A separately versioned module is distributed as one immutable, self-contained,
deterministic .tar.gz with a separately distributed SHA-256. The package
contract is independent of hosting, registry, transport, and marketplace.
ADR 0049 extends ADR 0048 with:
- the package layout: one top-level module directory with a generated runtime
package.json, the unchanged manifest, ekklesia.package.json, bundled backend
entrypoints, built browser artifacts, migrations, THIRD_PARTY_NOTICES, and
node_modules only for native dependencies;
- backend bundling of all pure-JavaScript dependencies, with externals decided
and validated by the canonical packager, never by module authors;
- targets: `any`, or <platform>-<arch>[-<libc>] (linux-x64-glibc for Signage);
- ekklesia.package.json (packageFormat 1): id, version, target, runtime needs,
provenance, incorporated SDK versions, a `transitional` Drizzle requirement
explicitly not the Module Database ABI, and per-file size and SHA-256;
- archive safety: no links of any kind, no absolute or `..` paths, no special
files or setuid/setgid; extraction normalizes ownership and modes;
- the intended installation lifecycle and its rollback limit: code-only
rollback only before new migrations apply, a backup restore after;
- integrity, not authenticity; signing and trust roots deferred;
- pnpm deploy explicitly not the packaging mechanism.
Status Proposed, following the repository's usual lifecycle. ADR 0047 gains a
cross-reference to consume canonical packages. The module development guide no
longer recommends running pnpm deploy in a workspace, which corrupts that
workspace's install state. No runtime, tooling, Docker, CI, Signage, or
instance changes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
