@codemation/host 0.0.1

package/src/application/queries/GetCredentialFieldEnvStatusQueryHandler.ts

@@ -0,0 +1,52 @@
+import type { CredentialFieldSchema } from "@codemation/core";
+import { inject } from "@codemation/core";
+
+import { ApplicationTokens } from "../../applicationTokens";
+import type { AppConfig } from "../../presentation/config/AppConfig";
+import { QueryHandler } from "../bus/QueryHandler";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { CredentialTypeRegistryImpl } from "../../domain/credentials/CredentialServices";
+
+import { GetCredentialFieldEnvStatusQuery, type CredentialFieldEnvStatusDto } from "./GetCredentialFieldEnvStatusQuery";
+
+@HandlesQuery.for(GetCredentialFieldEnvStatusQuery)
+export class GetCredentialFieldEnvStatusQueryHandler extends QueryHandler<
+  GetCredentialFieldEnvStatusQuery,
+  CredentialFieldEnvStatusDto
+> {
+  constructor(
+    @inject(CredentialTypeRegistryImpl)
+    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,
+    @inject(ApplicationTokens.AppConfig)
+    private readonly appConfig: AppConfig,
+  ) {
+    super();
+  }
+
+  async execute(): Promise<CredentialFieldEnvStatusDto> {
+    const names = new Set<string>();
+    for (const type of this.credentialTypeRegistry.listTypes()) {
+      for (const n of this.collectEnvVarNames(type.publicFields)) {
+        names.add(n);
+      }
+      for (const n of this.collectEnvVarNames(type.secretFields)) {
+        names.add(n);
+      }
+    }
+    const out: Record<string, boolean> = {};
+    for (const name of names) {
+      const v = this.appConfig.env[name];
+      out[name] = typeof v === "string" && v.length > 0;
+    }
+    return Object.freeze(out);
+  }
+
+  private collectEnvVarNames(fields: ReadonlyArray<CredentialFieldSchema> | undefined): ReadonlyArray<string> {
+    if (!fields) {
+      return [];
+    }
+    return fields
+      .map((f) => f.envVarName)
+      .filter((name): name is string => typeof name === "string" && name.trim().length > 0);
+  }
+}

package/src/application/queries/GetCredentialInstanceQuery.ts

@@ -0,0 +1,9 @@
+import type { CredentialInstanceDto } from "../contracts/CredentialContractsRegistry";
+
+import { Query } from "../bus/Query";
+
+export class GetCredentialInstanceQuery extends Query<CredentialInstanceDto | undefined> {
+  constructor(public readonly instanceId: string) {
+    super();
+  }
+}

package/src/application/queries/GetCredentialInstanceQueryHandler.ts

@@ -0,0 +1,27 @@
+import { inject } from "@codemation/core";
+
+import type { CredentialInstanceDto } from "../contracts/CredentialContractsRegistry";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { CredentialInstanceService } from "../../domain/credentials/CredentialServices";
+import { GetCredentialInstanceQuery } from "./GetCredentialInstanceQuery";
+
+@HandlesQuery.for(GetCredentialInstanceQuery)
+export class GetCredentialInstanceQueryHandler extends QueryHandler<
+  GetCredentialInstanceQuery,
+  CredentialInstanceDto | undefined
+> {
+  constructor(
+    @inject(CredentialInstanceService)
+    private readonly credentialInstanceService: CredentialInstanceService,
+  ) {
+    super();
+  }
+
+  async execute(query: GetCredentialInstanceQuery): Promise<CredentialInstanceDto | undefined> {
+    return await this.credentialInstanceService.getInstance(query.instanceId);
+  }
+}

package/src/application/queries/GetCredentialInstanceWithSecretsQuery.ts

@@ -0,0 +1,9 @@
+import type { CredentialInstanceWithSecretsDto } from "../contracts/CredentialContractsRegistry";
+
+import { Query } from "../bus/Query";
+
+export class GetCredentialInstanceWithSecretsQuery extends Query<CredentialInstanceWithSecretsDto | undefined> {
+  constructor(public readonly instanceId: string) {
+    super();
+  }
+}

package/src/application/queries/GetCredentialInstanceWithSecretsQueryHandler.ts

@@ -0,0 +1,27 @@
+import { inject } from "@codemation/core";
+
+import type { CredentialInstanceWithSecretsDto } from "../contracts/CredentialContractsRegistry";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { CredentialInstanceService } from "../../domain/credentials/CredentialServices";
+import { GetCredentialInstanceWithSecretsQuery } from "./GetCredentialInstanceWithSecretsQuery";
+
+@HandlesQuery.for(GetCredentialInstanceWithSecretsQuery)
+export class GetCredentialInstanceWithSecretsQueryHandler extends QueryHandler<
+  GetCredentialInstanceWithSecretsQuery,
+  CredentialInstanceWithSecretsDto | undefined
+> {
+  constructor(
+    @inject(CredentialInstanceService)
+    private readonly credentialInstanceService: CredentialInstanceService,
+  ) {
+    super();
+  }
+
+  async execute(query: GetCredentialInstanceWithSecretsQuery): Promise<CredentialInstanceWithSecretsDto | undefined> {
+    return await this.credentialInstanceService.getInstanceWithSecrets(query.instanceId);
+  }
+}

package/src/application/queries/GetRunBinaryAttachmentQuery.ts

@@ -0,0 +1,11 @@
+import type { BinaryAttachment } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class GetRunBinaryAttachmentQuery extends Query<BinaryAttachment | undefined> {
+  constructor(
+    public readonly runId: string,
+    public readonly binaryId: string,
+  ) {
+    super();
+  }
+}

package/src/application/queries/GetRunBinaryAttachmentQueryHandler.ts

@@ -0,0 +1,23 @@
+import type { BinaryAttachment } from "@codemation/core";
+import { inject } from "@codemation/core";
+import { RunBinaryAttachmentLookupService } from "../binary/RunBinaryAttachmentLookupService";
+import { QueryHandler } from "../bus/QueryHandler";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { GetRunBinaryAttachmentQuery } from "./GetRunBinaryAttachmentQuery";
+
+@HandlesQuery.for(GetRunBinaryAttachmentQuery)
+export class GetRunBinaryAttachmentQueryHandler extends QueryHandler<
+  GetRunBinaryAttachmentQuery,
+  BinaryAttachment | undefined
+> {
+  constructor(
+    @inject(RunBinaryAttachmentLookupService)
+    private readonly lookupService: RunBinaryAttachmentLookupService,
+  ) {
+    super();
+  }
+
+  async execute(query: GetRunBinaryAttachmentQuery): Promise<BinaryAttachment | undefined> {
+    return this.lookupService.findForRun(query.runId, query.binaryId);
+  }
+}

package/src/application/queries/GetRunStateQuery.ts

@@ -0,0 +1,8 @@
+import type { PersistedRunState } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class GetRunStateQuery extends Query<PersistedRunState | undefined> {
+  constructor(public readonly runId: string) {
+    super();
+  }
+}

package/src/application/queries/GetRunStateQueryHandler.ts

@@ -0,0 +1,21 @@
+import type { PersistedRunState } from "@codemation/core";
+import { inject } from "@codemation/core";
+import { ApplicationTokens } from "../../applicationTokens";
+import type { WorkflowRunRepository } from "../../domain/runs/WorkflowRunRepository";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { QueryHandler } from "../bus/QueryHandler";
+import { GetRunStateQuery } from "./GetRunStateQuery";
+
+@HandlesQuery.for(GetRunStateQuery)
+export class GetRunStateQueryHandler extends QueryHandler<GetRunStateQuery, PersistedRunState | undefined> {
+  constructor(
+    @inject(ApplicationTokens.WorkflowRunRepository)
+    private readonly workflowRunRepository: WorkflowRunRepository,
+  ) {
+    super();
+  }
+
+  async execute(query: GetRunStateQuery): Promise<PersistedRunState | undefined> {
+    return await this.workflowRunRepository.load(query.runId);
+  }
+}

package/src/application/queries/GetWorkflowCredentialHealthQuery.ts

@@ -0,0 +1,9 @@
+import type { WorkflowCredentialHealthDto } from "../contracts/CredentialContractsRegistry";
+
+import { Query } from "../bus/Query";
+
+export class GetWorkflowCredentialHealthQuery extends Query<WorkflowCredentialHealthDto> {
+  constructor(public readonly workflowId: string) {
+    super();
+  }
+}

package/src/application/queries/GetWorkflowCredentialHealthQueryHandler.ts

@@ -0,0 +1,27 @@
+import { inject } from "@codemation/core";
+
+import type { WorkflowCredentialHealthDto } from "../contracts/CredentialContractsRegistry";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { CredentialBindingService } from "../../domain/credentials/CredentialServices";
+import { GetWorkflowCredentialHealthQuery } from "./GetWorkflowCredentialHealthQuery";
+
+@HandlesQuery.for(GetWorkflowCredentialHealthQuery)
+export class GetWorkflowCredentialHealthQueryHandler extends QueryHandler<
+  GetWorkflowCredentialHealthQuery,
+  WorkflowCredentialHealthDto
+> {
+  constructor(
+    @inject(CredentialBindingService)
+    private readonly credentialBindingService: CredentialBindingService,
+  ) {
+    super();
+  }
+
+  async execute(query: GetWorkflowCredentialHealthQuery): Promise<WorkflowCredentialHealthDto> {
+    return await this.credentialBindingService.listWorkflowHealth(query.workflowId);
+  }
+}

package/src/application/queries/GetWorkflowDebuggerOverlayQuery.ts

@@ -0,0 +1,8 @@
+import type { WorkflowDebuggerOverlayState } from "../../domain/workflows/WorkflowDebuggerOverlayState";
+import { Query } from "../bus/Query";
+
+export class GetWorkflowDebuggerOverlayQuery extends Query<WorkflowDebuggerOverlayState> {
+  constructor(public readonly workflowId: string) {
+    super();
+  }
+}

package/src/application/queries/GetWorkflowDebuggerOverlayQueryHandler.ts

@@ -0,0 +1,28 @@
+import { inject } from "@codemation/core";
+import { ApplicationTokens } from "../../applicationTokens";
+import type { WorkflowDebuggerOverlayRepository } from "../../domain/workflows/WorkflowDebuggerOverlayRepository";
+import type { WorkflowDebuggerOverlayState } from "../../domain/workflows/WorkflowDebuggerOverlayState";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { QueryHandler } from "../bus/QueryHandler";
+import { WorkflowDebuggerOverlayStateFactory } from "../workflows/WorkflowDebuggerOverlayStateFactory";
+import { GetWorkflowDebuggerOverlayQuery } from "./GetWorkflowDebuggerOverlayQuery";
+
+@HandlesQuery.for(GetWorkflowDebuggerOverlayQuery)
+export class GetWorkflowDebuggerOverlayQueryHandler extends QueryHandler<
+  GetWorkflowDebuggerOverlayQuery,
+  WorkflowDebuggerOverlayState
+> {
+  constructor(
+    @inject(ApplicationTokens.WorkflowDebuggerOverlayRepository)
+    private readonly workflowDebuggerOverlayRepository: WorkflowDebuggerOverlayRepository,
+  ) {
+    super();
+  }
+
+  async execute(query: GetWorkflowDebuggerOverlayQuery): Promise<WorkflowDebuggerOverlayState> {
+    return (
+      (await this.workflowDebuggerOverlayRepository.load(query.workflowId)) ??
+      WorkflowDebuggerOverlayStateFactory.createEmpty(query.workflowId)
+    );
+  }
+}

package/src/application/queries/GetWorkflowDetailQuery.ts

@@ -0,0 +1,8 @@
+import type { WorkflowDefinition } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class GetWorkflowDetailQuery extends Query<WorkflowDefinition | undefined> {
+  constructor(public readonly workflowId: string) {
+    super();
+  }
+}

package/src/application/queries/GetWorkflowDetailQueryHandler.ts

@@ -0,0 +1,24 @@
+import type { WorkflowDefinition } from "@codemation/core";
+import { inject } from "@codemation/core";
+import { ApplicationTokens } from "../../applicationTokens";
+import type { WorkflowDefinitionRepository } from "../../domain/workflows/WorkflowDefinitionRepository";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { QueryHandler } from "../bus/QueryHandler";
+import { GetWorkflowDetailQuery } from "./GetWorkflowDetailQuery";
+
+@HandlesQuery.for(GetWorkflowDetailQuery)
+export class GetWorkflowDetailQueryHandler extends QueryHandler<
+  GetWorkflowDetailQuery,
+  WorkflowDefinition | undefined
+> {
+  constructor(
+    @inject(ApplicationTokens.WorkflowDefinitionRepository)
+    private readonly workflowDefinitionRepository: WorkflowDefinitionRepository,
+  ) {
+    super();
+  }
+
+  async execute(query: GetWorkflowDetailQuery): Promise<WorkflowDefinition | undefined> {
+    return await this.workflowDefinitionRepository.getDefinition(query.workflowId);
+  }
+}

package/src/application/queries/GetWorkflowOverlayBinaryAttachmentQuery.ts

@@ -0,0 +1,11 @@
+import type { BinaryAttachment } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class GetWorkflowOverlayBinaryAttachmentQuery extends Query<BinaryAttachment | undefined> {
+  constructor(
+    public readonly workflowId: string,
+    public readonly binaryId: string,
+  ) {
+    super();
+  }
+}

package/src/application/queries/GetWorkflowOverlayBinaryAttachmentQueryHandler.ts

@@ -0,0 +1,23 @@
+import type { BinaryAttachment } from "@codemation/core";
+import { inject } from "@codemation/core";
+import { RunBinaryAttachmentLookupService } from "../binary/RunBinaryAttachmentLookupService";
+import { QueryHandler } from "../bus/QueryHandler";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { GetWorkflowOverlayBinaryAttachmentQuery } from "./GetWorkflowOverlayBinaryAttachmentQuery";
+
+@HandlesQuery.for(GetWorkflowOverlayBinaryAttachmentQuery)
+export class GetWorkflowOverlayBinaryAttachmentQueryHandler extends QueryHandler<
+  GetWorkflowOverlayBinaryAttachmentQuery,
+  BinaryAttachment | undefined
+> {
+  constructor(
+    @inject(RunBinaryAttachmentLookupService)
+    private readonly lookupService: RunBinaryAttachmentLookupService,
+  ) {
+    super();
+  }
+
+  async execute(query: GetWorkflowOverlayBinaryAttachmentQuery): Promise<BinaryAttachment | undefined> {
+    return this.lookupService.findForWorkflowOverlay(query.workflowId, query.binaryId);
+  }
+}

package/src/application/queries/GetWorkflowSummariesQuery.ts

@@ -0,0 +1,4 @@
+import type { WorkflowDefinition } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class GetWorkflowSummariesQuery extends Query<ReadonlyArray<WorkflowDefinition>> {}

package/src/application/queries/GetWorkflowSummariesQueryHandler.ts

@@ -0,0 +1,23 @@
+import type { WorkflowDefinition, WorkflowRepository } from "@codemation/core";
+import { CoreTokens, inject } from "@codemation/core";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { QueryHandler } from "../bus/QueryHandler";
+import { GetWorkflowSummariesQuery } from "./GetWorkflowSummariesQuery";
+
+@HandlesQuery.for(GetWorkflowSummariesQuery)
+export class GetWorkflowSummariesQueryHandler extends QueryHandler<
+  GetWorkflowSummariesQuery,
+  ReadonlyArray<WorkflowDefinition>
+> {
+  constructor(
+    @inject(CoreTokens.WorkflowRepository)
+    private readonly workflowRepository: WorkflowRepository,
+  ) {
+    super();
+  }
+
+  async execute(query: GetWorkflowSummariesQuery): Promise<ReadonlyArray<WorkflowDefinition>> {
+    void query;
+    return [...this.workflowRepository.list()];
+  }
+}

package/src/application/queries/ListCredentialInstancesQuery.ts

@@ -0,0 +1,5 @@
+import type { CredentialInstanceDto } from "../contracts/CredentialContractsRegistry";
+
+import { Query } from "../bus/Query";
+
+export class ListCredentialInstancesQuery extends Query<ReadonlyArray<CredentialInstanceDto>> {}

package/src/application/queries/ListCredentialInstancesQueryHandler.ts

@@ -0,0 +1,27 @@
+import { inject } from "@codemation/core";
+
+import type { CredentialInstanceDto } from "../contracts/CredentialContractsRegistry";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { CredentialInstanceService } from "../../domain/credentials/CredentialServices";
+import { ListCredentialInstancesQuery } from "./ListCredentialInstancesQuery";
+
+@HandlesQuery.for(ListCredentialInstancesQuery)
+export class ListCredentialInstancesQueryHandler extends QueryHandler<
+  ListCredentialInstancesQuery,
+  ReadonlyArray<CredentialInstanceDto>
+> {
+  constructor(
+    @inject(CredentialInstanceService)
+    private readonly credentialInstanceService: CredentialInstanceService,
+  ) {
+    super();
+  }
+
+  async execute(): Promise<ReadonlyArray<CredentialInstanceDto>> {
+    return await this.credentialInstanceService.listInstances();
+  }
+}

package/src/application/queries/ListCredentialTypesQuery.ts

@@ -0,0 +1,5 @@
+import type { CredentialTypeDefinition } from "@codemation/core";
+
+import { Query } from "../bus/Query";
+
+export class ListCredentialTypesQuery extends Query<ReadonlyArray<CredentialTypeDefinition>> {}

package/src/application/queries/ListCredentialTypesQueryHandler.ts

@@ -0,0 +1,28 @@
+import type { CredentialTypeDefinition } from "@codemation/core";
+
+import { inject } from "@codemation/core";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { CredentialTypeRegistryImpl } from "../../domain/credentials/CredentialTypeRegistryImpl";
+
+import { ListCredentialTypesQuery } from "./ListCredentialTypesQuery";
+
+@HandlesQuery.for(ListCredentialTypesQuery)
+export class ListCredentialTypesQueryHandler extends QueryHandler<
+  ListCredentialTypesQuery,
+  ReadonlyArray<CredentialTypeDefinition>
+> {
+  constructor(
+    @inject(CredentialTypeRegistryImpl)
+    private readonly credentialTypeRegistry: CredentialTypeRegistryImpl,
+  ) {
+    super();
+  }
+
+  async execute(): Promise<ReadonlyArray<CredentialTypeDefinition>> {
+    return this.credentialTypeRegistry.listTypes();
+  }
+}

package/src/application/queries/ListUserAccountsQuery.ts

@@ -0,0 +1,5 @@
+import type { UserAccountDto } from "../contracts/userDirectoryContracts.types";
+
+import { Query } from "../bus/Query";
+
+export class ListUserAccountsQuery extends Query<ReadonlyArray<UserAccountDto>> {}

package/src/application/queries/ListUserAccountsQueryHandler.ts

@@ -0,0 +1,22 @@
+import { inject } from "@codemation/core";
+
+import type { UserAccountDto } from "../contracts/userDirectoryContracts.types";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { UserAccountService } from "../../domain/users/UserAccountServiceRegistry";
+
+import { ListUserAccountsQuery } from "./ListUserAccountsQuery";
+
+@HandlesQuery.for(ListUserAccountsQuery)
+export class ListUserAccountsQueryHandler extends QueryHandler<ListUserAccountsQuery, ReadonlyArray<UserAccountDto>> {
+  constructor(@inject(UserAccountService) private readonly userAccounts: UserAccountService) {
+    super();
+  }
+
+  async execute(_query: ListUserAccountsQuery): Promise<ReadonlyArray<UserAccountDto>> {
+    return await this.userAccounts.listUsers();
+  }
+}

package/src/application/queries/ListWorkflowRunsQuery.ts

@@ -0,0 +1,8 @@
+import type { RunSummary } from "@codemation/core";
+import { Query } from "../bus/Query";
+
+export class ListWorkflowRunsQuery extends Query<ReadonlyArray<RunSummary>> {
+  constructor(public readonly workflowId: string) {
+    super();
+  }
+}

package/src/application/queries/ListWorkflowRunsQueryHandler.ts

@@ -0,0 +1,21 @@
+import type { RunSummary } from "@codemation/core";
+import { inject } from "@codemation/core";
+import { ApplicationTokens } from "../../applicationTokens";
+import type { WorkflowRunRepository } from "../../domain/runs/WorkflowRunRepository";
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+import { QueryHandler } from "../bus/QueryHandler";
+import { ListWorkflowRunsQuery } from "./ListWorkflowRunsQuery";
+
+@HandlesQuery.for(ListWorkflowRunsQuery)
+export class ListWorkflowRunsQueryHandler extends QueryHandler<ListWorkflowRunsQuery, ReadonlyArray<RunSummary>> {
+  constructor(
+    @inject(ApplicationTokens.WorkflowRunRepository)
+    private readonly workflowRunRepository: WorkflowRunRepository,
+  ) {
+    super();
+  }
+
+  async execute(query: ListWorkflowRunsQuery): Promise<ReadonlyArray<RunSummary>> {
+    return await this.workflowRunRepository.listRuns({ workflowId: query.workflowId, limit: 50 });
+  }
+}

package/src/application/queries/UserAccountQueryHandlers.ts

@@ -0,0 +1,4 @@
+export { ListUserAccountsQuery } from "./ListUserAccountsQuery";
+export { ListUserAccountsQueryHandler } from "./ListUserAccountsQueryHandler";
+export { VerifyUserInviteQuery } from "./VerifyUserInviteQuery";
+export { VerifyUserInviteQueryHandler } from "./VerifyUserInviteQueryHandler";

package/src/application/queries/VerifyUserInviteQuery.ts

@@ -0,0 +1,9 @@
+import type { VerifyUserInviteResponseDto } from "../contracts/userDirectoryContracts.types";
+
+import { Query } from "../bus/Query";
+
+export class VerifyUserInviteQuery extends Query<VerifyUserInviteResponseDto> {
+  constructor(public readonly token: string) {
+    super();
+  }
+}

package/src/application/queries/VerifyUserInviteQueryHandler.ts

@@ -0,0 +1,21 @@
+import { inject } from "@codemation/core";
+
+import type { VerifyUserInviteResponseDto } from "../contracts/userDirectoryContracts.types";
+
+import { QueryHandler } from "../bus/QueryHandler";
+
+import { HandlesQuery } from "../../infrastructure/di/HandlesQueryRegistry";
+
+import { UserAccountService } from "../../domain/users/UserAccountServiceRegistry";
+import { VerifyUserInviteQuery } from "./VerifyUserInviteQuery";
+
+@HandlesQuery.for(VerifyUserInviteQuery)
+export class VerifyUserInviteQueryHandler extends QueryHandler<VerifyUserInviteQuery, VerifyUserInviteResponseDto> {
+  constructor(@inject(UserAccountService) private readonly userAccounts: UserAccountService) {
+    super();
+  }
+
+  async execute(query: VerifyUserInviteQuery): Promise<VerifyUserInviteResponseDto> {
+    return await this.userAccounts.verifyInviteToken(query.token);
+  }
+}

package/src/application/runs/WorkflowRunRetentionPruneScheduler.ts

@@ -0,0 +1,98 @@
+import type { BinaryStorage, Clock, RunId, WorkflowId } from "@codemation/core";
+import { CoreTokens, RunFinishedAtFactory } from "@codemation/core";
+import { inject, injectable } from "@codemation/core";
+import type { Logger } from "../logging/Logger";
+import { RunStateBinaryStorageKeysCollector } from "../binary/RunStateBinaryStorageKeysCollector";
+import { ApplicationTokens } from "../../applicationTokens";
+import type { AppConfig } from "../../presentation/config/AppConfig";
+import type { WorkflowRunRepository } from "../../domain/runs/WorkflowRunRepository";
+import { ServerLoggerFactory } from "../../infrastructure/logging/ServerLoggerFactory";
+
+/**
+ * Periodically deletes terminal workflow runs whose age exceeds the effective retention
+ * (`policySnapshot.retentionSeconds` or `CODEMATION_RUN_RETENTION_DEFAULT_SECONDS`),
+ * and removes binary blobs referenced from run state via {@link BinaryStorage}.
+ */
+@injectable()
+export class WorkflowRunRetentionPruneScheduler {
+  private timer: ReturnType<typeof setInterval> | undefined;
+  private readonly logger: Logger;
+  private readonly binaryKeysCollector = new RunStateBinaryStorageKeysCollector();
+
+  constructor(
+    @inject(ApplicationTokens.Clock) private readonly clock: Clock,
+    @inject(ApplicationTokens.WorkflowRunRepository) private readonly runs: WorkflowRunRepository,
+    @inject(CoreTokens.BinaryStorage) private readonly binaryStorage: BinaryStorage,
+    @inject(ApplicationTokens.AppConfig) private readonly appConfig: AppConfig,
+    @inject(ServerLoggerFactory) loggerFactory: ServerLoggerFactory,
+  ) {
+    this.logger = loggerFactory.create("codemation.runRetentionPrune");
+  }
+
+  start(): void {
+    if (this.appConfig.env.CODEMATION_RUN_PRUNE_ENABLED === "false") {
+      return;
+    }
+    if (this.timer) {
+      return;
+    }
+    const intervalMs = Number(this.appConfig.env.CODEMATION_RUN_PRUNE_INTERVAL_MS ?? 60_000);
+    this.timer = setInterval(() => {
+      void this.runOnce().catch((error: unknown) => {
+        this.logger.warn(`Run retention prune tick failed: ${error instanceof Error ? error.message : String(error)}`);
+      });
+    }, intervalMs);
+  }
+
+  stop(): void {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = undefined;
+    }
+  }
+
+  /** Exposed for tests; production path is the interval started by {@link start}. */
+  async runOnce(): Promise<void> {
+    this.logger.debug("Run retention prune: starting check");
+
+    const defaultRetentionSec = Number(this.appConfig.env.CODEMATION_RUN_RETENTION_DEFAULT_SECONDS ?? 86_400);
+    const summaries = await this.runs.listRuns({ limit: 500 });
+    const nowMs = this.clock.now().getTime();
+
+    let foundCount = 0;
+    let prunedCount = 0;
+    for (const s of summaries) {
+      if (s.status !== "completed" && s.status !== "failed") {
+        continue;
+      }
+      const state = await this.runs.load(s.runId);
+      if (!state) {
+        continue;
+      }
+      const retentionSec = state.policySnapshot?.retentionSeconds ?? defaultRetentionSec;
+      const finishedAt = RunFinishedAtFactory.resolveIso(state) ?? s.finishedAt;
+      if (!finishedAt) {
+        continue;
+      }
+      const ageMs = nowMs - Date.parse(finishedAt);
+      if (ageMs <= retentionSec * 1000) {
+        continue;
+      }
+
+      const runId = s.runId as RunId;
+      const workflowId = s.workflowId as WorkflowId;
+      foundCount += 1;
+
+      const storageKeys = this.binaryKeysCollector.collectFromRunState(state);
+      for (const key of storageKeys) {
+        await this.binaryStorage.delete(key);
+      }
+      await this.runs.deleteRun(runId);
+      prunedCount += 1;
+      this.logger.debug(`Run retention prune: pruned run ${runId} for workflow ${workflowId}`);
+    }
+
+    this.logger.info(`Run retention prune: found ${foundCount} run(s) to prune`);
+    this.logger.info(`Run retention prune: pruned ${prunedCount} run(s)`);
+  }
+}