@kici-dev/engine 0.5.0 → 0.6.0

package/dist/repo/pattern-negation.js

@@ -0,0 +1,86 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/repo/pattern-negation.ts
+/**
+* The one classifier for "picomatch would read this repo pattern as a
+* negation".
+*
+* Repo patterns are written on lists whose direction is already fixed by the
+* list itself — a role's allowed repositories, a global-workflow allow list, a
+* global-workflow deny list. A pattern picomatch reads as a negation inverts
+* that direction inside a single entry, so an entry that reads as a restriction
+* matches as its complement. On an allow list that grants almost everything; on
+* a deny list it admits the one repository the entry named.
+*
+* This lives in the engine, and not beside either consumer, because two
+* hand-maintained ban lists for one pattern language cannot be kept in step.
+* The two ways they drift apart are both live hazards: a list that misses the
+* regular-expression assertions accepts a real inversion, and a list that
+* refuses `[!…]` turns away a genuine restriction. Every surface that stores a
+* repo pattern reads its verdict from here, so neither can happen on one
+* surface alone.
+*/
+/**
+* The regular-expression negations picomatch passes through into the compiled
+* matcher: the negative lookahead `(?!…)` and the negative lookbehind `(?<!…)`.
+* The optional `<` is what makes one pattern cover both; the positive `(?=…)`,
+* `(?<=…)`, `(?:…)` and a plain capture group are deliberately not matched.
+*/
+const REGEX_NEGATIVE_ASSERTION = /\(\?<?!/;
+/**
+* Why picomatch would read `pattern` as a negation, or null when it would not.
+*
+* Four arms, because picomatch reads four negation forms, each of which turns a
+* pattern that reads as a restriction into a grant.
+*
+* A leading `!` negates the whole pattern. The extglob complement `!(…)`
+* negates wherever it appears, so `org/!(secret)` covers every repository under
+* `org/` except that one — the same defect in a prefix-scoped shape. The
+* negated character class `[^…]` does it one character at a time: `org/[^s]*`
+* covers every repository under `org/` whose name does not begin with `s`. The
+* negative assertions are the widest of the four, because they can spell a
+* whole repository identifier rather than one character: picomatch compiles a
+* pattern to a regular expression and passes a group it does not recognise
+* through verbatim, so `(?!org/secret)**` reaches the matcher as a real
+* lookahead and matches every repository in every organization except the one
+* it names.
+*
+* The extglob arm matches the two-character sequence `!(` and nothing wider:
+* `*(`, `+(`, `@(` and `?(` are the non-complementing extglob heads and do not
+* invert, so rejecting a bare `(` would refuse four harmless forms for no gain.
+* A `(` cannot appear in a repository identifier, so no legitimate pattern
+* contains `!(`. The assertion arm is narrow for the same reason: `(?=…)`,
+* `(?<=…)`, `(?:…)` and a plain capture group match strictly what they name, so
+* only the two negative forms are refused.
+*
+* The character-class arm matches `[^` and nothing wider: a `[` cannot appear
+* in a repository identifier either, and a bracket that is not a negation —
+* `org/[abc]*` — is a legitimate restriction. It matches `[^` and NOT `[!`:
+* picomatch does not read `[!…]` as the POSIX negation. It reads it as a
+* literal class containing `!` and the listed characters, so `org/[!s]*`
+* matches exactly the repositories whose name begins with `!` or `s` — the
+* exact inverse of `org/[^s]*`, and a genuine restriction. Rejecting it would
+* refuse a pattern that grants strictly less than it names while leaving the
+* real inversion open.
+*
+* A bare `!` is different — it *can* appear in a repository name — so the first
+* arm stays anchored: `org/we!rd` is a legitimate literal, and an
+* `includes('!')` check would silently reject a valid repository name.
+*/
+function negatedPatternReason(pattern) {
+	if (pattern.startsWith("!")) return "negation ('!' prefix)";
+	if (pattern.includes("!(")) return "extglob negation ('!(…)')";
+	if (pattern.includes("[^")) return "character-class negation ('[^…]')";
+	if (REGEX_NEGATIVE_ASSERTION.test(pattern)) return "negative assertion ('(?!…)' / '(?<!…)')";
+	return null;
+}
+/**
+* True when `pattern` is a picomatch negation — whole-pattern `!…`, extglob
+* `!(…)`, negated character class `[^…]`, or a negative lookahead / lookbehind.
+*/
+function isNegatedPattern(pattern) {
+	return negatedPatternReason(pattern) !== null;
+}
+//#endregion
+export { REGEX_NEGATIVE_ASSERTION, isNegatedPattern, negatedPatternReason };
+
+//# sourceMappingURL=pattern-negation.js.map

package/dist/scaler/registry-auth.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Registry-host extraction for container image references.
+ *
+ * Lives in the engine because three sites need the same answer: the agent's
+ * container sandbox, the container scaler backend, and the bare-metal backend
+ * in container mode. A private pull authenticates against the registry HOST,
+ * which is not a field of the image ref — it has to be derived from it.
+ */
+/**
+ * Registry host (a container runtime's `authconfig.serveraddress`) for an image ref.
+ *
+ * Docker's own rule: the first path segment is the registry only when it looks
+ * like a host — it contains a dot or a colon, or it is exactly `localhost`.
+ * Otherwise the ref is a Docker Hub short name (`nginx`, `acme/ci`) and the
+ * registry is `docker.io`.
+ */
+export declare function registryHostFromImageRef(image: string): string;
+//# sourceMappingURL=registry-auth.d.ts.map

package/dist/scaler/registry-auth.js

@@ -0,0 +1,28 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/scaler/registry-auth.ts
+/**
+* Registry-host extraction for container image references.
+*
+* Lives in the engine because three sites need the same answer: the agent's
+* container sandbox, the container scaler backend, and the bare-metal backend
+* in container mode. A private pull authenticates against the registry HOST,
+* which is not a field of the image ref — it has to be derived from it.
+*/
+/**
+* Registry host (a container runtime's `authconfig.serveraddress`) for an image ref.
+*
+* Docker's own rule: the first path segment is the registry only when it looks
+* like a host — it contains a dot or a colon, or it is exactly `localhost`.
+* Otherwise the ref is a Docker Hub short name (`nginx`, `acme/ci`) and the
+* registry is `docker.io`.
+*/
+function registryHostFromImageRef(image) {
+	const firstSlash = image.indexOf("/");
+	if (firstSlash === -1) return "docker.io";
+	const candidate = image.slice(0, firstSlash);
+	return candidate.includes(".") || candidate.includes(":") || candidate === "localhost" ? candidate : "docker.io";
+}
+//#endregion
+export { registryHostFromImageRef };
+
+//# sourceMappingURL=registry-auth.js.map

package/dist/scaler/scaler-backend-type.d.ts

@@ -9,8 +9,43 @@ import { z } from 'zod';
 export declare const ScalerBackendType: z.ZodEnum<{
     "bare-metal": "bare-metal";
     container: "container";
+    event: "event";
     firecracker: "firecracker";
     kubernetes: "kubernetes";
 }>;
 export type ScalerBackendType = z.infer<typeof ScalerBackendType>;
+/**
+ * Reserved event-name prefix for KiCI-internal system events (today: the event
+ * scaler's scale-up / scale-down events). Custom events emitted from user
+ * workflow steps (`ctx.emit(...)`) MUST NOT use this prefix — both the SDK
+ * (client-side) and the orchestrator (authoritative) reject a name that starts
+ * with it, so a user step cannot forge a system event. The rate limiter also
+ * exempts it. Defined in `@kici-dev/engine` so the SDK and the orchestrator
+ * share one source of truth without the SDK importing the orchestrator.
+ */
+export declare const KICI_EVENT_NAME_PREFIX = "kici.";
+/**
+ * Reserved event-name prefix for the events the ORCHESTRATOR mints for itself
+ * (`__schedule_fire`, `__workflow_complete`, `__job_complete`,
+ * `__workflows_failed_batch`).
+ *
+ * Reserved for the same reason as {@link KICI_EVENT_NAME_PREFIX}, and more
+ * sharply: every name under this prefix is exempt from the event-storm rate
+ * limiter, and `__schedule_fire` is additionally classified as a TRUSTED ref —
+ * no run causes it, so nothing external shaped it. The other three ARE caused
+ * by runs and inherit the tier of the run (or, for the failure batch, the most
+ * restrictive tier across the runs) behind them, so they forge no privilege on
+ * their own. A user step that could emit any of them would forge the
+ * rate-limiter exemption, and `__schedule_fire` the trusted classification on
+ * top of it — so the same two-sided reservation applies to the whole prefix,
+ * SDK first and orchestrator authoritatively.
+ */
+export declare const INTERNAL_EVENT_NAME_PREFIX = "__";
+/**
+ * The reserved prefix `eventName` uses, or `undefined` when a user step may
+ * emit it. One definition of "reserved", so the SDK-side check and the
+ * orchestrator's authoritative backstop can never disagree about which names a
+ * workflow may emit.
+ */
+export declare function reservedEventNamePrefix(eventName: string): string | undefined;
 //# sourceMappingURL=scaler-backend-type.d.ts.map

package/dist/scaler/scaler-backend-type.js

@@ -12,9 +12,46 @@ const ScalerBackendType = z.enum([
 	"container",
 	"bare-metal",
 	"firecracker",
-	"kubernetes"
+	"kubernetes",
+	"event"
 ]);
+/**
+* Reserved event-name prefix for KiCI-internal system events (today: the event
+* scaler's scale-up / scale-down events). Custom events emitted from user
+* workflow steps (`ctx.emit(...)`) MUST NOT use this prefix — both the SDK
+* (client-side) and the orchestrator (authoritative) reject a name that starts
+* with it, so a user step cannot forge a system event. The rate limiter also
+* exempts it. Defined in `@kici-dev/engine` so the SDK and the orchestrator
+* share one source of truth without the SDK importing the orchestrator.
+*/
+const KICI_EVENT_NAME_PREFIX = "kici.";
+/**
+* Reserved event-name prefix for the events the ORCHESTRATOR mints for itself
+* (`__schedule_fire`, `__workflow_complete`, `__job_complete`,
+* `__workflows_failed_batch`).
+*
+* Reserved for the same reason as {@link KICI_EVENT_NAME_PREFIX}, and more
+* sharply: every name under this prefix is exempt from the event-storm rate
+* limiter, and `__schedule_fire` is additionally classified as a TRUSTED ref —
+* no run causes it, so nothing external shaped it. The other three ARE caused
+* by runs and inherit the tier of the run (or, for the failure batch, the most
+* restrictive tier across the runs) behind them, so they forge no privilege on
+* their own. A user step that could emit any of them would forge the
+* rate-limiter exemption, and `__schedule_fire` the trusted classification on
+* top of it — so the same two-sided reservation applies to the whole prefix,
+* SDK first and orchestrator authoritatively.
+*/
+const INTERNAL_EVENT_NAME_PREFIX = "__";
+/**
+* The reserved prefix `eventName` uses, or `undefined` when a user step may
+* emit it. One definition of "reserved", so the SDK-side check and the
+* orchestrator's authoritative backstop can never disagree about which names a
+* workflow may emit.
+*/
+function reservedEventNamePrefix(eventName) {
+	for (const prefix of [KICI_EVENT_NAME_PREFIX, "__"]) if (eventName.startsWith(prefix)) return prefix;
+}
 //#endregion
-export { ScalerBackendType };
+export { INTERNAL_EVENT_NAME_PREFIX, KICI_EVENT_NAME_PREFIX, ScalerBackendType, reservedEventNamePrefix };
 
 //# sourceMappingURL=scaler-backend-type.js.map

package/dist/scaler/scaler-events.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared schemas and constants for the event scaler backend.
+ *
+ * The event scaler performs no local compute: its `spawn()` / `destroy()` emit
+ * reserved `kici.`-prefixed custom events (`kici.scaler.scale-up` /
+ * `kici.scaler.scale-down`) that a customer-authored provisioning / teardown
+ * workflow consumes via the `kiciEvent()` trigger. These schemas define the
+ * event payloads and the single source of truth for the reserved event names.
+ *
+ * They live here, not in the orchestrator, because both sides of the contract
+ * need them: the orchestrator emits, and a workflow file — which may import
+ * `@kici-dev/sdk` and nothing else — consumes. Engine is the only package both
+ * the SDK and the orchestrator depend on, so it is the shared floor. The SDK
+ * re-exports all four symbols; the orchestrator's `scaler/scaler-events.ts`
+ * re-exports them for its own call sites.
+ */
+import { z } from 'zod';
+/**
+ * Reserved event names the event scaler emits. Both start with
+ * `KICI_EVENT_NAME_PREFIX` (`./scaler-backend-type.ts`), so the rate limiter
+ * exempts them and user steps cannot forge them — `scaler-events.test.ts`
+ * asserts that relationship holds for both names.
+ */
+export declare const SCALER_EVENT_NAMES: {
+    readonly scaleUp: 'kici.scaler.scale-up';
+    readonly scaleDown: 'kici.scaler.scale-down';
+};
+/**
+ * Why the scaler asked for an agent to be torn down. Carried on the
+ * `kici.scaler.scale-down` event so a teardown workflow (and the timeline) can
+ * distinguish an idle reap from a job-complete teardown or a spawn timeout.
+ */
+export declare const ScaleDownReason: z.ZodEnum<{
+    drain: "drain";
+    "heartbeat-timeout": "heartbeat-timeout";
+    idle: "idle";
+    "job-complete": "job-complete";
+    shutdown: "shutdown";
+    "spawn-timeout": "spawn-timeout";
+}>;
+export type ScaleDownReason = z.infer<typeof ScaleDownReason>;
+/**
+ * Payload of a `kici.scaler.scale-up` event. Everything a provisioning workflow
+ * needs to boot an instance whose agent registers back with `agentId` and claim
+ * its ephemeral credentials with `claimCode`. The ephemeral token itself is
+ * NEVER in this payload — it is delivered only via the
+ * `scaler.claim-credentials` RPC response.
+ */
+export declare const ScalerScaleUpPayload: z.ZodObject<{
+    scalerName: z.ZodString;
+    agentId: z.ZodString;
+    labels: z.ZodArray<z.ZodString>;
+    mandatoryLabels: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    orchestratorUrl: z.ZodString;
+    claimCode: z.ZodString;
+    jobId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+export type ScalerScaleUpPayload = z.infer<typeof ScalerScaleUpPayload>;
+/**
+ * Payload of a `kici.scaler.scale-down` event. A teardown workflow deletes the
+ * instance registered under `agentId`.
+ */
+export declare const ScalerScaleDownPayload: z.ZodObject<{
+    scalerName: z.ZodString;
+    agentId: z.ZodString;
+    reason: z.ZodEnum<{
+        drain: "drain";
+        "heartbeat-timeout": "heartbeat-timeout";
+        idle: "idle";
+        "job-complete": "job-complete";
+        shutdown: "shutdown";
+        "spawn-timeout": "spawn-timeout";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+export type ScalerScaleDownPayload = z.infer<typeof ScalerScaleDownPayload>;
+//# sourceMappingURL=scaler-events.d.ts.map

package/dist/scaler/scaler-events.js

@@ -0,0 +1,87 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/scaler/scaler-events.ts
+/**
+* Shared schemas and constants for the event scaler backend.
+*
+* The event scaler performs no local compute: its `spawn()` / `destroy()` emit
+* reserved `kici.`-prefixed custom events (`kici.scaler.scale-up` /
+* `kici.scaler.scale-down`) that a customer-authored provisioning / teardown
+* workflow consumes via the `kiciEvent()` trigger. These schemas define the
+* event payloads and the single source of truth for the reserved event names.
+*
+* They live here, not in the orchestrator, because both sides of the contract
+* need them: the orchestrator emits, and a workflow file — which may import
+* `@kici-dev/sdk` and nothing else — consumes. Engine is the only package both
+* the SDK and the orchestrator depend on, so it is the shared floor. The SDK
+* re-exports all four symbols; the orchestrator's `scaler/scaler-events.ts`
+* re-exports them for its own call sites.
+*/
+/**
+* Reserved event names the event scaler emits. Both start with
+* `KICI_EVENT_NAME_PREFIX` (`./scaler-backend-type.ts`), so the rate limiter
+* exempts them and user steps cannot forge them — `scaler-events.test.ts`
+* asserts that relationship holds for both names.
+*/
+const SCALER_EVENT_NAMES = {
+	scaleUp: "kici.scaler.scale-up",
+	scaleDown: "kici.scaler.scale-down"
+};
+/**
+* Why the scaler asked for an agent to be torn down. Carried on the
+* `kici.scaler.scale-down` event so a teardown workflow (and the timeline) can
+* distinguish an idle reap from a job-complete teardown or a spawn timeout.
+*/
+const ScaleDownReason = z.enum([
+	"idle",
+	"job-complete",
+	"heartbeat-timeout",
+	"spawn-timeout",
+	"drain",
+	"shutdown"
+]);
+/**
+* Payload of a `kici.scaler.scale-up` event. Everything a provisioning workflow
+* needs to boot an instance whose agent registers back with `agentId` and claim
+* its ephemeral credentials with `claimCode`. The ephemeral token itself is
+* NEVER in this payload — it is delivered only via the
+* `scaler.claim-credentials` RPC response.
+*/
+const ScalerScaleUpPayload = z.object({
+	/** Name of the scaler entry that emitted the event. */
+	scalerName: z.string(),
+	/** Agent id the provisioned instance must register with (correlates the spawn). */
+	agentId: z.string(),
+	/** Exact label set the pending job needs. */
+	labels: z.array(z.string()),
+	/** Mandatory (taint) labels the pool gates on, if any. */
+	mandatoryLabels: z.array(z.string()).default([]),
+	/** Resolved resource hints for the provision (e.g. cpus / memBytes). */
+	resources: z.record(z.string(), z.unknown()).default({}),
+	/** Orchestrator WS URL the provisioned agent connects back to. */
+	orchestratorUrl: z.string(),
+	/** Single-use code the workflow exchanges for ephemeral agent credentials. */
+	claimCode: z.string(),
+	/** Execution job id the spawn is bound to (absent for unbound / warm spawns). */
+	jobId: z.string().optional(),
+	/** Correlation id for this scale-up request. */
+	requestId: z.string()
+});
+/**
+* Payload of a `kici.scaler.scale-down` event. A teardown workflow deletes the
+* instance registered under `agentId`.
+*/
+const ScalerScaleDownPayload = z.object({
+	/** Name of the scaler entry that emitted the event. */
+	scalerName: z.string(),
+	/** Agent id whose instance should be torn down. */
+	agentId: z.string(),
+	/** Why the teardown was requested. */
+	reason: ScaleDownReason,
+	/** Correlation id for this scale-down request. */
+	requestId: z.string()
+});
+//#endregion
+export { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload };
+
+//# sourceMappingURL=scaler-events.js.map

package/dist/trigger/content-requirements.js

@@ -19,7 +19,7 @@ import { parse } from "yaml";
 * of the browser-facing engine barrel (`src/index.ts`).
 */
 /** Hard byte cap enforced before any parse: an oversize file is indeterminate. */
-const MAX_CONTENT_BYTES = 1024 * 1024;
+const MAX_CONTENT_BYTES = 1048576;
 /**
 * Anchor/alias expansion cap for YAML parsing. The `yaml` library's default of
 * 100 does not reject a small billion-laughs bomb; 50 rejects it while staying

package/dist/trigger/decision-trace.d.ts

@@ -31,8 +31,28 @@ export interface WorkflowDecision {
     /** Summary reason */
     summary: string;
 }
+/**
+ * Max characters of any free-text field a trace entry carries, so an
+ * essay-length input stays bounded.
+ *
+ * The entry count is capped separately, downstream, but a count bound alone
+ * bounds nothing: a single `paths` entry names every changed file in the push
+ * and a single `bodyMatch` entry quotes a comment body an outsider authored, so
+ * fifty entries can still be megabytes. The forwarded trace rides one WebSocket
+ * frame to the Platform, and a frame past the server's payload ceiling closes
+ * the connection — stalling every delivery for that organization until it
+ * reconnects. Bounding at the point each field is minted is what makes the
+ * downstream size guards a backstop rather than the only limit.
+ */
+export declare const TRACE_TEXT_MAX = 200;
+/** Clamp one free-text trace field, marking a clamped value with an ellipsis. */
+export declare function truncateTraceText(text: string): string;
 /**
  * Create a new trace entry.
+ *
+ * Every free-text field is clamped here rather than at each call site: the
+ * fields are fed from event content of unbounded size, and one unclamped call
+ * site is enough to reintroduce an unbounded frame.
  */
 export declare function createTraceEntry(check: string, pattern: string, value: string, passed: boolean, reason?: string): TraceEntry;
 /**
@@ -54,6 +74,8 @@ export declare const TraceCheck: {
     readonly GlobalFilter: 'filter';
     /** Tier-0 declarative `commitMessage` filter, read from the normalized event. */
     readonly CommitMessage: 'commitMessage';
+    /** Materialization of a matched workflow's jobs, on the way to dispatch. */
+    readonly Dispatch: 'dispatch';
 };
 export type TraceCheck = (typeof TraceCheck)[keyof typeof TraceCheck];
 /**
@@ -96,6 +118,16 @@ export declare function createGlobalFilterTraceEntry(args: {
     indeterminate?: boolean;
     reason?: string;
 }): TraceEntry;
+/**
+ * Record that a matched workflow could not be materialized into jobs.
+ *
+ * A workflow whose triggers matched and whose build then threw is absent from
+ * every other record: no run row is created and no job is queued. Omitting it
+ * from the trace as well leaves its author unable to tell it apart from a
+ * workflow that was never registered — the exact indistinguishability the trace
+ * exists to remove.
+ */
+export declare function createDispatchFailureTraceEntry(reason: string): TraceEntry;
 /**
  * Return a copy of `decision` with `entries` appended to its checks.
  *
@@ -123,6 +155,53 @@ export declare function createCommitMessageTraceEntry(args: {
     indeterminate?: boolean;
     reason?: string;
 }): TraceEntry;
+/**
+ * What a withheld trace field is replaced with when the reader does not hold
+ * `event_log:read_payload`.
+ *
+ * Lives here rather than beside the Platform's redactor because three packages
+ * read it: the Platform writes it, the dashboard renders it, and the E2E suite
+ * asserts the permission boundary against it. A literal repeated at each site
+ * would drift into a marker one of them no longer recognizes.
+ */
+export declare const REDACTED_TRACE_FIELD = "[redacted \u2014 requires event_log:read_payload]";
+/**
+ * Workflow name the truncation marker carries.
+ *
+ * A reserved sentinel rather than a real workflow: it is written by one package
+ * and read back by two others, so a literal repeated at each site would drift
+ * into a marker nobody recognizes.
+ */
+export declare const TRACE_TRUNCATION_WORKFLOW_NAME = "(trace truncated)";
+/**
+ * Build the marker that stands in for the decisions a size budget dropped.
+ *
+ * The trace is truncated rather than discarded: a reader who is told nothing
+ * cannot tell "matching never ran" from "the trace was too large to keep", and
+ * those two have opposite answers to "why did my workflow not fire".
+ */
+export declare function createTraceTruncationMarker(omitted: number): Record<string, unknown>;
+/**
+ * UTF-8 byte length of `text`.
+ *
+ * Byte length, never `String.length`: the latter counts UTF-16 code units, so a
+ * CJK-heavy comment body measures at roughly a third of the bytes it actually
+ * costs on the wire and in the stored row.
+ */
+export declare function utf8ByteLength(text: string): number;
+/**
+ * Drop trailing decisions until the serialized array fits `maxBytes`, appending
+ * a marker naming how many were dropped.
+ *
+ * Shared by the orchestrator, which bounds what it puts on the wire, and the
+ * Platform, which bounds what it stores. Two independent budgets over one
+ * shape: keeping one implementation is what stops them from disagreeing about
+ * what a truncated trace looks like.
+ */
+export declare function truncateDecisionsToByteBudget<T>(decisions: readonly T[], maxBytes: number): {
+    decisions: Array<T | Record<string, unknown>>;
+    omitted: number;
+};
 /**
  * Create a workflow decision record.
  */