@freema/drobek-modules 0.3.3

package/dist/index.d.ts

@@ -0,0 +1,1604 @@
+import { ZodType, z } from 'zod';
+export { z } from 'zod';
+import { L as Logger, M as ModuleSecretDoc, H as HookApp, E as EndUser, D as DB, R as Rule, P as Principal, A as AccessDecision, a as ModuleLimit, b as Limits, C as ConfirmRole, c as AnyModule, d as EmailMessage, e as EmailKind, f as EmailRecipient, U as UploadedFile, g as EndUserListQuery, h as EndUserPage, i as EndUserRecord, O as OwnerFilesPage, j as OwnerFile, k as RecordsCollection, l as RecordsQuery, m as RecordsPage, S as SubmissionsQuery, n as SubmissionsPage, o as MailEnvelope, p as RateLimitResult, q as MailGuard, r as ModuleAvailability, s as ModuleDashboardEditor, t as ModuleErrorDoc, u as SdkBundle, v as ModuleServices, w as EndUserCallbackInput, x as EndUserCallbackResult } from './mail-guard.d-BKJhsVA2.js';
+export { B as BEACON_SCRIPT_PATH, y as BeaconScript, z as ComposedModuleParts, F as ConfirmContext, G as ConfirmItem, I as ConfirmedContext, J as DrobekModule, K as EndUserAuthority, N as EndUserCallbackApp, Q as FilesAuthority, T as MAIL_COUNTER_KEYS, V as MAIL_PAUSE_KEYS, W as MODULE_CONTRACT_VERSION, X as MODULE_ERROR_CODE_RE, Y as MODULE_NAME_RE, Z as MailAuthority, _ as MailBudgets, $ as MailClass, a0 as MailGuardConfig, a1 as MailGuardMeta, a2 as MailGuardRedis, a3 as MailPrepareInput, a4 as ModuleAppView, a5 as ModuleComposeInput, a6 as ModuleContext, a7 as ModuleDashboard, a8 as ModuleHooks, a9 as ModuleMigrations, aa as ModuleRequest, ab as ModuleResponse, ac as ModuleRouter, ad as ModuleSdk, ae as ModuleSkill, af as ModuleSlot, ag as OwnerSubmission, ah as OwnerView, ai as RECORDS_IMPORT_MAX_ROWS, aj as RecordsAuthority, ak as RecordsView, al as RouteHandler, am as RouteOptions, an as RouteRateLimit, ao as SDK_PATH, ap as SDK_TYPES_PATH, aq as SLOT_NAME_RE, ar as SubmissionsAuthority, as as buildBeaconScript, at as buildSdk, au as defineModule, av as inlineSpecifier, aw as isDefinedModule, ax as mailAppCounterKey, ay as mailBudgets, az as mailGuardConfigFromEnv, aA as memoryMailGuard, aB as memoryMailGuardRedis, aC as normalizeConfirmItems, aD as redisMailGuard, aE as respond, aF as sdkDeclarations } from './mail-guard.d-BKJhsVA2.js';
+export { SdkCore } from '@drobek/sdk';
+import { Readable } from 'node:stream';
+import { Redis } from 'ioredis';
+import 'drizzle-orm/postgres-js';
+
+/** Lazy shared ioredis client. Fails fast so /healthz can flip to 503. */
+declare function getRedis(): Redis {
+  if (!client) {
+    client = new Redis(requireRedisUrl(), { maxRetriesPerRequest: 2 });
+  }
+  return client;
+}
+
+/**
+ * Per-client-IP rate-limit keys (NSO-309, NSO-328). One implementation for
+ * every per-IP bucket in drobek: the dashboard sign-in guards, DCR, the app
+ * password gate, the module router's `per: 'ip'`, the proxy's `public-ip`, the
+ * error beacon and the abuse report form.
+ *
+ * A request whose client IP could not be resolved (no trusted proxy header —
+ * the plain-HTTP dev stack, a request that bypassed the proxy, a misconfigured
+ * `TRUST_PROXY`) gets NO per-IP bucket: the caller skips that check and keeps
+ * its other protections (per app, per principal, per code). The former
+ * `ip ?? 'unknown'` key put every such client into ONE shared bucket, so a
+ * handful of requests locked everybody out. Skipping loses nothing a spoofer
+ * could not already get by rotating forged headers.
+ *
+ * The first skip of each bucket logs one warning per process so a
+ * misconfigured proxy is visible without flooding the log.
+ */
+
+
+/**
+ * The key of the per-IP bucket `bucket` for this client: the resolved IP, or
+ * `null` when there is none — the caller must then skip the per-IP check
+ * (never substitute a shared placeholder). `bucket` only labels the warning.
+ */
+declare function perIpLimitKey(ip: string | null | undefined, bucket: string, log: Logger = defaultLog): string | null {
+  const key = ip?.trim();
+  if (key) return key;
+  if (!warnedBuckets.has(bucket)) {
+    warnedBuckets.add(bucket);
+    log.warn(
+      `[rate-limit] no client IP resolved — per-IP limit "${bucket}" skipped (check TRUST_PROXY and the proxy X-Real-IP header)`,
+      { event: 'rate_limit_no_client_ip', bucket }
+    );
+  }
+  return null;
+}
+
+/**
+ * What stored bytes ARE, decided from their first bytes — never from a
+ * client's Content-Type or a file name. PURE, shared by the files module
+ * (end-user uploads) and app assets (@drobek/apps, NSO-358), so both refuse
+ * the same disguised HTML page named `.png`.
+ *
+ *   image/png         89 50 4E 47 0D 0A 1A 0A
+ *   image/jpeg        FF D8 FF
+ *   image/gif         "GIF87a" | "GIF89a"
+ *   image/webp        "RIFF" …… "WEBP"
+ *   image/avif        …… "ftyp" + the "avif" / "avis" brand (major or compatible)
+ *   image/x-icon      00 00 01 00, at least one image, a zero reserved byte
+ *   application/pdf   "%PDF-"
+ *   video/mp4         …… "ftyp" + an MP4 brand (isom, mp41, mp42, avc1, M4V …)
+ *   audio/mp4         …… "ftyp" + the "M4A " / "M4B " brand
+ *   video/webm        1A 45 DF A3 (EBML) with the "webm" DocType in the header
+ *   audio/mpeg        "ID3" | an MPEG audio Layer III frame sync (FF Ex/Fx)
+ *   audio/ogg         "OggS"
+ *   audio/wav         "RIFF" …… "WAVE"
+ *   font/woff         "wOFF"
+ *   font/woff2        "wOF2"
+ *
+ * Other `ftyp` boxes (HEIC, QuickTime) are neither MP4 nor AVIF: their brands
+ * are not on the lists, so they sniff as nothing.
+ *
+ * SVG has no magic bytes: `looksLikeSvg` recognises an `<svg` root after an
+ * optional prolog. The caller checks that the whole stream is text.
+ */
+
+type SniffedType =
+  | 'image/png'
+  | 'image/jpeg'
+  | 'image/gif'
+  | 'image/webp'
+  | 'image/avif'
+  | 'image/x-icon'
+  | 'application/pdf'
+  | 'video/mp4'
+  | 'audio/mp4'
+  | 'video/webm'
+  | 'audio/mpeg'
+  | 'audio/ogg'
+  | 'audio/wav'
+  | 'font/woff'
+  | 'font/woff2';
+
+/** The type of some stored bytes from their first bytes (≥ SIGNATURE_HEAD_BYTES when there are that many), or null. */
+declare function sniffSignature(head: Buffer): SniffedType | null {
+  if (startsWith(head, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])) return 'image/png';
+  if (startsWith(head, [0xff, 0xd8, 0xff])) return 'image/jpeg';
+  if (startsWith(head, 'GIF87a') || startsWith(head, 'GIF89a')) return 'image/gif';
+  if (startsWith(head, 'RIFF') && startsWith(head, 'WEBP', 8)) return 'image/webp';
+  if (startsWith(head, 'RIFF') && startsWith(head, 'WAVE', 8)) return 'audio/wav';
+  if (startsWith(head, '%PDF-')) return 'application/pdf';
+  if (startsWith(head, 'ftyp', 4) && head.length >= 12) {
+    const { major, compatible } = ftypBrands(head);
+    if (AVIF_BRANDS.has(major) || compatible.some((b) => AVIF_BRANDS.has(b))) return 'image/avif';
+    if (MP4_BRANDS.has(major)) return 'video/mp4';
+    if (M4A_BRANDS.has(major)) return 'audio/mp4';
+    return null;
+  }
+  if (startsWith(head, [0x1a, 0x45, 0xdf, 0xa3])) {
+    return head.subarray(4, SIGNATURE_HEAD_BYTES).includes('webm', 0, 'latin1') ? 'video/webm' : null;
+  }
+  if (startsWith(head, 'OggS')) return 'audio/ogg';
+  if (startsWith(head, 'wOFF')) return 'font/woff';
+  if (startsWith(head, 'wOF2')) return 'font/woff2';
+  if (icoHeader(head)) return 'image/x-icon';
+  if (startsWith(head, 'ID3') || mp3FrameSync(head)) return 'audio/mpeg';
+  return null;
+}
+
+/**
+ * Does the (BOM-stripped) head start with an `<svg` root? Whitespace, then any
+ * mix of XML declarations / processing instructions (`<?…?>`) and comments
+ * (`<!--…-->`) — at most SVG_PROLOG_MAX_ITEMS — and one `<!DOCTYPE svg …>`
+ * (with an optional `[…]` internal subset), then `<svg`.
+ *
+ * A linear scanner on purpose: the regex it replaces backtracked
+ * exponentially on repeated `<?xml?>` (NSO-322 R1). Every step moves `i`
+ * forward through `indexOf`, so the cost is O(head length). An unterminated
+ * item is not an SVG.
+ */
+declare function looksLikeSvg(head: string): boolean {
+  let i = 0;
+  const skipSpace = (): void => {
+    while (i < head.length && isXmlSpace(head[i])) i++;
+  };
+  let doctype = false;
+  for (let items = 0; items <= SVG_PROLOG_MAX_ITEMS; items++) {
+    skipSpace();
+    if (head.startsWith('<?', i)) {
+      const end = head.indexOf('?>', i + 2);
+      if (end < 0) return false;
+      i = end + 2;
+      continue;
+    }
+    if (head.startsWith('<!--', i)) {
+      const end = head.indexOf('-->', i + 4);
+      if (end < 0) return false;
+      i = end + 3;
+      continue;
+    }
+    if (!doctype && matchesAt(DOCTYPE_SVG_RE, head, i)) {
+      doctype = true;
+      const gt = head.indexOf('>', i);
+      const bracket = head.indexOf('[', i);
+      if (gt < 0) return false;
+      if (bracket < 0 || gt < bracket) {
+        i = gt + 1;
+        continue;
+      }
+      // An internal subset: `[` … `]`, optional whitespace, `>`.
+      const close = head.indexOf(']', bracket + 1);
+      if (close < 0) return false;
+      i = close + 1;
+      skipSpace();
+      if (head[i] !== '>') return false;
+      i++;
+      continue;
+    }
+    return matchesAt(SVG_ROOT_RE, head, i);
+  }
+  return false;
+}
+
+/** A C0 control character other than tab, LF, CR (never in a text file drobek accepts). */
+declare function hasControlBytes(chunk: Buffer): boolean {
+  for (let i = 0; i < chunk.length; i++) {
+    const c = chunk[i];
+    if (c < 0x20 && c !== 0x09 && c !== 0x0a && c !== 0x0d) return true;
+  }
+  return false;
+}
+
+/**
+ * End-user sign-in providers (NSO-348, contract 1.1): the typed contract of
+ * the two slots the built-in `auth` module offers other modules.
+ *
+ *   `auth.provider` — a way to sign in besides the e-mail code (OIDC, SAML, …).
+ *     The provider only proves an identity `{ issuer, subject, email,
+ *     emailVerified, name? }`; `auth` keeps everything else — the allowlist, roles,
+ *     `mod_auth_users`, the session, `drobek.auth`, `<LoginGate>`.
+ *   `auth.signedIn` — an observer told about every successful sign-in (e.g.
+ *     a CRM sync); its failure is logged and never blocks the sign-in.
+ *
+ * A module contributes one of each at most:
+ *
+ *   export default defineModule({
+ *     name: 'oidc', …,
+ *     requires: ['auth'],
+ *     contributes: { 'auth.provider': defineAuthProvider({ id: 'oidc', label: 'Company SSO', … }) },
+ *   });
+ *
+ * The flow (docs/MODULES.md "Auth providers"): the app calls
+ * `drobek.auth.signIn(id)` → `POST /__drobek/v1/auth/begin` on the app host →
+ * `begin()` answers the IdP URL (state, nonce and a PKCE S256 challenge made
+ * by `auth`) → the IdP redirects to the ONE callback on the dashboard host,
+ * `/__drobek/auth/callback/<id>` (the `redirectUri`) → `callback()` answers
+ * the verified identity → a one-time handoff code carries it back to the app
+ * host, which sets the host-only session cookie.
+ *
+ * Providers are operator-installed server code (the module trust model);
+ * the types here are what `auth` guarantees them and asks of them.
+ */
+
+/** Provider ids: lowercase letters and digits, 2–16 characters (a URL segment, a config key, a secret prefix). */
+declare const AUTH_PROVIDER_ID_RE: RegExp;
+/** The provider id of the e-mail code (in `mod_auth_users.provider` and sessions) — no contribution may take it. */
+declare const EMAIL_PROVIDER_ID = "email";
+/** The keys `auth` adds to every provider's config entry — a provider's configSchema may not declare them. */
+declare const AUTH_RESERVED_CONFIG_KEYS: readonly ["enabled", "relinkByEmail"];
+/** The identity a provider proved (the IdP's verified answer — never a value the browser sent). */
+interface AuthIdentity {
+    /**
+     * The authority that asserted `subject`, as the provider VERIFIED it: OIDC —
+     * the `iss` of the validated ID token (the configured or discovered issuer,
+     * env fallbacks included); SAML — the assertion's Issuer. `auth` binds a
+     * person to (provider, issuer, subject) (OIDC Core §5.7): the same subject
+     * from another issuer is another person. Never a constant or a value the
+     * browser sent — max 2048 characters.
+     */
+    issuer: string;
+    /** The IdP's stable, unique id of the person at `issuer` (OIDC `sub`, SAML NameID) — max 255 characters. */
+    subject: string;
+    /** Their e-mail address (normalized to lower case by `auth`). */
+    email: string;
+    /**
+     * The IdP vouches for the address. `auth` refuses a sign-in with an
+     * unverified address (`email_not_verified`): the allowlist, `adminEmails`
+     * and the workspace-editor rule all decide by the address.
+     */
+    emailVerified: boolean;
+    /** A display name (optional, max 200 characters; passed to `auth.signedIn` observers, not stored). */
+    name?: string;
+}
+/**
+ * A secret a provider uses, declared under the `auth` module (per app,
+ * entered in the dashboard only). `name` starts with `<ID>_` (upper case),
+ * e.g. `OIDC_CLIENT_SECRET`.
+ */
+interface AuthProviderSecretDoc extends ModuleSecretDoc {
+    /**
+     * The operator's env var used when the app has no value of its own
+     * (`AUTH_<ID>_…`, e.g. `AUTH_OIDC_CLIENT_SECRET`) — one IdP for the whole
+     * self-hosted server.
+     */
+    env?: string;
+}
+/** The provider's secrets for ONE app: its declared names only (the app's value, else the declared env fallback). */
+interface AuthProviderSecrets {
+    get(name: string): Promise<string | null>;
+}
+interface AuthProviderInput<Config> {
+    app: HookApp;
+    /** The app's config of THIS provider (`auth.providers.<id>` without the keys auth adds), as its configSchema parsed it. */
+    config: Config;
+    secrets: AuthProviderSecrets;
+    /**
+     * The operator's `AUTH_<ID>_*` env vars (only those) — a provider's env
+     * fallback for config it may take from the server instead of the app.
+     */
+    env: Readonly<Record<string, string>>;
+    /**
+     * `<dashboard origin>/__drobek/auth/callback/<id>` — the ONE redirect URI
+     * to register at the IdP (the same for every app of the server).
+     */
+    redirectUri: string;
+    /** Opaque, signed and single-use: send it to the IdP (OIDC `state`, SAML `RelayState`), it comes back to the callback. */
+    state: string;
+    /** Random per sign-in (OIDC `nonce`): check the IdP's answer carries it. */
+    nonce: string;
+    log: Logger;
+}
+interface AuthProviderBeginInput<Config = unknown> extends AuthProviderInput<Config> {
+    /** PKCE: `BASE64URL(SHA-256(code_verifier))` — the verifier stays on the server. */
+    codeChallenge: string;
+    codeChallengeMethod: 'S256';
+}
+/** Where the browser goes to sign in: the IdP's authorization URL (a SAML provider: its HTTP-Redirect binding). */
+interface AuthProviderBeginResult {
+    /** https (http only outside production). */
+    url: string;
+}
+interface AuthProviderCallbackInput<Config = unknown> extends AuthProviderInput<Config> {
+    /**
+     * The callback's query parameters (first value of each). `auth` found the
+     * sign-in by its `state` (the `state` or `RelayState` parameter / form
+     * field) and consumed it before calling the provider.
+     */
+    query: Record<string, string>;
+    /** The form fields of a POST callback (`application/x-www-form-urlencoded`, e.g. a SAML response), else null. */
+    body: Record<string, string> | null;
+    /** The PKCE verifier of this sign-in (send it with the token request). */
+    codeVerifier: string;
+}
+/**
+ * A sign-in provider (the `auth.provider` slot). `begin` and `callback` are
+ * called unbound (`provider.begin(input)` on the parsed contribution): do
+ * not rely on `this`. A throw is logged by `auth` (the error's name only)
+ * and answers the user `provider_error` — never the IdP's details. Each
+ * call is cut off after 15 s.
+ */
+interface AuthProvider<Config = any> {
+    /** `AUTH_PROVIDER_ID_RE`, not `email`; unique within the slot. The `:provider` of the callback URL and the key of `auth.providers`. */
+    id: string;
+    /** What `<LoginGate>` shows: "Continue with <label>" (1–40 characters). */
+    label: string;
+    /**
+     * The per-app config of the provider (`auth.providers.<id>`), a zod OBJECT
+     * schema (`z.object` / `z.strictObject`) without the keys `auth` adds:
+     * `enabled: boolean` and `relinkByEmail?: boolean`. While disabled, every
+     * field is optional; enabling the provider validates the whole schema.
+     */
+    configSchema: ZodType<Config>;
+    /** Defaults merged under the app's config (optional; must pass `configSchema.partial()`). */
+    configDefaults?: Partial<Config>;
+    /**
+     * Config keys that decide WHO can sign in (e.g. `issuer`, `clientId`):
+     * changing one while the provider is enabled — and enabling it — waits for
+     * the app owner's confirmation. Their values and the operator's non-secret
+     * `AUTH_<ID>_*` env vars make the provider's connection: a change of either
+     * refuses the sign-ins in flight and ends the provider's sessions.
+     */
+    identityFields?: string[];
+    secrets?: AuthProviderSecretDoc[];
+    begin(input: AuthProviderBeginInput<Config>): Promise<AuthProviderBeginResult>;
+    callback(input: AuthProviderCallbackInput<Config>): Promise<AuthIdentity>;
+}
+/** What an `auth.signedIn` observer gets after a successful sign-in (e-mail code or provider). */
+interface AuthSignInEvent {
+    app: HookApp;
+    /** The signed-in user with the role they got (and the provider's display name, if any). */
+    user: EndUser & {
+        name?: string;
+    };
+    /** `email` (the e-mail code) or the provider id. */
+    provider: string;
+    /** The first sign-in of this user to the app. */
+    isNew: boolean;
+    db: DB;
+    log: Logger;
+}
+/** An observer of successful sign-ins (the `auth.signedIn` slot): run after the session exists, cut off after 5 s, errors logged. */
+interface AuthSignedInObserver {
+    /** Names the observer in logs (unique within the slot). */
+    id: string;
+    onSignIn(event: AuthSignInEvent): Promise<void> | void;
+}
+/** Type a provider contribution (identity at run time). */
+declare function defineAuthProvider<Config>(provider: AuthProvider<Config>): AuthProvider<Config>;
+/** Type a sign-in observer contribution (identity at run time). */
+declare function defineSignInObserver(observer: AuthSignedInObserver): AuthSignedInObserver;
+/** The `auth.provider` slot's schema (the contribution as `auth` gets it; unknown keys kept). */
+declare const authProviderSchema: ZodType<AuthProvider>;
+/** The `auth.signedIn` slot's schema. */
+declare const authSignedInObserverSchema: ZodType<AuthSignedInObserver>;
+/** What `auth` accepts from `callback()` (the address normalized to lower case). */
+declare const authIdentitySchema: z.ZodObject<{
+    issuer: z.ZodString;
+    subject: z.ZodString;
+    email: z.ZodPipe<z.ZodString, z.ZodEmail>;
+    emailVerified: z.ZodBoolean;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/**
+ * The ONE error shape every module route answers with (§3.5):
+ *   `{ error, message, details?, hint }` + an HTTP status.
+ * `hint` links the agent to the documentation — by default the module's own
+ * skill, `skill_info('<module>')`. Handlers throw ModuleError; anything else
+ * becomes a 500 `internal_error` without internals.
+ */
+type ModuleErrorCode = 'invalid_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'module_not_enabled' | 'method_not_allowed' | 'payload_too_large' | 'unsupported_media_type' | 'rate_limited' | 'limit_exceeded' | 'quota_exceeded' | 'conflict' | 'csrf_rejected' | 'password_required' | 'unavailable' | 'internal_error' | (string & {});
+/** Every code the platform answers module routes with (each has an agent-dx catalogue entry). */
+declare const MODULE_ERROR_CODES: readonly string[];
+/**
+ * Every code of the CORE error catalogue (`@drobek/agent-dx`
+ * `ERROR_CATALOGUE`, code-shaped entries): the module-route codes above plus
+ * the MCP tool, compile and OAuth codes. A module may not declare one of
+ * these in `errors`, and a module route may answer any of them. A unit test
+ * in @drobek/mcp keeps this list equal to the catalogue.
+ */
+declare const CORE_ERROR_CODES: readonly string[];
+interface ModuleErrorBody {
+    error: string;
+    message: string;
+    details?: unknown;
+    hint?: string;
+}
+/**
+ * Cross-instance brand: the dashboard's Vite SSR runner and the module
+ * processes can each hold their own copy of this class, and subclasses
+ * (`DataError`, …) rename `name`, so neither `instanceof` nor the name
+ * identifies a module error reliably. `Symbol.for` is shared per realm.
+ */
+declare const MODULE_ERROR_BRAND: unique symbol;
+declare class ModuleError extends Error {
+    readonly [MODULE_ERROR_BRAND]: true;
+    readonly code: ModuleErrorCode;
+    readonly status: number;
+    readonly details?: unknown;
+    readonly hint?: string;
+    readonly headers: Record<string, string>;
+    constructor(code: ModuleErrorCode, message: string, opts?: {
+        status?: number;
+        details?: unknown;
+        hint?: string;
+        headers?: Record<string, string>;
+    });
+    body(defaultHint?: string): ModuleErrorBody;
+}
+/**
+ * ModuleError by shape, not by class identity: a third-party module may bundle
+ * its own copy of this package, so `instanceof` is not enough.
+ */
+declare function isModuleError(err: unknown): err is ModuleError;
+/**
+ * NSO-346: an opt-in module (`availability: 'opt-in'`) that is not enabled
+ * for the app's workspace — the module route (404), configure_module and the
+ * owner's confirm answer this.
+ */
+declare function moduleNotEnabled(name: string): ModuleError;
+/** `skill_info('<name>')` — the hint every module error carries by default. */
+declare function skillHint(name?: string): string;
+/** zod issues → `[{ path: 'a.b[0]', message }]` (the agent-facing field paths). */
+declare function issuePaths(issues: ReadonlyArray<{
+    path: ReadonlyArray<PropertyKey>;
+    message: string;
+}>): {
+    path: string;
+    message: string;
+}[];
+
+/**
+ * The ONE rule evaluator every module uses (§5.0) — a pure function with
+ * table tests. A rule is a `|`-separated disjunction of principals:
+ *
+ *   public — anyone, signed in or not
+ *   user   — any end user signed in to this app
+ *   owner  — a signed-in user whose id equals the record's owner (`_owner`)
+ *   admin  — a signed-in user with role admin
+ *   none   — nobody (the operation is closed)
+ *
+ * Outcome: `{ ok: true }`, or 401 (anonymous and a sign-in could help) / 403
+ * (signed in but not allowed, or the rule admits nobody). An unknown token
+ * makes the rule invalid — `parseRule` reports it; `decideAccess` fails closed
+ * (403) on it.
+ */
+
+declare const RULE_TOKENS: readonly ["public", "user", "owner", "admin", "none"];
+type RuleToken = (typeof RULE_TOKENS)[number];
+/** The tokens of `rule`, or null when it contains an unknown/empty token. */
+declare function parseRule(rule: Rule): RuleToken[] | null;
+declare function isValidRule(rule: unknown): rule is Rule;
+/** Does `rule` let anyone in (`public`)? — the usual confirmRequired trigger. */
+declare function ruleIsPublic(rule: Rule): boolean;
+declare function decideAccess(rule: Rule, principal: Principal, ownerId?: string | null): AccessDecision;
+
+declare function mergePatch(target: unknown, patch: unknown): unknown;
+/** Structural equality of two JSON values (key order does not matter). */
+declare function jsonEqual(a: unknown, b: unknown): boolean;
+
+declare class Lru<V> {
+    readonly maxEntries: number;
+    private readonly map;
+    constructor(maxEntries: number);
+    get(key: string): V | undefined;
+    set(key: string, value: V): void;
+    clear(): void;
+    get size(): number;
+}
+/** JSON with object keys sorted at every level (so key order never changes the key). */
+declare function stableJson(value: unknown): string;
+/** A short content key of a JSON value: sha256 of its stable JSON. */
+declare function jsonKey(value: unknown): string;
+
+declare const LIMITS_CACHE_TTL_SEC = 60;
+declare const LIMITS_SIGNATURE_HEADER = "X-Drobek-Signature";
+declare const LIMITS_TIMESTAMP_HEADER = "X-Drobek-Timestamp";
+/**
+ * A catalogue entry: a module's limit, or a core limit that may take 0 (= off)
+ * and/or has a ceiling (`max`, the opt-in pseudo-limits: 0/1).
+ */
+type CatalogueLimit = ModuleLimit & {
+    allowZero?: boolean;
+    max?: number;
+};
+/** NSO-346: the pseudo-limit that enables an opt-in module for a workspace. */
+declare function moduleEnabledLimitName(module: string): string;
+/**
+ * The limits core enforces itself (NSO-329) — same env / provider mechanics
+ * as module limits, so a plan can set them per workspace. The SaaS limits
+ * provider mirrors this list (docs/MODULES.md "Limits"). DOMAINS_MAX_PER_APP's
+ * default must equal @drobek/domains DEFAULT_DOMAINS_MAX_PER_APP (guarded by
+ * a test in @drobek/mcp, which depends on both).
+ */
+declare const CORE_LIMITS: readonly CatalogueLimit[];
+interface LimitsProvider {
+    forWorkspace(workspaceId: string): Promise<Limits>;
+    /** The env-level values (no workspace): what skill_info documents. */
+    defaults(): Limits;
+    /**
+     * NSO-346: only the values the limits provider's plan sets for the workspace
+     * (validated, known names only) — null without a provider, or while it is
+     * unavailable. Tells an explicit plan value from the env default.
+     */
+    fromPlan?(workspaceId: string): Promise<Limits | null>;
+}
+type RedisLike$1 = {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, mode: 'EX', seconds: number): Promise<unknown>;
+};
+type FetchLike = (url: string, init: {
+    headers: Record<string, string>;
+    signal: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+interface LimitsProviderOptions {
+    catalogue: readonly CatalogueLimit[];
+    env?: NodeJS.ProcessEnv;
+    redis?: () => RedisLike$1;
+    fetch?: FetchLike;
+    log?: Logger;
+    now?: () => number;
+}
+/** HMAC-SHA256 signature of one provider request (exported for the provider side + tests). */
+declare function signLimitsRequest(secret: string, timestampSec: number, path: string): string;
+/** Startup check: LIMITS_PROVIDER_URL needs an http(s) URL and a strong secret. */
+declare function limitsProviderConfigError(env?: NodeJS.ProcessEnv): string | null;
+declare function createLimitsProvider(opts: LimitsProviderOptions): LimitsProvider;
+
+declare const END_USER_COOKIE = "__Host-drobek_eu";
+declare const END_USER_COOKIE_INSECURE = "drobek_eu";
+declare const END_USER_TOKEN_RE: RegExp;
+/** Session lifetime: 30 days, rolling. */
+declare const END_USER_SESSION_TTL_SEC: number;
+/** `__Host-` + Secure end-user cookies: production, and any https apps origin. */
+declare function endUserCookiesSecure(env?: NodeJS.ProcessEnv): boolean;
+declare function endUserCookieName(secure: boolean): string;
+/**
+ * The end-user Set-Cookie value: host-only (no Domain), Path=/, HttpOnly,
+ * SameSite=Lax; `__Host-` + Secure when `secure`. `clear` expires it.
+ */
+declare function endUserCookieHeader(token: string, opts: {
+    maxAgeSec: number;
+    clear?: boolean;
+}, secure: boolean): string;
+declare function endUserSessionKey(appId: string, token: string): string;
+declare function endUserEpochKey(appId: string): string;
+interface EndUserSession {
+    id: string;
+    email: string;
+    role: 'user' | 'admin';
+    /** The app's epoch when the session was issued. */
+    epoch: number;
+    /** How it signed in (`email` or an auth provider id); absent = `email`. */
+    provider?: string;
+    /** A provider session's connection fingerprint (see EndUser.connection). */
+    connection?: string;
+}
+/** The Redis subset the session helpers use (ioredis-compatible). */
+interface EndUserRedis {
+    mget(...keys: string[]): Promise<(string | null)[]>;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, mode: 'EX', seconds: number): Promise<unknown>;
+    del(...keys: string[]): Promise<number>;
+    incr(key: string): Promise<number>;
+}
+/** The end-user token of a Cookie header, or null (never a malformed value). */
+declare function readEndUserToken(cookieHeader: string | null, secure: boolean): string | null;
+declare function parseEndUserSession(raw: string | null): EndUserSession | null;
+/** The live session of `token` on `appId`: present, well-formed and of the current epoch — else null. */
+declare function loadEndUserSession(redis: Pick<EndUserRedis, 'mget'>, appId: string, token: string): Promise<EndUserSession | null>;
+/** Start a session for a verified end user of `appId` (current epoch, 30 days) → the token. */
+declare function createEndUserSession(redis: Pick<EndUserRedis, 'get' | 'set'>, appId: string, user: {
+    id: string;
+    email: string;
+    role: 'user' | 'admin';
+    provider?: string;
+    connection?: string;
+}): Promise<string>;
+/** Roll a live session forward another 30 days (and store a changed role). */
+declare function renewEndUserSession(redis: Pick<EndUserRedis, 'set'>, appId: string, token: string, session: EndUserSession): Promise<void>;
+declare function destroyEndUserSession(redis: Pick<EndUserRedis, 'del'>, appId: string, token: string): Promise<void>;
+/** Sign every end user of `appId` out (PHY-76 #9) → the new epoch. */
+declare function revokeEndUserSessions(redis: Pick<EndUserRedis, 'incr'>, appId: string): Promise<number>;
+/** Resolves the caller of one request on one app. */
+type PrincipalResolver = (input: {
+    app: HookApp;
+    cookieHeader: string | null;
+}) => Promise<Principal>;
+/** Who the user of a live session is NOW (null → the session ends). See EndUserAuthority. */
+type CurrentEndUser = (app: HookApp, user: EndUser) => Promise<EndUser | null>;
+/**
+ * The default resolver: end-user cookie → a live session of THIS app (current
+ * epoch) → `current(app, user)` → user with the CURRENT role. Anything
+ * missing, malformed, foreign, revoked or unreadable → anon (fail closed); no
+ * `current` (no module owns sessions) → anon. `current` answering null ends
+ * the session (deleted from Redis); `current` throwing → anon for this
+ * request only.
+ */
+declare function cookiePrincipalResolver(opts: {
+    redis: () => Pick<EndUserRedis, 'mget' | 'del'>;
+    secure: boolean;
+    current: CurrentEndUser | null;
+}): PrincipalResolver;
+
+declare const SECRET_NAME_RE: RegExp;
+declare const SECRET_MAX_BYTES: number;
+declare class SecretStoreError extends Error {
+    constructor(message: string);
+}
+/** Store (or rotate) one secret value. Dashboard-only; validates name + size. */
+declare function setModuleSecret(input: {
+    appId: string;
+    module: string;
+    name: string;
+    value: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<void>;
+declare function deleteModuleSecret(appId: string, module: string, name: string): Promise<boolean>;
+/** The plaintext (in memory only), or null when unset. Throws on a wrong/rotated KEK (fail closed). */
+declare function getModuleSecret(appId: string, module: string, name: string, env?: NodeJS.ProcessEnv): Promise<string | null>;
+/**
+ * When each of `names` was last set for this app + module (name → updated_at;
+ * unset names are absent) — for the dashboard's secrets form. Selects the name
+ * and the timestamp only: the ciphertext never leaves the database here.
+ */
+declare function secretsStatus(appId: string, module: string, names: string[]): Promise<Map<string, Date>>;
+/** Which of `names` are set for this app + module — names only, never values. */
+declare function secretsSet(appId: string, module: string, names: string[]): Promise<Set<string>>;
+
+/** A change held for the owner's confirmation (confirmRequired). */
+interface PendingChange {
+    /** The RFC 7396 merge patch the agent sent — applied on top of the config at confirm time. */
+    patch: Record<string, unknown>;
+    /** What needs confirming, verbatim from the module's confirmRequired. */
+    changes: string[];
+    proposed_at: string;
+    /** The dashboard user whose agent proposed it. */
+    proposed_by: string | null;
+    /** Who may confirm it (NSO-322 H3; missing on older rows = `editor`). */
+    confirm_role?: ConfirmRole;
+}
+interface ConfigRow {
+    config: Record<string, unknown>;
+    pending: PendingChange | null;
+    updatedAt: Date | null;
+}
+type Tx = Parameters<Parameters<DB['transaction']>[0]>[0];
+type Executor = DB | Tx;
+declare function readConfigRow(appId: string, module: string, executor?: Executor): Promise<ConfigRow>;
+
+/**
+ * The e-mail to an app's owners when an agent's configure_module leaves a
+ * change waiting for their confirmation (M2-02, NSO-291). Sent by the runtime
+ * through the normal module e-mail path (`{ appOwners: true }`, the mail
+ * authority = the `email` module, the operator-wide budgets), at most ONE per
+ * app per PENDING_MAIL_WINDOW_MS; each message lists EVERYTHING that is
+ * waiting for the app at that moment, so a burst of proposals is aggregated
+ * into one e-mail. The dashboard banner is the always-on signal.
+ */
+/** At most one pending-change e-mail per app per hour. */
+declare const PENDING_MAIL_WINDOW_MS: number;
+/** The rate-limit key of the per-app pending-change e-mail (`drobek:rl:` + this). */
+declare function pendingMailKey(appId: string): string;
+interface PendingMailModule {
+    module: string;
+    changes: string[];
+    /** The dashboard page where the owner reviews the module's pending change. */
+    confirmUrl: string;
+}
+/** Subject + plain text of the pending-change e-mail (the layout escapes the text). */
+declare function pendingMail(input: {
+    appName: string;
+    modules: PendingMailModule[];
+}): {
+    subject: string;
+    text: string;
+};
+
+/** The platform skill (installed into the agent) — never listed by skill_info. */
+declare const PLATFORM_SKILL_NAME = "drobek";
+interface SkillEntry {
+    name: string;
+    kind: 'module' | 'general';
+    useWhen: string;
+    markdown: string;
+    module?: AnyModule;
+}
+/** Split `---\nkey: value\n---\n` frontmatter off a SKILL.md. */
+declare function parseSkillMarkdown(text: string): {
+    meta: Record<string, string>;
+    body: string;
+};
+/**
+ * Where the general skills live: `DROBEK_SKILLS_DIR`, else `<cwd>/skills` (the
+ * production image copies the repo's `skills/` to `/app/skills`), else
+ * `<cwd>/../../skills` (the dev server runs in `apps/server`). null = none.
+ */
+declare function generalSkillsDir(env?: NodeJS.ProcessEnv, cwd?: string): string | null;
+/** Read every `<dir>/<name>/SKILL.md` except the platform skill. */
+declare function loadGeneralSkills(dir: string | null, log?: Logger): SkillEntry[];
+/**
+ * Backend packages an agent reaches for out of habit → the skill that does the
+ * job on drobek. An `unresolved_import` of one of them gets
+ * `hint: "skill_info('<skill>')"` (or `skill_info()` when this server has no
+ * such skill), so the agent learns the platform way instead of fighting the
+ * import map.
+ */
+declare const BACKEND_IMPORT_SKILLS: ReadonlyArray<readonly [prefix: string, skill: string]>;
+/** The skill for a backend-ish import specifier, or null. */
+declare function skillForImport(specifier: string): string | null;
+
+/**
+ * `ctx.email.send()` recipients (M1-01, M1-02, M1-04) — shared by the runtime
+ * and the test context so both resolve exactly the same way. A module never
+ * names an arbitrary address: it points at owner-confirmed config, at the
+ * signed-in end user, at the app's owners (verified drobek accounts), or
+ * (auth only) at the address being signed in with.
+ */
+
+declare const EMAIL_RE: RegExp;
+/** Longest message text a module may send (characters). */
+declare const MAX_EMAIL_TEXT = 20000;
+/** One header line: control characters (CR/LF/TAB, C0, DEL, U+2028/9) → a space, trimmed, capped. */
+declare function sanitizeSubject(subject: unknown): string;
+/** The message text, capped at MAX_EMAIL_TEXT characters (plain text; the layout escapes it). */
+declare function capEmailText(text: unknown): string;
+/** The recipient references of a message (one or several). */
+declare function recipientRefs(to: EmailMessage['to']): EmailRecipient[];
+/** A sign-in code, or a notification. */
+declare function emailKind(to: EmailMessage['to']): EmailKind;
+interface RecipientSources {
+    principal: Principal;
+    /** The sending module's effective config for this app. */
+    config: unknown;
+    /** The app's owners' addresses (only called when a message asks for them). */
+    owners?: () => Promise<string[]>;
+}
+/**
+ * The addresses a message goes to ([] = nobody), lowercased and de-duplicated.
+ * Throws `unauthorized` for `{ principal }` without a signed-in user.
+ */
+declare function resolveRecipients(to: EmailMessage['to'], src: RecipientSources): Promise<string[]>;
+
+/**
+ * `multipart/form-data` with TEXT fields only (M1-04) — what a plain
+ * `fetch(url, { body: new FormData(form) })` sends. The result is a plain
+ * object `{ name: value }`; a repeated name becomes an array of its values.
+ * A part with a `filename` (a file) is refused: modules take files through
+ * the files module, never inside another request.
+ *
+ * The body is already size-capped by the router before it gets here.
+ *
+ * `streamMultipartFile` is the other half: ONE file part, streamed (the
+ * `bodyTypes: ['file']` routes, i.e. the files module).
+ */
+
+/** The `boundary` parameter of a multipart Content-Type, or null. */
+declare function multipartBoundary(contentType: string | null): string | null;
+/** Parse a text-only multipart body into `{ name: value | value[] }`. */
+declare function parseMultipart(body: Buffer, contentType: string | null): Record<string, string | string[]>;
+/** Bytes before the first boundary + all part headers + the text fields before the file. */
+declare const MAX_FILE_HEAD_BYTES: number;
+/**
+ * Parse a `multipart/form-data` body that carries ONE file part WITHOUT
+ * buffering the file: the part headers (and any text fields before the file,
+ * at most 64 KiB together) are read up front, then `stream` yields the file's
+ * bytes as they arrive. A delimiter split across chunks is handled by holding
+ * back the last `boundary.length + 6` bytes. After the file only the closing
+ * delimiter may follow (a second part → `invalid_request` from the stream).
+ * Leaving the stream early — or finishing it — returns the source iterator,
+ * which lets the adapter discard the rest of the request.
+ */
+declare function streamMultipartFile(source: AsyncIterable<Buffer>, contentType: string | null): Promise<UploadedFile>;
+
+/**
+ * ModuleRouter (M1-01): the route table of one module and the request
+ * pipeline every module route goes through, in this order —
+ *
+ *   1. match method + path (404 / 405);
+ *   2. CSRF guard for mutations: an `Origin`, when present, must be the app
+ *      host itself (`null` and foreign origins → 403); with the default
+ *      `csrf: 'sdk-header'` also `X-Drobek-SDK: 1`;
+ *   3. the caller (principal) and this app's config → the route `rule`
+ *      (401 / 403);
+ *   4. rate limit (429 `rate_limited`, Retry-After);
+ *   5. body: JSON (or, when the route accepts it, text-only
+ *      multipart/form-data, or the raw bytes), size-capped, then the route's
+ *      zod schema; query too (400 `invalid_request` with
+ *      `details: [{ path, message }]`) — a `bodyTypes: ['file']` route
+ *      instead streams its one file through `req.file()` (the unread rest is
+ *      discarded after the handler);
+ *   6. the handler → JSON (or `respond(...)`), `Cache-Control: no-store`.
+ *
+ * Every failure answers the uniform `{ error, message, details?, hint }`.
+ */
+
+declare const DEFAULT_MAX_BODY_BYTES: number;
+declare const SDK_HEADER = "x-drobek-sdk";
+/** What the pipeline needs from the HTTP request (framework-free). */
+interface PipelineRequest {
+    method: string;
+    path: string;
+    query: string;
+    header(name: string): string | null;
+    /** Every header, lower-cased names (absent → ModuleRequest.headers() answers {}). */
+    headers?(): Record<string, string>;
+    clientIp: string | null;
+    /** The raw body up to `limit` bytes; 'too_large' past it. */
+    readBody(limit: number): Promise<Buffer | 'too_large' | null>;
+    /**
+     * The raw body as a stream, uncapped (`bodyTypes: ['file']` routes — the
+     * handler caps it). Call it at most once. `return()` abandons the rest: the
+     * adapter discards it without buffering. Adapters without it fall back to
+     * `readBody` (tests).
+     */
+    bodyStream?(): AsyncIterableIterator<Buffer>;
+}
+interface PipelineResult {
+    status: number;
+    headers: Record<string, string>;
+    /** A Node Readable is streamed by the adapter (and destroyed unread for HEAD). */
+    body: Buffer | string | Readable | null;
+}
+/** A Node Readable (a streamed response body)? */
+declare function isReadable(v: unknown): v is Readable;
+
+/**
+ * The streamed body of a CSV export (NSO-323 M5): CSV lines in, CRLF-terminated
+ * text chunks of about `chunkChars` out — so an export (the data module's
+ * `export.csv` on the app host, the dashboard's Data tab) holds one chunk in
+ * memory, never the whole file. `Readable.from(csvChunks(lines))` is a module
+ * route's streamed response body.
+ */
+declare function csvChunks(lines: AsyncIterable<string>, chunkChars?: number): AsyncGenerator<string>;
+
+/** Names a module may not take (they are path segments of `/__drobek/…`). */
+declare const RESERVED_MODULE_NAMES: Set<string>;
+declare class ModuleLoadError extends Error {
+    constructor(message: string);
+}
+/** `DROBEK_MODULES` → trimmed, de-duplicated entries (order kept). */
+declare function parseModuleList(raw: string | undefined): string[];
+/** The package an entry of DROBEK_MODULES refers to (rules 2 + 3 above). */
+declare function packageNameFor(entry: string): string;
+interface ResolveOptions {
+    /** Directory whose package.json the third-party modules are dependencies of. */
+    root?: string;
+    /** Test seam: import by specifier. */
+    importer?: (specifier: string) => Promise<unknown>;
+    /** Start-up warnings (a module without `contract`, an unused DROBEK_MODULE_<NAME>_DEFAULTS). */
+    log?: Logger;
+    /** The operator's modules directory (default: DROBEK_MODULES_DIR, else /data/modules). */
+    modulesDir?: string;
+}
+/** Where a module was loaded from: the modules directory or the server's own dependencies. */
+type ModuleSource = 'builtin' | 'dir';
+interface ModuleOrigin {
+    source: ModuleSource;
+    /** The install prefix `<DROBEK_MODULES_DIR>/<name>` of a dir module (null: builtin). Logs only — never served. */
+    path: string | null;
+}
+/** One module's contribution to a slot, as the slot's schema parsed it. */
+interface SlotContribution {
+    /** The contributing module. */
+    module: string;
+    value: unknown;
+}
+/**
+ * Every `contributes` of the active modules, checked against the slots they
+ * target and grouped by slot (each list in module order; every declared slot
+ * present, [] without contributions). Refuses the start on a contribution to
+ * a slot no active module declares, one that fails the slot's schema, and two
+ * contributions with the same value of the slot's `unique` key.
+ */
+declare function collectContributions(modules: AnyModule[]): Map<string, SlotContribution[]>;
+/**
+ * A slot host's module as composed from the contributions (`compose`): the
+ * parts it returns replace the declared ones (validated like a declared
+ * module: a zod configSchema, defaults that pass it, UPPER_SNAKE unique
+ * secret names). A module without `compose` is returned as is. Throws
+ * ModuleLoadError naming the module.
+ */
+declare function composeModule(m: AnyModule, contributions: <T = unknown>(slot: string) => T[]): AnyModule;
+/** An error code may be declared by one active module only (a clash refuses the start). */
+declare function checkErrorCodes(modules: AnyModule[]): void;
+/** The env var that overrides a module's config defaults: `DROBEK_MODULE_<NAME>_DEFAULTS`. */
+declare function moduleDefaultsEnvName(name: string): string;
+/**
+ * The config defaults of `m` on this server: its `configDefaults` with the
+ * operator's `DROBEK_MODULE_<NAME>_DEFAULTS` (a JSON merge patch) applied —
+ * validated by the module's configSchema (else ModuleLoadError with the issue
+ * paths).
+ */
+declare function effectiveConfigDefaults(m: AnyModule, env?: NodeJS.ProcessEnv): unknown;
+/**
+ * Every rule ACROSS the active modules (one owner per authority, `requires`,
+ * limit names, error codes, slots and contributions), the slot hosts'
+ * `compose`, then the operator's config-defaults overrides. Returns the
+ * modules composed and with their effective `configDefaults` (a module with
+ * neither is returned as is), in the same order. Throws ModuleLoadError.
+ */
+declare function checkModuleSet(modules: AnyModule[], env?: NodeJS.ProcessEnv, log?: Logger): AnyModule[];
+/**
+ * The one active module that owns app e-mail (`mail`), or null. Two would
+ * apply two policies to one message: refused at start.
+ */
+declare function mailAuthorityOf(modules: AnyModule[]): AnyModule | null;
+/**
+ * The one active module that stores the app's records (`records`), or null.
+ * query_data and the dashboard's data browser must read ONE store: two are
+ * refused at start.
+ */
+declare function recordsAuthorityOf(modules: AnyModule[]): AnyModule | null;
+/** The one active module that stores form submissions (`submissions`), or null (two refuse the start). */
+declare function submissionsAuthorityOf(modules: AnyModule[]): AnyModule | null;
+/** The one active module that stores end-user uploads (`files`), or null (two refuse the start). */
+declare function filesAuthorityOf(modules: AnyModule[]): AnyModule | null;
+/** Every module's `requires` must be active too (a clear start error names what to add). */
+declare function checkRequires(modules: AnyModule[]): void;
+/**
+ * The one active module that owns end-user sessions (`endUsers`), or null.
+ * Two owners would disagree about who is signed in: refused at start.
+ */
+declare function endUserAuthorityOf(modules: AnyModule[]): AnyModule | null;
+/** The active modules and where each came from (by module name). */
+interface LoadedModules {
+    modules: AnyModule[];
+    origins: Record<string, ModuleOrigin>;
+}
+/**
+ * Resolve + validate every DROBEK_MODULES entry (no duplicates, a short name
+ * loads a module of that name; a dir module also passes checkDirModule), then
+ * check the set (`checkModuleSet`). Returns the modules in DROBEK_MODULES
+ * order, with their effective config defaults, and their origins.
+ */
+declare function loadModuleSet(env?: NodeJS.ProcessEnv, opts?: ResolveOptions): Promise<LoadedModules>;
+/** `loadModuleSet` without the origins: the active modules in DROBEK_MODULES order. */
+declare function loadModules(env?: NodeJS.ProcessEnv, opts?: ResolveOptions): Promise<AnyModule[]>;
+
+/** `DROBEK_MODULES_DIR` when unset (the `modules_data` volume in the image). */
+declare const DEFAULT_MODULES_DIR = "/data/modules";
+
+type RateLimiter = (key: string, max: number, windowMs: number) => Promise<RateLimitResult>;
+/** One outgoing message to ONE address (recipients never see each other). */
+interface TransportMessage extends MailEnvelope {
+    to: string;
+    subject: string;
+    text: string;
+}
+interface EmailTransport {
+    send(message: TransportMessage): Promise<void>;
+}
+interface RuntimeDeps {
+    env: NodeJS.ProcessEnv;
+    log: Logger;
+    db: () => DB;
+    limits: LimitsProvider;
+    principal: PrincipalResolver;
+    rateLimit: RateLimiter;
+    email: EmailTransport;
+    /** The operator-wide hourly cap on module e-mail (auto-pause). */
+    mailGuard: MailGuard;
+    /**
+     * Count one response of a MATCHED route of an active module (M1-07 — get_logs
+     * `requests`; never a 429, an unknown route or a wrong method). Best-effort:
+     * never awaited by the response, errors dropped.
+     */
+    requestStats?: (appId: string, module: string, status: number) => Promise<void> | void;
+}
+type RedisLike = ReturnType<typeof getRedis>;
+/** Fixed-window counter in Redis (atomic INCR + PEXPIRE), `drobek:rl:` keys. */
+declare function redisRateLimiter(redis: () => Pick<RedisLike, 'incr' | 'pexpire' | 'ttl'>): RateLimiter;
+/** In-process fixed-window counter (tests; `now` is the clock seam). */
+declare function memoryRateLimiter(now?: () => number): RateLimiter & {
+    reset(): void;
+};
+/** Plain-text mail through the operator's transport (@drobek/email: SMTP or Resend per EMAIL_TRANSPORT — the transport of the login codes too). */
+declare function smtpEmailTransport(log: Logger, env?: NodeJS.ProcessEnv): EmailTransport;
+/** The addresses of an app's owners: the editors and workspace-admins of its workspace. */
+declare function appOwnerEmails(db: DB, workspaceId: string): Promise<string[]>;
+/** What serving hands over for a `/__drobek/*` request. */
+interface PlatformRequest extends PipelineRequest {
+}
+/** The app behind the host (resolved + visibility-gated by @drobek/serving). */
+interface PlatformApp {
+    id: string;
+    slug: string;
+    workspaceId: string;
+}
+interface SkillListItem {
+    name: string;
+    use_when: string;
+    /** NSO-346: only on an opt-in module's skill — it is active only for the workspaces it is enabled for. */
+    availability?: 'opt-in';
+    /** NSO-346: skill_info() with an app, on an opt-in module's skill: active for the app's workspace. */
+    enabled_for_workspace?: boolean;
+}
+/** NSO-346: what decides that an opt-in module is on or off for a workspace. */
+type WorkspaceModuleSource = 'dashboard' | 'plan' | 'env';
+/** NSO-346: one opt-in module for one workspace (the dashboard's Workspace → Modules). */
+interface WorkspaceModuleState {
+    name: string;
+    version: string;
+    use_when: string;
+    /** Active for the workspace now. */
+    enabled: boolean;
+    /**
+     * What decides it: the limits provider's plan (`MODULE_ENABLED_<NAME>`, 1 or
+     * 0), the operator's env (`MODULE_ENABLED_<NAME>=1`), or the super-admin's
+     * switch; null = nothing enables it.
+     */
+    source: WorkspaceModuleSource | null;
+    /** The super-admin's switch (a `workspace_modules` row) — a plan value overrides it. */
+    dashboard: {
+        enabled: boolean;
+        enabled_by: string | null;
+        enabled_at: string | null;
+    };
+}
+interface SkillInfo {
+    name: string;
+    kind: 'module' | 'general';
+    use_when: string;
+    content: string;
+    sdk?: {
+        import: string;
+        types: string;
+        inline?: {
+            import: string;
+            types: string;
+        };
+    };
+    config?: {
+        schema: unknown;
+        defaults: unknown;
+        confirm_required: string;
+    };
+    limits?: {
+        name: string;
+        value: number;
+        meaning: string;
+    }[];
+    secrets?: {
+        name: string;
+        description: string;
+        required: boolean;
+    }[];
+    /** A module's own error codes (the core ones are in the catalogue of /llms-full.txt); [] when it declares none. */
+    errors?: ModuleErrorDoc[];
+    /** Who the module is for: every workspace (`default`) or the workspaces it is enabled for (`opt-in`). */
+    availability?: ModuleAvailability;
+    /** A module's own semver, where it was loaded from, the contract range it declares (null: none) and the modules it requires. */
+    version?: string;
+    source?: ModuleSource;
+    contract?: string | null;
+    requires?: string[];
+    /** The extension points the module offers (with who contributes) and its own contributions to other modules' slots. */
+    slots?: ModuleFacts['slots'];
+    contributes?: ModuleFacts['contributes'];
+    /** NSO-346: skill_info with an app: whether this opt-in module is active for the app's workspace. */
+    enabled_for_workspace?: boolean;
+}
+/**
+ * The operator-facing facts of one active module, app-independent (NSO-347):
+ * the dashboard's workspace Modules page and the module page's "About", and
+ * the same fields in `skill_info(name)`. Never a path on disk, never a
+ * secret, never an app's config.
+ */
+interface ModuleFacts {
+    name: string;
+    version: string;
+    source: ModuleSource;
+    /** The contract range the module declares (`contract`), null when it declares none. */
+    contract: string | null;
+    availability: ModuleAvailability;
+    requires: string[];
+    /** Its slots: name, what a contribution does, the unique key, and the active modules contributing (with their unique value). */
+    slots: {
+        name: string;
+        description: string;
+        unique: string | null;
+        contributions: {
+            module: string;
+            key: string | null;
+        }[];
+    }[];
+    /** Its contributions to other modules' slots: the slot, the host module and the contribution's unique value (null without one). */
+    contributes: {
+        slot: string;
+        host: string;
+        key: string | null;
+    }[];
+    /** The limits it declares with the server's values (env or the module default; a workspace's plan may differ: workspaceLimits). */
+    limits: {
+        name: string;
+        default: number;
+        meaning: string;
+    }[];
+    /** Its own error codes (beyond the core catalogue). */
+    errors: ModuleErrorDoc[];
+    /** The dedicated dashboard editor its config declares it fits (`dashboard.editor`), null for the generic form. */
+    editor: ModuleDashboardEditor | null;
+}
+/** One module's own error codes (a section of the error catalogue). */
+interface ModuleErrorSection {
+    module: string;
+    errors: ModuleErrorDoc[];
+}
+interface AppModuleState {
+    /** NSO-346: active for the app's workspace (always true for a default module). */
+    enabled: boolean;
+    configured: boolean;
+    config: unknown;
+    pending: boolean;
+    pending_confirmation?: string[];
+    /** Only a workspace admin can confirm the pending change (absent: any editor). */
+    confirm_role?: 'admin';
+    confirm_url?: string;
+    secrets?: {
+        name: string;
+        hasSecret: boolean;
+    }[];
+    /** The module's `appInfo` (secret-free), when it declares one. */
+    info?: Record<string, unknown>;
+}
+interface ConfigureInput {
+    app: {
+        id: string;
+        slug: string;
+        workspaceId: string;
+        workspaceSlug: string;
+    };
+    module: string;
+    patch: unknown;
+    /** The dashboard user whose agent calls (audit + pending.proposed_by). */
+    actorUserId: string;
+    /**
+     * Who changes the config: `mcp` (default — configure_module, audit actor
+     * `agent`, the owners get the pending-change e-mail) or `web` (the owner's
+     * own dashboard form, audit actor `user`, no e-mail: they are looking at it).
+     */
+    surface?: 'mcp' | 'web';
+}
+interface ConfigureResult {
+    module: string;
+    applied: boolean;
+    /** The effective config now in force. */
+    config: unknown;
+    /** Changes waiting for the owner ([] when nothing waits). */
+    pending_confirmation: string[];
+    /** Only a workspace admin can confirm the pending change (absent: any editor). */
+    confirm_role?: 'admin';
+    confirm_url?: string;
+    secrets_missing?: string[];
+    unchanged?: true;
+    /** The module's `appInfo` for the config now in force (secret-free), when it declares one. */
+    info?: Record<string, unknown>;
+}
+/** The records store of one app (the module that declares `records`, bound to the app's config). */
+interface BoundRecords {
+    /** The module that stores the records (e.g. `data`). */
+    module: string;
+    collections(): Promise<RecordsCollection[]>;
+    query(query: RecordsQuery): Promise<RecordsPage>;
+    get(collection: string, id: string): Promise<Record<string, unknown> | null>;
+    remove(collection: string, id: string): Promise<boolean>;
+    csv(query: Omit<RecordsQuery, 'limit' | 'cursor'>): AsyncIterable<string>;
+    /** Replace a record's fields (owner edit); null when it does not exist. `unavailable` when the module cannot. */
+    update(collection: string, id: string, fields: Record<string, unknown>): Promise<Record<string, unknown> | null>;
+    /** All-or-nothing CSV import (see RecordsAuthority.importCsv). */
+    importCsv(collection: string, csv: string): Promise<{
+        imported: number;
+    }>;
+    /**
+     * Delete a collection: its records and its declaration in the module's
+     * config, in ONE transaction under the config lock; audited
+     * `data.collection_delete` (actor user).
+     */
+    dropCollection(collection: string, actorUserId: string): Promise<{
+        records: number;
+    }>;
+    /** Collections with records but no declaration (orphans); [] when the module cannot tell. */
+    orphans(): Promise<{
+        name: string;
+        records: number;
+    }[]>;
+    /**
+     * Purge the records of an orphan collection, under the config lock (so it
+     * cannot be declared meanwhile); audited `data.collection.purge` (actor user).
+     */
+    purgeOrphan(collection: string, actorUserId: string): Promise<{
+        records: number;
+    }>;
+}
+/** The end users of one app (the module that declares `endUsers`, bound to the app's config). */
+interface BoundEndUsers {
+    module: string;
+    list(query: EndUserListQuery): Promise<EndUserPage>;
+    /** Change a role; a config change is applied under the config lock and audited `end_users.role` (actor user). */
+    setRole(id: string, role: 'user' | 'admin', actorUserId: string): Promise<EndUserRecord>;
+    setDisabled(id: string, disabled: boolean): Promise<EndUserRecord | null>;
+}
+/** The form submissions of one app (the module that declares `submissions`). */
+interface BoundSubmissions {
+    module: string;
+    forms(): Promise<{
+        name: string;
+        submissions: number;
+    }[]>;
+    list(query: SubmissionsQuery): Promise<SubmissionsPage>;
+    csv(query: Omit<SubmissionsQuery, 'limit' | 'cursor'>): AsyncIterable<string>;
+    remove(id: string): Promise<boolean>;
+}
+/** The end-user uploads of one app (the module that declares `files`). */
+interface BoundFiles {
+    module: string;
+    list(query: {
+        limit?: number;
+        cursor?: string | null;
+    }): Promise<OwnerFilesPage>;
+    open(id: string): Promise<{
+        file: OwnerFile;
+        stream: Readable;
+    } | null>;
+    remove(id: string): Promise<boolean>;
+}
+/** A pending change as the dashboard shows it (M2-02). */
+interface PendingView {
+    /** What needs confirming, verbatim from the module's confirmRequired. */
+    changes: string[];
+    proposed_at: string;
+    proposed_by: string | null;
+    /** Who may confirm it: any editor, or only a workspace admin (NSO-322 H3). */
+    confirm_role: ConfirmRole;
+    /** The effective config once confirmed (null when it no longer validates). */
+    after: unknown;
+    /** Why confirming would fail now (the pending change no longer fits the config). */
+    invalid?: {
+        path: string;
+        message: string;
+    }[];
+}
+/** One module of one app, for the owner's dashboard (never a secret value). */
+interface ModuleDashboardView {
+    name: string;
+    version: string;
+    use_when: string;
+    /** The config's JSON Schema (zod → JSON Schema, input side), null when not representable. */
+    schema: unknown;
+    defaults: unknown;
+    /** What was set (sparse merge patch over the defaults). */
+    stored: Record<string, unknown>;
+    /** The effective config in force. */
+    config: unknown;
+    pending: PendingView | null;
+    /** Declared secrets: names, docs and whether/when they are set — never a value. */
+    secrets: {
+        name: string;
+        description: string;
+        required: boolean;
+        hasSecret: boolean;
+        updated_at: string | null;
+    }[];
+    /** The operations the module's rules cover (module.rules.ops). */
+    ops: Record<string, string>;
+    /** Whether some changes of this module wait for the owner (it declares confirmRequired). */
+    confirms: boolean;
+    /** The module's secret-free appInfo. */
+    info?: Record<string, unknown>;
+    /** Who the module is for (`default`: every workspace; `opt-in`: the workspaces it is enabled for). */
+    availability: ModuleAvailability;
+    /** The dedicated config editor the module declares (`dashboard.editor`), or null for the generic form. */
+    editor: ModuleDashboardEditor | null;
+    /** NSO-347 — the module's facts for the page's "About this module": where it came from, its contract range, requires, slots, contributions and error codes. */
+    source: ModuleSource;
+    contract: string | null;
+    requires: string[];
+    slots: ModuleFacts['slots'];
+    contributes: ModuleFacts['contributes'];
+    errors: ModuleErrorDoc[];
+    /** NSO-346: active for the app's workspace (an opt-in module may not be — the page then shows no form). */
+    enabled: boolean;
+}
+interface DecisionInput {
+    app: {
+        id: string;
+        slug: string;
+        workspaceId: string;
+    };
+    module: string;
+    userId: string;
+    /**
+     * The decider's role in the app's workspace: `admin` = workspace admin or
+     * super-admin. Default `editor` — a change that needs an admin is refused.
+     */
+    role?: ConfirmRole;
+}
+/** The dashboard page where the owner confirms a module change (M2-02 serves it). */
+declare function confirmUrl(env: NodeJS.ProcessEnv, workspaceSlug: string, appSlug: string, module: string): string;
+/** One active module as /healthz, /api/version and the start log show it — never a path on disk. */
+interface ModuleSummary {
+    name: string;
+    version: string;
+    source: ModuleSource;
+    /** The contract range the module declares (null: none). */
+    contract: string | null;
+}
+declare class ModuleRuntime {
+    readonly modules: AnyModule[];
+    readonly skills: SkillEntry[];
+    readonly sdk: SdkBundle;
+    readonly deps: RuntimeDeps;
+    private readonly routes;
+    private readonly byName;
+    /** Slot name → the contributions to it, in module order (checked at load). */
+    private readonly slotContributions;
+    /** Module → the error codes its routes may answer (the core catalogue + its own `errors`). */
+    private readonly errorCodes;
+    /**
+     * Effective configs by (module, content of the stored config) — NSO-322 H1:
+     * every module request used to re-run configSchema.safeParse (for data: an
+     * ajv compile per collection). Keyed on the stored JSON itself, so a
+     * configure / confirm (or a write by another process) is a new key and can
+     * never serve a stale config.
+     */
+    private readonly configMemo;
+    /** Module name → where it was loaded from (absent: builtin). */
+    private readonly origins;
+    constructor(input: {
+        modules: AnyModule[];
+        skills: SkillEntry[];
+        sdk: SdkBundle;
+        deps: RuntimeDeps;
+        origins?: Record<string, ModuleOrigin>;
+    });
+    get(name: string): AnyModule | undefined;
+    /**
+     * Where the active module `name` was loaded from — the single place that
+     * answers it (summary, moduleFacts, skill_info): `dir` when the
+     * DROBEK_MODULES_DIR loader found it in the operator's directory (its
+     * ModuleOrigin), `builtin` otherwise. Never a path on disk.
+     */
+    sourceOf(name: string): ModuleSource;
+    /** The active modules (name, version, source, contract) in DROBEK_MODULES order — for /healthz and /api/version. */
+    summary(): ModuleSummary[];
+    /**
+     * The contributions of the active modules to `slot`, in DROBEK_MODULES
+     * order, as the slot's schema parsed them ([] when nobody contributes or no
+     * active module declares the slot). With `enabled` (a workspace's
+     * enabledModules()) only those of the modules in it (NSO-360).
+     */
+    contributions<T = unknown>(slot: string, enabled?: ReadonlySet<string>): T[];
+    /** The services a hook (or a request context) gets; `enabled` scopes the contributions to a workspace's modules. */
+    services(enabled?: ReadonlySet<string>): ModuleServices;
+    /** The default (not opt-in) active modules: what is on when no workspace is known. */
+    private defaultModules;
+    /** The active modules' own error codes, one section per module that declares any (DROBEK_MODULES order). */
+    errorCatalogue(): ModuleErrorSection[];
+    /** The facts of one active module (see ModuleFacts), or null when no such module is active. */
+    moduleFacts(name: string): ModuleFacts | null;
+    /** The facts of every active module, in DROBEK_MODULES order. */
+    moduleFactsList(): ModuleFacts[];
+    /** The active modules declared `availability: 'opt-in'`. */
+    private optInModules;
+    /**
+     * Whether and why each opt-in module is on for `workspaceId`: the plan
+     * (limits provider, cached 60 s like every limit) wins in both directions,
+     * then the env value 1, then the super-admin's `workspace_modules` row
+     * (a primary-key read, so a toggle applies at once).
+     */
+    private optInStates;
+    /** NSO-346: is module `name` active for `workspaceId`? A default module always is; an unknown one never. */
+    isEnabled(workspaceId: string, name: string): Promise<boolean>;
+    /**
+     * NSO-346: the names of the active modules that are on for `workspaceId`
+     * (every default module + the enabled opt-in ones). No I/O when the server
+     * has no opt-in module. Compute it once per request and pass it on.
+     */
+    enabledModules(workspaceId: string): Promise<ReadonlySet<string>>;
+    /** NSO-346: every opt-in module with its state for `workspaceId` (the dashboard's Workspace → Modules). */
+    workspaceModules(workspaceId: string): Promise<WorkspaceModuleState[]>;
+    /**
+     * NSO-346: a super-admin turns an opt-in module on or off for a workspace
+     * (the dashboard's switch — the caller has checked super-admin). Audited
+     * `module.workspace_enable` / `module.workspace_disable` (meta: module) when
+     * it changes anything. A plan value (`MODULE_ENABLED_<NAME>`) still wins.
+     */
+    setWorkspaceModule(input: {
+        workspaceId: string;
+        module: string;
+        enabled: boolean;
+        actorUserId: string;
+    }): Promise<{
+        changed: boolean;
+    }>;
+    /**
+     * Who the user of a live session of `app` is NOW, according to the module
+     * that owns end-user sessions (its `endUsers.current` with this app's
+     * effective config and the contributions of the modules on for its
+     * workspace) — null when no active module owns sessions, it is off for the
+     * workspace, or the user may not be signed in any more.
+     */
+    currentEndUser(app: HookApp, user: EndUser): Promise<EndUser | null>;
+    /**
+     * The IdP callback of the end-user sign-in providers
+     * (`/__drobek/auth/callback/:provider` on the dashboard host): hands the
+     * request to the `endUsers` authority's `callback` with services that
+     * know no app yet — a callback-scoped rate limiter, the server's default
+     * limits, the default modules' contributions and `app(id)`, which the
+     * authority calls once its own signed state named the app (it carries the
+     * contributions of the app's workspace). No authority / no callback → 404
+     * page; a throw → a generic 500 page (logged without the error's text).
+     */
+    endUserCallback(input: Omit<EndUserCallbackInput, 'services'>): Promise<EndUserCallbackResult>;
+    /** A live app (not deleted, not taken down) as the end-user authority sees it in a callback, or null. */
+    private callbackApp;
+    /**
+     * The app's records store (the module that declares `records`, e.g. data),
+     * bound to the app's effective config — null when no active module stores
+     * records. For the OWNER's view (query_data, the dashboard): the caller has
+     * authorized a drobek account for the app already.
+     */
+    records(app: HookApp): Promise<BoundRecords | null>;
+    /**
+     * The effective limits of one workspace (NSO-329): the env defaults, or the
+     * limits provider's plan — CORE_LIMITS (APPS_MAX_PER_WORKSPACE,
+     * DOMAINS_MAX_PER_APP) and every module limit. For core callers: create_app
+     * and the dashboard's custom domains.
+     */
+    workspaceLimits(workspaceId: string): Promise<Limits>;
+    /** The OwnerView of `app` for an owner-facing authority (limits of the app's workspace, loaded once). */
+    private ownerView;
+    /**
+     * An OWNER's change of module `m`'s config for `app` (the dashboard, never
+     * an agent): under the config lock, `fn` gets the effective config and the
+     * transaction, does its own writes in it and returns a merge patch (or
+     * null); the patched config must pass configSchema. No confirmation: the
+     * owner is the one who confirms. A pending agent change stays pending.
+     */
+    private ownerConfigChange;
+    /** The app's end users (the module that declares `endUsers`), or null. */
+    endUsers(app: HookApp): Promise<BoundEndUsers | null>;
+    /** The app's form submissions (the module that declares `submissions`), or null. */
+    submissions(app: HookApp): Promise<BoundSubmissions | null>;
+    /** The app's end-user uploads (the module that declares `files`), or null. */
+    files(app: HookApp): Promise<BoundFiles | null>;
+    /**
+     * The skills list (skill_info(), create_app, get_app). Without `enabled`:
+     * every skill, an opt-in module's marked `availability: 'opt-in'`. With the
+     * app workspace's `enabled` set (enabledModules): the opt-in modules that
+     * are off for it are left out (NSO-346).
+     */
+    skillList(enabled?: ReadonlySet<string>): SkillListItem[];
+    /** One skill's documentation, or null (the caller answers not_found + the list). */
+    skillInfo(name: string): SkillInfo | null;
+    /**
+     * The hint for a compile message: backend imports point at the skill that
+     * replaces them — only when that skill is on the server and, given the app
+     * workspace's `enabled` set, its module is active there (NSO-346).
+     */
+    compileHint(msg: {
+        code?: string;
+        specifier?: string;
+    }, enabled?: ReadonlySet<string>): string | undefined;
+    /** The config's JSON Schema for forms (the INPUT side: defaulted keys are optional), or null. */
+    configJsonSchema(m: AnyModule): unknown;
+    /** The modules of `appId` with a change waiting for the owner (active modules only). */
+    pendingSummary(appId: string): Promise<{
+        module: string;
+        changes: string[];
+    }[]>;
+    /**
+     * One module of one app for the owner's dashboard (M2-02): schema, defaults,
+     * stored + effective config, the pending change with its effective result,
+     * the declared secrets with hasSecret / updated_at (NEVER a value), the rule
+     * operations and the module's secret-free appInfo.
+     */
+    moduleView(app: HookApp, name: string): Promise<ModuleDashboardView>;
+    /**
+     * The effective config of `module` for a stored (sparse) config. Memoized
+     * by content (configMemo); every caller gets its own copy, so a handler that
+     * mutates `ctx.config` cannot change what the next request sees. A stored
+     * config that fails configSchema is served through the module's
+     * `salvageConfig` when it has one, else as the defaults.
+     */
+    effectiveConfig(m: AnyModule, stored: Record<string, unknown>): unknown;
+    /**
+     * The secret-free `appInfo` of module `m` for `app` (undefined when the
+     * module has none, or it failed — logged, never fatal).
+     */
+    private appInfo;
+    /**
+     * get_app's `modules`. Pass the app (not only its id) to include each
+     * module's `info` (it needs the app's workspace). `enabled` = the app
+     * workspace's enabledModules() when the caller has it already.
+     */
+    appModules(app: string | HookApp, confirmLink?: (module: string) => string, enabled?: ReadonlySet<string>): Promise<Record<string, AppModuleState>>;
+    /** The workspace of an app id ('' when it does not exist: then only default modules are on). */
+    private workspaceOf;
+    private requireModule;
+    private validateConfig;
+    private missingSecrets;
+    /** configure_module: validate a partial config; apply it, or hold it for the owner. */
+    configure(input: ConfigureInput): Promise<ConfigureResult>;
+    /**
+     * E-mail the app's owners that changes wait for their confirmation (M2-02):
+     * through the module e-mail path (`{ appOwners: true }`, the mail authority
+     * — the `email` module — and the operator-wide budgets), at most once per
+     * app per hour (PENDING_MAIL_WINDOW_MS), listing every module that waits.
+     * Never fails the configure call: without a mail authority nothing is sent
+     * (the dashboard banner shows it), and any refusal is logged.
+     */
+    private notifyPendingOwners;
+    /** The owner confirms the pending change (dashboard): apply it on top of the current config. */
+    confirm(input: DecisionInput): Promise<{
+        module: string;
+        config: unknown;
+        confirmed: string[];
+    }>;
+    /** The owner rejects the pending change (dashboard): drop it, config unchanged. */
+    reject(input: DecisionInput): Promise<{
+        module: string;
+        config: unknown;
+        rejected: string[];
+    }>;
+    runHook(hook: 'onAppCreate' | 'onAppDelete', app: HookApp): Promise<void>;
+    runHook(hook: 'onPublish', app: HookApp & {
+        version: number;
+    }): Promise<void>;
+    /**
+     * `ctx.email.send` of module `m` for `app`: refuse `{ signInAddress }` from
+     * any module but the sign-in provider (`endUsers`), resolve the allowed recipients,
+     * refuse while module e-mail is paused, let the mail authority (the `email`
+     * module) apply the app's policy and envelope, count against the
+     * operator-wide hourly budget of the message's class (sign-in codes vs
+     * notifications, plus the app's and its workspace's shares — mail-guard.ts),
+     * send one message per address, audit.
+     */
+    private sendEmail;
+    /** Answer one `/__drobek/*` request of `app` (never throws). */
+    handle(req: PlatformRequest, app: PlatformApp): Promise<PipelineResult>;
+    /** get_logs `requests`: one response of a matched route of an active module (fire-and-forget). */
+    private countRequest;
+    private dispatch;
+    private serveSdk;
+    private serveBeaconScript;
+    /** A platform script: `?v=<hash>` → immutable, otherwise revalidated by ETag. */
+    private serveScript;
+    private context;
+}
+interface LoadRuntimeOptions extends ResolveOptions {
+    env?: NodeJS.ProcessEnv;
+    log?: Logger;
+    /** Use these modules instead of resolving DROBEK_MODULES (tests). */
+    modules?: AnyModule[];
+    /** Where the given `modules` came from (tests; absent: builtin). Ignored without `modules`. */
+    origins?: Record<string, ModuleOrigin>;
+    /** Directory of the general skills (default: generalSkillsDir()). null = none. */
+    skillsDir?: string | null;
+    /** Apply a module's migrations (default: runJournalMigrations against DATABASE_URL). */
+    migrate?: (folder: string, table: string) => Promise<void>;
+    deps?: Partial<RuntimeDeps>;
+}
+declare function moduleJournalTable(name: string): string;
+/** Load the active modules, apply their migrations, compose the SDK, collect the skills. */
+declare function loadModuleRuntime(opts?: LoadRuntimeOptions): Promise<ModuleRuntime>;
+/**
+ * The process-wide runtime: loaded once from the environment on first use
+ * (the server entry awaits it at boot, so a bad DROBEK_MODULES stops the
+ * start). Shared through globalThis with the dev server's Vite-loaded copy.
+ */
+declare function moduleRuntime(opts?: LoadRuntimeOptions): Promise<ModuleRuntime>;
+/**
+ * The active modules (name, version, source, contract) for `/healthz` and
+ * `/api/version` — never a path. The server entry loads the runtime at boot,
+ * so this only misses in tooling: then [].
+ */
+declare function activeModules(): Promise<ModuleSummary[]>;
+/** Tests: install a runtime (or null to reset). */
+declare function setModuleRuntimeForTests(runtime: ModuleRuntime | null): void;
+
+export { AUTH_PROVIDER_ID_RE, AUTH_RESERVED_CONFIG_KEYS, AccessDecision, AnyModule, BACKEND_IMPORT_SKILLS, CORE_ERROR_CODES, CORE_LIMITS, ConfirmRole, DB, DEFAULT_MAX_BODY_BYTES, DEFAULT_MODULES_DIR, EMAIL_PROVIDER_ID, EMAIL_RE, END_USER_COOKIE, END_USER_COOKIE_INSECURE, END_USER_SESSION_TTL_SEC, END_USER_TOKEN_RE, EmailKind, EmailMessage, EmailRecipient, EndUser, EndUserCallbackInput, EndUserCallbackResult, EndUserListQuery, EndUserPage, EndUserRecord, HookApp, LIMITS_CACHE_TTL_SEC, LIMITS_SIGNATURE_HEADER, LIMITS_TIMESTAMP_HEADER, Limits, Logger, Lru, MAX_EMAIL_TEXT, MAX_FILE_HEAD_BYTES, MODULE_ERROR_CODES, MailEnvelope, MailGuard, ModuleAvailability, ModuleDashboardEditor, ModuleError, ModuleErrorDoc, ModuleLimit, ModuleLoadError, ModuleRuntime, ModuleSecretDoc, ModuleServices, OwnerFile, OwnerFilesPage, PENDING_MAIL_WINDOW_MS, PLATFORM_SKILL_NAME, Principal, RESERVED_MODULE_NAMES, RULE_TOKENS, RateLimitResult, RecordsCollection, RecordsPage, RecordsQuery, Rule, SDK_HEADER, SECRET_MAX_BYTES, SECRET_NAME_RE, SdkBundle, SecretStoreError, SubmissionsPage, SubmissionsQuery, UploadedFile, activeModules, appOwnerEmails, authIdentitySchema, authProviderSchema, authSignedInObserverSchema, capEmailText, checkErrorCodes, checkModuleSet, checkRequires, collectContributions, composeModule, confirmUrl, cookiePrincipalResolver, createEndUserSession, createLimitsProvider, csvChunks, decideAccess, defineAuthProvider, defineSignInObserver, deleteModuleSecret, destroyEndUserSession, effectiveConfigDefaults, emailKind, endUserAuthorityOf, endUserCookieHeader, endUserCookieName, endUserCookiesSecure, endUserEpochKey, endUserSessionKey, filesAuthorityOf, generalSkillsDir, getModuleSecret, hasControlBytes, isModuleError, isReadable, isValidRule, issuePaths, jsonEqual, jsonKey, limitsProviderConfigError, loadEndUserSession, loadGeneralSkills, loadModuleRuntime, loadModuleSet, loadModules, looksLikeSvg, mailAuthorityOf, memoryRateLimiter, mergePatch, moduleDefaultsEnvName, moduleEnabledLimitName, moduleJournalTable, moduleNotEnabled, moduleRuntime, multipartBoundary, packageNameFor, parseEndUserSession, parseModuleList, parseMultipart, parseRule, parseSkillMarkdown, pendingMail, pendingMailKey, perIpLimitKey, readConfigRow, readEndUserToken, recipientRefs, recordsAuthorityOf, redisRateLimiter, renewEndUserSession, resolveRecipients, revokeEndUserSessions, ruleIsPublic, sanitizeSubject, secretsSet, secretsStatus, setModuleRuntimeForTests, setModuleSecret, signLimitsRequest, skillForImport, skillHint, smtpEmailTransport, sniffSignature, stableJson, streamMultipartFile, submissionsAuthorityOf };
+export type { AppModuleState, AuthIdentity, AuthProvider, AuthProviderBeginInput, AuthProviderBeginResult, AuthProviderCallbackInput, AuthProviderSecretDoc, AuthProviderSecrets, AuthSignInEvent, AuthSignedInObserver, BoundEndUsers, BoundFiles, BoundRecords, BoundSubmissions, ConfigRow, ConfigureInput, ConfigureResult, CurrentEndUser, DecisionInput, EmailTransport, EndUserRedis, EndUserSession, LimitsProvider, LoadRuntimeOptions, LoadedModules, ModuleDashboardView, ModuleErrorBody, ModuleErrorCode, ModuleErrorSection, ModuleFacts, ModuleOrigin, ModuleSource, ModuleSummary, PendingChange, PendingMailModule, PendingView, PipelineRequest, PipelineResult, PlatformApp, PlatformRequest, PrincipalResolver, RateLimiter, RecipientSources, RuntimeDeps, SkillEntry, SkillInfo, SkillListItem, SlotContribution, SniffedType, TransportMessage, WorkspaceModuleSource, WorkspaceModuleState };