### Create it in the dashboard
Open **Modules** and select **New Module**. The module dialog exposes the same
fields as the JSON contract: name, description, category, optional icon and
link, input descriptors, and payload. Saving creates the library record
immediately; the page also supports editing, cloning, exporting, and deletion.
There is no dashboard module-import action, so an exported definition must be
re-created in the editor or reviewed and added to `modules/` as a seed. The
backend reads top-level `*.json` files from that directory at startup only when
the module library is empty; adding a file does not update an initialized
library.
### Runtime lifecycle
A module is stored as a JSON definition. An operator selects it for an active
session and supplies its declared inputs. The campaign service then:
1. resolves `{{victim_id}}`, `{{module_id}}`, and declared
`{{ params[id] }}` placeholders;
2. places the HTML inside a managed full-screen overlay;
3. extracts scripts from the payload;
4. sends the HTML and JavaScript over the active session channel;
5. provides `__removeModule()` for deterministic DOM cleanup.
Use a module for one bounded interaction. Do not leave global event listeners,
timers, media tracks, overlays, or modified page state behind after completion.
### Module definition
Use `modules/_example-template.json` to understand the available fields, then
keep the finished definition strict and self-contained. This minimal example
uses no interpolated input:
```json assessment-marker.json theme={"system"}
{
"name": "Assessment marker",
"description": "Shows an approved message briefly in the active session.",
"category": "Awareness",
"icon": null,
"inputs": [],
"payload": "Authorized assessment marker
",
"link": null
}
```
The underscore in `_example-template.json` is a repository naming convention;
it is not a runtime exclusion rule. Add only finished, reviewed seed definitions
to `modules/`.
### Inputs and output
Parameter substitution is textual. Treat every operator-supplied value as
untrusted and validate or encode it for the exact HTML, attribute, URL, or
JavaScript context where it is used. Prefer DOM APIs such as `textContent` when
displaying values, and never build executable code from a parameter.
If a module must return approved, bounded results, post them to the
campaign-local collection route `c/{{victim_id}}` with:
* `data_type: "module_data"`;
* the resolved `{{module_id}}`;
* a small JSON `metadata` object containing only the required result.
For that campaign-local route, the module runtime adds the active session
collection credential to `fetch` requests. Do not copy that credential, log it,
or send it anywhere else.
Current module limits include 64 inputs, input IDs from 0 through 10,000, and a
1 MiB payload. See the complete [module format reference](/reference/module-format).