@freema/drobek-modules 0.3.3 → 0.5.0

package/dist/{chunk-WHKPW5MP.js → chunk-B7PEIWK7.js}

@@ -78,6 +78,7 @@ var CORE_ERROR_CODES = [
   "user_confirmation_required",
   "gallery_hidden",
   "gallery_disabled",
+  "not_duplicable",
   "publish_not_approved",
   "publish_blocked",
   // app assets (MCP asset tools, the upload URL)
@@ -95,6 +96,8 @@ var CORE_ERROR_CODES = [
   "domain_taken",
   "domain_not_verified",
   "dns_unavailable",
+  // proxy upstreams (MCP upstream tools)
+  "upstream_already_registered",
   // compile.errors[]
   "build_error",
   "unresolved_import",
@@ -221,6 +224,8 @@ __export(schema_exports, {
   blobs: () => blobs,
   compileStatusEnum: () => compileStatusEnum,
   domains: () => domains,
+  galleryLikes: () => galleryLikes,
+  galleryOpens: () => galleryOpens,
   membershipRoleEnum: () => membershipRoleEnum,
   memberships: () => memberships,
   moduleConfigs: () => moduleConfigs,
@@ -340,9 +345,16 @@ var apps = pgTable("apps", {
   /** NSO-340: the gallery's one-line public description (plain text, ≤ 160 chars). */
   galleryDescription: text("gallery_description"),
   /** NSO-340: a super-admin hid the gallery entry (non-null = hidden, whatever the owner sets). */
-  galleryHiddenAt: timestamp("gallery_hidden_at")
+  galleryHiddenAt: timestamp("gallery_hidden_at"),
+  /** NSO-340: the owner lets signed-in people duplicate the listed app into their own workspace. */
+  galleryAllowDuplicate: boolean("gallery_allow_duplicate").notNull().default(false),
+  /** NSO-340: the gallery app this one was duplicated from (null when the source is gone or none). */
+  duplicatedFromAppId: text("duplicated_from_app_id").references(() => apps.id, { onDelete: "set null" }),
+  /** The source's slug at duplication time, kept when the source is deleted. */
+  duplicatedFromSlug: text("duplicated_from_slug")
 }, (t) => [
   uniqueIndex("apps_slug_uq").on(t.slug),
+  index("apps_duplicated_from_idx").on(t.duplicatedFromAppId).where(sql`${t.duplicatedFromAppId} IS NOT NULL`),
   // The public gallery page reads listed apps newest-published first (NSO-340).
   index("apps_gallery_idx").on(t.publishedAt.desc(), t.slug.desc()).where(sql`${t.galleryListed}`),
   index("apps_workspace_idx").on(t.workspaceId),
@@ -352,6 +364,16 @@ var apps = pgTable("apps", {
   // words). A deleted app may carry its released-slug tombstone instead (0016).
   check("apps_slug_format", sql`(${t.slug} ~ '^[a-z0-9]+(-[a-z0-9]+)*$' AND char_length(${t.slug}) BETWEEN 3 AND 40) OR (${t.deletedAt} IS NOT NULL AND ${t.slug} ~ '^[a-z0-9]+(-[a-z0-9]+)*~deleted-[a-z0-9]+$')`)
 ]);
+var galleryLikes = pgTable("gallery_likes", {
+  appId: text("app_id").notNull().references(() => apps.id, { onDelete: "cascade" }),
+  userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+  createdAt: timestamp("created_at").notNull().defaultNow()
+}, (t) => [primaryKey({ columns: [t.appId, t.userId] })]);
+var galleryOpens = pgTable("gallery_opens", {
+  appId: text("app_id").notNull().references(() => apps.id, { onDelete: "cascade" }),
+  day: text("day").notNull(),
+  count: integer("count").notNull().default(0)
+}, (t) => [primaryKey({ columns: [t.appId, t.day] })]);
 var blobs = pgTable("blobs", {
   sha256: text("sha256").primaryKey(),
   bytes: bytea("bytes").notNull(),
@@ -695,16 +717,16 @@ async function runJournalMigrations(opts) {
   const databaseUrl = opts.databaseUrl ?? process.env.DATABASE_URL;
   if (!databaseUrl)
     throw new Error("DATABASE_URL is required");
-  const sql15 = postgres2(databaseUrl, { max: 1, connect_timeout: 10, onnotice: () => {
+  const sql17 = postgres2(databaseUrl, { max: 1, connect_timeout: 10, onnotice: () => {
   } });
   try {
-    await migrate(drizzle2(sql15), {
+    await migrate(drizzle2(sql17), {
       migrationsFolder: opts.migrationsFolder,
       migrationsTable: opts.migrationsTable,
       migrationsSchema: "drizzle"
     });
   } finally {
-    await sql15.end({ timeout: 5 });
+    await sql17.end({ timeout: 5 });
   }
 }
 
@@ -921,12 +943,12 @@ function looksLikeSvg(head) {
     }
     if (!doctype && matchesAt(DOCTYPE_SVG_RE, head, i)) {
       doctype = true;
-      const gt = head.indexOf(">", i);
+      const gt2 = head.indexOf(">", i);
       const bracket = head.indexOf("[", i);
-      if (gt < 0)
+      if (gt2 < 0)
         return false;
-      if (bracket < 0 || gt < bracket) {
-        i = gt + 1;
+      if (bracket < 0 || gt2 < bracket) {
+        i = gt2 + 1;
         continue;
       }
       const close = head.indexOf("]", bracket + 1);
@@ -952,6 +974,20 @@ function hasControlBytes(chunk) {
   return false;
 }
 
+// packages/core/dist/cookies.js
+function readCookieValue(header, name) {
+  if (!header)
+    return null;
+  for (const part of header.split(";")) {
+    const eq22 = part.indexOf("=");
+    if (eq22 === -1)
+      continue;
+    if (part.slice(0, eq22).trim() === name)
+      return part.slice(eq22 + 1).trim();
+  }
+  return null;
+}
+
 // packages/core/dist/redis.js
 import { Redis } from "ioredis";
 var client = null;
@@ -1182,6 +1218,10 @@ var AUDIT_ACTIONS = {
   appGalleryHidden: "app.gallery_hidden",
   /** NSO-340: a super-admin showed a hidden gallery entry again. */
   appGalleryUnhidden: "app.gallery_unhidden",
+  /** NSO-340: this app was created as a copy of a gallery app (meta: from = the source slug, version). */
+  appDuplicate: "app.duplicate",
+  /** NSO-340: someone duplicated this gallery app into their own workspace (no details about them). */
+  appDuplicated: "app.duplicated",
   /** NSO-346: a super-admin enabled an opt-in platform module for the workspace (meta: module). */
   moduleWorkspaceEnable: "module.workspace_enable",
   /** NSO-346: a super-admin disabled an opt-in platform module for the workspace (meta: module). */
@@ -1228,7 +1268,7 @@ async function writeAudit(entry, executor) {
 }
 
 // packages/audit/dist/read.server.js
-import { and, desc, eq, lt, or } from "drizzle-orm";
+import { and, desc, eq, gte, lt, or } from "drizzle-orm";
 
 // packages/audit/dist/retention.server.js
 import { lt as lt2 } from "drizzle-orm";
@@ -1253,7 +1293,7 @@ var DEFAULT_APPS_MAX_PER_WORKSPACE = 50;
 
 // packages/apps/dist/versions.server.js
 import { createHash as createHash3 } from "node:crypto";
-import { and as and8, desc as desc5, eq as eq8, gte, inArray as inArray4, sql as sql5 } from "drizzle-orm";
+import { and as and8, desc as desc5, eq as eq8, gte as gte2, inArray as inArray4, sql as sql5 } from "drizzle-orm";
 
 // packages/compile/dist/compiler.js
 import { mkdtempSync } from "node:fs";
@@ -1925,7 +1965,8 @@ var reportedAppColumns = {
   name: apps.name,
   workspaceId: apps.workspaceId,
   workspaceSlug: workspaces.slug,
-  lockedReason: apps.lockedReason
+  lockedReason: apps.lockedReason,
+  published: sql2`(${apps.publishedVersionId} IS NOT NULL)`.mapWith(Boolean)
 };
 var SCAN_MAX_FILE = 1024 * 1024;
 var SCAN_MAX_TOTAL = 4 * 1024 * 1024;
@@ -2373,7 +2414,27 @@ var CONTROL_RE = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029]+", "
 
 // packages/apps/dist/gallery.server.js
 import { and as and12, asc as asc3, desc as desc6, eq as eq12, isNotNull as isNotNull7, isNull as isNull5, sql as sql8 } from "drizzle-orm";
-var itemColumns = { slug: apps.slug, name: apps.name, description: apps.galleryDescription, publishedAt: apps.publishedAt };
+var baseColumns = {
+  slug: apps.slug,
+  name: apps.name,
+  description: apps.galleryDescription,
+  publishedAt: apps.publishedAt,
+  // Names only, from the current saved configuration. A correlated aggregate
+  // keeps pagination/counts intact and avoids a query per card. No extension
+  // or module runtime dependency is needed by this public core API.
+  modules: sql8`(select coalesce(jsonb_agg(${moduleConfigs.module} order by ${moduleConfigs.module}), '[]'::jsonb)
+    from ${moduleConfigs} where ${moduleConfigs.appId} = ${apps.id}
+    and jsonb_typeof(${moduleConfigs.config}) = 'object' and ${moduleConfigs.config} <> '{}'::jsonb)`,
+  duplicable: apps.galleryAllowDuplicate,
+  // Live copies; the alias keeps the outer "apps" row in reach of the subquery.
+  duplicates: sql8`(select count(*)::int from "apps" as "copies" where "copies"."duplicated_from_app_id" = "apps"."id" and "copies"."deleted_at" is null)`
+};
+
+// packages/apps/dist/duplicate.server.js
+import { and as and13, count as count2, eq as eq13, gt, isNull as isNull6, sql as sql9 } from "drizzle-orm";
+
+// packages/apps/dist/gallery-engagement.server.js
+import { and as and14, eq as eq14, gte as gte3, sql as sql10 } from "drizzle-orm";
 
 // packages/modules/dist/limits.js
 var LIMITS_CACHE_TTL_SEC = 60;
@@ -2570,20 +2631,8 @@ function endUserEpochKey(appId) {
 }
 var SESSION_PROVIDER_RE = /^[a-z][a-z0-9]{1,15}$/;
 var SESSION_CONNECTION_RE = /^[A-Za-z0-9_-]{16,64}$/;
-function readCookie(header, name) {
-  if (!header)
-    return null;
-  for (const part of header.split(";")) {
-    const eq20 = part.indexOf("=");
-    if (eq20 === -1)
-      continue;
-    if (part.slice(0, eq20).trim() === name)
-      return part.slice(eq20 + 1).trim();
-  }
-  return null;
-}
 function readEndUserToken(cookieHeader, secure) {
-  const token = readCookie(cookieHeader, endUserCookieName(secure));
+  const token = readCookieValue(cookieHeader, endUserCookieName(secure));
   return token && END_USER_TOKEN_RE.test(token) ? token : null;
 }
 function parseEndUserSession(raw) {
@@ -2684,7 +2733,7 @@ function cookiePrincipalResolver(opts) {
 }
 
 // packages/modules/dist/secrets.server.js
-import { and as and14, eq as eq14, inArray as inArray7 } from "drizzle-orm";
+import { and as and16, eq as eq16, inArray as inArray7 } from "drizzle-orm";
 
 // packages/proxy/dist/errors.js
 var ProxyError = class extends Error {
@@ -2810,7 +2859,7 @@ import https from "node:https";
 var DEFAULT_MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 
 // packages/proxy/dist/upstreams.server.js
-import { and as and13, eq as eq13, inArray as inArray6, sql as sql9 } from "drizzle-orm";
+import { and as and15, eq as eq15, inArray as inArray6, sql as sql11 } from "drizzle-orm";
 
 // packages/proxy/dist/forward.server.js
 import { promisify } from "node:util";
@@ -2884,11 +2933,11 @@ async function setModuleSecret(input) {
   });
 }
 async function deleteModuleSecret(appId, module, name) {
-  const rows = await getDb().delete(moduleSecrets).where(and14(eq14(moduleSecrets.appId, appId), eq14(moduleSecrets.module, module), eq14(moduleSecrets.name, name))).returning({ name: moduleSecrets.name });
+  const rows = await getDb().delete(moduleSecrets).where(and16(eq16(moduleSecrets.appId, appId), eq16(moduleSecrets.module, module), eq16(moduleSecrets.name, name))).returning({ name: moduleSecrets.name });
   return rows.length > 0;
 }
 async function getModuleSecret(appId, module, name, env) {
-  const [row] = await getDb().select().from(moduleSecrets).where(and14(eq14(moduleSecrets.appId, appId), eq14(moduleSecrets.module, module), eq14(moduleSecrets.name, name))).limit(1);
+  const [row] = await getDb().select().from(moduleSecrets).where(and16(eq16(moduleSecrets.appId, appId), eq16(moduleSecrets.module, module), eq16(moduleSecrets.name, name))).limit(1);
   if (!row)
     return null;
   return decryptSecret({ ciphertext: row.ciphertext, iv: row.iv, authTag: row.authTag, wrappedDek: row.wrappedDek, kekId: row.kekId }, env);
@@ -2896,18 +2945,18 @@ async function getModuleSecret(appId, module, name, env) {
 async function secretsStatus(appId, module, names) {
   if (names.length === 0)
     return /* @__PURE__ */ new Map();
-  const rows = await getDb().select({ name: moduleSecrets.name, updatedAt: moduleSecrets.updatedAt }).from(moduleSecrets).where(and14(eq14(moduleSecrets.appId, appId), eq14(moduleSecrets.module, module), inArray7(moduleSecrets.name, names)));
+  const rows = await getDb().select({ name: moduleSecrets.name, updatedAt: moduleSecrets.updatedAt }).from(moduleSecrets).where(and16(eq16(moduleSecrets.appId, appId), eq16(moduleSecrets.module, module), inArray7(moduleSecrets.name, names)));
   return new Map(rows.map((r) => [r.name, r.updatedAt]));
 }
 async function secretsSet(appId, module, names) {
   if (names.length === 0)
     return /* @__PURE__ */ new Set();
-  const rows = await getDb().select({ name: moduleSecrets.name }).from(moduleSecrets).where(and14(eq14(moduleSecrets.appId, appId), eq14(moduleSecrets.module, module), inArray7(moduleSecrets.name, names)));
+  const rows = await getDb().select({ name: moduleSecrets.name }).from(moduleSecrets).where(and16(eq16(moduleSecrets.appId, appId), eq16(moduleSecrets.module, module), inArray7(moduleSecrets.name, names)));
   return new Set(rows.map((r) => r.name));
 }
 
 // packages/modules/dist/configs.server.js
-import { and as and15, eq as eq15, inArray as inArray8 } from "drizzle-orm";
+import { and as and17, eq as eq17, inArray as inArray8 } from "drizzle-orm";
 function asObject2(v) {
   return v && typeof v === "object" && !Array.isArray(v) ? v : {};
 }
@@ -2924,7 +2973,7 @@ function asPending(v) {
   };
 }
 async function readConfigRow(appId, module, executor = getDb()) {
-  const [row] = await executor.select().from(moduleConfigs).where(and15(eq15(moduleConfigs.appId, appId), eq15(moduleConfigs.module, module))).limit(1);
+  const [row] = await executor.select().from(moduleConfigs).where(and17(eq17(moduleConfigs.appId, appId), eq17(moduleConfigs.module, module))).limit(1);
   if (!row)
     return { config: {}, pending: null, updatedAt: null };
   return { config: asObject2(row.config), pending: asPending(row.pending), updatedAt: row.updatedAt };
@@ -2933,7 +2982,7 @@ async function readConfigRows(appId, modules) {
   const out = /* @__PURE__ */ new Map();
   if (modules.length === 0)
     return out;
-  const rows = await getDb().select().from(moduleConfigs).where(and15(eq15(moduleConfigs.appId, appId), inArray8(moduleConfigs.module, modules)));
+  const rows = await getDb().select().from(moduleConfigs).where(and17(eq17(moduleConfigs.appId, appId), inArray8(moduleConfigs.module, modules)));
   for (const r of rows) {
     out.set(r.module, { config: asObject2(r.config), pending: asPending(r.pending), updatedAt: r.updatedAt });
   }
@@ -2942,7 +2991,7 @@ async function readConfigRows(appId, modules) {
 async function withLockedConfig(appId, module, fn) {
   return getDb().transaction(async (tx) => {
     await tx.insert(moduleConfigs).values({ appId, module }).onConflictDoNothing();
-    const [row] = await tx.select().from(moduleConfigs).where(and15(eq15(moduleConfigs.appId, appId), eq15(moduleConfigs.module, module))).for("update");
+    const [row] = await tx.select().from(moduleConfigs).where(and17(eq17(moduleConfigs.appId, appId), eq17(moduleConfigs.module, module))).for("update");
     const current = {
       config: asObject2(row?.config),
       pending: asPending(row?.pending),
@@ -2954,7 +3003,7 @@ async function withLockedConfig(appId, module, fn) {
         set.config = next.config;
       if (next.pending !== void 0)
         set.pending = next.pending;
-      await tx.update(moduleConfigs).set(set).where(and15(eq15(moduleConfigs.appId, appId), eq15(moduleConfigs.module, module)));
+      await tx.update(moduleConfigs).set(set).where(and17(eq17(moduleConfigs.appId, appId), eq17(moduleConfigs.module, module)));
     };
     return fn(current, write, tx);
   });
@@ -3415,7 +3464,7 @@ function redisMailGuard(opts) {
     const ttl = await r.pttl(key);
     return ttl > 0 ? ttl / 1e3 : fallbackSec;
   };
-  const count2 = async (r, key, n) => {
+  const count3 = async (r, key, n) => {
     const c = await r.incrby(key, n);
     if (c === n || await r.pttl(key) < 0)
       await r.pexpire(key, HOUR_MS2);
@@ -3478,7 +3527,7 @@ function redisMailGuard(opts) {
         if (!refusal) {
           const key = mailAppCounterKey(meta.app_id, cls);
           const share = appShareOf(budgets, cls);
-          const used = await count2(r, key, recipients);
+          const used = await count3(r, key, recipients);
           if (used > share) {
             if (used - recipients <= share) {
               log.warn(`module e-mail: an app used its hourly share of ${cls === "sign_in" ? "sign-in codes" : "notifications"}`, {
@@ -3494,7 +3543,7 @@ function redisMailGuard(opts) {
         if (!refusal) {
           const key = mailWorkspaceCounterKey(meta.workspace_id, cls);
           const share = workspaceShareOf(budgets, cls);
-          const used = await count2(r, key, recipients);
+          const used = await count3(r, key, recipients);
           if (used > share) {
             if (used - recipients <= share) {
               log.warn(`module e-mail: a workspace used its hourly share of ${cls === "sign_in" ? "sign-in codes" : "notifications"}`, {
@@ -3508,7 +3557,7 @@ function redisMailGuard(opts) {
           }
         }
         if (!refusal) {
-          const used = await count2(r, MAIL_COUNTER_KEYS[cls], recipients);
+          const used = await count3(r, MAIL_COUNTER_KEYS[cls], recipients);
           if (used > budgets[cls]) {
             await r.set(MAIL_PAUSE_KEYS[cls], "1", "PX", pauseMs);
             await r.set(MAIL_COUNTER_KEYS[cls], "0", "PX", pauseMs);
@@ -4117,43 +4166,43 @@ function readModulesLock(modulesDir) {
 // packages/modules/dist/migration-lint.js
 import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
-function blank(sql15) {
-  const out = sql15.split("");
+function blank(sql17) {
+  const out = sql17.split("");
   const wipe = (from, to) => {
     for (let k = from; k < to; k++)
       if (out[k] !== "\n")
         out[k] = " ";
   };
   let i = 0;
-  while (i < sql15.length) {
-    const c = sql15[i];
-    if (c === "-" && sql15[i + 1] === "-") {
-      const end = sql15.indexOf("\n", i);
-      const stop = end === -1 ? sql15.length : end;
+  while (i < sql17.length) {
+    const c = sql17[i];
+    if (c === "-" && sql17[i + 1] === "-") {
+      const end = sql17.indexOf("\n", i);
+      const stop = end === -1 ? sql17.length : end;
       wipe(i, stop);
       i = stop;
-    } else if (c === "/" && sql15[i + 1] === "*") {
-      const end = sql15.indexOf("*/", i + 2);
-      const stop = end === -1 ? sql15.length : end + 2;
+    } else if (c === "/" && sql17[i + 1] === "*") {
+      const end = sql17.indexOf("*/", i + 2);
+      const stop = end === -1 ? sql17.length : end + 2;
       wipe(i, stop);
       i = stop;
     } else if (c === "'") {
       let j = i + 1;
-      while (j < sql15.length) {
-        if (sql15[j] === "'" && sql15[j + 1] === "'")
+      while (j < sql17.length) {
+        if (sql17[j] === "'" && sql17[j + 1] === "'")
           j += 2;
-        else if (sql15[j] === "'")
+        else if (sql17[j] === "'")
           break;
         else
           j++;
       }
-      wipe(i, Math.min(j + 1, sql15.length));
+      wipe(i, Math.min(j + 1, sql17.length));
       i = j + 1;
     } else if (c === '"') {
-      const end = sql15.indexOf('"', i + 1);
-      i = end === -1 ? sql15.length : end + 1;
+      const end = sql17.indexOf('"', i + 1);
+      i = end === -1 ? sql17.length : end + 1;
     } else if (c === "$") {
-      const tag = /^\$[A-Za-z_]*\$/.exec(sql15.slice(i));
+      const tag = /^\$[A-Za-z_]*\$/.exec(sql17.slice(i));
       if (tag) {
         wipe(i, i + tag[0].length);
         i += tag[0].length;
@@ -4173,8 +4222,8 @@ function splitName(raw) {
   const unq = (p) => p.startsWith('"') ? p.slice(1, -1).replace(/""/g, '"') : p.toLowerCase();
   return parts.length === 2 ? { schema: unq(parts[0]), name: unq(parts[1]) } : { schema: null, name: unq(parts[0] ?? "") };
 }
-function lintMigrationSql(name, sql15, file = "migration.sql") {
-  const text2 = blank(sql15);
+function lintMigrationSql(name, sql17, file = "migration.sql") {
+  const text2 = blank(sql17);
   const prefix = `mod_${name}`;
   const own = (raw) => {
     const { schema, name: n } = splitName(raw);
@@ -4993,20 +5042,20 @@ var LOGS_RETENTION_DAYS = 30;
 import { createHash as createHash8 } from "node:crypto";
 
 // packages/insights/dist/resolve.server.js
-import { and as and16, eq as eq16, isNull as isNull6 } from "drizzle-orm";
+import { and as and18, eq as eq18, isNull as isNull7 } from "drizzle-orm";
 
 // packages/insights/dist/signals.server.js
-import { sql as sql10 } from "drizzle-orm";
+import { sql as sql12 } from "drizzle-orm";
 var SIGNAL_TTL_SEC = (LOGS_RETENTION_DAYS + 1) * 24 * 60 * 60;
-function utcDay(d = /* @__PURE__ */ new Date()) {
+function utcDay2(d = /* @__PURE__ */ new Date()) {
   return d.toISOString().slice(0, 10);
 }
 
 // packages/insights/dist/beacon.server.js
-import { sql as sql11 } from "drizzle-orm";
+import { sql as sql13 } from "drizzle-orm";
 
 // packages/insights/dist/query.server.js
-import { and as and17, desc as desc7, eq as eq17, gte as gte2 } from "drizzle-orm";
+import { and as and19, desc as desc7, eq as eq19, gte as gte4 } from "drizzle-orm";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 
 // packages/insights/dist/logs.js
@@ -5022,10 +5071,10 @@ function statusClass(status) {
 }
 
 // packages/insights/dist/logs.server.js
-import { and as and18, desc as desc8, eq as eq18, gte as gte3, lt as lt5, sql as sql13 } from "drizzle-orm";
+import { and as and20, desc as desc8, eq as eq20, gte as gte5, lt as lt5, sql as sql15 } from "drizzle-orm";
 
 // packages/insights/dist/module-stats.server.js
-import { sql as sql12 } from "drizzle-orm";
+import { sql as sql14 } from "drizzle-orm";
 var MODULE_STATS_FLUSH_SEC = 60;
 var MODULE_STATS_TTL_SEC = (LOGS_RETENTION_DAYS + 1) * 24 * 60 * 60;
 var sharedRedis = () => getRedis();
@@ -5038,7 +5087,7 @@ function flushMarkerKey(appId, day) {
 async function recordModuleRequest(appId, module, status, opts = {}) {
   try {
     const r = (opts.redis ?? sharedRedis)();
-    const day = utcDay(opts.now ?? /* @__PURE__ */ new Date());
+    const day = utcDay2(opts.now ?? /* @__PURE__ */ new Date());
     const key = moduleCountersKey(appId, day);
     if (await r.hincrby(key, `${module}:${statusClass(status)}`, 1) === 1)
       await r.expire(key, MODULE_STATS_TTL_SEC);
@@ -5055,10 +5104,10 @@ function moduleStatRows(appId, day, counters) {
     const at = field.lastIndexOf(":");
     const module = field.slice(0, at);
     const cls = field.slice(at + 1);
-    const count2 = Number(raw);
-    if (at <= 0 || !STATUS_CLASSES.includes(cls) || !Number.isInteger(count2) || count2 <= 0)
+    const count3 = Number(raw);
+    if (at <= 0 || !STATUS_CLASSES.includes(cls) || !Number.isInteger(count3) || count3 <= 0)
       continue;
-    rows.push({ appId, module, statusClass: cls, day, count: count2 });
+    rows.push({ appId, module, statusClass: cls, day, count: count3 });
   }
   return rows;
 }
@@ -5067,7 +5116,7 @@ async function upsertModuleStats(rows) {
     return;
   await getDb().insert(moduleRequestStats).values(rows).onConflictDoUpdate({
     target: [moduleRequestStats.appId, moduleRequestStats.module, moduleRequestStats.statusClass, moduleRequestStats.day],
-    set: { count: sql12`greatest(${moduleRequestStats.count}, excluded.count)` }
+    set: { count: sql14`greatest(${moduleRequestStats.count}, excluded.count)` }
   });
 }
 async function flushModuleRequests(appId, day, opts = {}) {
@@ -5082,12 +5131,12 @@ async function flushModuleRequests(appId, day, opts = {}) {
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 
 // packages/insights/dist/prune.server.js
-import { lt as lt6, sql as sql14 } from "drizzle-orm";
+import { lt as lt6, sql as sql16 } from "drizzle-orm";
 var DEFAULT_LOGS_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
 var DAY_MS3 = 24 * 60 * 60 * 1e3;
 
 // packages/modules/dist/runtime.js
-import { and as and19, eq as eq19, inArray as inArray9 } from "drizzle-orm";
+import { and as and21, eq as eq21, inArray as inArray9 } from "drizzle-orm";
 import { z } from "zod";
 function redisRateLimiter(redis) {
   return async (key, max, windowMs) => {
@@ -5134,7 +5183,7 @@ function smtpEmailTransport(log, env = process.env) {
   };
 }
 async function appOwnerEmails(db2, workspaceId) {
-  const rows = await db2.select({ email: users.email }).from(memberships).innerJoin(users, eq19(users.id, memberships.userId)).where(and19(eq19(memberships.workspaceId, workspaceId), inArray9(memberships.role, ["editor", "workspace-admin"])));
+  const rows = await db2.select({ email: users.email }).from(memberships).innerJoin(users, eq21(users.id, memberships.userId)).where(and21(eq21(memberships.workspaceId, workspaceId), inArray9(memberships.role, ["editor", "workspace-admin"])));
   return rows.map((r) => r.email);
 }
 function uniqueKeyOf(value, unique) {
@@ -5291,7 +5340,7 @@ var ModuleRuntime = class {
       return out;
     const plan = await this.deps.limits.fromPlan?.(workspaceId) ?? null;
     const env = this.deps.limits.defaults();
-    const rows = workspaceId ? await this.deps.db().select({ module: workspaceModules.module, enabledBy: workspaceModules.enabledBy, enabledAt: workspaceModules.enabledAt }).from(workspaceModules).where(and19(eq19(workspaceModules.workspaceId, workspaceId), inArray9(workspaceModules.module, modules.map((m) => m.name)))) : [];
+    const rows = workspaceId ? await this.deps.db().select({ module: workspaceModules.module, enabledBy: workspaceModules.enabledBy, enabledAt: workspaceModules.enabledAt }).from(workspaceModules).where(and21(eq21(workspaceModules.workspaceId, workspaceId), inArray9(workspaceModules.module, modules.map((m) => m.name)))) : [];
     const byModule = new Map(rows.map((r) => [r.module, { enabledBy: r.enabledBy, enabledAt: r.enabledAt }]));
     for (const m of modules) {
       const key = moduleEnabledLimitName(m.name);
@@ -5371,7 +5420,7 @@ var ModuleRuntime = class {
       });
     }
     return this.deps.db().transaction(async (tx) => {
-      const changed = input.enabled ? (await tx.insert(workspaceModules).values({ workspaceId: input.workspaceId, module: m.name, enabledBy: input.actorUserId }).onConflictDoNothing().returning({ module: workspaceModules.module })).length > 0 : (await tx.delete(workspaceModules).where(and19(eq19(workspaceModules.workspaceId, input.workspaceId), eq19(workspaceModules.module, m.name))).returning({ module: workspaceModules.module })).length > 0;
+      const changed = input.enabled ? (await tx.insert(workspaceModules).values({ workspaceId: input.workspaceId, module: m.name, enabledBy: input.actorUserId }).onConflictDoNothing().returning({ module: workspaceModules.module })).length > 0 : (await tx.delete(workspaceModules).where(and21(eq21(workspaceModules.workspaceId, input.workspaceId), eq21(workspaceModules.module, m.name))).returning({ module: workspaceModules.module })).length > 0;
       if (changed) {
         await writeAudit({
           workspaceId: input.workspaceId,
@@ -5444,7 +5493,7 @@ var ModuleRuntime = class {
       return null;
     const deps = this.deps;
     const db2 = deps.db();
-    const [row] = await db2.select({ id: apps.id, slug: apps.slug, workspaceId: apps.workspaceId, deletedAt: apps.deletedAt, lockedReason: apps.lockedReason }).from(apps).where(eq19(apps.id, appId)).limit(1);
+    const [row] = await db2.select({ id: apps.id, slug: apps.slug, workspaceId: apps.workspaceId, deletedAt: apps.deletedAt, lockedReason: apps.lockedReason }).from(apps).where(eq21(apps.id, appId)).limit(1);
     if (!row || row.deletedAt || row.lockedReason)
       return null;
     const app = { id: row.id, slug: row.slug, workspaceId: row.workspaceId };
@@ -5916,7 +5965,7 @@ var ModuleRuntime = class {
   async workspaceOf(appId) {
     if (this.optInModules().length === 0)
       return "";
-    const [row] = await this.deps.db().select({ workspaceId: apps.workspaceId }).from(apps).where(eq19(apps.id, appId)).limit(1);
+    const [row] = await this.deps.db().select({ workspaceId: apps.workspaceId }).from(apps).where(eq21(apps.id, appId)).limit(1);
     return row?.workspaceId ?? "";
   }
   requireModule(name) {
@@ -6047,7 +6096,7 @@ var ModuleRuntime = class {
       const waiting = await this.pendingSummary(app.id);
       if (waiting.length === 0)
         return;
-      const [row] = await deps.db().select({ name: apps.name }).from(apps).where(eq19(apps.id, app.id)).limit(1);
+      const [row] = await deps.db().select({ name: apps.name }).from(apps).where(eq21(apps.id, app.id)).limit(1);
       const mail = pendingMail({
         appName: row?.name ?? app.slug,
         modules: waiting.map((w) => ({ ...w, confirmUrl: confirmUrl(deps.env, app.workspaceSlug, app.slug, w.module) }))
@@ -6241,11 +6290,11 @@ var ModuleRuntime = class {
   }
   /** get_logs `requests`: one response of a matched route of an active module (fire-and-forget). */
   countRequest(appId, module, status) {
-    const count2 = this.deps.requestStats;
-    if (!count2)
+    const count3 = this.deps.requestStats;
+    if (!count3)
       return;
     try {
-      void Promise.resolve(count2(appId, module, status)).catch(() => void 0);
+      void Promise.resolve(count3(appId, module, status)).catch(() => void 0);
     } catch {
     }
   }
@@ -6489,6 +6538,8 @@ export {
   decideAccess,
   workspaces,
   apps,
+  moduleConfigs,
+  getDb,
   noopLogger,
   perIpLimitKey,
   sniffSignature,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { ZodType, z } from 'zod';
 export { z } from 'zod';
-import { L as Logger, M as ModuleSecretDoc, H as HookApp, E as EndUser, D as DB, R as Rule, P as Principal, A as AccessDecision, a as ModuleLimit, b as Limits, C as ConfirmRole, c as AnyModule, d as EmailMessage, e as EmailKind, f as EmailRecipient, U as UploadedFile, g as EndUserListQuery, h as EndUserPage, i as EndUserRecord, O as OwnerFilesPage, j as OwnerFile, k as RecordsCollection, l as RecordsQuery, m as RecordsPage, S as SubmissionsQuery, n as SubmissionsPage, o as MailEnvelope, p as RateLimitResult, q as MailGuard, r as ModuleAvailability, s as ModuleDashboardEditor, t as ModuleErrorDoc, u as SdkBundle, v as ModuleServices, w as EndUserCallbackInput, x as EndUserCallbackResult } from './mail-guard.d-BKJhsVA2.js';
-export { B as BEACON_SCRIPT_PATH, y as BeaconScript, z as ComposedModuleParts, F as ConfirmContext, G as ConfirmItem, I as ConfirmedContext, J as DrobekModule, K as EndUserAuthority, N as EndUserCallbackApp, Q as FilesAuthority, T as MAIL_COUNTER_KEYS, V as MAIL_PAUSE_KEYS, W as MODULE_CONTRACT_VERSION, X as MODULE_ERROR_CODE_RE, Y as MODULE_NAME_RE, Z as MailAuthority, _ as MailBudgets, $ as MailClass, a0 as MailGuardConfig, a1 as MailGuardMeta, a2 as MailGuardRedis, a3 as MailPrepareInput, a4 as ModuleAppView, a5 as ModuleComposeInput, a6 as ModuleContext, a7 as ModuleDashboard, a8 as ModuleHooks, a9 as ModuleMigrations, aa as ModuleRequest, ab as ModuleResponse, ac as ModuleRouter, ad as ModuleSdk, ae as ModuleSkill, af as ModuleSlot, ag as OwnerSubmission, ah as OwnerView, ai as RECORDS_IMPORT_MAX_ROWS, aj as RecordsAuthority, ak as RecordsView, al as RouteHandler, am as RouteOptions, an as RouteRateLimit, ao as SDK_PATH, ap as SDK_TYPES_PATH, aq as SLOT_NAME_RE, ar as SubmissionsAuthority, as as buildBeaconScript, at as buildSdk, au as defineModule, av as inlineSpecifier, aw as isDefinedModule, ax as mailAppCounterKey, ay as mailBudgets, az as mailGuardConfigFromEnv, aA as memoryMailGuard, aB as memoryMailGuardRedis, aC as normalizeConfirmItems, aD as redisMailGuard, aE as respond, aF as sdkDeclarations } from './mail-guard.d-BKJhsVA2.js';
+import { L as Logger, M as ModuleSecretDoc, H as HookApp, E as EndUser, D as DB, R as Rule, P as Principal, A as AccessDecision, a as ModuleLimit, b as Limits, C as ConfirmRole, c as AnyModule, d as EmailMessage, e as EmailKind, f as EmailRecipient, U as UploadedFile, g as EndUserListQuery, h as EndUserPage, i as EndUserRecord, O as OwnerFilesPage, j as OwnerFile, k as RecordsCollection, l as RecordsQuery, m as RecordsPage, S as SubmissionsQuery, n as SubmissionsPage, o as MailEnvelope, p as RateLimitResult, q as MailGuard, r as ModuleAvailability, s as ModuleDashboardEditor, t as ModuleErrorDoc, u as SdkBundle, v as ModuleServices, w as EndUserCallbackInput, x as EndUserCallbackResult } from './mail-guard.d-BHuy9yy0.js';
+export { B as BEACON_SCRIPT_PATH, y as BeaconScript, z as ComposedModuleParts, F as ConfirmContext, G as ConfirmItem, I as ConfirmedContext, J as DrobekModule, K as EndUserAuthority, N as EndUserCallbackApp, Q as FilesAuthority, T as MAIL_COUNTER_KEYS, V as MAIL_PAUSE_KEYS, W as MODULE_CONTRACT_VERSION, X as MODULE_ERROR_CODE_RE, Y as MODULE_NAME_RE, Z as MailAuthority, _ as MailBudgets, $ as MailClass, a0 as MailGuardConfig, a1 as MailGuardMeta, a2 as MailGuardRedis, a3 as MailPrepareInput, a4 as ModuleAppView, a5 as ModuleComposeInput, a6 as ModuleContext, a7 as ModuleDashboard, a8 as ModuleHooks, a9 as ModuleMigrations, aa as ModuleRequest, ab as ModuleResponse, ac as ModuleRouter, ad as ModuleSdk, ae as ModuleSkill, af as ModuleSlot, ag as OwnerSubmission, ah as OwnerView, ai as RECORDS_IMPORT_MAX_ROWS, aj as RecordsAuthority, ak as RecordsView, al as RouteHandler, am as RouteOptions, an as RouteRateLimit, ao as SDK_PATH, ap as SDK_TYPES_PATH, aq as SLOT_NAME_RE, ar as SubmissionsAuthority, as as buildBeaconScript, at as buildSdk, au as defineModule, av as inlineSpecifier, aw as isDefinedModule, ax as mailAppCounterKey, ay as mailBudgets, az as mailGuardConfigFromEnv, aA as memoryMailGuard, aB as memoryMailGuardRedis, aC as normalizeConfirmItems, aD as redisMailGuard, aE as respond, aF as sdkDeclarations } from './mail-guard.d-BHuy9yy0.js';
 export { SdkCore } from '@drobek/sdk';
 import { Readable } from 'node:stream';
 import { Redis } from 'ioredis';
@@ -1600,5 +1600,35 @@ declare function activeModules(): Promise<ModuleSummary[]>;
 /** Tests: install a runtime (or null to reset). */
 declare function setModuleRuntimeForTests(runtime: ModuleRuntime | null): void;
 
-export { AUTH_PROVIDER_ID_RE, AUTH_RESERVED_CONFIG_KEYS, AccessDecision, AnyModule, BACKEND_IMPORT_SKILLS, CORE_ERROR_CODES, CORE_LIMITS, ConfirmRole, DB, DEFAULT_MAX_BODY_BYTES, DEFAULT_MODULES_DIR, EMAIL_PROVIDER_ID, EMAIL_RE, END_USER_COOKIE, END_USER_COOKIE_INSECURE, END_USER_SESSION_TTL_SEC, END_USER_TOKEN_RE, EmailKind, EmailMessage, EmailRecipient, EndUser, EndUserCallbackInput, EndUserCallbackResult, EndUserListQuery, EndUserPage, EndUserRecord, HookApp, LIMITS_CACHE_TTL_SEC, LIMITS_SIGNATURE_HEADER, LIMITS_TIMESTAMP_HEADER, Limits, Logger, Lru, MAX_EMAIL_TEXT, MAX_FILE_HEAD_BYTES, MODULE_ERROR_CODES, MailEnvelope, MailGuard, ModuleAvailability, ModuleDashboardEditor, ModuleError, ModuleErrorDoc, ModuleLimit, ModuleLoadError, ModuleRuntime, ModuleSecretDoc, ModuleServices, OwnerFile, OwnerFilesPage, PENDING_MAIL_WINDOW_MS, PLATFORM_SKILL_NAME, Principal, RESERVED_MODULE_NAMES, RULE_TOKENS, RateLimitResult, RecordsCollection, RecordsPage, RecordsQuery, Rule, SDK_HEADER, SECRET_MAX_BYTES, SECRET_NAME_RE, SdkBundle, SecretStoreError, SubmissionsPage, SubmissionsQuery, UploadedFile, activeModules, appOwnerEmails, authIdentitySchema, authProviderSchema, authSignedInObserverSchema, capEmailText, checkErrorCodes, checkModuleSet, checkRequires, collectContributions, composeModule, confirmUrl, cookiePrincipalResolver, createEndUserSession, createLimitsProvider, csvChunks, decideAccess, defineAuthProvider, defineSignInObserver, deleteModuleSecret, destroyEndUserSession, effectiveConfigDefaults, emailKind, endUserAuthorityOf, endUserCookieHeader, endUserCookieName, endUserCookiesSecure, endUserEpochKey, endUserSessionKey, filesAuthorityOf, generalSkillsDir, getModuleSecret, hasControlBytes, isModuleError, isReadable, isValidRule, issuePaths, jsonEqual, jsonKey, limitsProviderConfigError, loadEndUserSession, loadGeneralSkills, loadModuleRuntime, loadModuleSet, loadModules, looksLikeSvg, mailAuthorityOf, memoryRateLimiter, mergePatch, moduleDefaultsEnvName, moduleEnabledLimitName, moduleJournalTable, moduleNotEnabled, moduleRuntime, multipartBoundary, packageNameFor, parseEndUserSession, parseModuleList, parseMultipart, parseRule, parseSkillMarkdown, pendingMail, pendingMailKey, perIpLimitKey, readConfigRow, readEndUserToken, recipientRefs, recordsAuthorityOf, redisRateLimiter, renewEndUserSession, resolveRecipients, revokeEndUserSessions, ruleIsPublic, sanitizeSubject, secretsSet, secretsStatus, setModuleRuntimeForTests, setModuleSecret, signLimitsRequest, skillForImport, skillHint, smtpEmailTransport, sniffSignature, stableJson, streamMultipartFile, submissionsAuthorityOf };
-export type { AppModuleState, AuthIdentity, AuthProvider, AuthProviderBeginInput, AuthProviderBeginResult, AuthProviderCallbackInput, AuthProviderSecretDoc, AuthProviderSecrets, AuthSignInEvent, AuthSignedInObserver, BoundEndUsers, BoundFiles, BoundRecords, BoundSubmissions, ConfigRow, ConfigureInput, ConfigureResult, CurrentEndUser, DecisionInput, EmailTransport, EndUserRedis, EndUserSession, LimitsProvider, LoadRuntimeOptions, LoadedModules, ModuleDashboardView, ModuleErrorBody, ModuleErrorCode, ModuleErrorSection, ModuleFacts, ModuleOrigin, ModuleSource, ModuleSummary, PendingChange, PendingMailModule, PendingView, PipelineRequest, PipelineResult, PlatformApp, PlatformRequest, PrincipalResolver, RateLimiter, RecipientSources, RuntimeDeps, SkillEntry, SkillInfo, SkillListItem, SlotContribution, SniffedType, TransportMessage, WorkspaceModuleSource, WorkspaceModuleState };
+/** Modules whose config is never copied: it points at records of the source workspace. */
+declare const NOT_COPIED_MODULES: readonly string[];
+/** The part of a saved `module` config a copy may propose, or null when nothing is left. */
+declare function configForCopy(module: string, config: unknown): Record<string, unknown> | null;
+interface DuplicateConfigsInput {
+    sourceAppId: string;
+    target: {
+        id: string;
+        slug: string;
+        workspaceId: string;
+        workspaceSlug: string;
+    };
+    actorUserId: string;
+    surface: 'mcp' | 'web';
+}
+interface DuplicateConfigsResult {
+    applied: string[];
+    pending: {
+        module: string;
+        changes: string[];
+        confirm_url?: string;
+    }[];
+    skipped: {
+        module: string;
+        reason: 'not_copied' | 'not_enabled' | 'invalid';
+    }[];
+}
+/** Propose the source app's saved module configs to the copy (see the file comment). */
+declare function duplicateModuleConfigs(runtime: ModuleRuntime, input: DuplicateConfigsInput): Promise<DuplicateConfigsResult>;
+
+export { AUTH_PROVIDER_ID_RE, AUTH_RESERVED_CONFIG_KEYS, AccessDecision, AnyModule, BACKEND_IMPORT_SKILLS, CORE_ERROR_CODES, CORE_LIMITS, ConfirmRole, DB, DEFAULT_MAX_BODY_BYTES, DEFAULT_MODULES_DIR, EMAIL_PROVIDER_ID, EMAIL_RE, END_USER_COOKIE, END_USER_COOKIE_INSECURE, END_USER_SESSION_TTL_SEC, END_USER_TOKEN_RE, EmailKind, EmailMessage, EmailRecipient, EndUser, EndUserCallbackInput, EndUserCallbackResult, EndUserListQuery, EndUserPage, EndUserRecord, HookApp, LIMITS_CACHE_TTL_SEC, LIMITS_SIGNATURE_HEADER, LIMITS_TIMESTAMP_HEADER, Limits, Logger, Lru, MAX_EMAIL_TEXT, MAX_FILE_HEAD_BYTES, MODULE_ERROR_CODES, MailEnvelope, MailGuard, ModuleAvailability, ModuleDashboardEditor, ModuleError, ModuleErrorDoc, ModuleLimit, ModuleLoadError, ModuleRuntime, ModuleSecretDoc, ModuleServices, NOT_COPIED_MODULES, OwnerFile, OwnerFilesPage, PENDING_MAIL_WINDOW_MS, PLATFORM_SKILL_NAME, Principal, RESERVED_MODULE_NAMES, RULE_TOKENS, RateLimitResult, RecordsCollection, RecordsPage, RecordsQuery, Rule, SDK_HEADER, SECRET_MAX_BYTES, SECRET_NAME_RE, SdkBundle, SecretStoreError, SubmissionsPage, SubmissionsQuery, UploadedFile, activeModules, appOwnerEmails, authIdentitySchema, authProviderSchema, authSignedInObserverSchema, capEmailText, checkErrorCodes, checkModuleSet, checkRequires, collectContributions, composeModule, configForCopy, confirmUrl, cookiePrincipalResolver, createEndUserSession, createLimitsProvider, csvChunks, decideAccess, defineAuthProvider, defineSignInObserver, deleteModuleSecret, destroyEndUserSession, duplicateModuleConfigs, effectiveConfigDefaults, emailKind, endUserAuthorityOf, endUserCookieHeader, endUserCookieName, endUserCookiesSecure, endUserEpochKey, endUserSessionKey, filesAuthorityOf, generalSkillsDir, getModuleSecret, hasControlBytes, isModuleError, isReadable, isValidRule, issuePaths, jsonEqual, jsonKey, limitsProviderConfigError, loadEndUserSession, loadGeneralSkills, loadModuleRuntime, loadModuleSet, loadModules, looksLikeSvg, mailAuthorityOf, memoryRateLimiter, mergePatch, moduleDefaultsEnvName, moduleEnabledLimitName, moduleJournalTable, moduleNotEnabled, moduleRuntime, multipartBoundary, packageNameFor, parseEndUserSession, parseModuleList, parseMultipart, parseRule, parseSkillMarkdown, pendingMail, pendingMailKey, perIpLimitKey, readConfigRow, readEndUserToken, recipientRefs, recordsAuthorityOf, redisRateLimiter, renewEndUserSession, resolveRecipients, revokeEndUserSessions, ruleIsPublic, sanitizeSubject, secretsSet, secretsStatus, setModuleRuntimeForTests, setModuleSecret, signLimitsRequest, skillForImport, skillHint, smtpEmailTransport, sniffSignature, stableJson, streamMultipartFile, submissionsAuthorityOf };
+export type { AppModuleState, AuthIdentity, AuthProvider, AuthProviderBeginInput, AuthProviderBeginResult, AuthProviderCallbackInput, AuthProviderSecretDoc, AuthProviderSecrets, AuthSignInEvent, AuthSignedInObserver, BoundEndUsers, BoundFiles, BoundRecords, BoundSubmissions, ConfigRow, ConfigureInput, ConfigureResult, CurrentEndUser, DecisionInput, DuplicateConfigsInput, DuplicateConfigsResult, EmailTransport, EndUserRedis, EndUserSession, LimitsProvider, LoadRuntimeOptions, LoadedModules, ModuleDashboardView, ModuleErrorBody, ModuleErrorCode, ModuleErrorSection, ModuleFacts, ModuleOrigin, ModuleSource, ModuleSummary, PendingChange, PendingMailModule, PendingView, PipelineRequest, PipelineResult, PlatformApp, PlatformRequest, PrincipalResolver, RateLimiter, RecipientSources, RuntimeDeps, SkillEntry, SkillInfo, SkillListItem, SlotContribution, SniffedType, TransportMessage, WorkspaceModuleSource, WorkspaceModuleState };

package/dist/index.js

@@ -66,6 +66,7 @@ import {
   endUserSessionKey,
   filesAuthorityOf,
   generalSkillsDir,
+  getDb,
   getModuleSecret,
   hasControlBytes,
   inlineSpecifier,
@@ -91,6 +92,7 @@ import {
   memoryMailGuardRedis,
   memoryRateLimiter,
   mergePatch,
+  moduleConfigs,
   moduleDefaultsEnvName,
   moduleEnabledLimitName,
   moduleJournalTable,
@@ -132,7 +134,7 @@ import {
   stableJson,
   streamMultipartFile,
   submissionsAuthorityOf
-} from "./chunk-WHKPW5MP.js";
+} from "./chunk-B7PEIWK7.js";
 
 // packages/modules/dist/index.js
 import { z as z2 } from "zod";
@@ -227,6 +229,63 @@ async function* csvChunks(lines, chunkChars = CSV_CHUNK_CHARS) {
   if (chunk)
     yield chunk;
 }
+
+// packages/modules/dist/duplicate.js
+import { eq } from "drizzle-orm";
+var NOT_COPIED_MODULES = ["proxy"];
+var EMAIL_RE2 = /[^\s@<>"',;]+@[^\s@<>"',;]+\.[^\s@<>"',;]+/;
+function stripForCopy(value) {
+  if (value === null)
+    return void 0;
+  if (typeof value === "string")
+    return EMAIL_RE2.test(value) ? void 0 : value;
+  if (Array.isArray(value)) {
+    return value.map(stripForCopy).filter((v) => v !== void 0);
+  }
+  if (typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const kept = stripForCopy(v);
+      if (kept !== void 0)
+        out[k] = kept;
+    }
+    return out;
+  }
+  return value;
+}
+function configForCopy(module, config) {
+  if (NOT_COPIED_MODULES.includes(module))
+    return null;
+  if (!config || typeof config !== "object" || Array.isArray(config))
+    return null;
+  const out = stripForCopy(config);
+  return Object.keys(out).length > 0 ? out : null;
+}
+async function duplicateModuleConfigs(runtime, input) {
+  const rows = await getDb().select({ module: moduleConfigs.module, config: moduleConfigs.config }).from(moduleConfigs).where(eq(moduleConfigs.appId, input.sourceAppId)).orderBy(moduleConfigs.module);
+  const out = { applied: [], pending: [], skipped: [] };
+  for (const row of rows) {
+    const patch = configForCopy(row.module, row.config);
+    if (!patch) {
+      if (NOT_COPIED_MODULES.includes(row.module))
+        out.skipped.push({ module: row.module, reason: "not_copied" });
+      continue;
+    }
+    try {
+      const r = await runtime.configure({ app: input.target, module: row.module, patch, actorUserId: input.actorUserId, surface: input.surface });
+      if (r.pending_confirmation.length > 0) {
+        out.pending.push({ module: row.module, changes: r.pending_confirmation, ...r.confirm_url ? { confirm_url: r.confirm_url } : {} });
+      } else {
+        out.applied.push(row.module);
+      }
+    } catch (err) {
+      if (!isModuleError(err))
+        throw err;
+      out.skipped.push({ module: row.module, reason: err.code === "module_not_enabled" || err.code === "not_found" ? "not_enabled" : "invalid" });
+    }
+  }
+  return out;
+}
 export {
   AUTH_PROVIDER_ID_RE,
   AUTH_RESERVED_CONFIG_KEYS,
@@ -257,6 +316,7 @@ export {
   ModuleError,
   ModuleLoadError,
   ModuleRuntime,
+  NOT_COPIED_MODULES,
   PENDING_MAIL_WINDOW_MS,
   PLATFORM_SKILL_NAME,
   RECORDS_IMPORT_MAX_ROWS,
@@ -282,6 +342,7 @@ export {
   checkRequires,
   collectContributions,
   composeModule,
+  configForCopy,
   confirmUrl,
   cookiePrincipalResolver,
   createEndUserSession,
@@ -293,6 +354,7 @@ export {
   defineSignInObserver,
   deleteModuleSecret,
   destroyEndUserSession,
+  duplicateModuleConfigs,
   effectiveConfigDefaults,
   emailKind,
   endUserAuthorityOf,

package/dist/{mail-guard.d-BKJhsVA2.d.ts → mail-guard.d-BHuy9yy0.d.ts}

@@ -185,9 +185,16 @@ declare const apps = pgTable(
     galleryDescription: text('gallery_description'),
     /** NSO-340: a super-admin hid the gallery entry (non-null = hidden, whatever the owner sets). */
     galleryHiddenAt: timestamp('gallery_hidden_at'),
+    /** NSO-340: the owner lets signed-in people duplicate the listed app into their own workspace. */
+    galleryAllowDuplicate: boolean('gallery_allow_duplicate').notNull().default(false),
+    /** NSO-340: the gallery app this one was duplicated from (null when the source is gone or none). */
+    duplicatedFromAppId: text('duplicated_from_app_id').references((): AnyPgColumn => apps.id, { onDelete: 'set null' }),
+    /** The source's slug at duplication time, kept when the source is deleted. */
+    duplicatedFromSlug: text('duplicated_from_slug'),
   },
   (t) => [
     uniqueIndex('apps_slug_uq').on(t.slug),
+    index('apps_duplicated_from_idx').on(t.duplicatedFromAppId).where(sql`${t.duplicatedFromAppId} IS NOT NULL`),
     // The public gallery page reads listed apps newest-published first (NSO-340).
     index('apps_gallery_idx').on(t.publishedAt.desc(), t.slug.desc()).where(sql`${t.galleryListed}`),
     index('apps_workspace_idx').on(t.workspaceId),
@@ -202,6 +209,34 @@ declare const apps = pgTable(
   ]
 );
 
+/** NSO-340: a signed-in drobek account likes a gallery app — one row per account and app. */
+declare const galleryLikes = pgTable(
+  'gallery_likes',
+  {
+    appId: text('app_id')
+      .notNull()
+      .references(() => apps.id, { onDelete: 'cascade' }),
+    userId: text('user_id')
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+  },
+  (t) => [primaryKey({ columns: [t.appId, t.userId] })]
+);
+
+/** NSO-340: opens of a gallery app through the gallery's counting link, per UTC day (`YYYY-MM-DD`); no visitor data. */
+declare const galleryOpens = pgTable(
+  'gallery_opens',
+  {
+    appId: text('app_id')
+      .notNull()
+      .references(() => apps.id, { onDelete: 'cascade' }),
+    day: text('day').notNull(),
+    count: integer('count').notNull().default(0),
+  },
+  (t) => [primaryKey({ columns: [t.appId, t.day] })]
+);
+
 /** Content-addressed file bytes, shared by every version (and app) that uses them. */
 declare const blobs = pgTable('blobs', {
   sha256: text('sha256').primaryKey(),
@@ -861,6 +896,8 @@ declare const schema_blobs: typeof blobs;
 declare const schema_bytea: typeof bytea;
 declare const schema_compileStatusEnum: typeof compileStatusEnum;
 declare const schema_domains: typeof domains;
+declare const schema_galleryLikes: typeof galleryLikes;
+declare const schema_galleryOpens: typeof galleryOpens;
 declare const schema_membershipRoleEnum: typeof membershipRoleEnum;
 declare const schema_memberships: typeof memberships;
 declare const schema_moduleConfigs: typeof moduleConfigs;
@@ -900,6 +937,8 @@ declare namespace schema {
     schema_bytea as bytea,
     schema_compileStatusEnum as compileStatusEnum,
     schema_domains as domains,
+    schema_galleryLikes as galleryLikes,
+    schema_galleryOpens as galleryOpens,
     schema_membershipRoleEnum as membershipRoleEnum,
     schema_memberships as memberships,
     schema_moduleConfigs as moduleConfigs,

package/dist/migrations/core/0028_gallery_duplicate.sql

@@ -0,0 +1,8 @@
+-- NSO-340: duplicating a gallery app. The owner opts in per app
+-- (gallery_allow_duplicate); a copy remembers its source (id, and the slug
+-- for when the source is deleted). Additive only.
+ALTER TABLE "apps" ADD COLUMN "gallery_allow_duplicate" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "duplicated_from_app_id" text;--> statement-breakpoint
+ALTER TABLE "apps" ADD COLUMN "duplicated_from_slug" text;--> statement-breakpoint
+ALTER TABLE "apps" ADD CONSTRAINT "apps_duplicated_from_app_id_apps_id_fk" FOREIGN KEY ("duplicated_from_app_id") REFERENCES "public"."apps"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "apps_duplicated_from_idx" ON "apps" USING btree ("duplicated_from_app_id") WHERE "apps"."duplicated_from_app_id" IS NOT NULL;

package/dist/migrations/core/0029_gallery_likes.sql

@@ -0,0 +1,19 @@
+-- NSO-340: gallery likes (one per signed-in account and app) and opens through
+-- the gallery's counting link (per app and UTC day, no visitor data).
+CREATE TABLE "gallery_likes" (
+	"app_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "gallery_likes_app_id_user_id_pk" PRIMARY KEY("app_id","user_id")
+);
+--> statement-breakpoint
+CREATE TABLE "gallery_opens" (
+	"app_id" text NOT NULL,
+	"day" text NOT NULL,
+	"count" integer DEFAULT 0 NOT NULL,
+	CONSTRAINT "gallery_opens_app_id_day_pk" PRIMARY KEY("app_id","day")
+);
+--> statement-breakpoint
+ALTER TABLE "gallery_likes" ADD CONSTRAINT "gallery_likes_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "gallery_likes" ADD CONSTRAINT "gallery_likes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "gallery_opens" ADD CONSTRAINT "gallery_opens_app_id_apps_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."apps"("id") ON DELETE cascade ON UPDATE no action;

package/dist/migrations/core/meta/_journal.json

@@ -162,6 +162,20 @@
       "when": 1790496410618,
       "tag": "0027_publish_block",
       "breakpoints": true
+    },
+    {
+      "idx": 28,
+      "version": "7",
+      "when": 1790525749936,
+      "tag": "0028_gallery_duplicate",
+      "breakpoints": true
+    },
+    {
+      "idx": 29,
+      "version": "7",
+      "when": 1790525800000,
+      "tag": "0029_gallery_likes",
+      "breakpoints": true
     }
   ]
 }

package/dist/testing.js

@@ -23,7 +23,7 @@ import {
   runRoute,
   sanitizeSubject,
   workspaces
-} from "./chunk-WHKPW5MP.js";
+} from "./chunk-B7PEIWK7.js";
 
 // packages/modules/dist/testing.js
 import { existsSync } from "node:fs";
@@ -63,14 +63,28 @@ var TOOL_DOCS = [
     returns: "{ app_id, name, slug, workspace, version:1, compile:{ok,errors,warnings}, preview_url, briefing, skills:[{name,use_when}] }",
     example: { name: "Shift planner", template: "react-ts" }
   },
+  {
+    name: "duplicate_app",
+    title: "Duplicate a gallery app",
+    scope: "write (editor+ role in the target workspace)",
+    description: "Copy an app from this server's public gallery into a workspace of the user \u2014 only an app whose owner allows duplicates (the gallery shows it as duplicable). Call it when the user asks to copy, fork or duplicate a gallery app. The copy is a new, unpublished app whose version 1 holds the source's PUBLISHED files, and it remembers where it came from (get_app `duplicated_from`). The source's module settings are proposed to the copy through the normal confirmation flow: anything that needs a confirmation waits on the new app's Modules page (`modules.pending[].confirm_url` \u2014 tell the user), and e-mail addresses and proxy upstreams are dropped. Never copied: secrets, data, end users, uploads, app assets, domains and the gallery listing. Refused when the server has no gallery (gallery_disabled), the app is not in the gallery (not_found), its owner does not allow copies (not_duplicable), the user made DUPLICATES_PER_USER_HOUR copies within the last hour (rate_limited) or the workspace is full (limit_exceeded); a `from` address that is not this server's is invalid_params. The same copy is on the dashboard at /duplicate/<slug>.",
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+    fields: [
+      { name: "from", type: "string", required: true, description: "The gallery app on this server: its slug, its address (published or --preview host, or a verified custom domain) or this dashboard's /duplicate/<slug> URL. An address of another server is invalid_params." },
+      { name: "workspace", type: "string (optional)", required: false, description: "Workspace slug for the copy (editor+); defaults to your personal workspace." },
+      { name: "name", type: "string (optional, \u2264 80 chars)", required: false, description: 'Name of the copy; default "<name> copy". The slug is derived from it.' }
+    ],
+    returns: "{ app_id, slug, workspace, version:1, from, preview_url, modules:{ applied:[module], pending:[{module,changes,confirm_url}], skipped:[{module,reason}] }, note? }",
+    example: { from: "pixel-wall", name: "My pixel wall" }
+  },
   {
     name: "get_app",
     title: "Get an app",
     scope: "read (any role in the workspace)",
-    description: "Snapshot of one app: everything list_apps shows plus the briefing, the source files of the latest version ({path,size,sha256}), the last 20 versions (number, created_at, actor_kind, reasoning, compile_status), the latest compile errors, the platform modules (per module: whether it is enabled for the app's workspace \u2014 an opt-in module the operator has not enabled says enabled:false and cannot be used \u2014, its effective config, whether a change waits for the owner's confirmation, which secrets are set \u2014 names and hasSecret only, never values \u2014 and the module's info, e.g. proxy: the workspace upstreams with registered/assigned/call/hasSecret), the skills list (without the opt-in modules that are off for the workspace), the public gallery state (listed, description, hidden_by_admin, visible \u2014 or enabled:false when the server has no gallery), the custom domains in short (host, status pending | verified, primary \u2014 list_domains has their DNS records), `can_publish` (+ `publish_contact` when the workspace may not publish: the operator blocked it or has not approved it yet) and the workspace's `publishing` state (default | allowed | blocked), and the write lock (holder + expires_at) if someone holds it. Use it to re-orient before editing.",
+    description: "Snapshot of one app: everything list_apps shows plus the briefing, the source files of the latest version ({path,size,sha256}), the last 20 versions (number, created_at, actor_kind, reasoning, compile_status), the latest compile errors, the platform modules (per module: whether it is enabled for the app's workspace \u2014 an opt-in module the operator has not enabled says enabled:false and cannot be used \u2014, its effective config, whether a change waits for the owner's confirmation, which secrets are set \u2014 names and hasSecret only, never values \u2014 and the module's info, e.g. proxy: the workspace upstreams with registered/assigned/call/hasSecret), the skills list (without the opt-in modules that are off for the workspace), the public gallery state (listed, description, hidden_by_admin, visible, allow_duplicate, likes \u2014 signed-in accounts that like it \u2014 and opens through the gallery in the last 30 days; or enabled:false when the server has no gallery), `duplicated_from` (the gallery app this one was copied from, when it was), the custom domains in short (host, status pending | verified, primary \u2014 list_domains has their DNS records), `can_publish` (+ `publish_contact` when the workspace may not publish: the operator blocked it or has not approved it yet) and the workspace's `publishing` state (default | allowed | blocked), and the write lock (holder + expires_at) if someone holds it. Use it to re-orient before editing.",
     annotations: READ_ONLY,
     fields: [{ name: "app_id", type: "string", required: true, description: "The app id (from list_apps / create_app)." }],
-    returns: '{ app_id, name, slug, workspace, preview_url, published_url?, published_version?, latest_version, compile_status, compile_errors, briefing, files:[{path,size,sha256}], versions:[{number,created_at,actor_kind,reasoning,compile_status}], modules:{<name>:{enabled,configured,config,pending,pending_confirmation?,confirm_url?,secrets?:[{name,hasSecret}],info?}}, skills:[{name,use_when}], gallery:{enabled,listed?,description?,hidden_by_admin?,visible?}, domains:[{host,status:"pending"|"verified",primary}], can_publish, publish_contact?, publishing, lock?:{holder,expires_at}, locked_by_admin?, locked_reason? }',
+    returns: '{ app_id, name, slug, workspace, preview_url, published_url?, published_version?, latest_version, compile_status, compile_errors, briefing, files:[{path,size,sha256}], versions:[{number,created_at,actor_kind,reasoning,compile_status}], modules:{<name>:{enabled,configured,config,pending,pending_confirmation?,confirm_url?,secrets?:[{name,hasSecret}],info?}}, skills:[{name,use_when}], gallery:{enabled,listed?,description?,hidden_by_admin?,visible?,allow_duplicate?,likes?,opens?}, duplicated_from?, domains:[{host,status:"pending"|"verified",primary}], can_publish, publish_contact?, publishing, lock?:{holder,expires_at}, locked_by_admin?, locked_reason? }',
     example: { app_id: "k3v9x0\u2026" }
   },
   {
@@ -148,7 +162,7 @@ var TOOL_DOCS = [
     name: "set_gallery_listing",
     title: "List an app in the public gallery",
     scope: "publish (editor+ role in the workspace)",
-    description: "Show a published app in this server's public gallery (its name, a one- or two-sentence description and its production URL, visible to everyone), change that description, or take the app out of the gallery. Listing (`listed: true`) needs a published app, a plain-text `description` of at most 160 characters and `user_confirmed: true` \u2014 set it ONLY after the user explicitly said yes to exactly this listing: ask them first and show them the description. Never list an app on your own initiative. Without the confirmation the answer is user_confirmation_required and nothing changes. Unlisting (`listed: false`) needs no confirmation and works at once. Refused when the server has no gallery (gallery_disabled), when the app is not published (not_published) and when the server operator hid the app from the gallery (gallery_hidden). Unpublishing the app also takes it out of the gallery. get_app shows the current state (`gallery`).",
+    description: "Show a published app in this server's public gallery (its name, a one- or two-sentence description and its production URL, visible to everyone), change that description, or take the app out of the gallery. Listing (`listed: true`) needs a published app, a plain-text `description` of at most 160 characters and `user_confirmed: true` \u2014 set it ONLY after the user explicitly said yes to exactly this listing: ask them first and show them the description. Never list an app on your own initiative. Without the confirmation the answer is user_confirmation_required and nothing changes. Unlisting (`listed: false`) needs no confirmation and works at once. Refused when the server has no gallery (gallery_disabled), when the app is not published (not_published) and when the server operator hid the app from the gallery (gallery_hidden). With `allow_duplicate: true` the gallery also offers a Duplicate button: signed-in people copy the published files into their own workspace (never data, users, secrets or domains) \u2014 include that in the question to the user. Unpublishing the app also takes it out of the gallery. get_app shows the current state (`gallery`).",
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true },
     fields: [
       { name: "app_id", type: "string", required: true, description: "The app id." },
@@ -159,6 +173,12 @@ var TOOL_DOCS = [
         required: false,
         description: "The public description: plain text, one or two sentences."
       },
+      {
+        name: "allow_duplicate",
+        type: "boolean (listing only, optional)",
+        required: false,
+        description: "true lets signed-in people copy the published app into their own workspace (duplicate_app, the gallery's Duplicate button); omitted keeps the current choice. Covered by the same user_confirmed."
+      },
       {
         name: "user_confirmed",
         type: "boolean (listing only)",
@@ -166,7 +186,7 @@ var TOOL_DOCS = [
         description: "true ONLY after the user explicitly said yes to this listing and description."
       }
     ],
-    returns: "{ app_id, listed, description, changed, visible, note? }",
+    returns: "{ app_id, listed, description, allow_duplicate, changed, visible, note? }",
     example: { app_id: "k3v9x0\u2026", listed: true, description: "Plan weekly shifts for a small team.", user_confirmed: true }
   },
   {
@@ -340,6 +360,48 @@ var TOOL_DOCS = [
     returns: "{ removed:host, was_verified, was_primary, note }",
     example: { app_id: "k3v9x0\u2026", host: "shop.example.com", user_confirmed: true }
   },
+  {
+    name: "list_upstreams",
+    title: "List a workspace's proxy upstreams",
+    scope: "read (workspace-admin role in the workspace)",
+    description: "The external APIs registered for the proxy module in one workspace \u2014 the dashboard's workspace \u2192 Upstreams page: per upstream its `name` (what apps call it by), `base_url`, `allowed_methods`, `allowed_path_prefixes`, `auth_type` (none | bearer | header), `auth_header_name`, `has_secret` (never the secret) and `apps` \u2014 the apps whose assignment a workspace admin confirmed. Plus `upstreams_url`, the dashboard page. Workspace admins only (forbidden otherwise); get_app \u2192 modules.proxy.info shows any editor what one app may call. Read-only.",
+    annotations: READ_ONLY,
+    fields: [{ name: "workspace", type: "string", required: true, description: "The workspace slug." }],
+    returns: '{ workspace, upstreams:[{ name, base_url, allowed_methods, allowed_path_prefixes, auth_type:"none"|"bearer"|"header", auth_header_name, has_secret, apps:[slug], created_at }], upstreams_url }',
+    example: { workspace: "acme-crew" }
+  },
+  {
+    name: "register_upstream",
+    title: "Register a proxy upstream",
+    scope: "write (workspace-admin role in the workspace)",
+    description: 'Register an external API for the proxy module in a workspace \u2014 what the dashboard\'s Upstreams page does, with the same checks: a public https or http base URL on port 80/443 (never a private address), the allowed HTTP methods and path prefixes apps may call under it. `auth_type: "none"` (an API without a key, e.g. https://pokeapi.co) registers at once. `bearer` / `header` need a key, and a key never passes through MCP: the answer is `registered: false` with `secret_url` \u2014 the Upstreams page with every field filled in; give the user that link, they paste the key and click Register. Never ask for the key in chat. A registered upstream does nothing yet: assign it to an app with configure_module(\'proxy\', { upstreams: { <name>: { rules: { call: "user" } } } }) \u2014 a workspace admin confirms that in the dashboard. A name the workspace already has answers upstream_already_registered.',
+    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    fields: [
+      { name: "workspace", type: "string", required: true, description: "The workspace slug." },
+      { name: "name", type: "string", required: true, description: "The name apps call it by, e.g. pokeapi." },
+      { name: "base_url", type: "string", required: true, description: "The base URL, e.g. https://pokeapi.co." },
+      { name: "allowed_methods", type: "string[]", required: true, description: 'e.g. ["GET"].' },
+      { name: "allowed_path_prefixes", type: "string[]", required: true, description: 'e.g. ["/api/v2/"].' },
+      { name: "auth_type", type: '"none" | "bearer" | "header"', required: true, description: "none registers now; bearer / header answer secret_url." },
+      { name: "auth_header_name", type: "string (header only)", required: false, description: "The header that carries the key, e.g. X-Api-Key." }
+    ],
+    returns: "{ registered:true, upstream:{ name, base_url, allowed_methods, allowed_path_prefixes, auth_type, auth_header_name, has_secret, apps, created_at }, next } \u2014 or { registered:false, name, secret_url, note } for bearer / header",
+    example: { workspace: "acme-crew", name: "pokeapi", base_url: "https://pokeapi.co", allowed_methods: ["GET"], allowed_path_prefixes: ["/api/v2/"], auth_type: "none" }
+  },
+  {
+    name: "remove_upstream",
+    title: "Remove a proxy upstream",
+    scope: "write (workspace-admin role in the workspace)",
+    description: "Delete a registered upstream and its stored key \u2014 the dashboard's Delete on the Upstreams page. Every app that calls it gets 404 upstream_not_registered at once, so it needs `user_confirmed: true` \u2014 set it ONLY after the user explicitly said yes to removing exactly this upstream; without it the answer is user_confirmation_required with the `apps` that use it, and nothing changes. Registering the name again creates a new record: each app's assignment then needs a new confirmation.",
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
+    fields: [
+      { name: "workspace", type: "string", required: true, description: "The workspace slug." },
+      { name: "name", type: "string", required: true, description: "A registered upstream (list_upstreams lists them)." },
+      { name: "user_confirmed", type: "boolean", required: false, description: "true ONLY after the user explicitly said yes to removing it." }
+    ],
+    returns: "{ removed:name, apps:[slug], note }",
+    example: { workspace: "acme-crew", name: "pokeapi", user_confirmed: true }
+  },
   {
     name: "set_workspace_publishing",
     title: "Set a workspace's publishing",
@@ -362,6 +424,16 @@ var TOOL_DOCS = [
 ];
 var TOOL_NAMES = TOOL_DOCS.map((t) => t.name);
 
+// packages/agent-dx/dist/plugin.js
+var PLUGIN_REPO = "freema/drobek-plugin";
+var PLUGIN_REPO_URL = `https://github.com/${PLUGIN_REPO}`;
+var PLUGIN_MARKETPLACE = "drobek";
+var PLUGIN_NAME = "drobek";
+var PLUGIN_MARKETPLACE_ADD_COMMAND = `claude plugin marketplace add ${PLUGIN_REPO}`;
+var PLUGIN_INSTALL_COMMAND = `claude plugin install ${PLUGIN_NAME}@${PLUGIN_MARKETPLACE}`;
+var PLUGIN_BUILD_COMMAND = `/${PLUGIN_NAME}:build-app`;
+var PLUGIN_PORT_COMMAND = `/${PLUGIN_NAME}:port-artifact`;
+
 // packages/agent-dx/dist/errors-catalogue.js
 var ERROR_CATALOGUE = [
   // ── MCP tools (isError: true, body { code, message, hint }) ───────────────
@@ -463,10 +535,16 @@ var ERROR_CATALOGUE = [
   },
   {
     code: "gallery_disabled",
-    surface: "MCP tool isError (set_gallery_listing)",
+    surface: "MCP tool isError (set_gallery_listing, duplicate_app)",
     meaning: "This server runs no public gallery (its operator left GALLERY_ENABLED off). Nothing changed.",
     fix: "Tell the user this server has no public gallery; do not retry."
   },
+  {
+    code: "not_duplicable",
+    surface: "MCP tool isError (duplicate_app); dashboard 403 (duplicate page)",
+    meaning: "The app is in the public gallery, but its owner did not allow duplicates. Nothing was created.",
+    fix: "Do not retry and do not copy the app another way. Tell the user its owner does not allow copies; they can build their own app with create_app."
+  },
   {
     code: "asset_too_large",
     surface: "MCP tool isError (create_asset_upload); upload URL 413",
@@ -545,6 +623,12 @@ var ERROR_CATALOGUE = [
     meaning: "A DNS lookup timed out or the resolver failed (SERVFAIL, network), so the records could not be checked. Nothing changed \u2014 an existing verification is kept.",
     fix: "Try verify_domain again in a few minutes; if it keeps failing, the domain's DNS servers may be down \u2014 tell the user."
   },
+  {
+    code: "upstream_already_registered",
+    surface: "MCP tool isError (register_upstream)",
+    meaning: "The workspace already has an upstream with this name. Nothing changed.",
+    fix: "list_upstreams shows it; use it as it is, pick another name, or remove_upstream it first (the user confirms) and register it again."
+  },
   {
     code: "internal_error",
     surface: "MCP tool isError",
@@ -611,9 +695,9 @@ var ERROR_CATALOGUE = [
   },
   {
     code: "rate_limited",
-    surface: "module route 429 (DrobekError), Retry-After; MCP tool isError (create_asset_upload)",
-    meaning: "A module limit was hit (per visitor, per user or per app \u2014 `details.limit` per `details.window_seconds`). From create_asset_upload: the app has asked for APP_ASSET_UPLOADS_PER_HOUR upload URLs within the last hour.",
-    fix: "Show the user a message and retry after Retry-After seconds; never loop. For upload URLs: upload the files you already have URLs for, and ask for more after the hour."
+    surface: "module route 429 (DrobekError), Retry-After; MCP tool isError (create_asset_upload, duplicate_app); dashboard 429 (duplicate page)",
+    meaning: "A module limit was hit (per visitor, per user or per app \u2014 `details.limit` per `details.window_seconds`). From create_asset_upload: the app has asked for APP_ASSET_UPLOADS_PER_HOUR upload URLs within the last hour. From duplicate_app: the user made DUPLICATES_PER_USER_HOUR copies of gallery apps within the last hour (`limit`, `value`).",
+    fix: "Show the user a message and retry after Retry-After seconds; never loop. For upload URLs: upload the files you already have URLs for, and ask for more after the hour. For duplicate_app: tell the user to try again in an hour; do not retry."
   },
   {
     code: "payload_too_large",
@@ -757,6 +841,11 @@ var LIMITS = [
     default: "60",
     meaning: "Upload URLs one app may get per hour (create_asset_upload \u2192 rate_limited)."
   },
+  {
+    env: "DUPLICATES_PER_USER_HOUR",
+    default: "10",
+    meaning: "Copies of gallery apps one person may make per hour, duplicate_app and the dashboard together (\u2192 rate_limited)."
+  },
   {
     env: "tool: asset upload URL",
     default: "30 min, single use",
@@ -805,16 +894,6 @@ var DOC_PAGES = {
   licensing: "https://github.com/freema/drobek/blob/main/docs/LICENSING.md"
 };
 
-// packages/agent-dx/dist/plugin.js
-var PLUGIN_REPO = "freema/drobek-plugin";
-var PLUGIN_REPO_URL = `https://github.com/${PLUGIN_REPO}`;
-var PLUGIN_MARKETPLACE = "drobek";
-var PLUGIN_NAME = "drobek";
-var PLUGIN_MARKETPLACE_ADD_COMMAND = `claude plugin marketplace add ${PLUGIN_REPO}`;
-var PLUGIN_INSTALL_COMMAND = `claude plugin install ${PLUGIN_NAME}@${PLUGIN_MARKETPLACE}`;
-var PLUGIN_BUILD_COMMAND = `/${PLUGIN_NAME}:build-app`;
-var PLUGIN_PORT_COMMAND = `/${PLUGIN_NAME}:port-artifact`;
-
 // packages/agent-dx/dist/render.js
 var AGENT_GUIDE_URL = DOC_PAGES.agent;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@freema/drobek-modules",
-  "version": "0.3.3",
+  "version": "0.5.0",
   "description": "The drobek platform module contract, registry and runtime: defineModule, the ModuleContext and the test kit (@drobek/modules/testing).",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -42,7 +42,7 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@drobek/sdk": "npm:@freema/drobek-sdk@0.3.3",
+    "@drobek/sdk": "npm:@freema/drobek-sdk@0.5.0",
     "@paralleldrive/cuid2": "^2.2.2",
     "esbuild": "^0.25.0",
     "ioredis": "^5.6.0",