@flowdular/sdk 0.3.1 → 0.3.2

package/modules/directory/spec/module.yaml

@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/documents/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/documents/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/exports/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/exports/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/import/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/import/spec/module.yaml

@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: documents.core

package/modules/metering/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/metering/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
   - id: reports.core

package/modules/notifications/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/notifications/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/reports/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/reports/spec/module.yaml

@@ -11,7 +11,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 provides:

package/modules/sandbox/module.json

@@ -13,7 +13,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/sandbox/spec/module.yaml

@@ -13,7 +13,7 @@ capabilities:
   - cli
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/search/module.json

@@ -14,7 +14,7 @@
 	"dependencies": [
 		{
 			"id": "system.core",
-			"range": "^0.7.0"
+			"range": "^0.8.0"
 		},
 		{
 			"id": "auth.core",

package/modules/search/spec/module.yaml

@@ -12,7 +12,7 @@ capabilities:
   - translations
 dependencies:
   - id: system.core
-    range: ^0.7.0
+    range: ^0.8.0
   - id: auth.core
     range: ^0.13.0
 tenancy: required

package/modules/system/migrations/0001_system_module_activations.down.sql

@@ -0,0 +1,2 @@
+DROP POLICY IF EXISTS system_module_activations_tenant_policy ON system_module_activations;
+DROP TABLE IF EXISTS system_module_activations;

package/modules/system/migrations/0001_system_module_activations.up.sql

@@ -0,0 +1,17 @@
+-- One row per module whose activation an owner changed for a workspace. A
+-- composed module without a row is active; the row keeps the last decision and
+-- who made it. The primary key is the only lookup: the snapshot reads every row
+-- of one tenant at once.
+CREATE TABLE IF NOT EXISTS system_module_activations (
+  tenant_id TEXT NOT NULL,
+  module_id TEXT NOT NULL CHECK (length(module_id) BETWEEN 1 AND 128),
+  active SMALLINT NOT NULL CHECK (active IN (0, 1)),
+  changed_by TEXT NOT NULL CHECK (length(changed_by) BETWEEN 1 AND 64),
+  changed_at BIGINT NOT NULL,
+  PRIMARY KEY (tenant_id, module_id)
+);
+ALTER TABLE system_module_activations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE system_module_activations FORCE ROW LEVEL SECURITY;
+CREATE POLICY system_module_activations_tenant_policy ON system_module_activations
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/system/module.json

@@ -3,14 +3,15 @@
 	"schemaVersion": 1,
 	"id": "system.core",
 	"package": "@flowdular/module-system",
-	"version": "0.7.3",
+	"version": "0.8.0",
 	"profile": "full",
-	"capabilities": ["api", "client", "translations"],
+	"capabilities": ["api", "database", "client", "translations"],
 	"platform": {
 		"server": true,
 		"client": true
 	},
 	"dependencies": [],
+	"provides": ["system.modules.v1"],
 	"tenancy": "required",
 	"locales": ["en", "pl"],
 	"stability": "experimental",

package/modules/system/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@flowdular/module-system",
-	"version": "0.7.3",
+	"version": "0.8.0",
 	"type": "module",
 	"exports": {
 		".": "./src/index.ts",
@@ -16,6 +16,7 @@
 	"dependencies": {
 		"@flowdular/client": "workspace:*",
 		"@flowdular/contracts": "workspace:*",
+		"@flowdular/database": "workspace:*",
 		"@flowdular/kernel": "workspace:*",
 		"@flowdular/module-auth": "workspace:*",
 		"@flowdular/server": "workspace:*",
@@ -26,7 +27,6 @@
 		"yaml": "2.9.0"
 	},
 	"devDependencies": {
-		"@flowdular/database": "workspace:*",
 		"@flowdular/database-testing": "workspace:*",
 		"@tsrx/typescript-plugin": "0.3.120",
 		"@types/node": "24.13.3",

package/modules/system/spec/module.yaml

@@ -1,12 +1,13 @@
 schemaVersion: 2
 id: system.core
-specVersion: 0.7.3
+specVersion: 0.8.0
 status: approved
 name: System Core
 description: Provides the application shell, platform health, module discovery, and the administration surface for module settings.
 profile: full
 capabilities:
   - api
+  - database
   - client
   - translations
 dependencies: []
@@ -26,6 +27,10 @@ invariants:
   - Module settings are declared by their owning module, stored per tenant by auth.core, and changed only through the settings administration API served by system.core, with an audit record.
   - system.core declares the workspace time zone as a shared tenant setting, system.core.timeZone, defaulting to UTC. Only a name the runtime zone database resolves is stored, in its canonical IANA spelling, and any module that declares a dependency on system.core reads it live through the settings runtime; a value this deployment cannot resolve reads back as UTC instead of failing the reader.
   - A feature flag is a module setting declared with kind flag, which is a non-secret boolean with a declared default, a label, a description, and tenant scope, the only scope a flag may take. It is stored, read, validated and overridden exactly like any other setting, so a module reads it on the request path through the settings runtime at no cost beyond the settings read itself; system.core adds no flag store, no flag endpoint and no second write path.
+  - The composed module set is CLI-owned and baked at build; a module cannot be added to a running application from the UI. system.core owns per-workspace activation of the modules the application already composes, stored in the tenant table system_module_activations under forced row-level security. A composed module without a row is active.
+  - system.core, auth.core, users.core and profile.core are required and always active. A module that another active module declares as a dependency, through a declared module dependency or a required public capability, cannot be deactivated; the refusal names the active dependents. A module cannot be activated while one of its dependencies is inactive.
+  - Every activation change appends one audit event, system.module.activated or system.module.deactivated, to the auth.core trail with the module id and the actor. Repeating the current state changes nothing and writes no event.
+  - Activation is enforced in three places from one per-workspace snapshot published as the public capability system.modules.v1 and memoised for at most thirty seconds per tenant, refreshed at once by a change made through this instance. defineEndpoint answers 403 MODULE_INACTIVE for an endpoint of an inactive module in the principal's workspace, required modules exempt; the application shell hides the navigation, views, widgets and command palette entries of inactive modules; the endpoint gate never reads a tenant id from the request.
 permissions:
   - id: system.workspace.access
     description: Open the authenticated ERP workspace.
@@ -44,6 +49,28 @@ dataOwnership:
   - Feature modules own their navigation metadata and screen implementations.
   - Module settings values are stored by auth.core on behalf of the declaring module; system.core owns the settings API, the per-module settings section of the Modules drawer, the Flags screen, and the settings permissions.
   - A feature flag is owned by the module that declares it; system.core only lists and edits it, and auth.core records the change.
+  - system.core owns the per-workspace module activation rows and the system.modules.v1 capability; the composed module set stays owned by the CLI and flowdular.json.
+entities:
+  - id: module-activation
+    name: Module activation
+    description: The last activation decision an owner made for one composed module in one workspace.
+    fields:
+      - id: moduleId
+        type: string
+        required: true
+        unique: tenant
+        maxLength: 128
+      - id: active
+        type: boolean
+        required: true
+      - id: changedBy
+        type: string
+        required: true
+        maxLength: 64
+        description: Account id of the owner who made the change.
+      - id: changedAt
+        type: datetime
+        required: true
 acceptanceScenarios:
   - id: SYSTEM-MULTI-VIEW-MODULE
     given: An enabled module contributes multiple valid navigation entries and matching views.
@@ -117,15 +144,85 @@ acceptanceScenarios:
     given: Enabled modules declare feature flags and a principal with system.settings.read opens the Flags screen in Administration > Modules.
     when: The principal reads the flags and a principal with system.settings.manage turns one on for this workspace, then resets it.
     then: Every declared flag is listed grouped by its owning module with its current value and a link to the audit trail; the override applies to that workspace alone and takes effect on the next settings read; a reset restores the declared default; each change appends one settings.flag.changed audit event carrying the module, the key, the previous and next values and the actor; and a principal without system.settings.manage is refused with 401 or 403 and changes nothing.
+  - id: SYSTEM-MODULE-ACTIVATE
+    given: An owner with system.settings.manage opens Administration > Modules, where every composed module is listed with its version, activation state and dependents and is active by default.
+    when: The owner deactivates an optional module, confirms the dialog, and later activates it again.
+    then: The module is inactive for that workspace alone and active again after the second change; each change is stored with the actor and appends one system.module.deactivated or system.module.activated audit event; a member without system.settings.manage sees the row action refused with a reason, and a request without a browser session, without the scope or without a CSRF token is refused with 401 or 403 and changes nothing.
+  - id: SYSTEM-MODULE-DEACTIVATE-REFUSED-DEPENDENCY
+    given: An active module that another active module depends on, or a required module.
+    when: An owner attempts to deactivate it.
+    then: The server refuses with 409 MODULE_HAS_ACTIVE_DEPENDENTS naming the active dependents, or 409 MODULE_REQUIRED, the screen shows the reason, nothing is stored and no audit event is written; once the dependents are inactive the deactivation is accepted, and activating a module whose dependency is inactive is refused with 409 MODULE_DEPENDENCY_INACTIVE.
+  - id: SYSTEM-MODULE-INACTIVE-ENDPOINT
+    given: A module an owner deactivated for the workspace.
+    when: A principal of that workspace calls any endpoint the module defines, or a principal of another workspace calls the same endpoint.
+    then: The first request is refused with 403 MODULE_INACTIVE after the permission check, the second is served, and an endpoint of system.core, auth.core, users.core or profile.core is never gated.
+  - id: SYSTEM-MODULE-INACTIVE-NAVIGATION
+    given: A module an owner deactivated for the workspace.
+    when: A member of that workspace opens the application shell.
+    then: The shell reads the active module ids through GET /api/system/modules/active, hides the module's navigation entries, views, workspace widgets and command palette search, returns a bookmark of one of its views to the dashboard, and shows every module when the read fails.
 screens:
   - id: flags
     kind: list
     title: Flags
     navigationGroup: Administration
+  - id: modules
+    kind: list
+    entity: module-activation
+    title: Modules
+    navigationGroup: Administration
+    columns:
+      - moduleId
+      - active
 actions:
+  - id: activate-module
+    entity: module-activation
+    permission: system.settings.manage
+    kind: update
+    risk: workspace-write
+    idempotent: true
+    description: Activate a composed optional module for this workspace after its dependencies are active.
+  - id: deactivate-module
+    entity: module-activation
+    permission: system.settings.manage
+    kind: update
+    risk: workspace-write
+    idempotent: true
+    description: Deactivate a composed optional module for this workspace unless a required module or an active dependent needs it.
   - id: set-flag
     permission: system.settings.manage
     kind: update
     risk: workspace-write
     idempotent: true
     description: Turn a declared feature flag on or off for this workspace, or clear the override so the module default applies again.
+decisions:
+  - id: D-MODULE-ACTIVATION-SCOPE
+    question: What can the administration UI change about modules?
+    answer: Per-workspace activation of the modules the application already composes; adding or removing a module stays a CLI operation because the composition is baked at build.
+    decidedBy: user
+  - id: D-MODULE-ACTIVATION-REQUIRED
+    question: Which modules can never be deactivated?
+    answer: system.core, auth.core, users.core and profile.core, and any module another active module depends on through a declared module dependency or a required public capability; the refusal names the active dependents.
+    decidedBy: user
+  - id: D-MODULE-ACTIVATION-DEFAULT
+    question: What is the state of a module nobody has touched?
+    answer: Active; the table holds only decisions an owner made, and a row is written for the module being changed, never for the whole set.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-SNAPSHOT
+    question: How often is the activation read?
+    answer: Once per tenant into a memoised snapshot held for thirty seconds and at most 1024 tenants per process, invalidated at once by a change through the same instance; another instance sees the change within the snapshot lifetime.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-AUDIT
+    question: Where is a change recorded?
+    answer: One system.module.activated or system.module.deactivated event in the auth.core audit trail, carrying the module id, the resulting state and the actor; a no-op repeat writes nothing.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-SHELL
+    question: How does the shell learn which modules are active?
+    answer: From GET /api/system/modules/active, served to every member holding system.workspace.access, read once per workspace before the shell renders; a failed read shows every module because the server gate still refuses an inactive module's API.
+    decidedBy: default
+  - id: D-MODULE-ACTIVATION-AGENT-TOOLS
+    question: Are the agent tools of an inactive module withheld?
+    answer: Not yet. The harness tool registry has no per-tenant module hook and a tool carries no module id, so this is a documented follow-up; a tool of an inactive module that calls the module's service still runs.
+    decidedBy: default
+outOfScope:
+  - Adding or removing a module from a running application through the UI; the composition is CLI-owned and baked at build.
+  - Withholding the agent tools of an inactive module from a workspace, which needs a per-tenant hook in the harness tool registry.

package/modules/system/src/client/ModulesView.tsrx

@@ -2,6 +2,7 @@ import { useEffect, useMemo } from 'octane';
 import {
 	Alert,
 	Button,
+	ConfirmDialog,
 	Drawer,
 	EmptyState,
 	Icon,
@@ -14,11 +15,21 @@ import {
 } from '@flowdular/sdk/ui';
 import { activeLocale, t } from '@flowdular/sdk/client';
 import { useValue } from 'segment-state';
-import { ApiError, loadModuleCatalog, type ModuleCatalogEntry } from './api.ts';
+import {
+	ApiError,
+	loadModuleCatalog,
+	setModuleActivation,
+	type ModuleCatalogEntry,
+} from './api.ts';
 import { FlagsPanel } from './FlagsPanel.tsrx';
-import { moduleColumns, surfaces } from './module-columns.tsrx';
+import {
+	activationLabel,
+	activationTone,
+	moduleColumns,
+	surfaces,
+} from './module-columns.tsrx';
 import { ModuleSettingsSection } from './ModuleSettingsSection.tsrx';
-import { createModulesClientState } from './state.ts';
+import { activationRefusal, createModulesClientState } from './state.ts';
 
 const TABS_ID = 'system-modules';
 
@@ -38,6 +49,11 @@ export function ModulesView(props: ModulesViewProps) @{
 		client.state.selectedModuleId,
 	);
 	const [tab, setTab] = useValue(client.state.tab);
+	const [pending, setPending] = useValue(client.state.pending);
+	const [busyModuleId, setBusyModuleId] = useValue(client.state.busyModuleId);
+	const [activationError, setActivationError] = useValue(
+		client.state.activationError,
+	);
 	const selected =
 		modules.find((module) => module.id === selectedModuleId) ?? null;
 	const term = query.trim().toLocaleLowerCase(activeLocale());
@@ -50,6 +66,9 @@ export function ModulesView(props: ModulesViewProps) @{
 							module.name.toLocaleLowerCase(activeLocale()).includes(term),
 				);
 	const enabled = modules.filter((module) => module.enabled);
+	const active = enabled.filter((module) => module.active);
+	const pendingModule =
+		modules.find((module) => module.id === pending?.moduleId) ?? null;
 
 	const refresh = async () => {
 		setStatus('loading');
@@ -76,6 +95,33 @@ export function ModulesView(props: ModulesViewProps) @{
 		void refresh();
 	}, []);
 
+	/* The server is the authority on dependencies: a refusal it answers is
+   shown with the modules it named, and the catalog is read again so the
+   table never shows a state the workspace no longer has. */
+	const confirmActivation = async () => {
+		if (!pending) return;
+		setBusyModuleId(pending.moduleId);
+		setActivationError('');
+		try {
+			await setModuleActivation(
+				pending.moduleId,
+				pending.active,
+				props.csrfToken,
+			);
+			setPending(null);
+			await refresh();
+		} catch (changeError) {
+			setPending(null);
+			setActivationError(
+				changeError instanceof Error
+					? changeError.message
+					: t('system.error.activation'),
+			);
+		} finally {
+			setBusyModuleId(null);
+		}
+	};
+
 	<div class="ui-view">
 		<PageHeader
 			eyebrow={t('system.page.eyebrow')}
@@ -118,9 +164,13 @@ export function ModulesView(props: ModulesViewProps) @{
 					@if (status === 'error') {
 						<Alert>{error}</Alert>
 					}
+					@if (activationError !== '') {
+						<Alert>{activationError}</Alert>
+					}
 					<TableCard
 						title={t('system.table.title')}
 						count={t('system.table.count', {
+							active: active.length,
 							enabled: enabled.length,
 							total: modules.length,
 						})}
@@ -158,6 +208,23 @@ export function ModulesView(props: ModulesViewProps) @{
 								icon: 'external',
 								onSelect: () => setSelectedModuleId(module.id),
 							},
+							{
+								id: 'activation',
+								label: module.enabled && module.active
+									? t('system.action.deactivate')
+									: t('system.action.activate'),
+								icon: module.enabled && module.active ? 'x' : 'play',
+								tone: module.enabled && module.active ? 'danger' : 'default',
+								disabled: busyModuleId !== null ||
+									activationRefusal(module, props.canManageSettings, t) !==
+										null,
+								reason: activationRefusal(module, props.canManageSettings, t) ??
+									undefined,
+								onSelect: () => setPending({
+									moduleId: module.id,
+									active: !module.active,
+								}),
+							},
 						]}
 						noteIcon="code"
 						note={<>
@@ -173,6 +240,28 @@ export function ModulesView(props: ModulesViewProps) @{
 				</>
 			}
 		</div>
+		<ConfirmDialog
+			open={pending !== null}
+			title={pending?.active
+				? t('system.activation.confirmActivateTitle', {
+						module: pendingModule?.name ?? pending.moduleId,
+					})
+				: t('system.activation.confirmDeactivateTitle', {
+						module: pendingModule?.name ?? pending?.moduleId ?? '',
+					})}
+			confirmLabel={pending?.active
+				? t('system.action.activate')
+				: t('system.action.deactivate')}
+			cancelLabel={t('system.action.cancel')}
+			tone={pending?.active ? 'primary' : 'danger'}
+			busy={busyModuleId !== null}
+			onConfirm={() => void confirmActivation()}
+			onCancel={() => setPending(null)}
+		>
+			{pending?.active
+				? t('system.activation.confirmActivate')
+				: t('system.activation.confirmDeactivate')}
+		</ConfirmDialog>
 		<Drawer
 			open={tab === 'catalog' && selected !== null}
 			title={selected?.name ?? t('system.drawer.module')}
@@ -224,11 +313,9 @@ function ModuleDetail(props: {
 					</span>
 					<span class="ui-cell">
 						<small>{t('system.table.status')}</small>
-						<Tag tone={props.module.enabled ? 'success' : 'neutral'} dot>
-							{props.module.enabled
-								? t('system.status.enabled')
-								: t('system.status.available')}
-						</Tag>
+						<Tag tone={activationTone(props.module)} dot>{activationLabel(
+							props.module,
+						)}</Tag>
 					</span>
 				</div>
 				<span class="ui-cell">
@@ -241,6 +328,12 @@ function ModuleDetail(props: {
 					<small>{t('system.detail.directory')}</small>
 					<span class="ui-mono">{props.module.directory}</span>
 				</span>
+				<span class="ui-cell">
+					<small>{t('system.table.dependents')}</small>
+					<span class="ui-mono">
+						{props.module.dependents.join(', ') || t('system.value.none')}
+					</span>
+				</span>
 			</div>
 			<div class="ui-form__section">
 				<div class="ui-form__section-head">

package/modules/system/src/client/api.ts

@@ -1,7 +1,8 @@
-import type { ModuleCatalogEntry } from '../server/module-catalog.ts';
+import type { ModuleCatalogPayload } from '../server/endpoints.ts';
+import type { ModuleActivationEntry } from '../domain/modules.ts';
 import { t } from '@flowdular/sdk/client/i18n';
 
-export type { ModuleCatalogEntry };
+export type ModuleCatalogEntry = ModuleCatalogPayload;
 
 export interface ModuleCatalog {
 	readonly modules: readonly ModuleCatalogEntry[];
@@ -10,27 +11,67 @@ export interface ModuleCatalog {
 
 export class ApiError extends Error {
 	readonly status: number;
+	/** The modules a refusal names, when the server named any. */
+	readonly modules: readonly string[];
 
-	constructor(status: number, message: string) {
+	constructor(
+		status: number,
+		message: string,
+		modules: readonly string[] = [],
+	) {
 		super(message);
 		this.name = 'ApiError';
 		this.status = status;
+		this.modules = modules;
 	}
 }
 
-export async function loadModuleCatalog(): Promise<ModuleCatalog> {
-	const response = await fetch('/api/system/modules', {
-		headers: { accept: 'application/json' },
-		credentials: 'same-origin',
-	});
-	const value = (await response.json()) as ModuleCatalog & {
-		readonly error?: { readonly message?: string };
+async function payload<T>(response: Response, fallback: string): Promise<T> {
+	const value = (await response.json()) as T & {
+		readonly error?: {
+			readonly message?: string;
+			readonly modules?: readonly string[];
+		};
 	};
 	if (!response.ok) {
 		throw new ApiError(
 			response.status,
-			value.error?.message ?? t('system.error.catalog'),
+			value.error?.message ?? fallback,
+			value.error?.modules ?? [],
 		);
 	}
 	return value;
 }
+
+export async function loadModuleCatalog(): Promise<ModuleCatalog> {
+	const response = await fetch('/api/system/modules', {
+		headers: { accept: 'application/json' },
+		credentials: 'same-origin',
+	});
+	return payload<ModuleCatalog>(response, t('system.error.catalog'));
+}
+
+export async function setModuleActivation(
+	moduleId: string,
+	active: boolean,
+	csrfToken: string,
+): Promise<ModuleActivationEntry> {
+	const response = await fetch(
+		active ? '/api/system/modules/activate' : '/api/system/modules/deactivate',
+		{
+			method: 'POST',
+			headers: {
+				'content-type': 'application/json',
+				'x-csrf-token': csrfToken,
+			},
+			credentials: 'same-origin',
+			body: JSON.stringify({ moduleId }),
+		},
+	);
+	return (
+		await payload<{ readonly module: ModuleActivationEntry }>(
+			response,
+			t('system.error.activation'),
+		)
+	).module;
+}