feat: standalone module-build readiness for the public @ekklesia packages (ADR 0053)

Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.

- Curated @ekklesia/module-sdk: an explicit author API, no contracts
  barrel, no identity/authorization internals, no Drizzle and no legacy
  ModuleDatabase type. defineModuleRuntime returns the SDK's own named
  interfaces so a module's emitted declarations never reach into
  @ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
  defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
  the legacy Drizzle schema validator (moved to core/src/modules) and
  its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
  checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
  Every public package carries "ekklesia.distribution":
  "module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
  and recognizes Ekklesia packages by name plus that marker, so
  registry-installed packages are incorporated, SDK-compatibility
  checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
  and inspects the nine public tarballs; scripts/test-standalone-module.sh
  (pnpm test:standalone-module, new CI job) installs them into a fixture
  module outside the repository and proves it typechecks, builds,
  packages, and verifies.
- Public-package boundary tests and module-development docs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/fixtures/standalone-module/drizzle/0000_initial.sql

@@ -0,0 +1 @@
+CREATE TABLE "standalone_proof_notes" ("id" uuid PRIMARY KEY NOT NULL, "body" text NOT NULL);

tests/fixtures/standalone-module/drizzle/meta/0000_snapshot.json

@@ -0,0 +1,6 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "id": "20000000-0000-4000-8000-000000000001",
+  "prevId": "00000000-0000-0000-0000-000000000000"
+}

tests/fixtures/standalone-module/drizzle/meta/_ekklesia.json

@@ -0,0 +1,5 @@
+{
+  "version": 1,
+  "moduleId": "standalone-proof",
+  "entries": [{ "tag": "0000_initial", "destructive": { "mode": "none" } }]
+}

tests/fixtures/standalone-module/drizzle/meta/_journal.json

@@ -0,0 +1,7 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    { "idx": 0, "version": "7", "when": 1700000000000, "tag": "0000_initial", "breakpoints": true }
+  ]
+}

tests/fixtures/standalone-module/ekklesia.module.json

@@ -0,0 +1,28 @@
+{
+  "manifestVersion": 8,
+  "id": "standalone-proof",
+  "name": "Standalone Proof",
+  "description": "Proves a module builds, packages, and verifies from published Ekklesia packages alone.",
+  "version": "0.1.0",
+  "compatibility": {
+    "platform": "^0.1.0",
+    "moduleSdk": "^0.1.0"
+  },
+  "database": {
+    "abi": 1
+  },
+  "capabilities": [],
+  "permissions": [
+    {
+      "id": "standalone-proof.notes.read",
+      "baseline": "restricted",
+      "description": "Read notes."
+    }
+  ],
+  "entrypoints": {
+    "server": "./dist/server/index.js",
+    "schema": "./dist/schema/index.js",
+    "migrations": "./drizzle",
+    "ui": "./dist/ui/index.js"
+  }
+}

tests/fixtures/standalone-module/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@ekklesia-fixtures/standalone-proof",
+  "version": "0.1.0",
+  "description": "A module built outside the Ekklesia repository from packed @ekklesia/* tarballs. Not a workspace package: scripts/test-standalone-module.sh copies it elsewhere and installs it.",
+  "license": "AGPL-3.0-or-later",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=24.11.0 <25"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && ekklesia-build-module-ui",
+    "typecheck": "tsc --noEmit --project tsconfig.json && tsc --noEmit --project tsconfig.ui.json"
+  },
+  "dependencies": {
+    "@ekklesia/design-tokens": "^0.1.2",
+    "@ekklesia/module-database": "^0.1.2",
+    "@ekklesia/module-sdk": "^0.1.2",
+    "@ekklesia/module-ui-sdk": "^0.1.2",
+    "@ekklesia/ui": "^0.1.2",
+    "react": "19.2.8",
+    "react-dom": "19.2.8"
+  },
+  "devDependencies": {
+    "@ekklesia/module-pack": "0.1.2",
+    "@ekklesia/module-ui-build": "^0.1.2",
+    "@ekklesia/typescript-config": "^0.1.2",
+    "@types/node": "24.13.3",
+    "@types/react": "19.2.18",
+    "@types/react-dom": "19.2.4",
+    "typescript": "7.0.2"
+  }
+}

tests/fixtures/standalone-module/src/schema/index.ts

@@ -0,0 +1,6 @@
+import { defineModuleSchemaMetadata } from "@ekklesia/module-database";
+
+export default defineModuleSchemaMetadata({
+  moduleId: "standalone-proof",
+  tables: [{ name: "standalone_proof_notes", foreignKeys: [] }],
+});

tests/fixtures/standalone-module/src/server/index.ts

@@ -0,0 +1,23 @@
+import { sql } from "@ekklesia/module-database";
+import { defineModuleRuntime } from "@ekklesia/module-sdk";
+
+/** A Module Database ABI v1 module with no ORM: SQL through the executor Core provides. */
+export default defineModuleRuntime({
+  database: { abi: 1 },
+  id: "standalone-proof",
+  version: "0.1.0",
+  register({ http }) {
+    http.route({
+      method: "GET",
+      path: "/notes",
+      permission: "standalone-proof.notes.read",
+      maxBodyBytes: 0,
+      async handler(_request, { services }) {
+        const result = await services.database.query(
+          sql`SELECT id, body FROM standalone_proof_notes ORDER BY id LIMIT ${50}`,
+        );
+        return Response.json(result.rows);
+      },
+    });
+  },
+});

tests/fixtures/standalone-module/src/ui/index.tsx

@@ -0,0 +1,23 @@
+import { designTokenVariableName } from "@ekklesia/design-tokens";
+import { defineModuleUi } from "@ekklesia/module-ui-sdk";
+import { EKKLESIA_UI_STYLESHEET, EmptyState, Panel } from "@ekklesia/ui";
+import { createRoot } from "react-dom/client";
+
+const accent = `var(${designTokenVariableName("color.accent")})`;
+
+export default defineModuleUi({
+  id: "standalone-proof",
+  version: "0.1.0",
+  styles: EKKLESIA_UI_STYLESHEET,
+  mount(container) {
+    const root = createRoot(container);
+    root.render(
+      <Panel title="Notes">
+        <div style={{ borderColor: accent }}>
+          <EmptyState title="No notes yet" />
+        </div>
+      </Panel>,
+    );
+    return () => root.unmount();
+  },
+});

tests/fixtures/standalone-module/tsconfig.build.json

@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "declaration": true,
+    "noEmit": false,
+    "outDir": "dist",
+    "rootDir": "src"
+  }
+}

tests/fixtures/standalone-module/tsconfig.json

@@ -0,0 +1,7 @@
+{
+  "extends": "@ekklesia/typescript-config/node.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["src/server/**/*.ts", "src/schema/**/*.ts"]
+}

tests/fixtures/standalone-module/tsconfig.ui.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@ekklesia/typescript-config/browser-react.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": []
+  },
+  "include": ["src/ui/**/*.tsx"]
+}