@codemation/host 0.0.1

package/src/presentation/http/hono/CodemationHonoApiAppFactory.ts

@@ -0,0 +1,64 @@
+import { inject, injectAll, injectable } from "@codemation/core";
+import { Hono } from "hono";
+import type { SessionVerifier } from "../../../application/auth/SessionVerifier";
+import { ApplicationTokens } from "../../../applicationTokens";
+import { BinaryHttpRouteHandler } from "../routeHandlers/BinaryHttpRouteHandlerFactory";
+import { ServerHttpErrorResponseFactory } from "../ServerHttpErrorResponseFactory";
+import type { HonoApiRouteRegistrar } from "./HonoApiRouteRegistrar";
+import { HonoHttpAnonymousRoutePolicy } from "./HonoHttpAnonymousRoutePolicyRegistry";
+
+@injectable()
+export class CodemationHonoApiApp {
+  private readonly app: Hono;
+
+  constructor(
+    @inject(ApplicationTokens.SessionVerifier)
+    sessionVerifier: SessionVerifier,
+    @injectAll(ApplicationTokens.HonoApiRouteRegistrar)
+    registrars: ReadonlyArray<HonoApiRouteRegistrar>,
+    @inject(BinaryHttpRouteHandler)
+    binaryHttpRouteHandler: BinaryHttpRouteHandler,
+  ) {
+    const app = new Hono().basePath("/api");
+    app.onError((error, _c) => ServerHttpErrorResponseFactory.fromUnknown(error));
+    app.use("*", async (c, next) => {
+      if (HonoHttpAnonymousRoutePolicy.isAnonymousRoute(c.req.raw)) {
+        await next();
+        return;
+      }
+      const principal = await sessionVerifier.verify(c.req.raw);
+      if (!principal) {
+        return c.json({ error: "Unauthorized" }, 401);
+      }
+      await next();
+    });
+    for (const registrar of registrars) {
+      registrar.register(app);
+    }
+    app.get("/workflows/:workflowId/debugger-overlay/binary/:binaryId/content", (c) =>
+      binaryHttpRouteHandler.getWorkflowOverlayBinaryContent(c.req.raw, {
+        workflowId: c.req.param("workflowId"),
+        binaryId: c.req.param("binaryId"),
+      }),
+    );
+    app.post("/workflows/:workflowId/debugger-overlay/binary/upload", (c) =>
+      binaryHttpRouteHandler.postWorkflowDebuggerOverlayBinaryUpload(c.req.raw, {
+        workflowId: c.req.param("workflowId"),
+      }),
+    );
+    app.notFound((c) => {
+      const method = c.req.method.toUpperCase();
+      const url = new URL(c.req.url);
+      return c.json({ error: `Unknown API route: ${method} ${url.pathname}` }, 404);
+    });
+    this.app = app;
+  }
+
+  getHono(): Hono {
+    return this.app;
+  }
+
+  fetch(request: Request): Response | Promise<Response> {
+    return this.app.fetch(request);
+  }
+}

package/src/presentation/http/hono/HonoApiRouteRegistrar.ts

@@ -0,0 +1,5 @@
+import type { Hono } from "hono";
+
+export interface HonoApiRouteRegistrar {
+  register(app: Hono): void;
+}

package/src/presentation/http/hono/HonoHttpAnonymousRoutePolicyRegistry.ts

@@ -0,0 +1,27 @@
+import { ApiPaths } from "../ApiPaths";
+
+/**
+ * Routes that must remain callable without an authenticated Codemation session.
+ * @see ApiPaths — keep in sync with webhook + dev-only endpoints.
+ */
+export class HonoHttpAnonymousRoutePolicy {
+  private static readonly webhookPrefix = `${ApiPaths.webhooks()}/`;
+
+  static isAnonymousRoute(request: Request): boolean {
+    const url = new URL(request.url);
+    const pathname = url.pathname;
+    if (pathname === ApiPaths.webhooks() || pathname.startsWith(this.webhookPrefix)) {
+      return true;
+    }
+    if (pathname === "/api/dev/runtime" || pathname === "/api/dev/bootstrap-summary") {
+      return true;
+    }
+    if (pathname === ApiPaths.userInviteVerify() || pathname === ApiPaths.userInviteAccept()) {
+      return true;
+    }
+    if (pathname === ApiPaths.whitelabelLogo()) {
+      return true;
+    }
+    return false;
+  }
+}

package/src/presentation/http/hono/registrars/BinaryHonoApiRouteRegistrar.ts

@@ -0,0 +1,21 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { BinaryHttpRouteHandler } from "../../routeHandlers/BinaryHttpRouteHandlerFactory";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+/** Run-scoped binary content. Workflow overlay binary GET/POST are registered on {@link CodemationHonoApiApp} after route registrars. */
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: BinaryHonoApiRouteRegistrar }])
+export class BinaryHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(BinaryHttpRouteHandler) private readonly handler: BinaryHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/runs/:runId/binary/:binaryId/content", (c) =>
+      this.handler.getRunBinaryContent(c.req.raw, {
+        runId: c.req.param("runId"),
+        binaryId: c.req.param("binaryId"),
+      }),
+    );
+  }
+}

package/src/presentation/http/hono/registrars/CredentialHonoApiRouteRegistrar.ts

@@ -0,0 +1,34 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { CredentialHttpRouteHandler } from "../../routeHandlers/CredentialHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: CredentialHonoApiRouteRegistrar }])
+export class CredentialHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(CredentialHttpRouteHandler) private readonly handler: CredentialHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/credentials/types", (_c) => this.handler.getCredentialTypes());
+    app.get("/credentials/env-status", (_c) => this.handler.getCredentialFieldEnvStatus());
+    app.get("/credentials/instances", (_c) => this.handler.getCredentialInstances());
+    app.get("/workflows/:workflowId/credential-health", (c) =>
+      this.handler.getWorkflowCredentialHealth(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.get("/credentials/instances/:instanceId", (c) =>
+      this.handler.getCredentialInstance(c.req.raw, { instanceId: c.req.param("instanceId") }),
+    );
+    app.post("/credentials/instances", (c) => this.handler.postCredentialInstance(c.req.raw));
+    app.put("/credentials/instances/:instanceId", (c) =>
+      this.handler.putCredentialInstance(c.req.raw, { instanceId: c.req.param("instanceId") }),
+    );
+    app.delete("/credentials/instances/:instanceId", (c) =>
+      this.handler.deleteCredentialInstance(c.req.raw, { instanceId: c.req.param("instanceId") }),
+    );
+    app.put("/credential-bindings", (c) => this.handler.putCredentialBinding(c.req.raw));
+    app.post("/credentials/instances/:instanceId/test", (c) =>
+      this.handler.postCredentialInstanceTest(c.req.raw, { instanceId: c.req.param("instanceId") }),
+    );
+  }
+}

package/src/presentation/http/hono/registrars/DevHonoApiRouteRegistrar.ts

@@ -0,0 +1,17 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { DevBootstrapSummaryHttpRouteHandler } from "../../routeHandlers/DevBootstrapSummaryHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: DevHonoApiRouteRegistrar }])
+export class DevHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(
+    @inject(DevBootstrapSummaryHttpRouteHandler) private readonly handler: DevBootstrapSummaryHttpRouteHandler,
+  ) {}
+
+  register(app: Hono): void {
+    app.get("/dev/bootstrap-summary", () => this.handler.getSummary());
+  }
+}

package/src/presentation/http/hono/registrars/OAuth2HonoApiRouteRegistrar.ts

@@ -0,0 +1,18 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { OAuth2HttpRouteHandler } from "../../routeHandlers/OAuth2HttpRouteHandlerFactory";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: OAuth2HonoApiRouteRegistrar }])
+export class OAuth2HonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(OAuth2HttpRouteHandler) private readonly handler: OAuth2HttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/oauth2/auth", (c) => this.handler.getAuthRedirect(c.req.raw));
+    app.get("/oauth2/callback", (c) => this.handler.getCallback(c.req.raw));
+    app.get("/oauth2/redirect-uri", (c) => this.handler.getRedirectUri(c.req.raw));
+    app.post("/oauth2/disconnect", (c) => this.handler.postDisconnect(c.req.raw));
+  }
+}

package/src/presentation/http/hono/registrars/RunHonoApiRouteRegistrar.ts

@@ -0,0 +1,31 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { RunHttpRouteHandler } from "../../routeHandlers/RunHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: RunHonoApiRouteRegistrar }])
+export class RunHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(RunHttpRouteHandler) private readonly handler: RunHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/runs/:runId", (c) => this.handler.getRun(c.req.raw, { runId: c.req.param("runId") }));
+    app.post("/runs", (c) => this.handler.postRuns(c.req.raw, {}));
+    app.patch("/runs/:runId/workflow-snapshot", (c) =>
+      this.handler.patchRunWorkflowSnapshot(c.req.raw, { runId: c.req.param("runId") }),
+    );
+    app.patch("/runs/:runId/nodes/:nodeId/pin", (c) =>
+      this.handler.patchRunNodePin(c.req.raw, {
+        runId: c.req.param("runId"),
+        nodeId: c.req.param("nodeId"),
+      }),
+    );
+    app.post("/runs/:runId/nodes/:nodeId/run", (c) =>
+      this.handler.postRunNode(c.req.raw, {
+        runId: c.req.param("runId"),
+        nodeId: c.req.param("nodeId"),
+      }),
+    );
+  }
+}

package/src/presentation/http/hono/registrars/UserHonoApiRouteRegistrar.ts

@@ -0,0 +1,24 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { UserHttpRouteHandler } from "../../routeHandlers/UserHttpRouteHandlerFactory";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: UserHonoApiRouteRegistrar }])
+export class UserHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(UserHttpRouteHandler) private readonly handler: UserHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/users/invites/verify", (c) => this.handler.getInviteVerify(c.req.raw));
+    app.post("/users/invites/accept", (c) => this.handler.postAcceptInvite(c.req.raw));
+    app.get("/users", (_c) => this.handler.getUsers());
+    app.post("/users/invites", (c) => this.handler.postInvite(c.req.raw));
+    app.post("/users/:userId/invites/regenerate", (c) =>
+      this.handler.postRegenerateInvite(c.req.raw, { userId: c.req.param("userId") }),
+    );
+    app.patch("/users/:userId/status", (c) =>
+      this.handler.patchUserStatus(c.req.raw, { userId: c.req.param("userId") }),
+    );
+  }
+}

package/src/presentation/http/hono/registrars/WebhookHonoApiRouteRegistrar.ts

@@ -0,0 +1,23 @@
+import { inject, injectable, registry } from "@codemation/core";
+import type { Context } from "hono";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { WebhookHttpRouteHandler } from "../../routeHandlers/WebhookHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: WebhookHonoApiRouteRegistrar }])
+export class WebhookHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(WebhookHttpRouteHandler) private readonly handler: WebhookHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    const path = "/webhooks/:endpointPath";
+    const handle = (c: Context) =>
+      this.handler.postWebhook(c.req.raw, { endpointPath: c.req.param("endpointPath") ?? "" });
+    app.get(path, handle);
+    app.post(path, handle);
+    app.put(path, handle);
+    app.patch(path, handle);
+    app.delete(path, handle);
+  }
+}

package/src/presentation/http/hono/registrars/WhitelabelHonoApiRouteRegistrar.ts

@@ -0,0 +1,18 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { WhitelabelLogoHttpRouteHandler } from "../../routeHandlers/WhitelabelLogoHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: WhitelabelHonoApiRouteRegistrar }])
+export class WhitelabelHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(
+    @inject(WhitelabelLogoHttpRouteHandler)
+    private readonly whitelabelLogoHttpRouteHandler: WhitelabelLogoHttpRouteHandler,
+  ) {}
+
+  register(app: Hono): void {
+    app.get("/whitelabel/logo", () => this.whitelabelLogoHttpRouteHandler.getLogo());
+  }
+}

package/src/presentation/http/hono/registrars/WorkflowHonoApiRouteRegistrar.ts

@@ -0,0 +1,33 @@
+import { inject, injectable, registry } from "@codemation/core";
+import { Hono } from "hono";
+import { ApplicationTokens } from "../../../../applicationTokens";
+import { WorkflowHttpRouteHandler } from "../../routeHandlers/WorkflowHttpRouteHandler";
+import type { HonoApiRouteRegistrar } from "../HonoApiRouteRegistrar";
+
+@injectable()
+@registry([{ token: ApplicationTokens.HonoApiRouteRegistrar, useClass: WorkflowHonoApiRouteRegistrar }])
+export class WorkflowHonoApiRouteRegistrar implements HonoApiRouteRegistrar {
+  constructor(@inject(WorkflowHttpRouteHandler) private readonly handler: WorkflowHttpRouteHandler) {}
+
+  register(app: Hono): void {
+    app.get("/workflows", (c) => this.handler.getWorkflows(c.req.raw, {}));
+    app.get("/workflows/:workflowId/runs", (c) =>
+      this.handler.getWorkflowRuns(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.get("/workflows/:workflowId/debugger-overlay", (c) =>
+      this.handler.getWorkflowDebuggerOverlay(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.put("/workflows/:workflowId/debugger-overlay", (c) =>
+      this.handler.putWorkflowDebuggerOverlay(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.post("/workflows/:workflowId/debugger-overlay/copy-run", (c) =>
+      this.handler.postCopyWorkflowDebuggerOverlay(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.get("/workflows/:workflowId", (c) =>
+      this.handler.getWorkflow(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+    app.patch("/workflows/:workflowId/activation", (c) =>
+      this.handler.patchWorkflowActivation(c.req.raw, { workflowId: c.req.param("workflowId") }),
+    );
+  }
+}

package/src/presentation/http/routeHandlers/BinaryHttpRouteHandlerFactory.ts

@@ -0,0 +1,101 @@
+import type { BinaryAttachment, BinaryBody, BinaryStorage } from "@codemation/core";
+import { CoreTokens, inject, injectable } from "@codemation/core";
+import type { CommandBus } from "../../../application/bus/CommandBus";
+import type { QueryBus } from "../../../application/bus/QueryBus";
+import { UploadOverlayPinnedBinaryCommand } from "../../../application/commands/UploadOverlayPinnedBinaryCommand";
+import { GetRunBinaryAttachmentQuery } from "../../../application/queries/GetRunBinaryAttachmentQuery";
+import { GetWorkflowOverlayBinaryAttachmentQuery } from "../../../application/queries/GetWorkflowOverlayBinaryAttachmentQuery";
+import { ApplicationTokens } from "../../../applicationTokens";
+import { ServerHttpErrorResponseFactory } from "../ServerHttpErrorResponseFactory";
+import type { ServerHttpRouteParams } from "../ServerHttpRouteParams";
+
+@injectable()
+export class BinaryHttpRouteHandler {
+  constructor(
+    @inject(ApplicationTokens.QueryBus)
+    private readonly queryBus: QueryBus,
+    @inject(ApplicationTokens.CommandBus)
+    private readonly commandBus: CommandBus,
+    @inject(CoreTokens.BinaryStorage)
+    private readonly binaryStorage: BinaryStorage,
+  ) {}
+
+  async getRunBinaryContent(_: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      const attachment = await this.queryBus.execute(new GetRunBinaryAttachmentQuery(params.runId!, params.binaryId!));
+      return await this.createBinaryResponse(attachment);
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async getWorkflowOverlayBinaryContent(_: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      const attachment = await this.queryBus.execute(
+        new GetWorkflowOverlayBinaryAttachmentQuery(params.workflowId!, params.binaryId!),
+      );
+      return await this.createBinaryResponse(attachment);
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async postWorkflowDebuggerOverlayBinaryUpload(request: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      const workflowId = params.workflowId!;
+      const form = await request.formData();
+      const fileEntry = form.get("file");
+      const nodeId = String(form.get("nodeId") ?? "").trim();
+      const attachmentName = String(form.get("attachmentName") ?? "file").trim() || "file";
+      const itemIndexRaw = form.get("itemIndex");
+      const itemIndex = typeof itemIndexRaw === "string" ? Number.parseInt(itemIndexRaw, 10) : Number(itemIndexRaw);
+      if (!nodeId) {
+        return Response.json({ error: "nodeId is required" }, { status: 400 });
+      }
+      if (!Number.isFinite(itemIndex) || itemIndex < 0) {
+        return Response.json({ error: "itemIndex must be a non-negative integer" }, { status: 400 });
+      }
+      if (!(fileEntry instanceof Blob) || fileEntry.size === 0) {
+        return Response.json({ error: "file is required" }, { status: 400 });
+      }
+      const mimeType = fileEntry.type && fileEntry.type.trim() ? fileEntry.type : "application/octet-stream";
+      const filename = fileEntry instanceof File ? fileEntry.name : undefined;
+      /** `Blob#stream()` is a web `ReadableStream`; core `BinaryBody` uses the same stream type under Node’s typings. */
+      const body = fileEntry.stream() as BinaryBody;
+      const attachment = await this.commandBus.execute(
+        new UploadOverlayPinnedBinaryCommand(workflowId, nodeId, itemIndex, attachmentName, mimeType, body, filename),
+      );
+      return Response.json({ attachment }, { status: 201 });
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  private async createBinaryResponse(attachment: BinaryAttachment | undefined): Promise<Response> {
+    if (!attachment) {
+      return Response.json({ error: "Unknown binary attachment" }, { status: 404 });
+    }
+    const stored = await this.binaryStorage.openReadStream(attachment.storageKey);
+    if (!stored) {
+      return Response.json({ error: "Binary attachment content is unavailable" }, { status: 404 });
+    }
+    const headers = new Headers();
+    headers.set("content-type", attachment.mimeType);
+    headers.set("content-length", String(stored.size ?? attachment.size));
+    headers.set("content-disposition", this.createContentDisposition(attachment));
+    return new Response(stored.body as unknown as BodyInit, {
+      status: 200,
+      headers,
+    });
+  }
+
+  private createContentDisposition(attachment: BinaryAttachment): string {
+    const dispositionType = attachment.previewKind === "download" ? "attachment" : "inline";
+    const filename = this.escapeFilename(attachment.filename ?? `${attachment.id}`);
+    return `${dispositionType}; filename="${filename}"`;
+  }
+
+  private escapeFilename(value: string): string {
+    return value.replace(/"/g, "");
+  }
+}

package/src/presentation/http/routeHandlers/CredentialHttpRouteHandler.ts

@@ -0,0 +1,129 @@
+import { inject, injectable } from "@codemation/core";
+import { HttpRequestJsonBodyReader } from "../HttpRequestJsonBodyReader";
+import type { CommandBus } from "../../../application/bus/CommandBus";
+import type { QueryBus } from "../../../application/bus/QueryBus";
+import {
+  CreateCredentialInstanceCommand,
+  DeleteCredentialInstanceCommand,
+  TestCredentialInstanceCommand,
+  UpdateCredentialInstanceCommand,
+  UpsertCredentialBindingCommand,
+} from "../../../application/commands/CredentialCommandHandlers";
+import type {
+  CreateCredentialInstanceRequest,
+  UpdateCredentialInstanceRequest,
+  UpsertCredentialBindingRequest,
+} from "../../../application/contracts/CredentialContractsRegistry";
+import {
+  GetCredentialFieldEnvStatusQuery,
+  GetCredentialInstanceQuery,
+  GetCredentialInstanceWithSecretsQuery,
+  GetWorkflowCredentialHealthQuery,
+  ListCredentialInstancesQuery,
+  ListCredentialTypesQuery,
+} from "../../../application/queries/CredentialQueryHandlers";
+import { ApplicationTokens } from "../../../applicationTokens";
+import { ServerHttpErrorResponseFactory } from "../ServerHttpErrorResponseFactory";
+import type { ServerHttpRouteParams } from "../ServerHttpRouteParams";
+
+@injectable()
+export class CredentialHttpRouteHandler {
+  constructor(
+    @inject(ApplicationTokens.QueryBus)
+    private readonly queryBus: QueryBus,
+    @inject(ApplicationTokens.CommandBus)
+    private readonly commandBus: CommandBus,
+  ) {}
+
+  async getCredentialTypes(): Promise<Response> {
+    try {
+      return Response.json(await this.queryBus.execute(new ListCredentialTypesQuery()));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async getCredentialFieldEnvStatus(): Promise<Response> {
+    try {
+      return Response.json(await this.queryBus.execute(new GetCredentialFieldEnvStatusQuery()));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async getCredentialInstances(): Promise<Response> {
+    try {
+      return Response.json(await this.queryBus.execute(new ListCredentialInstancesQuery()));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async getCredentialInstance(request: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      const withSecrets = new URL(request.url).searchParams.get("withSecrets") === "1";
+      const instance = withSecrets
+        ? await this.queryBus.execute(new GetCredentialInstanceWithSecretsQuery(params.instanceId!))
+        : await this.queryBus.execute(new GetCredentialInstanceQuery(params.instanceId!));
+      if (!instance) {
+        return Response.json({ error: "Unknown credential instance" }, { status: 404 });
+      }
+      return Response.json(instance);
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async postCredentialInstance(request: Request): Promise<Response> {
+    try {
+      const body = await HttpRequestJsonBodyReader.readJsonBody<CreateCredentialInstanceRequest>(request);
+      return Response.json(await this.commandBus.execute(new CreateCredentialInstanceCommand(body)));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async putCredentialInstance(request: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      const body = await HttpRequestJsonBodyReader.readJsonBody<UpdateCredentialInstanceRequest>(request);
+      return Response.json(
+        await this.commandBus.execute(new UpdateCredentialInstanceCommand(params.instanceId!, body)),
+      );
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async deleteCredentialInstance(_: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      return Response.json(await this.commandBus.execute(new DeleteCredentialInstanceCommand(params.instanceId!)));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async putCredentialBinding(request: Request): Promise<Response> {
+    try {
+      const body = await HttpRequestJsonBodyReader.readJsonBody<UpsertCredentialBindingRequest>(request);
+      return Response.json(await this.commandBus.execute(new UpsertCredentialBindingCommand(body)));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async postCredentialInstanceTest(_: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      return Response.json(await this.commandBus.execute(new TestCredentialInstanceCommand(params.instanceId!)));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+
+  async getWorkflowCredentialHealth(_: Request, params: ServerHttpRouteParams): Promise<Response> {
+    try {
+      return Response.json(await this.queryBus.execute(new GetWorkflowCredentialHealthQuery(params.workflowId!)));
+    } catch (error) {
+      return ServerHttpErrorResponseFactory.fromUnknown(error);
+    }
+  }
+}

package/src/presentation/http/routeHandlers/DevBootstrapSummaryHttpRouteHandler.ts

@@ -0,0 +1,21 @@
+import { inject, injectable } from "@codemation/core";
+import { DevBootstrapSummaryAssembler } from "../../../application/dev/DevBootstrapSummaryAssembler";
+
+@injectable()
+export class DevBootstrapSummaryHttpRouteHandler {
+  constructor(@inject(DevBootstrapSummaryAssembler) private readonly assembler: DevBootstrapSummaryAssembler) {}
+
+  getSummary(): Response {
+    const payload = this.assembler.assemble();
+    if (!payload) {
+      return new Response(JSON.stringify({ error: "Runtime summary not ready" }), {
+        status: 503,
+        headers: { "content-type": "application/json" },
+      });
+    }
+    return new Response(JSON.stringify(payload), {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    });
+  }
+}