feat: Module Package v1 carries the module's own license (ADR 0051)

Every Module Package v1 now declares the module's license and carries its
text. packageFormat stays 1; pre-ADR-0051 metadata fails closed.

- Contracts: ekklesia.package.json requires an SPDX `license` expression,
  validated with spdx-expression-parse, with UNLICENSED and non-expressions
  refused. The `files` list must hold exactly one non-empty root LICENSE.
  The package contracts move to the @ekklesia/contracts/module-package
  subpath, so the SPDX parser and its data (spdx-exceptions and
  spdx-license-ids ship no licence files) never reach a module bundle
  through the SDK's re-export of the contracts root.
- Packager: reads the source package.json's string SPDX declaration and
  never invents one. It requires an explicit --license-file (a non-empty
  regular file, no symlink, no parent search, no download) and copies its
  bytes unchanged to LICENSE, listed with size and SHA-256 and covered by
  the archive digest. THIRD_PARTY_NOTICES stays third-party only, and
  bundled Ekklesia code stays in `incorporates`.
- Verifier: rejects missing or invalid license metadata, and a missing,
  unlisted, duplicated, or corrupted LICENSE, through the schema and the
  existing strict inventory.
- Template: packaged as AGPL-3.0-or-later with the repository's canonical
  LICENSE, passed explicitly (Dockerfile, smoke, docs). Packing it twice
  gives byte-identical archives.

Started by Codex; reviewed and completed in Claude Code (empty license-text
refusal, schema non-empty LICENSE, symlink and empty-file tests).

ADR 0051 is Accepted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/tests/module-package.test.ts

@@ -1,13 +1,15 @@
 import { describe, expect, it } from "vitest";
 import {
   MODULE_PACKAGE_FORMAT,
+  MODULE_PACKAGE_LICENSE_FILENAME,
   MODULE_PACKAGE_METADATA_FILENAME,
   modulePackageArchiveFileName,
   modulePackageRuntimePackage,
+  safeParseModulePackageLicenseExpression,
   safeParseModulePackageMetadata,
   safeParseModulePackageRuntimePackage,
   safeParseModulePackageTarget,
-} from "../src/index.js";
+} from "../src/module-package.js";
 
 const digest = "a".repeat(64);
 
@@ -15,6 +17,7 @@ function metadata(overrides: Record<string, unknown> = {}): Record<string, unkno
   return {
     packageFormat: 1,
     module: { id: "example", version: "0.1.0" },
+    license: "AGPL-3.0-or-later",
     target: "any",
     runtime: { node: ">=24.11.0 <25" },
     provenance: {
@@ -24,6 +27,7 @@ function metadata(overrides: Record<string, unknown> = {}): Record<string, unkno
     incorporates: { "@ekklesia/contracts": "0.1.2", "@ekklesia/module-sdk": "0.1.2" },
     transitional: { databaseRuntime: { "drizzle-orm": "0.45.2" } },
     files: [
+      { path: "LICENSE", size: 9, sha256: digest },
       { path: "THIRD_PARTY_NOTICES", size: 10, sha256: digest },
       { path: "dist/server/index.js", size: 20, sha256: digest },
       { path: "ekklesia.module.json", size: 30, sha256: digest },
@@ -36,12 +40,46 @@ function metadata(overrides: Record<string, unknown> = {}): Record<string, unkno
 describe("Ekklesia Module Package v1 metadata (ADR 0049)", () => {
   it("names the format, its metadata file, and the recommended archive file name", () => {
     expect(MODULE_PACKAGE_FORMAT).toBe(1);
+    expect(MODULE_PACKAGE_LICENSE_FILENAME).toBe("LICENSE");
     expect(MODULE_PACKAGE_METADATA_FILENAME).toBe("ekklesia.package.json");
     expect(modulePackageArchiveFileName("example", "0.1.0", "any")).toBe(
       "example-0.1.0-any.tar.gz",
     );
   });
 
+  it("accepts SPDX license expressions and rejects non-expressions without a policy allowlist", () => {
+    for (const expression of [
+      "AGPL-3.0-or-later",
+      "MIT OR Apache-2.0",
+      "(MIT OR Apache-2.0) AND BSD-3-Clause",
+    ]) {
+      expect(safeParseModulePackageLicenseExpression(expression).success, expression).toBe(true);
+    }
+    for (const expression of ["", "UNLICENSED", "MIT OR", "not a license", {}]) {
+      expect(safeParseModulePackageLicenseExpression(expression).success, String(expression)).toBe(
+        false,
+      );
+    }
+  });
+
+  it("requires the package license declaration and canonical LICENSE payload entry", () => {
+    const withoutLicense = metadata();
+    delete withoutLicense.license;
+    expect(safeParseModulePackageMetadata(withoutLicense).success).toBe(false);
+
+    const withoutLicenseFile = metadata();
+    withoutLicenseFile.files = (withoutLicenseFile.files as { path: string }[]).filter(
+      (file) => file.path !== "LICENSE",
+    );
+    expect(safeParseModulePackageMetadata(withoutLicenseFile).success).toBe(false);
+
+    const emptyLicenseFile = metadata();
+    emptyLicenseFile.files = (emptyLicenseFile.files as { path: string; size: number }[]).map(
+      (file) => (file.path === "LICENSE" ? { ...file, size: 0 } : file),
+    );
+    expect(safeParseModulePackageMetadata(emptyLicenseFile).success).toBe(false);
+  });
+
   it("accepts a complete any-target package description", () => {
     expect(safeParseModulePackageMetadata(metadata()).success).toBe(true);
   });
@@ -97,7 +135,9 @@ describe("Ekklesia Module Package v1 metadata (ADR 0049)", () => {
     ).toBe(false);
     // Byte-wise, not locale order: upper case sorts before lower case.
     expect(
-      safeParseModulePackageMetadata(metadata({ files: [entry("THIRD"), entry("dist")] })).success,
+      safeParseModulePackageMetadata(
+        metadata({ files: [entry("LICENSE"), entry("THIRD"), entry("dist")] }),
+      ).success,
     ).toBe(true);
   });