feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/tests/pack-module.test.ts

@@ -23,7 +23,6 @@ async function pack(options: FixtureModuleOptions = {}, overrides: Record<string
   const result = await packModule({
     licenseFile: path.join(moduleDirectory, "LICENSE"),
     moduleDirectory,
-    nodeRange: ">=24.11.0 <25",
     outDirectory,
     sourceRevision: SOURCE_REVISION,
     target: "any",
@@ -379,6 +378,23 @@ describe("packModule: identity and inputs", () => {
     await packRejection({}, "MODULE_PACK_REVISION_INVALID", { sourceRevision: "86ae907" });
   });
 
+  it("takes the supported Node.js range from the module's own engines.node", async () => {
+    const { archive } = await pack({ engines: { node: ">=24.12.0 <25" } });
+    const metadata = JSON.parse(
+      fileEntries(archive).get("example/ekklesia.package.json")?.toString("utf8") ?? "",
+    );
+    expect(metadata.runtime).toEqual({ node: ">=24.12.0 <25" });
+  });
+
+  it("refuses a module that does not declare engines.node, without looking for a workspace", async () => {
+    for (const engines of [null, {}, { node: "" }, { node: 24 }]) {
+      const error = await packRejection({ engines }, "MODULE_PACK_RUNTIME_UNKNOWN");
+      expect(error.message).toBe(
+        "The module's package.json must declare the Node.js versions it supports in engines.node.",
+      );
+    }
+  });
+
   it("refuses an incorporated SDK outside the manifest's own range", async () => {
     await packRejection(
       {
@@ -392,6 +408,67 @@ describe("packModule: identity and inputs", () => {
   });
 });
 
+describe("packModule: recognising Ekklesia's packages by identity (ADR 0053)", () => {
+  async function metadataAndNotices(options: FixtureModuleOptions) {
+    const { archive } = await pack(options);
+    const files = fileEntries(archive);
+    return {
+      metadata: JSON.parse(files.get("example/ekklesia.package.json")?.toString("utf8") ?? ""),
+      notices: files.get("example/THIRD_PARTY_NOTICES")?.toString("utf8") ?? "",
+    };
+  }
+
+  it("incorporates registry-installed Ekklesia packages exactly as workspace-linked ones", async () => {
+    const options: FixtureModuleOptions = { databaseAbi: 1, withSchema: true };
+    const linked = await metadataAndNotices(options);
+    const installed = await metadataAndNotices({ ...options, ekklesiaInstall: "registry" });
+    expect(Object.keys(installed.metadata.incorporates).sort()).toEqual([
+      "@ekklesia/contracts",
+      "@ekklesia/module-database",
+      "@ekklesia/module-sdk",
+    ]);
+    expect(installed.metadata.incorporates).toEqual(linked.metadata.incorporates);
+    // Never credited as third-party code, however they were installed.
+    expect(installed.notices).not.toContain("@ekklesia/");
+    expect(linked.notices).not.toContain("@ekklesia/");
+  });
+
+  it("still checks a registry-installed SDK against the manifest's moduleSdk range", async () => {
+    await packRejection(
+      {
+        ekklesiaInstall: "registry",
+        manifest: (manifest) => ({
+          ...manifest,
+          compatibility: { platform: "^0.1.0", moduleSdk: "^9.0.0" },
+        }),
+      },
+      "MODULE_PACK_SDK_INCOMPATIBLE",
+    );
+  });
+
+  it("treats a package that only borrows the @ekklesia scope, or only the marker, as third-party", async () => {
+    const { metadata, notices } = await metadataAndNotices({
+      fakePackages: [
+        {
+          files: { "index.js": "export default 1;\n", LICENSE: MIT },
+          name: "@ekklesia/squatter",
+          packageJson: { ekklesia: { layer: "package" } },
+        },
+        {
+          files: { "index.js": "export default 2;\n", LICENSE: MIT },
+          name: "not-ekklesia",
+          packageJson: { ekklesia: { distribution: "module-development" } },
+        },
+      ],
+      serverSource:
+        'import a from "@ekklesia/squatter";\nimport b from "not-ekklesia";\nexport default { id: "example", version: "0.1.0", register() { return a + b; } };\n',
+    });
+    expect(metadata.incorporates).toEqual({});
+    expect(notices).toContain("\n@ekklesia/squatter 1.0.0\nLicense: MIT\n");
+    expect(notices).toContain("\nnot-ekklesia 1.0.0\nLicense: MIT\n");
+  });
+});
+
 describe("packModule: THIRD_PARTY_NOTICES", () => {
   const usesFake = (name: string) =>
     `import value from "${name}";\nexport default { id: "example", version: "0.1.0", register() { return value; } };\n`;