@tokenoftrust/storefront-runner 2.4.87 → 2.4.89

package/apps/storefront/src/lib/{storyblok → content/storyblok}/provider.ts

@@ -33,10 +33,10 @@ import {
   tenantDirRelative,
   tenantDirSegment,
 } from "@tot/public-runtime";
-import { renderRawChrome } from "../rawChrome.js";
+import { renderRawChrome } from "../shared/rawChrome.js";
 import { parseChromeConfig } from "../chrome/parseConfig.js";
 import { parseChromeAssignments } from "../chrome/model.js";
-import { stampTrackingIdsAtPublish } from "../tracking/publishSafetyNet.js";
+import { stampTrackingIdsAtPublish } from "../../measurement/tracking/publishSafetyNet.js";
 import { readWithImagePreviewRewriteOverlay } from "@tot/public-runtime/image-preview-rewrite-overlay";
 
 /** Safe, always-valid fallback when neither the tenant's own chrome.json nor
@@ -67,7 +67,7 @@ export interface ContentProvider {
   /**
    * The tenant's shared-chrome WRAPPER document (raw HTML), or null. A full
    * document containing the CHROME_BODY_MARKER where a body-only page fragment is
-   * spliced in (see lib/rawMarketingHtml.ts). Lets raw pages stop duplicating
+   * spliced in (see lib/content/shared/rawMarketingHtml.ts). Lets raw pages stop duplicating
    * chrome: chrome lives once here, pages become fragments. File:
    * `content/<tenant>/chrome.html`. Tenant-owned (no cross-tenant fallback).
    *
@@ -110,17 +110,17 @@ export interface DerivedArtifact {
 // Per-tenant local content lives under the colocated repo-root layout
 // tenants/<tenant_id>/content/. Vite globs bundle every tenant's JSON at build
 // time; a file missing for a tenant falls back to the default scope, so a
-// partially-adopted tenant still renders. Depth: from src/lib/storyblok/ the
-// repo root is five levels up (storyblok→lib→src→storefront→apps→root).
+// partially-adopted tenant still renders. Depth: from src/lib/content/storyblok/ the
+// repo root is six levels up (storyblok→content→lib→src→storefront→apps→root).
 const homeGlobs = import.meta.glob<HomeContent>([
-  "../../../../../tenants/*/content/home.json",
-  "../../../../../tenants/e2e/*/content/home.json",
+  "../../../../../../tenants/*/content/home.json",
+  "../../../../../../tenants/e2e/*/content/home.json",
 ], {
   import: "default",
 });
 const chromeGlobs = import.meta.glob<unknown>([
-  "../../../../../tenants/*/content/chrome.json",
-  "../../../../../tenants/e2e/*/content/chrome.json",
+  "../../../../../../tenants/*/content/chrome.json",
+  "../../../../../../tenants/e2e/*/content/chrome.json",
 ], {
   import: "default",
 });
@@ -129,22 +129,22 @@ const chromeGlobs = import.meta.glob<unknown>([
 // convention as chromeGlobs above.
 const chromeAssignmentGlobs = import.meta.glob<unknown>(
   [
-    "../../../../../tenants/*/content/chrome-assignments.json",
-    "../../../../../tenants/e2e/*/content/chrome-assignments.json",
+    "../../../../../../tenants/*/content/chrome-assignments.json",
+    "../../../../../../tenants/e2e/*/content/chrome-assignments.json",
   ],
   { import: "default" },
 );
 const pageGlobs = import.meta.glob<EditorialPage>([
-  "../../../../../tenants/*/content/pages/*.json",
-  "../../../../../tenants/e2e/*/content/pages/*.json",
+  "../../../../../../tenants/*/content/pages/*.json",
+  "../../../../../../tenants/e2e/*/content/pages/*.json",
 ], {
   import: "default",
 });
 // Raw self-authored home documents (marketing tenants). `?raw` bundles the file
 // as a string; a tenant with no home.html simply has no entry here.
 const homeHtmlGlobs = import.meta.glob<string>([
-  "../../../../../tenants/*/content/home.html",
-  "../../../../../tenants/e2e/*/content/home.html",
+  "../../../../../../tenants/*/content/home.html",
+  "../../../../../../tenants/e2e/*/content/home.html",
 ], {
   query: "?raw",
   import: "default",
@@ -152,8 +152,8 @@ const homeHtmlGlobs = import.meta.glob<string>([
 // Raw self-authored SUBPAGE documents: tenants/<tenant>/content/pages-html/<slug>.html
 // (e.g. pages-html/pricing.html -> /pricing/). `**` supports nested slugs.
 const pageHtmlGlobs = import.meta.glob<string>([
-  "../../../../../tenants/*/content/pages-html/**/*.html",
-  "../../../../../tenants/e2e/*/content/pages-html/**/*.html",
+  "../../../../../../tenants/*/content/pages-html/**/*.html",
+  "../../../../../../tenants/e2e/*/content/pages-html/**/*.html",
 ], {
   query: "?raw",
   import: "default",
@@ -161,15 +161,15 @@ const pageHtmlGlobs = import.meta.glob<string>([
 // Shared-chrome wrapper document (marketing tenants that author body-only page
 // fragments). One per tenant; a tenant without it keeps serving full documents.
 const chromeHtmlGlobs = import.meta.glob<string>([
-  "../../../../../tenants/*/content/chrome.html",
-  "../../../../../tenants/e2e/*/content/chrome.html",
+  "../../../../../../tenants/*/content/chrome.html",
+  "../../../../../../tenants/e2e/*/content/chrome.html",
 ], {
   query: "?raw",
   import: "default",
 });
 const artifactGlobs = import.meta.glob<string>([
-  "../../../../../tenants/*/content/**/*",
-  "../../../../../tenants/e2e/*/content/**/*",
+  "../../../../../../tenants/*/content/**/*",
+  "../../../../../../tenants/e2e/*/content/**/*",
 ], {
   query: "?raw",
   import: "default",
@@ -251,10 +251,10 @@ async function readRawDevFile(scope: string, relative: string): Promise<string |
       import("node:url"),
       import("node:path"),
     ]);
-    // provider.ts lives at apps/storefront/src/lib/storyblok/ — the repo root is five
-    // levels up, mirroring the import.meta.glob prefix ("../../../../../tenants/...").
+    // provider.ts lives at apps/storefront/src/lib/content/storyblok/ — the repo root is six
+    // levels up, mirroring the import.meta.glob prefix ("../../../../../../tenants/...").
     const here = dirname(fileURLToPath(import.meta.url));
-    const abs = resolve(here, "../../../../..", ...tenantDirRelative(scope).split("/"), "content", relative);
+    const abs = resolve(here, "../../../../../..", ...tenantDirRelative(scope).split("/"), "content", relative);
     return await readFile(abs, "utf8");
   } catch {
     return null;
@@ -305,7 +305,7 @@ export class LocalContentProvider implements ContentProvider {
     if (loader) return loader();
     // (2) No chrome.html: render the CANONICAL shared chrome from the
     //     tenant's chrome.json — but only when it validates whole against the
-    //     consolidated ChromeConfig schema (lib/chrome/parseConfig.ts). Tenant-
+    //     consolidated ChromeConfig schema (lib/content/chrome/parseConfig.ts). Tenant-
     //     owned only, like the raw HTML above (no cross-tenant fallback).
     const config = await this.loadChromeConfig();
     if (!config) return null;
@@ -708,7 +708,7 @@ export class PublishedContentProvider implements ContentProvider {
   }
   async getChrome(): Promise<ChromeConfig> {
     // Runs through the SAME fail-closed schema validator as getChromeHtml's
-    // chrome.json branch (lib/chrome/parseConfig.ts) — a published artifact is
+    // chrome.json branch (lib/content/chrome/parseConfig.ts) — a published artifact is
     // no longer trusted blind (was: JSON.parse + a raw cast to SiteChrome).
     const config = parseChromeConfig(await this.published<unknown>("chrome.json"));
     return config ?? ((await this.usesVersionedContent()) ? EMPTY_CHROME_CONFIG : this.base.getChrome());
@@ -867,7 +867,7 @@ export class DevDraftContentProvider implements ContentProvider {
 
   /** Draft artifact for a tenant-repo-relative path, or null to fall back. */
   private draftRaw(path: string): Promise<string | null> {
-    // Key shape mirrors lib/dev/devDraft.ts devDraftKey — duplicated as a plain
+    // Key shape mirrors lib/developer-experience/dev/devDraft.ts devDraftKey — duplicated as a plain
     // template to keep this module's imports renderer-safe (public-runtime only).
     return this.get(`dev-draft:${this.tenantId}:${this.draftId}:${path}`);
   }

package/apps/storefront/src/lib/{the-build → content/the-build}/provider.ts

@@ -1,5 +1,5 @@
 // Thin wrapper binding the generic blog engine to the "the-build" collection.
-// The engine (src/lib/blog/collection.ts) is the single implementation; this
+// The engine (src/lib/content/blog/collection.ts) is the single implementation; this
 // module only fixes the collection id so existing/downstream callers can import
 // collection-bound helpers.
 import { getIndexSettings, getPost, listPosts, resolveRedirect, type Collection } from "../blog/collection.js";

package/apps/storefront/src/lib/{the-build → content/the-build}/toc.ts

@@ -5,7 +5,7 @@
 // (`annotate`), so a render path can feed `htmlWithHeadingIds(post.contentHtml)`
 // to `set:html` and `toc(post.contentHtml)` to the aside and the anchors line up.
 import { parseFragment, serialize } from "parse5";
-import { slugifyHeading } from "../content/prose.js";
+import { slugifyHeading } from "../prose.js";
 
 /** Minimal structural view of a parse5 node (duck-typed, as scripts/dev/locate.mjs does). */
 interface P5Node {

package/apps/storefront/src/lib/customers/fixtures/customers.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   BlockedReason,
   CustomerBlockedQueueRow,

package/apps/storefront/src/lib/d1/schema-apps.ts

@@ -151,7 +151,7 @@ export const activityEvents = sqliteTable(
 
 // --- Per-tenant raw-interaction store directory ------------------------------
 // The DIRECTORY of per-tenant D1 databases that hold raw declarative-tracking
-// interaction rows — one database per tenant (`lib/tracking/interactionSchema.ts`
+// interaction rows — one database per tenant (`lib/measurement/tracking/interactionSchema.ts`
 // is that database's schema). This table holds NO interaction data: only the
 // `tenant_id → (database_name, database_uuid)` mapping the Worker needs to
 // address a tenant's own database over the D1 REST API, since Worker bindings
@@ -177,7 +177,7 @@ export const trackingTenantDatabases = sqliteTable(
   {
     tenantId: text("tenant_id").primaryKey(),
     // The Cloudflare D1 database name, derived deterministically from the tenant
-    // id (`lib/tracking/tenantD1Registry.ts`) — recorded so an operator can find
+    // id (`lib/measurement/tracking/tenantD1Registry.ts`) — recorded so an operator can find
     // it in the dashboard without re-deriving.
     databaseName: text("database_name").notNull(),
     // The D1 UUID — what the REST data plane actually addresses.

package/apps/storefront/src/lib/{admin → developer-experience/admin}/memoizeByEnvelope.ts

@@ -1,4 +1,4 @@
-import type { AdminTenantEnvelope } from "./envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 
 /**
  * Per-request memoization for the pure mock view-model builders. Each builder is

package/apps/storefront/src/lib/{dev → developer-experience/dev}/activityIngestToken.ts

@@ -4,12 +4,12 @@
  * local→hosted activity bridge.
  *
  * Minted alongside the existing cli-signin-code paste
- * (apps/storefront/src/lib/dev/cliSignInCode.ts) and cached by the CLI in
+ * (apps/storefront/src/lib/developer-experience/dev/cliSignInCode.ts) and cached by the CLI in
  * ~/.tot/credentials.json. Deliberately NOT a signed token: this reuses the
  * SESSION KV binding that already exists in every environment (dev/qa/prod),
  * so it needs no new secret to provision. Revoking is just deleting the KV
  * entry — the same posture as the browser's own tot_session cookie (see
- * lib/auth/session.ts).
+ * lib/access/auth/session.ts).
  */
 
 const KEY_PREFIX = "dev-activity-token:";

package/apps/storefront/src/lib/{dev → developer-experience/dev}/cliSignInCode.ts

@@ -18,13 +18,13 @@
  * on prod the shortest form is emitted.
  *
  * `activityBridge` (optional) piggybacks the local→hosted activity-bridge credential
- * (see lib/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
+ * (see lib/developer-experience/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
  * flags — no second browser round-trip. Omitted entirely when the caller has no SESSION KV
  * to mint against — the local loop then simply runs with no hosted signal.
  */
 import { readEnv } from "@/lib/env";
-import { redactEmailForHint } from "@/lib/privacy/emailHint";
-import { createRendezvous, type RendezvousDeps } from "@/lib/dev/rendezvousBroker";
+import { redactEmailForHint } from "@/lib/access/privacy/emailHint";
+import { createRendezvous, type RendezvousDeps } from "@/lib/developer-experience/dev/rendezvousBroker";
 
 // The CLI's built-in default MCP (packages/cli login.mjs DEFAULT_MCP_URL). When the derived
 // MCP origin equals this, --mcp is redundant noise, so we omit it.

package/apps/storefront/src/lib/{dev → developer-experience/dev}/livePreview.ts

@@ -5,7 +5,7 @@
  * shape + the request host + a config flag, never a secret.
  *
  * WHY AN IFRAME WORKS (no screenshots, no new infra): tenant routing is host-first with a
- * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/tenantRouting.ts), so
+ * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/access/shared/tenantRouting.ts), so
  * the tenant's real site is reachable at a RELATIVE path from /dev. CSP already permits
  * same-origin framing both directions (`frame-ancestors 'self'` + `frame-src 'self'`,
  * packages/public-runtime/src/csp.ts) alongside `X-Frame-Options: SAMEORIGIN` — no header

package/apps/storefront/src/lib/{dev → developer-experience/dev}/previewStatus.ts

@@ -20,8 +20,8 @@
  * transport / parse fault → { configured:true, ok:false } so a caller can distinguish
  * "definitely not provisioned" (ok + provisioned:false) from "couldn't tell". Never throws.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
-import { FetchHttpTransport, type HttpGetTransport } from "@/lib/http/fetchTransport";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
+import { FetchHttpTransport, type HttpGetTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpGetTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/rendezvousBroker.ts

@@ -20,8 +20,8 @@
  * one minted assertion shape covers every call. SERVER-SIDE ONLY.
  */
 import { readEnv } from "@/lib/env";
-import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/auth/mcpClientAssertion";
-import { FetchHttpTransport, type HttpTransport } from "@/lib/http/fetchTransport";
+import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/access/auth/mcpClientAssertion";
+import { FetchHttpTransport, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/subjectReissue.ts

@@ -20,8 +20,8 @@
  * MCP client_id, exactly what the MCP binds the subject_token audience to. This is the
  * same non-gated mint the MCP itself uses to power rendezvous creation.
  */
-import { getAccessClient } from "@/lib/auth/route";
-import type { TotAccessClient } from "@/lib/auth/totAccessClient";
+import { getAccessClient } from "@/lib/access/auth/route";
+import type { TotAccessClient } from "@/lib/access/auth/totAccessClient";
 
 /** Short — the proof is minted and used immediately at approve time. */
 const SUBJECT_TOKEN_TTL_SECONDS = 120;

package/apps/storefront/src/lib/email/candidateConflictEmail.ts

@@ -6,7 +6,7 @@
  * notification for that case — the author is pinged the MOMENT their change actually
  * conflicts with someone else's merge, not at their own accept attempt.
  *
- * Rendered here (our brand), transmitted by tot20 (see lib/messaging/messagesClient.ts).
+ * Rendered here (our brand), transmitted by tot20 (see lib/engagement/messaging/messagesClient.ts).
  * Email HTML rules: inline styles only, table-free simple layout, a visible fallback URL
  * under the button.
  */

package/apps/storefront/src/lib/{messaging → engagement/messaging}/messagesClient.ts

@@ -3,7 +3,7 @@
  *
  * The storefront RENDERS its own branded email HTML and hands it to tot20 to TRANSMIT, so we
  * reuse tot20's Mandrill SPF/DKIM deliverability (the whole point) while owning the body/brand.
- * Used for the magic-link invite email (see lib/grants/magicLinkInvite.ts).
+ * Used for the magic-link invite email (see lib/access/grants/magicLinkInvite.ts).
  *
  *   POST <core>/api/messages
  *   { channel:"email", to, subject, html, totApiKey, totSecretKey }  → 200 { sent:true, id? }

package/apps/storefront/src/lib/{newsletter → engagement/newsletter}/digest.ts

@@ -1,6 +1,6 @@
 /**
  * Hand-rolled newsletter digest HTML builder — the email analogue of
- * `renderRssFeed` (src/lib/blog/rss.ts): pure string concatenation, no
+ * `renderRssFeed` (src/lib/content/blog/rss.ts): pure string concatenation, no
  * templating dependency. Fed the engine's live-visible post list, so drafts /
  * unlisted / not-yet-scheduled posts can never reach an inbox.
  *
@@ -10,7 +10,7 @@
  * ESP (see send.ts). The RFC 8058 `List-Unsubscribe` headers are set on the
  * SEND call, not in this HTML body.
  */
-import type { BlogPostSummary } from "../blog/types.js";
+import type { BlogPostSummary } from "../../content/blog/types.js";
 
 /** Replaced per-recipient with the subscriber's opaque token at send time. */
 export const UNSUBSCRIBE_TOKEN_PLACEHOLDER = "{{unsubscribe_token}}";

package/apps/storefront/src/lib/{newsletter → engagement/newsletter}/resendClient.ts

@@ -5,7 +5,7 @@
  * (`POST /emails/batch`, up to 100 messages/call); audience/consent/unsubscribe
  * state stays first-party in our D1, never in a vendor list.
  */
-import { readEnv } from "../env.js";
+import { readEnv } from "../../env.js";
 
 /** Resend's batch limit: at most 100 messages per `/emails/batch` call. */
 export const RESEND_BATCH_LIMIT = 100;

package/apps/storefront/src/lib/{newsletter → engagement/newsletter}/send.ts

@@ -18,8 +18,8 @@
  * per-subscriber diff. "New since last send" is computed once from the previous
  * ledger row's `sent_at`, not per-subscriber.
  */
-import type { Queryable } from "../catalog/d1/catalog.js";
-import type { BlogPostSummary } from "../blog/types.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
+import type { BlogPostSummary } from "../../content/blog/types.js";
 import {
   sendBatch as realSendBatch,
   RESEND_BATCH_LIMIT,

package/apps/storefront/src/lib/{newsletter → engagement/newsletter}/subscribers.ts

@@ -9,7 +9,7 @@
  * caller is responsible for resolving `tenantId` from the request host/session
  * (NEVER a client body) — that is the multi-tenant isolation boundary.
  */
-import type { Queryable } from "../catalog/d1/catalog.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
 
 export type SubscriberStatus = "pending" | "confirmed" | "unsubscribed" | "bounced";
 

package/apps/storefront/src/lib/{social → engagement/social}/golive.ts

@@ -25,8 +25,8 @@
  * so the first ship after this hook deploys does NOT retro-announce the tenant's
  * whole back-catalog.
  */
-import { isVisibleOnLive } from "../blog/collection.js";
-import type { BlogPost, PostStatus } from "../blog/types.js";
+import { isVisibleOnLive } from "../../content/blog/collection.js";
+import type { BlogPost, PostStatus } from "../../content/blog/types.js";
 import { notifyPostPublished } from "./notify.js";
 
 /**

package/apps/storefront/src/lib/{social → engagement/social}/notify.ts

@@ -1,4 +1,4 @@
-import type { BlogPost } from "../blog/types.js";
+import type { BlogPost } from "../../content/blog/types.js";
 
 /** Swallow-and-log a soft failure — logging itself must never throw (mirrors `webhooks/emit.ts`). */
 function logDiag(fields: Record<string, unknown>): void {

package/apps/storefront/src/lib/{social → engagement/social}/tokenStore.ts

@@ -18,8 +18,8 @@
  * root that wires the real bindings (mirrors `getDispatcher()`); it returns
  * `null` when either binding is absent so callers degrade rather than throw.
  */
-import type { Queryable } from "../catalog/d1/catalog.js";
-import { readD1, readEnv } from "../env.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
+import { readD1, readEnv } from "../../env.js";
 
 /** The decrypted token material we persist as one JSON blob under AES-GCM. */
 export interface SocialTokenPayload {
@@ -162,7 +162,7 @@ export async function rotateSocialToken(
  */
 export async function resolveSocialTokenStore(): Promise<SocialTokenStoreDeps | null> {
   const [{ fromD1 }, d1, rawKek] = await Promise.all([
-    import("../catalog/d1/catalog.js"),
+    import("../../catalog/d1/catalog.js"),
     readD1("STOREFRONT_APPS_DB"),
     readEnv("SOCIAL_TOKEN_KEK"),
   ]);

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -31,9 +31,9 @@ import {
   type StockState,
 } from "@tot/public-runtime";
 import { readD1 } from "@/lib/env";
-import { decideAdminApiAccess } from "@/lib/auth/adminApiGuard";
-import { readViewerSession } from "@/lib/auth/route";
-import type { SessionRecord } from "@/lib/auth/session";
+import { decideAdminApiAccess } from "@/lib/access/auth/adminApiGuard";
+import { readViewerSession } from "@/lib/access/auth/route";
+import type { SessionRecord } from "@/lib/access/auth/session";
 import {
   canRelease,
   carrierPolicyForTenant,

package/apps/storefront/src/lib/integrations/integration/browserEnvironment.ts

@@ -19,7 +19,7 @@ import {
   type IntegrationSiteSurface,
   type ObligationTenant,
 } from "@tot/public-runtime";
-import { isAdminPath } from "@/lib/auth/loginGate";
+import { isAdminPath } from "@/lib/access/auth/loginGate";
 import {
   resolveIntegrationRenderState,
   type IntegrationRenderState,

package/apps/storefront/src/lib/{apps → measurement/consent}/consentConfigRead.ts

@@ -5,7 +5,7 @@
  * latest validated configuration and none of the authoring or history surface.
  */
 import type { TenantConsentConfig } from "@tot/public-runtime";
-import type { Queryable } from "../catalog/d1/catalog.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
 
 interface CurrentConsentConfigRow {
   config: string;

package/apps/storefront/src/lib/{tracking → measurement/tracking}/d1Control.ts

@@ -21,8 +21,8 @@
  * stores use (`d1/catalog.ts`), so the insert code in `interactionStore.ts` is
  * transport-agnostic and unit-testable against an in-memory sqlite.
  */
-import { readEnv } from "../env.js";
-import type { Queryable, QueryStatement } from "../catalog/d1/catalog.js";
+import { readEnv } from "../../env.js";
+import type { Queryable, QueryStatement } from "../../catalog/d1/catalog.js";
 
 const CF_API_BASE = "https://api.cloudflare.com/client/v4";
 

package/apps/storefront/src/lib/{tracking → measurement/tracking}/interactionCollector.ts

@@ -9,7 +9,7 @@
  * e.g. `dt-consent-environment-gate`):
  *
  *   import { onInteraction } from "@tot/public-runtime";
- *   import { collectInteraction } from "@/lib/tracking/interactionCollector";
+ *   import { collectInteraction } from "@/lib/measurement/tracking/interactionCollector";
  *   onInteraction((interaction) => {
  *     if (consentAndEnvironmentAllow()) collectInteraction(interaction);
  *   });
@@ -38,7 +38,7 @@ export const MAX_QUEUE_SIZE = 20;
 /** The wire shape POSTed to `INTERACTION_BEACON_PATH` — `TotInteraction`'s five
  *  fields plus this module's own synthesized correlation fields. Must stay in
  *  lockstep with `INTERACTION_WIRE_ALLOWLIST`
- *  (`apps/storefront/src/lib/tracking/collectorAllowlist.ts`). */
+ *  (`apps/storefront/src/lib/measurement/tracking/collectorAllowlist.ts`). */
 export interface InteractionWireEvent {
   type: TotInteraction["type"];
   el: string;

package/apps/storefront/src/lib/{tracking → measurement/tracking}/pruneRollup.ts

@@ -44,8 +44,8 @@
  * transient D1 fault) is caught, logged, and recorded in that tenant's
  * outcome — it never aborts the rest of the batch.
  */
-import type { Queryable } from "../catalog/d1/catalog.js";
-import type { AnalyticsEngineLike } from "../activity/store.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
+import type { AnalyticsEngineLike } from "../../activity/store.js";
 import { fromD1Rest, type D1ControlConfig } from "./d1Control.js";
 import { aggregateInteractions, writeInteractionAnalytics } from "./interactionStore.js";
 import type { StampedInteractionEvent } from "./collectorIngest.js";

package/apps/storefront/src/lib/{tracking → measurement/tracking}/publishSafetyNet.ts

@@ -6,7 +6,7 @@
  * that proposes `data-tot-el` for git-tracked tenant content and writes it
  * back to source as a reviewable diff. This module exists for everything
  * that bypasses that review — AI-edit drafts materialized into
- * `dev-draft:` KV (see `DevDraftContentProvider`, lib/storyblok/provider.ts)
+ * `dev-draft:` KV (see `DevDraftContentProvider`, lib/content/storyblok/provider.ts)
  * and direct KV-published edits (`PublishedContentProvider`'s overlay over
  * the customization store). Content sourced from `LocalContentProvider`
  * (build-bundled from git-tracked `tenants/<id>/content/*`) is explicitly

package/apps/storefront/src/lib/{tracking → measurement/tracking}/tenantD1Registry.ts

@@ -31,8 +31,8 @@
  * never fail because storage is unconfigured.
  */
 import { sha256Hex } from "@tot/public-runtime";
-import { readEnv } from "../env.js";
-import type { Queryable } from "../catalog/d1/catalog.js";
+import { readEnv } from "../../env.js";
+import type { Queryable } from "../../catalog/d1/catalog.js";
 import {
   ensureDatabase,
   fromD1Rest,

package/apps/storefront/src/lib/{monitoring → observability/monitoring}/manifest.ts

@@ -10,7 +10,7 @@
  * `needs-external` / `needs-secret`.
  *
  * Signal sources are named against real code where it exists in this repo
- * (`/health` → lib/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
+ * (`/health` → lib/observability/shared/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
  * commerce events → lib/analytics). Signals owned by sibling units are referenced
  * by CONTRACT NAME, not imported — Core Web Vitals come from the RUM beacon,
  * and age-verification / restricted-state denials come from the compliance
@@ -99,7 +99,7 @@ export const MONITORS: readonly Monitor[] = [
     title: "Storefront uptime / liveness",
     category: "availability",
     signal: {
-      source: "GET /health (lib/health.ts — answered before tenant/gate/cache)",
+      source: "GET /health (lib/observability/shared/health.ts — answered before tenant/gate/cache)",
       observe: "external synthetic probe hits /health across regions; expects 200 {status:'ok'}",
     },
     threshold: "2 consecutive probe failures (or >1% of probes failing over 5m)",

package/apps/storefront/src/lib/{analytics → observability/performance}/budgets.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/analytics/perfBudgets.ts (parsePerfBudgets).",
+  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/observability/performance/perfBudgets.ts (parsePerfBudgets).",
   "version": 1,
   "webVitals": {
     "$comment": "Core Web Vitals thresholds, evaluated at the 75th percentile (p75) of the field distribution — the same percentile Google's CrUX / the RUM alert contract use.",

package/apps/storefront/src/lib/orders/fixtures/orders.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   OrderDetail,
   OrderEvidenceEvent,
@@ -8,8 +8,8 @@ import type {
   OrderRow,
   OrdersViewModel,
 } from "../admin/viewmodels/orders";
-import { tenantProfile } from "../../admin/services/mock/tenants";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import { tenantProfile } from "../../access/fixtures/tenants";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 
 // Must stay index-aligned with customers.ts's NAMES: an order's customerId is
 // derived from the picked name's position here, and customers.ts assigns each

package/apps/storefront/src/lib/previewReload.ts

@@ -108,7 +108,7 @@ export function buildPreviewReloadScript(opts: {
  */
 export function buildCspViolationBannerScript(basePath = ""): string {
   // A style-guide surface is `/_style-guide/…` or `/style-guide/…`, under the tenant
-  // prefix when path-routed (lib/styleGuidePaths.ts).
+  // prefix when path-routed (lib/content/shared/styleGuidePaths.ts).
   return `(() => {
   if (window.__totCspBanner) return; window.__totCspBanner = true;
   const seen = new Set();

package/apps/storefront/src/lib/publication/contentProvider.ts

@@ -2,13 +2,13 @@ import type {
   OpenPublicationArtifactV1,
   PublicationRouteRenderPlanV1,
 } from "@tot/public-runtime";
-import { hasHomeContentShape, type EditorialPage, type HomeContent } from "@/lib/storyblok/content-model.js";
-import type { ChromeConfig } from "@/lib/chrome/model.js";
-import { parseChromeConfig } from "@/lib/chrome/parseConfig.js";
-import { parseChromeAssignments } from "@/lib/chrome/model.js";
-import { renderRawChrome } from "@/lib/rawChrome.js";
-import { stampTrackingIdsAtPublish } from "@/lib/tracking/publishSafetyNet.js";
-import type { ContentProvider } from "@/lib/storyblok/provider.js";
+import { hasHomeContentShape, type EditorialPage, type HomeContent } from "@/lib/content/storyblok/content-model.js";
+import type { ChromeConfig } from "@/lib/content/chrome/model.js";
+import { parseChromeConfig } from "@/lib/content/chrome/parseConfig.js";
+import { parseChromeAssignments } from "@/lib/content/chrome/model.js";
+import { renderRawChrome } from "@/lib/content/shared/rawChrome.js";
+import { stampTrackingIdsAtPublish } from "@/lib/measurement/tracking/publishSafetyNet.js";
+import type { ContentProvider } from "@/lib/content/storyblok/provider.js";
 
 const EMPTY_CHROME_CONFIG: ChromeConfig = {
   header: { variant: "primary", brand: { label: "" }, nav: [] },

package/apps/storefront/src/lib/publication/mountedDiscovery.ts

@@ -29,7 +29,7 @@ import {
   type PublicationDiscoveryEntryKindV1,
 } from "@tot/public-runtime";
 import { publicationRecoveryActiveV1, publicationRecoveryKeyV1 } from "@tot/public-runtime/publication-recovery";
-import { rawPageCanonicalUrl } from "../rawMarketingHtml.js";
+import { rawPageCanonicalUrl } from "../content/shared/rawMarketingHtml.js";
 
 export type DiscoverySurfaceV1 = "sitemap" | "feeds" | "publicSearch" | "llms";
 

package/apps/storefront/src/lib/publication/rootDiscovery.ts

@@ -5,10 +5,10 @@
  * Paths are spelled exactly as the root sitemap lists them.
  */
 import type { APIContext } from "astro";
-import { getBlogSettings, listBlogPosts } from "@/lib/blog/provider.js";
-import { listBuildPosts } from "@/lib/the-build/provider.js";
-import { isIndexableHtml, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml.js";
-import { collectionPathsV1, blogPathOptsV1 } from "@/lib/blog/collectionPaths.js";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { listBuildPosts } from "@/lib/content/the-build/provider.js";
+import { isIndexableHtml, rawPageCanonicalUrl } from "@/lib/content/shared/rawMarketingHtml.js";
+import { collectionPathsV1, blogPathOptsV1 } from "@/lib/content/blog/collectionPaths.js";
 
 export interface RootDiscoveryDocumentV1 {
   kind: "home" | "page" | "post";