arcrun — AI workflow execution engine (clean history)

Self-hosted 開源：WASM 零件 + recipe + cypher-executor，跑在你自己的 Cloudflare。

此為重建的乾淨歷史起點（移除曾誤 commit 的 GCP SA 金鑰，舊歷史保留在
richblack/arcrun 與本地 backup 分支）。含：
- acr init --self-hosted installer（建 KV/R2 + codeload 拉預編譯 wasm + wrangler deploy + seed recipe）
- recipe push 把關（資料外流提醒 + 打通檢查）
- 19 個正當零件預編譯 wasm（claude_api/km_writer/kbdb_upsert_block 排除：違反 DECISIONS §1）
- CLI / cypher-executor / registry / 完整 SDD

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cypher-executor/src/index.ts

@@ -0,0 +1,56 @@
+// arcrun cypher-executor Worker — AI 工作流執行引擎
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import type { ExecutionContext } from '@cloudflare/workers-types';
+import type { Bindings } from './types';
+import { handleScheduled } from './scheduled';
+import { healthRouter } from './routes/health';
+import { executeRouter } from './routes/execute';
+import { cypherRouter } from './routes/cypher';
+import { validateRouter } from './routes/validate';
+import { docsRouter } from './routes/docs';
+import { webhooksRouter } from './routes/webhooks';
+import { webhooksCrudRouter } from './routes/webhooks-crud';
+import { webhooksListRouter } from './routes/webhooks-list';
+import { registerRouter } from './routes/register';
+import { recipesRouter } from './routes/recipes';
+import { credentialsRouter } from './routes/credentials';
+import { webhooksNamedRouter } from './routes/webhooks-named';
+import { authRouter } from './routes/auth';
+import { resumeRouter } from './routes/resume';
+import { executionsRouter } from './routes/executions';
+
+const app = new Hono<{ Bindings: Bindings }>();
+
+// 全域 CORS（允許 arcrun.dev landing page 帶 credentials 存取）
+app.use('*', cors({
+  origin: ['https://arcrun.dev', 'https://www.arcrun.dev'],
+  allowMethods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+  allowHeaders: ['Content-Type', 'Authorization', 'X-Arcrun-API-Key'],
+  credentials: true,
+}));
+
+// 掛載所有路由器
+app.route('/', docsRouter);
+app.route('/', healthRouter);
+app.route('/', executeRouter);
+app.route('/', cypherRouter);
+app.route('/', validateRouter);
+app.route('/', webhooksRouter);
+app.route('/', webhooksNamedRouter);   // 必須在 webhooksCrudRouter 前（避免 /webhooks/:token 攔截 /webhooks/named）
+app.route('/', webhooksCrudRouter);
+app.route('/', webhooksListRouter);
+app.route('/', registerRouter);
+app.route('/', recipesRouter);
+app.route('/', credentialsRouter);
+app.route('/', authRouter);
+app.route('/', resumeRouter);
+app.route('/', executionsRouter);  // LI SDD M2.1: /executions/* + /workflows/:name/executions
+
+// Worker 導出（fetch + scheduled）
+// scheduled handler 對應 wrangler.toml [triggers].crons，每分鐘 tick；
+// 邏輯在 src/scheduled.ts。對應 SDD: arcrun.md 三-A P1 #3。
+export default {
+  fetch: app.fetch,
+  scheduled: handleScheduled,
+} satisfies ExportedHandler<Bindings>;