feat(arcrun): implement arcrun MVP — open-source AI workflow engine

Phase 1-5 complete per .agents/specs/u6u-core-mvp/:

**Phase 1 — Cherry-pick & cleanup**
- Create arcrun/ from cypher-executor, credentials, builtins, registry
- Remove 9 InkStone Service Bindings (KBDB, REGISTRY, CLINIC_*, AICEO, MINI_ME)
- Rewrite component-loader: 3-layer (builtin → WASM_BUCKET R2 → error)
- Remove autoPublishMissing.ts, proxy.ts (AICEO), execution-logger.ts (KBDB)
- Clean all KV namespace IDs and InkStone internal URLs from config files

**Phase 2 — contract.yaml completeness**
- Add credentials_required to gmail, google_sheets, telegram, line_notify
- Add config_example to all 21 components with annotated field descriptions

**Phase 3 — Credential injection**
- Add credential-injector.ts: AES-GCM decrypt from CREDENTIALS_KV
- Integrate into GraphExecutor before WASM execution
- Structured errors with repair instructions when credential missing

**Phase 4 — CLI (acr)**
- cli/package.json: arcrun package, bin: acr, deps: commander/js-yaml/chalk/ora
- 8 commands: init, creds push, push, run, validate, parts, list, logs
- Standard mode: writes directly to user's CF KV via CF REST API
- acr init: interactive setup with arcrun.dev API Key registration

**Phase 5 — Open source release prep**
- README.md: 5-minute quickstart, component table, workflow YAML syntax
- CONTRIBUTING.md: TinyGo dev env, component scaffolding, submission flow
- Security audit: no InkStone internal URLs/IDs in committed files
- .gitignore: exclude credentials.yaml, .wrangler, *.wasm

https://claude.ai/code/session_01BnCdSLVH8tUed9VrrPavgT

cypher-executor/src/actions/webhook-handlers.ts

@@ -0,0 +1,67 @@
+import type { Bindings, ExecutionGraph } from '../types';
+import { ExecutionError } from '../types';
+import { GraphExecutor } from '../graph-executor';
+import { graphSchema } from '../lib/schemas';
+import { createComponentLoader } from '../lib/component-loader';
+
+type WebhookRecord = {
+  graph: Record<string, unknown>;
+  description: string;
+  created_at: string;
+};
+
+export function generateToken(): string {
+  const tokenBytes = crypto.getRandomValues(new Uint8Array(16));
+  return Array.from(tokenBytes).map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
+export async function validateAndParseWebhook(raw: string): Promise<WebhookRecord | null> {
+  try {
+    return JSON.parse(raw) as WebhookRecord;
+  } catch {
+    return null;
+  }
+}
+
+export async function executeWebhookGraph(
+  env: Bindings,
+  graph: Record<string, unknown>,
+  triggerContext: Record<string, unknown>,
+  token: string,
+): Promise<{ success: boolean; data?: unknown; error?: string; trace?: unknown; duration_ms: number }> {
+  const parsed = graphSchema.safeParse(graph);
+  if (!parsed.success) {
+    return { success: false, error: '圖定義已失效', duration_ms: 0 };
+  }
+
+  const loader = createComponentLoader(env);
+  const executor = new GraphExecutor(loader, undefined, env);
+  const start = Date.now();
+
+  try {
+    const result = await executor.execute(
+      parsed.data as ExecutionGraph,
+      { ...triggerContext, _webhook_token: token },
+      env.EXEC_CONTEXT,
+    );
+    const duration_ms = Date.now() - start;
+    return { success: true, data: result.data, duration_ms };
+  } catch (err) {
+    const duration_ms = Date.now() - start;
+    const errMsg = err instanceof Error ? err.message : String(err);
+    if (err instanceof ExecutionError) {
+      const traceFormatted = err.trace.map(s => ({
+        node: s.nodeId,
+        status: s.error ? 'failed' : 'success',
+        ...(s.error ? { error: s.error } : {}),
+      }));
+      return {
+        success: false,
+        error: errMsg,
+        trace: traceFormatted,
+        duration_ms,
+      };
+    }
+    return { success: false, error: errMsg, duration_ms };
+  }
+}