For packages that should offer some customizable aspects I would prefer to go with a plugin approach.
This can be used by the end application to choose the final package tree. Eg: a web framework with session management that can be stored in db, redis, or cookes. I would expect webframework-session-pg, webframework-session-mysql, webframework-session-redis, etc packages.
If we don’t want to have an explosion of packages it would be possible to have only a webframework-session package that has the code for all supported “plugins”. In this scenario I would not list the dependencies in the shards so they are not forced downstream when not used. shards does not support optional/peer dependencies unfortunately, so it’s hard to enforce a version constraint. We could use explicit requirements to choose the plugin easily. eg: require "webframework/session/redis" this require would fail if there is no redis package.
If we are building an end user app and we want to customize which library is used upon build time I wish there would be some project configuration file (as briefly mentioned here).