feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

core/src/modules/legacy-schema-definition.ts

@@ -0,0 +1,73 @@
+/**
+ * The legacy module schema definition (ADR 0007): a v8 module that declares no `database` default-
+ * exports `{ moduleId, tables }` with its Drizzle table objects themselves. Core alone validates it,
+ * for the legacy facade's deprecation window (ADR 0050). It lives here, beside Core's own Drizzle
+ * dependency, so that no package a module installs needs Drizzle at run time (ADR 0053).
+ *
+ * Erasable TypeScript with no relative imports: the verifier's probe imports this source file
+ * directly in tests (`module-package-probe.ts`).
+ */
+import { is } from "drizzle-orm";
+import { type AnyPgTable, PgTable } from "drizzle-orm/pg-core";
+import { type ModuleId, moduleIdSchema } from "@ekklesia/contracts";
+
+export interface ModuleSchemaDefinition<
+  Tables extends Readonly<Record<string, AnyPgTable>> = Readonly<Record<string, AnyPgTable>>,
+> {
+  readonly moduleId: ModuleId;
+  readonly tables: Tables;
+}
+
+const schemaDefinitionKeys = new Set(["moduleId", "tables"]);
+const drizzleTableIsAlias = Symbol.for("drizzle:IsAlias");
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function hasOnlyStringKeys(value: object, allowedKeys?: ReadonlySet<string>): boolean {
+  return Reflect.ownKeys(value).every(
+    (key) => typeof key === "string" && (!allowedKeys || allowedKeys.has(key)),
+  );
+}
+
+export function isModuleSchemaDefinition(value: unknown): value is ModuleSchemaDefinition {
+  try {
+    if (
+      !isRecord(value) ||
+      !hasOnlyStringKeys(value, schemaDefinitionKeys) ||
+      !moduleIdSchema.safeParse(value.moduleId).success ||
+      !isRecord(value.tables) ||
+      !hasOnlyStringKeys(value.tables)
+    ) {
+      return false;
+    }
+
+    const tables = Object.values(value.tables);
+    return (
+      tables.length > 0 &&
+      tables.every(
+        (table) =>
+          is(table, PgTable) &&
+          (table as unknown as Record<PropertyKey, unknown>)[drizzleTableIsAlias] === false,
+      )
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function parseModuleSchemaDefinition(value: unknown): ModuleSchemaDefinition {
+  if (!isModuleSchemaDefinition(value)) {
+    throw new TypeError("Invalid Ekklesia module schema definition.");
+  }
+
+  const tables = Object.freeze(
+    Object.fromEntries(
+      Object.entries(value.tables).sort(([left], [right]) =>
+        left < right ? -1 : left > right ? 1 : 0,
+      ),
+    ) as Record<string, AnyPgTable>,
+  );
+  return Object.freeze({ moduleId: value.moduleId, tables });
+}

core/src/modules/module-package-probe.ts

@@ -9,14 +9,15 @@
 // The result travels over the IPC channel, never stdout, so nothing a module prints can forge it.
 // It carries fixed role and reason names only: never an error message, a path, or module output.
 //
-// Written as erasable TypeScript with no relative imports, so Node can run the source file directly
-// in tests as well as the compiled file in the image.
+// Written as erasable TypeScript, so Node can run the source file directly in tests as well as the
+// compiled file in the image. Its one relative import names the source file's own extension, which
+// the build rewrites to `.js` (`rewriteRelativeImportExtensions`); that file follows the same rules.
 import { pathToFileURL } from "node:url";
 import {
   parseModuleRuntimeDefinition,
-  parseModuleSchemaDefinition,
   parseModuleSchemaMetadataDefinition,
 } from "@ekklesia/contracts";
+import { parseModuleSchemaDefinition } from "./legacy-schema-definition.ts";
 
 interface ProbeRequest {
   readonly databaseAbi?: 1;

core/src/modules/schema-discovery.ts

@@ -1,14 +1,16 @@
 import { pathToFileURL } from "node:url";
 import {
   type ModuleId,
-  type ModuleSchemaDefinition,
   type ModuleSchemaMetadataDefinition,
   moduleTableLocalNameSchema,
   moduleTablePrefix,
-  parseModuleSchemaDefinition,
   parseModuleSchemaMetadataDefinition,
   physicalModuleTableNameSchema,
 } from "@ekklesia/contracts";
+import {
+  type ModuleSchemaDefinition,
+  parseModuleSchemaDefinition,
+} from "./legacy-schema-definition.js";
 import { is } from "drizzle-orm";
 import { type AnyPgTable, getTableConfig, PgColumn, PgTable } from "drizzle-orm/pg-core";
 import {