@tokenoftrust/storefront-runner 2.4.88 → 2.4.90

package/apps/storefront/astro.config.mjs

@@ -31,7 +31,7 @@ const cliVersion = (() => {
 const cliInstallSpec = cliVersion ? `@tokenoftrust/cli@${cliVersion}` : "@tokenoftrust/cli";
 
 // The commit THIS build was cut from, baked in at BUILD time so /health can report
-// exactly which code is live (see src/lib/health.ts + src/middleware). Prefer a CI-
+// exactly which code is live (see src/lib/observability/shared/health.ts + src/middleware). Prefer a CI-
 // provided SHA (Workers Builds / GitHub Actions / CF Pages) so the value is right even
 // when the build runs from a shallow/detached checkout; fall back to `git rev-parse`
 // for local deploys. deploy.sh's source guard pins HEAD to origin/<deploySourceBranch>,
@@ -87,7 +87,7 @@ export default defineConfig({
   // Small first-paint tradeoff, offset by cross-page caching (see LIMITATIONS).
   build: { inlineStylesheets: "never" },
   // The cross-site form check runs in the front door (src/middleware/index.ts,
-  // lib/cdnForward.ts `crossSiteFormRefusal`) with the same rule, against the
+  // lib/publication/shared/cdnForward.ts `crossSiteFormRefusal`) with the same rule, against the
   // origin the viewer used. Astro's own check compares with the request URL, which
   // for a CloudFront-forwarded Tier 3 request is this Worker's host, not the viewer's.
   security: { checkOrigin: false },

package/apps/storefront/drizzle.config.apps.ts

@@ -8,6 +8,6 @@ import { defineConfig } from "drizzle-kit";
 // lineage/journal — the whole point of splitting the database.
 export default defineConfig({
   dialect: "sqlite",
-  schema: "./src/lib/d1/schema-apps.ts",
+  schema: "./src/lib/publication/d1/schema-apps.ts",
   out: "./migrations-apps",
 });

package/apps/storefront/env.d.ts

@@ -226,7 +226,7 @@ declare global {
        * the opaque subject, email + role(s)/capability tot20 resolved on this tenant, so chrome
        * can show "signed in as … — owner/developer/staff". Absent on open or
        * password-gated hosts. Chrome only: authorization reads the session record for the
-       * routed tenant (lib/pipeline/admission-request), never this.
+       * routed tenant (lib/publication/pipeline/admission-request), never this.
        */
       viewer?: {
         /** Opaque identity-provider subject from the verified session assertion. */

package/apps/storefront/migrations/README.md

@@ -10,20 +10,20 @@ by **Drizzle Kit** (ADR-0002), applied by `wrangler d1 migrations apply`.
 
 ## Source of truth
 
-- **`src/lib/d1/schema.ts`** (Drizzle schema, catalog + customization ONLY) is the
+- **`src/lib/publication/d1/schema.ts`** (Drizzle schema, catalog + customization ONLY) is the
   source of truth for migration *generation*. `drizzle-kit generate` diffs it into
   numbered `migrations/*.sql` (+ `meta/` journal) and owns the SQLite table-rebuild
   logic for `ALTER`s.
 - **`products_fts`** (FTS5 virtual table) can't be modelled by Drizzle — it's a custom
   migration (`0001_products_fts.sql`), hand-maintained.
 - The raw-SQL read model + ETL still consume `CATALOG_D1_SCHEMA`/`CUSTOMIZATION_D1_SCHEMA`
-  (`@tot/private-controlplane`). A **structural** equivalence test (`src/lib/d1/schema.test.ts`,
+  (`@tot/private-controlplane`). A **structural** equivalence test (`src/lib/publication/d1/schema.test.ts`,
   PRAGMA-based) asserts the migrations reproduce that contract, so generator and read
   model can't drift.
 
 ## Safety (D1 has no rollback)
 
-`src/lib/d1/migrationSafety.ts` + its test **fail CI** on any unmarked `DROP TABLE` /
+`src/lib/publication/d1/migrationSafety.ts` + its test **fail CI** on any unmarked `DROP TABLE` /
 `DROP COLUMN` (which also catches SQLite column-dropping rebuilds), because the
 equivalence test only proves *end-state* correctness, not a safe transition. An
 *intended* destructive change must opt in, in the migration file:
@@ -35,7 +35,7 @@ equivalence test only proves *end-state* correctness, not a safe transition. An
 ## Workflows
 
 **Regular change (add/alter a column, table):**
-1. Edit `src/lib/d1/schema.ts`.
+1. Edit `src/lib/publication/d1/schema.ts`.
 2. `pnpm --filter @tot/storefront gen:migrations` (Drizzle emits the next numbered SQL,
    including SQLite table-rebuilds for unsupported `ALTER`s).
 3. If a column was removed, add `-- allow-destructive: <reason>` to the generated file.
@@ -56,5 +56,5 @@ wrangler d1 migrations apply CATALOG_DB --env <env> [--remote|--local]
 ```
 
 > Catalog + customization tables share the **one** `CATALOG_DB` binding (one edge DB),
-> per `src/lib/customization/d1Store.ts`. The storefront-apps tables are a SEPARATE D1
+> per `src/lib/publication/customization/d1Store.ts`. The storefront-apps tables are a SEPARATE D1
 > (`STOREFRONT_APPS_DB`) applied the same way, from `../migrations-apps/`.

package/apps/storefront/perf/README.md

@@ -9,12 +9,12 @@ harness); the **field half** (Real User Monitoring) lives in
 
 | File | Role |
 |------|------|
-| `../src/lib/analytics/budgets.json` | **Source of truth.** Route budgets (LCP/INP/CLS p75 + JS/CSS/image/total KiB) + the third-party script allowlist. Edit here; everything derives from it. |
-| `../src/lib/analytics/perfBudgets.ts` | Typed lens + **pure** budget-assertion logic (`evaluateManifest`) + the Lighthouse-budgets exporter (`toLighthouseBudgets`). Unit-tested in `perfBudgets.test.ts`. |
-| `../src/lib/analytics/lighthouseReport.ts` | Pure adapter: a Lighthouse result (LHR JSON) → a `RouteMeasurement` the gate evaluates. Unit-tested in `lighthouseReport.test.ts`. |
+| `../src/lib/observability/performance/budgets.json` | **Source of truth.** Route budgets (LCP/INP/CLS p75 + JS/CSS/image/total KiB) + the third-party script allowlist. Edit here; everything derives from it. |
+| `../src/lib/observability/performance/perfBudgets.ts` | Typed lens + **pure** budget-assertion logic (`evaluateManifest`) + the Lighthouse-budgets exporter (`toLighthouseBudgets`). Unit-tested in `perfBudgets.test.ts`. |
+| `../src/lib/observability/performance/lighthouseReport.ts` | Pure adapter: a Lighthouse result (LHR JSON) → a `RouteMeasurement` the gate evaluates. Unit-tested in `lighthouseReport.test.ts`. |
 | `assert-budgets.ts` | Thin CLI: reads measurements / LHRs, runs the gate, exits non-zero on a violation. |
-| `../src/lib/analytics/webVitals.ts` | Field RUM beacon (LCP/INP/CLS from real visitors → the RUM sink). |
-| `../src/lib/analytics/rumAlert.ts` | Pure sink-side regression-alert contract; feeds F16's `core-web-vitals` monitor. Unit-tested in `rumAlert.test.ts`. |
+| `../src/lib/observability/performance/webVitals.ts` | Field RUM beacon (LCP/INP/CLS from real visitors → the RUM sink). |
+| `../src/lib/observability/performance/rumAlert.ts` | Pure sink-side regression-alert contract; feeds F16's `core-web-vitals` monitor. Unit-tested in `rumAlert.test.ts`. |
 
 The budget numbers are enforced identically in three places, all reading the one
 manifest: the lab gate here, a Lighthouse `--budget-path` run (via
@@ -56,7 +56,7 @@ silently drift.
 
 ## Field RUM
 
-`startWebVitals()` (from `../src/lib/analytics/webVitals.ts`) is called from the
+`startWebVitals()` (from `../src/lib/observability/performance/webVitals.ts`) is called from the
 client entry; it measures LCP/INP/CLS per real navigation, buckets each into the
 same budgeted route id the lab gate uses, and beacons finished samples to the RUM
 sink (`RUM_BEACON_PATH`). The sink rolls samples up per route/hour and calls

package/apps/storefront/perf/assert-budgets.ts

@@ -41,8 +41,8 @@ import {
   ROUTE_IDS,
   type RouteId,
   type RouteMeasurement,
-} from "../src/lib/analytics/perfBudgets.js";
-import { lhrToMeasurement, type LighthouseResult } from "../src/lib/analytics/lighthouseReport.js";
+} from "../src/lib/observability/performance/perfBudgets.js";
+import { lhrToMeasurement, type LighthouseResult } from "../src/lib/observability/performance/lighthouseReport.js";
 
 function die(msg: string, code = 2): never {
   process.stderr.write(`assert-budgets: ${msg}\n`);

package/apps/storefront/src/components/catalog/storefront/CollectionCard.astro

@@ -6,7 +6,7 @@
  */
 import type { CatalogCollection } from "@tot/public-runtime";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/ProductCard.astro

@@ -14,7 +14,7 @@ import Img from "@/components/assets/storefront/Img.astro";
 import Badge from "@/components/content/storefront/Badge.astro";
 import PriceDisplay from "@/components/catalog/storefront/commerce/PriceDisplay.astro";
 import RatingStars from "@/components/catalog/storefront/commerce/RatingStars.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/commerce/BrandGrid.astro

@@ -15,7 +15,7 @@
  */
 import Section from "@/components/content/storefront/Section.astro";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface Brand {
   /** Brand name — the link label, image alt, and text-fallback wordmark. */

package/apps/storefront/src/components/catalog/storefront/commerce/TagFilterCloud.astro

@@ -10,7 +10,7 @@
  * raw-chrome `.tag-cloud` / `.tag-chip` block in
  * public/shared/commerce-chrome.css — same token vocabulary, same look.
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface TagItem {
   /** Display label. */

package/apps/storefront/src/components/catalog/storefront/islands/QuickView.tsx

@@ -9,7 +9,7 @@
 import { useEffect, useRef, useState } from "preact/hooks";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface QV {
   handle: string;

package/apps/storefront/src/components/catalog/storefront/islands/RecentlyViewed.tsx

@@ -8,7 +8,7 @@
 import { useEffect, useState } from "preact/hooks";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 export interface RVItem {
   handle: string;

package/apps/storefront/src/components/catalog/storefront/islands/SearchTypeahead.tsx

@@ -14,7 +14,7 @@ import { useCallback, useEffect, useRef, useState } from "preact/hooks";
 import type { TypeaheadDoc } from "@/lib/catalog/search/index";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   action?: string;

package/apps/storefront/src/components/catalog/storefront/plp/ActiveFilters.astro

@@ -2,10 +2,10 @@
 /**
  * Active-filter chips (Shopify-style). Shows what's applied as removable pills
  * above the grid — each chip is a link that drops exactly one filter, so it's
- * URL-addressable and back-button safe like the rest of faceting (src/lib/url.ts).
+ * URL-addressable and back-button safe like the rest of faceting (src/lib/publication/shared/url.ts).
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import { toggleFacet, buildQueryString } from "@/lib/url";
+import { toggleFacet, buildQueryString } from "@/lib/publication/shared/url";
 
 interface Props {
   query: ListProductsQuery;

package/apps/storefront/src/components/catalog/storefront/plp/FacetSidebar.astro

@@ -4,10 +4,10 @@
  * facet is a real link that toggles a querystring param (no JS required for
  * filtering). The optional mobile drawer toggle is the only island.
  *
- * Encoding handled by src/lib/url.ts (opt.<Name>=<value>, tag=, price, avail).
+ * Encoding handled by src/lib/publication/shared/url.ts (opt.<Name>=<value>, tag=, price, avail).
  */
 import type { Facet, ListProductsQuery } from "@tot/public-runtime";
-import { toggleFacet, buildQueryString, isPriceBucketActive, togglePriceBucket } from "@/lib/url";
+import { toggleFacet, buildQueryString, isPriceBucketActive, togglePriceBucket } from "@/lib/publication/shared/url";
 import { PRICE_BUCKETS, bucketByKey } from "@/lib/catalog/shared/priceBuckets";
 
 interface Props {

package/apps/storefront/src/components/catalog/storefront/plp/Pagination.astro

@@ -6,7 +6,7 @@
  * be progressively enhanced to append, but the no-JS path stays correct.
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import { buildQueryString } from "@/lib/url";
+import { buildQueryString } from "@/lib/publication/shared/url";
 
 interface Props {
   query: ListProductsQuery;

package/apps/storefront/src/components/content/storefront/Breadcrumbs.astro

@@ -13,7 +13,7 @@
  * Build `crumbs` with `siteTrail` (lib/content/shared/breadcrumbs.ts) and pass the SAME array to `breadcrumbLd`.
  * `class` adds a hook for the page's own styles (`breadcrumbs` on the blog templates).
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import type { Crumb } from "@/lib/content/shared/breadcrumbs";
 

package/apps/storefront/src/components/content/storefront/EmptyState.astro

@@ -3,7 +3,7 @@
  * <EmptyState> — intentional empty result (search/PLP). Copy is passed in by
  * the parent (kept in the tenant's editorial voice).
  */
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   title: string;

package/apps/storefront/src/components/content/storefront/blog/BlogPaywall.astro

@@ -1,6 +1,6 @@
 ---
 // Paywall card shown under the teaser of a gated post the viewer can't read in
-// full. Mirrors the "Coming soon" host gate (`src/lib/auth/gatePage.ts`):
+// full. Mirrors the "Coming soon" host gate (`src/lib/access/auth/gatePage.ts`):
 // badge + headline + one line of value + a single CTA — restyled with the site's
 // design tokens so it reads as native article chrome, and preceded by a fade that
 // dissolves the truncated body into the card.

package/apps/storefront/src/components/content/storefront/blog/ReactionBar.astro

@@ -9,8 +9,8 @@
  * view counts). Tenant/collection-generic: mounts on any post route.
  */
 import { getReactionCounts, REACTIONS, type Reaction } from "@/lib/content/blog/reactions.js";
-import { readKv } from "@/lib/runtimeEnv";
-import { withBase } from "@/lib/basePath";
+import { readKv } from "@/lib/publication/shared/runtimeEnv";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   /** Collection id the post lives in (e.g. "blog", "the-build"). */

package/apps/storefront/src/components/content/storefront/chrome/NavDropdown.astro

@@ -16,7 +16,7 @@
  * Tenant-agnostic; theme-token skinned.
  */
 import type { ChromeNavItem, ChromeLink } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { isCurrentNavHref } from "@/lib/content/chrome/navCurrent";
 import { trackingAttributes } from "@tot/public-runtime";
 

package/apps/storefront/src/components/content/storefront/chrome/SiteFooter.astro

@@ -8,7 +8,7 @@
  * or checkout logic (commerce boundary).
  */
 import type { ChromeLink, FooterColumn, FooterNewsletter, SocialLink, ChromeLogo, FooterVariant } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { resolveNewsletterAgeAttestation } from "@/lib/content/chrome/newsletterAgeAttestation";
 import { trackingAttributes } from "@tot/public-runtime";

package/apps/storefront/src/components/content/storefront/chrome/SiteHeader.astro

@@ -18,7 +18,7 @@ import MegaMenu from "@/components/content/storefront/chrome/MegaMenu.astro";
 import NavDropdown from "@/components/content/storefront/chrome/NavDropdown.astro";
 import SearchTypeahead from "@/components/catalog/storefront/islands/SearchTypeahead.tsx";
 import MobileNav from "@/components/content/storefront/islands/MobileNav.tsx";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { ctaIdentityAttr } from "@/lib/content/chrome/ctaIdentity";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { trackingAttributes } from "@tot/public-runtime";

package/apps/storefront/src/components/content/storefront/chrome/UtilityNav.astro

@@ -6,7 +6,7 @@
  * convenience — the mobile menu carries these links).
  */
 import type { ChromeLink, SocialLink } from "@/lib/content/chrome/model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { CHROME_PLACEMENT } from "@/lib/content/chrome/trackingPlacements";
 import { trackingAttributes } from "@tot/public-runtime";
 

package/apps/storefront/src/components/content/storefront/commerce/ArticleCard.astro

@@ -17,7 +17,7 @@
  * excerpts — omit a field and its row simply doesn't render.
  */
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export interface ArticleImage {
   src: string;

package/apps/storefront/src/components/content/storefront/home/Hero.astro

@@ -22,7 +22,7 @@
 import type { HeroBlock } from "@/lib/content/storyblok/content-model";
 import type { CatalogProduct } from "@tot/public-runtime";
 import Img from "@/components/assets/storefront/Img.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import { heroSlideshowView } from "@/lib/content/shared/heroSlideshow";
 

package/apps/storefront/src/components/content/storefront/marketing/CardGrid.astro

@@ -6,7 +6,7 @@
  */
 import Section from "@/components/content/storefront/Section.astro";
 import type { CardGridBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   block: CardGridBlock;

package/apps/storefront/src/components/content/storefront/marketing/Integrations.astro

@@ -7,7 +7,7 @@
 import Section from "@/components/content/storefront/Section.astro";
 import CodeSample from "@/components/content/storefront/marketing/CodeSample.astro";
 import type { IntegrationsBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   block: IntegrationsBlock;

package/apps/storefront/src/components/content/storefront/marketing/MarketingCtas.astro

@@ -6,7 +6,7 @@
  * base-path prefix so path-routed tenants stay in-tenant.
  */
 import type { MarketingCta } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   ctas?: MarketingCta[];

package/apps/storefront/src/components/customers/storefront/islands/SavedList.tsx

@@ -13,7 +13,7 @@ import {
 } from "@/lib/customers/shared/wishlist";
 import { formatPrice } from "@/lib/content/shared/format";
 import { placeholderDataUri, isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withClientBase } from "@/lib/basePath";
+import { withClientBase } from "@/lib/publication/shared/basePath";
 
 interface Props {
   locale: string;

package/apps/storefront/src/config/adminTargetTenant.ts

@@ -4,7 +4,7 @@
  *
  * The admin console can operate on a target tenant that differs from the routed
  * (adminApp) tenant on `Astro.locals.tenant` — a real ToT-staff session may point
- * `targetTenant` at another tenant it has access to (see lib/adminTenantEnvelope).
+ * `targetTenant` at another tenant it has access to (see lib/access/shared/adminTenantEnvelope).
  * Panels that need the target's real config (e.g. the checkout appearance
  * panel, which derives from `theme_tokens` + `commerce.checkout`) resolve it HERE,
  * in the config layer, rather than reaching into the static tenant map — so they

package/apps/storefront/src/config/devTenants.ts

@@ -1,7 +1,7 @@
 /**
  * Dev-only tenant-registry seam for the localhost sign-in bypass.
  *
- * `lib/auth/devAuth` can't import the concrete static tenant map directly
+ * `lib/access/auth/devAuth` can't import the concrete static tenant map directly
  * (tenancy-resolver-fence — the registry stays behind the `config` boundary so a
  * single-tenant extraction stays a drop-in). This exposes exactly the one thing
  * that bypass needs: the resources a local dev session is granted membership on.

package/apps/storefront/src/config/resolver.ts

@@ -21,7 +21,7 @@
  * default is configurable, not hardcoded.
  */
 import { tenantIdFromPath, type TenantResolver } from "@tot/public-runtime";
-import { readEnv, readKv } from "@/lib/env";
+import { readEnv, readKv } from "@/lib/publication/shared/env";
 import {
   tenantResolver as staticResolver,
   staticTenants,
@@ -31,7 +31,7 @@ import { KvTenantResolver, putTenant } from "@/config/kvTenantResolver";
 import { getTenantTheme } from "@/themes/tenants";
 import { devTenantsToSeed } from "@/config/devTenantSeed";
 import { tenantAnalyticsRawById } from "@/config/tenantAnalyticsFiles";
-import { MemoryKv } from "@/lib/memoryKv";
+import { MemoryKv } from "@/lib/developer-experience/shared/memoryKv";
 
 // LOCAL dev loop discovery: enumerate the colocated tenant dirs on disk,
 // INCLUDING a developer's checkout grafted in by `tot dev` (scripts/tot-dev.mjs).

package/apps/storefront/src/layouts/Layout.astro

@@ -21,7 +21,7 @@ import ShippingRestrictionNotice from "@/components/compliance/storefront/compli
 import ExciseTaxNotice from "@/components/compliance/storefront/compliance/ExciseTaxNotice.astro";
 import { EXCISE_TAX_DISCLOSURE_TEXT } from "@/lib/compliance/rawComplianceNotices";
 import IsolatedAgeGate from "@/components/compliance/storefront/islands/IsolatedAgeGate.tsx";
-import AuthBadge from "@/components/auth/AuthBadge.astro";
+import AuthBadge from "@/components/access/storefront/auth/AuthBadge.astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
 import { organizationLd, websiteLd } from "@/lib/content/shared/jsonld";
@@ -37,7 +37,7 @@ import { splitFooterLegal } from "@/lib/content/chrome/footerLegal";
 import { bindManagedCartAnchors, managedCartHref } from "@/lib/content/chrome/managedCart";
 import type { HeaderVariant, FooterVariant } from "@/lib/content/chrome/model";
 import { renderIntegrationPhases, INTERACTION_TRACKING_BOOT_JS } from "@tot/public-runtime";
-import { readViewerSession } from "@/lib/auth/route";
+import { readViewerSession } from "@/lib/access/auth/route";
 import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";
 import { getRegistryService } from "@/lib/integrations/apps/registryAccess.js";
 import { renderWidgetSlot } from "@/lib/integrations/apps/widgets/renderSlot.js";
@@ -542,7 +542,7 @@ const footerWidgets = await renderWidgetSlot(
         root-absolute links inside that prefix so navigation stays on the
         tenant. Host-routed requests have no base path and skip this entirely. */}
     <script>
-      import { bindBasePathAnchors } from "@/lib/basePath";
+      import { bindBasePathAnchors } from "@/lib/publication/shared/basePath";
       bindBasePathAnchors();
     </script>
 
@@ -601,7 +601,7 @@ const footerWidgets = await renderWidgetSlot(
         where PerformanceObserver is absent. This is the per-route-template
         signal the `core-web-vitals` monitor consumes. */}
     <script>
-      import { startConsentGatedWebVitals } from "@/lib/analytics/webVitals";
+      import { startConsentGatedWebVitals } from "@/lib/observability/performance/webVitals";
       startConsentGatedWebVitals();
     </script>
 
@@ -631,7 +631,7 @@ const footerWidgets = await renderWidgetSlot(
         listener, and the install-once marker makes a double install a no-op —
         which is what makes the raw chrome wrapper spliced into this document
         (above) safe. Emitted as `is:inline` + the page nonce so it needs no
-        entry in lib/cspStaticHashes.ts. */}
+        entry in lib/access/shared/cspStaticHashes.ts. */}
     <script is:inline nonce={cspNonce} set:html={INTERACTION_TRACKING_BOOT_JS}></script>
 
     {/* Swaps every <AsyncStylesheet>-rendered preload link to rel="stylesheet"

package/apps/storefront/src/lib/{admin → access/admin}/README.md

@@ -10,8 +10,8 @@ these implement.
 ## Tenant envelope
 
 The canonical tenant envelope is `AdminTenantEnvelope`, defined in
-`lib/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
-`lib/admin/envelope.ts` so everything under `lib/admin/**` can import it from
+`lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) and re-exported from
+`lib/access/admin/envelope.ts` so everything under `lib/admin/**` can import it from
 a stable relative path:
 
 ```ts
@@ -29,7 +29,7 @@ refused not hidden-only). `targetTenant` is the sole key mock services use to
 select/derive data. **Authorization must always be evaluated against
 `targetTenant`, never `adminAppTenant`** (decision `tenant-envelope-contract`).
 
-(`lib/admin/envelope.ts` used to declare its own 2-field copy of this
+(`lib/access/admin/envelope.ts` used to declare its own 2-field copy of this
 interface — data-view-contracts and admin-tenant-mode were built in parallel
 per that decision, with no live coordination. Reconciled here per decision
 `envelope-type-duplication-follow-up`: one canonical type, re-exported.)

package/apps/storefront/src/lib/{admin → access/admin}/adminShell.ts

@@ -10,7 +10,7 @@
  * only (window.__toTAdminAsk + a "tot:admin-ask" CustomEvent), never sent over
  * the network.
  */
-import { buildAskEnvelope, type AskEnvelope } from "./ai/askEnvelope";
+import { buildAskEnvelope, type AskEnvelope } from "../../automation/ai/askEnvelope";
 
 /** Static shell data shared by server-rendered navigation and browser startup. */
 export const ADMIN_SHELL_CONFIG = {

package/apps/storefront/src/lib/{admin → access/admin}/envelope.ts

@@ -1,9 +1,9 @@
 /**
  * Canonical tenant envelope for the admin console lives in
- * `lib/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
+ * `lib/access/shared/adminTenantEnvelope.ts` (admin-tenant-mode) — it carries the real
  * staff-override authorization (`resolveAdminTenantMode`) that admin.astro
  * actually runs. This module re-exports that type so every mock service under
  * `lib/admin/**` can keep importing it from a stable relative path
  * (`../../envelope`) without declaring a second, competing interface.
  */
-export type { AdminTenantEnvelope } from "@/lib/adminTenantEnvelope";
+export type { AdminTenantEnvelope } from "@/lib/access/shared/adminTenantEnvelope";

package/apps/storefront/src/lib/{admin → access/admin}/viewmodels/settings.ts

@@ -7,8 +7,8 @@
  */
 
 import type { CheckoutStyle } from "@tot/public-runtime";
-import type { ApprovalMode } from "../ai/approvalMode";
-import type { AuditEvent } from "../ai/audit";
+import type { ApprovalMode } from "../../../automation/ai/approvalMode";
+import type { AuditEvent } from "../../../automation/ai/audit";
 
 export type { ApprovalMode };
 export type { CheckoutStyle };

package/apps/storefront/src/lib/{auth → access/auth}/adminApiGuard.ts

@@ -17,8 +17,8 @@
  * Astro/I-O wrapper the routes call.
  */
 import type { APIContext } from "astro";
-import { readViewerSession } from "@/lib/auth/route";
-import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/auth/adminEntry";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { resolveAdminEntry, type AdminEntryDecision } from "@/lib/access/auth/adminEntry";
 import type { SessionRecord } from "./session.js";
 
 export type AdminApiAccess =

package/apps/storefront/src/lib/{auth → access/auth}/adminEntry.ts

@@ -4,7 +4,7 @@
  * keeps a non-member / unauthenticated visitor on the legitimate sign-in gate.
  *
  * NARROW to auth/session ENTRY: it CONSUMES the admin tab UX
- * (`pages/admin.astro` + `components/admin/AdminPublishTab.astro`) and the
+ * (`pages/admin.astro` + `components/publication/admin/AdminPublishTab.astro`) and the
  * ship-capability model (`change/shipCapabilities` + `change/route` decideIsOwner)
  * rather than reimplementing either. Everything it resolves is bound to the
  * RESOLVED tenant, never taken from client input, and never requires a
@@ -31,14 +31,14 @@
  */
 import type { SessionRecord } from "./session.js";
 import { sessionHostCapability } from "./loginGate.js";
-import { staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import {
   decideIsOwner,
   isOwnerCapability,
   resolveShipCapabilities,
   type Capability,
   type ShipCapabilities,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** Which entry case a viewer is in, for chrome + the DoD test matrix. */
 export type AdminEntryPrincipal =

package/apps/storefront/src/lib/{auth → access/auth}/adminLanding.ts

@@ -25,7 +25,7 @@
 import type { SessionRecord } from "./session.js";
 import { sessionAdmitsHost } from "./loginGate.js";
 import { safeNext } from "./route.js";
-import { selectTenant } from "@/lib/dashboard/tenantSelection";
+import { selectTenant } from "@/lib/access/dashboard/tenantSelection";
 
 /** The tenant-selection surface, in both host-routed and tenant-first path forms. */
 export function isAdminSelectPath(pathname: string): boolean {

package/apps/storefront/src/lib/{auth → access/auth}/brokerAssertion.ts

@@ -23,7 +23,7 @@
  * direction of the same decoupled-authZ pattern).
  */
 import { SignJWT, importPKCS8, type CryptoKey } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The audience tot20's broker verifier pins. */
 export const BROKER_AUDIENCE = "tot20-broker";

package/apps/storefront/src/lib/{auth → access/auth}/devAuth.ts

@@ -16,7 +16,7 @@
  * Keeping the bypass in one file means "does prod contain the bypass?" is a single
  * grep (`devAuth`), and the production path in send/verify is never weakened.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { devTenantResources } from "@/config/devTenants";
 import { createSession } from "./session.js";
 

package/apps/storefront/src/lib/{auth → access/auth}/identityToken.ts

@@ -26,12 +26,12 @@ import {
   type JWTVerifyGetKey,
   type JSONWebKeySet,
 } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   TENANT_ROLES,
   isTenantRole,
   type TenantRole,
-} from "@/lib/shared/capability";
+} from "@/lib/access/shared/capability";
 
 /** tot's issuer — consumers pin/allowlist this (`auth.jwt.issuer`). */
 export const TOT_ISSUER = "tokenoftrust-internal-ops";