Makes the public module-development package set usable from a module
repository outside the monorepo. Nothing is published.
- Curated @ekklesia/module-sdk: an explicit author API, no contracts
barrel, no identity/authorization internals, no Drizzle and no legacy
ModuleDatabase type. defineModuleRuntime returns the SDK's own named
interfaces so a module's emitted declarations never reach into
@ekklesia/contracts. defineModuleSchema is gone; createModuleTable and
defineModuleSchemaMetadata live in @ekklesia/module-database.
- Drizzle: no longer a dependency of module-sdk or contracts. Core keeps
the legacy Drizzle schema validator (moved to core/src/modules) and
its legacy runtime support; drizzle-orm is an optional peer only.
- React is a peer (plus devDependency) of @ekklesia/ui; the boundary
checker allows exactly that consumer-selected peer.
- @ekklesia/typescript-config is publishable; module-ui-host is private.
Every public package carries "ekklesia.distribution":
"module-development" and no monorepo-root prepack.
- module-pack reads the Node.js range from the module's own engines.node
and recognizes Ekklesia packages by name plus that marker, so
registry-installed packages are incorporated, SDK-compatibility
checked, and never credited as third-party.
- scripts/pack-public-packages.ts (pnpm packages:pack) rebuilds, packs
and inspects the nine public tarballs; scripts/test-standalone-module.sh
(pnpm test:standalone-module, new CI job) installs them into a fixture
module outside the repository and proves it typechecks, builds,
packages, and verifies.
- Public-package boundary tests and module-development docs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Implements ADR 0049's deferred native target and ADR 0052's reviewed
license supplements. The proof case is a real module using sharp.
packageFormat stays 1, and `any` is unchanged.
Packager (@ekklesia/module-pack):
- --target linux-x64-glibc. Native or platform-specific packages, found by
the same generic rule that refuses them in `any`, stay outside the bundle.
- Each native package's production closure is walked through its own
dependencies, installed optionalDependencies that match the target, and
required peers. It is copied as real files flat under node_modules/<name>,
with no links, dev dependencies, declarations, source maps, or other
platforms' packages. Missing or foreign-platform required dependencies,
version conflicts, links, foreign machines, and Node.js range conflicts
fail closed.
- runtime.nodeApi, nodeAbi, and libcVersion are read from the binaries by a
small ELF reader: the addon's node_api_module_get_api_version_v1 and the
newest GLIBC_ symbol version needed. No shelling out. A native target with
no addon is refused.
- ADR 0052 supplements: package-provided material stays primary. An exact
match on name, version, and ekklesia-content-v1 digest (sorted normalized
paths with each file's size and SHA-256; no metadata) adds labelled
material after the package's own. Any mismatch, a declared-licence
conflict, or a malformed or unreviewed supplement file fails. Missing
material with no supplement still fails.
Supplement for @img/[email protected]:
- 184 components and 143 unique texts, assembled from the exact upstream
sources sharp-libvips v1.3.3 builds linux-x64 from: 27 C/C++ libraries,
glib's gvdb, librsvg's Rust crates (reproduced with cargo tree), the Rust
standard library at the rustc commit recorded in the binary, plus the
LGPL-3.0, GPL-3.0, and MPL-2.0 texts. Each source is recorded with its
SHA-256 in PROVENANCE.md.
- It pins digest ekklesia-content-v1:sha256:50647b0b…, which is identical
from the installed copy and from the registry tarball.
- LGPL/MPL source-availability determinations stay open, as ADR 0052
states. Nothing claims they are met.
Verifier (Core):
- linux-x64-glibc is accepted only on a host whose platform, arch, glibc
family and version, and Node-API version (from Node itself) match.
- Every ELF file must be x86-64; every .node must be an ELF object.
- `any` packages now also refuse node_modules/ and ELF files.
- Contract: native metadata must state nodeApi or nodeAbi, and Linux targets
libcVersion (ADR 0049).
Proof:
- A checked-in AGPL native fixture packs byte-identically from unrelated
copies (8.86 MB) and verifies with Core's verifier.
- Extracted elsewhere, it runs a sharp resize and PNG round trip in an
empty-environment process. Every resolution stays in the package, and
only the package's addon and libvips plus host system libraries load.
Signage is untouched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adds Core-owned identity contracts, a Core-owned Better Auth database schema
(ekklesia_core_user/session/account/verification), a first-class Core-owned
migration source that coexists with module-owned migrations under the exact
existing migration system, and an explicit Better Auth construction boundary.
No authentication endpoint or sign-in UI is exposed yet (ADR 0010).
Co-Authored-By: Claude Sonnet 5 <[email protected]>
