Defines the external module-development and package-distribution contract
that ADR 0049 deferred.
- Protocol, not provider: packages are distributed over the standard npm
registry protocol. Gitea may host the private phase. Host-neutral
lockfiles and an Ekklesia proxy are not required; a registry move may need
one configuration change and a lockfile regeneration, while integrity hashes
keep verifying content.
- Public set:
- Author API: module-sdk, module-database, module-ui-sdk, design-tokens.
- Tooling: module-ui-build, module-pack, typescript-config.
- ui as a pre-1.0 component API.
- contracts only as a transitive implementation dependency.
- Core, apps, module-ui-host, and module-template stay unpublished.
- Curated SDK before first publication: no full contracts barrel, no forced
Drizzle at the SDK root, and no legacy Drizzle database contract in the
standalone surface. Drizzle support lives in module-database's adapter.
- Dependency rules: React/ReactDOM are peers of the public UI packages
(bundling per ADR 0023 is unchanged); Drizzle is an optional peer only
where the adapter needs it; modules put runtime packages in dependencies
and tooling/config in devDependencies.
- Versioning: one coordinated 0.x release version equal to the platform
version, with no mixed trains. Ranges go in source and exact artifacts in
lockfiles; module-pack is pinned exactly; independent versions deferred.
- Standalone packaging: no monorepo checkout. The module declares its own
Node range (engines.node). The packager recognizes Ekklesia packages by
identity and metadata, not path. No monorepo-root commands at install time.
- Supply chain: immutable versions, frozen-lockfile integrity, and a
pre-publication smoke that installs the packed tarballs into a clean
standalone fixture and proves build, package, and verify. Signing deferred.
- Private phase: no committed secrets; credentials come from the
environment; verify actual read access before the first publication.
Status Proposed. ADR 0047 (still proposed) must be revised against this. No
code, registry, credential, or Signage changes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
