refactor(layout): ranger les modules par destin à la migration

Les 25 modules étaient à plat, nommés d'après ce qu'ils font mécaniquement
(`store-registry`, `read-model`, `reach`, `caps`). Rien dans l'arborescence ne
disait lesquels DEVIENDRONT le vrai SDK, lesquels tiennent lieu du travail que
le verifier fera nativement, et lesquels n'existent que parce qu'un wallet est
partagé — trois destins sans rapport.

Quatre dossiers, les deux fichiers d'entrée restant à la racine pour que
l'`exports` du paquet et le code du consommateur ne bougent pas :

- `model/` — le modèle d'adressage de la cible, transcrit : vocabulaire pur,
  pas d'I/O. Survit comme connaissance.
- `surface/` — ce que l'app touche, chaque symbole ayant un pendant cible
  documenté. Supprimé quand l'alias bascule ; le code de l'app est inchangé.
- `emulated-verifier/` — les doublures de ce que le verifier fait nativement :
  possession, dépôt des caps, frontière, non-livraison, traitement des inbox,
  registres de branche, ouverture de repo. **C'est le dossier où diverger du
  modèle est possible.** Le préfixe `emulated-` porte le sens : tient lieu de,
  jamais est — cette bibliothèque ne réside dans aucune couche de la cible,
  elle les référence.
- `shared-wallet/` — n'existe que parce qu'un wallet héberge toutes les
  identités. Aucun pendant, rien sur quoi s'aligner ; sa seule loi est de
  rester invisible depuis `surface/`. S'évapore, remplacé par rien.

`store-registry-api.ts` devient `surface/placement.ts` : il faisait déjà à la
main ce que la frontière de dossier fait structurellement — c'est la meilleure
preuve interne du bien-fondé de ce rangement.

Ce commit ne fait que déplacer et recâbler les imports (src, test, e2e). Les
scissions des modules à cheval suivent.

157 tests unitaires, typecheck src/test/e2e vert.

packages/client/src/emulated-verifier/caps.ts

@@ -50,8 +50,8 @@
  * writer; they are left as-is and belong to P1b.
  */
 
-import { hasReadCap, mintCap, targetOf } from "./nuri";
-import type { Nuri, PrincipalId, ReadCap, Scope } from "./types";
+import { hasReadCap, mintCap, targetOf } from "../model/nuri";
+import type { Nuri, PrincipalId, ReadCap, Scope } from "../model/types";
 
 /** The map key of the anonymous holder (no identity established yet). */
 const ANONYMOUS = "";

packages/client/src/emulated-verifier/connect.ts

@@ -34,9 +34,9 @@
  * them and this drains each in turn.
  */
 
-import { getCaps, getCurrentUser } from "./polyfill";
-import { myInboxes, readLinks, resolveAccount } from "./store-registry";
-import { processInbox } from "./inbox";
+import { getCaps, getCurrentUser } from "../polyfill";
+import { myInboxes, readLinks, resolveAccount } from "../shared-wallet/account-registry";
+import { processInbox } from "../surface/inbox";
 
 /** The in-flight connection work, per user key — so two calls do not race. */
 const inFlight = new Map<string, Promise<void>>();

packages/client/src/emulated-verifier/open-repo.ts

@@ -60,10 +60,10 @@
  */
 
 import { mustNotAttempt } from "./reach";
-import { getConfig, getStoreRegistryDeps } from "./polyfill";
-import { subscribePhysicalDoc, type Unsubscribe } from "./subscribe";
-import { logStage, shortNuri } from "./access-log";
-import type { Nuri } from "./types";
+import { getConfig, getStoreRegistryDeps } from "../polyfill";
+import { subscribePhysicalDoc, type Unsubscribe } from "../surface/subscribe";
+import { logStage, shortNuri } from "../shared-wallet/access-log";
+import type { Nuri } from "../model/types";
 
 /**
  * The per-nuri bootstrap sync state (lib-internal). See the module header:

packages/client/src/emulated-verifier/reach.ts

@@ -40,9 +40,9 @@
  * At migration this module disappears: the boundary becomes the wallet itself.
  */
 
-import { getCaps } from "./polyfill";
-import { targetOf } from "./nuri";
-import type { Nuri } from "./types";
+import { getCaps } from "../polyfill";
+import { targetOf } from "../model/nuri";
+import type { Nuri } from "../model/types";
 
 /**
  * NURIs of the polyfill's own scaffolding, registered as they are resolved.

packages/client/src/emulated-verifier/read-filter.ts

@@ -21,8 +21,8 @@
  */
 
 import type { CapRegistry } from "./caps";
-import { isNuri } from "./nuri";
-import type { Nuri } from "./types";
+import { isNuri } from "../model/nuri";
+import type { Nuri } from "../model/types";
 
 /** The document (repo NURI) an item lives in — its `@graph`. The ORM boundary:
  *  `@graph` is an untyped value on a property bag, so it is narrowed here rather

packages/client/src/index.ts

@@ -20,24 +20,24 @@
  * away is visible at the import line.
  */
 
-export * from "./types";
-export { useShape } from "./use-shape";
-export { watchShape } from "./watch-shape";
-export type { ShapeQuery, ShapeObservable } from "./watch-shape";
-export { init, initNg } from "./lifecycle";
-export * as inbox from "./inbox";
-export * as docs from "./docs";
-export { subscribeDoc, subscribeDocs, docChangeType } from "./subscribe";
-export type { DocChange, DocChangeType, Unsubscribe } from "./subscribe";
-export * as readModel from "./read-model";
-export type { UnionSubject } from "./read-model";
-export * as storeRegistry from "./store-registry-api";
+export * from "./model/types";
+export { useShape } from "./surface/use-shape";
+export { watchShape } from "./surface/watch-shape";
+export type { ShapeQuery, ShapeObservable } from "./surface/watch-shape";
+export { init, initNg } from "./surface/lifecycle";
+export * as inbox from "./surface/inbox";
+export * as docs from "./surface/docs";
+export { subscribeDoc, subscribeDocs, docChangeType } from "./surface/subscribe";
+export type { DocChange, DocChangeType, Unsubscribe } from "./surface/subscribe";
+export * as readModel from "./surface/read-model";
+export type { UnionSubject } from "./surface/read-model";
+export * as storeRegistry from "./surface/placement";
 
 // SPARQL injection-safety helpers — so the app can reuse the same escaping /
 // validation when it builds SPARQL by interpolation. `escapeLiteral` for string
 // literals, `escapeIri` to embed untrusted values in an IRI, `assertNuri` to
 // validate trusted-shaped NURIs before embedding them in an IRI.
-export { escapeLiteral, escapeIri, assertNuri } from "./sparql";
+export { escapeLiteral, escapeIri, assertNuri } from "./surface/sparql";
 
 // NURI type guards — the doors through which an app's own `string` (read back
 // from storage, a URL, JSON, a form) becomes a typed `Nuri` or `ReadCap`. `Nuri`
@@ -46,7 +46,7 @@ export { escapeLiteral, escapeIri, assertNuri } from "./sparql";
 // particular, it cannot pass a bare reference where a cap is required. Narrow
 // with these rather than casting: a cast re-opens exactly the confusion the
 // types exist to close.
-export { isNuri, hasReadCap } from "./nuri";
+export { isNuri, hasReadCap } from "./model/nuri";
 
 // SDK type re-exports — so the app imports these from @ng-eventually/client too,
 // not from @ng-org. `export type` is ERASED at build, so this adds NO runtime
@@ -55,7 +55,7 @@ export type { ShapeType, BaseType, Schema } from "@ng-org/shex-orm";
 export type { DeepSignalSet } from "@ng-org/alien-deepsignals";
 export type { NG } from "@ng-org/web";
 
-import { makeNg } from "./ng-proxy";
+import { makeNg } from "./surface/ng-proxy";
 
 /** SDK-identical `ng` (wrapped). Drop-in replacement for `@ng-org/web`'s `ng`. */
 export const ng: Record<string, any> = makeNg();

packages/client/src/polyfill.ts

@@ -8,12 +8,12 @@
  * here is removed at migration.
  */
 
-import type { NgLike, UseShapeLike, Nuri, PrincipalId, ReadCap } from "./types";
-import type { RegistrySession } from "./store-registry";
-import { CapRegistry } from "./caps";
-import { setAccessLog } from "./access-log";
-import { inspectOutbox } from "./outbox-log";
-import { startConnect } from "./connect";
+import type { NgLike, UseShapeLike, Nuri, PrincipalId, ReadCap } from "./model/types";
+import type { RegistrySession } from "./shared-wallet/account-registry";
+import { CapRegistry } from "./emulated-verifier/caps";
+import { setAccessLog } from "./shared-wallet/access-log";
+import { inspectOutbox } from "./shared-wallet/outbox-log";
+import { startConnect } from "./emulated-verifier/connect";
 
 /**
  * Consumer-injected dependencies of the storeRegistry (polyfill-era). The
@@ -224,9 +224,9 @@ export function resetCaps(): void {
 // lives in `inbox.ts` because sharing IS an inbox deposit (upstream: a sealed
 // message carrying the cap), but it is surfaced here so the cap vocabulary stays
 // on the polyfill side of the boundary rather than in the SDK-identical entry.
-export { CapRegistry } from "./caps";
-export { shareCap } from "./inbox";
-export { connectedUser } from "./connect";
+export { CapRegistry } from "./emulated-verifier/caps";
+export { shareCap } from "./surface/inbox";
+export { connectedUser } from "./emulated-verifier/connect";
 
 // --- identity persistence (polyfill-era, no SDK counterpart) ----------------
 //
@@ -235,7 +235,7 @@ export { connectedUser } from "./connect";
 // one shared wallet hosts several identities. The real SDK has no counterpart: there
 // each user opens their own wallet, and "who am I" is the session. Shipping it from
 // the SDK entry advertised as durable something that disappears at migration.
-export * as accounts from "./accounts";
-export type { AccountStorage } from "./accounts";
+export * as accounts from "./shared-wallet/accounts";
+export type { AccountStorage } from "./shared-wallet/accounts";
 // Config-shaped types the bootstrap needs; both describe the shim, not the SDK.
-export type { AccountRecord, RegistrySession } from "./store-registry";
+export type { AccountRecord, RegistrySession } from "./shared-wallet/account-registry";

packages/client/src/shared-wallet/access-log.ts

@@ -19,7 +19,7 @@
  * migration where the broker/verifier enforces isolation natively.
  */
 
-import { getCurrentUser } from "./polyfill";
+import { getCurrentUser } from "../polyfill";
 
 /** Access kind: a document READ or a document WRITE. */
 export type AccessOp = "READ" | "WRITE";

packages/client/src/shared-wallet/account-registry.ts

@@ -61,15 +61,15 @@
  * `ng`), so this module imports **no** `@ng-org` package.
  */
 
-import { sparqlUpdate, sparqlQuery } from "./docs";
+import { sparqlUpdate, sparqlQuery } from "../surface/docs";
 import { physicalCreate, physicalQuery, physicalUpdate } from "./physical";
-import { getCaps, getCurrentUser, getStoreRegistryDeps } from "./polyfill";
-import { ensureRepoOpen, ensurePhysicalRepoOpen } from "./open-repo";
-import { escapeLiteral, escapeIri, assertNuri } from "./sparql";
-import { hasReadCap, isNuri, mintCap } from "./nuri";
-import { mustNotAttempt } from "./reach";
+import { getCaps, getCurrentUser, getStoreRegistryDeps } from "../polyfill";
+import { ensureRepoOpen, ensurePhysicalRepoOpen } from "../emulated-verifier/open-repo";
+import { escapeLiteral, escapeIri, assertNuri } from "../surface/sparql";
+import { hasReadCap, isNuri, mintCap } from "../model/nuri";
+import { mustNotAttempt } from "../emulated-verifier/reach";
 import { accessLogPrefix, logStage, shortNuri } from "./access-log";
-import type { Nuri, ReadCap, Scope } from "./types";
+import type { Nuri, ReadCap, Scope } from "../model/types";
 
 // --- sharedWalletShim model ----------------------------------------------
 

packages/client/src/shared-wallet/physical.ts

@@ -38,10 +38,10 @@
  * split once each user opens their own wallet.
  */
 
-import { getConfig } from "./polyfill";
+import { getConfig } from "../polyfill";
 import { logAccess } from "./access-log";
-import { isNuri } from "./nuri";
-import type { Nuri } from "./types";
+import { isNuri } from "../model/nuri";
+import type { Nuri } from "../model/types";
 
 /**
  * Create a document as the PHYSICAL user — the shim's own documents (the doc-shim,

packages/client/src/surface/docs.ts

@@ -13,11 +13,11 @@
  * app's storeRegistry usage), so this is a drop-in for those raw calls.
  */
 
-import { getCaps, getConfig } from "./polyfill";
-import { logAccess, enabled as accessLogEnabled } from "./access-log";
-import { isNuri } from "./nuri";
-import { assertMayReach } from "./reach";
-import type { Nuri } from "./types";
+import { getCaps, getConfig } from "../polyfill";
+import { logAccess, enabled as accessLogEnabled } from "../shared-wallet/access-log";
+import { isNuri } from "../model/nuri";
+import { assertMayReach } from "../emulated-verifier/reach";
+import type { Nuri } from "../model/types";
 
 // The low common point for ALL document access: every read in the SDK routes
 // through `sparqlQuery`, every write through `sparqlUpdate` (+ container creation

packages/client/src/surface/inbox.ts

@@ -28,19 +28,19 @@
 
 import { depositInto, sparqlQuery } from "./docs";
 import { subscribeDoc } from "./subscribe";
-import { ensureRepoOpen } from "./open-repo";
-import { getCaps, getCurrentUser, getStoreRegistryDeps } from "./polyfill";
-import { addLink, documentInboxAddress, isOwnInbox } from "./store-registry";
+import { ensureRepoOpen } from "../emulated-verifier/open-repo";
+import { getCaps, getCurrentUser, getStoreRegistryDeps } from "../polyfill";
+import { addLink, documentInboxAddress, isOwnInbox } from "../shared-wallet/account-registry";
 import { escapeLiteral } from "./sparql";
-import { hasReadCap } from "./nuri";
+import { hasReadCap } from "../model/nuri";
 import {
   accessLogPrefix,
   enabled as accessLogEnabled,
   logAccess,
   logStage,
   shortNuri,
-} from "./access-log";
-import type { Nuri, PrincipalId, ReadCap } from "./types";
+} from "../shared-wallet/access-log";
+import type { Nuri, PrincipalId, ReadCap } from "../model/types";
 
 // --- deposit model --------------------------------------------------------
 

packages/client/src/surface/lifecycle.ts

@@ -5,7 +5,7 @@
  * a hook point later (e.g. opening the shared wallet on `init`).
  */
 
-import { getConfig } from "./polyfill";
+import { getConfig } from "../polyfill";
 
 /** Forwards to the real `@ng-org/web` `init`. */
 export function init(...args: any[]): any {

packages/client/src/surface/ng-proxy.ts

@@ -4,8 +4,8 @@
  * surface stays identical to `@ng-org/web`'s `ng`.
  */
 
-import { getConfig, getCaps, getCurrentUser } from "./polyfill";
-import type { Nuri } from "./types";
+import { getConfig, getCaps, getCurrentUser } from "../polyfill";
+import type { Nuri } from "../model/types";
 
 export function makeNg(): Record<string, any> {
   return new Proxy({} as Record<string, any>, {

packages/client/src/surface/placement.ts

@@ -5,7 +5,7 @@
  * placement/addressing calls a consumer application legitimately makes, and the
  * shim machinery that makes virtual users work at all (account resolution, the
  * durable cap registers, the inbox-ownership predicate, cache resets). Until now
- * `index.ts` did `export * as storeRegistry from "./store-registry"` and shipped
+ * `index.ts` did `export * as storeRegistry from "../shared-wallet/account-registry"` and shipped
  * both, so an application could reach `ensureAccount`, `addLink` or
  * `resetRegistryCache` from the SDK-identical entry — machinery it must never call,
  * on the entry whose whole promise is "this survives migration unchanged".
@@ -34,4 +34,4 @@ export {
   openDocumentInbox,
   /** WHERE to deposit for a document — readable by any holder of it. `undefined` if none. */
   documentInboxAddress,
-} from "./store-registry";
+} from "../shared-wallet/account-registry";

packages/client/src/surface/read-model.ts

@@ -42,12 +42,12 @@
  */
 
 import { docCreate, sparqlUpdate, sparqlQuery } from "./docs";
-import { getCaps, getStoreRegistryDeps } from "./polyfill";
-import { mustNotAttempt } from "./reach";
-import { ensureReposOpen } from "./open-repo";
+import { getCaps, getStoreRegistryDeps } from "../polyfill";
+import { mustNotAttempt } from "../emulated-verifier/reach";
+import { ensureReposOpen } from "../emulated-verifier/open-repo";
 import { assertNuri } from "./sparql";
-import { isMachinerySubject } from "./machinery";
-import type { Nuri } from "./types";
+import { isMachinerySubject } from "../emulated-verifier/machinery";
+import type { Nuri } from "../model/types";
 
 // Keep the primitives referenced so tree-shaking never drops the import used by
 // the (side-effecting) open step below; `docCreate`/`sparqlUpdate` are not used

packages/client/src/surface/subscribe.ts

@@ -33,9 +33,9 @@
  * builds a set of these with per-doc error isolation to preserve that property.
  */
 
-import { getConfig, getStoreRegistryDeps } from "./polyfill";
-import { assertMayReach } from "./reach";
-import type { Nuri } from "./types";
+import { getConfig, getStoreRegistryDeps } from "../polyfill";
+import { assertMayReach } from "../emulated-verifier/reach";
+import type { Nuri } from "../model/types";
 
 /**
  * A push from the platform to a document subscriber. Loosely typed: the raw

packages/client/src/surface/use-shape.ts

@@ -6,8 +6,8 @@
  * only delivers documents whose cap the wallet holds.
  */
 
-import { getConfig, getCaps } from "./polyfill";
-import { makeReadFilteredView } from "./read-filter";
+import { getConfig, getCaps } from "../polyfill";
+import { makeReadFilteredView } from "../emulated-verifier/read-filter";
 
 export function useShape(shapeType: unknown, scope: unknown): unknown {
   const set = getConfig().useShape(shapeType, scope) as object;

packages/client/src/surface/watch-shape.ts

@@ -51,12 +51,12 @@
  * `isError` fires ONLY on a real thrown exception in the pipeline.
  */
 
-import { getCaps, getCurrentUser } from "./polyfill";
-import { ensureReposOpen, getSyncState } from "./open-repo";
+import { getCaps, getCurrentUser } from "../polyfill";
+import { ensureReposOpen, getSyncState } from "../emulated-verifier/open-repo";
 import { readUnion, type UnionSubject } from "./read-model";
 import { subscribeDoc, type Unsubscribe } from "./subscribe";
-import { listMyEntityDocs, userStoreDoc } from "./store-registry";
-import type { Nuri, Scope } from "./types";
+import { listMyEntityDocs, userStoreDoc } from "../shared-wallet/account-registry";
+import type { Nuri, Scope } from "../model/types";
 
 /**
  * The RDF `type` predicate IRI. A SHEX shape pins its class via a triple