bunqueue-dashboard 0.0.35 → 0.0.36

package/agent/server/handler.ts

@@ -0,0 +1,146 @@
+import { BunqueueBackupRunner, type BackupRunnerPort } from '../backup/runner';
+import type { ProcessManager } from '../manager';
+import { QueueOperationsRuntime } from '../queue/runtime';
+import type { QueueOperationsPort } from '../queue/types';
+import { WorkflowRuntime, type WorkflowRuntimePort } from '../workflow/runtime';
+import { errorMessage, errorStatus } from './errors';
+import { AgentLifecycleGate, type AgentLifecyclePort } from './lifecycle';
+import { corsHeaders, isHostAllowed, isOriginAllowed, tokenOk } from './policy';
+import { routeAgentRequest } from './router';
+import type { AgentFetchHandler, AgentOptions, RouteResponse } from './types';
+
+function responseOf(
+  result: RouteResponse | Response | null,
+  origin: string | null,
+  allowedOrigins: string[]
+): Response {
+  if (result instanceof Response) return result;
+  const routed = result ?? { status: 404, body: { ok: false, error: 'Not found' } };
+  return new Response(JSON.stringify(routed.body), {
+    status: routed.status,
+    headers: {
+      'Content-Type': 'application/json',
+      ...corsHeaders(origin, allowedOrigins),
+    },
+  });
+}
+
+/** Build a network-independent request handler with persistent SDK resources. */
+export function createFetchHandler(
+  manager: ProcessManager,
+  options: AgentOptions,
+  runtime: WorkflowRuntimePort = new WorkflowRuntime(),
+  backupRunner: BackupRunnerPort = new BunqueueBackupRunner(),
+  queueRuntime: QueueOperationsPort = new QueueOperationsRuntime(),
+  lifecycle: AgentLifecyclePort = new AgentLifecycleGate()
+): AgentFetchHandler {
+  const {
+    allowedOrigins,
+    allowedHosts,
+    token,
+    requireTokenForAll = false,
+  } = options;
+  const json = (body: unknown, status: number, origin: string | null) =>
+    responseOf({ body, status }, origin, allowedOrigins);
+
+  const handle = async (request: Request): Promise<Response> => {
+    const { pathname } = new URL(request.url);
+    const method = request.method;
+    const origin = request.headers.get('origin');
+    if (!isHostAllowed(request.headers.get('host'), allowedHosts)) {
+      return json({ ok: false, error: 'Host not allowed' }, 403, origin);
+    }
+    if (!isOriginAllowed(origin, allowedOrigins)) {
+      return json({ ok: false, error: 'Origin not allowed' }, 403, origin);
+    }
+    if (method === 'OPTIONS') {
+      return new Response(null, { status: 204, headers: corsHeaders(origin, allowedOrigins) });
+    }
+    const mutating = method === 'POST' || method === 'PUT';
+    const authRequired = requireTokenForAll || (mutating && Boolean(token));
+    if (authRequired && !tokenOk(request, token)) {
+      return json({ ok: false, error: 'Unauthorized' }, 401, origin);
+    }
+
+    try {
+      lifecycle.assertOpen();
+      const result = await routeAgentRequest(
+        request,
+        pathname,
+        method,
+        manager,
+        runtime,
+        backupRunner,
+        queueRuntime,
+        lifecycle,
+        origin,
+        allowedOrigins
+      );
+      return responseOf(result, origin, allowedOrigins);
+    } catch (error) {
+      return json({ ok: false, error: errorMessage(error) }, errorStatus(error), origin);
+    }
+  };
+  let closing: Promise<void> | null = null;
+  const close = () => {
+    closing ??= lifecycle.close(() =>
+      settleResourceClosures([
+        () => runtime.close(),
+        () => backupRunner.close(),
+        () => queueRuntime.close(),
+      ])
+    );
+    return closing;
+  };
+  const beginShutdown = () => {
+    manager.beginShutdown();
+    return close();
+  };
+  let shuttingDown: Promise<void> | null = null;
+  const shutdown = () => {
+    shuttingDown ??= closeThenShutdown(beginShutdown, manager);
+    return shuttingDown;
+  };
+  const forceShutdown = () => manager.forceShutdown();
+  return Object.assign(handle, { close, beginShutdown, shutdown, forceShutdown });
+}
+
+async function closeThenShutdown(
+  beginShutdown: () => Promise<void>,
+  manager: ProcessManager
+): Promise<void> {
+  const closeResult = await settle(beginShutdown);
+  const shutdownResult = await settle(() => manager.shutdown());
+  if (!closeResult.ok && !shutdownResult.ok) {
+    throw new AggregateError(
+      [closeResult.error, shutdownResult.error],
+      'Agent resources and managed server both failed to shut down'
+    );
+  }
+  if (!closeResult.ok) throw closeResult.error;
+  if (!shutdownResult.ok) throw shutdownResult.error;
+}
+
+async function settleResourceClosures(closures: Array<() => Promise<void>>): Promise<void> {
+  const settled = await Promise.allSettled(
+    closures.map((closeResource) => Promise.resolve().then(closeResource))
+  );
+  const failures = settled.flatMap((result) =>
+    result.status === 'rejected' ? [result.reason] : []
+  );
+  if (failures.length === 1) throw failures[0];
+  if (failures.length > 1) {
+    throw new AggregateError(failures, 'Multiple agent resources failed to close');
+  }
+}
+
+type SettledOperation = { ok: true } | { ok: false; error: unknown };
+
+async function settle(operation: () => Promise<unknown>): Promise<SettledOperation> {
+  try {
+    await operation();
+    return { ok: true };
+  } catch (error) {
+    return { ok: false, error };
+  }
+}

package/agent/server/jsonBody.ts

@@ -0,0 +1,109 @@
+export interface LimitedJsonBodyOptions {
+  scope: string;
+  maxBytes: number;
+  limitLabel: string;
+  invalidContentLengthMessage?: string;
+  exceedsMessage?: string;
+  missingMessage?: string;
+  invalidUtf8Message?: string;
+  invalidJsonMessage?: string;
+}
+
+/** Read and parse a JSON body without ever buffering more than maxBytes. */
+export async function readLimitedJsonBody(
+  request: Request,
+  options: LimitedJsonBodyOptions
+): Promise<unknown> {
+  validateContentLength(request.headers.get('content-length'), options);
+  if (!request.body) throw new Error(message(options, 'missing'));
+
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder('utf-8', { fatal: true });
+  const textChunks: string[] = [];
+  let totalBytes = 0;
+  try {
+    for (;;) {
+      const next = await reader.read();
+      if (next.done) break;
+      totalBytes += next.value.byteLength;
+      if (totalBytes > options.maxBytes) {
+        throw new Error(message(options, 'exceeds'));
+      }
+      textChunks.push(decode(decoder, next.value, true, options));
+    }
+    textChunks.push(decode(decoder, undefined, false, options));
+  } catch (error) {
+    await cancelQuietly(reader);
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+
+  if (totalBytes === 0) throw new Error(message(options, 'missing'));
+  try {
+    return JSON.parse(textChunks.join(''));
+  } catch {
+    throw new Error(message(options, 'invalidJson'));
+  }
+}
+
+function validateContentLength(
+  declared: string | null,
+  options: LimitedJsonBodyOptions
+): void {
+  if (declared === null) return;
+  if (!/^\d+$/.test(declared)) {
+    throw new Error(message(options, 'invalidContentLength'));
+  }
+  const normalized = declared.replace(/^0+/, '') || '0';
+  const maximum = String(options.maxBytes);
+  if (
+    normalized.length > maximum.length ||
+    (normalized.length === maximum.length && normalized > maximum)
+  ) {
+    throw new Error(message(options, 'exceeds'));
+  }
+}
+
+function decode(
+  decoder: TextDecoder,
+  value: Uint8Array | undefined,
+  stream: boolean,
+  options: LimitedJsonBodyOptions
+): string {
+  try {
+    return decoder.decode(value, { stream });
+  } catch {
+    throw new Error(message(options, 'invalidUtf8'));
+  }
+}
+
+async function cancelQuietly(reader: { cancel(reason?: unknown): Promise<void> }): Promise<void> {
+  await reader.cancel().catch(() => undefined);
+}
+
+type MessageKind =
+  | 'invalidContentLength'
+  | 'exceeds'
+  | 'missing'
+  | 'invalidUtf8'
+  | 'invalidJson';
+
+function message(options: LimitedJsonBodyOptions, kind: MessageKind): string {
+  if (kind === 'invalidContentLength') {
+    return (
+      options.invalidContentLengthMessage ??
+      `${options.scope} Content-Length must be a non-negative integer`
+    );
+  }
+  if (kind === 'exceeds') {
+    return options.exceedsMessage ?? `${options.scope} request exceeds ${options.limitLabel}`;
+  }
+  if (kind === 'missing') {
+    return options.missingMessage ?? `${options.scope} request body is required`;
+  }
+  if (kind === 'invalidUtf8') {
+    return options.invalidUtf8Message ?? `${options.scope} request body must use valid UTF-8`;
+  }
+  return options.invalidJsonMessage ?? `${options.scope} request body must contain valid JSON`;
+}

package/agent/server/lifecycle.ts

@@ -0,0 +1,72 @@
+/** Coordinates exclusive process transitions with concurrent SDK leases. */
+export interface AgentLifecyclePort {
+  assertOpen(): void;
+  lease<T>(operation: () => Promise<T>): Promise<T>;
+  run<T>(operation: () => Promise<T>): Promise<T>;
+  close(operation: () => Promise<void>): Promise<void>;
+}
+
+export class AgentLifecycleClosedError extends Error {
+  constructor() {
+    super('The Bunqueue control agent is closing');
+    this.name = 'AgentLifecycleClosedError';
+  }
+}
+
+export class AgentLifecycleGate implements AgentLifecyclePort {
+  private barrier: Promise<void> = Promise.resolve();
+  private leases = new Set<Promise<void>>();
+  private closed = false;
+  private closing: Promise<void> | null = null;
+
+  assertOpen(): void {
+    if (this.closed) throw new AgentLifecycleClosedError();
+  }
+
+  lease<T>(operation: () => Promise<T>): Promise<T> {
+    try {
+      this.assertOpen();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    const result = this.barrier.then(operation);
+    const batch = this.leases;
+    const completion = result.then(
+      () => undefined,
+      () => undefined
+    );
+    batch.add(completion);
+    void completion.then(() => batch.delete(completion));
+    return result;
+  }
+
+  run<T>(operation: () => Promise<T>): Promise<T> {
+    try {
+      this.assertOpen();
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    return this.enqueueTransition(operation);
+  }
+
+  close(operation: () => Promise<void>): Promise<void> {
+    if (this.closing) return this.closing;
+    this.closed = true;
+    this.closing = this.enqueueTransition(operation);
+    return this.closing;
+  }
+
+  private enqueueTransition<T>(operation: () => Promise<T>): Promise<T> {
+    const precedingBarrier = this.barrier;
+    const precedingLeases = this.leases;
+    this.leases = new Set();
+    const result = precedingBarrier
+      .then(() => Promise.all(precedingLeases))
+      .then(operation);
+    this.barrier = result.then(
+      () => undefined,
+      () => undefined
+    );
+    return result;
+  }
+}

package/agent/server/managedRuntime.ts

@@ -0,0 +1,41 @@
+import type { ProcessManager, ServerConfig, StatusSnapshot } from '../manager';
+import type { AgentLifecyclePort } from './lifecycle';
+
+export interface ManagedRuntimeSnapshot {
+  config: ServerConfig;
+  running: boolean;
+}
+
+export type ManagedRuntimeAdmission = <T>(
+  operation: (snapshot: ManagedRuntimeSnapshot) => Promise<T>
+) => Promise<T>;
+
+/**
+ * Admit SDK work against one managed-process generation. The operation and its
+ * final state/config check share the same lifecycle section as start/stop.
+ */
+export function managedRuntimeAdmission(
+  manager: ProcessManager,
+  lifecycle: AgentLifecyclePort,
+  initial: StatusSnapshot
+): ManagedRuntimeAdmission {
+  return (operation) =>
+    lifecycle.lease(async () => {
+      const current = manager.getStatus();
+      if (generationChanged(initial, current)) {
+        throw new Error('Managed Bunqueue server restarted while the request was prepared');
+      }
+      return operation({
+        config: current.runningConfig ?? current.config,
+        running: current.status === 'running',
+      });
+    });
+}
+
+function generationChanged(initial: StatusSnapshot, current: StatusSnapshot): boolean {
+  return (
+    initial.status === 'running' &&
+    current.status === 'running' &&
+    initial.generation !== current.generation
+  );
+}

package/agent/server/policy.ts

@@ -0,0 +1,60 @@
+const DEFAULT_ORIGINS = ['http://localhost:5273', 'http://127.0.0.1:5273'];
+const LOOPBACK_HOSTS = ['localhost', '127.0.0.1', '::1', '0.0.0.0'];
+
+export function resolveAllowedOrigins(env = process.env): string[] {
+  const extra = (env.AGENT_ALLOWED_ORIGINS ?? '')
+    .split(',')
+    .map((origin) => origin.trim().replace(/\/$/, ''))
+    .filter(Boolean);
+  return Array.from(new Set([...DEFAULT_ORIGINS, ...extra]));
+}
+
+/** Extract a lowercase bare hostname from a Host header or origin. */
+export function hostnameOf(host: string): string {
+  const stripped = host.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
+  const ipv6 = stripped.match(/^\[([^\]]+)\]/);
+  if (ipv6) return ipv6[1].toLowerCase();
+  const firstColon = stripped.indexOf(':');
+  if (firstColon === -1) return stripped.toLowerCase();
+  if (firstColon !== stripped.lastIndexOf(':')) return stripped.toLowerCase();
+  return stripped.slice(0, firstColon).toLowerCase();
+}
+
+export function resolveAllowedHosts(env = process.env, extra: string[] = []): string[] {
+  const fromEnvironment = (env.AGENT_ALLOWED_HOSTS ?? '')
+    .split(',')
+    .map((host) => hostnameOf(host.trim()))
+    .filter(Boolean);
+  const extraHosts = extra.map(hostnameOf).filter(Boolean);
+  return Array.from(new Set([...LOOPBACK_HOSTS, ...extraHosts, ...fromEnvironment]));
+}
+
+export function isOriginAllowed(origin: string | null, allowed: string[]): boolean {
+  if (!origin) return true;
+  return allowed.includes(origin.replace(/\/$/, ''));
+}
+
+export function isHostAllowed(host: string | null, allowed?: string[]): boolean {
+  if (!allowed) return true;
+  if (!host) return false;
+  return allowed.includes(hostnameOf(host));
+}
+
+export function corsHeaders(origin: string | null, allowed: string[]): Record<string, string> {
+  const headers: Record<string, string> = {
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Agent-Token',
+    Vary: 'Origin',
+  };
+  if (origin && allowed.includes(origin.replace(/\/$/, ''))) {
+    headers['Access-Control-Allow-Origin'] = origin;
+  }
+  return headers;
+}
+
+export function tokenOk(request: Request, token?: string): boolean {
+  if (!token) return false;
+  const authorization = request.headers.get('authorization') ?? '';
+  const bearer = authorization.startsWith('Bearer ') ? authorization.slice(7) : '';
+  return bearer === token || request.headers.get('x-agent-token') === token;
+}

package/agent/server/router.ts

@@ -0,0 +1,150 @@
+import { routeBackupRequest } from '../backup/routes';
+import type { BackupRunnerPort } from '../backup/runner';
+import { routeFlowRequest } from '../flow/routes';
+import type { ProcessManager } from '../manager';
+import { routeQueueOperationsRequest } from '../queue/routes';
+import type { QueueOperationsPort } from '../queue/types';
+import type { WorkflowRuntimePort } from '../workflow/runtime';
+import { routeWorkflowRuntimeRequest } from '../workflow/runtimeRoutes';
+import { routeControlRequest } from './controlRoutes';
+import { routeDatabaseRequest } from './databaseRoutes';
+import type { AgentLifecyclePort } from './lifecycle';
+import { managedRuntimeAdmission } from './managedRuntime';
+import type { RouteResponse } from './types';
+import { routeWorkflowReadRequest } from './workflowReadRoutes';
+
+export async function routeAgentRequest(
+  request: Request,
+  pathname: string,
+  method: string,
+  manager: ProcessManager,
+  runtime: WorkflowRuntimePort,
+  backupRunner: BackupRunnerPort,
+  queueRuntime: QueueOperationsPort,
+  lifecycle: AgentLifecyclePort,
+  origin: string | null,
+  allowedOrigins: string[]
+): Promise<RouteResponse | Response | null> {
+  if (pathname.startsWith('/control/')) {
+    const control = await routeControlRequest(
+      request,
+      pathname,
+      method,
+      manager,
+      runtime,
+      lifecycle
+    );
+    if (control) return control;
+  }
+
+  const snapshot = manager.getStatus();
+  const managedConfig = snapshot.runningConfig ?? snapshot.config;
+  const admission = managedRuntimeAdmission(manager, lifecycle, snapshot);
+  if (pathname.startsWith('/flows/')) {
+    const flow = await routeFlowRequest(
+      request,
+      pathname,
+      method,
+      managedConfig,
+      snapshot.status === 'running',
+      { admission }
+    );
+    if (flow) return flow;
+  }
+
+  // Runtime control must precede the generic /workflows/:executionId reader,
+  // otherwise GET /workflows/runtime is interpreted as an execution lookup.
+  if (isWorkflowRuntimeRoute(pathname, method)) {
+    const workflowRuntime = await routeWorkflowRuntimeRequest(
+      request,
+      pathname,
+      method,
+      managedConfig,
+      runtime,
+      snapshot.status === 'running',
+      admission
+    );
+    if (workflowRuntime) return workflowRuntime;
+  }
+
+  const desiredConfig = manager.getConfig();
+  const workflowRead = routeWorkflowReadRequest(
+    request,
+    pathname,
+    method,
+    managedConfig.dataPath
+  );
+  if (workflowRead) return workflowRead;
+
+  if (pathname.startsWith('/queue-operations/')) {
+    const queueOperation = await routeQueueOperationsRequest(
+      request,
+      pathname,
+      method,
+      managedConfig,
+      queueRuntime,
+      snapshot.status === 'running',
+      admission
+    );
+    if (queueOperation) return queueOperation;
+  }
+
+  if (pathname.startsWith('/backup/')) {
+    if (pathname === '/backup/restore' && method === 'POST') {
+      return manager.withStoppedMaintenance('restoring a backup', async () => {
+        const stoppedSnapshot = manager.getStatus();
+        const restoreDesired = manager.getConfig();
+        const restoreConfig = {
+          ...(stoppedSnapshot.runningConfig ?? stoppedSnapshot.config),
+          extraEnv: restoreDesired.extraEnv,
+        };
+        return routeBackupRequest(
+          request,
+          pathname,
+          method,
+          restoreConfig,
+          stoppedSnapshot.status === 'running',
+          await manager.dbStats(),
+          backupRunner
+        );
+      });
+    }
+    const database = await manager.dbStats();
+    const backupConfig = { ...managedConfig, extraEnv: desiredConfig.extraEnv };
+    const backup = await routeBackupRequest(
+      request,
+      pathname,
+      method,
+      backupConfig,
+      snapshot.status === 'running',
+      database,
+      backupRunner,
+      (extraEnv) => manager.setConfig({ extraEnv })
+    );
+    if (backup) return backup;
+  }
+
+  return routeDatabaseRequest(
+    request,
+    pathname,
+    method,
+    desiredConfig.dataPath,
+    origin,
+    allowedOrigins
+  );
+}
+
+function isWorkflowRuntimeRoute(pathname: string, method: string): boolean {
+  if (method === 'GET') return pathname === '/workflows/runtime';
+  if (method !== 'POST') return false;
+  return (
+    [
+      '/workflows/runtime/reload',
+      '/workflows/start',
+      '/workflows/recover',
+      '/workflows/archive',
+      '/workflows/cleanup',
+    ].includes(pathname) ||
+    /^\/workflows\/[^/]+\/(signal|resume-compensation|abandon-compensation)$/.test(pathname)
+  );
+}

package/agent/server/types.ts

@@ -0,0 +1,39 @@
+import type { WorkflowRuntimePort } from '../workflow/runtime';
+
+export interface AgentOptions {
+  allowedOrigins: string[];
+  /** DNS-rebinding defense; compared by hostname only. */
+  allowedHosts?: string[];
+  /** On loopback, when set, changing requests must present this token. */
+  token?: string;
+  /** Network exposure: require token on every non-OPTIONS request. */
+  requireTokenForAll?: boolean;
+}
+
+export interface AgentFetchHandler {
+  (request: Request): Promise<Response>;
+  /** Release the handler's persistent SDK resources. */
+  close(): Promise<void>;
+  /** Synchronously close admission and latch the process manager, then drain resources. */
+  beginShutdown(): Promise<void>;
+  /** Close resources through the lifecycle gate, then stop the managed process. */
+  shutdown(): Promise<void>;
+  /** Send SIGKILL to the managed process after terminal grace is exhausted. */
+  forceShutdown(): void;
+}
+
+export interface RouteResponse {
+  status: number;
+  body: unknown;
+}
+
+export type JsonResponder = (
+  data: unknown,
+  status: number,
+  origin: string | null
+) => Response;
+
+export interface HandlerResources {
+  runtime: WorkflowRuntimePort;
+  close(): Promise<void>;
+}

package/agent/server/workflowReadRoutes.ts

@@ -0,0 +1,80 @@
+import {
+  type WorkflowStateFilter,
+  type WorkflowStoreKind,
+  workflowExecution,
+  workflowExecutions,
+  workflowStats,
+  WORKFLOW_STATES,
+} from '../workflows';
+import type { RouteResponse } from './types';
+
+function workflowKind(query: URLSearchParams): WorkflowStoreKind {
+  const kind = query.get('kind') ?? 'active';
+  if (kind !== 'active' && kind !== 'archive') {
+    throw new Error('Workflow kind must be "active" or "archive"');
+  }
+  return kind;
+}
+
+function integer(query: URLSearchParams, name: 'limit' | 'offset', fallback: number): number {
+  const raw = query.get(name);
+  if (raw === null) return fallback;
+  if (!/^\d+$/.test(raw)) throw new Error(`Workflow ${name} must be an integer`);
+  return Number(raw);
+}
+
+export function routeWorkflowReadRequest(
+  request: Request,
+  pathname: string,
+  method: string,
+  dataPath: string
+): RouteResponse | null {
+  if (pathname === '/workflows/stats' && method === 'GET') {
+    return { status: 200, body: { ok: true, ...workflowStats(dataPath) } };
+  }
+  if (pathname === '/workflows' && method === 'GET') {
+    const query = new URL(request.url).searchParams;
+    const allowed = new Set(['kind', 'workflowName', 'state', 'limit', 'offset']);
+    for (const key of query.keys()) {
+      if (!allowed.has(key)) throw new Error(`Unknown workflow option: ${key}`);
+      if (query.getAll(key).length !== 1) throw new Error(`Duplicate workflow option: ${key}`);
+    }
+    const state = query.get('state') || undefined;
+    if (
+      state &&
+      state !== 'compensation' &&
+      !(WORKFLOW_STATES as readonly string[]).includes(state)
+    ) {
+      throw new Error('Unknown workflow execution state');
+    }
+    return {
+      status: 200,
+      body: {
+        ok: true,
+        ...workflowExecutions(dataPath, {
+          kind: workflowKind(query),
+          workflowName: query.get('workflowName') || undefined,
+          state: state as WorkflowStateFilter | undefined,
+          limit: integer(query, 'limit', 50),
+          offset: integer(query, 'offset', 0),
+        }),
+      },
+    };
+  }
+  if (!pathname.startsWith('/workflows/') || method !== 'GET') return null;
+  const rawId = pathname.slice('/workflows/'.length);
+  if (!rawId || rawId.includes('/')) {
+    return { status: 404, body: { ok: false, error: 'Not found' } };
+  }
+  const query = new URL(request.url).searchParams;
+  for (const key of query.keys()) {
+    if (key !== 'kind') throw new Error(`Unknown workflow detail option: ${key}`);
+    if (query.getAll(key).length !== 1) {
+      throw new Error(`Duplicate workflow detail option: ${key}`);
+    }
+  }
+  const execution = workflowExecution(dataPath, decodeURIComponent(rawId), workflowKind(query));
+  return execution
+    ? { status: 200, body: { ok: true, execution } }
+    : { status: 404, body: { ok: false, error: 'Workflow execution not found' } };
+}