SDK Package Split and Release Plan

Sets a concrete package split, release order, and dependency boundaries for protocol SDK publishing.

1. Release @ryvra/auth at 0.1.0.
2. Release @ryvra/api-client at 0.1.0 after auth contracts are stable.
3. Release @ryvra/events at 0.1.0 only after api-client contracts and error envelopes are stable.

• Own token providers, request signing, key rotation hooks, auth config validation, and clock-skew handling.
• Expose auth client, signing helpers, and middleware/interceptor interfaces.
• Remain dependency-isolated from @ryvra/api-client and @ryvra/events.
• Require typed auth errors and sandbox auth-flow integration tests before promotion.

• Own typed command/query transport for intents, payments, markets, treasury, and settlement endpoints.
• Provide pagination, retry policies, idempotency/correlation metadata handling, and normalized error mapping.
• Depend on @ryvra/auth for trust and signing primitives.
• Require endpoint parity coverage and end-to-end tests with real auth middleware.

• Own webhook verification, signature checks, canonical event schema typing, and consumer routing utilities.
• Provide replay-safe helpers for dedupe, ordering, and checkpoint progression.
• Allow dependencies on @ryvra/auth and shared envelope/resource types from @ryvra/api-client.
• Require verified webhook flow tests, replay-safe examples, and compatibility checks against produced protocol events.

• @ryvra/auth owns identity and trust primitives only.
• @ryvra/api-client owns synchronous API command/query transport only.
• @ryvra/events owns asynchronous event delivery and consumption only.
• Share only canonical error envelope, request metadata (idempotencyKey and correlationId), and canonical event envelope across packages.

• Start each package at version 0.1.0 with semver tagging.
• Do not publish @ryvra/events before @ryvra/api-client contract stability is confirmed.
• Require changelog entries and compatibility notes on every publish.