs", "dueDate", "dueDatetime", "release.ref", "subject" ], PREVIEW_PROJECTION = `{\n  _id, _type, modelVersion, minReaderModel, workflowResource, definition, pinnedVersion,\n  currentStage, startedAt, completedAt, abortedAt, perspective, ancestors,\n  "fields": fields[_type in $previewFieldTypes],\n  "stages": stages[!defined(exitedAt) && name == ^.currentStage]{\n    _key, name, enteredAt,\n    "fields": fields[_type in $previewFieldTypes],\n    "activities": activities[]{\n      _key, name, status, completedBy,\n      "fields": fields[_type in $previewFieldTypes]\n    }\n  },\n  "claimedEffects": pendingEffects[defined(claim)]{name, title},\n  "failedEffects": effectHistory[status == "failed"]{name, title}\n}`.replaceAll(/\s+/g, " ").trim();
+
+function instancePreviewsQuery(args) {
+    const {tag: tag, filter: filter = {}} = args;
+    validateTag(tag);
+    const params = {
+        tag: tag,
+        previewFieldTypes: PREVIEW_FIELD_TYPES
+    };
+    return {
+        query: `*[${compiledConditions(filter, params).join(" && ")}]${orderedSlice(filter)} ${PREVIEW_PROJECTION}`,
         params: params
     };
 }
@@ -9875,6 +10595,11 @@ function hashDefinitionContent(def) {
 }
 
 function planDefinitionDeploy({def: def, latest: latest, target: target}) {
+    assertRoleConstrainedAssignmentResource({
+        context: "workflow.deployDefinitions",
+        definition: def,
+        workflowResource: target.workflowResource
+    });
     const expanded = expandResourceAliases(def, target.resourceAliases), contentHash = hashDefinitionContent(expanded), unchanged = latest !== void 0 && latest.contentHash === contentHash, version = unchanged ? latest.version : (latest?.version ?? 0) + 1, docId = definitionDocId({
         tag: target.tag,
         definition: expanded.name,
@@ -10067,7 +10792,9 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
         self: selfGdr(ctx.instance),
         now: ctx.now,
         snapshot: ctx.snapshot,
-        refSurface: ctx.refSurface
+        refSurface: ctx.refSurface,
+        memberRoles: ctx.memberRoles,
+        roleAliases: ctx.definition.roleAliases
     });
     return await persistThenMaybeRefresh({
         ctx: ctx,
@@ -10084,7 +10811,8 @@ async function commitEdit({ctx: ctx, target: target, mode: mode, value: value, r
 }
 
 async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
-    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), can = await advisoryCanForCall({
+    const actor = options?.actor, window = fieldWindowOpen(ctx.instance, site), vars = await callerBoundVarsForCall({
+        client: ctx.client,
         instance: ctx.instance,
         options: options
     }), predicateSatisfied = window.open && site.effective !== !0 && site.effective !== void 0 ? await ctxEvaluateCondition({
@@ -10097,10 +10825,8 @@ async function assertFieldEditable({ctx: ctx, site: site, options: options}) {
             ...actor !== void 0 ? {
                 actor: actor
             } : {},
-            ...can !== void 0 ? {
-                vars: {
-                    can: can
-                }
+            ...vars !== void 0 ? {
+                vars: vars
             } : {}
         }
     }) : site.effective === !0, reason = editDisabledReason({
@@ -10167,6 +10893,7 @@ async function resolveOperationContext(args) {
     return {
         access: access,
         actor: access.actor,
+        memberRolesLoader: createAssignmentMemberRolesLoader(args.client),
         clientForGdr: buildClientForGdr({
             client: args.client,
             workflowResource: args.workflowResource,
@@ -10199,6 +10926,7 @@ async function runCommitVerb(params) {
         actor: context.actor,
         clientForGdr: context.clientForGdr,
         refSurface: context.refSurface,
+        memberRolesLoader: context.memberRolesLoader,
         clock: clock,
         executionContext: args.executionContext,
         telemetry: args.telemetry,
@@ -10223,7 +10951,7 @@ function requestRecordFor(args) {
 }
 
 async function runDeduped(args) {
-    const {client: client, tag: tag, instanceId: instanceId, record: record, before: before, now: now, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, run: run} = args, {clock: clock, executionContext: executionContext, telemetry: telemetry} = args, replay = async () => {
+    const {client: client, tag: tag, instanceId: instanceId, record: record, before: before, now: now, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, run: run} = args, {clock: clock, executionContext: executionContext, telemetry: telemetry} = args, replay = async () => {
         const pre = await reload({
             client: client,
             instanceId: instanceId,
@@ -10235,6 +10963,7 @@ async function runDeduped(args) {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             executionContext: executionContext,
             telemetry: telemetry
@@ -10258,13 +10987,14 @@ async function runDeduped(args) {
     }
 }
 
-async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
+async function cascade({client: client, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, overlay: overlay}) {
     const count = await cascadeAutoTransitions({
         client: client,
         instanceId: instanceId,
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -10284,6 +11014,7 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -10297,7 +11028,7 @@ async function cascade({client: client, instanceId: instanceId, actor: actor, cl
 }
 
 async function cascadeAndReload(args) {
-    const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock} = args;
+    const {client: client, tag: tag, instanceId: instanceId, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock} = args;
     return {
         cascaded: await cascade({
             client: client,
@@ -10305,6 +11036,7 @@ async function cascadeAndReload(args) {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             ...args.executionContext !== void 0 ? {
                 executionContext: args.executionContext
@@ -10328,6 +11060,7 @@ async function settleStart(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: args.clock,
         ...args.executionContext !== void 0 ? {
             executionContext: args.executionContext
@@ -10370,31 +11103,20 @@ function resumeMismatch(args) {
 }
 
 async function resumeStart(args) {
-    const {existing: existing} = args, mismatch = resumeMismatch({
+    const {existing: existing, definition: definition, version: version, initialFieldCount: initialFieldCount, ...settlementArgs} = args, mismatch = resumeMismatch({
         existing: existing,
-        definition: args.definition,
-        version: args.version
+        definition: definition,
+        version: version
     });
     if (mismatch !== void 0) throw new ContractViolationError(`startInstance: instanceId "${existing._id}" already exists and ${mismatch}. A supplied instanceId is start's idempotency key — reuse one only to retry the same start.`);
     if (existing.stages.length === 0 && terminalState(existing) !== "in-flight") throw new ContractViolationError(`startInstance: instanceId "${existing._id}" belongs to a start that was discarded (aborted before it finished starting) — mint a new id to start again.`);
     const completesStart = isUnprimed(existing), emitStarted = () => resolveTelemetry(args.telemetry).log(WorkflowInstanceStarted, instanceStartedDataFor({
         instance: existing,
-        initialFieldCount: args.initialFieldCount,
+        initialFieldCount: initialFieldCount,
         viaSpawn: !1
     })), cascaded = await settleStart({
-        client: args.client,
-        tag: args.tag,
+        ...settlementArgs,
         instanceId: existing._id,
-        actor: args.actor,
-        clientForGdr: args.clientForGdr,
-        refSurface: args.refSurface,
-        clock: args.clock,
-        ...args.executionContext !== void 0 ? {
-            executionContext: args.executionContext
-        } : {},
-        ...args.telemetry !== void 0 ? {
-            telemetry: args.telemetry
-        } : {},
         ...completesStart ? {
             emitStarted: emitStarted
         } : {}
@@ -10410,7 +11132,7 @@ async function resumeStart(args) {
     };
 }
 
-function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, executionContext: executionContext, telemetry: telemetry}) {
+function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, executionContext: executionContext, telemetry: telemetry}) {
     return {
         ...actor !== void 0 ? {
             actor: actor
@@ -10418,6 +11140,7 @@ function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: client
         clock: clock,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
         } : {},
@@ -10428,7 +11151,7 @@ function engineOptionsForActor({actor: actor, clock: clock, clientForGdr: client
 }
 
 async function abortAndPropagate(args) {
-    const {client: client, instanceId: instanceId, reason: reason, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, executionContext: executionContext, telemetry: telemetry, requestRecord: requestRecord} = args, result = await abortInstance({
+    const {client: client, instanceId: instanceId, reason: reason, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, executionContext: executionContext, telemetry: telemetry, requestRecord: requestRecord} = args, result = await abortInstance({
         client: client,
         instanceId: instanceId,
         ...reason !== void 0 ? {
@@ -10442,6 +11165,7 @@ async function abortAndPropagate(args) {
             clock: clock,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             executionContext: executionContext,
             telemetry: telemetry
         })
@@ -10451,6 +11175,7 @@ async function abortAndPropagate(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10468,6 +11193,7 @@ async function abortAndPropagate(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10509,6 +11235,7 @@ async function dispatchGatedWrite(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: args.clock,
         executionContext: args.executionContext,
         telemetry: args.telemetry
@@ -10584,12 +11311,16 @@ function buildEngineCallOptions(args) {
         actor: args.actor,
         clientForGdr: args.clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         ...args.localPrincipalId !== void 0 ? {
             localPrincipalId: args.localPrincipalId
         } : {},
         ...args.grants !== void 0 ? {
             grants: args.grants
         } : {},
+        ...args.attributes !== void 0 ? {
+            attributes: args.attributes
+        } : {},
         ...args.clock !== void 0 ? {
             clock: args.clock
         } : {},
@@ -10620,7 +11351,7 @@ async function applyAction(args) {
 }
 
 async function deleteDefinition(args) {
-    const {client: client, tag: tag, definition: definition, version: version, cascade: cascade2, reason: reason, executionContext: executionContext, telemetry: telemetry} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersionsOrThrow({
+    const {client: client, tag: tag, definition: definition, version: version, cascade: cascade2, reason: reason, executionContext: executionContext, telemetry: telemetry} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = await resolveOperationContext(args), clock = args.clock ?? wallClock, versions = await loadDefinitionVersionsOrThrow({
         client: client,
         definition: definition,
         tag: tag
@@ -10659,6 +11390,7 @@ async function deleteDefinition(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         executionContext: executionContext,
         telemetry: telemetry
@@ -10717,6 +11449,7 @@ async function abortInstances(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: args.refSurface,
+        memberRolesLoader: args.memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -10749,11 +11482,12 @@ async function fetchStartSlice(args) {
 
 const workflow = {
     deployDefinitions: async rawArgs => {
-        assertReaderModelAcknowledgement(rawArgs.expectedMinReaderModel);
-        const args = taggedScope(rawArgs, REQUEST_TAG.deploy), {client: client, tag: tag, resourceAliases: resourceAliases} = args;
+        const args = taggedScope(rawArgs, REQUEST_TAG.deploy), {client: client, tag: tag, workflowResource: workflowResource, resourceAliases: resourceAliases} = args;
         validateTag(tag);
         const definitions = args.definitions.map(def => parseDefinitionInput(def, "workflow.deployDefinitions"));
-        definitions.forEach(validateDefinition);
+        definitions.forEach(validateDefinition), assertReaderModelAcknowledgement(args.expectedMinReaderModel, {
+            requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
+        });
         const ordered = await sortByDependencies({
             client: client,
             definitions: definitions,
@@ -10772,6 +11506,7 @@ const workflow = {
                 latest: latest,
                 target: {
                     tag: tag,
+                    workflowResource: workflowResource,
                     ...resourceAliases !== void 0 ? {
                         resourceAliases: resourceAliases
                     } : {}
@@ -10822,7 +11557,7 @@ const workflow = {
         }), result;
     },
     startInstance: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.start), {client: client, tag: tag, definition: definitionName, version: version, initialFields: initialFields, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = operationContext, clock = args.clock ?? wallClock, seedFields = initialFields ?? [], existing = instanceId !== void 0 ? await getInstanceDocument(client, instanceId) : void 0;
+        const args = taggedScope(rawArgs, REQUEST_TAG.start), {client: client, tag: tag, definition: definitionName, version: version, initialFields: initialFields, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = operationContext, clock = args.clock ?? wallClock, seedFields = initialFields ?? [], existing = instanceId !== void 0 ? await getInstanceDocument(client, instanceId) : void 0;
         return existing !== void 0 && existing.tag === tag ? resumeStart({
             client: client,
             tag: tag,
@@ -10833,6 +11568,7 @@ const workflow = {
             actor: actor,
             clientForGdr: clientForGdr,
             refSurface: refSurface,
+            memberRolesLoader: memberRolesLoader,
             clock: clock,
             ...executionContext !== void 0 ? {
                 executionContext: executionContext
@@ -10852,7 +11588,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "fireAction",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 if (findCurrentActivityEntry(before, activity) === void 0 && idempotent === !0) return {
                     instance: before,
                     cascaded: 0,
@@ -10866,6 +11602,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     before: before,
                     ...grantsFromPath !== void 0 ? {
@@ -10899,6 +11636,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         ...executionContext !== void 0 ? {
                             executionContext: executionContext
                         } : {},
@@ -10927,7 +11665,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "editField",
-            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await dispatchGatedWrite({
                     client: client,
                     tag: tag,
@@ -10936,6 +11674,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     before: before,
                     ...grantsFromPath !== void 0 ? {
@@ -10970,6 +11709,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         ...executionContext !== void 0 ? {
                             executionContext: executionContext
                         } : {},
@@ -10990,7 +11730,7 @@ const workflow = {
         });
     },
     completeEffect: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.completeEffect), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, status: status, outputs: outputs, ops: ops, detail: detail, error: error, durationMs: durationMs, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "completeEffect",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11001,9 +11741,7 @@ const workflow = {
             instanceId: instanceId,
             record: record,
             now: clock(),
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry,
@@ -11032,10 +11770,8 @@ const workflow = {
                         requestRecord: record
                     } : {},
                     options: engineOptionsForActor({
-                        actor: actor,
+                        ...operationContext,
                         clock: clock,
-                        clientForGdr: clientForGdr,
-                        refSurface: refSurface,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11043,9 +11779,7 @@ const workflow = {
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
-                    actor: actor,
-                    clientForGdr: clientForGdr,
-                    refSurface: refSurface,
+                    ...operationContext,
                     clock: clock,
                     executionContext: executionContext,
                     telemetry: args.telemetry
@@ -11066,7 +11800,7 @@ const workflow = {
         });
     },
     commitEffectOps: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
+        const args = taggedScope(rawArgs, REQUEST_TAG.commitEffectOps), {client: client, tag: tag, instanceId: instanceId, effectKey: effectKey, claimToken: claimToken, ops: ops, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), clock = args.clock ?? wallClock, record = requestRecordFor({
             idempotencyKey: args.idempotencyKey,
             op: "commitEffectOps",
             idempotencyTtlMs: args.idempotencyTtlMs
@@ -11078,9 +11812,7 @@ const workflow = {
             instanceId: instanceId,
             record: record,
             now: clock(),
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry,
@@ -11094,10 +11826,8 @@ const workflow = {
                     requestRecord: record,
                     leaseMs: args.leaseMs ?? DEFAULT_EFFECT_LEASE_MS,
                     options: engineOptionsForActor({
-                        actor: actor,
+                        ...operationContext,
                         clock: clock,
-                        clientForGdr: clientForGdr,
-                        refSurface: refSurface,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11105,9 +11835,7 @@ const workflow = {
                     client: client,
                     tag: tag,
                     instanceId: instanceId,
-                    actor: actor,
-                    clientForGdr: clientForGdr,
-                    refSurface: refSurface,
+                    ...operationContext,
                     clock: clock,
                     executionContext: executionContext,
                     telemetry: args.telemetry
@@ -11126,7 +11854,7 @@ const workflow = {
         });
     },
     tick: async rawArgs => {
-        const args = taggedScope(rawArgs, REQUEST_TAG.tick), {client: client, tag: tag, instanceId: instanceId, executionContext: executionContext} = args, {access: access, actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = await resolveOperationContext(args), clock = args.clock ?? wallClock, current = await reload({
+        const args = taggedScope(rawArgs, REQUEST_TAG.tick), {client: client, tag: tag, instanceId: instanceId, executionContext: executionContext} = args, operationContext = await resolveOperationContext(args), {access: access} = operationContext, clock = args.clock ?? wallClock, current = await reload({
             client: client,
             instanceId: instanceId,
             tag: tag
@@ -11140,9 +11868,7 @@ const workflow = {
             client: client,
             tag: tag,
             instanceId: instanceId,
-            actor: actor,
-            clientForGdr: clientForGdr,
-            refSurface: refSurface,
+            ...operationContext,
             clock: clock,
             executionContext: executionContext,
             telemetry: args.telemetry
@@ -11162,7 +11888,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "setStage",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await setStage({
                     client: client,
                     instanceId: instanceId,
@@ -11178,6 +11904,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11187,6 +11914,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11216,7 +11944,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "abortInstance",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const changed = await abortAndPropagate({
                     client: client,
                     instanceId: instanceId,
@@ -11224,6 +11952,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11257,7 +11986,7 @@ const workflow = {
         return runCommitVerb({
             args: args,
             op: "resetActivity",
-            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, clock: clock, record: record, before: before}) => {
+            run: async ({actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader, clock: clock, record: record, before: before}) => {
                 const result = await resetActivity({
                     client: client,
                     instanceId: instanceId,
@@ -11271,6 +12000,7 @@ const workflow = {
                         clock: clock,
                         clientForGdr: clientForGdr,
                         refSurface: refSurface,
+                        memberRolesLoader: memberRolesLoader,
                         executionContext: executionContext,
                         telemetry: args.telemetry
                     })
@@ -11280,6 +12010,7 @@ const workflow = {
                     actor: actor,
                     clientForGdr: clientForGdr,
                     refSurface: refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     clock: clock,
                     ...executionContext !== void 0 ? {
                         executionContext: executionContext
@@ -11585,7 +12316,7 @@ async function startRequirementVerdict(args) {
 }
 
 async function startFreshInstance(args) {
-    const {args: startArgs, operationContext: operationContext, clock: clock, seedFields: seedFields} = args, {client: client, tag: tag, workflowResource: workflowResource, definition: definitionName, version: version, ancestors: ancestors, context: context, instanceId: instanceId, perspective: perspective, executionContext: executionContext} = startArgs, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface} = operationContext, definition = await loadDefinition({
+    const {args: startArgs, operationContext: operationContext, clock: clock, seedFields: seedFields} = args, {client: client, tag: tag, workflowResource: workflowResource, definition: definitionName, version: version, ancestors: ancestors, context: context, instanceId: instanceId, perspective: perspective, executionContext: executionContext} = startArgs, {actor: actor, clientForGdr: clientForGdr, refSurface: refSurface, memberRolesLoader: memberRolesLoader} = operationContext, definition = await loadDefinition({
         client: client,
         definition: definitionName,
         version: version,
@@ -11609,6 +12340,7 @@ async function startFreshInstance(args) {
         id: id,
         now: now,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...perspective !== void 0 ? {
             perspective: perspective
         } : {}
@@ -11640,6 +12372,7 @@ async function startFreshInstance(args) {
         actor: actor,
         clientForGdr: clientForGdr,
         refSurface: refSurface,
+        memberRolesLoader: memberRolesLoader,
         clock: clock,
         ...executionContext !== void 0 ? {
             executionContext: executionContext
@@ -11695,7 +12428,10 @@ async function assertStartInputs(args) {
 }
 
 async function resolveStartFields(args) {
-    const {client: client, tag: tag, workflowResource: workflowResource, definition: definition, initialFields: initialFields, id: id, now: now, refSurface: refSurface, perspective: perspective} = args, fieldDiscards = [];
+    const {client: client, tag: tag, workflowResource: workflowResource, definition: definition, initialFields: initialFields, id: id, now: now, refSurface: refSurface, memberRolesLoader: memberRolesLoader, perspective: perspective} = args, fieldDiscards = [], memberRoles = await memberRolesLoader({
+        workflowResource: workflowResource,
+        definition: definition
+    });
     return {
         resolvedFields: await resolveDeclaredFields({
             entryDefs: definition.fields ?? [],
@@ -11708,6 +12444,8 @@ async function resolveStartFields(args) {
                 workflowResource: workflowResource,
                 definitionName: definition.name,
                 refSurface: refSurface,
+                memberRoles: memberRoles,
+                roleAliases: definition.roleAliases,
                 ...perspective !== void 0 ? {
                     perspective: perspective
                 } : {},
@@ -12348,7 +13086,7 @@ function createInstanceSession(args) {
             refSurface: evalScope.refSurface
         });
     }, evaluateWith = async ({held: held, guards: guards, self: self}) => {
-        const {actor: actor, localPrincipalId: localPrincipalId, grants: grants} = await access(), resourceGrants = await subjectResourceGrants({
+        const [{actor: actor, localPrincipalId: localPrincipalId, grants: grants}, attributes] = await Promise.all([ access(), resolveUserAttributes(client) ]), resourceGrants = await subjectResourceGrants({
             clientForGdr: evalScope.clientForGdr,
             instance: instance
         }), normalizedSelf = await normalizeInstanceIdentities({
@@ -12370,13 +13108,17 @@ function createInstanceSession(args) {
             } : {},
             ...grants !== void 0 ? {
                 grants: grants
+            } : {},
+            ...attributes !== void 0 ? {
+                attributes: attributes
             } : {}
         });
-    }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope}) => {
+    }, settleAfterApply = async ({actor: actor, held: held, ranOps: ranOps, scope: scope, memberRolesLoader: memberRolesLoader}) => {
         const cascaded = await cascadeHeld({
             scope: scope,
             actor: actor,
-            held: held
+            held: held,
+            memberRolesLoader: memberRolesLoader
         });
         return instance = await reload({
             client: scope.client,
@@ -12390,12 +13132,13 @@ function createInstanceSession(args) {
                 ranOps: ranOps
             } : {}
         };
-    }, cascadeHeld = ({scope: scope, actor: actor, held: held}) => cascade({
+    }, cascadeHeld = ({scope: scope, actor: actor, held: held, memberRolesLoader: memberRolesLoader}) => cascade({
         client: scope.client,
         instanceId: instance._id,
         actor: actor,
         clientForGdr: scope.clientForGdr,
         refSurface: scope.refSurface,
+        memberRolesLoader: memberRolesLoader,
         ...clock !== void 0 ? {
             clock: clock
         } : {},
@@ -12492,6 +13235,7 @@ function createInstanceSession(args) {
         },
         tick() {
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(tickScope.client);
                 await assertInstanceWriteAllowed({
                     instance: instance,
                     guards: heldGuards,
@@ -12507,7 +13251,8 @@ function createInstanceSession(args) {
                 }), cascaded = await cascadeHeld({
                     scope: tickScope,
                     actor: actor,
-                    held: held
+                    held: held,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return instance = await reload({
                     client: tickScope.client,
@@ -12526,6 +13271,7 @@ function createInstanceSession(args) {
         },
         fireAction({activity: activity, action: action, params: params}) {
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(fireScope.client);
                 assertActionAllowed({
                     evaluation: await evaluateWith({
                         held: held,
@@ -12546,6 +13292,7 @@ function createInstanceSession(args) {
                     } : {},
                     clientForGdr: fireScope.clientForGdr,
                     refSurface: fireScope.refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     ...grants !== void 0 ? {
                         grants: grants
                     } : {},
@@ -12565,7 +13312,8 @@ function createInstanceSession(args) {
                     actor: actor,
                     held: held,
                     ranOps: ranOps,
-                    scope: fireScope
+                    scope: fireScope,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return telemetry.log(WorkflowActionFired, actionFiredData({
                     instance: preOp,
@@ -12587,6 +13335,7 @@ function createInstanceSession(args) {
                 return Promise.reject(err);
             }
             return commit(async ({actor: actor, localPrincipalId: localPrincipalId}, held) => {
+                const memberRolesLoader = createAssignmentMemberRolesLoader(editScope.client);
                 assertEditAllowed(await evaluateWith({
                     held: held,
                     guards: heldGuards,
@@ -12608,6 +13357,7 @@ function createInstanceSession(args) {
                     } : {},
                     clientForGdr: editScope.clientForGdr,
                     refSurface: editScope.refSurface,
+                    memberRolesLoader: memberRolesLoader,
                     ...grants !== void 0 ? {
                         grants: grants
                     } : {},
@@ -12624,7 +13374,8 @@ function createInstanceSession(args) {
                     actor: actor,
                     held: held,
                     ranOps: ranOps,
-                    scope: editScope
+                    scope: editScope,
+                    memberRolesLoader: memberRolesLoader
                 });
                 return telemetry.log(WorkflowFieldEdited, fieldEditedData({
                     instance: preOp,
@@ -12943,8 +13694,11 @@ function attributeMember({member: member, group: group, chain: chain}) {
 }
 
 function diffEntry({def: rawDef, latestRaw: latestRaw, target: target}) {
-    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
-    const def = parseDefinitionInput(rawDef, "diffEntry"), plan = planDefinitionDeploy({
+    const def = parseDefinitionInput(rawDef, "diffEntry");
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel, {
+        requiredMinReaderModel: requiredDefinitionReaderModel([ def ])
+    });
+    const plan = planDefinitionDeploy({
         def: def,
         latest: asLatest(latestRaw),
         target: target
@@ -12975,10 +13729,13 @@ function asLatest(raw) {
 }
 
 async function computeDiffEntries({client: client, defs: defs, target: target}) {
-    assertReaderModelAcknowledgement(target.expectedMinReaderModel);
+    const definitions = defs.map(def => parseDefinitionInput(def, "computeDiffEntries"));
+    assertReaderModelAcknowledgement(target.expectedMinReaderModel, {
+        requiredMinReaderModel: requiredDefinitionReaderModel(definitions)
+    });
     const entries = [];
-    for (const rawDef of defs) {
-        const def = parseDefinitionInput(rawDef, "computeDiffEntries"), latest = await loadLatestDeployed({
+    for (const def of definitions) {
+        const latest = await loadLatestDeployed({
             client: client,
             definition: def.name,
             tag: target.tag
@@ -13065,7 +13822,7 @@ const HISTORY_DISPLAY = {
     },
     opApplied: {
         title: "Op applied",
-        description: "An inline field-mutation op (field.set / field.append / status.set / etc.) ran during an action commit."
+        description: "An action, direct edit, or effect completion executed an operation and recorded its audit payload."
     },
     fieldQueryDiscarded: {
         title: "Query result discarded",
@@ -13170,6 +13927,10 @@ const HISTORY_DISPLAY = {
         title: "Set field entry",
         description: "Overwrite a field entry's value with a resolved value expression."
     },
+    "field.setIfMissing": {
+        title: "Set field entry if missing",
+        description: "Set a nullable field entry's value only when it is currently null or undefined; array, assignees, and doc.refs entries are always arrays and are not supported."
+    },
     "field.unset": {
         title: "Unset field entry",
         description: "Reset a field entry to its default (null for scalars, [] for array kinds)."
@@ -13178,6 +13939,14 @@ const HISTORY_DISPLAY = {
         title: "Append to field entry",
         description: "Push a resolved item onto an array-kind entry (array, assignees, doc.refs)."
     },
+    "field.inc": {
+        title: "Increment field entry",
+        description: "Add a resolved numeric delta, defaulting to 1, to a number entry that already holds a finite number."
+    },
+    "field.dec": {
+        title: "Decrement field entry",
+        description: "Subtract a resolved numeric delta, defaulting to 1, from a number entry that already holds a finite number."
+    },
     "field.updateWhere": {
         title: "Update matching rows",
         description: "Merge declared sub-fields into rows of an `array` entry that match the `where` condition (`array` only — `doc.refs`/`assignees` rows are engine-shaped)."
@@ -13291,4 +14060,4 @@ function displayDescription(typeKey) {
     if (typeKey) return DISPLAY[typeKey]?.description;
 }
 
-export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findCurrentActivityEntry, findOpenStageEntry, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceDocId, instanceGuardQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };
+export { ACTION_SEMANTICS, ACTIVITY_KINDS, ACTIVITY_KIND_DISPLAY, ACTOR_KINDS, ANONYMOUS_IDENTITY, AUTHORING_DISPLAY, ActionDisabledError, ActionParamsInvalidError, CONDITION_VARS, CONTEXT_ENTRY_DISPLAY, CascadeLimitError, ConcurrentCommitEffectOpsError, ConcurrentCompleteEffectError, ConcurrentEditFieldError, ConcurrentFireActionError, ContractViolationError, DATA_MODEL_CHANGES, DATA_MODEL_MAX_READER, DATA_MODEL_MIN_READER, DATA_MODEL_VERSION, DECISION_SEMANTICS, DEFAULT_CONTENT_PERSPECTIVE, DEFAULT_EFFECT_LEASE_MS, DEFAULT_IDEMPOTENCY_TTL_MS, DEFAULT_TRANSITION_WHEN, DISPLAY, DRIVER_KINDS, DRIVER_KIND_DISPLAY, DefinitionInUseError, DefinitionNotFoundError, EFFECT_COMMIT_DISPATCH_CAP, EFFECT_COMMIT_QUEUE_DEPTH, ENGINE_API_VERSION, EXECUTION_KINDS, EXECUTOR_CLASSIFICATIONS, EXECUTOR_CLASSIFICATION_DISPLAY, EditFieldDeniedError, EffectCommitQueueOverflowError, EffectNotFoundError, EffectOpsInvalidError, EffectOutputsInvalidError, FIELD_KIND_DISPLAY, FILTER_SCOPE_VARS, FieldValueShapeError, GROUP_KINDS, GROUP_KIND_DISPLAY, GUARD_DOC_TYPE, GUARD_OWNER, GUARD_PREDICATE_VARS, HISTORY_DISPLAY, InitialFieldsInvalidError, InstanceNotFoundError, MAX_COUNTERFACTUAL_INDEX2 as MAX_COUNTERFACTUAL_INDEX, MissingHandlerError, ModelVersionAheadError, MutationGuardDeniedError, MutationGuardDocSchema, NEUTRAL_MARK, OP_DISPLAY, OUTCOME_MARKS, PartialGuardDeployError, PersistedDocShapeError, READER_MODEL_ROLLOUT_URL, RESERVED_CONDITION_VARS, ReaderModelAcknowledgementError, RefResourceUndeclaredError, RequiredFieldNotProvidedError, SIGNAL_SEMANTICS, START_FILTER_VARS, START_REQUIREMENT_VARS, SYSTEM_IDENTITY, SpawnContractsInvalidError, StaleEffectClaimError, StartNotAllowedError, StartNotPrimedError, StartNotSettledError, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, WorkflowActionFired, WorkflowActivityReset, WorkflowDefinitionDeleted, WorkflowDefinitionDeployed, WorkflowEffectCompleted, WorkflowEffectStateReported, WorkflowEffectsDrained, WorkflowError, WorkflowFieldEdited, WorkflowInstanceAborted, WorkflowInstancePreviewSchema, WorkflowInstanceSchema, WorkflowInstanceStarted, WorkflowInstanceTicked, WorkflowStageSet, WorkflowStageTransitioned, WorkflowStateDivergedError, abortReason, acceptsDocumentType, aclPathForResource, actionDisabledDetail, actionRendering, actionVerdict, activityAutonomyOf, actorFulfillsRole, analyzeCondition2 as analyzeCondition, applicableDefinitions, assertReadableModel, assertReaderModelAcknowledgement, atomReadsDataset2 as atomReadsDataset, autonomySummary, availableActions, buildInitialFields, buildSnapshot, checklistLines, classifyPrincipalId, clientConfigFromResource, clientProjectUserDirectory, compileGuard, computeDiffEntries, conditionFieldReadNames, conditionSitesOf, contentDocQuery, contentDraftFallback, contentReleaseName, contextMap, createEngine, createTelemetryIntake, datasetResourceParts, defaultLoggerFactory, definitionDeployedData, definitionLookupGroq, definitionTagsGroq, definitionsListGroq, deniedGuardLabels, deniedGuardRefs, denyingGuards, deployStageGuards, deployedTagsGroq, deriveActivityKind, deriveExecutorClassification, deriveWorkflowAutonomy, describeAtom, describeAutonomyWait, describeCondition, describeDefinition, describeFieldInsight, describeNode, describeSite, describeSiteHeading, diagnoseInputFromEvaluation, diagnoseInstance, diffEntry, displayDescription, displayTitle, documentActionDenials, documentPrefilter, documentStuckCause, driverKind, effectOutputsMap, entryDocRefs, errorMessage, evaluateFromSnapshot, evaluateMutationGuard, evaluateStartFilter, expandResourceAliases, explainCondition2 as explainCondition, explainStartRequirement, extractDocumentId, fieldTreeShape, findActivityNode, findCurrentActivityEntry, findOpenStageEntry, findStageNode, formatRead, gdrFromResource, gdrRef, gdrUri, groupMembershipNames, groupSitesOf, guardMatches, guardsForDefinition, guardsForInstance, guardsForResource, guillemets2 as guillemets, hasSingleSubjectRequirement, hashDefinitionContent, humanize2 as humanize, inFlightFilter, initialFieldIssues, instanceChangesQuery, instanceDocId, instanceGuardQuery, instancePreviewsQuery, instanceWatchesDocument, instancesGuardQuery, instancesQuery, isCascadeFired, isClaimExpired, isClientProjectUser, isComparisonOp, isDefinitionApplicable, isFilterScopedOut, isGdr, isInputSourced, isNotesEntry, isProjectUserNotFoundError, isRevisionConflict, isSingleDocRefEntry, isSingleDocRefKind, isStartableDefinition, isSubjectEntry, isTelemetryEnvDenied, isTerminalActivityStatus, isTerminalStage, isTodoListEntry, isTodoListItem, isUnprimed, lakeGuardId, lakePrincipalId, latestDefinitionsGroq, latestDeployedDefinitions, lintEffectOutputs, minReaderModelOf, missingRequiredInputs, modelVersionOf, narrateAutonomyWaits, noopTelemetry, parentRef, parseDefinitionInput, parseDefinitionSnapshot, parseDefinitionSnapshotValue, parseGdr, parseGuardDocument, parseInstanceDocument, parseInstancePreviewDocument, parseResourceGdr, processShellUserProperties, projectStartSliceRow, projectToWatchRef, quoted2 as quoted, readInstanceDoc, readInstancePreviewDoc, readsRaw, readsRootDocument, refCanvas, refDashboard, refDataset, refKindAcceptsTypes, refMediaLibrary, refsOf, rejectedRefTypes, releaseDocId, releaseRef, remediationsFor, requiredDefinitionReaderModel, requiredModelFeatures, requiredReaderModel, resolveAccess, resolveActor, resolveClientActor, resolveFieldEntry$1 as resolveFieldEntry, resolveUserAttributes, resourceAliasesToMap, resourceFromParsed, resourceGdr, retractStageGuards, sameResource, scalarValidationIssues, schemaTreeShape, sentenceCase, silentLogger, singleSubjectRequirementRefused, stageAutonomyOf, startFieldsParam, startKindOf, startRefusal, stripSystemFields, subjectDenialLabels, subscriptionDocument, subscriptionDocumentsForInstance, sweepStaleClaims, tagScopeFilter, terminalState, toBareId, tryParseGdr, unboundRequirementReads, unsatisfiedTransitionSummaries, userLoginProvider, validateDefinition, validateTag, verdictGuardsForInstance, wallClock, whatIfCondition2 as whatIfCondition, withAssignment, workflow };