@tokenoftrust/storefront-runner 2.4.87 → 2.4.89

package/apps/storefront/src/lib/reporting/fixtures/reporting.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { pick, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { pick, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type { AnalysisBriefItem, ReportingCategory, ReportingSummary, ReportingViewModel } from "../admin/viewmodels/reporting";
 
 const CATEGORY_DEFS: { category: ReportingCategory; label: string; drilldownHref: string }[] = [

package/apps/storefront/src/lib/runtimeEnv.ts

@@ -22,7 +22,7 @@ let workerEnv: Record<string, unknown> | null | undefined;
 export async function getWorkerEnv(): Promise<Record<string, unknown> | null> {
   if (workerEnv !== undefined) return workerEnv;
   try {
-    // Only resolvable in the Workers runtime; types in lib/cloudflare-workers.d.ts.
+    // Only resolvable in the Workers runtime; types in lib/developer-experience/types/cloudflare-workers.d.ts.
     const mod = await import("cloudflare:workers");
     workerEnv = (mod.env ?? null) as Record<string, unknown> | null;
   } catch {

package/apps/storefront/src/lib/subscriptions/fixtures/subscriptions.ts

@@ -7,14 +7,14 @@ import {
   isSubscriptionFrequency,
   purchaseOptionPrice,
 } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 import {
   MOCK_ANCHOR_ISO,
   offsetIso,
   randomInt,
   seededRandom,
-} from "../../admin/seed";
+} from "../../developer-experience/admin/seed";
 import type { CustomerRow } from "../../customers/admin/viewmodels/customers";
 import type { ProductDetail, ProductRow } from "../../catalog/admin/viewmodels/products";
 import type {

package/apps/storefront/src/middleware/controlPlane.ts

@@ -9,7 +9,7 @@
 import type { APIContext, MiddlewareNext } from "astro";
 import { readEnv, readD1, readKv } from "@/lib/env";
 import { fromD1, type D1Like } from "@/lib/catalog/d1/catalog";
-import { readCurrentTenantConsentConfig } from "@/lib/apps/consentConfigRead";
+import { readCurrentTenantConsentConfig } from "@/lib/measurement/consent/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integrations/integration/managedInstallDeclarations";
 import { buildTenantConsentBroker, verifyPreviewToken } from "@tot/public-runtime";
 import { tenantIsDeclaredPublic } from "@/config/tenants";
@@ -30,14 +30,14 @@ import {
   sessionAdmitsHost,
   sessionHostCapability,
   type GateMode,
-} from "@/lib/auth/loginGate";
-import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import { gatedApiResponse, gatedHoldingResponse } from "@/lib/auth/gatePage";
-import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+} from "@/lib/access/auth/loginGate";
+import { resolveAdminLanding, isAdminSelectPath } from "@/lib/access/auth/adminLanding";
+import { resolveAdminTenantMode } from "@/lib/access/shared/adminTenantEnvelope";
+import { gatedApiResponse, gatedHoldingResponse } from "@/lib/access/auth/gatePage";
+import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
 import { runRenderChain } from "./renderChain.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
+import type { InternalContentGrant } from "@/lib/access/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
   context: APIContext;

package/apps/storefront/src/middleware/index.ts

@@ -23,19 +23,19 @@ import { defineMiddleware } from "astro:middleware";
 import type { APIContext, MiddlewareNext } from "astro";
 import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
-import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
+import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/access/shared/tenantRouting";
 import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
 import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
-import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
 import { visitorRegionFor, withVisitorRegionCookie } from "@/lib/compliance/shared/visitorRegionCookie";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import { parseGateMode } from "@/lib/auth/loginGate";
-import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
-import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
-import { HEALTH_PATH, healthResponse } from "@/lib/health";
+import { parseGateMode } from "@/lib/access/auth/loginGate";
+import { evaluateDemoGate, hostInGateList } from "@/lib/access/shared/demoGate";
+import { isMaintenanceOn, maintenanceResponse } from "@/lib/access/shared/maintenance";
+import { HEALTH_PATH, healthResponse } from "@/lib/observability/shared/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
 import {
@@ -46,13 +46,13 @@ import {
 } from "./routeBranch.js";
 import { servePublicRender } from "./publicRender.js";
 import { serveControlPlane } from "./controlPlane.js";
-import { KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
-import { mintOpaqueBrokerAssertion } from "@/lib/auth/brokerAssertion";
+import { KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
+import { mintOpaqueBrokerAssertion } from "@/lib/access/auth/brokerAssertion";
 import {
   applyInternalContentResponsePolicy,
   authorizeInternalContentRequest,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 /**
  * Compiled once per tenant-config object, as the resolver's contract asks —
@@ -109,7 +109,7 @@ async function serveRequest(
   // ---- /health — liveness + deploy-identity probe ---------------------------
   // Answered FIRST: before tenant resolution, the access gate, the maintenance
   // kill-switch, and the edge cache — so it reports the running build's commit SHA
-  // regardless of Host, an unresolved tenant, or a closed site. See lib/health.
+  // regardless of Host, an unresolved tenant, or a closed site. See lib/observability/shared/health.
   if (url.pathname === HEALTH_PATH) {
     return healthResponse();
   }

package/apps/storefront/src/middleware/renderChain.ts

@@ -16,10 +16,10 @@ import { readEnv, readR2 } from "@/lib/runtimeEnv";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { isPlatformPublicDiscoveryPath } from "./routeBranch.js";
 import { resolveCandidateContentPin, type CandidateContentPin } from "./candidatePin.js";
-import { createContentProvider, DevDraftContentProvider } from "@/lib/storyblok/provider";
+import { createContentProvider, DevDraftContentProvider } from "@/lib/content/storyblok/provider";
 import { bindPublicationSpaceContentProviderV1 } from "@/lib/publication/contentProvider.js";
 import { resolvePublicationRuntimeSourceV1 } from "@/lib/publication/runtimeSource.js";
-import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
+import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/developer-experience/dev/devDraft";
 import {
   isCacheablePath,
   pageCacheKey,
@@ -27,8 +27,8 @@ import {
   getCachedPage,
   putCachedPage,
 } from "@/lib/edgeCache";
-import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/access/shared/cspStaticHashes";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
 import { maybeInjectPreviewReload } from "@/lib/previewReload";
 import {
   resolveCustomizationEnv,
@@ -104,13 +104,13 @@ import {
 } from "@/lib/integrations/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
-import { declaredTenantOrigins } from "@/lib/tenantOrigins";
+import { declaredTenantOrigins } from "@/lib/access/shared/tenantOrigins";
 import { withDeclaredTenantConfig } from "@/config/declaredTenantConfig";
 import {
   applyInternalContentResponsePolicy,
   internalContentGrantMatchesPlan,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 export interface RenderChainInput {
   context: APIContext;

package/apps/storefront/src/pages/[...slug].astro

@@ -6,19 +6,19 @@
  * prefixes so a stray slug can never shadow a real route.
  */
 import Layout from "@/layouts/Layout.astro";
-import Breadcrumbs from "@/components/Breadcrumbs.astro";
-import { homeCrumbLabel, siteTrail } from "@/lib/breadcrumbs";
-import ProseSections from "@/components/content/ProseSections.astro";
-import ProseToc from "@/components/content/ProseToc.astro";
-import { breadcrumbLd } from "@/lib/jsonld";
-import { truncate } from "@/lib/format";
-import { faqFromHtml, faqFromSections } from "@/lib/seo/faqItems";
-import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/rawMarketingHtml";
+import Breadcrumbs from "@/components/content/storefront/Breadcrumbs.astro";
+import { homeCrumbLabel, siteTrail } from "@/lib/content/shared/breadcrumbs";
+import ProseSections from "@/components/content/storefront/content/ProseSections.astro";
+import ProseToc from "@/components/content/storefront/content/ProseToc.astro";
+import { breadcrumbLd } from "@/lib/content/shared/jsonld";
+import { truncate } from "@/lib/content/shared/format";
+import { faqFromHtml, faqFromSections } from "@/lib/content/seo/faqItems";
+import { rawHtmlPolicy, rawHtmlResponse, rawPageCanonicalUrl } from "@/lib/content/shared/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
-import { styleGuideAliasRewrite } from "@/lib/styleGuidePaths";
-import { getBlogSettings } from "@/lib/blog/provider.js";
-import { loadBlogPostViewV1, type BlogPostViewPropsV1 } from "@/lib/blog/postView.js";
-import BlogPostArticle from "@/components/blog/BlogPostArticle.astro";
+import { styleGuideAliasRewrite } from "@/lib/content/shared/styleGuidePaths";
+import { getBlogSettings } from "@/lib/content/blog/provider.js";
+import { loadBlogPostViewV1, type BlogPostViewPropsV1 } from "@/lib/content/blog/postView.js";
+import BlogPostArticle from "@/components/content/storefront/blog/BlogPostArticle.astro";
 
 const { tenant, canonicalBase, content, basePath, apiBasePath, capabilities, features } =
   Astro.locals;
@@ -45,7 +45,7 @@ if (styleGuideTarget !== undefined) {
   return Astro.rewrite(styleGuideTarget);
 }
 
-// A tenant that declares `BlogSettings.postsAtRoot` (see lib/blog/types.ts) serves its
+// A tenant that declares `BlogSettings.postsAtRoot` (see lib/content/blog/types.ts) serves its
 // individual posts at the site root — a single-segment slug tries the blog collection
 // before falling through to a raw marketing page or a CMS page. Multi-segment slugs are
 // never posts, so this never shadows a nested marketing/CMS path.

package/apps/storefront/src/pages/api/admin/activity-alerts.ts

@@ -25,7 +25,7 @@
  * ops-timeline; never a URL/query value.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { checkActivityAlerts } from "@/lib/activity/alerts";

package/apps/storefront/src/pages/api/admin/commerce-readiness.ts

@@ -9,7 +9,7 @@
  * surface has no ledger, so configured, absent, and unreadable stay unhealthy.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { workerCommit } from "@/lib/activity/workerCommit";
 import {
   COMMERCE_SCHEDULER,

package/apps/storefront/src/pages/api/admin/fulfillment/batches.ts

@@ -2,7 +2,7 @@
  * Authenticated owner API for whole-order batch claim and batch read.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -3,7 +3,7 @@
  * The read runs only after the owner gate admits the caller.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id].ts

@@ -3,7 +3,7 @@
  * The response is state codes and the fulfillment view. It never returns an address.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/interaction-insights.ts

@@ -28,12 +28,12 @@
  * scoping) — see the unit's completion report for the reasoning.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { resolveTenantStore, trackingNamePrefix } from "@/lib/tracking/tenantD1Registry";
-import { readD1Control } from "@/lib/tracking/d1Control";
-import { readTenantInteractionInsights } from "@/lib/tracking/tenantReadAccess";
+import { resolveTenantStore, trackingNamePrefix } from "@/lib/measurement/tracking/tenantD1Registry";
+import { readD1Control } from "@/lib/measurement/tracking/d1Control";
+import { readTenantInteractionInsights } from "@/lib/measurement/tracking/tenantReadAccess";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -8,7 +8,7 @@
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   commerceActorForAdmin,
   createCheckoutOrderClient,

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -11,7 +11,7 @@
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   createCheckoutOrderClient,
   orderApiBaseUrl,

package/apps/storefront/src/pages/api/auth/logout.ts

@@ -7,8 +7,8 @@
  * sign out.
  */
 import type { APIContext } from "astro";
-import { getSessionStore, clearSessionCookie } from "@/lib/auth/route";
-import { revokeSession, SESSION_COOKIE } from "@/lib/auth/session";
+import { getSessionStore, clearSessionCookie } from "@/lib/access/auth/route";
+import { revokeSession, SESSION_COOKIE } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -18,15 +18,15 @@ import {
   getSessionStore,
   setSessionCookie,
   safeNext,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { acceptDeveloperInvite } from "@/lib/shared/developerInvites";
-import { explainDeveloperAccess } from "@/lib/shared/accessExplain";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { acceptDeveloperInvite } from "@/lib/access/shared/developerInvites";
+import { explainDeveloperAccess } from "@/lib/access/shared/accessExplain";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/send.ts

@@ -15,13 +15,13 @@ import {
   getAccessClient,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   devAuthEnabled,
   devAuthCode,
   storeDevCode,
   DEV_AUTH_CODE_TTL_SECONDS,
-} from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-send.ts

@@ -13,7 +13,7 @@
  * but also accepts a plain form post so a no-JS fallback stays possible.
  */
 import type { APIContext } from "astro";
-import { getAccessClient } from "@/lib/auth/route";
+import { getAccessClient } from "@/lib/access/auth/route";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -22,9 +22,9 @@ import {
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
-import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
+} from "@/lib/access/auth/route";
+import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -21,13 +21,13 @@ import {
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -18,8 +18,8 @@ import {
   isReaction,
   recordReaction,
   type Reaction,
-} from "@/lib/blog/reactions";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
+} from "@/lib/content/blog/reactions";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -17,10 +17,10 @@
 import type { APIRoute } from "astro";
 import { readD1, readKv, readEnv } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
-import { NewsletterSubscribersStore } from "@/lib/newsletter/subscribers";
-import { randomToken, hashConsentIp } from "@/lib/newsletter/consent";
-import { sendConfirmationEmail } from "@/lib/newsletter/confirmationEmail";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
+import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
+import { randomToken, hashConsentIp } from "@/lib/engagement/newsletter/consent";
+import { sendConfirmationEmail } from "@/lib/engagement/newsletter/confirmationEmail";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/newsletter/confirm.ts

@@ -12,7 +12,7 @@
 import type { APIRoute } from "astro";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { NewsletterSubscribersStore } from "@/lib/newsletter/subscribers";
+import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/newsletter/unsubscribe.ts

@@ -21,7 +21,7 @@
 import type { APIContext } from "astro";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { unsubscribeByToken } from "@/lib/newsletter/subscribers";
+import { unsubscribeByToken } from "@/lib/engagement/newsletter/subscribers";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -13,9 +13,9 @@
  * store/forward is the documented follow-up; the SHAPE it stores is fixed here.
  */
 import type { APIRoute } from "astro";
-import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/analytics/webVitals";
+import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/observability/performance/webVitals";
 import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
-import { recordBlogView } from "@/lib/blog/viewCounts";
+import { recordBlogView } from "@/lib/content/blog/viewCounts";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/tracking/interaction.ts

@@ -2,7 +2,7 @@
  * POST /api/tracking/interaction (dt-collector-v1) — the beacon sink for
  * declarative interaction tracking.
  *
- * The browser collector (`@/lib/tracking/interactionCollector`) batches
+ * The browser collector (`@/lib/measurement/tracking/interactionCollector`) batches
  * `TotInteraction`s captured off `installInteractionTracking` /
  * `onInteraction` (`@tot/public-runtime`) — via `dt-consent-environment-gate`'s
  * consent/environment wrapper in front of it — and POSTs them here with
@@ -39,10 +39,10 @@
 import type { APIContext } from "astro";
 import { readD1, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { ingestInteractions, type StampedInteractionEvent } from "@/lib/tracking/collectorIngest";
-import { readD1Control } from "@/lib/tracking/d1Control";
-import { resolveTenantStore, trackingNamePrefix } from "@/lib/tracking/tenantD1Registry";
-import { persistInteractions } from "@/lib/tracking/interactionStore";
+import { ingestInteractions, type StampedInteractionEvent } from "@/lib/measurement/tracking/collectorIngest";
+import { readD1Control } from "@/lib/measurement/tracking/d1Control";
+import { resolveTenantStore, trackingNamePrefix } from "@/lib/measurement/tracking/tenantD1Registry";
+import { persistInteractions } from "@/lib/measurement/tracking/interactionStore";
 import type { AnalyticsEngineLike } from "@/lib/activity/store";
 
 export const prerender = false;

package/apps/storefront/src/pages/auth/login.astro

@@ -10,8 +10,8 @@
  * (tot20 sends/verifies the code, the storefront mints the session). No secrets
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { safeNext } from "@/lib/auth/route";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { safeNext } from "@/lib/access/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.

package/apps/storefront/src/pages/auth/magic.astro

@@ -9,7 +9,7 @@
  * the token before the user ever clicked. So: NEVER exchange on GET. The token rides
  * in a hidden form field and leaves only via the POST.
  */
-import { normalizeEmailHint, redactEmailForHint } from "@/lib/privacy/emailHint";
+import { normalizeEmailHint, redactEmailForHint } from "@/lib/access/privacy/emailHint";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.

package/apps/storefront/src/pages/blog/[slug].astro

@@ -1,6 +1,6 @@
 ---
-import BlogPostArticle from "@/components/blog/BlogPostArticle.astro";
-import { loadBlogPostViewV1 } from "@/lib/blog/postView.js";
+import BlogPostArticle from "@/components/content/storefront/blog/BlogPostArticle.astro";
+import { loadBlogPostViewV1 } from "@/lib/content/blog/postView.js";
 
 // These redirects also exist in the published artifact: the publication composition lifts this
 // file into the space's `routes.aliases`, which reach the CDN plane through the live pointer. The

package/apps/storefront/src/pages/blog/author/[author].astro

@@ -1,13 +1,13 @@
 ---
 import Layout from "@/layouts/Layout.astro";
-import Breadcrumbs from "@/components/Breadcrumbs.astro";
-import PostAccessBadge from "@/components/blog/PostAccessBadge.astro";
-import { getBlogSettings, listBlogPosts } from "@/lib/blog/provider.js";
-import { resolveBlogPresentation } from "@/lib/blog/presentation.js";
-import { homeCrumbLabel, siteTrail } from "@/lib/breadcrumbs.js";
-import { authorSlug, getAuthors } from "@/lib/blog/collection.js";
-import { breadcrumbLd } from "@/lib/jsonld.js";
-import { collectionPathsV1, blogPathOptsV1 } from "@/lib/blog/collectionPaths.js";
+import Breadcrumbs from "@/components/content/storefront/Breadcrumbs.astro";
+import PostAccessBadge from "@/components/content/storefront/blog/PostAccessBadge.astro";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { resolveBlogPresentation } from "@/lib/content/blog/presentation.js";
+import { homeCrumbLabel, siteTrail } from "@/lib/content/shared/breadcrumbs.js";
+import { authorSlug, getAuthors } from "@/lib/content/blog/collection.js";
+import { breadcrumbLd } from "@/lib/content/shared/jsonld.js";
+import { collectionPathsV1, blogPathOptsV1 } from "@/lib/content/blog/collectionPaths.js";
 
 // Author archive for the `/blog` collection. Lists exactly the posts whose
 // bylines link here (same source as /blog/index.astro + /blog/[slug].astro),

package/apps/storefront/src/pages/blog/category/[category].astro

@@ -1,13 +1,13 @@
 ---
 import Layout from "@/layouts/Layout.astro";
-import Breadcrumbs from "@/components/Breadcrumbs.astro";
-import PostGrid from "@/components/blog/PostGrid.astro";
-import { getBlogSettings, listBlogPosts } from "@/lib/blog/provider.js";
-import { collectPostsByTerm } from "@/lib/blog/collection.js";
-import { resolveBlogPresentation } from "@/lib/blog/presentation.js";
-import { homeCrumbLabel, siteTrail } from "@/lib/breadcrumbs.js";
-import { breadcrumbLd } from "@/lib/jsonld.js";
-import { collectionPathsV1, blogPathOptsV1 } from "@/lib/blog/collectionPaths.js";
+import Breadcrumbs from "@/components/content/storefront/Breadcrumbs.astro";
+import PostGrid from "@/components/content/storefront/blog/PostGrid.astro";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { collectPostsByTerm } from "@/lib/content/blog/collection.js";
+import { resolveBlogPresentation } from "@/lib/content/blog/presentation.js";
+import { homeCrumbLabel, siteTrail } from "@/lib/content/shared/breadcrumbs.js";
+import { breadcrumbLd } from "@/lib/content/shared/jsonld.js";
+import { collectionPathsV1, blogPathOptsV1 } from "@/lib/content/blog/collectionPaths.js";
 
 const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const param = Astro.params.category ?? "";

package/apps/storefront/src/pages/blog/index.astro

@@ -1,8 +1,8 @@
 ---
-import BlogIndexView from "@/components/blog/BlogIndexView.astro";
-import { getBlogSettings, listBlogPosts } from "@/lib/blog/provider.js";
-import { paginateBlogPosts, resolveBlogIndexCopy } from "@/lib/blog/pagination.js";
-import { resolveBlogPresentation } from "@/lib/blog/presentation.js";
+import BlogIndexView from "@/components/content/storefront/blog/BlogIndexView.astro";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { paginateBlogPosts, resolveBlogIndexCopy } from "@/lib/content/blog/pagination.js";
+import { resolveBlogPresentation } from "@/lib/content/blog/presentation.js";
 
 const { tenant, basePath, canonicalBase, content, publicationTimestamp } = Astro.locals;
 const posts = await listBlogPosts(tenant.tenant_id, content, publicationTimestamp);

package/apps/storefront/src/pages/blog/page/[n].astro

@@ -2,10 +2,10 @@
 // /blog/page/<n>/ — page N≥2 of the blog index. Page 1 lives at /blog/
 // (src/pages/blog/index.astro); both render through the same BlogIndexView so the
 // tenant-copy + pagination contract can't drift between the two routes.
-import BlogIndexView from "@/components/blog/BlogIndexView.astro";
-import { getBlogSettings, listBlogPosts } from "@/lib/blog/provider.js";
-import { paginateBlogPosts, parseBlogPageParam, resolveBlogIndexCopy } from "@/lib/blog/pagination.js";
-import { resolveBlogPresentation } from "@/lib/blog/presentation.js";
+import BlogIndexView from "@/components/content/storefront/blog/BlogIndexView.astro";
+import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
+import { paginateBlogPosts, parseBlogPageParam, resolveBlogIndexCopy } from "@/lib/content/blog/pagination.js";
+import { resolveBlogPresentation } from "@/lib/content/blog/presentation.js";
 
 const page = parseBlogPageParam(Astro.params.n);
 if (page === null) return new Response(null, { status: 404 });