Module Runtime and Security

WOML packages the complete local module graph before activation so a run stays bound to immutable source.

Available bindings

A module receives services and native fetch() automatically. It does not receive context, attempt, or secrets; pass required values explicitly from the workflow script.

Project boundary

Imports must remain inside the workflow project. WOML rejects path escapes, symlink escapes, cycles, case collisions, missing extensions, unsupported exports, graphs above 512 sources, and graphs above 16 MiB.

Secret discipline

Keep symbolic secret reads in WOML scripts. Pass only the specific value needed by a module function, and never return or log it.

Understand immutable packaging

Before activation, WOML follows every supported static relative import, validates the graph, bundles its sources, and binds the resulting artifact to the workflow definition. A waiting or recovered run therefore does not silently execute a different module because a source file changed later.

Editing a module affects newly admitted definitions and runs after validation; it does not mutate the code identity of an existing run.

Keep imports inside the project

Paths must remain inside the workflow project after resolving symlinks. WOML rejects path traversal, symlink escape, missing extensions, cycles, case-colliding paths, more than 512 sources, and a graph larger than 16 MiB.

The current module system supports local .js and .ts files. It does not install npm packages at runtime or accept bare package specifiers. Vendor required code into the project only when its licensing and security implications are understood.

Treat modules as trusted project code

Module bundling creates reproducibility; it does not turn arbitrary JavaScript into a hostile multi-tenant sandbox. Local modules can use runtime capabilities made available by the project, so review them like application source.

Pass the minimum required data and secret values. Prefer a managed service for important external effects so WOML can record bounded outcomes, cancellation, and operation identity.

Review generated declarations

woml-env.d.ts improves editor understanding but does not grant runtime capability. The compiled module graph and runtime remain authoritative. Never assume a type declaration means an unsupported import or service will execute.