@flowdular/sdk 0.3.0 → 0.3.2

package/modules/system/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-system",
-	"version": "0.7.3",
+	"version": "0.8.0",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",
@@ -16,6 +16,7 @@
 	"dependencies": {
 		"@flowdular/client": "workspace:*",
 		"@flowdular/contracts": "workspace:*",
+		"@flowdular/database": "workspace:*",
 		"@flowdular/kernel": "workspace:*",
 		"@flowdular/module-auth": "workspace:*",
 		"@flowdular/server": "workspace:*",
@@ -26,7 +27,6 @@
 		"yaml": "2.9.0"
 	},
 	"devDependencies": {
-		"@flowdular/database": "workspace:*",
 		"@flowdular/database-testing": "workspace:*",
 		"@tsrx/typescript-plugin": "0.3.120",
 		"@types/node": "24.13.3",

package/modules/system/spec/module.yaml

@@ -1,12 +1,13 @@
 schemaVersion: 2
 id: system.core
-specVersion: 0.7.3
+specVersion: 0.8.0
 status: approved
 name: System Core
 description: Provides the application shell, platform health, module discovery, and the administration surface for module settings.
 profile: full
 capabilities:
   - api
+  - database
   - client
   - translations
 dependencies: []
@@ -26,6 +27,10 @@ invariants:
   - Module settings are declared by their owning module, stored per tenant by auth.core, and changed only through the settings administration API served by system.core, with an audit record.
   - system.core declares the workspace time zone as a shared tenant setting, system.core.timeZone, defaulting to UTC. Only a name the runtime zone database resolves is stored, in its canonical IANA spelling, and any module that declares a dependency on system.core reads it live through the settings runtime; a value this deployment cannot resolve reads back as UTC instead of failing the reader.
   - A feature flag is a module setting declared with kind flag, which is a non-secret boolean with a declared default, a label, a description, and tenant scope, the only scope a flag may take. It is stored, read, validated and overridden exactly like any other setting, so a module reads it on the request path through the settings runtime at no cost beyond the settings read itself; system.core adds no flag store, no flag endpoint and no second write path.
+  - The composed module set is CLI-owned and baked at build; a module cannot be added to a running application from the UI. system.core owns per-workspace activation of the modules the application already composes, stored in the tenant table system_module_activations under forced row-level security. A composed module without a row is active.
+  - system.core, auth.core, users.core and profile.core are required and always active. A module that another active module declares as a dependency, through a declared module dependency or a required public capability, cannot be deactivated; the refusal names the active dependents. A module cannot be activated while one of its dependencies is inactive.
+  - Every activation change appends one audit event, system.module.activated or system.module.deactivated, to the auth.core trail with the module id and the actor. Repeating the current state changes nothing and writes no event.
+  - Activation is enforced in three places from one per-workspace snapshot published as the public capability system.modules.v1 and memoised for at most thirty seconds per tenant, refreshed at once by a change made through this instance. defineEndpoint answers 403 MODULE_INACTIVE for an endpoint of an inactive module in the principal's workspace, required modules exempt; the application shell hides the navigation, views, widgets and command palette entries of inactive modules; the endpoint gate never reads a tenant id from the request.
 permissions:
   - id: system.workspace.access
     description: Open the authenticated ERP workspace.
@@ -44,6 +49,28 @@ dataOwnership:
   - Feature modules own their navigation metadata and screen implementations.
   - Module settings values are stored by auth.core on behalf of the declaring module; system.core owns the settings API, the per-module settings section of the Modules drawer, the Flags screen, and the settings permissions.
   - A feature flag is owned by the module that declares it; system.core only lists and edits it, and auth.core records the change.
+  - system.core owns the per-workspace module activation rows and the system.modules.v1 capability; the composed module set stays owned by the CLI and flowdular.json.
+entities:
+  - id: module-activation
+    name: Module activation
+    description: The last activation decision an owner made for one composed module in one workspace.
+    fields:
+      - id: moduleId
+        type: string
+        required: true
+        unique: tenant
+        maxLength: 128
+      - id: active
+        type: boolean
+        required: true
+      - id: changedBy
+        type: string
+        required: true
+        maxLength: 64
+        description: Account id of the owner who made the change.
+      - id: changedAt
+        type: datetime
+        required: true
 acceptanceScenarios:
   - id: SYSTEM-MULTI-VIEW-MODULE
     given: An enabled module contributes multiple valid navigation entries and matching views.
@@ -117,15 +144,85 @@ acceptanceScenarios:
     given: Enabled modules declare feature flags and a principal with system.settings.read opens the Flags screen in Administration > Modules.
     when: The principal reads the flags and a principal with system.settings.manage turns one on for this workspace, then resets it.
     then: Every declared flag is listed grouped by its owning module with its current value and a link to the audit trail; the override applies to that workspace alone and takes effect on the next settings read; a reset restores the declared default; each change appends one settings.flag.changed audit event carrying the module, the key, the previous and next values and the actor; and a principal without system.settings.manage is refused with 401 or 403 and changes nothing.
+  - id: SYSTEM-MODULE-ACTIVATE
+    given: An owner with system.settings.manage opens Administration > Modules, where every composed module is listed with its version, activation state and dependents and is active by default.
+    when: The owner deactivates an optional module, confirms the dialog, and later activates it again.
+    then: The module is inactive for that workspace alone and active again after the second change; each change is stored with the actor and appends one system.module.deactivated or system.module.activated audit event; a member without system.settings.manage sees the row action refused with a reason, and a request without a browser session, without the scope or without a CSRF token is refused with 401 or 403 and changes nothing.
+  - id: SYSTEM-MODULE-DEACTIVATE-REFUSED-DEPENDENCY
+    given: An active module that another active module depends on, or a required module.
+    when: An owner attempts to deactivate it.
+    then: The server refuses with 409 MODULE_HAS_ACTIVE_DEPENDENTS naming the active dependents, or 409 MODULE_REQUIRED, the screen shows the reason, nothing is stored and no audit event is written; once the dependents are inactive the deactivation is accepted, and activating a module whose dependency is inactive is refused with 409 MODULE_DEPENDENCY_INACTIVE.
+  - id: SYSTEM-MODULE-INACTIVE-ENDPOINT
+    given: A module an owner deactivated for the workspace.
+    when: A principal of that workspace calls any endpoint the module defines, or a principal of another workspace calls the same endpoint.
+    then: The first request is refused with 403 MODULE_INACTIVE after the permission check, the second is served, and an endpoint of system.core, auth.core, users.core or profile.core is never gated.
+  - id: SYSTEM-MODULE-INACTIVE-NAVIGATION
+    given: A module an owner deactivated for the workspace.
+    when: A member of that workspace opens the application shell.
+    then: The shell reads the active module ids through GET /api/system/modules/active, hides the module's navigation entries, views, workspace widgets and command palette search, returns a bookmark of one of its views to the dashboard, and shows every module when the read fails.
 screens:
   - id: flags
     kind: list
     title: Flags
     navigationGroup: Administration
+  - id: modules
+    kind: list
+    entity: module-activation
+    title: Modules
+    navigationGroup: Administration
+    columns:
+      - moduleId
+      - active
 actions:
+  - id: activate-module
+    entity: module-activation
+    permission: system.settings.manage
+    kind: update
+    risk: workspace-write
+    idempotent: true
+    description: Activate a composed optional module for this workspace after its dependencies are active.
+  - id: deactivate-module
+    entity: module-activation
+    permission: system.settings.manage
+    kind: update
+    risk: workspace-write
+    idempotent: true
+    description: Deactivate a composed optional module for this workspace unless a required module or an active dependent needs it.
   - id: set-flag
     permission: system.settings.manage
     kind: update
     risk: workspace-write
     idempotent: true
     description: Turn a declared feature flag on or off for this workspace, or clear the override so the module default applies again.
+decisions:
+  - id: D-MODULE-ACTIVATION-SCOPE
+    question: What can the administration UI change about modules?
+    answer: Per-workspace activation of the modules the application already composes; adding or removing a module stays a CLI operation because the composition is baked at build.
+    decidedBy: user
+  - id: D-MODULE-ACTIVATION-REQUIRED
+    question: Which modules can never be deactivated?
+    answer: system.core, auth.core, users.core and profile.core, and any module another active module depends on through a declared module dependency or a required public capability; the refusal names the active dependents.
+    decidedBy: user
+  - id: D-MODULE-ACTIVATION-DEFAULT
+    question: What is the state of a module nobody has touched?
+    answer: Active; the table holds only decisions an owner made, and a row is written for the module being changed, never for the whole set.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-SNAPSHOT
+    question: How often is the activation read?
+    answer: Once per tenant into a memoised snapshot held for thirty seconds and at most 1024 tenants per process, invalidated at once by a change through the same instance; another instance sees the change within the snapshot lifetime.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-AUDIT
+    question: Where is a change recorded?
+    answer: One system.module.activated or system.module.deactivated event in the auth.core audit trail, carrying the module id, the resulting state and the actor; a no-op repeat writes nothing.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-SHELL
+    question: How does the shell learn which modules are active?
+    answer: From GET /api/system/modules/active, served to every member holding system.workspace.access, read once per workspace before the shell renders; a failed read shows every module because the server gate still refuses an inactive module's API.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-AGENT-TOOLS
+    question: Are the agent tools of an inactive module withheld?
+    answer: Not yet. The harness tool registry has no per-tenant module hook and a tool carries no module id, so this is a documented follow-up; a tool of an inactive module that calls the module's service still runs.
+    decidedBy: default
+outOfScope:
+  - Adding or removing a module from a running application through the UI; the composition is CLI-owned and baked at build.
+  - Withholding the agent tools of an inactive module from a workspace, which needs a per-tenant hook in the harness tool registry.

package/modules/system/src/client/ModulesView.tsrx

@@ -2,6 +2,7 @@ import { useEffect, useMemo } from 'octane';
 import {
 	Alert,
 	Button,
+	ConfirmDialog,
 	Drawer,
 	EmptyState,
 	Icon,
@@ -14,11 +15,21 @@ import {
 } from '@flowdular/sdk/ui';
 import { activeLocale, t } from '@flowdular/sdk/client';
 import { useValue } from 'segment-state';
-import { ApiError, loadModuleCatalog, type ModuleCatalogEntry } from './api.ts';
+import {
+	ApiError,
+	loadModuleCatalog,
+	setModuleActivation,
+	type ModuleCatalogEntry,
+} from './api.ts';
 import { FlagsPanel } from './FlagsPanel.tsrx';
-import { moduleColumns, surfaces } from './module-columns.tsrx';
+import {
+	activationLabel,
+	activationTone,
+	moduleColumns,
+	surfaces,
+} from './module-columns.tsrx';
 import { ModuleSettingsSection } from './ModuleSettingsSection.tsrx';
-import { createModulesClientState } from './state.ts';
+import { activationRefusal, createModulesClientState } from './state.ts';
 
 const TABS_ID = 'system-modules';
 
@@ -38,6 +49,11 @@ export function ModulesView(props: ModulesViewProps) @{
 		client.state.selectedModuleId,
 	);
 	const [tab, setTab] = useValue(client.state.tab);
+	const [pending, setPending] = useValue(client.state.pending);
+	const [busyModuleId, setBusyModuleId] = useValue(client.state.busyModuleId);
+	const [activationError, setActivationError] = useValue(
+		client.state.activationError,
+	);
 	const selected =
 		modules.find((module) => module.id === selectedModuleId) ?? null;
 	const term = query.trim().toLocaleLowerCase(activeLocale());
@@ -50,6 +66,9 @@ export function ModulesView(props: ModulesViewProps) @{
 							module.name.toLocaleLowerCase(activeLocale()).includes(term),
 				);
 	const enabled = modules.filter((module) => module.enabled);
+	const active = enabled.filter((module) => module.active);
+	const pendingModule =
+		modules.find((module) => module.id === pending?.moduleId) ?? null;
 
 	const refresh = async () => {
 		setStatus('loading');
@@ -76,6 +95,33 @@ export function ModulesView(props: ModulesViewProps) @{
 		void refresh();
 	}, []);
 
+	/* The server is the authority on dependencies: a refusal it answers is
+   shown with the modules it named, and the catalog is read again so the
+   table never shows a state the workspace no longer has. */
+	const confirmActivation = async () => {
+		if (!pending) return;
+		setBusyModuleId(pending.moduleId);
+		setActivationError('');
+		try {
+			await setModuleActivation(
+				pending.moduleId,
+				pending.active,
+				props.csrfToken,
+			);
+			setPending(null);
+			await refresh();
+		} catch (changeError) {
+			setPending(null);
+			setActivationError(
+				changeError instanceof Error
+					? changeError.message
+					: t('system.error.activation'),
+			);
+		} finally {
+			setBusyModuleId(null);
+		}
+	};
+
 	<div class="ui-view">
 		<PageHeader
 			eyebrow={t('system.page.eyebrow')}
@@ -118,9 +164,13 @@ export function ModulesView(props: ModulesViewProps) @{
 					@if (status === 'error') {
 						<Alert>{error}</Alert>
 					}
+					@if (activationError !== '') {
+						<Alert>{activationError}</Alert>
+					}
 					<TableCard
 						title={t('system.table.title')}
 						count={t('system.table.count', {
+							active: active.length,
 							enabled: enabled.length,
 							total: modules.length,
 						})}
@@ -158,6 +208,23 @@ export function ModulesView(props: ModulesViewProps) @{
 								icon: 'external',
 								onSelect: () => setSelectedModuleId(module.id),
 							},
+							{
+								id: 'activation',
+								label: module.enabled && module.active
+									? t('system.action.deactivate')
+									: t('system.action.activate'),
+								icon: module.enabled && module.active ? 'x' : 'play',
+								tone: module.enabled && module.active ? 'danger' : 'default',
+								disabled: busyModuleId !== null ||
+									activationRefusal(module, props.canManageSettings, t) !==
+										null,
+								reason: activationRefusal(module, props.canManageSettings, t) ??
+									undefined,
+								onSelect: () => setPending({
+									moduleId: module.id,
+									active: !module.active,
+								}),
+							},
 						]}
 						noteIcon="code"
 						note={<>
@@ -173,6 +240,28 @@ export function ModulesView(props: ModulesViewProps) @{
 				</>
 			}
 		</div>
+		<ConfirmDialog
+			open={pending !== null}
+			title={pending?.active
+				? t('system.activation.confirmActivateTitle', {
+						module: pendingModule?.name ?? pending.moduleId,
+					})
+				: t('system.activation.confirmDeactivateTitle', {
+						module: pendingModule?.name ?? pending?.moduleId ?? '',
+					})}
+			confirmLabel={pending?.active
+				? t('system.action.activate')
+				: t('system.action.deactivate')}
+			cancelLabel={t('system.action.cancel')}
+			tone={pending?.active ? 'primary' : 'danger'}
+			busy={busyModuleId !== null}
+			onConfirm={() => void confirmActivation()}
+			onCancel={() => setPending(null)}
+		>
+			{pending?.active
+				? t('system.activation.confirmActivate')
+				: t('system.activation.confirmDeactivate')}
+		</ConfirmDialog>
 		<Drawer
 			open={tab === 'catalog' && selected !== null}
 			title={selected?.name ?? t('system.drawer.module')}
@@ -224,11 +313,9 @@ function ModuleDetail(props: {
 					</span>
 					<span class="ui-cell">
 						<small>{t('system.table.status')}</small>
-						<Tag tone={props.module.enabled ? 'success' : 'neutral'} dot>
-							{props.module.enabled
-								? t('system.status.enabled')
-								: t('system.status.available')}
-						</Tag>
+						<Tag tone={activationTone(props.module)} dot>{activationLabel(
+							props.module,
+						)}</Tag>
 					</span>
 				</div>
 				<span class="ui-cell">
@@ -241,6 +328,12 @@ function ModuleDetail(props: {
 					<small>{t('system.detail.directory')}</small>
 					<span class="ui-mono">{props.module.directory}</span>
 				</span>
+				<span class="ui-cell">
+					<small>{t('system.table.dependents')}</small>
+					<span class="ui-mono">
+						{props.module.dependents.join(', ') || t('system.value.none')}
+					</span>
+				</span>
 			</div>
 			<div class="ui-form__section">
 				<div class="ui-form__section-head">

package/modules/system/src/client/api.ts

@@ -1,7 +1,8 @@
-import type { ModuleCatalogEntry } from '../server/module-catalog.ts';
+import type { ModuleCatalogPayload } from '../server/endpoints.ts';
+import type { ModuleActivationEntry } from '../domain/modules.ts';
 import { t } from '@flowdular/sdk/client/i18n';
 
-export type { ModuleCatalogEntry };
+export type ModuleCatalogEntry = ModuleCatalogPayload;
 
 export interface ModuleCatalog {
 	readonly modules: readonly ModuleCatalogEntry[];
@@ -10,27 +11,67 @@ export interface ModuleCatalog {
 
 export class ApiError extends Error {
 	readonly status: number;
+	/** The modules a refusal names, when the server named any. */
+	readonly modules: readonly string[];
 
-	constructor(status: number, message: string) {
+	constructor(
+		status: number,
+		message: string,
+		modules: readonly string[] = [],
+	) {
 		super(message);
 		this.name = 'ApiError';
 		this.status = status;
+		this.modules = modules;
 	}
 }
 
-export async function loadModuleCatalog(): Promise<ModuleCatalog> {
-	const response = await fetch('/api/system/modules', {
-		headers: { accept: 'application/json' },
-		credentials: 'same-origin',
-	});
-	const value = (await response.json()) as ModuleCatalog & {
-		readonly error?: { readonly message?: string };
+async function payload<T>(response: Response, fallback: string): Promise<T> {
+	const value = (await response.json()) as T & {
+		readonly error?: {
+			readonly message?: string;
+			readonly modules?: readonly string[];
+		};
 	};
 	if (!response.ok) {
 		throw new ApiError(
 			response.status,
-			value.error?.message ?? t('system.error.catalog'),
+			value.error?.message ?? fallback,
+			value.error?.modules ?? [],
 		);
 	}
 	return value;
 }
+
+export async function loadModuleCatalog(): Promise<ModuleCatalog> {
+	const response = await fetch('/api/system/modules', {
+		headers: { accept: 'application/json' },
+		credentials: 'same-origin',
+	});
+	return payload<ModuleCatalog>(response, t('system.error.catalog'));
+}
+
+export async function setModuleActivation(
+	moduleId: string,
+	active: boolean,
+	csrfToken: string,
+): Promise<ModuleActivationEntry> {
+	const response = await fetch(
+		active ? '/api/system/modules/activate' : '/api/system/modules/deactivate',
+		{
+			method: 'POST',
+			headers: {
+				'content-type': 'application/json',
+				'x-csrf-token': csrfToken,
+			},
+			credentials: 'same-origin',
+			body: JSON.stringify({ moduleId }),
+		},
+	);
+	return (
+		await payload<{ readonly module: ModuleActivationEntry }>(
+			response,
+			t('system.error.activation'),
+		)
+	).module;
+}

package/modules/system/src/client/module-columns.tsrx

@@ -2,6 +2,22 @@ import { Tag, type TableColumn } from '@flowdular/sdk/ui';
 import { activeLocale, t } from '@flowdular/sdk/client';
 import type { ModuleCatalogEntry } from './api.ts';
 
+export function activationTone(
+	module: ModuleCatalogEntry,
+): 'success' | 'warning' | 'ink' | 'neutral' {
+	if (!module.enabled) return 'neutral';
+	if (!module.optional) return 'ink';
+	return module.active ? 'success' : 'warning';
+}
+
+export function activationLabel(module: ModuleCatalogEntry): string {
+	if (!module.enabled) return t('system.status.available');
+	if (!module.optional) return t('system.status.required');
+	return module.active
+		? t('system.status.active')
+		: t('system.status.inactive');
+}
+
 export function surfaces(module: ModuleCatalogEntry): string {
 	const parts = [
 		module.platform.server && 'server',
@@ -37,7 +53,7 @@ export function moduleColumns(): readonly TableColumn<ModuleCatalogEntry>[] {
 		{
 			key: 'platform',
 			header: t('system.table.platform'),
-			width: '30%',
+			width: '20%',
 			cell: (module) => <span class="ui-cell">
 				<span>{surfaces(module)}</span>
 				<small>{module.capabilities.join(', ')}</small>
@@ -52,15 +68,25 @@ export function moduleColumns(): readonly TableColumn<ModuleCatalogEntry>[] {
 				module.permissions.length,
 			),
 		},
+		{
+			key: 'dependents',
+			header: t('system.table.dependents'),
+			width: '14%',
+			cell: (module) => <span class="ui-cell">
+				<span>{new Intl.NumberFormat(activeLocale()).format(
+					module.dependents.length,
+				)}</span>
+				{module.dependents.length > 0
+					? <small class="ui-mono">{module.dependents.join(', ')}</small>
+					: null}
+			</span>,
+		},
 		{
 			key: 'status',
 			header: t('system.table.status'),
 			width: '14%',
-			cell: (module) => <Tag tone={module.enabled ? 'success' : 'neutral'} dot>
-				{module.enabled
-					? t('system.status.enabled')
-					: t('system.status.available')}
-			</Tag>,
+			cell: (module) =>
+				<Tag tone={activationTone(module)} dot>{activationLabel(module)}</Tag>,
 		},
 	];
 }

package/modules/system/src/client/state.ts

@@ -4,6 +4,12 @@ import type { ModuleCatalogEntry } from './api.ts';
 export type ModulesStatus = 'loading' | 'idle' | 'denied' | 'error';
 export type ModulesTab = 'catalog' | 'flags';
 
+/** The activation change waiting for the owner's confirmation. */
+export interface PendingActivation {
+	readonly moduleId: string;
+	readonly active: boolean;
+}
+
 export function createModulesClientState() {
 	const store = createStore({
 		modules: cell<readonly ModuleCatalogEntry[]>([]),
@@ -13,6 +19,26 @@ export function createModulesClientState() {
 		query: '',
 		selectedModuleId: cell<string | null>(null),
 		tab: cell<ModulesTab>('catalog'),
+		pending: cell<PendingActivation | null>(null),
+		busyModuleId: cell<string | null>(null),
+		activationError: '',
 	});
 	return { store, state: store.state };
 }
+
+/** Why the row action is refused before the server is asked, else null. */
+export function activationRefusal(
+	module: ModuleCatalogEntry,
+	canManage: boolean,
+	translate: (key: string, params?: Record<string, string>) => string,
+): string | null {
+	if (!module.enabled) return translate('system.activation.notComposed');
+	if (!canManage) return translate('system.activation.deniedManage');
+	if (!module.optional) return translate('system.activation.required');
+	if (module.active && module.dependents.length > 0) {
+		return translate('system.activation.dependents', {
+			modules: module.dependents.join(', '),
+		});
+	}
+	return null;
+}

package/modules/system/src/domain/modules.ts

@@ -0,0 +1,93 @@
+import { REQUIRED_MODULE_IDS } from '@flowdular/sdk/contracts';
+
+export const SYSTEM_MODULES_CAPABILITY = 'system.modules.v1';
+
+const REQUIRED = new Set<string>(REQUIRED_MODULE_IDS);
+
+export function isRequiredModule(moduleId: string): boolean {
+	return REQUIRED.has(moduleId);
+}
+
+/** One module the application composes, with the modules it cannot run without. */
+export interface ComposedModule {
+	readonly id: string;
+	readonly version: string;
+	readonly dependencies: readonly string[];
+}
+
+export interface ModuleActivationEntry {
+	readonly id: string;
+	readonly version: string;
+	readonly active: boolean;
+	/** False for a required module, which is never deactivated. */
+	readonly optional: boolean;
+	/** Composed modules that declare this one as a dependency. */
+	readonly dependents: readonly string[];
+}
+
+export interface ModuleActivationChange {
+	readonly moduleId: string;
+	readonly active: boolean;
+}
+
+/** What other composed modules a public capability is served by. */
+export interface ManifestDependencies {
+	readonly id: string;
+	readonly version: string;
+	readonly dependencies: readonly string[];
+	readonly provides: readonly string[];
+	/** Capability ids the module cannot compose without. */
+	readonly requires: readonly string[];
+}
+
+/* A dependency is a declared module dependency or a required capability,
+   resolved to the composed module that provides it. */
+export function composedModules(
+	manifests: readonly ManifestDependencies[],
+): readonly ComposedModule[] {
+	const providers = new Map<string, string>();
+	const ids = new Set(manifests.map((manifest) => manifest.id));
+	for (const manifest of manifests) {
+		for (const capability of manifest.provides) {
+			providers.set(capability, manifest.id);
+		}
+	}
+	return manifests.map((manifest) => {
+		const dependencies = new Set<string>();
+		for (const id of manifest.dependencies) {
+			if (ids.has(id) && id !== manifest.id) dependencies.add(id);
+		}
+		for (const capability of manifest.requires) {
+			const provider = providers.get(capability);
+			if (provider !== undefined && provider !== manifest.id) {
+				dependencies.add(provider);
+			}
+		}
+		return {
+			id: manifest.id,
+			version: manifest.version,
+			dependencies: [...dependencies].sort(),
+		};
+	});
+}
+
+export function dependentsOf(
+	modules: readonly ComposedModule[],
+	moduleId: string,
+): readonly string[] {
+	return modules
+		.filter((module) => module.dependencies.includes(moduleId))
+		.map((module) => module.id)
+		.sort();
+}
+
+/** The composed module ids that are active for a workspace, sorted. */
+export function activeModuleIds(
+	modules: readonly ComposedModule[],
+	inactive: ReadonlySet<string>,
+): readonly string[] {
+	return modules
+		.map((module) => module.id)
+		.filter((id) => isRequiredModule(id) || !inactive.has(id))
+		.sort();
+}

package/modules/system/src/index.ts

@@ -21,3 +21,16 @@ export {
 	TENANT_TIME_ZONE_KEY,
 	tenantTimeZone,
 } from './domain/time-zone.ts';
+export {
+	activeModuleIds,
+	composedModules,
+	dependentsOf,
+	isRequiredModule,
+	SYSTEM_MODULES_CAPABILITY,
+} from './domain/modules.ts';
+export type {
+	ComposedModule,
+	ManifestDependencies,
+	ModuleActivationChange,
+	ModuleActivationEntry,
+} from './domain/modules.ts';