woml-cli 1.0.1

package/dist/script-host-worker.js

@@ -0,0 +1,1616 @@
+// @bun
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+
+// src/script-host/json.ts
+function inspectJsonValue(value, path, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return;
+  }
+  if (typeof value === "number") {
+    return Number.isFinite(value) ? undefined : { path, reason: "numbers must be finite" };
+  }
+  if (typeof value !== "object") {
+    return { path, reason: `${typeof value} is not a JSON value` };
+  }
+  if (ancestors.has(value)) {
+    return { path, reason: "circular references are not JSON values" };
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      const allowedKeys = new Set(["length"]);
+      for (let index = 0;index < value.length; index += 1) {
+        allowedKeys.add(String(index));
+        if (!Object.prototype.hasOwnProperty.call(value, index)) {
+          return {
+            path: `${path}[${index}]`,
+            reason: "array holes are not JSON values"
+          };
+        }
+        const issue = inspectJsonValue(value[index], `${path}[${index}]`, ancestors);
+        if (issue !== undefined)
+          return issue;
+      }
+      for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string" || !allowedKeys.has(key)) {
+          return { path, reason: "arrays must not contain custom properties" };
+        }
+      }
+      return;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return { path, reason: "objects must be plain JSON objects" };
+    }
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") {
+        return { path, reason: "symbol keys are not JSON object keys" };
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (descriptor === undefined || descriptor.enumerable !== true || "get" in descriptor || "set" in descriptor) {
+        return {
+          path: `${path}.${key}`,
+          reason: "JSON fields must be enumerable data properties"
+        };
+      }
+      const issue = inspectJsonValue(descriptor.value, `${path}.${key}`, ancestors);
+      if (issue !== undefined)
+        return issue;
+    }
+    return;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function findJsonViolation(value) {
+  return inspectJsonValue(value, "$", new Set);
+}
+function deepFreezeJson(value) {
+  if (typeof value !== "object" || value === null)
+    return value;
+  if (Array.isArray(value)) {
+    for (const item of value)
+      deepFreezeJson(item);
+  } else {
+    for (const item of Object.values(value))
+      deepFreezeJson(item);
+  }
+  return Object.isFrozen(value) ? value : Object.freeze(value);
+}
+
+// src/script-host/worker.ts
+var AsyncFunction = Object.getPrototypeOf(async function emptyAsyncFunction() {}).constructor;
+function redactKnownSecrets(value, secrets) {
+  let redacted = value;
+  for (const secret of secrets) {
+    if (secret.length > 0)
+      redacted = redacted.split(secret).join("[REDACTED]");
+  }
+  return redacted.slice(0, 1024);
+}
+function safeSourceMapSources(sourceMap) {
+  try {
+    const decoded = JSON.parse(sourceMap);
+    if (!Array.isArray(decoded.sources))
+      return [];
+    return decoded.sources.filter((source) => typeof source === "string" && source.length > 0 && source.length <= 512 && !source.startsWith("/") && !source.includes("\\") && !source.split("/").includes(".."));
+  } catch {
+    return [];
+  }
+}
+function executableModuleBundle(module) {
+  if (module.sourceMap === undefined)
+    return module.bundle;
+  const sourceMapUrl = Buffer.from(module.sourceMap, "utf8").toString("base64");
+  return `${module.bundle.replace(/\n?\/\/# sourceMappingURL=.*$/m, "")}
+//# sourceMappingURL=data:application/json;base64,${sourceMapUrl}`;
+}
+function safeModuleFrame(stack, modules) {
+  if (stack === undefined || modules === undefined)
+    return;
+  const sources = new Set;
+  for (const module of modules) {
+    if (module.sourceMap === undefined)
+      continue;
+    for (const source of safeSourceMapSources(module.sourceMap))
+      sources.add(source);
+  }
+  for (const line of stack.split(`
+`)) {
+    for (const source of sources) {
+      const offset = line.indexOf(source);
+      if (offset < 0)
+        continue;
+      const suffix = line.slice(offset + source.length);
+      const location = /^:(\d+):(\d+)/.exec(suffix);
+      if (location !== null)
+        return `${source}:${location[1]}:${location[2]}`;
+    }
+  }
+  for (const module of modules) {
+    if (module.sourceMap === undefined)
+      continue;
+    const source = safeSourceMapSources(module.sourceMap)[0];
+    if (source === undefined)
+      continue;
+    const encoded = Buffer.from(executableModuleBundle(module), "utf8").toString("base64");
+    const offset = stack.indexOf(`data:text/javascript;base64,${encoded}`);
+    if (offset < 0)
+      continue;
+    const suffix = stack.slice(offset + `data:text/javascript;base64,${encoded}`.length);
+    const location = /^:(\d+):(\d+)/.exec(suffix);
+    if (location !== null)
+      return `${source}:${location[1]}:${location[2]}`;
+  }
+  return;
+}
+function serializeError(error, secrets = [], modules) {
+  if (error instanceof NativeFetchTrackingError) {
+    return {
+      ok: false,
+      error: {
+        kind: "service",
+        name: error.name,
+        message: redactKnownSecrets(error.message, secrets),
+        capability: "http",
+        operation: "fetch",
+        callId: error.callId,
+        cause: error.cause
+      }
+    };
+  }
+  if (typeof error === "object" && error !== null || typeof error === "function") {
+    const nativeFetch = nativeFetchFailures.get(error);
+    if (nativeFetch !== undefined) {
+      return {
+        ok: false,
+        error: {
+          kind: "service",
+          name: error instanceof Error ? error.name : "Error",
+          message: redactKnownSecrets(nativeFetch.cause.message, secrets),
+          capability: "http",
+          operation: "fetch",
+          callId: nativeFetch.callId,
+          cause: nativeFetch.cause
+        }
+      };
+    }
+  }
+  if (error instanceof ServiceCallError) {
+    return {
+      ok: false,
+      error: {
+        kind: "service",
+        name: error.name,
+        message: redactKnownSecrets(error.message, secrets),
+        capability: error.capability,
+        operation: error.operation,
+        callId: error.callId,
+        cause: error.cause
+      }
+    };
+  }
+  if (error instanceof Error) {
+    return {
+      ok: false,
+      error: {
+        kind: "script",
+        name: error.name,
+        message: redactKnownSecrets(error.message, secrets),
+        ...error.stack === undefined ? {} : { stack: redactKnownSecrets(error.stack, secrets) },
+        ...safeModuleFrame(error.stack, modules) === undefined ? {} : { moduleFrame: safeModuleFrame(error.stack, modules) }
+      }
+    };
+  }
+  return {
+    ok: false,
+    error: {
+      kind: "script",
+      name: "Error",
+      message: redactKnownSecrets(String(error), secrets)
+    }
+  };
+}
+
+class ServiceCallError extends Error {
+  code;
+  service;
+  capability;
+  operation;
+  callId;
+  retryable;
+  ambiguous;
+  details;
+  cause;
+  constructor(capability, operation, callId, cause) {
+    super(cause.message);
+    this.name = "WomlServiceError";
+    this.code = cause.code;
+    this.service = capability;
+    this.capability = capability;
+    this.operation = operation;
+    this.callId = callId;
+    this.retryable = cause.retryable;
+    this.ambiguous = cause.ambiguous;
+    this.details = cause.details;
+    this.cause = cause;
+  }
+}
+var pendingCalls = new Map;
+var pendingFetchAcks = new Map;
+var operationSequences = new Map;
+var automaticEffectfulCalls = new Map;
+var workflowTargetIdentityModes = new Map;
+var fetchSequence = 0;
+var nativeFetch = globalThis.fetch.bind(globalThis);
+var nativeFetchFailures = new WeakMap;
+
+class NativeFetchTrackingError extends Error {
+  callId;
+  cause;
+  code;
+  retryable;
+  ambiguous;
+  constructor(callId, failure) {
+    super(failure.message);
+    this.name = "WomlFetchTrackingError";
+    this.callId = callId;
+    this.cause = failure;
+    this.code = failure.code;
+    this.retryable = failure.retryable;
+    this.ambiguous = failure.ambiguous;
+  }
+}
+function requestBodyBytes(body) {
+  if (body === undefined || body === null)
+    return;
+  if (typeof body === "string")
+    return Buffer.byteLength(body, "utf8");
+  if (body instanceof URLSearchParams) {
+    return Buffer.byteLength(body.toString(), "utf8");
+  }
+  if (body instanceof Blob)
+    return body.size;
+  if (body instanceof ArrayBuffer)
+    return body.byteLength;
+  if (ArrayBuffer.isView(body))
+    return body.byteLength;
+  return;
+}
+function fetchStartObservation(request, requestId, input, init) {
+  const rawUrl = input instanceof Request ? input.url : input instanceof URL ? input.href : String(input);
+  const url = new URL(rawUrl);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return;
+  }
+  const method = String(init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+  const bytes = requestBodyBytes(init?.body);
+  return {
+    contract: "woml.native-fetch-observation",
+    contractVersion: 1,
+    observationType: "started",
+    invocationId: request.invocationId,
+    requestId,
+    method,
+    origin: url.origin,
+    path: url.pathname,
+    ...bytes === undefined ? {} : { requestBodyBytes: bytes },
+    startedAt: new Date().toISOString()
+  };
+}
+async function observeFetch(observation) {
+  if (pendingFetchAcks.has(observation.requestId)) {
+    throw new Error("Native Fetch reused an active request ID.");
+  }
+  await new Promise((resolve, reject) => {
+    pendingFetchAcks.set(observation.requestId, { resolve, reject });
+    self.postMessage({
+      messageType: "fetch_observation",
+      observation
+    });
+  });
+}
+function trackedNativeFetch(request) {
+  const tracked = async (input, init) => {
+    const requestId = `fetch_${++fetchSequence}_${crypto.randomUUID().replaceAll("-", "")}`;
+    const startedAt = performance.now();
+    const start = fetchStartObservation(request, requestId, input, init);
+    if (start === undefined)
+      return nativeFetch(input, init);
+    await observeFetch(start);
+    let response;
+    try {
+      response = await nativeFetch(input, init);
+    } catch (error) {
+      const name = error instanceof Error ? error.name : "";
+      const kind = name === "AbortError" ? "cancelled" : name === "TimeoutError" ? "timed_out" : "fetch_rejected";
+      const failure = {
+        kind: kind === "cancelled" ? "cancelled" : kind === "timed_out" ? "timed_out" : "transport_failed",
+        code: kind === "cancelled" ? "WOML_NATIVE_FETCH_CANCELLED" : kind === "timed_out" ? "WOML_NATIVE_FETCH_TIMED_OUT" : "WOML_NATIVE_FETCH_REJECTED",
+        message: kind === "cancelled" ? "Bun Fetch was cancelled." : kind === "timed_out" ? "Bun Fetch exceeded its deadline." : "Bun Fetch rejected the request.",
+        retryable: false,
+        ambiguous: true
+      };
+      await observeFetch({
+        contract: "woml.native-fetch-observation",
+        contractVersion: 1,
+        observationType: "failed",
+        invocationId: request.invocationId,
+        requestId,
+        durationMs: Math.max(0, performance.now() - startedAt),
+        failedAt: new Date().toISOString(),
+        error: {
+          kind,
+          code: failure.code,
+          message: failure.message
+        }
+      });
+      if (typeof error === "object" && error !== null || typeof error === "function") {
+        nativeFetchFailures.set(error, { callId: requestId, cause: failure });
+      }
+      throw error;
+    }
+    await observeFetch({
+      contract: "woml.native-fetch-observation",
+      contractVersion: 1,
+      observationType: "completed",
+      invocationId: request.invocationId,
+      requestId,
+      status: response.status,
+      responseBodyBytes: null,
+      durationMs: Math.max(0, performance.now() - startedAt),
+      completedAt: new Date().toISOString()
+    });
+    return response;
+  };
+  return tracked;
+}
+async function operationKey(stepIdempotencyKey, operationName) {
+  const bytes = new TextEncoder().encode(`woml.capability-operation\x00v1\x00${stepIdempotencyKey}\x00${operationName}`);
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+  return `sha256:${[...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function callId() {
+  return `call_${crypto.randomUUID().replaceAll("-", "")}`;
+}
+function plainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function httpTimeoutMilliseconds(input) {
+  if (input.timeout !== undefined && input.timeoutMs !== undefined) {
+    throw new TypeError("Managed HTTP accepts timeout or timeoutMs, not both.");
+  }
+  const value = input.timeout ?? input.timeoutMs ?? 30000;
+  if (typeof value === "number" && Number.isSafeInteger(value))
+    return value;
+  if (typeof value !== "string") {
+    throw new TypeError("Managed HTTP timeout must be milliseconds or a duration string.");
+  }
+  const match = value.match(/^(\d+)(ms|s|m|h)$/);
+  if (match === null) {
+    throw new TypeError("Managed HTTP timeout must look like 500ms, 10s, 2m, or 1h.");
+  }
+  const multiplier = match[2] === "ms" ? 1 : match[2] === "s" ? 1000 : match[2] === "m" ? 60000 : 3600000;
+  return Number(match[1]) * multiplier;
+}
+function normalizeHttpRequest(input) {
+  const object = plainObject(input);
+  if (object === undefined) {
+    throw new TypeError("services.http.request() requires a request object.");
+  }
+  const allowed = new Set([
+    "url",
+    "method",
+    "headers",
+    "query",
+    "json",
+    "text",
+    "bytesBase64",
+    "responseType",
+    "storage",
+    "timeout",
+    "timeoutMs",
+    "acceptedStatus",
+    "redirect",
+    "maximumRedirects",
+    "idempotency"
+  ]);
+  const unknown = Object.keys(object).find((key) => !allowed.has(key));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown managed HTTP option "${unknown}".`);
+  }
+  if (typeof object.url !== "string" || object.url.length === 0) {
+    throw new TypeError("Managed HTTP requires a URL string.");
+  }
+  const method = String(object.method ?? "GET").toUpperCase();
+  const headers = plainObject(object.headers ?? {});
+  if (headers === undefined || Object.values(headers).some((value) => typeof value !== "string")) {
+    throw new TypeError("Managed HTTP headers must contain string values.");
+  }
+  const timeoutMs = httpTimeoutMilliseconds(object);
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 86400000) {
+    throw new TypeError("Managed HTTP timeout must be between 1 ms and 24 hours.");
+  }
+  const responseType = object.responseType ?? "json";
+  const storage = plainObject(object.storage);
+  if (responseType === "storage") {
+    if (storage === undefined) {
+      throw new TypeError('Managed HTTP responseType "storage" requires a storage target.');
+    }
+    const unknownStorageOption = Object.keys(storage).find((key) => !["key", "contentType", "overwrite", "ifVersion"].includes(key));
+    if (unknownStorageOption !== undefined) {
+      throw new TypeError(`Unknown managed HTTP storage option "${unknownStorageOption}".`);
+    }
+    if (typeof storage.key !== "string" || storage.key.length === 0) {
+      throw new TypeError("Managed HTTP storage requires a key string.");
+    }
+    if (storage.contentType !== undefined && typeof storage.contentType !== "string") {
+      throw new TypeError("Managed HTTP storage contentType must be a string.");
+    }
+    if (storage.overwrite !== undefined && typeof storage.overwrite !== "boolean") {
+      throw new TypeError("Managed HTTP storage overwrite must be a Boolean.");
+    }
+    if (storage.ifVersion !== undefined && typeof storage.ifVersion !== "string") {
+      throw new TypeError("Managed HTTP storage ifVersion must be a string.");
+    }
+    if (storage.overwrite !== undefined && storage.ifVersion !== undefined) {
+      throw new TypeError("Managed HTTP storage overwrite and ifVersion are mutually exclusive.");
+    }
+  } else if (object.storage !== undefined) {
+    throw new TypeError('Managed HTTP storage is valid only with responseType "storage".');
+  }
+  const normalized = {
+    contract: "woml.managed-http",
+    contractVersion: 1,
+    kind: "request",
+    method,
+    url: object.url,
+    headers,
+    responseType,
+    timeoutMs,
+    acceptedStatus: object.acceptedStatus ?? { minimum: 200, maximum: 299 },
+    redirect: object.redirect ?? "follow",
+    maximumRedirects: object.maximumRedirects ?? 10
+  };
+  for (const field of [
+    "query",
+    "json",
+    "text",
+    "bytesBase64",
+    "idempotency",
+    "storage"
+  ]) {
+    if (object[field] !== undefined)
+      normalized[field] = object[field];
+  }
+  return normalized;
+}
+function normalizeTelegramSend(input) {
+  const object = plainObject(input);
+  if (object === undefined) {
+    throw new TypeError("services.telegram.send() requires a request object.");
+  }
+  const allowed = new Set([
+    "botToken",
+    "conversationId",
+    "text",
+    "replyToMessageId"
+  ]);
+  const unknown = Object.keys(object).find((key) => !allowed.has(key));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown Telegram send option "${unknown}".`);
+  }
+  for (const required of ["botToken", "conversationId", "text"]) {
+    if (typeof object[required] !== "string" || object[required].length === 0) {
+      throw new TypeError(`Telegram send requires a non-empty ${required} string.`);
+    }
+  }
+  if (object.replyToMessageId !== undefined && (typeof object.replyToMessageId !== "string" || object.replyToMessageId.length === 0)) {
+    throw new TypeError("Telegram replyToMessageId must be a non-empty string.");
+  }
+  return {
+    contract: "woml.telegram-message",
+    contractVersion: 1,
+    kind: "send",
+    botToken: object.botToken,
+    conversationId: object.conversationId,
+    text: object.text,
+    ...object.replyToMessageId === undefined ? {} : { replyToMessageId: object.replyToMessageId }
+  };
+}
+function publicTelegramResult(result) {
+  const object = plainObject(result);
+  if (object === undefined || object.provider !== "telegram" || typeof object.conversationId !== "string" || typeof object.messageId !== "string" || typeof object.acceptedAt !== "string") {
+    throw new TypeError("Telegram returned an invalid managed result.");
+  }
+  return Object.freeze({
+    provider: "telegram",
+    conversationId: object.conversationId,
+    messageId: object.messageId,
+    acceptedAt: object.acceptedAt
+  });
+}
+function normalizeDiscordSend(input) {
+  const object = plainObject(input);
+  if (object === undefined) {
+    throw new TypeError("services.discord.send() requires a request object.");
+  }
+  const allowed = new Set([
+    "botToken",
+    "conversationId",
+    "text",
+    "replyToMessageId"
+  ]);
+  const unknown = Object.keys(object).find((key) => !allowed.has(key));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown Discord send option "${unknown}".`);
+  }
+  for (const required of ["botToken", "conversationId", "text"]) {
+    if (typeof object[required] !== "string" || object[required].length === 0) {
+      throw new TypeError(`Discord send requires a non-empty ${required} string.`);
+    }
+  }
+  if (!/^[0-9]{17,20}$/.test(object.conversationId)) {
+    throw new TypeError("Discord conversationId must be a numeric snowflake.");
+  }
+  if (object.text.length > 2000) {
+    throw new TypeError("Discord text may contain at most 2000 characters.");
+  }
+  if (object.replyToMessageId !== undefined && (typeof object.replyToMessageId !== "string" || !/^[0-9]{17,20}$/.test(object.replyToMessageId))) {
+    throw new TypeError("Discord replyToMessageId must be a numeric snowflake.");
+  }
+  return {
+    contract: "woml.discord-message",
+    contractVersion: 1,
+    kind: "send",
+    botToken: object.botToken,
+    conversationId: object.conversationId,
+    text: object.text,
+    ...object.replyToMessageId === undefined ? {} : { replyToMessageId: object.replyToMessageId }
+  };
+}
+function publicDiscordResult(result) {
+  const object = plainObject(result);
+  if (object === undefined || object.provider !== "discord" || typeof object.conversationId !== "string" || typeof object.messageId !== "string" || typeof object.acceptedAt !== "string") {
+    throw new TypeError("Discord returned an invalid managed result.");
+  }
+  return Object.freeze({
+    provider: "discord",
+    conversationId: object.conversationId,
+    messageId: object.messageId,
+    acceptedAt: object.acceptedAt
+  });
+}
+function normalizeWhatsAppSend(input) {
+  const object = plainObject(input);
+  if (object === undefined) {
+    throw new TypeError("services.whatsapp.send() requires a request object.");
+  }
+  const allowed = new Set([
+    "accessToken",
+    "phoneNumberId",
+    "conversationId",
+    "template"
+  ]);
+  const unknown = Object.keys(object).find((key) => !allowed.has(key));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown WhatsApp send option "${unknown}".`);
+  }
+  for (const required of [
+    "accessToken",
+    "phoneNumberId",
+    "conversationId"
+  ]) {
+    if (typeof object[required] !== "string" || object[required].length === 0) {
+      throw new TypeError(`WhatsApp send requires a non-empty ${required} string.`);
+    }
+  }
+  if (!/^[0-9]{6,32}$/.test(object.phoneNumberId)) {
+    throw new TypeError("WhatsApp phoneNumberId must be a numeric Meta Phone Number ID.");
+  }
+  if (!/^[0-9]{8,16}$/.test(object.conversationId)) {
+    throw new TypeError("WhatsApp conversationId must contain 8 to 16 digits without a plus sign.");
+  }
+  const template = plainObject(object.template);
+  if (template === undefined || Object.keys(template).some((key) => key !== "name" && key !== "language" && key !== "parameters") || typeof template.name !== "string" || !/^[a-z][a-z0-9_]{0,511}$/.test(template.name) || typeof template.language !== "string" || !/^[a-z]{2,3}(?:_[A-Z]{2})?$/.test(template.language) || !Array.isArray(template.parameters) || template.parameters.length > 32 || template.parameters.some((value) => typeof value !== "string" || value.length > 1024)) {
+    throw new TypeError("WhatsApp template must contain a valid name, language, and string parameters array.");
+  }
+  return {
+    contract: "woml.whatsapp-message",
+    contractVersion: 1,
+    kind: "send",
+    accessToken: object.accessToken,
+    phoneNumberId: object.phoneNumberId,
+    conversationId: object.conversationId,
+    template: {
+      name: template.name,
+      language: template.language,
+      parameters: template.parameters
+    }
+  };
+}
+function publicWhatsAppResult(result) {
+  const object = plainObject(result);
+  if (object === undefined || object.provider !== "whatsapp" || typeof object.conversationId !== "string" || typeof object.messageId !== "string" || typeof object.acceptedAt !== "string") {
+    throw new TypeError("WhatsApp returned an invalid managed result.");
+  }
+  return Object.freeze({
+    provider: "whatsapp",
+    conversationId: object.conversationId,
+    messageId: object.messageId,
+    acceptedAt: object.acceptedAt
+  });
+}
+function namedOperation(capability, operation, options) {
+  if (options === undefined) {
+    const key = `${capability}.${operation}`;
+    const sequence = (operationSequences.get(key) ?? 0) + 1;
+    operationSequences.set(key, sequence);
+    return {
+      mode: "automatic",
+      name: sequence === 1 ? key : `${key}.${sequence}`
+    };
+  }
+  const object = plainObject(options);
+  const name = object?.name;
+  if (object === undefined || Object.keys(object).length !== 1 || typeof name !== "string" || !/^[a-z][a-z0-9._-]{0,127}$/.test(name)) {
+    throw new TypeError('Service call options must be exactly { name: "stable-operation-name" }.');
+  }
+  return { mode: "named", name: `${capability}.${operation}.${name}` };
+}
+function publicHttpResult(result) {
+  const object = plainObject(result);
+  if (object?.contract !== "woml.managed-http" || object.contractVersion !== 1 || object.kind !== "result") {
+    throw new TypeError("Rust returned an invalid Managed HTTP v1 result.");
+  }
+  return {
+    status: object.status,
+    ok: object.ok,
+    headers: object.headers,
+    data: object.data,
+    url: object.url,
+    redirected: object.redirected
+  };
+}
+var databaseOperations = new Set([
+  "query",
+  "execute",
+  "read",
+  "insert",
+  "update",
+  "delete",
+  "transaction"
+]);
+function normalizeDatabaseConfig(input) {
+  const object = plainObject(input);
+  if (object === undefined || Object.keys(object).some((key) => key !== "driver" && key !== "connection") || object.driver !== "sqlite" && object.driver !== "postgres" || typeof object.connection !== "string" || object.connection.length === 0) {
+    throw new TypeError('services.db() requires exactly { driver: "sqlite" | "postgres", connection: "database connection" }.');
+  }
+  return { driver: object.driver, connection: object.connection };
+}
+function normalizeDatabaseRequest(config, operation, input) {
+  if (!databaseOperations.has(operation)) {
+    throw new TypeError(`Unknown Database v1 operation "${operation}".`);
+  }
+  return {
+    contract: "woml.database",
+    contractVersion: 1,
+    kind: "request",
+    driver: config.driver,
+    connection: config.connection,
+    operation,
+    input
+  };
+}
+function publicDatabaseResult(result, operation) {
+  const object = plainObject(result);
+  if (object?.contract !== "woml.database" || object.contractVersion !== 1 || object.kind !== "result" || object.operation !== operation || object.data === undefined) {
+    throw new TypeError("Rust returned an invalid Database v1 result.");
+  }
+  return object.data;
+}
+var storageOperations = new Set(["put", "get", "head", "list", "delete"]);
+var cacheOperations = new Set([
+  "get",
+  "set",
+  "delete",
+  "has",
+  "increment",
+  "setIfAbsent"
+]);
+var stateOperations = new Set([
+  "get",
+  "has",
+  "set",
+  "delete",
+  "increment",
+  "setIfAbsent"
+]);
+var stateWireOperations = new Set([
+  "get",
+  "has",
+  "set",
+  "delete",
+  "increment",
+  "set_if_absent"
+]);
+var cacheWireOperations = new Set([
+  "get",
+  "set",
+  "delete",
+  "has",
+  "increment",
+  "set_if_absent"
+]);
+var eventOperations = new Set(["emit"]);
+function normalizeStorageInput(operation, rawInput) {
+  const object = plainObject(rawInput);
+  if (object === undefined) {
+    throw new TypeError(`services.storage.${operation}() requires an object.`);
+  }
+  const allowedByOperation = {
+    put: [
+      "key",
+      "value",
+      "text",
+      "bytesBase64",
+      "contentType",
+      "overwrite",
+      "ifVersion"
+    ],
+    get: ["key", "responseType", "ifVersion"],
+    head: ["key"],
+    list: ["prefix", "limit", "cursor"],
+    delete: ["key", "ifVersion"]
+  };
+  const allowed = allowedByOperation[operation];
+  if (allowed === undefined) {
+    throw new TypeError(`Unknown Storage v1 operation "${operation}".`);
+  }
+  const unknown = Object.keys(object).find((key) => !allowed.includes(key));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown Storage v1 ${operation} option "${unknown}".`);
+  }
+  if (operation === "get") {
+    return { ...object, responseType: object.responseType ?? "json" };
+  }
+  if (operation === "list") {
+    return { prefix: "", limit: 100, ...object };
+  }
+  return object;
+}
+function normalizeStorageRequest(operation, input) {
+  if (!storageOperations.has(operation)) {
+    throw new TypeError(`Unknown Storage v1 operation "${operation}".`);
+  }
+  return {
+    contract: "woml.storage",
+    contractVersion: 1,
+    kind: "request",
+    operation,
+    input: normalizeStorageInput(operation, input)
+  };
+}
+function publicStorageResult(result, operation) {
+  const object = plainObject(result);
+  if (object?.contract !== "woml.storage" || object.contractVersion !== 1 || object.kind !== "result" || object.operation !== operation || object.data === undefined) {
+    throw new TypeError("Rust returned an invalid Storage v1 result.");
+  }
+  return object.data;
+}
+function cacheTtlMilliseconds(value) {
+  if (value === undefined)
+    return 300000;
+  if (typeof value === "number" && Number.isSafeInteger(value)) {
+    if (value >= 1 && value <= 2592000000)
+      return value;
+  } else if (typeof value === "string") {
+    const match = value.match(/^(\d+)(ms|s|m|h|d)$/);
+    if (match !== null) {
+      const multiplier = match[2] === "ms" ? 1 : match[2] === "s" ? 1000 : match[2] === "m" ? 60000 : match[2] === "h" ? 3600000 : 86400000;
+      const ttl = Number(match[1]) * multiplier;
+      if (Number.isSafeInteger(ttl) && ttl >= 1 && ttl <= 2592000000) {
+        return ttl;
+      }
+    }
+  }
+  throw new TypeError("Cache ttl must be milliseconds or a whole duration from 1ms through 30d.");
+}
+function normalizeCacheOptions(value, acceptsTtl) {
+  if (value === undefined) {
+    return { ttlMs: 300000 };
+  }
+  const object = plainObject(value);
+  const allowed = acceptsTtl ? ["ttl", "name"] : ["name"];
+  if (object === undefined || Object.keys(object).some((key) => !allowed.includes(key)) || object.name !== undefined && typeof object.name !== "string") {
+    throw new TypeError(acceptsTtl ? "Cache options accept only ttl and a stable name." : "Cache options accept only a stable name.");
+  }
+  return {
+    ttlMs: cacheTtlMilliseconds(object.ttl),
+    ...object.name === undefined ? {} : { callOptions: { name: object.name } }
+  };
+}
+function normalizeCacheRequest(operation, args) {
+  if (!cacheOperations.has(operation)) {
+    throw new TypeError(`Unknown Cache v1 operation "${operation}".`);
+  }
+  const key = args[0];
+  if (typeof key !== "string") {
+    throw new TypeError(`services.cache.${operation}() requires a string key.`);
+  }
+  let input;
+  let callOptions;
+  const wireOperation = operation === "setIfAbsent" ? "set_if_absent" : operation;
+  if (operation === "get" || operation === "has") {
+    if (args.length !== 1) {
+      throw new TypeError(`services.cache.${operation}() accepts only a key.`);
+    }
+    input = { key };
+  } else if (operation === "delete") {
+    if (args.length > 2) {
+      throw new TypeError("services.cache.delete() accepts key and options.");
+    }
+    const normalized = normalizeCacheOptions(args[1], false);
+    input = { key };
+    callOptions = normalized.callOptions;
+  } else if (operation === "set" || operation === "setIfAbsent") {
+    if (args.length < 2 || args.length > 3) {
+      throw new TypeError(`services.cache.${operation}() requires key, value, and optional options.`);
+    }
+    const normalized = normalizeCacheOptions(args[2], true);
+    input = { key, value: args[1], ttlMs: normalized.ttlMs };
+    callOptions = normalized.callOptions;
+  } else {
+    if (args.length > 3) {
+      throw new TypeError("services.cache.increment() accepts key, optional amount, and options.");
+    }
+    const secondIsOptions = plainObject(args[1]) !== undefined;
+    const amount = args[1] === undefined || secondIsOptions ? 1 : args[1];
+    if (typeof amount !== "number" || !Number.isSafeInteger(amount)) {
+      throw new TypeError("Cache increment amount must be a safe integer.");
+    }
+    const normalized = normalizeCacheOptions(secondIsOptions ? args[1] : args[2], true);
+    input = { key, amount, ttlMs: normalized.ttlMs };
+    callOptions = normalized.callOptions;
+  }
+  return {
+    request: {
+      contract: "woml.cache",
+      contractVersion: 1,
+      kind: "request",
+      operation: wireOperation,
+      input
+    },
+    ...callOptions === undefined ? {} : { callOptions }
+  };
+}
+function publicCacheResult(result, operation) {
+  const object = plainObject(result);
+  if (object?.contract !== "woml.cache" || object.contractVersion !== 1 || object.kind !== "result" || object.operation !== operation || object.data === undefined) {
+    throw new TypeError("Rust returned an invalid Cache v1 result.");
+  }
+  return object.data;
+}
+function stateKey(value, operation) {
+  if (typeof value !== "string" || value.length === 0 || Buffer.byteLength(value, "utf8") > 256) {
+    throw new TypeError(`services.state.${operation}() requires a non-empty key up to 256 UTF-8 bytes.`);
+  }
+  return value;
+}
+function stateMutationOptions(value, acceptsVersion) {
+  const object = plainObject(value);
+  const allowed = acceptsVersion ? ["name", "ifVersion"] : ["name"];
+  if (object === undefined || Object.keys(object).some((key) => !allowed.includes(key)) || typeof object.name !== "string" || !/^[a-z][a-z0-9._-]{0,127}$/.test(object.name) || object.ifVersion !== undefined && (!Number.isSafeInteger(object.ifVersion) || Number(object.ifVersion) < 0)) {
+    throw new TypeError(acceptsVersion ? "State mutation options require a stable name and optional non-negative ifVersion." : "State mutation options require exactly one stable name.");
+  }
+  return {
+    callOptions: { name: object.name },
+    ...object.ifVersion === undefined ? {} : { ifVersion: Number(object.ifVersion) }
+  };
+}
+function stateValue(value) {
+  const violation = findJsonViolation(value);
+  if (violation !== undefined) {
+    throw new TypeError(`State value ${violation.path}: ${violation.reason}`);
+  }
+  const encoded = JSON.stringify(value);
+  if (Buffer.byteLength(encoded, "utf8") > 262144) {
+    throw new TypeError("State values must not exceed 256 KiB of canonical JSON.");
+  }
+  return value;
+}
+function normalizeStateRequest(operation, args) {
+  if (!stateOperations.has(operation)) {
+    throw new TypeError(`Unknown Durable User State v1 operation "${operation}".`);
+  }
+  const key = stateKey(args[0], operation);
+  let input;
+  let callOptions;
+  const wireOperation = operation === "setIfAbsent" ? "set_if_absent" : operation;
+  if (operation === "get" || operation === "has") {
+    if (args.length !== 1) {
+      throw new TypeError(`services.state.${operation}() accepts only a key.`);
+    }
+    input = { key };
+  } else if (operation === "delete") {
+    if (args.length !== 2) {
+      throw new TypeError("services.state.delete() requires key and mutation options.");
+    }
+    const options = stateMutationOptions(args[1], true);
+    input = { key, ...options.ifVersion === undefined ? {} : { ifVersion: options.ifVersion } };
+    callOptions = options.callOptions;
+  } else if (operation === "set" || operation === "setIfAbsent") {
+    if (args.length !== 3) {
+      throw new TypeError(`services.state.${operation}() requires key, JSON value, and mutation options.`);
+    }
+    const options = stateMutationOptions(args[2], operation === "set");
+    input = {
+      key,
+      value: stateValue(args[1]),
+      ...options.ifVersion === undefined ? {} : { ifVersion: options.ifVersion }
+    };
+    callOptions = options.callOptions;
+  } else {
+    if (args.length !== 3 || typeof args[1] !== "number" || !Number.isSafeInteger(args[1])) {
+      throw new TypeError("services.state.increment() requires key, safe-integer amount, and mutation options.");
+    }
+    const options = stateMutationOptions(args[2], true);
+    input = {
+      key,
+      amount: args[1],
+      ...options.ifVersion === undefined ? {} : { ifVersion: options.ifVersion }
+    };
+    callOptions = options.callOptions;
+  }
+  return {
+    request: {
+      contract: "woml.state",
+      contractVersion: 1,
+      kind: "request",
+      operation: wireOperation,
+      input
+    },
+    ...callOptions === undefined ? {} : { callOptions }
+  };
+}
+function publicStateResult(result, operation) {
+  const object = plainObject(result);
+  const data = plainObject(object?.data);
+  const exact = (required, optional = []) => data !== undefined && required.every((key) => Object.hasOwn(data, key)) && Object.keys(data).every((key) => required.includes(key) || optional.includes(key));
+  const version = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+  const instant = (value) => typeof value === "string" && Number.isFinite(Date.parse(value));
+  const validData = operation === "get" ? exact(["found"]) && data?.found === false || exact(["found", "value", "version", "updatedAt"]) && data?.found === true && version(data.version) && instant(data.updatedAt) : operation === "has" ? exact(["present"]) && data?.present === false || exact(["present", "version"]) && data?.present === true && version(data.version) : operation === "set" ? exact(["stored", "version", "updatedAt"]) && data?.stored === true && version(data.version) && instant(data.updatedAt) : operation === "delete" ? exact(["deleted"]) && typeof data?.deleted === "boolean" : operation === "increment" ? exact(["value", "version", "updatedAt"]) && typeof data?.value === "number" && Number.isSafeInteger(data.value) && version(data.version) && instant(data.updatedAt) : operation === "set_if_absent" ? exact(["stored", "value", "version", "updatedAt"]) && typeof data?.stored === "boolean" && version(data.version) && instant(data.updatedAt) : false;
+  if (object?.contract !== "woml.state" || object.contractVersion !== 1 || object.kind !== "result" || object.operation !== operation || !validData) {
+    throw new TypeError("Rust returned an invalid Durable User State v1 result.");
+  }
+  return deepFreezeJson(data);
+}
+function normalizeEventEmit(args) {
+  if (args.length < 1 || args.length > 3) {
+    throw new TypeError("services.events.emit() requires an event name, optional payload, and optional options.");
+  }
+  const name = args[0];
+  if (typeof name !== "string" || !/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)+$/.test(name) || Buffer.byteLength(name, "utf8") > 256) {
+    throw new TypeError("services.events.emit() requires a valid lowercase dotted event name.");
+  }
+  const payload = args[1] ?? {};
+  if (plainObject(payload) === undefined) {
+    throw new TypeError("Event payload must be a top-level JSON object.");
+  }
+  const options = args[2];
+  if (options !== undefined) {
+    namedOperation("events", "emit", options);
+  }
+  return {
+    request: {
+      contract: "woml.events",
+      contractVersion: 1,
+      kind: "request",
+      operation: "emit",
+      input: { name, payload }
+    },
+    ...options === undefined ? {} : { callOptions: options }
+  };
+}
+function publicEventResult(result) {
+  const object = plainObject(result);
+  if (object?.contract !== "woml.events" || object.contractVersion !== 1 || object.kind !== "result" || object.operation !== "emit" || object.data === undefined) {
+    throw new TypeError("Rust returned an invalid Events Service v1 result.");
+  }
+  return object.data;
+}
+function workflowCallTimeoutMilliseconds(value) {
+  if (typeof value === "number" && Number.isSafeInteger(value))
+    return value;
+  if (typeof value !== "string") {
+    throw new TypeError("Workflow Call timeout must be milliseconds or a duration string.");
+  }
+  const match = value.match(/^(\d+)(ms|s|m|h)$/);
+  if (match === null) {
+    throw new TypeError("Workflow Call timeout must look like 500ms, 10s, 2m, or 1h.");
+  }
+  const multiplier = match[2] === "ms" ? 1 : match[2] === "s" ? 1000 : match[2] === "m" ? 60000 : 3600000;
+  return Number(match[1]) * multiplier;
+}
+function normalizeWorkflowOperation(operation, args, remainingTimeoutMs) {
+  if (args.length < 2 || args.length > 3) {
+    throw new TypeError(`services.workflows.${operation}() requires workflowId, payload, and optional options.`);
+  }
+  const [workflowId, payload, rawOptions] = args;
+  if (typeof workflowId !== "string" || !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(workflowId) || workflowId.length > 256) {
+    throw new TypeError(`Workflow ${operation} workflowId must use lowercase kebab-case.`);
+  }
+  const payloadObject = plainObject(payload);
+  if (payloadObject === undefined) {
+    throw new TypeError(`Workflow ${operation} payload must be a JSON object.`);
+  }
+  const options = rawOptions === undefined ? {} : plainObject(rawOptions);
+  if (options === undefined) {
+    throw new TypeError(`Workflow ${operation} options must be an object.`);
+  }
+  const unknown = Object.keys(options).find((key) => key !== "name" && (operation !== "call" || key !== "timeout"));
+  if (unknown !== undefined) {
+    throw new TypeError(`Unknown services.workflows.${operation}() option "${unknown}".`);
+  }
+  const name = options.name;
+  if (name !== undefined && (typeof name !== "string" || !/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(name) || name.length > 128)) {
+    throw new TypeError(`Workflow ${operation} name is invalid.`);
+  }
+  const timeoutMs = operation === "call" ? options.timeout === undefined ? remainingTimeoutMs : workflowCallTimeoutMilliseconds(options.timeout) : undefined;
+  if (timeoutMs !== undefined && (timeoutMs < 1 || timeoutMs > 86400000)) {
+    throw new TypeError("Workflow Call timeout must be between 1 ms and 24 hours.");
+  }
+  if (timeoutMs !== undefined && timeoutMs > remainingTimeoutMs) {
+    throw new TypeError("Workflow Call timeout cannot exceed the calling step remaining timeout.");
+  }
+  const identityMode = name === undefined ? "automatic" : "named";
+  const targetIdentityKey = `${operation}:${workflowId}`;
+  const previousIdentityMode = workflowTargetIdentityModes.get(targetIdentityKey);
+  if (previousIdentityMode !== undefined && (previousIdentityMode === "automatic" || identityMode === "automatic")) {
+    throw new TypeError(`Multiple services.workflows.${operation}() operations for workflow "${workflowId}" in one step require stable names, for example { name: "primary-operation" }.`);
+  }
+  workflowTargetIdentityModes.set(targetIdentityKey, identityMode);
+  return {
+    request: {
+      contract: operation === "call" ? "woml.workflow-call" : "woml.workflow-start",
+      contractVersion: 1,
+      kind: "request",
+      workflowId,
+      payload: payloadObject,
+      options: {
+        ...name === undefined ? {} : { name },
+        ...timeoutMs === undefined ? {} : { timeoutMs }
+      }
+    },
+    ...name === undefined ? {} : { callOptions: { name } }
+  };
+}
+function publicWorkflowResult(result, operation) {
+  const object = plainObject(result);
+  if (operation === "start") {
+    if (object?.contract !== "woml.workflow-start" || object.contractVersion !== 1 || object.kind !== "started" || typeof object.workflowId !== "string" || typeof object.runId !== "string" || typeof object.duplicate !== "boolean") {
+      throw new TypeError("Rust returned an invalid Workflow Start v1 result.");
+    }
+    return Object.freeze({
+      workflowId: object.workflowId,
+      runId: object.runId,
+      duplicate: object.duplicate
+    });
+  }
+  if (object?.contract !== "woml.workflow-call" || object.contractVersion !== 1 || object.kind !== "succeeded" || typeof object.workflowId !== "string" || typeof object.definitionHash !== "string" || typeof object.childRunId !== "string" || !Object.hasOwn(object, "result")) {
+    throw new TypeError("Rust returned an invalid Workflow Call v1 result.");
+  }
+  return object.result;
+}
+function deeplyReadonlyServiceFacade(request, executionDeadline) {
+  if (request.attempt === undefined || request.bindings === undefined) {
+    return Object.freeze({});
+  }
+  const attempt = request.attempt;
+  const capabilityCache = new Map;
+  const invokeCapability = async (capability, operation, input, callOptions) => {
+    const managedHttp = capability === "http" && operation === "request";
+    const managedDatabase = capability === "db" && databaseOperations.has(operation);
+    const managedStorage = capability === "storage" && storageOperations.has(operation);
+    const managedCache = capability === "cache" && cacheWireOperations.has(operation);
+    const managedState = capability === "state" && stateWireOperations.has(operation);
+    const managedEvents = capability === "events" && eventOperations.has(operation);
+    const managedWorkflows = capability === "workflows" && (operation === "call" || operation === "start");
+    const managedTelegram = capability === "telegram" && operation === "send";
+    const managedDiscord = capability === "discord" && operation === "send";
+    const managedWhatsApp = capability === "whatsapp" && operation === "send";
+    if (!managedHttp && !managedDatabase && !managedStorage && !managedCache && !managedState && !managedEvents && !managedWorkflows && !managedTelegram && !managedDiscord && !managedWhatsApp && callOptions !== undefined) {
+      throw new TypeError("Named service-call options are supported by managed WOML services only.");
+    }
+    const violation = findJsonViolation(input);
+    if (violation !== undefined) {
+      throw new TypeError(`${violation.path}: ${violation.reason}`);
+    }
+    const inputBytes = Buffer.byteLength(JSON.stringify(input), "utf8");
+    const inputLimit = managedWorkflows ? 1052672 : 1048576;
+    if (inputBytes > inputLimit) {
+      const id2 = callId();
+      throw new ServiceCallError(capability, operation, id2, {
+        kind: "input_too_large",
+        code: "WOML_CAPABILITY_INPUT_TOO_LARGE",
+        message: "The capability input exceeds its configured byte limit.",
+        retryable: false,
+        ambiguous: false,
+        details: { actualBytes: inputBytes, limitBytes: inputLimit }
+      });
+    }
+    const identity = namedOperation(capability, operation, callOptions);
+    const method = managedHttp ? String(input.method) : undefined;
+    const effectful = managedHttp ? input.responseType === "storage" || method !== "GET" && method !== "HEAD" && method !== "OPTIONS" : managedDatabase ? operation !== "query" && operation !== "read" : managedStorage && (operation === "put" || operation === "delete");
+    const cacheEffectful = managedCache && operation !== "get" && operation !== "has";
+    const stateEffectful = managedState && operation !== "get" && operation !== "has";
+    if ((effectful || cacheEffectful || stateEffectful || managedEvents || managedTelegram || managedDiscord || managedWhatsApp) && identity.mode === "automatic") {
+      const key = `${capability}.${operation}`;
+      const count = (automaticEffectfulCalls.get(key) ?? 0) + 1;
+      automaticEffectfulCalls.set(key, count);
+      if (count > 1) {
+        throw new TypeError(`Multiple effectful services.${capability}.${operation}() calls in one step require stable names, for example { name: "write-customer" }.`);
+      }
+    }
+    const httpIdempotency = managedHttp ? plainObject(input.idempotency) : undefined;
+    const providerIdempotencyKey = typeof httpIdempotency?.value === "string" ? httpIdempotency.value : undefined;
+    const timeoutMs = managedHttp ? Math.min(86400000, Number(input.timeoutMs) + 1000) : managedWorkflows ? Math.min(86400000, Number(plainObject(input.options)?.timeoutMs ?? 30000) + 1000) : 30000;
+    const id = callId();
+    const call = {
+      contract: "woml.capability-call",
+      contractVersion: 1,
+      messageType: "request",
+      invocationId: request.invocationId,
+      callId: id,
+      runId: request.runId,
+      nodeId: request.nodeId,
+      attemptNumber: attempt.number,
+      capability,
+      operation,
+      inputContractVersion: 1,
+      resultContractVersion: 1,
+      identity: {
+        mode: identity.mode,
+        stepIdempotencyKey: attempt.idempotencyKey,
+        operationName: identity.name,
+        operationKey: await operationKey(attempt.idempotencyKey, identity.name),
+        ...providerIdempotencyKey === undefined ? {} : { providerIdempotencyKey }
+      },
+      limits: {
+        inputBytes: inputLimit,
+        resultBytes: managedWorkflows ? 4198400 : 4194304,
+        timeoutMs
+      },
+      input
+    };
+    const result = await new Promise((resolve, reject) => {
+      pendingCalls.set(id, { capability, operation, resolve, reject });
+      self.postMessage({
+        messageType: "capability_call",
+        call
+      });
+    });
+    return managedHttp ? publicHttpResult(result) : managedDatabase ? publicDatabaseResult(result, operation) : managedStorage ? publicStorageResult(result, operation) : managedCache ? publicCacheResult(result, operation) : managedState ? publicStateResult(result, operation) : managedEvents ? publicEventResult(result) : managedWorkflows ? publicWorkflowResult(result, operation) : managedTelegram ? publicTelegramResult(result) : managedDiscord ? publicDiscordResult(result) : managedWhatsApp ? publicWhatsAppResult(result) : result;
+  };
+  return new Proxy(Object.freeze({}), {
+    get(_target, capabilityProperty) {
+      if (typeof capabilityProperty !== "string")
+        return;
+      const cached = capabilityCache.get(capabilityProperty);
+      if (cached !== undefined)
+        return cached;
+      if (capabilityProperty === "db") {
+        const database = (rawConfig) => {
+          const config = Object.freeze(normalizeDatabaseConfig(rawConfig));
+          const operationCache2 = new Map;
+          return new Proxy(Object.freeze({}), {
+            get(_databaseTarget, operationProperty) {
+              if (typeof operationProperty !== "string")
+                return;
+              const known = operationCache2.get(operationProperty);
+              if (known !== undefined)
+                return known;
+              if (!databaseOperations.has(operationProperty)) {
+                return;
+              }
+              const invoke = async (rawInput = null, callOptions) => invokeCapability("db", operationProperty, normalizeDatabaseRequest(config, operationProperty, rawInput), callOptions);
+              Object.freeze(invoke);
+              operationCache2.set(operationProperty, invoke);
+              return invoke;
+            },
+            set: () => false,
+            defineProperty: () => false,
+            deleteProperty: () => false
+          });
+        };
+        Object.freeze(database);
+        capabilityCache.set(capabilityProperty, database);
+        return database;
+      }
+      if (capabilityProperty === "storage") {
+        const operationCache2 = new Map;
+        const storage = new Proxy(Object.freeze({}), {
+          get(_storageTarget, operationProperty) {
+            if (typeof operationProperty !== "string")
+              return;
+            const known = operationCache2.get(operationProperty);
+            if (known !== undefined)
+              return known;
+            if (!storageOperations.has(operationProperty))
+              return;
+            const invoke = async (rawInput = {}, callOptions) => invokeCapability("storage", operationProperty, normalizeStorageRequest(operationProperty, rawInput), callOptions);
+            Object.freeze(invoke);
+            operationCache2.set(operationProperty, invoke);
+            return invoke;
+          },
+          set: () => false,
+          defineProperty: () => false,
+          deleteProperty: () => false
+        });
+        capabilityCache.set(capabilityProperty, storage);
+        return storage;
+      }
+      if (capabilityProperty === "cache") {
+        const operationCache2 = new Map;
+        const cache = new Proxy(Object.freeze({}), {
+          get(_cacheTarget, operationProperty) {
+            if (typeof operationProperty !== "string")
+              return;
+            const known = operationCache2.get(operationProperty);
+            if (known !== undefined)
+              return known;
+            if (!cacheOperations.has(operationProperty))
+              return;
+            const invoke = async (...args) => {
+              const normalized = normalizeCacheRequest(operationProperty, args);
+              const wireOperation = String(normalized.request.operation);
+              return invokeCapability("cache", wireOperation, normalized.request, normalized.callOptions);
+            };
+            Object.freeze(invoke);
+            operationCache2.set(operationProperty, invoke);
+            return invoke;
+          },
+          set: () => false,
+          defineProperty: () => false,
+          deleteProperty: () => false
+        });
+        capabilityCache.set(capabilityProperty, cache);
+        return cache;
+      }
+      if (capabilityProperty === "state") {
+        const operationCache2 = new Map;
+        const state = new Proxy(Object.freeze({}), {
+          get(_stateTarget, operationProperty) {
+            if (typeof operationProperty !== "string")
+              return;
+            const known = operationCache2.get(operationProperty);
+            if (known !== undefined)
+              return known;
+            if (!stateOperations.has(operationProperty))
+              return;
+            const invoke = async (...args) => {
+              const normalized = normalizeStateRequest(operationProperty, args);
+              const wireOperation = String(normalized.request.operation);
+              return invokeCapability("state", wireOperation, normalized.request, normalized.callOptions);
+            };
+            Object.freeze(invoke);
+            operationCache2.set(operationProperty, invoke);
+            return invoke;
+          },
+          set: () => false,
+          defineProperty: () => false,
+          deleteProperty: () => false
+        });
+        capabilityCache.set(capabilityProperty, state);
+        return state;
+      }
+      if (capabilityProperty === "events") {
+        const emit = async (...args) => {
+          const normalized = normalizeEventEmit(args);
+          return invokeCapability("events", "emit", normalized.request, normalized.callOptions);
+        };
+        Object.freeze(emit);
+        const events = Object.freeze({ emit });
+        capabilityCache.set(capabilityProperty, events);
+        return events;
+      }
+      if (capabilityProperty === "workflows") {
+        const call = async (...args) => {
+          const remainingTimeoutMs = Math.max(1, Math.floor(executionDeadline - performance.now()));
+          const normalized = normalizeWorkflowOperation("call", args, remainingTimeoutMs);
+          return invokeCapability("workflows", "call", normalized.request, normalized.callOptions);
+        };
+        const start = async (...args) => {
+          const remainingTimeoutMs = Math.max(1, Math.floor(executionDeadline - performance.now()));
+          const normalized = normalizeWorkflowOperation("start", args, remainingTimeoutMs);
+          return invokeCapability("workflows", "start", normalized.request, normalized.callOptions);
+        };
+        Object.freeze(call);
+        Object.freeze(start);
+        const workflows = Object.freeze({ call, start });
+        capabilityCache.set(capabilityProperty, workflows);
+        return workflows;
+      }
+      const operationCache = new Map;
+      const capability = new Proxy(Object.freeze({}), {
+        get(_capabilityTarget, operationProperty) {
+          if (typeof operationProperty !== "string")
+            return;
+          const known = operationCache.get(operationProperty);
+          if (known !== undefined)
+            return known;
+          const invoke = async (rawInput = null, callOptions) => invokeCapability(capabilityProperty, operationProperty, capabilityProperty === "http" && operationProperty === "request" ? normalizeHttpRequest(rawInput) : capabilityProperty === "telegram" && operationProperty === "send" ? normalizeTelegramSend(rawInput) : capabilityProperty === "discord" && operationProperty === "send" ? normalizeDiscordSend(rawInput) : capabilityProperty === "whatsapp" && operationProperty === "send" ? normalizeWhatsAppSend(rawInput) : rawInput, callOptions);
+          Object.freeze(invoke);
+          operationCache.set(operationProperty, invoke);
+          return invoke;
+        },
+        set: () => false,
+        defineProperty: () => false,
+        deleteProperty: () => false
+      });
+      capabilityCache.set(capabilityProperty, capability);
+      return capability;
+    },
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+
+class ModuleInitializationEffectError extends Error {
+  constructor() {
+    super("Fetch and managed services cannot be used while a WOML module is initializing.");
+    this.name = "ModuleInitializationEffectError";
+  }
+}
+function servicePath(root, path) {
+  let value = root;
+  for (const part of path)
+    value = Reflect.get(value, part);
+  return value;
+}
+function guardedModuleServices(currentServices, invocationActive, path = []) {
+  const callable = function guardedWomlModuleService() {};
+  return new Proxy(callable, {
+    get(_target, property) {
+      return guardedModuleServices(currentServices, invocationActive, [
+        ...path,
+        property
+      ]);
+    },
+    apply(_target, thisArgument, argumentsList) {
+      if (!invocationActive())
+        throw new ModuleInitializationEffectError;
+      const value = servicePath(currentServices(), path);
+      if (typeof value !== "function") {
+        throw new TypeError(`services.${path.map(String).join(".")} is not callable.`);
+      }
+      return Reflect.apply(value, thisArgument, argumentsList);
+    },
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+function mergedServiceFacade(builtIns, modules) {
+  return new Proxy(Object.freeze({}), {
+    get(_target, property) {
+      if (typeof property === "string" && Object.hasOwn(modules, property)) {
+        return modules[property];
+      }
+      return Reflect.get(builtIns, property);
+    },
+    set: () => false,
+    defineProperty: () => false,
+    deleteProperty: () => false
+  });
+}
+async function loadRuntimeModules(request, builtIns, trackedFetch) {
+  const imported = {};
+  let moduleInvocationDepth = 0;
+  let activeServices = builtIns;
+  const invocationActive = () => moduleInvocationDepth > 0;
+  const moduleServices = guardedModuleServices(() => activeServices, invocationActive);
+  const moduleFetch = (...args) => {
+    if (!invocationActive())
+      throw new ModuleInitializationEffectError;
+    return trackedFetch(...args);
+  };
+  Object.defineProperty(globalThis, "services", {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: moduleServices
+  });
+  Object.defineProperty(globalThis, "fetch", {
+    configurable: false,
+    enumerable: true,
+    writable: false,
+    value: moduleFetch
+  });
+  for (const module of request.modules ?? []) {
+    const actualDigest = `sha256:${new Bun.CryptoHasher("sha256").update(module.bundle).digest("hex")}`;
+    if (actualDigest !== module.bundleDigest) {
+      throw new Error(`Module ${module.name} failed its Worker digest check.`);
+    }
+    if (module.sourceMap !== undefined) {
+      const actualSourceMapDigest = `sha256:${new Bun.CryptoHasher("sha256").update(module.sourceMap).digest("hex")}`;
+      if (actualSourceMapDigest !== module.sourceMapDigest) {
+        throw new Error(`Module ${module.name} failed its source-map digest check.`);
+      }
+    }
+    const executableBundle = executableModuleBundle(module);
+    const encoded = Buffer.from(executableBundle, "utf8").toString("base64");
+    const namespace = await import(`data:text/javascript;base64,${encoded}`);
+    const exposed = {};
+    for (const exportName of module.exports) {
+      const implementation = namespace[exportName];
+      if (typeof implementation !== "function") {
+        throw new TypeError(`Module ${module.name} export ${exportName} is not a function.`);
+      }
+      const wrapped = function womlImportedModuleFunction(...args) {
+        moduleInvocationDepth += 1;
+        try {
+          const result = Reflect.apply(implementation, undefined, args);
+          if (typeof result === "object" && result !== null || typeof result === "function") {
+            const then = Reflect.get(result, "then");
+            if (typeof then === "function") {
+              return Promise.resolve(result).finally(() => {
+                moduleInvocationDepth -= 1;
+              });
+            }
+          }
+          moduleInvocationDepth -= 1;
+          return result;
+        } catch (error) {
+          moduleInvocationDepth -= 1;
+          throw error;
+        }
+      };
+      Object.freeze(wrapped);
+      exposed[exportName] = wrapped;
+    }
+    imported[module.name] = Object.freeze(exposed);
+  }
+  activeServices = mergedServiceFacade(builtIns, imported);
+  return activeServices;
+}
+async function execute(request) {
+  let secretValues = [];
+  try {
+    const executionDeadline = performance.now() + request.timeoutMs;
+    operationSequences.clear();
+    automaticEffectfulCalls.clear();
+    workflowTargetIdentityModes.clear();
+    const context = deepFreezeJson({
+      ...request.context,
+      payload: request.context.trigger
+    });
+    const attempt = request.attempt === undefined ? undefined : deepFreezeJson(request.attempt);
+    const secrets = deepFreezeJson(request.bindings?.secrets ?? {});
+    const lifecycle = request.lifecycle === undefined ? undefined : deepFreezeJson(request.lifecycle);
+    const reusable = request.reusable === undefined ? undefined : deepFreezeJson(request.reusable);
+    const reusableLifecycle = request.reusableLifecycle === undefined ? undefined : deepFreezeJson(request.reusableLifecycle);
+    secretValues = Object.values(request.bindings?.secrets ?? {});
+    const safeConsole = Object.freeze({
+      log: (...values) => globalThis.console.error(redactKnownSecrets(values.map((value) => String(value)).join(" "), secretValues)),
+      info: (...values) => globalThis.console.error(redactKnownSecrets(values.map((value) => String(value)).join(" "), secretValues)),
+      warn: (...values) => globalThis.console.error(redactKnownSecrets(values.map((value) => String(value)).join(" "), secretValues)),
+      error: (...values) => globalThis.console.error(redactKnownSecrets(values.map((value) => String(value)).join(" "), secretValues))
+    });
+    const builtInServices = deeplyReadonlyServiceFacade(request, executionDeadline);
+    const nativeFetch2 = trackedNativeFetch(request);
+    const services = request.modules === undefined ? builtInServices : await loadRuntimeModules(request, builtInServices, nativeFetch2);
+    if (request.bindings !== undefined && request.modules === undefined) {
+      Object.defineProperty(globalThis, "fetch", {
+        configurable: false,
+        enumerable: true,
+        writable: false,
+        value: nativeFetch2
+      });
+    }
+    const safeNodeId = request.nodeId.replace(/[^A-Za-z0-9_-]/g, "_");
+    const body = `"use strict";
+${request.source}
+//# sourceURL=woml-${request.mode === "lifecycle" ? "lifecycle" : "step"}-${safeNodeId}.js`;
+    const script = request.bindings === undefined ? new AsyncFunction("context", "attempt", "console", body) : reusable !== undefined && reusableLifecycle !== undefined ? reusable.definition.kind === "step" ? new AsyncFunction("props", "context", "lifecycle", "services", "fetch", "console", body) : new AsyncFunction("props", "lifecycle", "services", "fetch", "console", body) : reusable !== undefined ? new AsyncFunction("props", "context", "attempt", "services", "fetch", "console", body) : request.mode === "lifecycle" ? new AsyncFunction("context", "lifecycle", "attempt", "services", "secrets", "fetch", "console", body) : new AsyncFunction("context", "attempt", "services", "secrets", "fetch", "console", body);
+    let result = request.bindings === undefined ? await script(context, attempt, safeConsole) : reusable !== undefined && reusableLifecycle !== undefined ? reusable.definition.kind === "step" ? await script(reusable.props, context, reusableLifecycle, services, nativeFetch2, safeConsole) : await script(reusable.props, reusableLifecycle, services, nativeFetch2, safeConsole) : reusable !== undefined ? await script(reusable.props, context, attempt, services, nativeFetch2, safeConsole) : request.mode === "lifecycle" ? await script(context, lifecycle, attempt, services, secrets, nativeFetch2, safeConsole) : await script(context, attempt, services, secrets, nativeFetch2, safeConsole);
+    if ((request.mode === "lifecycle" || reusableLifecycle !== undefined) && result === undefined) {
+      result = null;
+    }
+    const violation = findJsonViolation(result);
+    if (violation !== undefined) {
+      self.postMessage({
+        messageType: "completed",
+        response: {
+          ok: false,
+          error: {
+            kind: "non-json",
+            name: "NonJsonResult",
+            message: `${violation.path}: ${violation.reason}`
+          }
+        }
+      });
+      return;
+    }
+    self.postMessage({
+      messageType: "completed",
+      response: { ok: true, result }
+    });
+  } catch (error) {
+    self.postMessage({
+      messageType: "completed",
+      response: serializeError(error, secretValues, request.modules)
+    });
+  }
+}
+self.onmessage = (event) => {
+  const message = event.data;
+  if (message.messageType === "execute") {
+    execute(message.request);
+    return;
+  }
+  if (message.messageType === "fetch_observation_ack") {
+    const pending2 = pendingFetchAcks.get(message.requestId);
+    if (pending2 === undefined)
+      return;
+    pendingFetchAcks.delete(message.requestId);
+    if (message.ack.accepted)
+      pending2.resolve();
+    else
+      pending2.reject(new NativeFetchTrackingError(message.requestId, message.ack.error));
+    return;
+  }
+  const pending = pendingCalls.get(message.callId);
+  if (pending === undefined)
+    return;
+  pendingCalls.delete(message.callId);
+  if (message.result.outcome === "succeeded") {
+    const actualBytes = Buffer.byteLength(JSON.stringify(message.result.result), "utf8");
+    if (actualBytes > 4194304 || actualBytes !== message.result.resultBytes) {
+      pending.reject(new ServiceCallError(pending.capability, pending.operation, message.callId, {
+        kind: "invalid_result",
+        code: "WOML_CAPABILITY_RESULT_INVALID",
+        message: "The capability result failed its byte-size contract.",
+        retryable: false,
+        ambiguous: false
+      }));
+      return;
+    }
+    pending.resolve(message.result.result);
+  } else {
+    pending.reject(new ServiceCallError(pending.capability, pending.operation, message.callId, message.result.error));
+  }
+};
+
+//# debugId=3B98B459CBEA2E9664756E2164756E21