Initial scaffold: @ng-eventually/client — SDK-shaped polyfill over NextGraph

Generic polyfill layer that makes a single NextGraph broker behave like the
not-yet-shipped multi-user NextGraph (emulated capabilities + inbox). Zero app domain.

@ng-eventually/client exposes an SDK-identical surface (ng, useShape, inbox); the
polyfill bootstrap (configure + capability helpers) is isolated under /polyfill, so
the main entry stays a drop-in for @ng-org/web|orm. The real SDK is injected at
configure() (no hard import → build-alias safe + testable).

Scaffold: NextGraph wiring stubbed with TODO; capability helpers implemented and
unit-tested (4 tests, typecheck clean). The global-index curator is deferred — in
NextGraph apps/services are mono-user with no global data.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/use-shape.ts

@@ -0,0 +1,16 @@
+/**
+ * Wrapped `useShape`: same signature as `@ng-org/orm`. The returned reactive set
+ * is filtered to what the current user may read (emulated caps). At migration
+ * this filtering disappears — the broker only syncs authorized documents.
+ */
+
+import { getConfig } from "./polyfill";
+
+export function useShape(shapeType: unknown, scope: unknown): unknown {
+  const { useShape: real } = getConfig();
+  const set = real(shapeType, scope);
+  // TODO(polyfill): wrap `set` so iteration yields only entries whose emulated
+  // grant satisfies access.canRead(grant, getCurrentUser()), while preserving
+  // the reactivity of the underlying DeepSignalSet. This is the trickiest piece.
+  return set;
+}