feat. refactor Proof SDK into standalone publishable packages

[tmchow]

Why

This PR completes the first pass of making the @proof/* packages real standalone packages instead of thin monorepo aliases.

Before this branch:

• the package directories existed, but much of the real implementation still lived in root src/ and server/
• non-core packages exported raw source instead of built artifacts
• package boundaries were blurry enough that the workspace layout itself was doing a lot of the work

The goal here is to make the package boundaries honest and publishable.

The biggest architecture choice in this PR is @proof/editor: instead of moving the entire browser runtime into the package, this branch narrows @proof/editor to reusable editor modules and keeps the app/web runtime out of the package surface.

What Changed

1. Package-owned source now lives in the packages

The package directories now own the implementation for the reusable/public parts of:

• @proof/core
• @proof/editor
• @proof/server
• @proof/sqlite

That includes moving the core marks/provenance code, the reusable editor plugins/schema/utilities, the server route/runtime modules, and the sqlite store contract under packages/.

The old root files under src/ and server/ are mostly compatibility shims now, so existing internal imports still work while the package boundaries become the source of truth.

2. The package surfaces are explicit now

This branch adds explicit package exports and subpath exports instead of relying on broad re-export behavior.

Notable change:

• @proof/editor no longer exports the old ./editor browser runtime entrypoint

That runtime is app/web-runtime code, not a clean reusable SDK module. Narrowing the package surface makes the package boundary more honest and avoids shipping a disguised application singleton as part of the editor SDK.

3. The non-core packages are now buildable/publishable

@proof/editor, @proof/server, and @proof/sqlite now:

• build to dist/
• publish JS from built artifacts instead of raw src/*.ts
• emit .d.ts files for the published exports
• declare their runtime dependencies directly
• include basic publish metadata (repository, homepage, bugs, license, keywords, publishConfig)

The workspace root stays private.

4. Package validation is part of the branch now

This branch adds package-focused verification instead of relying on the monorepo shape:

• package surface import tests
• editor extraction regression tests
• server shim/facade alignment tests
• packed external-consumer smoke test using npm pack

The packed-consumer test was tightened so it only links the dependencies actually declared by the packed @proof/* packages. That means missing dependency declarations now fail in the test instead of being hidden by the repo root install.

As part of manual local testing, this branch also fixes the local /d/:slug share-page wiring that was affected by the server extraction and adds regression coverage around that path.

Review Guide

This is a large refactor, so the easiest way to review it is in this order:

1. package.json files and scripts/build-package.mjs

   • package shape
   • exports
   • build/publish contract

2. src/tests/*package* and related regression tests

   • what contract is being preserved/proved

3. packages/doc-core/**

   • smallest, cleanest completed slice

4. packages/doc-editor/**

   • note the narrowed package surface and removal of ./editor

5. packages/doc-server/** and packages/doc-store-sqlite/**

   • package-owned server/sqlite runtime and route modules

6. root src/** and server/** shims

   • compatibility layer only

Testing

Ran:

• npm run build
• npm run test:packages
• npm run pack:packages

This now covers built package outputs, package-name imports, packed external-consumer imports, and local share-page regressions uncovered during manual testing.

Out Of Scope / Follow-ups

This PR is about standalone package ownership and publishability, not root-app adoption.

Intentionally not included here:

• changing the root app/server to consume only package-name imports everywhere
• creating a separate publishable web-runtime package for the old editor singleton
• optimizing @proof/server package size

Known follow-up worth tracking:

• @proof/server packs a large tarball because it includes bundled runtime code plus OG-share assets

[tmchow]

@dshipper I realize how insane the changeset is given the line count, but it's a complete refactor to try to improve the overall architecture. I also realize it'll be easy to punt on this, so I won't be offended :)