@kb-labs/workflow-daemon 1.1.0

package/dist/index.js

@@ -0,0 +1,2535 @@
+#!/usr/bin/env node
+import { createServiceBootstrap, platform } from '@kb-labs/core-runtime';
+import { WorkflowEngine, WorkflowService } from '@kb-labs/workflow-engine';
+import { createCorrelatedLogger, registerOpenAPI, HttpObservabilityCollector, createServiceReadyResponse, metricLine } from '@kb-labs/shared-http';
+import { logDiagnosticEvent } from '@kb-labs/core-platform';
+import { PluginCronJobSchema, UserCronJobSchema, evaluateExpression, interpolateObject, resolveValue } from '@kb-labs/workflow-contracts';
+import { SandboxRunner } from '@kb-labs/workflow-runtime';
+import * as cron from 'node-cron';
+import { CronExpressionParser } from 'cron-parser';
+import { stat, readdir, readFile } from 'fs/promises';
+import { join, extname, basename } from 'path';
+import YAML from 'yaml';
+import Fastify from 'fastify';
+import cors from '@fastify/cors';
+import { createRegistry } from '@kb-labs/core-registry';
+import { findRepoRoot } from '@kb-labs/core-sys';
+import { randomUUID } from 'crypto';
+
+async function createWorkflowWorker(options) {
+  const {
+    engine,
+    cliApi,
+    logger,
+    platform: platform2,
+    workspaceRoot,
+    concurrency = 5,
+    defaultTimeout = 12e4,
+    analytics
+  } = options;
+  let isRunning = false;
+  let stopRequested = false;
+  const runningJobs = /* @__PURE__ */ new Map();
+  const claimedJobs = /* @__PURE__ */ new Set();
+  const executionBackend = platform2.executionBackend;
+  const runner = new SandboxRunner({
+    backend: executionBackend,
+    // ExecutionBackend type from plugin-execution
+    cliApi,
+    workspaceRoot,
+    defaultTimeout
+  });
+  async function processJob() {
+    const entry = await engine.nextJob();
+    if (!entry) {
+      return false;
+    }
+    const run = await engine.getRun(entry.runId);
+    if (!run) {
+      logger.error("Data inconsistency: Run not found for job entry", void 0, {
+        runId: entry.runId,
+        jobId: entry.jobId
+      });
+      return true;
+    }
+    const job = run.jobs.find((j) => j.id === entry.jobId);
+    if (!job) {
+      logger.error("Data inconsistency: Job not found in run", void 0, {
+        runId: run.id,
+        jobId: entry.jobId
+      });
+      return true;
+    }
+    const jobKey = `${run.id}:${job.id}`;
+    if (claimedJobs.has(jobKey)) {
+      return true;
+    }
+    claimedJobs.add(jobKey);
+    const jobStartTime = Date.now();
+    const jobLogger = createCorrelatedLogger(logger, {
+      serviceId: "workflow",
+      logsSource: "workflow",
+      layer: "workflow",
+      service: "worker",
+      requestId: run.id,
+      traceId: run.id,
+      operation: "workflow.job",
+      bindings: {
+        workflowId: run.id,
+        runId: run.id,
+        jobId: job.id
+      }
+    });
+    jobLogger.info("Processing job", {
+      runId: run.id,
+      jobId: job.id,
+      jobName: job.jobName
+    });
+    await engine.markJobStarted(run.id, job.id);
+    analytics?.track("workflow.worker.job.started", {
+      runId: run.id,
+      jobId: job.id,
+      jobName: job.jobName,
+      stepCount: job.steps.length
+    }).catch(() => {
+    });
+    const runTarget = run.metadata?.target;
+    const jobTarget = job.target;
+    const target = jobTarget ?? runTarget;
+    const wsProvider = platform2.getAdapter("workspace");
+    let runWorkspace = workspaceRoot;
+    let provisionedWorkspaceId;
+    if (wsProvider) {
+      const wsId = `wt_${run.id.slice(0, 8)}`;
+      try {
+        const ws = await wsProvider.materialize({
+          workspaceId: wsId,
+          sourceRef: "main",
+          metadata: { runId: run.id, jobId: job.id },
+          onProgress: (event) => {
+            jobLogger.info(`[workspace] ${event.stage}: ${event.message}`, {
+              stage: event.stage,
+              progress: event.progress
+            });
+          }
+        });
+        if (ws.rootPath) {
+          runWorkspace = ws.rootPath;
+          provisionedWorkspaceId = ws.workspaceId;
+          jobLogger.info("Workspace provisioned", {
+            workspaceId: ws.workspaceId,
+            provider: ws.provider,
+            rootPath: ws.rootPath
+          });
+        }
+      } catch (wsError) {
+        const msg = wsError instanceof Error ? wsError.message : String(wsError);
+        logDiagnosticEvent(jobLogger, {
+          domain: "workflow",
+          event: "workflow.workspace.provision",
+          level: "error",
+          reasonCode: inferWorkspaceProvisionReasonCode(msg),
+          message: "Workspace provisioning failed",
+          outcome: "failed",
+          error: wsError instanceof Error ? wsError : new Error(String(wsError)),
+          serviceId: "workflow",
+          stage: "materialize",
+          evidence: {
+            runId: run.id,
+            jobId: job.id,
+            workspaceId: wsId
+          }
+        });
+        throw new Error(`Workspace provisioning failed: ${msg}`);
+      }
+    }
+    const jobPromise = (async () => {
+      try {
+        for (const step of job.steps) {
+          if (step.status === "success") {
+            continue;
+          }
+          const freshRun = await engine.getRun(run.id);
+          const exprCtx = {
+            env: freshRun?.env ?? {},
+            trigger: freshRun?.trigger ?? { type: "manual" },
+            steps: {}
+          };
+          if (freshRun) {
+            for (const j of freshRun.jobs) {
+              for (const s of j.steps) {
+                if (s.status === "success" && s.spec.id) {
+                  exprCtx.steps[s.spec.id] = {
+                    outputs: s.outputs ?? {}
+                  };
+                }
+              }
+            }
+          }
+          if (step.spec.if) {
+            const condition = step.spec.if;
+            const rawExpr = condition.trim().replace(/^\$\{\{\s*/, "").replace(/\s*\}\}$/, "");
+            const shouldRun = evaluateExpression(rawExpr, exprCtx);
+            if (!shouldRun) {
+              jobLogger.info("Step skipped (condition false)", {
+                runId: run.id,
+                jobId: job.id,
+                stepId: step.id,
+                condition
+              });
+              await engine.markStepCompleted(run.id, job.id, step.id, { skipped: true });
+              continue;
+            }
+          }
+          const interpolatedWith = step.spec.with ? interpolateObject(step.spec.with, exprCtx) : void 0;
+          const stepExecutionId = `wf-${run.id}-${job.id}-${step.id}-${Date.now()}`;
+          const stepLogger = jobLogger.child({
+            operation: "workflow.step",
+            stepId: step.id,
+            attempt: 1,
+            executionId: stepExecutionId,
+            spanId: stepExecutionId,
+            invocationId: stepExecutionId
+          });
+          stepLogger.info("Executing step", {
+            runId: run.id,
+            jobId: job.id,
+            stepId: step.id,
+            uses: step.spec.uses
+          });
+          if (step.spec.uses === "builtin:approval") {
+            if (step.status !== "waiting_approval") {
+              if (interpolatedWith) {
+                const stateStore = engine.getStateStore();
+                await stateStore.updateStep(run.id, job.id, step.id, (draft) => {
+                  draft.spec = { ...draft.spec, with: interpolatedWith };
+                });
+              }
+              await engine.markStepWaitingApproval(run.id, job.id, step.id);
+            }
+            stepLogger.info("Waiting for approval", {
+              runId: run.id,
+              jobId: job.id,
+              stepId: step.id,
+              context: interpolatedWith
+            });
+            while (!stopRequested) {
+              await sleep(2e3);
+              const currentRun = await engine.getRun(run.id);
+              const currentJob = currentRun?.jobs.find((j) => j.id === job.id);
+              const currentStep = currentJob?.steps.find((s) => s.id === step.id);
+              if (!currentStep || currentStep.status === "success") {
+                stepLogger.info("Approval granted", { runId: run.id, stepId: step.id });
+                break;
+              }
+              if (currentStep.status === "failed") {
+                const rejectMsg = currentStep.error?.message ?? "Approval rejected";
+                stepLogger.info("Approval rejected", { runId: run.id, stepId: step.id });
+                throw new Error(rejectMsg);
+              }
+            }
+            if (stopRequested) {
+              stepLogger.info("Approval wait interrupted by shutdown", { stepId: step.id });
+              return;
+            }
+            continue;
+          }
+          if (step.spec.uses === "builtin:gate") {
+            const gateInput = interpolatedWith ?? {};
+            const decisionPath = gateInput.decision;
+            const maxIterations = gateInput.maxIterations ?? 3;
+            const decisionValue = resolveValue(decisionPath, exprCtx);
+            const decisionKey = String(decisionValue);
+            const route = gateInput.routes[decisionKey] ?? gateInput.routes[decisionValue];
+            const action = route ?? gateInput.default ?? "fail";
+            stepLogger.info("Gate evaluation", {
+              runId: run.id,
+              stepId: step.id,
+              decision: decisionPath,
+              decisionValue,
+              action: typeof action === "string" ? action : "restart"
+            });
+            const iterationKey = `gate:${step.spec.id ?? step.id}:iterations`;
+            const metadata = freshRun?.metadata ?? {};
+            const currentIteration = metadata[iterationKey] ?? 0;
+            if (action === "continue") {
+              await engine.markStepCompleted(run.id, job.id, step.id, {
+                decisionValue,
+                action: "continue",
+                iteration: currentIteration
+              });
+              continue;
+            }
+            if (action === "fail") {
+              const error = new Error(`Gate failed: decision=${decisionKey}`);
+              await engine.markStepFailed(run.id, job.id, step.id, error, {
+                decisionValue,
+                action: "fail",
+                iteration: currentIteration
+              });
+              throw error;
+            }
+            const restartAction = action;
+            const nextIteration = currentIteration + 1;
+            if (nextIteration >= maxIterations) {
+              const error = new Error(
+                `Gate max iterations reached (${maxIterations}) for step ${step.spec.id ?? step.id}`
+              );
+              await engine.markStepFailed(run.id, job.id, step.id, error, {
+                decisionValue,
+                action: "fail",
+                maxIterationsReached: true,
+                iteration: currentIteration,
+                maxIterations
+              });
+              throw error;
+            }
+            stepLogger.info("Gate triggering restart", {
+              restartFrom: restartAction.restartFrom,
+              iteration: nextIteration,
+              maxIterations
+            });
+            await engine.markStepCompleted(run.id, job.id, step.id, {
+              decisionValue,
+              action: "restart",
+              restartFrom: restartAction.restartFrom,
+              iteration: nextIteration
+            });
+            await engine.updateRun(run.id, (draft) => {
+              const md = draft.metadata ?? {};
+              md[iterationKey] = nextIteration;
+              draft.metadata = md;
+              if (restartAction.context) {
+                const payload = draft.trigger.payload ?? {};
+                Object.assign(payload, restartAction.context);
+                draft.trigger.payload = payload;
+              }
+              return draft;
+            });
+            const stateStore = engine.getStateStore();
+            const scheduler = engine.getScheduler();
+            let foundTarget = false;
+            for (const s of job.steps) {
+              if (s.spec.id === restartAction.restartFrom || s.id === restartAction.restartFrom) {
+                foundTarget = true;
+              }
+              if (foundTarget) {
+                await stateStore.updateStep(run.id, job.id, s.id, (draft) => {
+                  draft.status = "queued";
+                  draft.startedAt = void 0;
+                  draft.finishedAt = void 0;
+                  draft.error = void 0;
+                  draft.outputs = void 0;
+                });
+              }
+            }
+            await stateStore.updateJob(run.id, job.id, (draft) => {
+              draft.status = "queued";
+              draft.startedAt = void 0;
+              draft.finishedAt = void 0;
+            });
+            const updatedRun = await engine.getRun(run.id);
+            const updatedJob = updatedRun?.jobs.find((j) => j.id === job.id);
+            if (updatedJob) {
+              await scheduler.enqueueJob(run.id, updatedJob, updatedJob.priority ?? "normal");
+            }
+            return;
+          }
+          await engine.markStepStarted(run.id, job.id, step.id);
+          const interpolatedSpec = interpolatedWith ? { ...step.spec, with: interpolatedWith } : step.spec;
+          const result = await runner.execute({
+            spec: interpolatedSpec,
+            context: {
+              runId: run.id,
+              jobId: job.id,
+              stepId: step.id,
+              attempt: 1,
+              env: freshRun?.env || {},
+              secrets: {},
+              // TODO: map run.secrets array to Record
+              logger: {
+                debug: (message, meta) => stepLogger.debug(message, meta),
+                info: (message, meta) => stepLogger.info(message, meta),
+                warn: (message, meta) => stepLogger.warn(message, meta),
+                error: (message, meta) => stepLogger.error(message, void 0, meta)
+              },
+              trace: {
+                traceId: run.id,
+                spanId: stepExecutionId,
+                parentSpanId: job.id
+              },
+              onLog: (entry2) => {
+                void engine.publishLog(run.id, job.id, step.id, entry2);
+              }
+            },
+            workspace: runWorkspace,
+            target
+          });
+          if (result.status === "failed") {
+            const error = new Error(result.error?.message ?? "Step execution failed");
+            await engine.markStepFailed(run.id, job.id, step.id, error);
+            stepLogger.error("Step failed", error, {
+              runId: run.id,
+              jobId: job.id,
+              stepId: step.id
+            });
+            throw error;
+          }
+          await engine.markStepCompleted(run.id, job.id, step.id, result.status === "success" ? result.outputs : void 0);
+          stepLogger.info("Step completed", {
+            runId: run.id,
+            jobId: job.id,
+            stepId: step.id
+          });
+        }
+        await engine.markJobCompleted(run.id, job.id);
+        const jobDuration = Date.now() - jobStartTime;
+        jobLogger.info("Job completed successfully", {
+          runId: run.id,
+          jobId: job.id
+        });
+        analytics?.track("workflow.worker.job.completed", {
+          runId: run.id,
+          jobId: job.id,
+          jobName: job.jobName,
+          durationMs: jobDuration,
+          stepCount: job.steps.length
+        }).catch(() => {
+        });
+        if (provisionedWorkspaceId && wsProvider) {
+          try {
+            await wsProvider.release(provisionedWorkspaceId);
+            jobLogger.info("Workspace released", { workspaceId: provisionedWorkspaceId });
+          } catch (releaseErr) {
+            jobLogger.warn("Workspace release failed", {
+              workspaceId: provisionedWorkspaceId,
+              error: releaseErr instanceof Error ? releaseErr.message : String(releaseErr)
+            });
+          }
+        }
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        const jobDuration = Date.now() - jobStartTime;
+        await engine.markJobFailed(run.id, job.id, err);
+        analytics?.track("workflow.worker.job.failed", {
+          runId: run.id,
+          jobId: job.id,
+          jobName: job.jobName,
+          errorMessage: err.message,
+          durationMs: jobDuration
+        }).catch(() => {
+        });
+        if (provisionedWorkspaceId) {
+          jobLogger.warn("Workspace kept for debugging", {
+            workspaceId: provisionedWorkspaceId,
+            path: runWorkspace
+          });
+        }
+      } finally {
+        runningJobs.delete(jobKey);
+        claimedJobs.delete(jobKey);
+      }
+    })();
+    runningJobs.set(jobKey, jobPromise);
+    await jobPromise;
+    return true;
+  }
+  async function workerLoop() {
+    while (isRunning && !stopRequested) {
+      try {
+        const processed = await processJob();
+        if (!processed) {
+          await sleep(1e3);
+        }
+      } catch (error) {
+        logDiagnosticEvent(logger, {
+          domain: "workflow",
+          event: "workflow.worker.loop",
+          level: "error",
+          reasonCode: "worker_loop_error",
+          message: "Worker loop error",
+          outcome: "failed",
+          error: error instanceof Error ? error : new Error(String(error)),
+          serviceId: "workflow",
+          evidence: {
+            errorMessage: error instanceof Error ? error.message : String(error),
+            errorStack: error instanceof Error ? error.stack : void 0
+          }
+        });
+        await sleep(5e3);
+      }
+    }
+    logger.info("Worker loop stopped");
+  }
+  return {
+    async start() {
+      if (isRunning) {
+        logger.warn("Worker already running");
+        return;
+      }
+      logger.info("Starting workflow worker", { concurrency });
+      isRunning = true;
+      stopRequested = false;
+      analytics?.track("workflow.worker.started", {
+        concurrency
+      }).catch(() => {
+      });
+      const promises = [];
+      for (let i = 0; i < concurrency; i++) {
+        promises.push(workerLoop());
+      }
+      await Promise.all(promises);
+    },
+    async stop() {
+      if (!isRunning) {
+        return;
+      }
+      logger.info("Stopping workflow worker", {
+        runningJobsCount: runningJobs.size
+      });
+      stopRequested = true;
+      isRunning = false;
+      if (runningJobs.size > 0) {
+        logger.info("Waiting for in-flight jobs to complete", {
+          count: runningJobs.size
+        });
+        const shutdownTimeoutMs = parseInt(
+          process.env.WORKFLOW_SHUTDOWN_TIMEOUT_MS || "120000",
+          10
+        );
+        try {
+          await Promise.race([
+            Promise.all(Array.from(runningJobs.values())),
+            sleep(shutdownTimeoutMs)
+          ]);
+          if (runningJobs.size > 0) {
+            logger.warn("Shutdown timeout reached, marking jobs as interrupted", {
+              count: runningJobs.size
+            });
+            await Promise.all(
+              Array.from(runningJobs.keys()).map(async (jobKey) => {
+                const [runId, jobId] = jobKey.split(":");
+                if (runId && jobId) {
+                  await engine.markJobInterrupted(runId, jobId);
+                }
+              })
+            );
+          } else {
+            logger.info("All in-flight jobs completed gracefully");
+          }
+        } catch (error) {
+          logger.error("Error during graceful shutdown", error instanceof Error ? error : void 0, {
+            runningJobsCount: runningJobs.size
+          });
+        }
+      }
+      logger.info("Workflow worker stopped");
+      analytics?.track("workflow.worker.stopped", {
+        gracefulShutdown: runningJobs.size === 0,
+        interruptedJobs: runningJobs.size
+      }).catch(() => {
+      });
+    }
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+function inferWorkspaceProvisionReasonCode(message) {
+  return /ETIMEDOUT|timeout/iu.test(message) ? "workspace_provision_timeout" : "workspace_provision_failed";
+}
+
+// src/job-broker.ts
+var JobBroker = class {
+  constructor(engine, logger, platform2) {
+    this.engine = engine;
+    this.logger = logger;
+    this.platform = platform2;
+  }
+  /**
+   * Submit a background job for execution.
+   * Creates a WorkflowSpec with a single job and submits to WorkflowEngine.
+   */
+  async submit(request) {
+    this.logger.info("Submitting background job", {
+      handler: request.handler,
+      priority: request.priority ?? "normal"
+    });
+    const uses = request.handler.includes(":") ? request.handler : `command:${request.handler}`;
+    const spec = {
+      name: `job-${request.handler}`,
+      version: "1.0.0",
+      on: { manual: true },
+      jobs: {
+        main: {
+          runsOn: "local",
+          steps: [
+            {
+              id: "execute",
+              name: "Execute handler",
+              uses,
+              // @ts-expect-error - WorkflowSpec step.with type mismatch
+              with: request.input ?? {}
+            }
+          ]
+        }
+      }
+    };
+    const run = await this.engine.runFromInline(spec, {
+      env: {},
+      metadata: request.metadata
+    });
+    this.logger.info("Background job submitted", {
+      runId: run.id,
+      handler: request.handler,
+      status: run.status
+    });
+    return run;
+  }
+  /**
+   * Schedule a recurring job with cron expression.
+   * Registers job with CronScheduler (if available).
+   *
+   * NOTE: CronScheduler integration not yet implemented.
+   * This is a placeholder for future implementation.
+   */
+  async schedule(request) {
+    this.logger.warn("CronScheduler not yet implemented", {
+      handler: request.handler,
+      cron: request.cron
+    });
+    throw new Error("CronScheduler not yet implemented");
+  }
+  /**
+   * Get job status by run ID.
+   */
+  async getStatus(runId) {
+    return this.engine.getRun(runId);
+  }
+  /**
+   * Cancel a running job.
+   */
+  async cancel(runId) {
+    await this.engine.cancelRun(runId);
+    this.logger.info("Job cancelled", { runId });
+  }
+  /**
+   * Get job logs by run ID.
+   * Returns execution logs with optional filtering by level and pagination.
+   * Uses platform.logs service to query logs by runId metadata.
+   */
+  async getJobLogs(runId, options) {
+    const run = await this.engine.getRun(runId);
+    if (!run) {
+      return [];
+    }
+    const limit = options?.limit ?? 100;
+    const offset = options?.offset ?? 0;
+    const startTime = run.startedAt ? new Date(run.startedAt).getTime() : Date.now() - 36e5;
+    const endTime = run.finishedAt ? new Date(run.finishedAt).getTime() : Date.now();
+    const queryResult = await this.platform.logs.query(
+      {
+        from: startTime,
+        to: endTime,
+        level: options?.level && options.level !== "all" ? options.level : void 0
+      },
+      {
+        limit: 1e3,
+        // Query more logs, then filter in-memory
+        offset: 0
+      }
+    );
+    const filteredLogs = queryResult.logs.filter((log) => {
+      return log.fields.runId === runId || log.fields.executionId === runId || // Also check jobId and stepId for drill-down capability
+      log.fields.jobId?.toString().startsWith(runId);
+    });
+    const sortedLogs = filteredLogs.sort((a, b) => b.timestamp - a.timestamp);
+    const paginatedLogs = sortedLogs.slice(offset, offset + limit);
+    return paginatedLogs.map((log) => ({
+      timestamp: new Date(log.timestamp).toISOString(),
+      level: log.level,
+      message: log.message,
+      context: log.fields
+    }));
+  }
+};
+var CronScheduler = class {
+  jobBroker;
+  workflowEngine;
+  logger;
+  defaultTimezone;
+  analytics;
+  // eslint-disable-line @typescript-eslint/consistent-type-imports
+  registeredJobs = /* @__PURE__ */ new Map();
+  scheduledTasks = /* @__PURE__ */ new Map();
+  isRunning = false;
+  constructor(options) {
+    this.jobBroker = options.jobBroker;
+    this.workflowEngine = options.workflowEngine;
+    this.logger = options.logger;
+    this.defaultTimezone = options.timezone ?? "UTC";
+    this.analytics = options.analytics;
+  }
+  /**
+   * Register cron job from plugin manifest.
+   */
+  registerPluginJob(pluginId, job) {
+    const cronJobId = `plugin:${pluginId}:${job.id}`;
+    if (this.registeredJobs.has(cronJobId)) {
+      this.logger.warn("Cron job already registered, skipping", { cronJobId });
+      return;
+    }
+    const registered = {
+      id: cronJobId,
+      source: "plugin",
+      schedule: job.schedule,
+      timezone: job.timezone ?? this.defaultTimezone,
+      priority: job.priority,
+      enabled: job.enabled,
+      handler: job.handler,
+      input: job.input,
+      metadata: job.metadata
+    };
+    this.registeredJobs.set(cronJobId, registered);
+    this.logger.debug("Plugin cron job registered", {
+      cronJobId,
+      schedule: job.schedule,
+      handler: job.handler
+    });
+  }
+  /**
+   * Register cron job from user YAML file.
+   */
+  registerUserJob(fileName, job) {
+    const cronJobId = `user:${fileName}`;
+    if (this.registeredJobs.has(cronJobId)) {
+      this.logger.warn("Cron job already registered, skipping", { cronJobId });
+      return;
+    }
+    const registered = {
+      id: cronJobId,
+      source: "user",
+      schedule: job.schedule,
+      timezone: job.timezone ?? this.defaultTimezone,
+      priority: job.priority,
+      enabled: job.enabled,
+      workflowSpec: {
+        name: job.name,
+        jobs: job.jobs,
+        env: job.env
+      },
+      metadata: job.metadata
+    };
+    this.registeredJobs.set(cronJobId, registered);
+    this.logger.debug("User cron job registered", {
+      cronJobId,
+      schedule: job.schedule,
+      name: job.name
+    });
+  }
+  /**
+   * Start all registered cron jobs.
+   * Schedules enabled jobs using node-cron.
+   */
+  async start() {
+    if (this.isRunning) {
+      this.logger.warn("CronScheduler already running");
+      return;
+    }
+    this.logger.info("Starting CronScheduler", {
+      totalJobs: this.registeredJobs.size
+    });
+    for (const [cronJobId, job] of this.registeredJobs) {
+      if (!job.enabled) {
+        this.logger.debug("Skipping disabled cron job", { cronJobId });
+        continue;
+      }
+      if (!cron.validate(job.schedule)) {
+        this.logger.error("Invalid cron expression", void 0, {
+          cronJobId,
+          schedule: job.schedule
+        });
+        continue;
+      }
+      const task = cron.schedule(
+        job.schedule,
+        () => this.executeCronJob(cronJobId, job),
+        {
+          timezone: job.timezone
+        }
+      );
+      this.scheduledTasks.set(cronJobId, task);
+      this.logger.info("Cron job scheduled", {
+        cronJobId,
+        schedule: job.schedule,
+        timezone: job.timezone,
+        source: job.source
+      });
+    }
+    this.isRunning = true;
+    this.logger.info("CronScheduler started", {
+      scheduledJobs: this.scheduledTasks.size
+    });
+    this.analytics?.track("workflow.cron.scheduler.started", {
+      totalJobs: this.registeredJobs.size,
+      scheduledJobs: this.scheduledTasks.size
+    }).catch(() => {
+    });
+  }
+  /**
+   * Stop all scheduled cron jobs.
+   * Called during graceful shutdown.
+   */
+  async stop() {
+    if (!this.isRunning) {
+      return;
+    }
+    this.logger.info("Stopping CronScheduler", {
+      scheduledJobs: this.scheduledTasks.size
+    });
+    for (const [cronJobId, task] of this.scheduledTasks) {
+      task.stop();
+      this.logger.debug("Cron job stopped", { cronJobId });
+    }
+    const stoppedCount = this.scheduledTasks.size;
+    this.scheduledTasks.clear();
+    this.isRunning = false;
+    this.logger.info("CronScheduler stopped");
+    this.analytics?.track("workflow.cron.scheduler.stopped", {
+      stoppedJobs: stoppedCount
+    }).catch(() => {
+    });
+  }
+  /**
+   * Execute cron job by submitting it to JobBroker.
+   */
+  async executeCronJob(cronJobId, job) {
+    const startTime = Date.now();
+    this.logger.info("Executing cron job", { cronJobId });
+    this.analytics?.track("workflow.cron.job.started", {
+      cronJobId,
+      source: job.source,
+      schedule: job.schedule
+    }).catch(() => {
+    });
+    try {
+      if (job.source === "plugin" && job.handler) {
+        const result = await this.jobBroker.submit({
+          handler: job.handler,
+          input: job.input,
+          priority: job.priority,
+          metadata: {
+            ...job.metadata,
+            cronJobId,
+            scheduledBy: "cron",
+            scheduledAt: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+        this.logger.info("Cron job submitted", {
+          cronJobId,
+          runId: result.id
+        });
+      } else if (job.source === "user" && job.workflowSpec) {
+        const spec = {
+          name: job.workflowSpec.name,
+          version: "1.0.0",
+          on: { manual: true },
+          // Cron-triggered workflows use manual trigger
+          jobs: job.workflowSpec.jobs,
+          env: job.workflowSpec.env
+        };
+        console.log("\u{1F50D} CRON SPEC:", JSON.stringify(spec, null, 2));
+        this.logger.debug("Running workflow from cron", {
+          cronJobId,
+          spec: JSON.stringify(spec, null, 2)
+        });
+        const result = await this.workflowEngine.runFromInline(spec, {
+          trigger: {
+            type: "schedule",
+            payload: {
+              cronJobId,
+              scheduledAt: (/* @__PURE__ */ new Date()).toISOString()
+            }
+          },
+          env: job.workflowSpec.env ?? {},
+          metadata: {
+            ...job.metadata,
+            cronJobId,
+            scheduledBy: "cron",
+            scheduledAt: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+        this.logger.info("Cron workflow submitted", {
+          cronJobId,
+          runId: result.id,
+          workflowName: spec.name
+        });
+      } else {
+        throw new Error(`Invalid cron job configuration: ${cronJobId}`);
+      }
+      const duration = Date.now() - startTime;
+      this.analytics?.track("workflow.cron.job.completed", {
+        cronJobId,
+        source: job.source,
+        durationMs: duration
+      }).catch(() => {
+      });
+    } catch (error) {
+      const duration = Date.now() - startTime;
+      this.logger.error(
+        "Failed to execute cron job",
+        error instanceof Error ? error : void 0,
+        { cronJobId }
+      );
+      this.analytics?.track("workflow.cron.job.failed", {
+        cronJobId,
+        source: job.source,
+        errorMessage: error instanceof Error ? error.message : "Unknown error",
+        durationMs: duration
+      }).catch(() => {
+      });
+    }
+  }
+  /**
+   * Get all registered cron jobs.
+   */
+  getRegisteredJobs() {
+    return Array.from(this.registeredJobs.values());
+  }
+  /**
+   * Get cron job by ID.
+   */
+  getJob(cronJobId) {
+    return this.registeredJobs.get(cronJobId);
+  }
+  /**
+   * Check if scheduler is running.
+   */
+  isSchedulerRunning() {
+    return this.isRunning;
+  }
+  /**
+   * Register cron job (generic method for API usage).
+   * Supports both plugin and API-registered jobs.
+   */
+  register(job) {
+    if (this.registeredJobs.has(job.id)) {
+      this.logger.warn("Cron job already registered, overwriting", { cronJobId: job.id });
+    }
+    this.registeredJobs.set(job.id, job);
+    this.logger.debug("Cron job registered", {
+      cronJobId: job.id,
+      schedule: job.schedule,
+      source: job.source
+    });
+    if (this.isRunning && job.enabled) {
+      this.scheduleJob(job.id, job);
+    }
+  }
+  /**
+   * Unregister cron job by ID.
+   * Stops the scheduled task if running.
+   */
+  unregister(cronJobId) {
+    const job = this.registeredJobs.get(cronJobId);
+    if (!job) {
+      this.logger.warn("Cron job not found for unregister", { cronJobId });
+      return;
+    }
+    const task = this.scheduledTasks.get(cronJobId);
+    if (task) {
+      task.stop();
+      this.scheduledTasks.delete(cronJobId);
+      this.logger.debug("Cron task stopped", { cronJobId });
+    }
+    this.registeredJobs.delete(cronJobId);
+    this.logger.info("Cron job unregistered", { cronJobId });
+  }
+  /**
+   * Pause cron job (stop task but keep registration).
+   */
+  pause(cronJobId) {
+    const job = this.registeredJobs.get(cronJobId);
+    if (!job) {
+      throw new Error(`Cron job not found: ${cronJobId}`);
+    }
+    const task = this.scheduledTasks.get(cronJobId);
+    if (!task) {
+      throw new Error(`Cron task not scheduled: ${cronJobId}`);
+    }
+    task.stop();
+    job.enabled = false;
+    this.logger.info("Cron job paused", { cronJobId });
+  }
+  /**
+   * Resume cron job (restart stopped task).
+   */
+  resume(cronJobId) {
+    const job = this.registeredJobs.get(cronJobId);
+    if (!job) {
+      throw new Error(`Cron job not found: ${cronJobId}`);
+    }
+    const task = this.scheduledTasks.get(cronJobId);
+    if (!task) {
+      if (this.isRunning) {
+        this.scheduleJob(cronJobId, job);
+      }
+    } else {
+      task.start();
+    }
+    job.enabled = true;
+    this.logger.info("Cron job resumed", { cronJobId });
+  }
+  /**
+   * Trigger cron job immediately (manual execution).
+   */
+  async triggerNow(cronJobId) {
+    const job = this.registeredJobs.get(cronJobId);
+    if (!job) {
+      throw new Error(`Cron job not found: ${cronJobId}`);
+    }
+    this.logger.info("Manually triggering cron job", { cronJobId });
+    await this.executeCronJob(cronJobId, job);
+  }
+  /**
+   * Schedule a single cron job (helper method).
+   */
+  scheduleJob(cronJobId, job) {
+    if (!cron.validate(job.schedule)) {
+      this.logger.error("Invalid cron expression", void 0, {
+        cronJobId,
+        schedule: job.schedule
+      });
+      return;
+    }
+    const task = cron.schedule(
+      job.schedule,
+      () => this.executeCronJob(cronJobId, job),
+      {
+        timezone: job.timezone
+      }
+    );
+    this.scheduledTasks.set(cronJobId, task);
+    this.logger.info("Cron job scheduled", {
+      cronJobId,
+      schedule: job.schedule,
+      timezone: job.timezone,
+      source: job.source
+    });
+  }
+  /**
+   * Get next scheduled run time for a cron job.
+   * Returns null if job doesn't exist or has invalid cron expression.
+   */
+  getNextRunTime(cronJobId) {
+    const job = this.registeredJobs.get(cronJobId);
+    if (!job) {
+      return null;
+    }
+    if (!job.schedule || job.schedule.trim() === "") {
+      return null;
+    }
+    try {
+      const interval = CronExpressionParser.parse(job.schedule, {
+        tz: job.timezone,
+        currentDate: /* @__PURE__ */ new Date()
+      });
+      return interval.next().toDate();
+    } catch (error) {
+      this.logger.error("Failed to parse cron expression", error instanceof Error ? error : void 0, {
+        cronJobId,
+        schedule: job.schedule
+      });
+      return null;
+    }
+  }
+  /**
+   * Clear all registered cron jobs.
+   * IMPORTANT: This does NOT stop scheduled tasks - call stop() first if needed.
+   */
+  clearAll() {
+    this.logger.info("Clearing all registered cron jobs", {
+      count: this.registeredJobs.size
+    });
+    this.registeredJobs.clear();
+  }
+};
+var CronDiscovery = class {
+  cliApi;
+  scheduler;
+  logger;
+  workspaceRoot;
+  constructor(options) {
+    this.cliApi = options.cliApi;
+    this.scheduler = options.scheduler;
+    this.logger = options.logger;
+    this.workspaceRoot = options.workspaceRoot;
+  }
+  /**
+   * Discover and register all cron jobs.
+   * Scans plugin manifests and user YAML files.
+   */
+  async discoverAll() {
+    this.logger.info("Starting cron job discovery");
+    const pluginJobs = await this.discoverPluginJobs();
+    const userJobs = await this.discoverUserJobs();
+    this.logger.info("Cron job discovery complete", {
+      pluginJobs,
+      userJobs,
+      total: pluginJobs + userJobs
+    });
+    return { plugins: pluginJobs, users: userJobs };
+  }
+  /**
+   * Discover cron jobs from plugin manifests via entity registry.
+   * Uses queryEntities({ kind: 'cron' }) — no manual manifest scanning.
+   */
+  async discoverPluginJobs() {
+    let count = 0;
+    try {
+      const cronEntities = this.cliApi.queryEntities({ kind: "cron" });
+      for (const entity of cronEntities) {
+        try {
+          const validated = PluginCronJobSchema.parse(entity.declaration);
+          this.scheduler.registerPluginJob(entity.ref.pluginId, validated);
+          count++;
+        } catch (error) {
+          this.logger.warn("Invalid plugin cron job definition", {
+            pluginId: entity.ref.pluginId,
+            entityId: entity.ref.entityId,
+            error: error instanceof Error ? error.message : String(error)
+          });
+        }
+      }
+      if (cronEntities.length > 0) {
+        this.logger.debug("Discovered plugin cron jobs via registry", {
+          total: cronEntities.length,
+          registered: count
+        });
+      }
+    } catch (error) {
+      this.logger.error(
+        "Failed to discover plugin cron jobs",
+        error instanceof Error ? error : void 0
+      );
+    }
+    return count;
+  }
+  /**
+   * Discover cron jobs from user YAML files in .kb/jobs/*.yml
+   */
+  async discoverUserJobs() {
+    let count = 0;
+    const jobsDir = join(this.workspaceRoot, ".kb", "jobs");
+    try {
+      const dirStat = await stat(jobsDir).catch(() => null);
+      if (!dirStat?.isDirectory()) {
+        this.logger.debug("User jobs directory does not exist", { jobsDir });
+        return 0;
+      }
+      const files = await readdir(jobsDir);
+      const yamlFiles = files.filter((file) => {
+        const ext = extname(file);
+        return ext === ".yml" || ext === ".yaml";
+      });
+      const results = await Promise.allSettled(
+        yamlFiles.map(async (file) => {
+          const filePath = join(jobsDir, file);
+          const ext = extname(file);
+          const content = await readFile(filePath, "utf-8");
+          const parsed = YAML.parse(content);
+          const validated = UserCronJobSchema.parse(parsed);
+          if (validated.autoStart) {
+            const fileName = basename(file, ext);
+            this.scheduler.registerUserJob(fileName, validated);
+            return 1;
+          } else {
+            this.logger.debug("Skipping user cron job (autoStart: false)", {
+              file
+            });
+            return 0;
+          }
+        })
+      );
+      for (const result of results) {
+        if (result.status === "fulfilled") {
+          count += result.value;
+        } else {
+          this.logger.warn("Failed to parse user cron job file", {
+            error: result.reason instanceof Error ? result.reason.message : String(result.reason)
+          });
+        }
+      }
+    } catch (error) {
+      this.logger.warn("Failed to discover user cron jobs", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    return count;
+  }
+};
+
+// src/host/workflow-host-service.ts
+var TENANT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
+var CRON_SCHEDULER_NOT_AVAILABLE = "Cron scheduler not available";
+var WorkflowHostService = class {
+  constructor(options) {
+    this.options = options;
+  }
+  getHealth() {
+    return { ok: true, service: "workflow-daemon" };
+  }
+  async getMetrics() {
+    return this.options.engine.getMetrics();
+  }
+  async submitJob(tenantId, request) {
+    this.assertTenantId(tenantId);
+    if (!request.type) {
+      throw new Error("Missing required field: type");
+    }
+    if (request.priority !== void 0 && (request.priority < 1 || request.priority > 10)) {
+      throw new Error("Priority must be between 1 and 10");
+    }
+    const run = await this.options.jobBroker.submit({
+      handler: request.type,
+      input: request.payload,
+      priority: mapPriority(request.priority ?? 5)
+    });
+    this.options.logger.info("Job submitted", {
+      jobId: run.id,
+      type: request.type,
+      tenantId
+    });
+    return { jobId: run.id };
+  }
+  async getJob(tenantId, jobId) {
+    this.assertTenantId(tenantId);
+    const run = await this.options.engine.getRun(jobId);
+    if (!run) {
+      throw new Error("Job not found");
+    }
+    return {
+      id: run.id,
+      type: run.name,
+      status: mapRunStatusToJobStatus(run.status),
+      tenantId: run.tenantId ?? tenantId,
+      createdAt: run.createdAt,
+      startedAt: run.startedAt,
+      finishedAt: run.finishedAt,
+      result: run.result,
+      error: run.result?.error?.message,
+      jobs: run.jobs?.map((job) => ({
+        id: job.id,
+        name: job.jobName,
+        status: job.status,
+        startedAt: job.startedAt,
+        finishedAt: job.finishedAt,
+        durationMs: job.durationMs,
+        error: job.error?.message,
+        steps: job.steps?.map((step) => ({
+          id: step.id,
+          name: step.name,
+          status: step.status,
+          handler: step.spec?.uses,
+          startedAt: step.startedAt,
+          finishedAt: step.finishedAt,
+          durationMs: step.durationMs,
+          outputs: step.outputs,
+          error: step.error
+        }))
+      }))
+    };
+  }
+  async getJobSteps(jobId) {
+    const run = await this.options.engine.getRun(jobId);
+    if (!run) {
+      throw new Error("Job not found");
+    }
+    return run.jobs?.flatMap(
+      (job) => job.steps?.map((step) => ({
+        id: step.id,
+        name: step.name,
+        status: step.status,
+        handler: step.spec?.uses,
+        startedAt: step.startedAt,
+        finishedAt: step.finishedAt,
+        durationMs: step.durationMs,
+        outputs: step.outputs,
+        error: step.error,
+        jobId: job.id,
+        jobName: job.jobName
+      })) ?? []
+    ) ?? [];
+  }
+  async getJobLogs(jobId, options) {
+    const logs = await this.options.jobBroker.getJobLogs(jobId, options);
+    return logs;
+  }
+  async cancelJob(tenantId, jobId) {
+    await this.options.engine.cancelRun(jobId);
+    this.options.logger.info("Job cancelled", { jobId, tenantId });
+    return { cancelled: true };
+  }
+  async listJobs(tenantId, filter) {
+    this.assertTenantId(tenantId);
+    const { type, status, limit, offset } = filter;
+    const allRuns = await this.options.engine.getAllRuns();
+    let jobs = allRuns.map((run) => ({
+      id: run.id,
+      type: run.name,
+      status: mapRunStatusToJobStatus(run.status),
+      tenantId: run.tenantId ?? tenantId,
+      createdAt: run.createdAt,
+      startedAt: run.startedAt,
+      finishedAt: run.finishedAt,
+      result: run.result,
+      error: run.result?.error?.message
+    }));
+    if (type) {
+      const pattern = type.replace(/\*/g, ".*");
+      const regex = new RegExp(`^${pattern}$`);
+      jobs = jobs.filter((job) => regex.test(job.type));
+    }
+    if (status) {
+      jobs = jobs.filter((job) => job.status === status);
+    }
+    const start = offset ?? 0;
+    const end = limit ? start + limit : jobs.length;
+    return { jobs: jobs.slice(start, end) };
+  }
+  async listActiveExecutions() {
+    const runs = await this.options.engine.getActiveExecutions();
+    return runs.map((run) => ({
+      id: run.id,
+      type: run.name,
+      status: mapRunStatusToJobStatus(run.status),
+      startedAt: run.startedAt,
+      createdAt: run.createdAt
+    }));
+  }
+  async listWorkflows(options) {
+    const workflowService = this.requireWorkflowService();
+    const workflows = await workflowService.listAll({
+      source: options.source,
+      status: options.status === "inactive" ? "disabled" : options.status,
+      tags: options.tags ? options.tags.split(",") : void 0
+    });
+    const response = {
+      workflows: workflows.map((w) => this.mapWorkflowInfo(w))
+    };
+    return response;
+  }
+  async getWorkflow(id) {
+    const workflowService = this.requireWorkflowService();
+    const workflow = await workflowService.get(id);
+    if (!workflow) {
+      return null;
+    }
+    return this.mapWorkflowInfo(workflow);
+  }
+  async runWorkflow(id, request) {
+    const workflowService = this.requireWorkflowService();
+    const workflow = await workflowService.get(id);
+    if (!workflow) {
+      throw new Error("Workflow not found");
+    }
+    const specInput = workflow.input;
+    const spec = {
+      ...specInput,
+      ...request.target ? { target: request.target } : {},
+      ...request.isolation ? { isolation: request.isolation } : {}
+    };
+    const triggerType = request.trigger?.type === "cron" ? "schedule" : request.trigger?.type === "api" ? "webhook" : "manual";
+    const run = await this.options.engine.runFromSpec(spec, {
+      trigger: {
+        type: triggerType,
+        actor: request.trigger?.user,
+        payload: request.input && typeof request.input === "object" ? request.input : void 0
+      }
+    });
+    return {
+      runId: run.id,
+      status: run.status
+    };
+  }
+  registerCron(tenantId, request) {
+    this.assertTenantId(tenantId);
+    const scheduler = this.requireCronScheduler();
+    if (!request.id || !request.schedule || !request.jobType) {
+      throw new Error("Missing required fields: id, schedule, jobType");
+    }
+    scheduler.register({
+      id: request.id,
+      source: "user",
+      schedule: request.schedule,
+      timezone: request.timezone ?? "UTC",
+      priority: "normal",
+      enabled: request.enabled ?? true,
+      handler: request.jobType,
+      metadata: {
+        tenantId,
+        payload: request.payload
+      }
+    });
+    this.options.logger.info("Cron job registered", {
+      id: request.id,
+      schedule: request.schedule,
+      jobType: request.jobType,
+      tenantId
+    });
+    return { ok: true };
+  }
+  unregisterCron(tenantId, id) {
+    const scheduler = this.requireCronScheduler();
+    scheduler.unregister(id);
+    this.options.logger.info("Cron job unregistered", { id, tenantId });
+    return { ok: true };
+  }
+  triggerCron(tenantId, id) {
+    const scheduler = this.requireCronScheduler();
+    return scheduler.triggerNow(id).then(() => {
+      this.options.logger.info("Cron job triggered manually", { id, tenantId });
+      return { ok: true };
+    });
+  }
+  pauseCron(tenantId, id) {
+    const scheduler = this.requireCronScheduler();
+    scheduler.pause(id);
+    this.options.logger.info("Cron job paused", { id, tenantId });
+    return { ok: true };
+  }
+  resumeCron(tenantId, id) {
+    const scheduler = this.requireCronScheduler();
+    scheduler.resume(id);
+    this.options.logger.info("Cron job resumed", { id, tenantId });
+    return { ok: true };
+  }
+  listCron() {
+    const scheduler = this.requireCronScheduler();
+    const crons = scheduler.getRegisteredJobs().map((job) => ({
+      id: job.id,
+      schedule: job.schedule,
+      jobType: job.handler ?? "unknown",
+      timezone: job.timezone ?? "UTC",
+      enabled: job.enabled,
+      lastRun: void 0,
+      nextRun: scheduler.getNextRunTime(job.id) ?? void 0,
+      pluginId: job.source === "plugin" ? job.id.split(":")[1] : void 0
+    }));
+    return { crons };
+  }
+  listLegacyCronJobs() {
+    const scheduler = this.requireCronScheduler();
+    const cronJobs = scheduler.getRegisteredJobs();
+    return {
+      cronJobs: cronJobs.map((job) => ({
+        id: job.id,
+        source: job.source,
+        schedule: job.schedule,
+        timezone: job.timezone,
+        priority: job.priority,
+        enabled: job.enabled,
+        handler: job.handler,
+        workflowName: job.workflowSpec?.name,
+        metadata: job.metadata
+      })),
+      total: cronJobs.length,
+      running: scheduler.isSchedulerRunning()
+    };
+  }
+  assertTenantId(tenantId) {
+    if (!TENANT_ID_PATTERN.test(tenantId) || tenantId.length > 64) {
+      throw new Error("Invalid tenant ID format or length (max 64 chars)");
+    }
+  }
+  async listWorkflowRuns(workflowId, filters) {
+    const allRuns = await this.options.engine.getAllRuns();
+    let workflowName;
+    if (this.options.workflowService) {
+      const workflow = await this.options.workflowService.get(workflowId);
+      workflowName = workflow?.name;
+    }
+    let runs = allRuns.filter(
+      (run) => run.name === workflowId || workflowName && run.name === workflowName
+    );
+    if (filters?.status) {
+      runs = runs.filter((run) => run.status === filters.status);
+    }
+    runs.sort((a, b) => new Date(b.createdAt ?? 0).getTime() - new Date(a.createdAt ?? 0).getTime());
+    const start = filters?.offset ?? 0;
+    const end = filters?.limit ? start + filters.limit : runs.length;
+    const page = runs.slice(start, end);
+    return {
+      workflowId,
+      runs: page.map((run) => ({
+        id: run.id,
+        workflowId,
+        status: run.status,
+        trigger: {
+          type: run.trigger?.type ?? "manual",
+          user: run.trigger?.actor
+        },
+        startedAt: run.startedAt ?? run.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+        finishedAt: run.finishedAt,
+        durationMs: run.durationMs,
+        error: run.result?.error?.message
+      })),
+      total: runs.length
+    };
+  }
+  mapWorkflowInfo(workflow) {
+    return {
+      id: workflow.id,
+      name: workflow.name,
+      description: workflow.description,
+      source: workflow.source,
+      pluginId: workflow.pluginId,
+      status: workflow.status === "active" ? "active" : "inactive",
+      tags: workflow.tags,
+      inputs: workflow.inputSchema
+    };
+  }
+  async getRun(runId) {
+    return await this.options.engine.getRun(runId);
+  }
+  async listRuns(filters) {
+    const allRuns = await this.options.engine.getAllRuns();
+    let runs = allRuns;
+    if (filters?.status) {
+      runs = runs.filter((run) => run.status === filters.status);
+    }
+    runs.sort((a, b) => new Date(b.createdAt ?? 0).getTime() - new Date(a.createdAt ?? 0).getTime());
+    const total = runs.length;
+    const start = filters?.offset ?? 0;
+    const end = filters?.limit ? start + filters.limit : runs.length;
+    return { runs: runs.slice(start, end), total };
+  }
+  async cancelRun(runId) {
+    const run = await this.options.engine.getRun(runId);
+    if (!run) {
+      throw new Error("Run not found");
+    }
+    if (run.status !== "running" && run.status !== "queued") {
+      throw new Error(`Cannot cancel run with status "${run.status}"`);
+    }
+    await this.options.engine.cancelRun(runId);
+  }
+  requireWorkflowService() {
+    if (!this.options.workflowService) {
+      throw new Error("Workflow service not available");
+    }
+    return this.options.workflowService;
+  }
+  requireCronScheduler() {
+    if (!this.options.cronScheduler) {
+      throw new Error(CRON_SCHEDULER_NOT_AVAILABLE);
+    }
+    return this.options.cronScheduler;
+  }
+};
+function mapRunStatusToJobStatus(status) {
+  switch (status) {
+    case "queued":
+      return "pending";
+    case "running":
+      return "running";
+    case "success":
+      return "completed";
+    case "failed":
+      return "failed";
+    case "cancelled":
+      return "cancelled";
+    case "skipped":
+      return "cancelled";
+    case "dlq":
+      return "failed";
+  }
+}
+function mapPriority(priority) {
+  if (priority <= 3) {
+    return "low";
+  }
+  if (priority <= 7) {
+    return "normal";
+  }
+  return "high";
+}
+
+// src/api/response.ts
+function ok(data) {
+  return { ok: true, data };
+}
+function fail(reply, statusCode, message) {
+  reply.code(statusCode);
+  return { ok: false, error: message };
+}
+
+// src/api/jobs-api.ts
+function registerJobsAPI(options) {
+  const { server, hostService, logger, observability } = options;
+  server.post(
+    "/api/v1/jobs",
+    { schema: { tags: ["Jobs"], summary: "Submit a new job" } },
+    async (request, reply) => {
+      const tenantId = request.headers["x-tenant-id"] ?? "default";
+      try {
+        const data = await observability.observeOperation("workflow.job.submit", () => hostService.submitJob(tenantId, request.body));
+        return ok(data);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Job submission failed";
+        logger.error("Job submission failed", error instanceof Error ? error : void 0, { tenantId });
+        if (message.startsWith("Invalid tenant") || message.startsWith("Missing required") || message.startsWith("Priority")) {
+          return fail(reply, 400, message);
+        } else {
+          return fail(reply, 500, message);
+        }
+      }
+    }
+  );
+  server.get(
+    "/api/v1/jobs/:jobId",
+    { schema: { tags: ["Jobs"], summary: "Get job status" } },
+    async (request, reply) => {
+      const { jobId } = request.params;
+      const tenantId = request.headers["x-tenant-id"] ?? "default";
+      try {
+        const data = await observability.observeOperation("workflow.job.get", () => hostService.getJob(tenantId, jobId));
+        return ok(data);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to get job status";
+        if (message === "Job not found") {
+          return fail(reply, 404, message);
+        }
+        logger.error("Failed to get job status", error instanceof Error ? error : void 0, { jobId });
+        return fail(reply, 500, message);
+      }
+    }
+  );
+  server.post(
+    "/api/v1/jobs/:jobId/cancel",
+    { schema: { tags: ["Jobs"], summary: "Cancel a job" } },
+    async (request, reply) => {
+      const { jobId } = request.params;
+      const tenantId = request.headers["x-tenant-id"] ?? "default";
+      try {
+        const data = await observability.observeOperation("workflow.job.cancel", () => hostService.cancelJob(tenantId, jobId));
+        return ok(data);
+      } catch (error) {
+        logger.error("Failed to cancel job", error instanceof Error ? error : void 0);
+        return fail(reply, 500, error instanceof Error ? error.message : "Failed to cancel job");
+      }
+    }
+  );
+  server.get(
+    "/api/v1/jobs",
+    { schema: { tags: ["Jobs"], summary: "List jobs" } },
+    async (request, reply) => {
+      const tenantId = request.headers["x-tenant-id"] ?? "default";
+      const filter = request.query;
+      try {
+        const data = await observability.observeOperation("workflow.job.list", () => hostService.listJobs(tenantId, filter));
+        return ok(data);
+      } catch (error) {
+        logger.error("Failed to list jobs", error instanceof Error ? error : void 0);
+        return fail(reply, 500, error instanceof Error ? error.message : "Failed to list jobs");
+      }
+    }
+  );
+  server.get(
+    "/api/v1/jobs/:jobId/steps",
+    { schema: { tags: ["Jobs"], summary: "Get job steps" } },
+    async (request, reply) => {
+      const { jobId } = request.params;
+      try {
+        const steps = await observability.observeOperation("workflow.job.steps", () => hostService.getJobSteps(jobId));
+        return ok(steps);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to get job steps";
+        if (message === "Job not found") {
+          return fail(reply, 404, message);
+        }
+        return fail(reply, 500, message);
+      }
+    }
+  );
+  server.get(
+    "/api/v1/jobs/:jobId/logs",
+    { schema: { tags: ["Jobs"], summary: "Get job logs" } },
+    async (request, reply) => {
+      const { jobId } = request.params;
+      const limit = typeof request.query === "object" && request.query && "limit" in request.query ? Number(request.query.limit) : void 0;
+      const offset = typeof request.query === "object" && request.query && "offset" in request.query ? Number(request.query.offset) : void 0;
+      const level = typeof request.query === "object" && request.query && "level" in request.query ? String(request.query.level) : void 0;
+      try {
+        const logs = await observability.observeOperation(
+          "workflow.job.logs",
+          () => hostService.getJobLogs(jobId, { limit, offset, level })
+        );
+        return ok({ logs });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to get job logs";
+        if (message === "Job not found") {
+          return fail(reply, 404, message);
+        }
+        return fail(reply, 500, message);
+      }
+    }
+  );
+}
+
+// src/api/cron-api.ts
+function registerCronAPI(options) {
+  const { server, hostService, logger, observability } = options;
+  const registerCronHandler = async (request, reply) => {
+    const tenantId = request.headers["x-tenant-id"] ?? "default";
+    try {
+      const data = await observability.observeOperation(
+        "workflow.cron.register",
+        () => Promise.resolve(hostService.registerCron(tenantId, request.body))
+      );
+      return ok(data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to register cron job";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      if (message.startsWith("Missing required fields")) {
+        return fail(reply, 400, message);
+      }
+      logger.error("Failed to register cron job", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  const listCronHandler = async (_request, reply) => {
+    try {
+      return ok(await observability.observeOperation("workflow.cron.list", () => Promise.resolve(hostService.listCron())));
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to list cron jobs";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      logger.error("Failed to list cron jobs", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  const unregisterCronHandler = async (request, reply) => {
+    const { id } = request.params;
+    const tenantId = request.headers["x-tenant-id"] ?? "default";
+    try {
+      const data = await observability.observeOperation(
+        "workflow.cron.unregister",
+        () => Promise.resolve(hostService.unregisterCron(tenantId, id))
+      );
+      return ok(data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to unregister cron job";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      logger.error("Failed to unregister cron job", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  const triggerCronHandler = async (request, reply) => {
+    const { id } = request.params;
+    const tenantId = request.headers["x-tenant-id"] ?? "default";
+    try {
+      const data = await observability.observeOperation("workflow.cron.trigger", () => hostService.triggerCron(tenantId, id));
+      return ok(data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to trigger cron job";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      logger.error("Failed to trigger cron job", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  const pauseCronHandler = async (request, reply) => {
+    const { id } = request.params;
+    const tenantId = request.headers["x-tenant-id"] ?? "default";
+    try {
+      const data = await observability.observeOperation(
+        "workflow.cron.pause",
+        () => Promise.resolve(hostService.pauseCron(tenantId, id))
+      );
+      return ok(data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to pause cron job";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      logger.error("Failed to pause cron job", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  const resumeCronHandler = async (request, reply) => {
+    const { id } = request.params;
+    const tenantId = request.headers["x-tenant-id"] ?? "default";
+    try {
+      const data = await observability.observeOperation(
+        "workflow.cron.resume",
+        () => Promise.resolve(hostService.resumeCron(tenantId, id))
+      );
+      return ok(data);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to resume cron job";
+      if (message === "Cron scheduler not available") {
+        return fail(reply, 503, message);
+      }
+      logger.error("Failed to resume cron job", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  };
+  server.post("/api/v1/crons", { schema: { tags: ["Cron"], summary: "Register a cron job" } }, registerCronHandler);
+  server.get("/api/v1/crons", { schema: { tags: ["Cron"], summary: "List cron jobs" } }, listCronHandler);
+  server.delete("/api/v1/crons/:id", { schema: { tags: ["Cron"], summary: "Unregister a cron job" } }, unregisterCronHandler);
+  server.post("/api/v1/crons/:id/trigger", { schema: { tags: ["Cron"], summary: "Trigger a cron job immediately" } }, triggerCronHandler);
+  server.post("/api/v1/crons/:id/pause", { schema: { tags: ["Cron"], summary: "Pause a cron job" } }, pauseCronHandler);
+  server.post("/api/v1/crons/:id/resume", { schema: { tags: ["Cron"], summary: "Resume a cron job" } }, resumeCronHandler);
+}
+
+// src/api/workflows-api.ts
+var TERMINAL_EVENTS = ["run.finished", "run.failed", "run.cancelled"];
+var TERMINAL_STATUSES = ["success", "failed", "cancelled", "skipped"];
+var KEEP_ALIVE_MS = 3e4;
+var IDLE_TIMEOUT_MS = 6e4;
+function registerWorkflowsAPI(options) {
+  const { server, hostService, engine, workflowService, logger, observability } = options;
+  server.post("/api/v1/workflows/refresh", { schema: { tags: ["Workflows"], summary: "Reload workflow definitions from disk" } }, async () => {
+    try {
+      logger.info("[workflows-api] Refreshing workflows from disk");
+      if (workflowService) {
+        await observability.observeOperation("workflow.catalog.refresh", () => workflowService.refreshManifests());
+      }
+      const workflows = workflowService ? await observability.observeOperation("workflow.catalog.list", () => workflowService.listAll()) : [];
+      return ok({
+        workflowsLoaded: workflows.length,
+        workflowIds: workflows.map((w) => w.id)
+      });
+    } catch (error) {
+      logger.error("[workflows-api] Failed to refresh workflows", error instanceof Error ? error : void 0);
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    }
+  });
+  server.get("/api/v1/workflows", { schema: { tags: ["Workflows"], summary: "List workflow definitions" } }, async (request, reply) => {
+    try {
+      const response = await observability.observeOperation("workflow.catalog.list", () => hostService.listWorkflows(request.query));
+      return ok(response);
+    } catch (error) {
+      logger.error("[workflows-api] Error listing workflows", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to list workflows");
+    }
+  });
+  server.get("/api/v1/workflows/:id", { schema: { tags: ["Workflows"], summary: "Get workflow definition" } }, async (request, reply) => {
+    try {
+      const { id } = request.params;
+      const workflow = await observability.observeOperation("workflow.catalog.get", () => hostService.getWorkflow(id));
+      if (!workflow) {
+        return fail(reply, 404, "Workflow not found");
+      }
+      return ok(workflow);
+    } catch (error) {
+      logger.error("[workflows-api] Error getting workflow", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to get workflow");
+    }
+  });
+  server.get("/api/v1/workflows/:id/runs", { schema: { tags: ["Workflows"], summary: "List runs for a workflow" } }, async (request, reply) => {
+    try {
+      const { id } = request.params;
+      const { limit, offset, status } = request.query;
+      const response = await observability.observeOperation(
+        "workflow.run.list",
+        () => hostService.listWorkflowRuns(id, {
+          limit: limit ? parseInt(limit, 10) : 50,
+          offset: offset ? parseInt(offset, 10) : 0,
+          status
+        })
+      );
+      return ok(response);
+    } catch (error) {
+      logger.error("[workflows-api] Error listing workflow runs", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to list workflow runs");
+    }
+  });
+  server.post("/api/v1/workflows/:id/runs", { schema: { tags: ["Workflows"], summary: "Run a workflow" } }, async (request, reply) => {
+    try {
+      const { id } = request.params;
+      const response = await observability.observeOperation("workflow.run.start", () => hostService.runWorkflow(id, request.body || {}));
+      return ok(response);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to run workflow";
+      if (message === "Workflow not found") {
+        return fail(reply, 404, message);
+      }
+      logger.error("[workflows-api] Error running workflow", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  });
+  server.post("/api/v1/runs/:runId/cancel", { schema: { tags: ["Runs"], summary: "Cancel a workflow run" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      await observability.observeOperation("workflow.run.cancel", () => hostService.cancelRun(runId));
+      return ok({ cancelled: true, runId });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to cancel run";
+      if (message === "Run not found") {
+        return fail(reply, 404, message);
+      }
+      if (message.startsWith("Cannot cancel run")) {
+        return fail(reply, 409, message);
+      }
+      logger.error("[workflows-api] Error cancelling run", error instanceof Error ? error : void 0);
+      return fail(reply, 500, message);
+    }
+  });
+  server.get("/api/v1/runs", { schema: { tags: ["Runs"], summary: "List all workflow runs" } }, async (request, reply) => {
+    try {
+      const { status, limit, offset } = request.query;
+      const response = await observability.observeOperation(
+        "workflow.run.list",
+        () => hostService.listRuns({
+          status,
+          limit: limit ? parseInt(limit, 10) : 50,
+          offset: offset ? parseInt(offset, 10) : 0
+        })
+      );
+      return ok(response);
+    } catch (error) {
+      logger.error("[workflows-api] Error listing runs", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to list runs");
+    }
+  });
+  server.get("/api/v1/runs/:runId", { schema: { tags: ["Runs"], summary: "Get a workflow run" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      const run = await observability.observeOperation("workflow.run.get", () => hostService.getRun(runId));
+      if (!run) {
+        return fail(reply, 404, "Run not found");
+      }
+      return ok({ run });
+    } catch (error) {
+      logger.error("[workflows-api] Error getting run", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to get run");
+    }
+  });
+  server.get("/api/v1/runs/:runId/events", { schema: { hide: true } }, async (request, reply) => {
+    const { runId } = request.params;
+    const run = await observability.observeOperation("workflow.run.events", () => engine.getRun(runId));
+    if (!run) {
+      return fail(reply, 404, "Run not found");
+    }
+    reply.hijack();
+    const raw = reply.raw;
+    const origin = request.headers.origin;
+    if (typeof origin === "string" && origin.startsWith("http://localhost")) {
+      raw.setHeader("Access-Control-Allow-Origin", origin);
+      raw.setHeader("Access-Control-Allow-Credentials", "true");
+    }
+    raw.setHeader("Content-Type", "text/event-stream");
+    raw.setHeader("Cache-Control", "no-cache, no-transform");
+    raw.setHeader("Connection", "keep-alive");
+    raw.flushHeaders?.();
+    raw.write(": connected\n\n");
+    const sendEvent = (type, payload) => {
+      if (raw.writableEnded) return;
+      raw.write(`event: workflow.event
+`);
+      raw.write(`data: ${JSON.stringify({ type, runId, payload, timestamp: (/* @__PURE__ */ new Date()).toISOString() })}
+
+`);
+    };
+    sendEvent("run.snapshot", run);
+    if (TERMINAL_STATUSES.includes(run.status)) {
+      raw.end();
+      return;
+    }
+    let idleTimer = null;
+    const resetIdle = () => {
+      if (idleTimer) clearTimeout(idleTimer);
+      idleTimer = setTimeout(() => {
+        cleanup();
+      }, IDLE_TIMEOUT_MS);
+    };
+    const keepAliveTimer = setInterval(() => {
+      if (raw.writableEnded) return;
+      raw.write(": keep-alive\n\n");
+    }, KEEP_ALIVE_MS);
+    const unsubscribe = engine.subscribeToRunEvents(runId, (event) => {
+      sendEvent(event.type, event.payload);
+      resetIdle();
+      if (TERMINAL_EVENTS.includes(event.type)) {
+        cleanup();
+      }
+    });
+    const cleanup = () => {
+      unsubscribe();
+      if (idleTimer) clearTimeout(idleTimer);
+      clearInterval(keepAliveTimer);
+      if (!raw.writableEnded) raw.end();
+    };
+    resetIdle();
+    request.raw.on("close", cleanup);
+  });
+  logger.info("[workflows-api] Workflows API endpoints registered");
+}
+
+// src/api/approvals-api.ts
+function registerApprovalsAPI(options) {
+  const { server, engine, logger, observability } = options;
+  server.get("/api/v1/runs/:runId/approvals", { schema: { tags: ["Approvals"], summary: "List pending approvals for a run" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      const run = await observability.observeOperation("workflow.approval.list", () => engine.getRun(runId));
+      if (!run) {
+        return fail(reply, 404, "Run not found");
+      }
+      const pending = [];
+      for (const job of run.jobs) {
+        for (const step of job.steps) {
+          if (step.status === "waiting_approval") {
+            pending.push({
+              jobId: job.id,
+              stepId: step.id,
+              stepName: step.name,
+              specId: step.spec.id,
+              context: step.spec.with ?? {},
+              waitingSince: step.startedAt
+            });
+          }
+        }
+      }
+      return ok({ runId, pending });
+    } catch (error) {
+      logger.error("[approvals-api] Error listing pending approvals", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to list pending approvals");
+    }
+  });
+  server.post("/api/v1/runs/:runId/approvals/resolve", { schema: { tags: ["Approvals"], summary: "Approve or reject a pending step" } }, async (request, reply) => {
+    try {
+      const { runId } = request.params;
+      const { jobId, stepId, action, comment, data } = request.body;
+      if (!jobId || !stepId || !action) {
+        return fail(reply, 400, "Missing required fields: jobId, stepId, action");
+      }
+      if (action !== "approve" && action !== "reject") {
+        return fail(reply, 400, 'action must be "approve" or "reject"');
+      }
+      const run = await observability.observeOperation("workflow.approval.get", () => engine.getRun(runId));
+      if (!run) {
+        return fail(reply, 404, "Run not found");
+      }
+      const job = run.jobs.find((j) => j.id === jobId);
+      if (!job) {
+        return fail(reply, 404, "Job not found");
+      }
+      const step = job.steps.find((s) => s.id === stepId);
+      if (!step) {
+        return fail(reply, 404, "Step not found");
+      }
+      if (step.status !== "waiting_approval") {
+        return fail(reply, 409, `Step is not waiting for approval (current status: ${step.status})`);
+      }
+      await observability.observeOperation(
+        "workflow.approval.resolve",
+        () => engine.resolveApproval(runId, jobId, stepId, action, data, comment)
+      );
+      logger.info("[approvals-api] Approval resolved", {
+        runId,
+        jobId,
+        stepId,
+        action,
+        comment
+      });
+      return ok({
+        runId,
+        jobId,
+        stepId,
+        action,
+        resolved: true
+      });
+    } catch (error) {
+      logger.error("[approvals-api] Error resolving approval", error instanceof Error ? error : void 0);
+      return fail(reply, 500, error instanceof Error ? error.message : "Failed to resolve approval");
+    }
+  });
+}
+
+// src/api/stats-api.ts
+function registerStatsAPI(options) {
+  const { server, hostService, cronScheduler } = options;
+  server.get("/api/v1/stats", { schema: { tags: ["Stats"], summary: "Get dashboard statistics" } }, async (_request, _reply) => {
+    const tenantId = "default";
+    const { jobs } = await hostService.listJobs(tenantId, {});
+    const running = jobs.filter((j) => j.status === "running").length;
+    const pending = jobs.filter((j) => j.status === "pending").length;
+    const completed = jobs.filter((j) => j.status === "completed").length;
+    const failed = jobs.filter((j) => j.status === "failed").length;
+    const activeRaw = await hostService.listActiveExecutions();
+    const now = Date.now();
+    const activeExecutions = activeRaw.map((e) => {
+      const startedAt = e["startedAt"];
+      const startedAtStr = startedAt ? new Date(startedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+      const durationMs = startedAt ? now - new Date(startedAt).getTime() : void 0;
+      return {
+        id: String(e["id"] ?? ""),
+        type: String(e["type"] ?? ""),
+        status: "running",
+        startedAt: startedAtStr,
+        durationMs
+      };
+    });
+    const finished = jobs.filter((j) => j.status === "completed" || j.status === "failed" || j.status === "cancelled").filter((j) => j.finishedAt != null).sort((a, b) => new Date(b.finishedAt).getTime() - new Date(a.finishedAt).getTime()).slice(0, 10);
+    const recentActivity = finished.map((j) => {
+      const finishedAt = new Date(j.finishedAt).toISOString();
+      const durationMs = j.startedAt && j.finishedAt ? new Date(j.finishedAt).getTime() - new Date(j.startedAt).getTime() : void 0;
+      return {
+        id: j.id,
+        type: j.type,
+        status: j.status,
+        finishedAt,
+        durationMs,
+        error: j.error
+      };
+    });
+    let workflowStats = { total: 0, active: 0, inactive: 0 };
+    try {
+      const { workflows } = await hostService.listWorkflows({});
+      const active = workflows.filter((w) => w.status !== "inactive").length;
+      workflowStats = { total: workflows.length, active, inactive: workflows.length - active };
+    } catch {
+    }
+    let cronStats = { total: 0, enabled: 0, disabled: 0 };
+    if (cronScheduler) {
+      try {
+        const { crons } = hostService.listCron();
+        const enabled = crons.filter((c) => c.enabled).length;
+        cronStats = { total: crons.length, enabled, disabled: crons.length - enabled };
+      } catch {
+      }
+    }
+    const stats = {
+      workflows: workflowStats,
+      jobs: { running, pending, completed, failed },
+      crons: cronStats,
+      activeExecutions,
+      recentActivity
+    };
+    return ok(stats);
+  });
+}
+
+// src/server.ts
+async function createServer(options) {
+  const { engine, jobBroker, workflowService, cronScheduler, cronDiscovery, logger } = options;
+  const hostService = new WorkflowHostService({
+    engine,
+    jobBroker,
+    workflowService,
+    cronScheduler,
+    logger
+  });
+  const server = Fastify({
+    logger: false,
+    // Use platform logger instead
+    bodyLimit: 1048576
+    // 1MB body limit (prevents parsing huge payloads)
+  });
+  const isProduction = process.env.NODE_ENV === "production";
+  await registerOpenAPI(server, {
+    title: "KB Labs Workflow Daemon",
+    description: "Background job execution and workflow orchestration API",
+    version: "1.0.0",
+    servers: [{ url: "http://localhost:7778", description: "Local dev" }],
+    ui: !isProduction
+  });
+  const requireAuth = process.env.KB_DAEMON_REQUIRE_AUTH === "true" || isProduction;
+  const daemonApiKey = process.env.KB_DAEMON_API_KEY;
+  const observability = new HttpObservabilityCollector({
+    serviceId: "workflow",
+    serviceType: "workflow-daemon",
+    version: "1.0.0",
+    logsSource: "workflow",
+    dependencies: [
+      {
+        serviceId: "state-daemon",
+        required: false,
+        description: "Workflow run and job state storage"
+      }
+    ]
+  });
+  if (requireAuth && !daemonApiKey) {
+    throw new Error(
+      "KB_DAEMON_API_KEY is required when daemon auth is enabled (KB_DAEMON_REQUIRE_AUTH=true or NODE_ENV=production)"
+    );
+  }
+  server.addHook("onRequest", async (request, reply) => {
+    if (!requireAuth) {
+      return;
+    }
+    if (request.url === "/health") {
+      return;
+    }
+    const apiKeyHeader = request.headers["x-api-key"];
+    const authHeader = request.headers.authorization;
+    const bearerToken = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice("Bearer ".length).trim() : void 0;
+    const token = (typeof apiKeyHeader === "string" ? apiKeyHeader : void 0) ?? bearerToken;
+    if (!token || token !== daemonApiKey) {
+      reply.code(401).send({ ok: false, error: "Unauthorized" });
+    }
+  });
+  observability.register(server);
+  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
+    "http://localhost:3000",
+    "http://localhost:5173"
+    // Vite dev server
+  ];
+  await server.register(cors, {
+    origin: (origin, callback) => {
+      if (!origin) {
+        const isDevelopment = process.env.NODE_ENV !== "production";
+        if (isDevelopment) {
+          callback(null, true);
+          return;
+        }
+        callback(new Error("Origin header required in production"), false);
+        return;
+      }
+      if (allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error(`Origin ${origin} not allowed by CORS`), false);
+      }
+    }
+  });
+  registerJobsAPI({
+    server,
+    hostService,
+    logger,
+    observability
+  });
+  registerCronAPI({
+    server,
+    hostService,
+    logger,
+    observability
+  });
+  if (workflowService) {
+    registerWorkflowsAPI({
+      server,
+      hostService,
+      engine,
+      workflowService,
+      logger,
+      observability
+    });
+  }
+  registerApprovalsAPI({
+    server,
+    engine,
+    logger,
+    observability
+  });
+  registerStatsAPI({
+    server,
+    hostService,
+    cronScheduler});
+  server.get("/health", async () => {
+    const metrics = await hostService.getMetrics();
+    const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
+    return {
+      status: checks.some((entry) => entry.status === "error") ? "degraded" : "ok",
+      service: "workflow",
+      ts: Date.now()
+    };
+  });
+  server.get("/ready", async () => {
+    const metrics = await hostService.getMetrics();
+    const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
+    const hasErrors = checks.some((entry) => entry.status === "error");
+    const hasWarnings = checks.some((entry) => entry.status === "warn");
+    return createServiceReadyResponse({
+      ready: !hasErrors,
+      status: hasErrors ? "initializing" : hasWarnings ? "degraded" : "ready",
+      reason: hasErrors ? "workflow_checks_failed" : "ready",
+      components: {
+        workflowEngine: {
+          ready: true
+        },
+        workflowCatalog: {
+          ready: Boolean(workflowService)
+        },
+        cronScheduler: {
+          ready: Boolean(cronScheduler)
+        }
+      }
+    });
+  });
+  server.get("/metrics", async (_request, reply) => {
+    const metrics = await hostService.getMetrics();
+    const healthStatus = resolveWorkflowHealthStatus();
+    reply.header("Content-Type", "text/plain; version=0.0.4; charset=utf-8");
+    return observability.renderPrometheusMetrics(
+      healthStatus,
+      buildWorkflowMetricLines(metrics)
+    );
+  });
+  server.get("/observability/describe", async () => observability.buildDescribe());
+  server.get("/observability/health", async () => {
+    const metrics = await hostService.getMetrics();
+    const checks = buildWorkflowChecks({ workflowService, cronScheduler, metrics });
+    return observability.buildHealth({
+      status: resolveWorkflowHealthStatus(),
+      checks,
+      topOperations: buildWorkflowTopOperations(metrics, observability.getTopOperations(3)),
+      meta: {
+        workflowServiceEnabled: Boolean(workflowService),
+        cronSchedulerEnabled: Boolean(cronScheduler),
+        cronDiscoveryEnabled: Boolean(cronDiscovery),
+        runs: metrics.runs,
+        jobs: metrics.jobs
+      }
+    });
+  });
+  return server;
+}
+function resolveWorkflowHealthStatus(metrics) {
+  return "healthy";
+}
+function buildWorkflowChecks(input) {
+  return [
+    {
+      id: "workflow-engine",
+      status: "ok",
+      message: `${input.metrics.runs.total} runs tracked`
+    },
+    {
+      id: "workflow-catalog",
+      status: input.workflowService ? "ok" : "warn",
+      message: input.workflowService ? "Workflow service available" : "Workflow service not configured"
+    },
+    {
+      id: "cron-scheduler",
+      status: input.cronScheduler ? "ok" : "warn",
+      message: input.cronScheduler ? "Cron scheduler available" : "Cron scheduler not configured"
+    },
+    {
+      id: "workflow-failures",
+      status: input.metrics.runs.failed > 0 || input.metrics.jobs.failed > 0 ? "warn" : "ok",
+      message: input.metrics.runs.failed > 0 || input.metrics.jobs.failed > 0 ? `${input.metrics.runs.failed} failed runs, ${input.metrics.jobs.failed} failed jobs retained in history` : "No failed workflow runs or jobs in retained history"
+    }
+  ];
+}
+function buildWorkflowTopOperations(metrics, httpOperations) {
+  return [
+    ...httpOperations,
+    {
+      operation: "workflow.runs",
+      count: metrics.runs.total,
+      errorCount: metrics.runs.failed + metrics.runs.cancelled + metrics.runs.dlq
+    },
+    {
+      operation: "workflow.jobs",
+      count: metrics.jobs.total,
+      errorCount: metrics.jobs.failed
+    }
+  ].slice(0, 5);
+}
+function buildWorkflowMetricLines(metrics) {
+  return [
+    "# HELP workflow_runs_total Total workflow runs grouped by status",
+    "# TYPE workflow_runs_total gauge",
+    metricLine("workflow_runs_total", metrics.runs.total, { status: "total" }),
+    metricLine("workflow_runs_total", metrics.runs.queued, { status: "queued" }),
+    metricLine("workflow_runs_total", metrics.runs.running, { status: "running" }),
+    metricLine("workflow_runs_total", metrics.runs.completed, { status: "completed" }),
+    metricLine("workflow_runs_total", metrics.runs.failed, { status: "failed" }),
+    metricLine("workflow_runs_total", metrics.runs.cancelled, { status: "cancelled" }),
+    metricLine("workflow_runs_total", metrics.runs.dlq, { status: "dlq" }),
+    "# HELP workflow_jobs_total Total workflow jobs grouped by status",
+    "# TYPE workflow_jobs_total gauge",
+    metricLine("workflow_jobs_total", metrics.jobs.total, { status: "total" }),
+    metricLine("workflow_jobs_total", metrics.jobs.queued, { status: "queued" }),
+    metricLine("workflow_jobs_total", metrics.jobs.running, { status: "running" }),
+    metricLine("workflow_jobs_total", metrics.jobs.completed, { status: "completed" }),
+    metricLine("workflow_jobs_total", metrics.jobs.failed, { status: "failed" }),
+    metricLine("service_operation_total", metrics.runs.total, { operation: "workflow.runs", status: "ok" }),
+    metricLine("service_operation_total", metrics.runs.failed + metrics.runs.cancelled + metrics.runs.dlq, { operation: "workflow.runs", status: "error" }),
+    metricLine("service_operation_total", metrics.jobs.total, { operation: "workflow.jobs", status: "ok" }),
+    metricLine("service_operation_total", metrics.jobs.failed, { operation: "workflow.jobs", status: "error" })
+  ];
+}
+var workerInstance = null;
+var serverInstance = null;
+var cronSchedulerInstance = null;
+async function bootstrap(cwd = process.cwd()) {
+  const repoRoot = await findRepoRoot(cwd);
+  await createServiceBootstrap({ appId: "workflow-daemon", repoRoot });
+  if (!platform.isConfigured("workspace")) {
+    process.stderr.write(
+      '[workflow-daemon] WARNING: workspace adapter is not configured.\n[workflow-daemon] Workflows that use isolation: balanced (default) or isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.workspace in kb.config.json.\n[workflow-daemon] To run without a workspace: add "isolation: relaxed" to your workflow YAML.\n'
+    );
+  }
+  if (!platform.isConfigured("environment") && platform.isConfigured("workspace")) {
+    process.stderr.write(
+      "[workflow-daemon] WARNING: environment adapter is not configured.\n[workflow-daemon] Workflows that use isolation: strict will fail.\n[workflow-daemon] To fix: set platform.adapters.environment in kb.config.json.\n"
+    );
+  }
+  const startupRequestId = `workflow-startup-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+  const startupTraceId = randomUUID();
+  const startupSpanId = randomUUID();
+  const bootstrapLogger = createCorrelatedLogger(platform.logger, {
+    serviceId: "workflow",
+    logsSource: "workflow",
+    layer: "workflow",
+    service: "bootstrap",
+    requestId: startupRequestId,
+    traceId: startupTraceId,
+    operation: "workflow.bootstrap",
+    bindings: {
+      spanId: startupSpanId,
+      invocationId: startupSpanId,
+      executionId: startupSpanId
+    }
+  });
+  bootstrapLogger.info("Workflow daemon starting", { repoRoot });
+  const createWorkflowLogger = (service, operation, bindings) => createCorrelatedLogger(platform.logger, {
+    serviceId: "workflow",
+    logsSource: "workflow",
+    layer: "workflow",
+    service,
+    operation,
+    bindings
+  });
+  bootstrapLogger.info("Loading plugin registry snapshot");
+  const cliApi = await createRegistry({
+    registry: {
+      root: repoRoot
+    },
+    cache: {
+      inMemory: true,
+      ttlMs: 10 * 60 * 1e3
+      // 10 minutes
+    },
+    logger: {
+      level: "info"
+    },
+    snapshot: {
+      mode: "consumer"
+    }
+  });
+  await cliApi.initialize();
+  const plugins = await cliApi.listPlugins();
+  bootstrapLogger.info("Plugin registry snapshot loaded", {
+    pluginsFound: plugins.length,
+    pluginIds: plugins.map((p) => `${p.id}@${p.version}`)
+  });
+  bootstrapLogger.info("Creating WorkflowEngine");
+  const engine = new WorkflowEngine({
+    cache: platform.cache,
+    events: platform.eventBus,
+    logger: createWorkflowLogger("engine", "workflow.engine"),
+    snapshotManager: platform.snapshotManager,
+    workspaceRoot: repoRoot
+  });
+  bootstrapLogger.info("Cleaning up stale runs from previous daemon process");
+  await engine.cleanupStaleRuns();
+  bootstrapLogger.info("Resuming interrupted jobs");
+  await engine.resumeInterruptedJobs();
+  bootstrapLogger.info("Creating JobBroker");
+  const jobBroker = new JobBroker(engine, createWorkflowLogger("job-broker", "workflow.job-broker"), platform);
+  bootstrapLogger.info("Creating CronScheduler");
+  const cronScheduler = new CronScheduler({
+    jobBroker,
+    workflowEngine: engine,
+    logger: createWorkflowLogger("cron-scheduler", "workflow.cron-scheduler"),
+    timezone: process.env.WORKFLOW_CRON_TIMEZONE
+  });
+  cronSchedulerInstance = cronScheduler;
+  bootstrapLogger.info("Discovering cron jobs");
+  const cronDiscovery = new CronDiscovery({
+    cliApi,
+    scheduler: cronScheduler,
+    logger: createWorkflowLogger("cron-discovery", "workflow.cron-discovery"),
+    workspaceRoot: repoRoot
+  });
+  const discovered = await cronDiscovery.discoverAll();
+  bootstrapLogger.info("Cron job discovery complete", discovered);
+  bootstrapLogger.info("Creating WorkflowService");
+  const workflowService = new WorkflowService({
+    cliApi,
+    platform,
+    workspaceRoot: repoRoot
+  });
+  bootstrapLogger.info("Creating HTTP server");
+  const server = await createServer({
+    engine,
+    jobBroker,
+    workflowService,
+    cronScheduler,
+    cronDiscovery,
+    logger: createWorkflowLogger("api", "workflow.api")
+  });
+  const port = parseInt(process.env.WORKFLOW_PORT || "7778", 10);
+  await server.listen({ port, host: "0.0.0.0" });
+  bootstrapLogger.info("HTTP API listening", { port });
+  serverInstance = server;
+  bootstrapLogger.info("Creating WorkflowWorker");
+  const worker = await createWorkflowWorker({
+    engine,
+    cliApi,
+    logger: createWorkflowLogger("worker", "workflow.worker"),
+    analytics: platform.analytics,
+    platform,
+    workspaceRoot: repoRoot,
+    concurrency: parseInt(process.env.WORKFLOW_CONCURRENCY || "5", 10)
+  });
+  workerInstance = worker;
+  bootstrapLogger.info("Starting WorkflowWorker");
+  worker.start().catch((error) => {
+    bootstrapLogger.error("Worker crashed - shutting down daemon", error instanceof Error ? error : void 0);
+    process.kill(process.pid, "SIGTERM");
+  });
+  if (discovered.plugins + discovered.users > 0) {
+    bootstrapLogger.info("Starting CronScheduler");
+    await cronScheduler.start();
+  } else {
+    bootstrapLogger.info("No cron jobs found, skipping CronScheduler start");
+  }
+  bootstrapLogger.info("Workflow daemon started successfully", { port });
+  const shutdown = async (signal) => {
+    bootstrapLogger.warn("Received shutdown signal", { signal });
+    if (cronSchedulerInstance) {
+      await cronSchedulerInstance.stop();
+      cronSchedulerInstance = null;
+    }
+    if (workerInstance) {
+      await workerInstance.stop();
+      workerInstance = null;
+    }
+    if (serverInstance) {
+      await serverInstance.close();
+      serverInstance = null;
+    }
+    await cliApi.dispose();
+    await platform.shutdown();
+    bootstrapLogger.info("Workflow daemon shutdown complete");
+    process.exit(0);
+  };
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  process.on("SIGINT", () => shutdown("SIGINT"));
+}
+
+// src/index.ts
+(async () => {
+  try {
+    await bootstrap(process.cwd());
+  } catch (error) {
+    console.error("Failed to start workflow daemon:", error);
+    process.exit(1);
+  }
+})();
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map