@tokenoftrust/storefront-runner 2.4.87 → 2.4.89

package/apps/storefront/src/components/{islands → content/storefront/islands}/MobileNav.tsx

@@ -11,8 +11,8 @@
  * prefers-reduced-motion.
  */
 import { useCallback, useEffect, useRef, useState } from "preact/hooks";
-import { isCurrentNavHref } from "@/lib/chrome/navCurrent";
-import { CHROME_PLACEMENT } from "@/lib/chrome/trackingPlacements";
+import { isCurrentNavHref } from "@/lib/content/chrome/navCurrent";
+import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { trackingAttributes } from "@tot/public-runtime";
 
 /**

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/CardGrid.astro

@@ -4,8 +4,8 @@
  * component, three visual variants (density + emphasis). Cards may link
  * internally (base-path prefixed) or externally.
  */
-import Section from "@/components/Section.astro";
-import type { CardGridBlock } from "@/lib/storyblok/content-model";
+import Section from "@/components/content/storefront/Section.astro";
+import type { CardGridBlock } from "@/lib/content/storyblok/content-model";
 import { withBase } from "@/lib/basePath";
 
 interface Props {

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/CodeSample.astro

@@ -5,7 +5,7 @@
  * inject markup or scripts. Samples must be public/server-side framed — never
  * embed secret keys or tokens (see the epic's D7 secret-scan guardrail).
  */
-import type { CodeSample } from "@/lib/storyblok/content-model";
+import type { CodeSample } from "@/lib/content/storyblok/content-model";
 interface Props {
   sample: CodeSample;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/CtaBand.astro

@@ -3,8 +3,8 @@
  * <CtaBand> — the final conversion band: a headline, optional subhead, and a
  * centered CTA row. Sits on the surface tone to close the page.
  */
-import type { CtaBandBlock } from "@/lib/storyblok/content-model";
-import MarketingCtas from "@/components/marketing/MarketingCtas.astro";
+import type { CtaBandBlock } from "@/lib/content/storyblok/content-model";
+import MarketingCtas from "@/components/content/storefront/marketing/MarketingCtas.astro";
 interface Props {
   block: CtaBandBlock;
   basePath: string;

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/Faq.astro

@@ -3,13 +3,13 @@
  * <Faq> — a no-JS accordion of question/answer pairs using native
  * <details>/<summary>. Emits FAQPage JSON-LD so answers are eligible for rich
  * results — unless the tenant declares a structured-data profile, which owns every
- * JSON-LD node on the page (lib/seo/structuredData.ts). Answers are plain text
+ * JSON-LD node on the page (lib/content/seo/structuredData.ts). Answers are plain text
  * (auto-escaped).
  */
-import Section from "@/components/Section.astro";
-import type { FaqBlock } from "@/lib/storyblok/content-model";
-import { safeJsonScriptContent } from "@/lib/jsonScript";
-import { structuredDataProfile } from "@/lib/seo/structuredData";
+import Section from "@/components/content/storefront/Section.astro";
+import type { FaqBlock } from "@/lib/content/storyblok/content-model";
+import { safeJsonScriptContent } from "@/lib/content/shared/jsonScript";
+import { structuredDataProfile } from "@/lib/content/seo/structuredData";
 interface Props {
   block: FaqBlock;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/Integrations.astro

@@ -4,9 +4,9 @@
  * platform names/links, optional implementation points, and an optional safe
  * code sample. Platform links open externally when they carry an http href.
  */
-import Section from "@/components/Section.astro";
-import CodeSample from "@/components/marketing/CodeSample.astro";
-import type { IntegrationsBlock } from "@/lib/storyblok/content-model";
+import Section from "@/components/content/storefront/Section.astro";
+import CodeSample from "@/components/content/storefront/marketing/CodeSample.astro";
+import type { IntegrationsBlock } from "@/lib/content/storyblok/content-model";
 import { withBase } from "@/lib/basePath";
 
 interface Props {

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/MarketingBlocks.astro

@@ -5,17 +5,17 @@
  * block is styled through theme tokens and reads its copy from tenant content.
  * Reused by the homepage and (future) marketing content pages.
  */
-import type { MarketingBlock } from "@/lib/storyblok/content-model";
-import MarketingHero from "@/components/marketing/MarketingHero.astro";
-import TrustBar from "@/components/marketing/TrustBar.astro";
-import SplitCompare from "@/components/marketing/SplitCompare.astro";
-import Steps from "@/components/marketing/Steps.astro";
-import CardGrid from "@/components/marketing/CardGrid.astro";
-import Integrations from "@/components/marketing/Integrations.astro";
-import ProofStrip from "@/components/marketing/ProofStrip.astro";
-import Testimonials from "@/components/marketing/Testimonials.astro";
-import Faq from "@/components/marketing/Faq.astro";
-import CtaBand from "@/components/marketing/CtaBand.astro";
+import type { MarketingBlock } from "@/lib/content/storyblok/content-model";
+import MarketingHero from "@/components/content/storefront/marketing/MarketingHero.astro";
+import TrustBar from "@/components/content/storefront/marketing/TrustBar.astro";
+import SplitCompare from "@/components/content/storefront/marketing/SplitCompare.astro";
+import Steps from "@/components/content/storefront/marketing/Steps.astro";
+import CardGrid from "@/components/content/storefront/marketing/CardGrid.astro";
+import Integrations from "@/components/content/storefront/marketing/Integrations.astro";
+import ProofStrip from "@/components/content/storefront/marketing/ProofStrip.astro";
+import Testimonials from "@/components/content/storefront/marketing/Testimonials.astro";
+import Faq from "@/components/content/storefront/marketing/Faq.astro";
+import CtaBand from "@/components/content/storefront/marketing/CtaBand.astro";
 
 interface Props {
   blocks: MarketingBlock[];

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/MarketingCtas.astro

@@ -5,7 +5,7 @@
  * a new tab with rel="noopener"; same-origin root-absolute hrefs get the tenant
  * base-path prefix so path-routed tenants stay in-tenant.
  */
-import type { MarketingCta } from "@/lib/storyblok/content-model";
+import type { MarketingCta } from "@/lib/content/storyblok/content-model";
 import { withBase } from "@/lib/basePath";
 
 interface Props {

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/MarketingHero.astro

@@ -5,8 +5,8 @@
  * Right (optional): a "product moment" panel of demo/evidence log lines.
  * All copy is plain text (auto-escaped); no raw HTML is rendered.
  */
-import type { MarketingHeroBlock } from "@/lib/storyblok/content-model";
-import MarketingCtas from "@/components/marketing/MarketingCtas.astro";
+import type { MarketingHeroBlock } from "@/lib/content/storyblok/content-model";
+import MarketingCtas from "@/components/content/storefront/marketing/MarketingCtas.astro";
 
 interface Props {
   block: MarketingHeroBlock;

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/ProofStrip.astro

@@ -4,7 +4,7 @@
  * data"). A bold statement + supporting copy + a grid of proof bullets. Painted
  * in the primary color for a single strong moment. Plain text only.
  */
-import type { ProofStripBlock } from "@/lib/storyblok/content-model";
+import type { ProofStripBlock } from "@/lib/content/storyblok/content-model";
 interface Props {
   block: ProofStripBlock;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/SplitCompare.astro

@@ -4,8 +4,8 @@
  * patchwork" vs "one platform"). The `before` column reads as the problem
  * (muted, ⚠) and `after` as the solution (accent, ✓).
  */
-import Section from "@/components/Section.astro";
-import type { SplitCompareBlock } from "@/lib/storyblok/content-model";
+import Section from "@/components/content/storefront/Section.astro";
+import type { SplitCompareBlock } from "@/lib/content/storyblok/content-model";
 interface Props {
   block: SplitCompareBlock;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/Steps.astro

@@ -3,8 +3,8 @@
  * <Steps> — a numbered/emoji journey (e.g. the checkout verification flow).
  * Renders as a horizontal-scrolling rail on small screens, a wrapped row above.
  */
-import Section from "@/components/Section.astro";
-import type { StepsBlock } from "@/lib/storyblok/content-model";
+import Section from "@/components/content/storefront/Section.astro";
+import type { StepsBlock } from "@/lib/content/storyblok/content-model";
 interface Props {
   block: StepsBlock;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/Testimonials.astro

@@ -3,8 +3,8 @@
  * <Testimonials> — outcome/quote cards with an optional stat lead-in and
  * attribution, plus an optional row of rating tokens. Plain text only.
  */
-import Section from "@/components/Section.astro";
-import type { TestimonialsBlock } from "@/lib/storyblok/content-model";
+import Section from "@/components/content/storefront/Section.astro";
+import type { TestimonialsBlock } from "@/lib/content/storyblok/content-model";
 interface Props {
   block: TestimonialsBlock;
 }

package/apps/storefront/src/components/{marketing → content/storefront/marketing}/TrustBar.astro

@@ -3,7 +3,7 @@
  * <TrustBar> — a quiet horizontal strip of proof tokens (countries, standards,
  * platform names, ratings). Plain text, dot-separated on small screens.
  */
-import type { TrustBarBlock } from "@/lib/storyblok/content-model";
+import type { TrustBarBlock } from "@/lib/content/storyblok/content-model";
 interface Props {
   block: TrustBarBlock;
 }

package/apps/storefront/src/components/{style-guide → content/storefront/style-guide}/StyleGuideNav.astro

@@ -14,7 +14,7 @@
  * aria-current="page". When `headings` is supplied (the guide's H2 outline) a
  * nested table of contents is rendered as in-page anchor links.
  */
-import { styleGuideHref } from "@/lib/styleGuidePaths";
+import { styleGuideHref } from "@/lib/content/shared/styleGuidePaths";
 
 type Active = "index" | "tenant" | "components" | "chrome" | "guide";
 

package/apps/storefront/src/components/{the-build → content/storefront/the-build}/TheBuildIndexView.astro

@@ -5,11 +5,11 @@
 // implements, can't drift between the two routes (the-build sibling of fb-1791301493691-brzl6f —
 // mirrors @/components/blog/BlogIndexView.astro).
 import Layout from "@/layouts/Layout.astro";
-import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
-import type { BlogPostSummary } from "@/lib/blog/types.js";
-import type { TheBuildIndexCopy } from "@/lib/the-build/pagination.js";
-import type { BlogPresentation } from "@/lib/blog/presentation.js";
-import { collectionPathsV1 } from "@/lib/blog/collectionPaths.js";
+import PostAccessBadge from "@/components/content/storefront/blog/PostAccessBadge.astro";
+import type { BlogPostSummary } from "@/lib/content/blog/types.js";
+import type { TheBuildIndexCopy } from "@/lib/content/the-build/pagination.js";
+import type { BlogPresentation } from "@/lib/content/blog/presentation.js";
+import { collectionPathsV1 } from "@/lib/content/blog/collectionPaths.js";
 
 interface Props {
   basePath: string;

package/apps/storefront/src/components/customers/storefront/islands/SavedList.tsx

@@ -11,8 +11,8 @@ import {
   WISHLIST_EVENT,
   type SavedItem,
 } from "@/lib/customers/shared/wishlist";
-import { formatPrice } from "@/lib/format";
-import { placeholderDataUri, isUsableImageUrl } from "@/lib/placeholder";
+import { formatPrice } from "@/lib/content/shared/format";
+import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
 import { withClientBase } from "@/lib/basePath";
 
 interface Props {

package/apps/storefront/src/config/adminTargetTenant.ts

@@ -4,7 +4,7 @@
  *
  * The admin console can operate on a target tenant that differs from the routed
  * (adminApp) tenant on `Astro.locals.tenant` — a real ToT-staff session may point
- * `targetTenant` at another tenant it has access to (see lib/adminTenantEnvelope).
+ * `targetTenant` at another tenant it has access to (see lib/access/shared/adminTenantEnvelope).
  * Panels that need the target's real config (e.g. the checkout appearance
  * panel, which derives from `theme_tokens` + `commerce.checkout`) resolve it HERE,
  * in the config layer, rather than reaching into the static tenant map — so they

package/apps/storefront/src/config/devTenants.ts

@@ -1,7 +1,7 @@
 /**
  * Dev-only tenant-registry seam for the localhost sign-in bypass.
  *
- * `lib/auth/devAuth` can't import the concrete static tenant map directly
+ * `lib/access/auth/devAuth` can't import the concrete static tenant map directly
  * (tenancy-resolver-fence — the registry stays behind the `config` boundary so a
  * single-tenant extraction stays a drop-in). This exposes exactly the one thing
  * that bypass needs: the resources a local dev session is granted membership on.

package/apps/storefront/src/config/resolver.ts

@@ -31,7 +31,7 @@ import { KvTenantResolver, putTenant } from "@/config/kvTenantResolver";
 import { getTenantTheme } from "@/themes/tenants";
 import { devTenantsToSeed } from "@/config/devTenantSeed";
 import { tenantAnalyticsRawById } from "@/config/tenantAnalyticsFiles";
-import { MemoryKv } from "@/lib/memoryKv";
+import { MemoryKv } from "@/lib/developer-experience/shared/memoryKv";
 
 // LOCAL dev loop discovery: enumerate the colocated tenant dirs on disk,
 // INCLUDING a developer's checkout grafted in by `tot dev` (scripts/tot-dev.mjs).

package/apps/storefront/src/layouts/Layout.astro

@@ -8,10 +8,10 @@ import "@/styles/global.css";
 // Self-hosted web fonts (audit finding 6) — replaces the render-blocking
 // fonts.googleapis.com stylesheet. Bundled by Vite, served same-origin.
 import "@/styles/fonts.css";
-import Seo from "@/components/Seo.astro";
-import AnnouncementBar from "@/components/chrome/AnnouncementBar.astro";
-import SiteHeader from "@/components/chrome/SiteHeader.astro";
-import SiteFooter from "@/components/chrome/SiteFooter.astro";
+import Seo from "@/components/content/storefront/Seo.astro";
+import AnnouncementBar from "@/components/content/storefront/chrome/AnnouncementBar.astro";
+import SiteHeader from "@/components/content/storefront/chrome/SiteHeader.astro";
+import SiteFooter from "@/components/content/storefront/chrome/SiteFooter.astro";
 import QuickView from "@/components/catalog/storefront/islands/QuickView.tsx";
 import CheckoutLoader from "@/components/checkout/storefront/commerce/CheckoutLoader.astro";
 import CartDrawerStyles from "@/components/checkout/storefront/commerce/CartDrawerStyles.astro";
@@ -21,23 +21,23 @@ import ShippingRestrictionNotice from "@/components/compliance/storefront/compli
 import ExciseTaxNotice from "@/components/compliance/storefront/compliance/ExciseTaxNotice.astro";
 import { EXCISE_TAX_DISCLOSURE_TEXT } from "@/lib/compliance/rawComplianceNotices";
 import IsolatedAgeGate from "@/components/compliance/storefront/islands/IsolatedAgeGate.tsx";
-import AuthBadge from "@/components/auth/AuthBadge.astro";
+import AuthBadge from "@/components/access/storefront/auth/AuthBadge.astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
-import { organizationLd, websiteLd } from "@/lib/jsonld";
-import { composeStructuredData, structuredDataProfile, type StructuredDataPage } from "@/lib/seo/structuredData";
-import { canonicalUrl } from "@/lib/seo/urlForm";
-import { documentTitle } from "@/lib/seo/documentTitle";
-import { nonceInlineTags, prefixApiFormActions, CHROME_BODY_MARKER } from "@/lib/rawMarketingHtml";
-import { CHROME_BEHAVIOR_JS, CHROME_HEAD_JS, sanitizeSharedChromeFragment } from "@/lib/rawChrome";
-import { ASYNC_CSS_SWAP_JS } from "@/lib/asyncCss";
-import { reportTrackingChainHealth } from "@/lib/tracking/interactionHealth";
-import { resolveHeaderVariant, resolveFooterVariant } from "@/lib/chrome/variant";
-import { splitFooterLegal } from "@/lib/chrome/footerLegal";
-import { bindManagedCartAnchors, managedCartHref } from "@/lib/chrome/managedCart";
-import type { HeaderVariant, FooterVariant } from "@/lib/chrome/model";
+import { organizationLd, websiteLd } from "@/lib/content/shared/jsonld";
+import { composeStructuredData, structuredDataProfile, type StructuredDataPage } from "@/lib/content/seo/structuredData";
+import { canonicalUrl } from "@/lib/content/seo/urlForm";
+import { documentTitle } from "@/lib/content/seo/documentTitle";
+import { nonceInlineTags, prefixApiFormActions, CHROME_BODY_MARKER } from "@/lib/content/shared/rawMarketingHtml";
+import { CHROME_BEHAVIOR_JS, CHROME_HEAD_JS, sanitizeSharedChromeFragment } from "@/lib/content/shared/rawChrome";
+import { ASYNC_CSS_SWAP_JS } from "@/lib/content/shared/asyncCss";
+import { reportTrackingChainHealth } from "@/lib/measurement/tracking/interactionHealth";
+import { resolveHeaderVariant, resolveFooterVariant } from "@/lib/content/chrome/variant";
+import { splitFooterLegal } from "@/lib/content/chrome/footerLegal";
+import { bindManagedCartAnchors, managedCartHref } from "@/lib/content/chrome/managedCart";
+import type { HeaderVariant, FooterVariant } from "@/lib/content/chrome/model";
 import { renderIntegrationPhases, INTERACTION_TRACKING_BOOT_JS } from "@tot/public-runtime";
-import { readViewerSession } from "@/lib/auth/route";
+import { readViewerSession } from "@/lib/access/auth/route";
 import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
@@ -54,7 +54,7 @@ interface Props {
   jsonLd?: Record<string, unknown> | Record<string, unknown>[];
   /**
    * What the page knows about itself for the tenant's declared structured-data profile
-   * (lib/seo/structuredData.ts). When the profile declares a graph for `pageType`, that graph
+   * (lib/content/seo/structuredData.ts). When the profile declares a graph for `pageType`, that graph
    * is the page's ONLY JSON-LD and `jsonLd` is not emitted.
    */
   structuredData?: StructuredDataPage;
@@ -66,7 +66,7 @@ interface Props {
   fullBleed?: boolean;
   /**
    * Explicit per-page header/footer content-variant override (see
-   * lib/chrome/model.ts HeaderVariant/FooterVariant). NEVER inferred from the
+   * lib/content/chrome/model.ts HeaderVariant/FooterVariant). NEVER inferred from the
    * route/CSS/title — a page that wants e.g. a minimal checkout header sets
    * this prop. Absent ⇒ the tenant's chrome-config default
    * (chrome.header.variant / chrome.footer.variant). An unrecognized value
@@ -76,7 +76,7 @@ interface Props {
   headerVariant?: HeaderVariant;
   footerVariant?: FooterVariant;
   // --- Article SEO hardening: pass-through to <Seo> (all additive) ---
-  article?: import("@/lib/seo/meta.js").ArticleMeta;
+  article?: import("@/lib/content/seo/meta.js").ArticleMeta;
   imageAlt?: string;
   imageWidth?: number;
   imageHeight?: number;
@@ -86,7 +86,7 @@ interface Props {
   // --- hreflang / <html lang> (additive) ---
   /** Per-variant `hreflang` alternates for a translated article; threaded to
    *  <Seo>. Absent/empty ⇒ no alternate links (singleton unchanged). */
-  alternates?: import("@/lib/seo/alternates.js").Alternate[];
+  alternates?: import("@/lib/content/seo/alternates.js").Alternate[];
   /** Overrides `<html lang>` (e.g. a translated article's `inLanguage`). Absent ⇒
    *  the tenant-locale default, so non-translated pages are unchanged. */
   lang?: string;
@@ -156,7 +156,7 @@ const chrome = await Astro.locals.content.getChrome();
 
 // Explicit variant resolution (fail-closed): the page's override wins over
 // the tenant's chrome-config default; an unrecognized value throws with an
-// actionable message rather than silently falling back (lib/chrome/variant.ts).
+// actionable message rather than silently falling back (lib/content/chrome/variant.ts).
 const resolvedHeaderVariant = resolveHeaderVariant(headerVariant, chrome.header.variant);
 const resolvedFooterVariant = resolveFooterVariant(footerVariant, chrome.footer.variant);
 const footerCompliance = [chrome.footer.warning, chrome.complianceStrip]
@@ -256,7 +256,7 @@ const themeHeaderLogo =
     ? { src: headerLogoSrc, alt: tenant.displayName }
     : undefined;
 
-// chrome.header.brand (lib/chrome/model.ts ChromeBrand) is the governed,
+// chrome.header.brand (lib/content/chrome/model.ts ChromeBrand) is the governed,
 // schema-validated brand identity — SOURCE OF TRUTH per field when set,
 // falling back to the theme-derived values above only where a field is
 // absent, so a tenant that hasn't authored a brand config is unaffected.
@@ -268,7 +268,7 @@ const headerBrandHref = brand?.href;
 
 // Footer bottom bar: a "Legal"-titled column MOVES out of the grid and its
 // links render beside the copyright — one shared split with the raw renderer
-// (lib/chrome/footerLegal.ts), so neither surface can duplicate them.
+// (lib/content/chrome/footerLegal.ts), so neither surface can duplicate them.
 const { gridColumns: footerColumns, legalLinks: bottomLinks } = splitFooterLegal(
   chrome.footer.columns,
 );
@@ -601,7 +601,7 @@ const footerWidgets = await renderWidgetSlot(
         where PerformanceObserver is absent. This is the per-route-template
         signal the `core-web-vitals` monitor consumes. */}
     <script>
-      import { startConsentGatedWebVitals } from "@/lib/analytics/webVitals";
+      import { startConsentGatedWebVitals } from "@/lib/observability/performance/webVitals";
       startConsentGatedWebVitals();
     </script>
 
@@ -631,12 +631,12 @@ const footerWidgets = await renderWidgetSlot(
         listener, and the install-once marker makes a double install a no-op —
         which is what makes the raw chrome wrapper spliced into this document
         (above) safe. Emitted as `is:inline` + the page nonce so it needs no
-        entry in lib/cspStaticHashes.ts. */}
+        entry in lib/access/shared/cspStaticHashes.ts. */}
     <script is:inline nonce={cspNonce} set:html={INTERACTION_TRACKING_BOOT_JS}></script>
 
     {/* Swaps every <AsyncStylesheet>-rendered preload link to rel="stylesheet"
         once fetched. ONE nonced script per document handles every such link,
-        however many <AsyncStylesheet> instances rendered (lib/asyncCss.ts —
+        however many <AsyncStylesheet> instances rendered (lib/content/shared/asyncCss.ts —
         the onload="" attribute trick can't carry a nonce under this CSP). A
         no-op when the page has none. */}
     <script is:inline nonce={cspNonce} set:html={ASYNC_CSS_SWAP_JS}></script>

package/apps/storefront/src/lib/{admin → access/admin}/README.md

@@ -10,8 +10,8 @@ these implement.
 ## Tenant envelope
 
 The canonical tenant envelope is `AdminTenantEnvelope`, defined in
-`lib/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
-`lib/admin/envelope.ts` so everything under `lib/admin/**` can import it from
+`lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
+`lib/access/admin/envelope.ts` so everything under `lib/admin/**` can import it from
 a stable relative path:
 
 ```ts
@@ -29,7 +29,7 @@ refused not hidden-only). `targetTenant` is the sole key mock services use to
 select/derive data. **Authorization must always be evaluated against
 `targetTenant`, never `adminAppTenant`** (decision `tenant-envelope-contract`).
 
-(`lib/admin/envelope.ts` used to declare its own 2-field copy of this
+(`lib/access/admin/envelope.ts` used to declare its own 2-field copy of this
 interface — data-view-contracts and admin-tenant-mode were built in parallel
 per that decision, with no live coordination. Reconciled here per decision
 `envelope-type-duplication-follow-up`: one canonical type, re-exported.)

package/apps/storefront/src/lib/{admin → access/admin}/adminShell.ts

@@ -10,7 +10,7 @@
  * only (window.__toTAdminAsk + a "tot:admin-ask" CustomEvent), never sent over
  * the network.
  */
-import { buildAskEnvelope, type AskEnvelope } from "./ai/askEnvelope";
+import { buildAskEnvelope, type AskEnvelope } from "../../automation/ai/askEnvelope";
 
 /** Static shell data shared by server-rendered navigation and browser startup. */
 export const ADMIN_SHELL_CONFIG = {

package/apps/storefront/src/lib/{admin → access/admin}/envelope.ts

@@ -1,9 +1,9 @@
 /**
  * Canonical tenant envelope for the admin console lives in
- * `lib/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
+ * `lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
  * staff-override authorization (`resolveAdminTenantMode`) that admin.astro
  * actually runs. This module re-exports that type so every mock service under
  * `lib/admin/**` can keep importing it from a stable relative path
  * (`../../envelope`) without declaring a second, competing interface.
  */
-export type { AdminTenantEnvelope } from "@/lib/adminTenantEnvelope";
+export type { AdminTenantEnvelope } from "@/lib/access/shared/adminTenantEnvelope";

package/apps/storefront/src/lib/{admin → access/admin}/viewmodels/settings.ts

@@ -7,8 +7,8 @@
  */
 
 import type { CheckoutStyle } from "@tot/public-runtime";
-import type { ApprovalMode } from "../ai/approvalMode";
-import type { AuditEvent } from "../ai/audit";
+import type { ApprovalMode } from "../../../automation/ai/approvalMode";
+import type { AuditEvent } from "../../../automation/ai/audit";
 
 export type { ApprovalMode };
 export type { CheckoutStyle };

package/apps/storefront/src/lib/{auth → access/auth}/adminApiGuard.ts

@@ -17,8 +17,8 @@
  * Astro/I-O wrapper the routes call.
  */
 import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/auth/adminEntry";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/access/auth/adminEntry";
 import type { SessionRecord } from "./session.js";
 
 export type AdminApiAccess =

package/apps/storefront/src/lib/{auth → access/auth}/adminEntry.ts

@@ -31,14 +31,14 @@
  */
 import type { SessionRecord } from "./session.js";
 import { sessionHostCapability } from "./loginGate.js";
-import { staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import {
   decideIsOwner,
   isOwnerCapability,
   resolveShipCapabilities,
   type Capability,
   type ShipCapabilities,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** Which entry case a viewer is in, for chrome + the DoD test matrix. */
 export type AdminEntryPrincipal =

package/apps/storefront/src/lib/{auth → access/auth}/adminLanding.ts

@@ -25,7 +25,7 @@
 import type { SessionRecord } from "./session.js";
 import { sessionAdmitsHost } from "./loginGate.js";
 import { safeNext } from "./route.js";
-import { selectTenant } from "@/lib/dashboard/tenantSelection";
+import { selectTenant } from "@/lib/access/dashboard/tenantSelection";
 
 /** The tenant-selection surface, in both host-routed and tenant-first path forms. */
 export function isAdminSelectPath(pathname: string): boolean {

package/apps/storefront/src/lib/{auth → access/auth}/identityToken.ts

@@ -31,7 +31,7 @@ import {
   TENANT_ROLES,
   isTenantRole,
   type TenantRole,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** tot's issuer — consumers pin/allowlist this (`auth.jwt.issuer`). */
 export const TOT_ISSUER = "tokenoftrust-internal-ops";

package/apps/storefront/src/lib/{auth → access/auth}/loginGate.ts

@@ -13,8 +13,8 @@
  * drifting apart. The auth surface itself (/auth/*, /api/auth/*) is always exempt
  * so a visitor can actually sign in.
  */
-import { hostInGateList } from "@/lib/demoGate";
-import { normalizeMemberships, staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { hostInGateList } from "@/lib/access/shared/demoGate";
+import { normalizeMemberships, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import type { SessionRecord } from "./session.js";
 
 export type GateMode = "password" | "login";

package/apps/storefront/src/lib/{auth → access/auth}/totAccessClient.ts

@@ -27,8 +27,8 @@
  * bodies, response shapes) is contract-fixed.
  */
 import { readEnv } from "@/lib/env";
-import { diagEmail } from "@/lib/diag/redact";
-import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/http/fetchTransport";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 import { classifyStepUp, type StepUpChallenge, type StepUpObligation } from "./stepUpChallenge.js";
 
 /** `send` is deliberately opaque — it never reveals whether the email was eligible. */
@@ -49,7 +49,7 @@ export type AccessCodeVerifyResult =
        * Present-usually, NOT guaranteed: tot returns the flat result without it
        * if signing hiccups (contract §6 graceful degradation). Phase 3 verifies
        * this OFFLINE and derives the session from its claims rather than trusting
-       * the flat `roles`/`capability`. See `@/lib/auth/identityToken`.
+       * the flat `roles`/`capability`. See `@/lib/access/auth/identityToken`.
        */
       id_token?: string;
     }
@@ -128,7 +128,7 @@ export interface TotAccessClient {
  * (signer degradation, contract §6); the consumer fails closed when it's absent.
  *
  * The `step-up-required`/`success-pending` variants carry tot20's RFC 9470
- * obligations (see `@/lib/auth/stepUpChallenge`) instead of a plain failure
+ * obligations (see `@/lib/access/auth/stepUpChallenge`) instead of a plain failure
  * reason, so the caller can drive the SMS completion loop rather than just
  * showing a generic "invalid code" error.
  */

package/apps/storefront/src/lib/{dashboard → access/dashboard}/delegateGate.ts

@@ -22,8 +22,8 @@
  * the page, matching `@/lib/dashboard/tenantSelection` and `@/lib/auth/loginGate`.
  */
 import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
-import { membershipFor, staffAdmits } from "@/lib/dashboard/tenantSelection";
-import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSelection";
+import { membershipFor, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
+import type { StaffAdmission, TenantMembership } from "@/lib/access/dashboard/tenantSelection";
 
 /** What every viewer of an unpaid store is told in place of the delegate section. */
 export const UNPAID_DELEGATION_NOTE =

package/apps/storefront/src/lib/{dashboard → access/dashboard}/staffAdmission.ts

@@ -12,7 +12,7 @@
  * scoped to the returned staffRoles capability. It is stamped on the session as a
  * DISTINCT marker from `tenants[]` — never a synthesized membership.
  */
-import type { SessionRecord, StaffSelection } from "@/lib/auth/session";
+import type { SessionRecord, StaffSelection } from "@/lib/access/auth/session";
 
 /**
  * Staff selection lifetime. Deliberately short: staff cross-vendor access is a

package/apps/storefront/src/lib/{dashboard → access/dashboard}/tenantSelection.ts

@@ -17,7 +17,7 @@
  * tot20 populates all of the email's memberships. Flagged to the workstream lead.
  */
 
-import type { StaffSelection } from "@/lib/auth/session";
+import type { StaffSelection } from "@/lib/access/auth/session";
 
 /** One tenant membership carried in the verified session. */
 export interface TenantMembership {

package/apps/storefront/src/lib/{admin/services/mock → access/fixtures}/settings.ts

@@ -1,8 +1,8 @@
 import { DEFAULT_CHECKOUT_STYLE } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../envelope";
-import { memoizeByEnvelope } from "../../memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../seed";
-import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../../viewmodels/settings";
+import type { AdminTenantEnvelope } from "../admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../admin/viewmodels/settings";
 
 const SECTION_DEFS: Omit<SettingsSection, "riskyChangeReview">[] = [
   { key: "store", label: "Store", summary: "Store profile, branding, and white-label copy." },

package/apps/storefront/src/lib/{email → access/notifications}/magicLinkInviteEmail.ts

@@ -1,7 +1,7 @@
 /**
  * The storefront's OWN branded developer-invite email (magic-link flow). The storefront
  * owns presentation now — this is our template, our brand, rendered here and handed to
- * tot20 only for transport (see lib/messaging/messagesClient.ts). A single primary CTA
+ * tot20 only for transport (see lib/engagement/messaging/messagesClient.ts). A single primary CTA
  * links to the GET-safe /auth/magic landing carrying the one-time token.
  *
  * Email HTML rules: inline styles only (no <style>/external CSS — mail clients strip them),