feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/module-pack/tests/support/fixture-module.ts

@@ -1,4 +1,14 @@
-import { cp, mkdir, mkdtemp, realpath, rm, symlink, writeFile } from "node:fs/promises";
+import {
+  cp,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  realpath,
+  rm,
+  symlink,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -30,6 +40,12 @@ export interface FixtureModuleOptions {
   readonly serverSource?: string;
   readonly withModuleDatabase?: boolean;
   readonly withSchema?: boolean;
+  /** The module's `engines` field; omitted from `package.json` when `null`. */
+  readonly engines?: Record<string, unknown> | null;
+  /** How the module's `@ekklesia/*` dependencies are installed: linked to this workspace's packages
+   * (the default), or copied as real directories into a flat `node_modules`, as a registry install
+   * lays them out. */
+  readonly ekklesiaInstall?: "workspace" | "registry";
   readonly fakePackages?: readonly FakePackage[];
   readonly manifest?: (manifest: Record<string, unknown>) => Record<string, unknown>;
 }
@@ -63,12 +79,9 @@ const defaultServer = (
 export default defineModuleRuntime({ ${databaseAbi === 1 ? "database: { abi: 1 }, " : ""}id: ${JSON.stringify(id)}, version: ${JSON.stringify(version)}, register() {} });
 `;
 
-const schemaSource = (id: string, databaseAbi?: 1) => `${
-  databaseAbi === 1
-    ? 'import { moduleDrizzleSchemaMetadata } from "@ekklesia/module-database/drizzle";'
-    : 'import { defineModuleSchema } from "@ekklesia/module-sdk";'
-}
-import { createModuleTable } from "@ekklesia/module-sdk";
+const schemaSource = (id: string, databaseAbi?: 1) => `import { createModuleTable${
+  databaseAbi === 1 ? ", moduleDrizzleSchemaMetadata" : ""
+} } from "@ekklesia/module-database/drizzle";
 import { text, uuid } from "drizzle-orm/pg-core";
 export const records = createModuleTable(${JSON.stringify(id)})("records", {
   id: uuid("id").primaryKey(),
@@ -77,7 +90,7 @@ export const records = createModuleTable(${JSON.stringify(id)})("records", {
 export default ${
   databaseAbi === 1
     ? `moduleDrizzleSchemaMetadata(${JSON.stringify(id)}, { records })`
-    : `defineModuleSchema({ moduleId: ${JSON.stringify(id)}, tables: { records } })`
+    : `{ moduleId: ${JSON.stringify(id)}, tables: { records } }`
 };
 `;
 
@@ -87,7 +100,9 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
   const root = await scratchDirectory("ekklesia-pack-fixture-");
   const moduleDirectory = path.join(root, id);
   const tableName = `${id.replaceAll("-", "_")}_records`;
-  const usesModuleDatabase = options.withModuleDatabase || options.databaseAbi === 1;
+  const usesModuleDatabase =
+    options.withModuleDatabase || options.withSchema || options.databaseAbi === 1;
+  const engines = options.engines === undefined ? { node: ">=24.11.0 <25" } : options.engines;
 
   const baseManifest: Record<string, unknown> = {
     manifestVersion: 8,
@@ -119,6 +134,7 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
         license: Object.hasOwn(options, "license") ? options.license : "MIT",
         private: true,
         type: "module",
+        ...(engines === null ? {} : { engines }),
         scripts: { build: "tsc" },
         dependencies: {
           "@ekklesia/module-sdk": "workspace:*",
@@ -185,18 +201,23 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
     }),
   );
 
-  // The module's dependencies, as a workspace links them: the real packages this package depends on.
+  // The module's dependencies: the real packages this package depends on, either linked as a
+  // workspace links them, or copied as a registry install would place them.
   const modules = path.join(moduleDirectory, "node_modules");
   await mkdir(path.join(modules, "@ekklesia"), { recursive: true });
-  await symlink(
-    await realpath(path.join(packageRoot, "node_modules", "@ekklesia", "module-sdk")),
-    path.join(modules, "@ekklesia", "module-sdk"),
-  );
-  if (usesModuleDatabase) {
-    await symlink(
-      await realpath(path.join(packageRoot, "node_modules", "@ekklesia", "module-database")),
-      path.join(modules, "@ekklesia", "module-database"),
-    );
+  const ekklesiaPackages = [
+    "module-sdk",
+    ...(usesModuleDatabase ? ["module-database"] : []),
+  ] as const;
+  if (options.ekklesiaInstall === "registry") {
+    await installLikeARegistry(modules, [...ekklesiaPackages, "contracts"]);
+  } else {
+    for (const name of ekklesiaPackages) {
+      await symlink(
+        await realpath(path.join(packageRoot, "node_modules", "@ekklesia", name)),
+        path.join(modules, "@ekklesia", name),
+      );
+    }
   }
   await symlink(
     await realpath(path.join(packageRoot, "node_modules", "drizzle-orm")),
@@ -222,6 +243,45 @@ export async function fixtureModule(options: FixtureModuleOptions = {}): Promise
   return moduleDirectory;
 }
 
+/**
+ * Copies each `@ekklesia/*` package's published files (`package.json`, `dist`, `LICENSE`) into a flat
+ * `node_modules` as real directories, and links the third-party packages they depend on beside them:
+ * the layout a registry install produces, with nothing pointing back into the workspace's sources.
+ */
+async function installLikeARegistry(modules: string, names: readonly string[]): Promise<void> {
+  for (const name of names) {
+    const source = await realpath(path.join(packageRoot, "..", name));
+    const target = path.join(modules, "@ekklesia", name);
+    await mkdir(target, { recursive: true });
+    for (const entry of ["package.json", "dist", "LICENSE"]) {
+      await cp(path.join(source, entry), path.join(target, entry), {
+        force: false,
+        recursive: true,
+      }).catch((error: NodeJS.ErrnoException) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+    }
+    const manifest = JSON.parse(
+      await readFile(path.join(source, "package.json"), "utf8"),
+    ) as Record<string, Record<string, string> | undefined>;
+    for (const dependency of Object.keys(manifest.dependencies ?? {})) {
+      const link = path.join(modules, ...dependency.split("/"));
+      if (dependency.startsWith("@ekklesia/") || (await exists(link))) continue;
+      await mkdir(path.dirname(link), { recursive: true });
+      await symlink(await realpath(path.join(source, "node_modules", dependency)), link);
+    }
+  }
+}
+
+async function exists(file: string): Promise<boolean> {
+  try {
+    await lstat(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export const SOURCE_REVISION = "86ae907f59458508e3277666cdd214f5bd7c1078";
 
 const nativeFixtureSource = path.join(packageRoot, "tests", "fixtures", "native-module");