@tokenoftrust/storefront-runner 2.4.88 → 2.4.90

package/apps/storefront/src/lib/{auth → access/auth}/loginGate.ts

@@ -13,8 +13,8 @@
  * drifting apart. The auth surface itself (/auth/*, /api/auth/*) is always exempt
  * so a visitor can actually sign in.
  */
-import { hostInGateList } from "@/lib/demoGate";
-import { normalizeMemberships, staffAdmits } from "@/lib/dashboard/tenantSelection";
+import { hostInGateList } from "@/lib/access/shared/demoGate";
+import { normalizeMemberships, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
 import type { SessionRecord } from "./session.js";
 
 export type GateMode = "password" | "login";

package/apps/storefront/src/lib/{auth → access/auth}/mcpClientAssertion.ts

@@ -34,7 +34,7 @@
  * `devbook/app-binding.md` Recipe A ("multiple execution environments").
  */
 import { importPKCS8, exportJWK, SignJWT, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The only algorithm this assertion is signed with (the MCP verifier rejects anything else). */
 export const MCP_CLIENT_ASSERTION_ALG = "RS256";

package/apps/storefront/src/lib/{auth → access/auth}/route.ts

@@ -14,7 +14,7 @@
  * tenant — never from request input.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import { createTotAccessClient, type TotAccessClient } from "./totAccessClient.js";
 import {
   KvSessionStore,

package/apps/storefront/src/lib/{auth → access/auth}/totAccessClient.ts

@@ -26,9 +26,9 @@
  * to `credentialFields()` below — the ONLY spot to touch. Everything else (paths,
  * bodies, response shapes) is contract-fixed.
  */
-import { readEnv } from "@/lib/env";
-import { diagEmail } from "@/lib/diag/redact";
-import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/http/fetchTransport";
+import { readEnv } from "@/lib/publication/shared/env";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { FetchHttpTransport, type HttpResponseLike, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 import { classifyStepUp, type StepUpChallenge, type StepUpObligation } from "./stepUpChallenge.js";
 
 /** `send` is deliberately opaque — it never reveals whether the email was eligible. */
@@ -49,7 +49,7 @@ export type AccessCodeVerifyResult =
        * Present-usually, NOT guaranteed: tot returns the flat result without it
        * if signing hiccups (contract §6 graceful degradation). Phase 3 verifies
        * this OFFLINE and derives the session from its claims rather than trusting
-       * the flat `roles`/`capability`. See `@/lib/auth/identityToken`.
+       * the flat `roles`/`capability`. See `@/lib/access/auth/identityToken`.
        */
       id_token?: string;
     }
@@ -128,7 +128,7 @@ export interface TotAccessClient {
  * (signer degradation, contract §6); the consumer fails closed when it's absent.
  *
  * The `step-up-required`/`success-pending` variants carry tot20's RFC 9470
- * obligations (see `@/lib/auth/stepUpChallenge`) instead of a plain failure
+ * obligations (see `@/lib/access/auth/stepUpChallenge`) instead of a plain failure
  * reason, so the caller can drive the SMS completion loop rather than just
  * showing a generic "invalid code" error.
  */

package/apps/storefront/src/lib/{dashboard → access/dashboard}/delegateGate.ts

@@ -22,8 +22,8 @@
  * the page, matching `@/lib/dashboard/tenantSelection` and `@/lib/auth/loginGate`.
  */
 import { storefrontModeAllowsGoLive } from "@tot/public-runtime";
-import { membershipFor, staffAdmits } from "@/lib/dashboard/tenantSelection";
-import type { StaffAdmission, TenantMembership } from "@/lib/dashboard/tenantSelection";
+import { membershipFor, staffAdmits } from "@/lib/access/dashboard/tenantSelection";
+import type { StaffAdmission, TenantMembership } from "@/lib/access/dashboard/tenantSelection";
 
 /** What every viewer of an unpaid store is told in place of the delegate section. */
 export const UNPAID_DELEGATION_NOTE =
@@ -37,7 +37,7 @@ export type DelegateSection = { mode: "unpaid"; role: null; explanation: string
 /**
  * Resolve the whole delegate section. Before a store is paid, an invited developer can
  * already add changes AND publish them (both `merge-to-preview` and `publish-live` admit the
- * "unpaid-store-developer" basis, lib/pipeline/admission.ts), so delegation has nothing to
+ * "unpaid-store-developer" basis, lib/publication/pipeline/admission.ts), so delegation has nothing to
  * grant: every viewer, the owner included, gets {@link UNPAID_DELEGATION_NOTE}. A paid store
  * resolves {@link resolveDelegateGate} unchanged.
  */

package/apps/storefront/src/lib/{dashboard → access/dashboard}/staffAdmission.ts

@@ -12,7 +12,7 @@
  * scoped to the returned staffRoles capability. It is stamped on the session as a
  * DISTINCT marker from `tenants[]` — never a synthesized membership.
  */
-import type { SessionRecord, StaffSelection } from "@/lib/auth/session";
+import type { SessionRecord, StaffSelection } from "@/lib/access/auth/session";
 
 /**
  * Staff selection lifetime. Deliberately short: staff cross-vendor access is a

package/apps/storefront/src/lib/{dashboard → access/dashboard}/staffVendorAccess.ts

@@ -30,7 +30,7 @@
  * factory) so the routes develop/test against `MockStaffVendorAccessClient` and
  * swap in the Http client with no call-site change.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { decodeJwt } from "jose";
 
 /**

package/apps/storefront/src/lib/{dashboard → access/dashboard}/tenantSelection.ts

@@ -17,7 +17,7 @@
  * tot20 populates all of the email's memberships. Flagged to the workstream lead.
  */
 
-import type { StaffSelection } from "@/lib/auth/session";
+import type { StaffSelection } from "@/lib/access/auth/session";
 
 /** One tenant membership carried in the verified session. */
 export interface TenantMembership {

package/apps/storefront/src/lib/{admin/services/mock → access/fixtures}/settings.ts

@@ -1,8 +1,8 @@
 import { DEFAULT_CHECKOUT_STYLE } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../envelope";
-import { memoizeByEnvelope } from "../../memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../seed";
-import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../../viewmodels/settings";
+import type { AdminTenantEnvelope } from "../admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import type { SettingsAuditEvent, SettingsSection, SettingsViewModel } from "../admin/viewmodels/settings";
 
 const SECTION_DEFS: Omit<SettingsSection, "riskyChangeReview">[] = [
   { key: "store", label: "Store", summary: "Store profile, branding, and white-label copy." },

package/apps/storefront/src/lib/{shared → access/shared}/accessExplain.ts

@@ -17,7 +17,7 @@
  * Nothing here is ever reported as verified unless tot-mcp said so: an unconfigured seam,
  * a non-200 or a timeout is `unavailable`, which the UI shows as unverified.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 
 const EXPLAIN_TIMEOUT_MS = 8000;
 

package/apps/storefront/src/lib/{adminTenantEnvelope.ts → access/shared/adminTenantEnvelope.ts}

@@ -21,9 +21,9 @@
  *     request asks for: the staff check gates evaluation of the request
  *     entirely, not just the picker's visibility.
  */
-import type { SessionRecord } from "@/lib/auth/session";
-import { isStaffSession } from "@/lib/dashboard/staffAdmission";
-import { membershipFor, normalizeMemberships, type TenantMembership } from "@/lib/dashboard/tenantSelection";
+import type { SessionRecord } from "@/lib/access/auth/session";
+import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
+import { membershipFor, normalizeMemberships, type TenantMembership } from "@/lib/access/dashboard/tenantSelection";
 
 export interface AdminTenantEnvelope {
   /** The tenant that actually served this request. */

package/apps/storefront/src/lib/{shared → access/shared}/developerInvites.ts

@@ -52,11 +52,11 @@
  * seam is duplicated locally rather than imported from `@/lib/auth` so the grants
  * control-plane cluster stays self-contained (see `.dependency-cruiser.cjs`).
  */
-import { readEnv } from "@/lib/env";
-import { callMcpService } from "@/lib/http/mcpServiceCall";
-import { diagEmail } from "@/lib/diag/redact";
-import { checkStorePreviewReady, type PreflightDecision } from "@/lib/shared/invitePreflight";
-import { explainDeveloperAccess, type AccessVerification } from "@/lib/shared/accessExplain";
+import { readEnv } from "@/lib/publication/shared/env";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { checkStorePreviewReady, type PreflightDecision } from "@/lib/access/shared/invitePreflight";
+import { explainDeveloperAccess, type AccessVerification } from "@/lib/access/shared/accessExplain";
 
 /**
  * The header carrying the storefront-signed staff BROKER ASSERTION to tot20

package/apps/storefront/src/lib/{shared → access/shared}/invitePreflight.ts

@@ -22,7 +22,7 @@
  * mirroring recordDeveloperAppBinding's "skipped when not-configured" stance — we
  * never break invites just because the MCP is briefly unreachable.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 
 /** How long we'll wait on the preview-status read before failing open. */
 const PREFLIGHT_TIMEOUT_MS = 4000;

package/apps/storefront/src/lib/{shared → access/shared}/principalGrants.ts

@@ -75,9 +75,9 @@
  * factory) so the route develops/tests against `MockPrincipalGrantClient` and
  * swaps in the Http client with no call-site change.
  */
-import { readEnv } from "@/lib/env";
-import { diagEmail } from "@/lib/diag/redact";
-import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/auth/brokerAssertion";
+import { readEnv } from "@/lib/publication/shared/env";
+import { diagEmail } from "@/lib/observability/diag/redact";
+import { BROKER_ASSERTION_HEADER, BROKER_PRIVATE_KEY_ENV } from "@/lib/access/auth/brokerAssertion";
 
 /** A human grantee — the only principal type this HTTP surface accepts. */
 export interface UserPrincipal {

package/apps/storefront/src/lib/{tenantRouting.ts → access/shared/tenantRouting.ts}

@@ -55,7 +55,7 @@ function normalizePath(path: string): string {
 }
 
 /**
- * Routing for an authenticated CDN forward (lib/cdnForward.ts). The forward names
+ * Routing for an authenticated CDN forward (lib/publication/shared/cdnForward.ts). The forward names
  * its tenant outright and renders at the apex, as the tenant's own host would.
  * Only a tenant served from CloudFront static storage (`serving.provider:
  * "s3-overwrite"`) has a distribution that forwards here; any other resolves to

package/apps/storefront/src/lib/{shared → access/shared}/viewerGrant.ts

@@ -30,7 +30,7 @@
  * app-binding WRITE (`recordDeveloperAppBinding`) targets, so this READ and that
  * WRITE always agree on which subject-capability store they speak to.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
 import type { Capability } from "./capability.js";
 
 /** Minimal GET transport (mirrors `dev/previewStatus.ts` — decoupled by design). */

package/apps/storefront/src/lib/activity/fixtures/evidence.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 import type { EvidenceReference } from "../evidence/evidenceReference";
 import { getCustomersViewModel } from "../../customers/fixtures/customers";
 import { getOrdersViewModel } from "../../orders/fixtures/orders";

package/apps/storefront/src/lib/activity/killSwitch.ts

@@ -24,7 +24,7 @@
  * dev/tests immediately, and a Worker secret takes effect from the first primed
  * request of each isolate.
  */
-import { readEnv } from "../runtimeEnv.js";
+import { readEnv } from "../publication/shared/runtimeEnv.js";
 
 /** The one canonical flag name — shared verbatim by the server and the CLI mirror. */
 export const ACTIVITY_KILL_SWITCH_FLAG = "ACTIVITY_TELEMETRY_DISABLED";

package/apps/storefront/src/lib/activity/uiActor.ts

@@ -48,11 +48,11 @@ import type {
   ActivityPayload,
 } from "@tot/public-runtime";
 import type { ActionKey } from "@tot/public-runtime";
-import { readViewerSession } from "@/lib/auth/route";
-import { sessionHostCapability } from "@/lib/auth/loginGate";
-import { isStaffSession } from "@/lib/dashboard/staffAdmission";
-import { readEnv } from "@/lib/env";
-import { isOwnerCapability } from "@/lib/shared/capability";
+import { readViewerSession } from "@/lib/access/auth/route";
+import { sessionHostCapability } from "@/lib/access/auth/loginGate";
+import { isStaffSession } from "@/lib/access/dashboard/staffAdmission";
+import { readEnv } from "@/lib/publication/shared/env";
+import { isOwnerCapability } from "@/lib/access/shared/capability";
 import { hashActorId, recordActivity } from "./recordActivity";
 
 /** The minimal viewer chrome the middleware stamps on `locals.viewer`. */

package/apps/storefront/src/lib/activity/workerCommit.ts

@@ -11,7 +11,7 @@
  * baked in at BUILD time: astro.config.mjs's Vite `define` replaces the
  * `__GIT_SHA__` token with a string literal of the build's commit (CI-provided
  * `GIT_SHA`/`WORKERS_CI_COMMIT_SHA`/`GITHUB_SHA`, else local `git rev-parse`,
- * else "unknown"). This is the SAME source /health already reports (lib/health.ts)
+ * else "unknown"). This is the SAME source /health already reports (lib/observability/shared/health.ts)
  * — we read it through the identical `typeof` guard so both agree by construction,
  * and so the value is safe under vitest (where the define isn't applied → "unknown").
  *

package/apps/storefront/src/lib/admin/services/mock/index.ts

@@ -2,11 +2,11 @@ export { getOrdersViewModel } from "../../../orders/fixtures/orders";
 export { getProductsViewModel } from "../../../catalog/fixtures/products";
 export { getCustomersViewModel } from "../../../customers/fixtures/customers";
 export { getReportingViewModel } from "../../../reporting/fixtures/reporting";
-export { getSettingsViewModel } from "./settings";
+export { getSettingsViewModel } from "../../../access/fixtures/settings";
 export { getCheckoutSettingsViewModel } from "../../../checkout/fixtures/checkoutSettings";
 export type { CheckoutSettingsViewModel } from "../../../checkout/fixtures/checkoutSettings";
 export { getSubscriptionsViewModel } from "../../../subscriptions/fixtures/subscriptions";
-export { getAiWorkflowsViewModel } from "./aiWorkflows";
+export { getAiWorkflowsViewModel } from "../../../automation/fixtures/aiWorkflows";
 export { getEvidenceViewModel } from "../../../activity/fixtures/evidence";
-export { SEEDED_TENANTS, tenantProfile } from "./tenants";
-export type { SeededTenantProfile, MockVertical } from "./tenants";
+export { SEEDED_TENANTS, tenantProfile } from "../../../access/fixtures/tenants";
+export type { SeededTenantProfile, MockVertical } from "../../../access/fixtures/tenants";

package/apps/storefront/src/lib/assets/durableR2Bindings.ts

@@ -4,7 +4,7 @@
  * with) and TENANT_CACHE for the durable-image status record. Unbound ⇒ every pre-flip stage
  * refuses, so a pointer-served version can never go live missing its captured images.
  */
-import { readKv, readR2 } from "@/lib/env";
+import { readKv, readR2 } from "@/lib/publication/shared/env";
 import { makeWorkerR2PinnedOriginalStager, R2StagingError, type R2BucketLike, type StatusKvLike } from "./durableR2.js";
 
 export async function workerR2PinnedOriginalStagerFromEnv(): Promise<

package/apps/storefront/src/lib/{admin → automation/admin}/viewmodels/aiWorkflows.ts

@@ -5,9 +5,9 @@
  * come from `lib/admin/ai`, which formalizes the approval/evidence models.
  */
 
-import type { ApprovalMode } from "../ai/approvalMode";
-import type { AiRecommendation } from "../ai/recommendation";
-import type { AuditEvent } from "../ai/audit";
+import type { ApprovalMode } from "../../ai/approvalMode";
+import type { AiRecommendation } from "../../ai/recommendation";
+import type { AuditEvent } from "../../ai/audit";
 
 export type { ApprovalMode };
 

package/apps/storefront/src/lib/{admin → automation}/ai/askEnvelope.ts

@@ -6,7 +6,7 @@
  * this is emitted for dev inspection only (see adminShell.ts's `data-admin-ask`
  * click handler), never sent over the network.
  */
-import type { AdminTenantEnvelope } from "../envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 
 export type AdminRole = "internal_staff" | "merchant_operator";
 

package/apps/storefront/src/lib/{admin → automation}/ai/operationalRuns.ts

@@ -7,10 +7,10 @@
  * The other 5 workflows remain scaffold-only until their own units connect
  * real source data.
  */
-import type { AdminTenantEnvelope } from "../envelope";
-import { getOrdersViewModel, getProductsViewModel, getEvidenceViewModel } from "../services/mock";
-import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../seed";
-import { OPERATIONAL_WORKFLOW_KEYS, type OperationalWorkflowKey } from "../viewmodels/aiWorkflows";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { getOrdersViewModel, getProductsViewModel, getEvidenceViewModel } from "../../admin/services/mock/index";
+import { MOCK_ANCHOR_ISO, offsetIso, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import { OPERATIONAL_WORKFLOW_KEYS, type OperationalWorkflowKey } from "../admin/viewmodels/aiWorkflows";
 import type { ApprovalMode } from "./approvalMode";
 import type { AuditEvent } from "./audit";
 import type { AiRecommendation } from "./recommendation";

package/apps/storefront/src/lib/{admin/services/mock → automation/fixtures}/aiWorkflows.ts

@@ -1,7 +1,7 @@
-import type { AdminTenantEnvelope } from "../../envelope";
-import { memoizeByEnvelope } from "../../memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomInt, seededRandom } from "../../seed";
-import { AI_WORKFLOW_NAMES, OPERATIONAL_WORKFLOW_KEYS, type AiWorkflowsViewModel, type ApprovalMode, type WorkflowRecord, type WorkflowStatus } from "../../viewmodels/aiWorkflows";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomInt, seededRandom } from "../../developer-experience/admin/seed";
+import { AI_WORKFLOW_NAMES, OPERATIONAL_WORKFLOW_KEYS, type AiWorkflowsViewModel, type ApprovalMode, type WorkflowRecord, type WorkflowStatus } from "../admin/viewmodels/aiWorkflows";
 
 const OWNERS = ["Ops", "Trust & Safety", "Growth", "Fulfillment"];
 const APPROVAL_MODES: ApprovalMode[] = ["draft_only", "approval_required", "guarded_automation"];

package/apps/storefront/src/lib/catalog/fixtures/products.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   ExciseCheckKey,
   ExciseReadinessCheck,
@@ -8,8 +8,8 @@ import type {
   ProductsViewModel,
   ProductVariant,
 } from "../admin/viewmodels/products";
-import { tenantProfile } from "../../admin/services/mock/tenants";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import { tenantProfile } from "../../access/fixtures/tenants";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 
 // Must stay index-aligned with orders.ts's ITEM_POOLS: a product's id is
 // `prod-<tenant>-<position here>`, and orders.ts derives each order's productId

package/apps/storefront/src/lib/checkout/admin/checkoutStyleTarget.ts

@@ -20,8 +20,8 @@
  * Pure (no I/O, no Astro) — the caller supplies the already-read viewer session —
  * so it is unit-testable in isolation.
  */
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import type { SessionRecord } from "@/lib/auth/session";
+import { resolveAdminTenantMode } from "@/lib/access/shared/adminTenantEnvelope";
+import type { SessionRecord } from "@/lib/access/auth/session";
 
 export type WriteTargetResult =
   | { ok: true; targetTenant: string }

package/apps/storefront/src/lib/checkout/commerce/checkoutHandoffCorrelation.ts

@@ -33,7 +33,7 @@ import {
   type HandoffCorrelation,
   type IntegrationEnvironment,
 } from "@tot/public-runtime";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The server-only correlation-signing key binding — distinct from the cart secret
  * (key separation), and the SAME binding the order join verifies against. */

package/apps/storefront/src/lib/checkout/fixtures/checkoutSettings.ts

@@ -18,7 +18,7 @@ import { resolveManagedCheckout } from "@tot/public-runtime";
 import type { TenantConfig } from "@tot/public-runtime";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme } from "@/themes/schema";
-import type { AdminTenantEnvelope } from "../../admin/envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 import {
   buildCheckoutSettingsFields,
   deriveCheckoutSettings,

package/apps/storefront/src/lib/checkout/shared/checkoutCommerce.ts

@@ -29,7 +29,7 @@ import {
   resolveManagedCheckout,
   SHARED_DEMO_CHECKOUT,
 } from "@tot/public-runtime";
-import { readEnv } from "@/lib/runtimeEnv";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 
 /**
  * Resolve the effective checkout facts for a tenant, or null when the tenant has

package/apps/storefront/src/lib/compliance/browser/checkoutVerificationFlow.ts

@@ -175,7 +175,7 @@ export interface PollDeps {
 
 /**
  * True when the login gate, not the preflight route, answered: the store is not
- * public and this viewer holds no session (see `lib/auth/gatePage.ts`). Still fail
+ * public and this viewer holds no session (see `lib/access/auth/gatePage.ts`). Still fail
  * closed — the caller only names the reason instead of reporting an outage.
  */
 export function isStoreNotPublicRefusal(res: Pick<Response, "status" | "headers">): boolean {

package/apps/storefront/src/lib/compliance/enforcement.ts

@@ -18,7 +18,7 @@ import type {
   EnforcementEvidenceSignals,
 } from "@tot/public-runtime";
 import { enforcementSignals } from "@tot/public-runtime";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import { COMPLIANCE_RULE_PROFILES } from "@/config/compliance/rulesets";
 
 /** True when the tenant sells age/nicotine-restricted goods (drives fail-closed). */

package/apps/storefront/src/lib/compliance/tamper-sentinel-boot.ts

@@ -24,7 +24,7 @@ import type {
   IntegrationSiteSurface,
 } from "@tot/public-runtime";
 import { INTEGRATION_PLAN_GLOBAL } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** Where the browser posts a tamper beacon; the server receiver records + suspends. */
 export const TAMPER_BEACON_ENDPOINT = "/api/compliance/tamper";

package/apps/storefront/src/lib/compliance/verification/totVerificationClient.ts

@@ -34,13 +34,13 @@
  * Structure mirrors `@/lib/auth/totAccessClient`: interface + Http impl + Mock +
  * env factory, with the wire-credential shape isolated to `credentialFields()`.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   FetchHttpTransport,
   type HttpGetTransport,
   type HttpResponseLike,
   type HttpTransport,
-} from "@/lib/http/fetchTransport";
+} from "@/lib/developer-experience/http/fetchTransport";
 
 // --- Gate normalization -----------------------------------------------------
 

package/apps/storefront/src/lib/content/blog/access.ts

@@ -1,4 +1,4 @@
-import type { SessionRecord } from "@/lib/auth/session.js";
+import type { SessionRecord } from "@/lib/access/auth/session.js";
 import type { BlogAccess } from "./types.js";
 
 /**

package/apps/storefront/src/lib/content/blog/collection.ts

@@ -6,7 +6,7 @@ import {
 } from "@tot/public-runtime";
 import type { AuthorBio, BlogPost, BlogPostSummary, BlogSettings, PostStatus } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 type ArtifactSource = Pick<ContentProvider, "readArtifact" | "listArtifactPaths">;
 function canReadArtifacts(value: ArtifactSource | undefined): value is ArtifactSource {

package/apps/storefront/src/lib/content/blog/postView.ts

@@ -18,12 +18,12 @@ import {
 import { homeCrumbLabel, siteTrail, type Crumb } from "@/lib/content/shared/breadcrumbs.js";
 import { viewerHasBlogAccess } from "./access.js";
 import { articleBodyHtml } from "./teaser.js";
-import { readViewerSession, safeNext } from "@/lib/auth/route.js";
+import { readViewerSession, safeNext } from "@/lib/access/auth/route.js";
 import { buildAlternates, type Alternate } from "@/lib/content/seo/alternates.js";
 import { breadcrumbLd, blogPostingLd } from "@/lib/content/shared/jsonld.js";
 import { collectionPathsV1, blogPathOptsV1 } from "./collectionPaths.js";
 import type { BlogPost } from "./types.js";
-import type { SessionRecord } from "@/lib/auth/session.js";
+import type { SessionRecord } from "@/lib/access/auth/session.js";
 
 export interface BlogPostViewPropsV1 {
   post: BlogPost;

package/apps/storefront/src/lib/content/blog/provider.ts

@@ -13,7 +13,7 @@ import {
 import { getIndexSettings, listPosts } from "./collection.js";
 import type { BlogPost, BlogPostSummary, BlogSettings } from "./types.js";
 import type { ContentProvider } from "../storyblok/provider.js";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 /** The collection id `/blog` reads — the derived fallback's second argument. */
 const BLOG_COLLECTION = "blog";

package/apps/storefront/src/lib/content/shared/heroSlideshow.ts

@@ -1,5 +1,5 @@
 import type { HeroBlock } from "@/lib/content/storyblok/content-model";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 export function heroAutoplayAllowed(input: {
   enabled: boolean;

package/apps/storefront/src/lib/content/shared/homeVisualParity.ts

@@ -2,7 +2,7 @@ import {
   isSafeRehostedAssetPathForTenant,
   isSafeStorefrontHref,
 } from "@tot/public-runtime";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import type {
   CommerceTrustStripBlock,
   EditorialBlock,

package/apps/storefront/src/lib/content/shared/rawMarketingHtml.ts

@@ -24,7 +24,7 @@ import {
 } from "@tot/public-runtime";
 import { reportTrackingChainHealth } from "../../measurement/tracking/interactionHealth.js";
 import { ASYNC_CSS_SWAP_JS } from "./asyncCss.js";
-import { ROOT_SERVED_HREF_NAMESPACES } from "../../basePath.js";
+import { ROOT_SERVED_HREF_NAMESPACES } from "../../publication/shared/basePath.js";
 
 export { rawHtmlPolicy } from "@tot/public-runtime";
 

package/apps/storefront/src/lib/content/storyblok/provider.ts

@@ -867,7 +867,7 @@ export class DevDraftContentProvider implements ContentProvider {
 
   /** Draft artifact for a tenant-repo-relative path, or null to fall back. */
   private draftRaw(path: string): Promise<string | null> {
-    // Key shape mirrors lib/dev/devDraft.ts devDraftKey — duplicated as a plain
+    // Key shape mirrors lib/developer-experience/dev/devDraft.ts devDraftKey — duplicated as a plain
     // template to keep this module's imports renderer-safe (public-runtime only).
     return this.get(`dev-draft:${this.tenantId}:${this.draftId}:${path}`);
   }

package/apps/storefront/src/lib/customers/fixtures/customers.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   BlockedReason,
   CustomerBlockedQueueRow,

package/apps/storefront/src/lib/{admin → developer-experience/admin}/memoizeByEnvelope.ts

@@ -1,4 +1,4 @@
-import type { AdminTenantEnvelope } from "./envelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
 
 /**
  * Per-request memoization for the pure mock view-model builders. Each builder is

package/apps/storefront/src/lib/{dev → developer-experience/dev}/activityIngestToken.ts

@@ -4,12 +4,12 @@
  * local→hosted activity bridge.
  *
  * Minted alongside the existing cli-signin-code paste
- * (apps/storefront/src/lib/dev/cliSignInCode.ts) and cached by the CLI in
+ * (apps/storefront/src/lib/developer-experience/dev/cliSignInCode.ts) and cached by the CLI in
  * ~/.tot/credentials.json. Deliberately NOT a signed token: this reuses the
  * SESSION KV binding that already exists in every environment (dev/qa/prod),
  * so it needs no new secret to provision. Revoking is just deleting the KV
  * entry — the same posture as the browser's own tot_session cookie (see
- * lib/auth/session.ts).
+ * lib/access/auth/session.ts).
  */
 
 const KEY_PREFIX = "dev-activity-token:";

package/apps/storefront/src/lib/{dev → developer-experience/dev}/cliSignInCode.ts

@@ -18,13 +18,13 @@
  * on prod the shortest form is emitted.
  *
  * `activityBridge` (optional) piggybacks the local→hosted activity-bridge credential
- * (see lib/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
+ * (see lib/developer-experience/dev/activityIngestToken.ts) onto the SAME pasted line as two extra `tot login`
  * flags — no second browser round-trip. Omitted entirely when the caller has no SESSION KV
  * to mint against — the local loop then simply runs with no hosted signal.
  */
-import { readEnv } from "@/lib/env";
-import { redactEmailForHint } from "@/lib/privacy/emailHint";
-import { createRendezvous, type RendezvousDeps } from "@/lib/dev/rendezvousBroker";
+import { readEnv } from "@/lib/publication/shared/env";
+import { redactEmailForHint } from "@/lib/access/privacy/emailHint";
+import { createRendezvous, type RendezvousDeps } from "@/lib/developer-experience/dev/rendezvousBroker";
 
 // The CLI's built-in default MCP (packages/cli login.mjs DEFAULT_MCP_URL). When the derived
 // MCP origin equals this, --mcp is redundant noise, so we omit it.