bazis 0.131.0 → 0.132.0

package/core/workflow/internal/WorkflowLanguages.ts

@@ -0,0 +1,35 @@
+import type { ConfigView } from "../../kernel";
+import type { WorkflowSettings } from "../contracts/Workflow.config";
+
+/**
+ * The language of a call (WORKFLOW-002 §6): over HTTP from `Accept-Language`
+ * among `workflow.languages`, otherwise `workflow.language`; in events, schedules
+ * and the background always `workflow.language`.
+ */
+export class WorkflowLanguages {
+  constructor(private readonly config: ConfigView<WorkflowSettings>) {}
+
+  get default(): string {
+    return this.config.get("language");
+  }
+
+  /** The best language of an `Accept-Language` header: by weight, then by order; `ru-RU` also finds `ru`. */
+  of(header: string | undefined): string {
+    if (header === undefined) return this.default;
+    const known = new Set([this.default, ...this.config.get("languages").split(",").map((item) => item.trim())]);
+    const wanted = header.split(",")
+      .map((part, index) => {
+        const [tag = "", ...parameters] = part.trim().split(";");
+        const weight = parameters.map((item) => /^\s*q=([\d.]+)\s*$/.exec(item)?.[1]).find((item) => item !== undefined);
+        return { tag: tag.trim(), weight: weight === undefined ? 1 : Number(weight), index };
+      })
+      .filter(({ tag, weight }) => tag !== "" && weight > 0)
+      .sort((a, b) => b.weight - a.weight || a.index - b.index);
+    for (const { tag } of wanted) {
+      if (known.has(tag)) return tag;
+      const base = tag.split("-")[0]!;
+      if (known.has(base)) return base;
+    }
+    return this.default;
+  }
+}

package/core/workflow/internal/canonicalJson.ts

@@ -0,0 +1,8 @@
+/** JSON with sorted keys: the same document gives the same hash whatever the key order. */
+export function canonicalJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson((value as Record<string, unknown>)[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}

package/core/workflow/internal/http.ts

@@ -2,14 +2,28 @@ import { IAccess, type AccessObject, type SubjectAccess } from "../../access";
 import { ForbiddenError, type HttpContext } from "../../http";
 import { frameworkBadRequest } from "../../http/Errors/HttpError";
 import { ListQueryError, parseListQuery, type ListQuery, type ListQueryOptions, type ListQueryProblem } from "../../../library/jsonapi";
+import { textOf, type LocalizedText } from "../../../library/workflow";
 import type { WorkflowActor, WorkflowPaging, WorkflowRequest } from "../contracts/types";
 import { WorkflowError } from "../contracts/WorkflowError";
+import { WorkflowLanguages } from "./WorkflowLanguages";
 
 /** Who calls a route: their rights and how they are recorded as an actor. */
 export interface WorkflowCaller {
   readonly access: SubjectAccess;
   readonly actor: WorkflowActor;
   readonly request: WorkflowRequest;
+  /** The language of the request: `Accept-Language` among `workflow.languages`. */
+  readonly language: string;
+}
+
+/** A record with `titleText`: its `title` in the language of the request. `title` itself stays for editing. */
+export function withTitleText<T extends { readonly title: LocalizedText }>(item: T, language: string, fallback: string): T & { readonly titleText: string } {
+  return { ...item, titleText: textOf(item.title, language, fallback) };
+}
+
+/** The default language, for {@link withTitleText}. */
+export function defaultLanguage(ctx: HttpContext): string {
+  return ctx.services.resolve(WorkflowLanguages).default;
 }
 
 /**
@@ -23,7 +37,7 @@ export async function callerOf(ctx: HttpContext, permission?: string, object?: A
   if (permission !== undefined && !await access.can(permission, object)) throw new ForbiddenError();
   const sub = access.subject.sub;
   const [id = sub.slice(sub.lastIndexOf(":") + 1)] = await access.ownerIds();
-  return { access, actor: { kind: "user", id }, request: { ip: ctx.clientIp ?? null, userAgent: ctx.header("user-agent") ?? null } };
+  return { access, actor: { kind: "user", id }, request: { ip: ctx.clientIp ?? null, userAgent: ctx.header("user-agent") ?? null }, language: ctx.services.resolve(WorkflowLanguages).of(ctx.header("accept-language")) };
 }
 
 /** A route parameter as a string. */
@@ -31,6 +45,11 @@ export function param(ctx: HttpContext, name: string): string {
   return String(ctx.params[name] ?? "");
 }
 
+/** A title or a description from a body; the service checks it. */
+export function optionalText(value: unknown): LocalizedText | null | undefined {
+  return value as LocalizedText | null | undefined;
+}
+
 /** The JSON body as an object; anything else is `invalid_input`. */
 export async function body(ctx: HttpContext): Promise<Record<string, unknown>> {
   const text = await ctx.text();

package/core/workflow/runtime_module/WorkflowRuntime.module.ts

@@ -5,7 +5,6 @@ import { WorkflowDefinitionsModule } from "../definitions_module/WorkflowDefinit
 import { runtimePermissions } from "./access/Runtime.permissions";
 import { WorkflowRetention } from "./background/WorkflowRetention";
 import { WorkflowWorker } from "./background/WorkflowWorker";
-import { workflowRuntimeConfig } from "./config/Runtime.config";
 import { EventsController } from "./http/Events.controller";
 import { InstancesController } from "./http/Instances.controller";
 import { GraphCache } from "./internal/GraphCache";
@@ -25,7 +24,6 @@ import { WorkflowRuntime } from "./services/WorkflowRuntime.service";
 @Module({
   imports: [AccessModule, WorkflowDefinitionsModule],
   permissions: runtimePermissions,
-  config: [workflowRuntimeConfig],
   ormBazis: { context: RuntimeDbContext, entities: [...RUNTIME_ENTITIES], ownedStore: runtimeStore, registerRepositories: false },
   providers: [
     singleton(GraphCache),

package/core/workflow/runtime_module/access/Runtime.permissions.ts

@@ -1,24 +1,26 @@
 import { definePermissions } from "../../../access";
+import { ProcessFolderLookup } from "../../definitions_module/access/ProcessFolder.lookup";
 
 const process = { ref: "workflow.process", column: "processKey" };
+const folder = { ref: "workflow.folder", lookup: ProcessFolderLookup };
 
 /** The rights of running processes (WORKFLOW-002 §6.2). */
 export const runtimePermissions = definePermissions({
   "workflow.instances.start": {
     title: { en: "Start processes", ru: "Запускать процессы" },
     scope: "request",
-    on: { process },
+    on: { process, folder },
   },
   "workflow.instances.read": {
     title: { en: "See instances", ru: "Видеть экземпляры" },
     scope: { column: "partition" },
-    on: { process },
+    on: { process, folder },
     owner: "startedById",
   },
   "workflow.instances.manage": {
     title: { en: "Cancel and retry instances", ru: "Отменять и повторять экземпляры" },
     scope: { column: "partition" },
-    on: { process },
+    on: { process, folder },
   },
   "workflow.events.emit": {
     title: { en: "Send events to processes", ru: "Отправлять события процессам" },

package/core/workflow/runtime_module/background/WorkflowRetention.ts

@@ -5,7 +5,7 @@ import { WorkflowClock } from "../../contracts/WorkflowClock";
 import { IWorkflowDefinitions } from "../../definitions_module/services/IWorkflowDefinitions.service";
 import { WORKFLOW_INSTANCES_DELETED } from "../events/Runtime.events";
 import { RuntimeDbContext } from "../model/Runtime.dbContext";
-import type { WorkflowSettings } from "../config/Runtime.config";
+import type { WorkflowSettings } from "../../contracts/Workflow.config";
 
 const DAY_MS = 86_400_000;
 

package/core/workflow/runtime_module/background/WorkflowWorker.ts

@@ -2,14 +2,14 @@ import { BackgroundService, delay } from "../../../background";
 import type { ServiceProvider } from "../../../di";
 import { WorkflowClock } from "../../contracts/WorkflowClock";
 import type { ConfigView } from "../../../kernel";
-import type { WorkflowSettings } from "../config/Runtime.config";
+import type { WorkflowSettings } from "../../contracts/Workflow.config";
 import { WorkflowJobs } from "../internal/WorkflowJobs";
 
 /** How often the scheduled starts are matched against the published versions. */
 const RECONCILE_MS = 60_000;
 
 /**
- * Takes due jobs of `bazis_wf_run_jobs` every `worker.intervalMs`, up to
+ * Takes due jobs of `bazis_wf2_run_jobs` every `worker.intervalMs`, up to
  * `worker.batchSize` at a time ({@link WorkflowJobs}). A full batch is
  * followed by the next one at once.
  */

package/core/workflow/runtime_module/events/Runtime.events.ts

@@ -1,5 +1,5 @@
 import { createEventToken } from "../../../kernel";
-import type { FormSpec } from "../../../../library/workflow";
+import type { FormSpec, LocalizedText } from "../../../../library/workflow";
 import type { WorkflowActor, WorkflowRequest } from "../../contracts/types";
 import type { InstanceStatus, StartedVia } from "../model/WfInstance.model";
 
@@ -10,7 +10,7 @@ export interface WorkflowTaskRequested {
   readonly processKey: string;
   readonly nodeId: string;
   readonly partition: string | null;
-  readonly title: string;
+  readonly title: LocalizedText;
   readonly assignee: { readonly role: string } | { readonly user: string };
   readonly form: FormSpec | null;
   /** When the task is due, from the node's `dueIn`. */

package/core/workflow/runtime_module/http/Instances.controller.ts

@@ -4,12 +4,16 @@ import { Authorize, Controller, Created, Get, Post, type HttpContext } from "../
 import { buildListDocument } from "../../../../library/jsonapi";
 import { body, callerOf, filterOf, listQuery, optionalString, pagingOfList, param, requiredString } from "../../internal/http";
 import type { InstanceStatus } from "../model/WfInstance.model";
+import { IWorkflowDefinitions } from "../../definitions_module/services/IWorkflowDefinitions.service";
 import { IWorkflowRuntime, type InstanceSummary } from "../services/IWorkflowRuntime.service";
 
 /** Instances over HTTP (WORKFLOW-001 §4); rights are `workflow.instances.*` (WORKFLOW-002 §6.2). */
 @Controller("workflow/instances")
 export class InstancesController {
-  constructor(private readonly runtime: IWorkflowRuntime) {}
+  constructor(
+    private readonly runtime: IWorkflowRuntime,
+    private readonly definitions: IWorkflowDefinitions,
+  ) {}
 
   @Post()
   @Authorize(can("workflow.instances.start"))
@@ -17,13 +21,14 @@ export class InstancesController {
     const request = await body(ctx);
     const processKey = requiredString(request.processKey, "processKey", 64);
     const partition = optionalString(request.partition, "partition") ?? null;
-    const { actor, request: from } = await callerOf(ctx, "workflow.instances.start", { scope: partition, process: processKey });
+    const { actor, request: from, language } = await callerOf(ctx, "workflow.instances.start", { scope: partition, process: processKey, folder: await this.definitions.folderOf(processKey) });
     const instance = await this.runtime.start(processKey, {
       input: request.input,
       partition,
       businessKey: optionalString(request.businessKey, "businessKey") ?? null,
       actor,
       request: from,
+      language,
     });
     return Created(`${ctx.path}/${instance.id}`, instance);
   }
@@ -52,7 +57,7 @@ export class InstancesController {
   @Authorize(can("workflow.instances.read"))
   async get(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
+    await callerOf(ctx, "workflow.instances.read", await this.objectOf(instance));
     return instance;
   }
 
@@ -60,7 +65,7 @@ export class InstancesController {
   @Authorize(can("workflow.instances.read"))
   async history(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    await callerOf(ctx, "workflow.instances.read", objectOf(instance));
+    await callerOf(ctx, "workflow.instances.read", await this.objectOf(instance));
     return { data: await this.runtime.history(instance.id) };
   }
 
@@ -69,7 +74,7 @@ export class InstancesController {
   async cancel(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
     const request = await body(ctx);
-    const { actor, request: from } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
+    const { actor, request: from } = await callerOf(ctx, "workflow.instances.manage", await this.objectOf(instance));
     return await this.runtime.cancel(instance.id, { reason: optionalString(request.reason, "reason", 1000) ?? null, actor, request: from });
   }
 
@@ -77,14 +82,14 @@ export class InstancesController {
   @Authorize(can("workflow.instances.manage"))
   async retry(ctx: HttpContext) {
     const instance = await this.runtime.instance(param(ctx, "id"));
-    const { actor, request } = await callerOf(ctx, "workflow.instances.manage", objectOf(instance));
+    const { actor, request } = await callerOf(ctx, "workflow.instances.manage", await this.objectOf(instance));
     return await this.runtime.retry(instance.id, { actor, request });
   }
-}
-contextOnlyController(InstancesController);
 
-/** The instance as the object of a permission. */
-function objectOf(instance: InstanceSummary): AccessObject {
-  return { scope: instance.partition, process: instance.processKey, startedById: instance.startedBy.id };
+  /** The instance as the object of a permission. */
+  private async objectOf(instance: InstanceSummary): Promise<AccessObject> {
+    return { scope: instance.partition, process: instance.processKey, folder: await this.definitions.folderOf(instance.processKey), startedById: instance.startedBy.id };
+  }
 }
+contextOnlyController(InstancesController);
 

package/core/workflow/runtime_module/internal/Schedules.ts

@@ -1,4 +1,4 @@
-import { parseCron } from "../../../../library/workflow";
+import { inputSpecOf, parseCron, validateForm } from "../../../../library/workflow";
 import type { IWorkflowDefinitions, VersionDetails } from "../../definitions_module/services/IWorkflowDefinitions.service";
 import type { RuntimeDbContext } from "../model/Runtime.dbContext";
 import { WfJob } from "../model/WfJob.model";
@@ -65,7 +65,7 @@ export class Schedules {
       else await this.db.jobs.asNoTracking().where((j) => j.id.eq(job.id)).executeUpdate({ dueAt: next, lockedUntil: null, attempts: 0, lastError: null });
       for (const [nodeId, cron] of scheduleNodes(latest)) {
         if (!cron.matches(due)) continue;
-        await this.engine.begin(graph, nodeId, { input: {}, partition: null, businessKey: null, startedVia: "schedule", actor: SCHEDULE_ACTOR });
+        await this.engine.begin(graph, nodeId, { input: validateForm(inputSpecOf(latest.document), {}).value, partition: null, businessKey: null, startedVia: "schedule", actor: SCHEDULE_ACTOR });
       }
     });
   }

package/core/workflow/runtime_module/internal/ToolStep.ts

@@ -1,5 +1,5 @@
-import type { AgentToolResult } from "../../../agent";
-import { durationMs, resolveInput } from "../../../../library/workflow";
+import type { AgentSchemaContract, AgentToolResult } from "../../../agent";
+import { durationMs, maskByMapping, maskBySchema, masksPersonal, personalPaths, resolveInput, type ProcessDocument } from "../../../../library/workflow";
 import type { WorkflowToolMetadata } from "../../contracts/types";
 import type { WorkflowTools } from "../../internal/WorkflowTools";
 import type { RuntimeDbContext } from "../model/Runtime.dbContext";
@@ -13,6 +13,11 @@ import { dataOf, type WorkflowEngine } from "./WorkflowEngine";
  * started the instance, with the token id as its idempotency key: after a crash
  * between the call and the step the call may repeat (TOOLS-001 §7).
  */
+/** How long a claimed job belongs to its worker; if it dies, another one takes the job after that. */
+export const LEASE_MS = 5 * 60_000;
+
+const TIMEOUT_CODES: ReadonlySet<string> = new Set(["TOOL_TIMEOUT", "TOOL_TIMEOUT_OUTCOME_UNKNOWN"]);
+
 export class ToolStep {
   constructor(
     private readonly db: RuntimeDbContext,
@@ -30,7 +35,12 @@ export class ToolStep {
     const graph = await this.engine.graphOf(instance.versionId);
     const node = graph.document.nodes[token.nodeId];
     const name = String(node?.config?.tool ?? "");
-    const input = resolveInput(node?.config?.input ?? {}, dataOf(instance));
+    const input = resolveInput(node?.config?.input ?? {}, dataOf(instance, this.engine.now()));
+    const timeoutMs = stepTimeoutMs(node?.config?.timeout, graph.document);
+    // A step may run longer than the lease: another worker must not take the job and call the Tool again meanwhile.
+    if (timeoutMs !== undefined && timeoutMs >= LEASE_MS) {
+      await this.db.jobs.asNoTracking().where((j) => j.id.eq(job.id)).executeUpdate({ lockedUntil: new Date(this.engine.now().getTime() + timeoutMs + LEASE_MS) });
+    }
     const runner = this.tools.bound;
     const result: AgentToolResult = runner === undefined
       ? { callId: token.id, name, status: "error", error: { code: "TOOL_NOT_FOUND", message: `Tool ${name} is not available to processes` }, metadata: {} } as AgentToolResult
@@ -39,12 +49,15 @@ export class ToolStep {
         actor: { kind: instance.startedByKind, id: instance.startedById },
         metadata: { instanceId: instance.id, processKey: instance.processKey, nodeId: token.nodeId, partition: instance.partition, test: false } satisfies WorkflowToolMetadata,
         signal,
+        ...(timeoutMs === undefined ? {} : { timeoutMs }),
       });
 
-    const reason = reasonOf(result);
+    const timedOut = TIMEOUT_CODES.has(result.error?.code ?? "");
+    const reason = timedOut ? "timeout" : reasonOf(result);
+    const payloads = graph.document.settings?.log?.toolPayloads === true ? this.payloads(graph.document, name, node?.config?.input, input, result) : {};
     await this.engine.inStep(instance.id, async (step) => {
       const current = step.tokens.find((t) => t.id === token.id);
-      const retryAt = current?.status === "waiting" && step.instance.status === "running" && result.status === "error" && reason === undefined
+      const retryAt = current?.status === "waiting" && step.instance.status === "running" && result.status === "error" && (reason === undefined || timedOut)
         ? nextAttempt(node?.config?.retry, job.attempts, this.engine.now())
         : undefined;
       if (retryAt !== undefined) {
@@ -59,6 +72,7 @@ export class ToolStep {
         status: result.status,
         attempt: job.attempts,
         durationMs: result.durationMs ?? null,
+        ...payloads,
         ...(result.error ? { error: { code: result.error.code ?? null, message: result.error.message, ...(reason === undefined ? {} : { reason }) } } : {}),
         ...(retryAt === undefined ? {} : { retryAt: retryAt.toISOString() }),
       });
@@ -74,6 +88,15 @@ export class ToolStep {
       }
     });
   }
+
+  /** The input and output for the history under `log.toolPayloads`; personal data is masked unless `log.maskPersonal` is `false`. */
+  private payloads(document: ProcessDocument, name: string, mapping: unknown, input: unknown, result: AgentToolResult): Record<string, unknown> {
+    if (!masksPersonal(document)) return { input, output: result.output ?? null };
+    const contract = this.tools.bound?.describe(name);
+    const schemaOf = (side: AgentSchemaContract | undefined) => (side?.kind === "json-schema" ? side.schema : undefined);
+    const masked = maskByMapping(mapping ?? {}, maskBySchema(input, schemaOf(contract?.input)), personalPaths(document));
+    return { input: masked, output: maskBySchema(result.output ?? null, schemaOf(contract?.output)) };
+  }
 }
 
 /** The business reason of a `ToolError`, if the Tool gave one. */
@@ -83,15 +106,23 @@ function reasonOf(result: AgentToolResult): string | undefined {
   return typeof reason === "string" ? reason : undefined;
 }
 
+/** How long a step's Tool may run: its `timeout`, else `settings.stepTimeout`; `undefined` leaves the Tool's own limit. */
+function stepTimeoutMs(timeout: unknown, document: ProcessDocument): number | undefined {
+  const value = typeof timeout === "string" ? timeout : document.settings?.stepTimeout;
+  return value === undefined ? undefined : durationMs(value);
+}
+
 /**
  * When to try a failed call again under the node's `retry` policy, or
- * `undefined` when the attempts are used up. The pause doubles from `backoff`
- * (10 seconds by default) and stops growing at a day.
+ * `undefined` when the attempts are used up. The pause starts at `backoff` (10
+ * seconds by default), grows by `factor` (2 by default) unless `growth` is
+ * `fixed`, and stops growing at a day.
  */
 export function nextAttempt(policy: unknown, attempts: number, now: Date): Date | undefined {
   if (typeof policy !== "object" || policy === null) return undefined;
-  const { maxAttempts, backoff } = policy as { maxAttempts?: unknown; backoff?: unknown };
+  const { maxAttempts, backoff, growth, factor } = policy as { maxAttempts?: unknown; backoff?: unknown; growth?: unknown; factor?: unknown };
   if (typeof maxAttempts !== "number" || attempts >= maxAttempts) return undefined;
   const base = typeof backoff === "string" ? durationMs(backoff) ?? 10_000 : 10_000;
-  return new Date(now.getTime() + Math.min(base * 2 ** Math.max(attempts - 1, 0), 86_400_000));
+  const scale = growth === "fixed" ? 1 : (typeof factor === "number" ? factor : 2) ** Math.max(attempts - 1, 0);
+  return new Date(now.getTime() + Math.min(base * scale, 86_400_000));
 }

package/core/workflow/runtime_module/internal/WorkflowEngine.ts

@@ -1,5 +1,5 @@
 import type { EventToken } from "../../../kernel";
-import { durationMs, evaluateCondition, nodeKindOf, readPath, type FormSpec, type InstanceData, type ProcessFlow, type ProcessNode } from "../../../../library/workflow";
+import { durationMs, evaluateExpression, initialVarsOf, isTruthy, masksPersonal, maskByMapping, nodeKindOf, outputOf, personalPaths, personalVariables, PERSONAL_MASK, readPath, type Expr, type FormSpec, type InstanceData, type ProcessFlow, type ProcessNode } from "../../../../library/workflow";
 import type { WorkflowActor, WorkflowRequest } from "../../contracts/types";
 import type { WorkflowClock } from "../../contracts/WorkflowClock";
 import type { IWorkflowDefinitions, VersionDetails } from "../../definitions_module/services/IWorkflowDefinitions.service";
@@ -38,6 +38,8 @@ export interface BeginOptions {
   readonly actor: WorkflowActor;
   /** Where the start came from; `null` for code, schedules and the worker. */
   readonly request?: WorkflowRequest | null;
+  /** The event that starts it: `$event` and `$trigger.eventKey`. */
+  readonly event?: { readonly key: string; readonly payload: unknown };
 }
 
 const LIVE = new Set(["active", "waiting", "failed"]);
@@ -86,6 +88,14 @@ export class WorkflowEngine {
       version: graph.version,
       partition: options.partition,
       input: options.input,
+      vars: initialVarsOf(graph.document),
+      event: options.event?.payload ?? null,
+      trigger: {
+        via: options.startedVia,
+        at: this.now().toISOString(),
+        actor: options.actor,
+        ...(options.event === undefined ? {} : { eventKey: options.event.key }),
+      },
       businessKey: options.businessKey,
       startedVia: options.startedVia,
       startedByKind: options.actor.kind,
@@ -150,13 +160,20 @@ export class WorkflowEngine {
   /**
    * A step's Tool failed for good. An error boundary attached to the step takes
    * the token (first one whose `errorCode` equals the Tool's `reason` or error
-   * code, else one without `errorCode`); otherwise the instance fails.
+   * code, else one without `errorCode`); otherwise `onError: "skip"` moves on with
+   * `{ skipped: true, error }`; otherwise the instance fails.
    */
   async failStep(step: Step, token: WfToken, error: { readonly code: string; readonly message: string; readonly reason?: string }): Promise<void> {
     const boundaries = (step.graph.boundaries.get(token.nodeId) ?? []).filter(([, node]) => node.kind === "boundaryError");
     const matching = boundaries.find(([, node]) => node.config?.errorCode !== undefined && (node.config.errorCode === error.reason || node.config.errorCode === error.code))
       ?? boundaries.find(([, node]) => node.config?.errorCode === undefined);
     if (!matching) {
+      if (step.graph.document.nodes[token.nodeId]?.config?.onError === "skip") {
+        const skipped = { code: error.code, message: error.message, ...(error.reason === undefined ? {} : { reason: error.reason }) };
+        this.history(step, token, token.nodeId, "skipped", skipped);
+        await this.complete(step, token.id, { skipped: true, error: skipped });
+        return;
+      }
       this.fail(step, token, error.code, error.message);
       return;
     }
@@ -197,6 +214,7 @@ export class WorkflowEngine {
     const token = step.tokens.find((t) => t.id === tokenId);
     if (!token || token.status !== "waiting" || step.instance.status !== "running") return false;
     const node = step.graph.document.nodes[token.nodeId];
+    if (node?.kind === "eventWait" || node?.kind === "boundaryEvent") step.instance.event = payload;
     if (node?.kind === "eventWait") {
       this.history(step, token, token.nodeId, "event", { event: eventKey });
       return await this.complete(step, tokenId, payload);
@@ -298,6 +316,7 @@ export class WorkflowEngine {
     if (step.instance.status === "running" && !step.tokens.some((t) => LIVE.has(t.status))) {
       step.instance.status = "completed";
       step.instance.endedAt = this.now();
+      step.instance.output = outputOf(step.graph.document, step.instance.vars);
       this.history(step, null, null, "completed", null);
       this.finished(step, "completed");
     }
@@ -319,6 +338,8 @@ export class WorkflowEngine {
     // An error boundary that caught a step's failure: it only leads on.
     if (role === "boundary") return this.leave(step, token, this.single(step, token.nodeId));
     switch (node.kind) {
+      case "assign":
+        return this.assign(step, token, node);
       case "serviceTask":
         return this.arm(step, token, this.waitForTool(step, token));
       case "userTask":
@@ -337,8 +358,28 @@ export class WorkflowEngine {
     }
   }
 
+  /**
+   * An `assign` step: each value sees the ones before it. The history names the
+   * variables; their values go there only under `log.variables`, personal ones masked.
+   */
+  private assign(step: Step, token: WfToken, node: ProcessNode): WfToken[] {
+    const { document } = step.graph;
+    const assignments = (node.config?.assignments ?? []) as readonly { readonly var: string; readonly value: Expr }[];
+    const personal = masksPersonal(document) ? personalVariables(document) : new Set<string>();
+    const reads = masksPersonal(document) ? personalPaths(document) : new Set<string>();
+    const logged: Record<string, unknown> = {};
+    for (const { var: name, value } of assignments) {
+      const result = evaluateExpression(value, dataOf(step.instance, this.now())) ?? null;
+      step.instance.vars = { ...step.instance.vars, [name]: result };
+      logged[name] = personal.has(name) ? PERSONAL_MASK : maskByMapping(value, result, reads);
+    }
+    const log = document.settings?.log?.variables === true;
+    this.history(step, token, token.nodeId, "assigned", log ? { values: logged } : { vars: assignments.map((item) => item.var) });
+    return this.leave(step, token, this.single(step, token.nodeId));
+  }
+
   private waitForTimer(step: Step, token: WfToken, node: ProcessNode): WfToken[] {
-    const dueAt = timerDue(node.config ?? {}, dataOf(step.instance), this.now());
+    const dueAt = timerDue(node.config ?? {}, dataOf(step.instance, this.now()), this.now());
     if (dueAt === undefined) {
       this.fail(step, token, "bad_timer", `the timer of ${token.nodeId} has no valid date`);
       return [];
@@ -356,7 +397,7 @@ export class WorkflowEngine {
     if (host.status !== "waiting") return next;
     for (const [id, node] of step.graph.boundaries.get(host.nodeId) ?? []) {
       if (node.kind === "boundaryEvent") {
-        const correlation = correlationOf(node.config ?? {}, dataOf(step.instance));
+        const correlation = correlationOf(node.config ?? {}, dataOf(step.instance, this.now()));
         if (correlation === undefined) {
           this.fail(step, host, "bad_correlation", `the correlation of ${id} has no value`);
           return [];
@@ -367,7 +408,7 @@ export class WorkflowEngine {
         continue;
       }
       if (node.kind !== "boundaryTimer") continue;
-      const dueAt = timerDue(node.config ?? {}, dataOf(step.instance), this.now());
+      const dueAt = timerDue(node.config ?? {}, dataOf(step.instance, this.now()), this.now());
       if (dueAt === undefined) {
         this.fail(step, host, "bad_timer", `the timer of ${id} has no valid date`);
         return [];
@@ -389,7 +430,7 @@ export class WorkflowEngine {
   }
 
   private waitForEvent(step: Step, token: WfToken, node: ProcessNode): WfToken[] {
-    const correlation = correlationOf(node.config ?? {}, dataOf(step.instance));
+    const correlation = correlationOf(node.config ?? {}, dataOf(step.instance, this.now()));
     if (correlation === undefined) {
       this.fail(step, token, "bad_correlation", `the correlation of ${token.nodeId} has no value`);
       return [];
@@ -441,8 +482,8 @@ export class WorkflowEngine {
   private choose(step: Step, token: WfToken): WfToken[] {
     const flows = step.graph.outgoing.get(token.nodeId) ?? [];
     if (flows.length === 1) return this.leave(step, token, flows[0]!);
-    const data = dataOf(step.instance);
-    const chosen = flows.find(([, flow]) => flow.condition !== undefined && evaluateCondition(flow.condition, data))
+    const data = dataOf(step.instance, this.now());
+    const chosen = flows.find(([, flow]) => flow.condition !== undefined && isTruthy(evaluateExpression(flow.condition, data)))
       ?? flows.find(([, flow]) => flow.isDefault === true);
     if (!chosen) {
       this.fail(step, token, "no_branch", "no condition matched and there is no default flow");
@@ -539,6 +580,15 @@ export function correlationOf(config: Readonly<Record<string, unknown>>, data: I
   return value === undefined || value === null || value === "" || typeof value === "object" ? undefined : String(value);
 }
 
-export function dataOf(instance: WfInstance): InstanceData {
-  return { input: instance.input, vars: instance.vars, nodes: instance.nodes };
+/** What expressions read in an instance at this moment of the engine's clock. */
+export function dataOf(instance: WfInstance, now: Date): InstanceData {
+  return {
+    input: instance.input,
+    vars: instance.vars,
+    nodes: instance.nodes,
+    event: instance.event,
+    trigger: instance.trigger,
+    run: { id: instance.id, processKey: instance.processKey, version: instance.version, partition: instance.partition, test: instance.test },
+    now: now.toISOString(),
+  };
 }

package/core/workflow/runtime_module/internal/WorkflowJobs.ts

@@ -4,11 +4,9 @@ import { RuntimeDbContext } from "../model/Runtime.dbContext";
 import type { WfJob } from "../model/WfJob.model";
 import { Schedules } from "./Schedules";
 import { TimerStep } from "./TimerStep";
-import { ToolStep } from "./ToolStep";
+import { LEASE_MS, ToolStep } from "./ToolStep";
 import { WorkflowEngine } from "./WorkflowEngine";
 
-/** How long a claimed job belongs to its worker; if it dies, another one takes the job after that. */
-const LEASE_MS = 5 * 60_000;
 /** A job that keeps failing outside its Tool (the database, a lost version) fails its step after this many tries. */
 const MAX_JOB_ATTEMPTS = 5;
 
@@ -16,7 +14,7 @@ const MAX_JOB_ATTEMPTS = 5;
 export type JobFailureReport = (message: string, error: unknown, fields?: Readonly<Record<string, unknown>>) => void;
 
 /**
- * Claiming and running jobs of `bazis_wf_run_jobs`: the work of the worker, and
+ * Claiming and running jobs of `bazis_wf2_run_jobs`: the work of the worker, and
  * of `drain` in tests. Every job runs in its own DI scope.
  */
 export class WorkflowJobs {

package/core/workflow/runtime_module/model/Runtime.dbContext.ts

@@ -19,7 +19,7 @@ export const RUNTIME_ENTITIES = [WfInstance, WfToken, WfJob, WfSubscription, WfH
 /** The tables of the Runtime part: bazis creates and checks them in the application database. */
 export const runtimeStore = defineOrmOwnedStoreV1({
   contract: "bazis.orm-owned-store/v1",
-  storeKey: "bazis.workflow.runtime",
+  storeKey: "bazis.workflow.runtime.v2",
   formatVersion: 1,
-  ownedScope: { schema: "public", tablePrefix: "bazis_wf_run_" },
+  ownedScope: { schema: "public", tablePrefix: "bazis_wf2_run_" },
 });

package/core/workflow/runtime_module/model/WfHistory.model.ts

@@ -1,12 +1,12 @@
 import { Column, Entity, ForeignKey, Index, UUID } from "../../../orm";
 import { WfInstance } from "./WfInstance.model";
 
-export type HistoryType = "started" | "entered" | "left" | "tool" | "timer" | "event" | "error" | "retried" | "cancelled" | "completed";
+export type HistoryType = "started" | "entered" | "left" | "tool" | "assigned" | "skipped" | "timer" | "event" | "error" | "retried" | "cancelled" | "completed";
 
 /** The journal of an instance, append only. Its v7 ids give the order. */
 @ForeignKey(() => WfInstance, { properties: ["instanceId"], onDelete: "cascade" })
 @Index(["instanceId", "id"])
-@Entity({ table: "bazis_wf_run_history" })
+@Entity({ table: "bazis_wf2_run_history" })
 export class WfHistory {
   @UUID({ version: "v7" })
   id = "";