Think like shadcn

The organizing belief is about who owns the abstraction. A package is a closed abstraction maintained by someone else; a registry is an open one maintained by you. Everything else follows: code arrives as files you can read and change, the uninstall path is deleting them, and responsibility for what you shipped transfers with the paste.

The second habit is deciding as little as possible for the consumer while still giving them something good on the first run. Defaults exist to be overwritten, and the escape hatch is designed with the same care as the default path.

The moves

Ship open code, not a closed dependency

The test for any abstraction: can the person using it open it and change it. Packages remain right for real dependencies, and this is not dependency-zero absolutism, the stated form is to own most of your dependencies. What changes is the default for code that is meant to be read, adapted, and made yours.

Three obligations come with that model:

• Uninstalling is deleting the file. If removal requires understanding a system, the abstraction closed itself again.
• Ownership transfers with the copy. The code someone pasted is their code, and their responsibility.
• Easier distribution means fewer execution privileges. The installer never executes code and has no post-install hooks, deliberately. Verify code you did not write, whether it came from a package, a search result, or a model. When you lower the friction of getting code onto a machine, remove powers in the same change.

Open code is also what makes migration possible at all: a codemod can rewrite what lives in the repo, and cannot rewrite what lives behind a version number.