@tokenoftrust/storefront-runner 2.4.88 → 2.4.89

package/apps/storefront/src/lib/content/storyblok/provider.ts

@@ -867,7 +867,7 @@ export class DevDraftContentProvider implements ContentProvider {
 
   /** Draft artifact for a tenant-repo-relative path, or null to fall back. */
   private draftRaw(path: string): Promise<string | null> {
-    // Key shape mirrors lib/dev/devDraft.ts devDraftKey — duplicated as a plain
+    // Key shape mirrors lib/developer-experience/dev/devDraft.ts devDraftKey — duplicated as a plain
     // template to keep this module's imports renderer-safe (public-runtime only).
     return this.get(`dev-draft:${this.tenantId}:${this.draftId}:${path}`);
   }

package/apps/storefront/src/lib/customers/fixtures/customers.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   BlockedReason,
   CustomerBlockedQueueRow,

package/apps/storefront/src/lib/{admin → developer-experience/admin}/memoizeByEnvelope.ts

@@ -1,4 +1,4 @@
-import type { AdminTenantEnvelope } from "./envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 
 /**
  * Per-request memoization for the pure mock view-model builders. Each builder is

package/apps/storefront/src/lib/{dev → developer-experience/dev}/activityIngestToken.ts

@@ -4,12 +4,12 @@
  * local→hosted activity bridge.
  *
  * Minted alongside the existing cli-signin-code paste
- * (apps/storefront/src/lib/dev/cliSignInCode.ts) and cached by the CLI in
+ * (apps/storefront/src/lib/developer-experience/dev/cliSignInCode.ts) and cached by the CLI in
  * ~/.tot/credentials.json. Deliberately NOT a signed token: this reuses the
  * SESSION KV binding that already exists in every environment (dev/qa/prod),
  * so it needs no new secret to provision. Revoking is just deleting the KV
  * entry — the same posture as the browser's own tot_session cookie (see
- * lib/auth/session.ts).
+ * lib/access/auth/session.ts).
  */
 
 const KEY_PREFIX = "dev-activity-token:";

package/apps/storefront/src/lib/{dev → developer-experience/dev}/cliSignInCode.ts

@@ -18,13 +18,13 @@
  * on prod the shortest form is emitted.
  *
  * `activityBridge` (optional) piggybacks the local→hosted activity-bridge credential
- * (see lib/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
+ * (see lib/developer-experience/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
  * flags — no second browser round-trip. Omitted entirely when the caller has no SESSION KV
  * to mint against — the local loop then simply runs with no hosted signal.
  */
 import { readEnv } from "@/lib/env";
-import { redactEmailForHint } from "@/lib/privacy/emailHint";
-import { createRendezvous, type RendezvousDeps } from "@/lib/dev/rendezvousBroker";
+import { redactEmailForHint } from "@/lib/access/privacy/emailHint";
+import { createRendezvous, type RendezvousDeps } from "@/lib/developer-experience/dev/rendezvousBroker";
 
 // The CLI's built-in default MCP (packages/cli login.mjs DEFAULT_MCP_URL). When the derived
 // MCP origin equals this, --mcp is redundant noise, so we omit it.

package/apps/storefront/src/lib/{dev → developer-experience/dev}/livePreview.ts

@@ -5,7 +5,7 @@
  * shape + the request host + a config flag, never a secret.
  *
  * WHY AN IFRAME WORKS (no screenshots, no new infra): tenant routing is host-first with a
- * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/tenantRouting.ts), so
+ * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/access/shared/tenantRouting.ts), so
  * the tenant's real site is reachable at a RELATIVE path from /dev. CSP already permits
  * same-origin framing both directions (`frame-ancestors 'self'` + `frame-src 'self'`,
  * packages/public-runtime/src/csp.ts) alongside `X-Frame-Options: SAMEORIGIN` — no header

package/apps/storefront/src/lib/{dev → developer-experience/dev}/previewStatus.ts

@@ -20,8 +20,8 @@
  * transport / parse fault → { configured:true, ok:false } so a caller can distinguish
  * "definitely not provisioned" (ok + provisioned:false) from "couldn't tell". Never throws.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
-import { FetchHttpTransport, type HttpGetTransport } from "@/lib/http/fetchTransport";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
+import { FetchHttpTransport, type HttpGetTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpGetTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/rendezvousBroker.ts

@@ -20,8 +20,8 @@
  * one minted assertion shape covers every call. SERVER-SIDE ONLY.
  */
 import { readEnv } from "@/lib/env";
-import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/auth/mcpClientAssertion";
-import { FetchHttpTransport, type HttpTransport } from "@/lib/http/fetchTransport";
+import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/access/auth/mcpClientAssertion";
+import { FetchHttpTransport, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/subjectReissue.ts

@@ -20,8 +20,8 @@
  * MCP client_id, exactly what the MCP binds the subject_token audience to. This is the
  * same non-gated mint the MCP itself uses to power rendezvous creation.
  */
-import { getAccessClient } from "@/lib/auth/route";
-import type { TotAccessClient } from "@/lib/auth/totAccessClient";
+import { getAccessClient } from "@/lib/access/auth/route";
+import type { TotAccessClient } from "@/lib/access/auth/totAccessClient";
 
 /** Short — the proof is minted and used immediately at approve time. */
 const SUBJECT_TOKEN_TTL_SECONDS = 120;

package/apps/storefront/src/lib/engagement/messaging/messagesClient.ts

@@ -3,7 +3,7 @@
  *
  * The storefront RENDERS its own branded email HTML and hands it to tot20 to TRANSMIT, so we
  * reuse tot20's Mandrill SPF/DKIM deliverability (the whole point) while owning the body/brand.
- * Used for the magic-link invite email (see lib/grants/magicLinkInvite.ts).
+ * Used for the magic-link invite email (see lib/access/grants/magicLinkInvite.ts).
  *
  *   POST <core>/api/messages
  *   { channel:"email", to, subject, html, totApiKey, totSecretKey }  → 200 { sent:true, id? }

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -31,9 +31,9 @@ import {
   type StockState,
 } from "@tot/public-runtime";
 import { readD1 } from "@/lib/env";
-import { decideAdminApiAccess } from "@/lib/auth/adminApiGuard";
-import { readViewerSession } from "@/lib/auth/route";
-import type { SessionRecord } from "@/lib/auth/session";
+import { decideAdminApiAccess } from "@/lib/access/auth/adminApiGuard";
+import { readViewerSession } from "@/lib/access/auth/route";
+import type { SessionRecord } from "@/lib/access/auth/session";
 import {
   canRelease,
   carrierPolicyForTenant,

package/apps/storefront/src/lib/integrations/integration/browserEnvironment.ts

@@ -19,7 +19,7 @@ import {
   type IntegrationSiteSurface,
   type ObligationTenant,
 } from "@tot/public-runtime";
-import { isAdminPath } from "@/lib/auth/loginGate";
+import { isAdminPath } from "@/lib/access/auth/loginGate";
 import {
   resolveIntegrationRenderState,
   type IntegrationRenderState,

package/apps/storefront/src/lib/{monitoring → observability/monitoring}/manifest.ts

@@ -10,7 +10,7 @@
  * `needs-external` / `needs-secret`.
  *
  * Signal sources are named against real code where it exists in this repo
- * (`/health` → lib/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
+ * (`/health` → lib/observability/shared/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
  * commerce events → lib/analytics). Signals owned by sibling units are referenced
  * by CONTRACT NAME, not imported — Core Web Vitals come from the RUM beacon,
  * and age-verification / restricted-state denials come from the compliance
@@ -99,7 +99,7 @@ export const MONITORS: readonly Monitor[] = [
     title: "Storefront uptime / liveness",
     category: "availability",
     signal: {
-      source: "GET /health (lib/health.ts — answered before tenant/gate/cache)",
+      source: "GET /health (lib/observability/shared/health.ts — answered before tenant/gate/cache)",
       observe: "external synthetic probe hits /health across regions; expects 200 {status:'ok'}",
     },
     threshold: "2 consecutive probe failures (or >1% of probes failing over 5m)",

package/apps/storefront/src/lib/{analytics → observability/performance}/budgets.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/analytics/perfBudgets.ts (parsePerfBudgets).",
+  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/observability/performance/perfBudgets.ts (parsePerfBudgets).",
   "version": 1,
   "webVitals": {
     "$comment": "Core Web Vitals thresholds, evaluated at the 75th percentile (p75) of the field distribution — the same percentile Google's CrUX / the RUM alert contract use.",

package/apps/storefront/src/lib/orders/fixtures/orders.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   OrderDetail,
   OrderEvidenceEvent,
@@ -8,8 +8,8 @@ import type {
   OrderRow,
   OrdersViewModel,
 } from "../admin/viewmodels/orders";
-import { tenantProfile } from "../../admin/services/mock/tenants";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import { tenantProfile } from "../../access/fixtures/tenants";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 
 // Must stay index-aligned with customers.ts's NAMES: an order's customerId is
 // derived from the picked name's position here, and customers.ts assigns each

package/apps/storefront/src/lib/reporting/fixtures/reporting.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { pick, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { pick, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type { AnalysisBriefItem, ReportingCategory, ReportingSummary, ReportingViewModel } from "../admin/viewmodels/reporting";
 
 const CATEGORY_DEFS: { category: ReportingCategory; label: string; drilldownHref: string }[] = [

package/apps/storefront/src/lib/runtimeEnv.ts

@@ -22,7 +22,7 @@ let workerEnv: Record<string, unknown> | null | undefined;
 export async function getWorkerEnv(): Promise<Record<string, unknown> | null> {
   if (workerEnv !== undefined) return workerEnv;
   try {
-    // Only resolvable in the Workers runtime; types in lib/cloudflare-workers.d.ts.
+    // Only resolvable in the Workers runtime; types in lib/developer-experience/types/cloudflare-workers.d.ts.
     const mod = await import("cloudflare:workers");
     workerEnv = (mod.env ?? null) as Record<string, unknown> | null;
   } catch {

package/apps/storefront/src/lib/subscriptions/fixtures/subscriptions.ts

@@ -7,14 +7,14 @@ import {
   isSubscriptionFrequency,
   purchaseOptionPrice,
 } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 import {
   MOCK_ANCHOR_ISO,
   offsetIso,
   randomInt,
   seededRandom,
-} from "../../admin/seed";
+} from "../../developer-experience/admin/seed";
 import type { CustomerRow } from "../../customers/admin/viewmodels/customers";
 import type { ProductDetail, ProductRow } from "../../catalog/admin/viewmodels/products";
 import type {

package/apps/storefront/src/middleware/controlPlane.ts

@@ -30,14 +30,14 @@ import {
   sessionAdmitsHost,
   sessionHostCapability,
   type GateMode,
-} from "@/lib/auth/loginGate";
-import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import { gatedApiResponse, gatedHoldingResponse } from "@/lib/auth/gatePage";
-import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+} from "@/lib/access/auth/loginGate";
+import { resolveAdminLanding, isAdminSelectPath } from "@/lib/access/auth/adminLanding";
+import { resolveAdminTenantMode } from "@/lib/access/shared/adminTenantEnvelope";
+import { gatedApiResponse, gatedHoldingResponse } from "@/lib/access/auth/gatePage";
+import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
 import { runRenderChain } from "./renderChain.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
+import type { InternalContentGrant } from "@/lib/access/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
   context: APIContext;

package/apps/storefront/src/middleware/index.ts

@@ -23,19 +23,19 @@ import { defineMiddleware } from "astro:middleware";
 import type { APIContext, MiddlewareNext } from "astro";
 import { getTenantResolver } from "@/config/resolver";
 import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
-import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
+import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/access/shared/tenantRouting";
 import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
 import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
-import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
 import { visitorRegionFor, withVisitorRegionCookie } from "@/lib/compliance/shared/visitorRegionCookie";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import { parseGateMode } from "@/lib/auth/loginGate";
-import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
-import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
-import { HEALTH_PATH, healthResponse } from "@/lib/health";
+import { parseGateMode } from "@/lib/access/auth/loginGate";
+import { evaluateDemoGate, hostInGateList } from "@/lib/access/shared/demoGate";
+import { isMaintenanceOn, maintenanceResponse } from "@/lib/access/shared/maintenance";
+import { HEALTH_PATH, healthResponse } from "@/lib/observability/shared/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
 import {
@@ -46,13 +46,13 @@ import {
 } from "./routeBranch.js";
 import { servePublicRender } from "./publicRender.js";
 import { serveControlPlane } from "./controlPlane.js";
-import { KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
-import { mintOpaqueBrokerAssertion } from "@/lib/auth/brokerAssertion";
+import { KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
+import { mintOpaqueBrokerAssertion } from "@/lib/access/auth/brokerAssertion";
 import {
   applyInternalContentResponsePolicy,
   authorizeInternalContentRequest,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 /**
  * Compiled once per tenant-config object, as the resolver's contract asks —
@@ -109,7 +109,7 @@ async function serveRequest(
   // ---- /health — liveness + deploy-identity probe ---------------------------
   // Answered FIRST: before tenant resolution, the access gate, the maintenance
   // kill-switch, and the edge cache — so it reports the running build's commit SHA
-  // regardless of Host, an unresolved tenant, or a closed site. See lib/health.
+  // regardless of Host, an unresolved tenant, or a closed site. See lib/observability/shared/health.
   if (url.pathname === HEALTH_PATH) {
     return healthResponse();
   }

package/apps/storefront/src/middleware/renderChain.ts

@@ -19,7 +19,7 @@ import { resolveCandidateContentPin, type CandidateContentPin } from "./candidat
 import { createContentProvider, DevDraftContentProvider } from "@/lib/content/storyblok/provider";
 import { bindPublicationSpaceContentProviderV1 } from "@/lib/publication/contentProvider.js";
 import { resolvePublicationRuntimeSourceV1 } from "@/lib/publication/runtimeSource.js";
-import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
+import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/developer-experience/dev/devDraft";
 import {
   isCacheablePath,
   pageCacheKey,
@@ -27,8 +27,8 @@ import {
   getCachedPage,
   putCachedPage,
 } from "@/lib/edgeCache";
-import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/access/shared/cspStaticHashes";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
 import { maybeInjectPreviewReload } from "@/lib/previewReload";
 import {
   resolveCustomizationEnv,
@@ -104,13 +104,13 @@ import {
 } from "@/lib/integrations/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
-import { declaredTenantOrigins } from "@/lib/tenantOrigins";
+import { declaredTenantOrigins } from "@/lib/access/shared/tenantOrigins";
 import { withDeclaredTenantConfig } from "@/config/declaredTenantConfig";
 import {
   applyInternalContentResponsePolicy,
   internalContentGrantMatchesPlan,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 export interface RenderChainInput {
   context: APIContext;

package/apps/storefront/src/pages/api/admin/activity-alerts.ts

@@ -25,7 +25,7 @@
  * ops-timeline; never a URL/query value.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { checkActivityAlerts } from "@/lib/activity/alerts";

package/apps/storefront/src/pages/api/admin/commerce-readiness.ts

@@ -9,7 +9,7 @@
  * surface has no ledger, so configured, absent, and unreadable stay unhealthy.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { workerCommit } from "@/lib/activity/workerCommit";
 import {
   COMMERCE_SCHEDULER,

package/apps/storefront/src/pages/api/admin/fulfillment/batches.ts

@@ -2,7 +2,7 @@
  * Authenticated owner API for whole-order batch claim and batch read.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -3,7 +3,7 @@
  * The read runs only after the owner gate admits the caller.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id].ts

@@ -3,7 +3,7 @@
  * The response is state codes and the fulfillment view. It never returns an address.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/interaction-insights.ts

@@ -28,7 +28,7 @@
  * scoping) — see the unit's completion report for the reasoning.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { readD1 } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { resolveTenantStore, trackingNamePrefix } from "@/lib/measurement/tracking/tenantD1Registry";

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -8,7 +8,7 @@
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   commerceActorForAdmin,
   createCheckoutOrderClient,

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -11,7 +11,7 @@
  */
 import type { APIContext } from "astro";
 import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   createCheckoutOrderClient,
   orderApiBaseUrl,

package/apps/storefront/src/pages/api/auth/logout.ts

@@ -7,8 +7,8 @@
  * sign out.
  */
 import type { APIContext } from "astro";
-import { getSessionStore, clearSessionCookie } from "@/lib/auth/route";
-import { revokeSession, SESSION_COOKIE } from "@/lib/auth/session";
+import { getSessionStore, clearSessionCookie } from "@/lib/access/auth/route";
+import { revokeSession, SESSION_COOKIE } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -18,15 +18,15 @@ import {
   getSessionStore,
   setSessionCookie,
   safeNext,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { acceptDeveloperInvite } from "@/lib/shared/developerInvites";
-import { explainDeveloperAccess } from "@/lib/shared/accessExplain";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { acceptDeveloperInvite } from "@/lib/access/shared/developerInvites";
+import { explainDeveloperAccess } from "@/lib/access/shared/accessExplain";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/send.ts

@@ -15,13 +15,13 @@ import {
   getAccessClient,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   devAuthEnabled,
   devAuthCode,
   storeDevCode,
   DEV_AUTH_CODE_TTL_SECONDS,
-} from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-send.ts

@@ -13,7 +13,7 @@
  * but also accepts a plain form post so a no-JS fallback stays possible.
  */
 import type { APIContext } from "astro";
-import { getAccessClient } from "@/lib/auth/route";
+import { getAccessClient } from "@/lib/access/auth/route";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -22,9 +22,9 @@ import {
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
-import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
+} from "@/lib/access/auth/route";
+import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -21,13 +21,13 @@ import {
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -19,7 +19,7 @@ import {
   recordReaction,
   type Reaction,
 } from "@/lib/content/blog/reactions";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -17,7 +17,7 @@
 import type { APIRoute } from "astro";
 import { readD1, readKv, readEnv } from "@/lib/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
 import { randomToken, hashConsentIp } from "@/lib/engagement/newsletter/consent";
 import { sendConfirmationEmail } from "@/lib/engagement/newsletter/confirmationEmail";

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -13,7 +13,7 @@
  * store/forward is the documented follow-up; the SHAPE it stores is fixed here.
  */
 import type { APIRoute } from "astro";
-import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/analytics/webVitals";
+import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/observability/performance/webVitals";
 import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
 import { recordBlogView } from "@/lib/content/blog/viewCounts";
 

package/apps/storefront/src/pages/auth/login.astro

@@ -10,8 +10,8 @@
  * (tot20 sends/verifies the code, the storefront mints the session). No secrets
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { safeNext } from "@/lib/auth/route";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { safeNext } from "@/lib/access/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.

package/apps/storefront/src/pages/auth/magic.astro

@@ -9,7 +9,7 @@
  * the token before the user ever clicked. So: NEVER exchange on GET. The token rides
  * in a hidden form field and leaves only via the POST.
  */
-import { normalizeEmailHint, redactEmailForHint } from "@/lib/privacy/emailHint";
+import { normalizeEmailHint, redactEmailForHint } from "@/lib/access/privacy/emailHint";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.88",
+  "version": "2.4.89",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/scripts/dev/locate.mjs

@@ -6,7 +6,7 @@
 // with node:test and carries no framework/build coupling.
 //
 // THE WALK (must stay byte-identical in intent to captureDomPath() in
-// apps/storefront/src/lib/dev/ai-widget-client.js):
+// apps/storefront/src/lib/developer-experience/dev/ai-widget-client.js):
 //   A DOM path is an array of { tag, index } steps, ordered from the <body>'s
 //   direct child DOWN to the target. Each step names a lowercased tag and the
 //   0-based position of that element among its same-tag ELEMENT siblings (text and

package/apps/storefront/src/lib/admin/ai/index.ts

@@ -1,6 +0,0 @@
-export type { ApprovalMode } from "./approvalMode";
-export { isDraftOnly, requiresHumanApproval, isAutomationAllowed } from "./approvalMode";
-export type { AuditEvent } from "./audit";
-export type { AiRecommendation } from "./recommendation";
-export type { AskEnvelope, AdminRole } from "./askEnvelope";
-export { buildAskEnvelope } from "./askEnvelope";