@tokenoftrust/storefront-runner 2.4.88 → 2.4.89

package/apps/storefront/astro.config.mjs

@@ -31,7 +31,7 @@ const cliVersion = (() => {
 const cliInstallSpec = cliVersion ? `@tokenoftrust/cli@${cliVersion}` : "@tokenoftrust/cli";
 
 // The commit THIS build was cut from, baked in at BUILD time so /health can report
-// exactly which code is live (see src/lib/health.ts + src/middleware). Prefer a CI-
+// exactly which code is live (see src/lib/observability/shared/health.ts + src/middleware). Prefer a CI-
 // provided SHA (Workers Builds / GitHub Actions / CF Pages) so the value is right even
 // when the build runs from a shallow/detached checkout; fall back to `git rev-parse`
 // for local deploys. deploy.sh's source guard pins HEAD to origin/<deploySourceBranch>,

package/apps/storefront/perf/README.md

@@ -9,12 +9,12 @@ harness); the **field half** (Real User Monitoring) lives in
 
 | File | Role |
 |------|------|
-| `../src/lib/analytics/budgets.json` | **Source of truth.** Route budgets (LCP/INP/CLS p75 + JS/CSS/image/total KiB) + the third-party script allowlist. Edit here; everything derives from it. |
-| `../src/lib/analytics/perfBudgets.ts` | Typed lens + **pure** budget-assertion logic (`evaluateManifest`) + the Lighthouse-budgets exporter (`toLighthouseBudgets`). Unit-tested in `perfBudgets.test.ts`. |
-| `../src/lib/analytics/lighthouseReport.ts` | Pure adapter: a Lighthouse result (LHR JSON) → a `RouteMeasurement` the gate evaluates. Unit-tested in `lighthouseReport.test.ts`. |
+| `../src/lib/observability/performance/budgets.json` | **Source of truth.** Route budgets (LCP/INP/CLS p75 + JS/CSS/image/total KiB) + the third-party script allowlist. Edit here; everything derives from it. |
+| `../src/lib/observability/performance/perfBudgets.ts` | Typed lens + **pure** budget-assertion logic (`evaluateManifest`) + the Lighthouse-budgets exporter (`toLighthouseBudgets`). Unit-tested in `perfBudgets.test.ts`. |
+| `../src/lib/observability/performance/lighthouseReport.ts` | Pure adapter: a Lighthouse result (LHR JSON) → a `RouteMeasurement` the gate evaluates. Unit-tested in `lighthouseReport.test.ts`. |
 | `assert-budgets.ts` | Thin CLI: reads measurements / LHRs, runs the gate, exits non-zero on a violation. |
-| `../src/lib/analytics/webVitals.ts` | Field RUM beacon (LCP/INP/CLS from real visitors → the RUM sink). |
-| `../src/lib/analytics/rumAlert.ts` | Pure sink-side regression-alert contract; feeds F16's `core-web-vitals` monitor. Unit-tested in `rumAlert.test.ts`. |
+| `../src/lib/observability/performance/webVitals.ts` | Field RUM beacon (LCP/INP/CLS from real visitors → the RUM sink). |
+| `../src/lib/observability/performance/rumAlert.ts` | Pure sink-side regression-alert contract; feeds F16's `core-web-vitals` monitor. Unit-tested in `rumAlert.test.ts`. |
 
 The budget numbers are enforced identically in three places, all reading the one
 manifest: the lab gate here, a Lighthouse `--budget-path` run (via
@@ -56,7 +56,7 @@ silently drift.
 
 ## Field RUM
 
-`startWebVitals()` (from `../src/lib/analytics/webVitals.ts`) is called from the
+`startWebVitals()` (from `../src/lib/observability/performance/webVitals.ts`) is called from the
 client entry; it measures LCP/INP/CLS per real navigation, buckets each into the
 same budgeted route id the lab gate uses, and beacons finished samples to the RUM
 sink (`RUM_BEACON_PATH`). The sink rolls samples up per route/hour and calls

package/apps/storefront/perf/assert-budgets.ts

@@ -41,8 +41,8 @@ import {
   ROUTE_IDS,
   type RouteId,
   type RouteMeasurement,
-} from "../src/lib/analytics/perfBudgets.js";
-import { lhrToMeasurement, type LighthouseResult } from "../src/lib/analytics/lighthouseReport.js";
+} from "../src/lib/observability/performance/perfBudgets.js";
+import { lhrToMeasurement, type LighthouseResult } from "../src/lib/observability/performance/lighthouseReport.js";
 
 function die(msg: string, code = 2): never {
   process.stderr.write(`assert-budgets: ${msg}\n`);

package/apps/storefront/src/components/content/storefront/blog/BlogPaywall.astro

@@ -1,6 +1,6 @@
 ---
 // Paywall card shown under the teaser of a gated post the viewer can't read in
-// full. Mirrors the "Coming soon" host gate (`src/lib/auth/gatePage.ts`):
+// full. Mirrors the "Coming soon" host gate (`src/lib/access/auth/gatePage.ts`):
 // badge + headline + one line of value + a single CTA — restyled with the site's
 // design tokens so it reads as native article chrome, and preceded by a fade that
 // dissolves the truncated body into the card.

package/apps/storefront/src/config/adminTargetTenant.ts

@@ -4,7 +4,7 @@
  *
  * The admin console can operate on a target tenant that differs from the routed
  * (adminApp) tenant on `Astro.locals.tenant` — a real ToT-staff session may point
- * `targetTenant` at another tenant it has access to (see lib/adminTenantEnvelope).
+ * `targetTenant` at another tenant it has access to (see lib/access/shared/adminTenantEnvelope).
  * Panels that need the target's real config (e.g. the checkout appearance
  * panel, which derives from `theme_tokens` + `commerce.checkout`) resolve it HERE,
  * in the config layer, rather than reaching into the static tenant map — so they

package/apps/storefront/src/config/devTenants.ts

@@ -1,7 +1,7 @@
 /**
  * Dev-only tenant-registry seam for the localhost sign-in bypass.
  *
- * `lib/auth/devAuth` can't import the concrete static tenant map directly
+ * `lib/access/auth/devAuth` can't import the concrete static tenant map directly
  * (tenancy-resolver-fence — the registry stays behind the `config` boundary so a
  * single-tenant extraction stays a drop-in). This exposes exactly the one thing
  * that bypass needs: the resources a local dev session is granted membership on.

package/apps/storefront/src/config/resolver.ts

@@ -31,7 +31,7 @@ import { KvTenantResolver, putTenant } from "@/config/kvTenantResolver";
 import { getTenantTheme } from "@/themes/tenants";
 import { devTenantsToSeed } from "@/config/devTenantSeed";
 import { tenantAnalyticsRawById } from "@/config/tenantAnalyticsFiles";
-import { MemoryKv } from "@/lib/memoryKv";
+import { MemoryKv } from "@/lib/developer-experience/shared/memoryKv";
 
 // LOCAL dev loop discovery: enumerate the colocated tenant dirs on disk,
 // INCLUDING a developer's checkout grafted in by `tot dev` (scripts/tot-dev.mjs).

package/apps/storefront/src/layouts/Layout.astro

@@ -21,7 +21,7 @@ import ShippingRestrictionNotice from "@/components/compliance/storefront/compli
 import ExciseTaxNotice from "@/components/compliance/storefront/compliance/ExciseTaxNotice.astro";
 import { EXCISE_TAX_DISCLOSURE_TEXT } from "@/lib/compliance/rawComplianceNotices";
 import IsolatedAgeGate from "@/components/compliance/storefront/islands/IsolatedAgeGate.tsx";
-import AuthBadge from "@/components/auth/AuthBadge.astro";
+import AuthBadge from "@/components/access/storefront/auth/AuthBadge.astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
 import { organizationLd, websiteLd } from "@/lib/content/shared/jsonld";
@@ -37,7 +37,7 @@ import { splitFooterLegal } from "@/lib/content/chrome/footerLegal";
 import { bindManagedCartAnchors, managedCartHref } from "@/lib/content/chrome/managedCart";
 import type { HeaderVariant, FooterVariant } from "@/lib/content/chrome/model";
 import { renderIntegrationPhases, INTERACTION_TRACKING_BOOT_JS } from "@tot/public-runtime";
-import { readViewerSession } from "@/lib/auth/route";
+import { readViewerSession } from "@/lib/access/auth/route";
 import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
@@ -601,7 +601,7 @@ const footerWidgets = await renderWidgetSlot(
         where PerformanceObserver is absent. This is the per-route-template
         signal the `core-web-vitals` monitor consumes. */}
     <script>
-      import { startConsentGatedWebVitals } from "@/lib/analytics/webVitals";
+      import { startConsentGatedWebVitals } from "@/lib/observability/performance/webVitals";
       startConsentGatedWebVitals();
     </script>
 
@@ -631,7 +631,7 @@ const footerWidgets = await renderWidgetSlot(
         listener, and the install-once marker makes a double install a no-op —
         which is what makes the raw chrome wrapper spliced into this document
         (above) safe. Emitted as `is:inline` + the page nonce so it needs no
-        entry in lib/cspStaticHashes.ts. */}
+        entry in lib/access/shared/cspStaticHashes.ts. */}
     <script is:inline nonce={cspNonce} set:html={INTERACTION_TRACKING_BOOT_JS}></script>
 
     {/* Swaps every <AsyncStylesheet>-rendered preload link to rel="stylesheet"

package/apps/storefront/src/lib/{admin → access/admin}/README.md

@@ -10,8 +10,8 @@ these implement.
 ## Tenant envelope
 
 The canonical tenant envelope is `AdminTenantEnvelope`, defined in
-`lib/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
-`lib/admin/envelope.ts` so everything under `lib/admin/**` can import it from
+`lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
+`lib/access/admin/envelope.ts` so everything under `lib/admin/**` can import it from
 a stable relative path:
 
 ```ts
@@ -29,7 +29,7 @@ refused not hidden-only). `targetTenant` is the sole key mock services use to
 select/derive data. **Authorization must always be evaluated against
 `targetTenant`, never `adminAppTenant`** (decision `tenant-envelope-contract`).
 
-(`lib/admin/envelope.ts` used to declare its own 2-field copy of this
+(`lib/access/admin/envelope.ts` used to declare its own 2-field copy of this
 interface — data-view-contracts and admin-tenant-mode were built in parallel
 per that decision, with no live coordination. Reconciled here per decision
 `envelope-type-duplication-follow-up`: one canonical type, re-exported.)

package/apps/storefront/src/lib/{admin → access/admin}/adminShell.ts

@@ -10,7 +10,7 @@
  * only (window.__toTAdminAsk + a "tot:admin-ask" CustomEvent), never sent over
  * the network.
  */
-import { buildAskEnvelope, type AskEnvelope } from "./ai/askEnvelope";
+import { buildAskEnvelope, type AskEnvelope } from "../../automation/ai/askEnvelope";
 
 /** Static shell data shared by server-rendered navigation and browser startup. */
 export const ADMIN_SHELL_CONFIG = {

package/apps/storefront/src/lib/{admin → access/admin}/envelope.ts

@@ -1,9 +1,9 @@
 /**
  * Canonical tenant envelope for the admin console lives in
- * `lib/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
+ * `lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
  * staff-override authorization (`resolveAdminTenantMode`) that admin.astro
  * actually runs. This module re-exports that type so every mock service under
  * `lib/admin/**` can keep importing it from a stable relative path
  * (`../../envelope`) without declaring a second, competing interface.
  */
-export type { AdminTenantEnvelope } from "@/lib/adminTenantEnvelope";
+export type { AdminTenantEnvelope } from "@/lib/access/shared/adminTenantEnvelope";

package/apps/storefront/src/lib/{admin → access/admin}/viewmodels/settings.ts

@@ -7,8 +7,8 @@
  */
 
 import type { CheckoutStyle } from "@tot/public-runtime";
-import type { ApprovalMode } from "../ai/approvalMode";
-import type { AuditEvent } from "../ai/audit";
+import type { ApprovalMode } from "../../../automation/ai/approvalMode";
+import type { AuditEvent } from "../../../automation/ai/audit";
 
 export type { ApprovalMode };
 export type { CheckoutStyle };

package/apps/storefront/src/lib/{auth → access/auth}/adminApiGuard.ts

@@ -17,8 +17,8 @@
  * Astro/I-O wrapper the routes call.
  */
 import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/auth/adminEntry";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/access/auth/adminEntry";
 import type { SessionRecord } from "./session.js";
 
 export type AdminApiAccess =

package/apps/storefront/src/lib/{auth → access/auth}/adminEntry.ts

@@ -31,14 +31,14 @@
  */
 import type { SessionRecord } from "./session.js";
 import { sessionHostCapability } from "./loginGate.js";
-import { staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import {
   decideIsOwner,
   isOwnerCapability,
   resolveShipCapabilities,
   type Capability,
   type ShipCapabilities,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** Which entry case a viewer is in, for chrome + the DoD test matrix. */
 export type AdminEntryPrincipal =

package/apps/storefront/src/lib/{auth → access/auth}/adminLanding.ts

@@ -25,7 +25,7 @@
 import type { SessionRecord } from "./session.js";
 import { sessionAdmitsHost } from "./loginGate.js";
 import { safeNext } from "./route.js";
-import { selectTenant } from "@/lib/dashboard/tenantSelection";
+import { selectTenant } from "@/lib/access/dashboard/tenantSelection";
 
 /** The tenant-selection surface, in both host-routed and tenant-first path forms. */
 export function isAdminSelectPath(pathname: string): boolean {

package/apps/storefront/src/lib/{auth → access/auth}/identityToken.ts

@@ -31,7 +31,7 @@ import {
   TENANT_ROLES,
   isTenantRole,
   type TenantRole,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** tot's issuer — consumers pin/allowlist this (`auth.jwt.issuer`). */
 export const TOT_ISSUER = "tokenoftrust-internal-ops";

package/apps/storefront/src/lib/{auth → access/auth}/loginGate.ts

@@ -13,8 +13,8 @@
  * drifting apart. The auth surface itself (/auth/*, /api/auth/*) is always exempt
  * so a visitor can actually sign in.
  */
-import { hostInGateList } from "@/lib/demoGate";
-import { normalizeMemberships, staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { hostInGateList } from "@/lib/access/shared/demoGate";
+import { normalizeMemberships, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import type { SessionRecord } from "./session.js";
 
 export type GateMode = "password" | "login";

package/apps/storefront/src/lib/{auth → access/auth}/totAccessClient.ts

@@ -27,8 +27,8 @@
  * bodies, response shapes) is contract-fixed.
  */
 import { readEnv } from "@/lib/env";
-import { diagEmail } from "@/lib/diag/redact";
-import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/http/fetchTransport";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 import { classifyStepUp, type StepUpChallenge, type StepUpObligation } from "./stepUpChallenge.js";
 
 /** `send` is deliberately opaque — it never reveals whether the email was eligible. */
@@ -49,7 +49,7 @@ export type AccessCodeVerifyResult =
        * Present-usually, NOT guaranteed: tot returns the flat result without it
        * if signing hiccups (contract §6 graceful degradation). Phase 3 verifies
        * this OFFLINE and derives the session from its claims rather than trusting
-       * the flat `roles`/`capability`. See `@/lib/auth/identityToken`.
+       * the flat `roles`/`capability`. See `@/lib/access/auth/identityToken`.
        */
       id_token?: string;
     }
@@ -128,7 +128,7 @@ export interface TotAccessClient {
  * (signer degradation, contract §6); the consumer fails closed when it's absent.
  *
  * The `step-up-required`/`success-pending` variants carry tot20's RFC 9470
- * obligations (see `@/lib/auth/stepUpChallenge`) instead of a plain failure
+ * obligations (see `@/lib/access/auth/stepUpChallenge`) instead of a plain failure
  * reason, so the caller can drive the SMS completion loop rather than just
  * showing a generic "invalid code" error.
  */

package/apps/storefront/src/lib/{dashboard → access/dashboard}/delegateGate.ts

@@ -22,8 +22,8 @@
  * the page, matching `@/lib/dashboard/tenantSelection` and `@/lib/auth/loginGate`.
  */
 import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
-import { membershipFor, staffAdmits } from "@/lib/dashboard/tenantSelection";
-import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSelection";
+import { membershipFor, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
+import type { StaffAdmission, TenantMembership } from "@/lib/access/dashboard/tenantSelection";
 
 /** What every viewer of an unpaid store is told in place of the delegate section. */
 export const UNPAID_DELEGATION_NOTE =

package/apps/storefront/src/lib/{dashboard → access/dashboard}/staffAdmission.ts

@@ -12,7 +12,7 @@
  * scoped to the returned staffRoles capability. It is stamped on the session as a
  * DISTINCT marker from `tenants[]` — never a synthesized membership.
  */
-import type { SessionRecord, StaffSelection } from "@/lib/auth/session";
+import type { SessionRecord, StaffSelection } from "@/lib/access/auth/session";
 
 /**
  * Staff selection lifetime. Deliberately short: staff cross-vendor access is a

package/apps/storefront/src/lib/{dashboard → access/dashboard}/tenantSelection.ts

@@ -17,7 +17,7 @@
  * tot20 populates all of the email's memberships. Flagged to the workstream lead.
  */
 
-import type { StaffSelection } from "@/lib/auth/session";
+import type { StaffSelection } from "@/lib/access/auth/session";
 
 /** One tenant membership carried in the verified session. */
 export interface TenantMembership {

package/apps/storefront/src/lib/{admin/services/mock → access/fixtures}/settings.ts

@@ -1,8 +1,8 @@
 import { DEFAULT_CHECKOUT_STYLE } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../envelope";
-import { memoizeByEnvelope } from "../../memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../seed";
-import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../../viewmodels/settings";
+import type { AdminTenantEnvelope } from "../admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../admin/viewmodels/settings";
 
 const SECTION_DEFS: Omit<SettingsSection, "riskyChangeReview">[] = [
   { key: "store", label: "Store", summary: "Store profile, branding, and white-label copy." },

package/apps/storefront/src/lib/{shared → access/shared}/accessExplain.ts

@@ -17,7 +17,7 @@
  * Nothing here is ever reported as verified unless tot-mcp said so: an unconfigured seam,
  * a non-200 or a timeout is `unavailable`, which the UI shows as unverified.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 
 const EXPLAIN_TIMEOUT_MS = 8000;
 

package/apps/storefront/src/lib/{adminTenantEnvelope.ts → access/shared/adminTenantEnvelope.ts}

@@ -21,9 +21,9 @@
  *     request asks for: the staff check gates evaluation of the request
  *     entirely, not just the picker's visibility.
  */
-import type { SessionRecord } from "@/lib/auth/session";
-import { isStaffSession } from "@/lib/dashboard/staffAdmission";
-import { membershipFor, normalizeMemberships, type TenantMembership } from "@/lib/dashboard/tenantSelection";
+import type { SessionRecord } from "@/lib/access/auth/session";
+import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
+import { membershipFor, normalizeMemberships, type TenantMembership } from "@/lib/access/dashboard/tenantSelection";
 
 export interface AdminTenantEnvelope {
   /** The tenant that actually served this request. */

package/apps/storefront/src/lib/{shared → access/shared}/developerInvites.ts

@@ -53,10 +53,10 @@
  * control-plane cluster stays self-contained (see `.dependency-cruiser.cjs`).
  */
 import { readEnv } from "@/lib/env";
-import { callMcpService } from "@/lib/http/mcpServiceCall";
-import { diagEmail } from "@/lib/diag/redact";
-import { checkStorePreviewReady, type PreflightDecision } from "@/lib/shared/invitePreflight";
-import { explainDeveloperAccess, type AccessVerification } from "@/lib/shared/accessExplain";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { checkStorePreviewReady, type PreflightDecision } from "@/lib/access/shared/invitePreflight";
+import { explainDeveloperAccess, type AccessVerification } from "@/lib/access/shared/accessExplain";
 
 /**
  * The header carrying the storefront-signed staff BROKER ASSERTION to tot20

package/apps/storefront/src/lib/{shared → access/shared}/invitePreflight.ts

@@ -22,7 +22,7 @@
  * mirroring recordDeveloperAppBinding's "skipped when not-configured" stance — we
  * never break invites just because the MCP is briefly unreachable.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 
 /** How long we'll wait on the preview-status read before failing open. */
 const PREFLIGHT_TIMEOUT_MS = 4000;

package/apps/storefront/src/lib/{shared → access/shared}/principalGrants.ts

@@ -76,8 +76,8 @@
  * swaps in the Http client with no call-site change.
  */
 import { readEnv } from "@/lib/env";
-import { diagEmail } from "@/lib/diag/redact";
-import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/auth/brokerAssertion";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
 export interface UserPrincipal {

package/apps/storefront/src/lib/{shared → access/shared}/viewerGrant.ts

@@ -30,7 +30,7 @@
  * app-binding WRITE (`recordDeveloperAppBinding`) targets, so this READ and that
  * WRITE always agree on which subject-capability store they speak to.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 import type { Capability } from "./capability.js";
 
 /** Minimal GET transport (mirrors `dev/previewStatus.ts` — decoupled by design). */

package/apps/storefront/src/lib/activity/fixtures/evidence.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 import type { EvidenceReference } from "../evidence/evidenceReference";
 import { getCustomersViewModel } from "../../customers/fixtures/customers";
 import { getOrdersViewModel } from "../../orders/fixtures/orders";

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -48,11 +48,11 @@ import type {
   ActivityPayload,
 } from "@tot/public-runtime";
 import type { ActionKey } from "@tot/public-runtime";
-import { readViewerSession } from "@/lib/auth/route";
-import { sessionHostCapability } from "@/lib/auth/loginGate";
-import { isStaffSession } from "@/lib/dashboard/staffAdmission";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { sessionHostCapability } from "@/lib/access/auth/loginGate";
+import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
 import { readEnv } from "@/lib/env";
-import { isOwnerCapability } from "@/lib/shared/capability";
+import { isOwnerCapability } from "@/lib/access/shared/capability";
 import { hashActorId, recordActivity } from "./recordActivity";
 
 /** The minimal viewer chrome the middleware stamps on `locals.viewer`. */

package/apps/storefront/src/lib/activity/workerCommit.ts

@@ -11,7 +11,7 @@
  * baked in at BUILD time: astro.config.mjs's Vite `define` replaces the
  * `__GIT_SHA__` token with a string literal of the build's commit (CI-provided
  * `GIT_SHA`/`WORKERS_CI_COMMIT_SHA`/`GITHUB_SHA`, else local `git rev-parse`,
- * else "unknown"). This is the SAME source /health already reports (lib/health.ts)
+ * else "unknown"). This is the SAME source /health already reports (lib/observability/shared/health.ts)
  * — we read it through the identical `typeof` guard so both agree by construction,
  * and so the value is safe under vitest (where the define isn't applied → "unknown").
  *

package/apps/storefront/src/lib/admin/services/mock/index.ts

@@ -2,11 +2,11 @@ export { getOrdersViewModel } from "../../../orders/fixtures/orders";
 export { getProductsViewModel } from "../../../catalog/fixtures/products";
 export { getCustomersViewModel } from "../../../customers/fixtures/customers";
 export { getReportingViewModel } from "../../../reporting/fixtures/reporting";
-export { getSettingsViewModel } from "./settings";
+export { getSettingsViewModel } from "../../../access/fixtures/settings";
 export { getCheckoutSettingsViewModel } from "../../../checkout/fixtures/checkoutSettings";
 export type { CheckoutSettingsViewModel } from "../../../checkout/fixtures/checkoutSettings";
 export { getSubscriptionsViewModel } from "../../../subscriptions/fixtures/subscriptions";
-export { getAiWorkflowsViewModel } from "./aiWorkflows";
+export { getAiWorkflowsViewModel } from "../../../automation/fixtures/aiWorkflows";
 export { getEvidenceViewModel } from "../../../activity/fixtures/evidence";
-export { SEEDED_TENANTS, tenantProfile } from "./tenants";
-export type { SeededTenantProfile, MockVertical } from "./tenants";
+export { SEEDED_TENANTS, tenantProfile } from "../../../access/fixtures/tenants";
+export type { SeededTenantProfile, MockVertical } from "../../../access/fixtures/tenants";

package/apps/storefront/src/lib/{admin → automation/admin}/viewmodels/aiWorkflows.ts

@@ -5,9 +5,9 @@
  * come from `lib/admin/ai`, which formalizes the approval/evidence models.
  */
 
-import type { ApprovalMode } from "../ai/approvalMode";
-import type { AiRecommendation } from "../ai/recommendation";
-import type { AuditEvent } from "../ai/audit";
+import type { ApprovalMode } from "../../ai/approvalMode";
+import type { AiRecommendation } from "../../ai/recommendation";
+import type { AuditEvent } from "../../ai/audit";
 
 export type { ApprovalMode };
 

package/apps/storefront/src/lib/{admin → automation}/ai/askEnvelope.ts

@@ -6,7 +6,7 @@
  * this is emitted for dev inspection only (see adminShell.ts's `data-admin-ask`
  * click handler), never sent over the network.
  */
-import type { AdminTenantEnvelope } from "../envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 
 export type AdminRole = "internal_staff" | "merchant_operator";
 

package/apps/storefront/src/lib/{admin → automation}/ai/operationalRuns.ts

@@ -7,10 +7,10 @@
  * The other 5 workflows remain scaffold-only until their own units connect
  * real source data.
  */
-import type { AdminTenantEnvelope } from "../envelope";
-import { getOrdersViewModel, getProductsViewModel, getEvidenceViewModel } from "../services/mock";
-import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../seed";
-import { OPERATIONAL_WORKFLOW_KEYS, type OperationalWorkflowKey } from "../viewmodels/aiWorkflows";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { getOrdersViewModel, getProductsViewModel, getEvidenceViewModel } from "../../admin/services/mock/index";
+import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import { OPERATIONAL_WORKFLOW_KEYS, type OperationalWorkflowKey } from "../admin/viewmodels/aiWorkflows";
 import type { ApprovalMode } from "./approvalMode";
 import type { AuditEvent } from "./audit";
 import type { AiRecommendation } from "./recommendation";

package/apps/storefront/src/lib/{admin/services/mock → automation/fixtures}/aiWorkflows.ts

@@ -1,7 +1,7 @@
-import type { AdminTenantEnvelope } from "../../envelope";
-import { memoizeByEnvelope } from "../../memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomInt, seededRandom } from "../../seed";
-import { AI_WORKFLOW_NAMES, OPERATIONAL_WORKFLOW_KEYS, type AiWorkflowsViewModel, type ApprovalMode, type WorkflowRecord, type WorkflowStatus } from "../../viewmodels/aiWorkflows";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import { AI_WORKFLOW_NAMES, OPERATIONAL_WORKFLOW_KEYS, type AiWorkflowsViewModel, type ApprovalMode, type WorkflowRecord, type WorkflowStatus } from "../admin/viewmodels/aiWorkflows";
 
 const OWNERS = ["Ops", "Trust & Safety", "Growth", "Fulfillment"];
 const APPROVAL_MODES: ApprovalMode[] = ["draft_only", "approval_required", "guarded_automation"];

package/apps/storefront/src/lib/basePath.ts

@@ -2,7 +2,7 @@
  * Tenant base-path helpers.
  *
  * When a request selects its tenant via a `/<domain>/` path prefix (see
- * lib/tenantRouting.ts), every same-origin link must carry that prefix or the
+ * lib/access/shared/tenantRouting.ts), every same-origin link must carry that prefix or the
  * visitor falls out of the tenant. Host-routed requests have an empty base path
  * and links are returned unchanged.
  *

package/apps/storefront/src/lib/catalog/fixtures/products.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   ExciseCheckKey,
   ExciseReadinessCheck,
@@ -8,8 +8,8 @@ import type {
   ProductsViewModel,
   ProductVariant,
 } from "../admin/viewmodels/products";
-import { tenantProfile } from "../../admin/services/mock/tenants";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import { tenantProfile } from "../../access/fixtures/tenants";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 
 // Must stay index-aligned with orders.ts's ITEM_POOLS: a product's id is
 // `prod-<tenant>-<position here>`, and orders.ts derives each order's productId

package/apps/storefront/src/lib/checkout/admin/checkoutStyleTarget.ts

@@ -20,8 +20,8 @@
  * Pure (no I/O, no Astro) — the caller supplies the already-read viewer session —
  * so it is unit-testable in isolation.
  */
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import type { SessionRecord } from "@/lib/auth/session";
+import { resolveAdminTenantMode } from "@/lib/access/shared/adminTenantEnvelope";
+import type { SessionRecord } from "@/lib/access/auth/session";
 
 export type WriteTargetResult =
   | { ok: true; targetTenant: string }

package/apps/storefront/src/lib/checkout/fixtures/checkoutSettings.ts

@@ -18,7 +18,7 @@ import { resolveManagedCheckout } from "@tot/public-runtime";
 import type { TenantConfig } from "@tot/public-runtime";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
-import type { AdminTenantEnvelope } from "../../admin/envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 import {
   buildCheckoutSettingsFields,
   deriveCheckoutSettings,

package/apps/storefront/src/lib/compliance/browser/checkoutVerificationFlow.ts

@@ -175,7 +175,7 @@ export interface PollDeps {
 
 /**
  * True when the login gate, not the preflight route, answered: the store is not
- * public and this viewer holds no session (see `lib/auth/gatePage.ts`). Still fail
+ * public and this viewer holds no session (see `lib/access/auth/gatePage.ts`). Still fail
  * closed — the caller only names the reason instead of reporting an outage.
  */
 export function isStoreNotPublicRefusal(res: Pick<Response, "status" | "headers">): boolean {

package/apps/storefront/src/lib/compliance/verification/totVerificationClient.ts

@@ -40,7 +40,7 @@ import {
   type HttpGetTransport,
   type HttpResponseLike,
   type HttpTransport,
-} from "@/lib/http/fetchTransport";
+} from "@/lib/developer-experience/http/fetchTransport";
 
 // --- Gate normalization -----------------------------------------------------
 

package/apps/storefront/src/lib/content/blog/access.ts

@@ -1,4 +1,4 @@
-import type { SessionRecord } from "@/lib/auth/session.js";
+import type { SessionRecord } from "@/lib/access/auth/session.js";
 import type { BlogAccess } from "./types.js";
 
 /**

package/apps/storefront/src/lib/content/blog/postView.ts

@@ -18,12 +18,12 @@ import {
 import { homeCrumbLabel, siteTrail, type Crumb } from "@/lib/content/shared/breadcrumbs.js";
 import { viewerHasBlogAccess } from "./access.js";
 import { articleBodyHtml } from "./teaser.js";
-import { readViewerSession, safeNext } from "@/lib/auth/route.js";
+import { readViewerSession, safeNext } from "@/lib/access/auth/route.js";
 import { buildAlternates, type Alternate } from "@/lib/content/seo/alternates.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/content/shared/jsonld.js";
 import { collectionPathsV1, blogPathOptsV1 } from "./collectionPaths.js";
 import type { BlogPost } from "./types.js";
-import type { SessionRecord } from "@/lib/auth/session.js";
+import type { SessionRecord } from "@/lib/access/auth/session.js";
 
 export interface BlogPostViewPropsV1 {
   post: BlogPost;