@tokenoftrust/storefront-runner 2.4.88 → 2.4.90

package/apps/storefront/src/lib/{dev → developer-experience/dev}/livePreview.ts

@@ -5,7 +5,7 @@
  * shape + the request host + a config flag, never a secret.
  *
  * WHY AN IFRAME WORKS (no screenshots, no new infra): tenant routing is host-first with a
- * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/tenantRouting.ts), so
+ * `/<appDomain>/…` path-prefix fallback on the same worker (src/lib/access/shared/tenantRouting.ts), so
  * the tenant's real site is reachable at a RELATIVE path from /dev. CSP already permits
  * same-origin framing both directions (`frame-ancestors 'self'` + `frame-src 'self'`,
  * packages/public-runtime/src/csp.ts) alongside `X-Frame-Options: SAMEORIGIN` — no header

package/apps/storefront/src/lib/{dev → developer-experience/dev}/previewStatus.ts

@@ -20,8 +20,8 @@
  * transport / parse fault → { configured:true, ok:false } so a caller can distinguish
  * "definitely not provisioned" (ok + provisioned:false) from "couldn't tell". Never throws.
  */
-import { callMcpService } from "@/lib/http/mcpServiceCall";
-import { FetchHttpTransport, type HttpGetTransport } from "@/lib/http/fetchTransport";
+import { callMcpService } from "@/lib/developer-experience/http/mcpServiceCall";
+import { FetchHttpTransport, type HttpGetTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpGetTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/rendezvousBroker.ts

@@ -19,9 +19,9 @@
  * (the MCP derives the expected audience from that fixed path, not the sub-path), so
  * one minted assertion shape covers every call. SERVER-SIDE ONLY.
  */
-import { readEnv } from "@/lib/env";
-import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/auth/mcpClientAssertion";
-import { FetchHttpTransport, type HttpTransport } from "@/lib/http/fetchTransport";
+import { readEnv } from "@/lib/publication/shared/env";
+import { mintMcpClientAssertion, McpClientAssertionError } from "@/lib/access/auth/mcpClientAssertion";
+import { FetchHttpTransport, type HttpTransport } from "@/lib/developer-experience/http/fetchTransport";
 
 export type { HttpTransport };
 

package/apps/storefront/src/lib/{dev → developer-experience/dev}/subjectReissue.ts

@@ -20,8 +20,8 @@
  * MCP client_id, exactly what the MCP binds the subject_token audience to. This is the
  * same non-gated mint the MCP itself uses to power rendezvous creation.
  */
-import { getAccessClient } from "@/lib/auth/route";
-import type { TotAccessClient } from "@/lib/auth/totAccessClient";
+import { getAccessClient } from "@/lib/access/auth/route";
+import type { TotAccessClient } from "@/lib/access/auth/totAccessClient";
 
 /** Short — the proof is minted and used immediately at approve time. */
 const SUBJECT_TOKEN_TTL_SECONDS = 120;

package/apps/storefront/src/lib/{http → developer-experience/http}/mcpServiceCall.ts

@@ -10,7 +10,7 @@
  * (a non-skipped failure), while each caller keeps its own fail-open / fail-closed mapping
  * for the outcome.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export interface McpServiceResponse {
   status: number;

package/apps/storefront/src/lib/{cloudflare-workers.d.ts → developer-experience/types/cloudflare-workers.d.ts}

@@ -4,7 +4,7 @@
  * The storefront does not depend on @cloudflare/workers-types (its globals collide with the DOM
  * lib Astro compiles against), so the Durable Object surface the pipeline needs is declared here.
  * The module only resolves inside workerd; under Node it is imported lazily and guarded
- * (`lib/runtimeEnv.ts`).
+ * (`lib/publication/shared/runtimeEnv.ts`).
  */
 declare module "cloudflare:workers" {
   export type SqlStorageValue = ArrayBuffer | string | number | null;

package/apps/storefront/src/lib/engagement/messaging/messagesClient.ts

@@ -3,7 +3,7 @@
  *
  * The storefront RENDERS its own branded email HTML and hands it to tot20 to TRANSMIT, so we
  * reuse tot20's Mandrill SPF/DKIM deliverability (the whole point) while owning the body/brand.
- * Used for the magic-link invite email (see lib/grants/magicLinkInvite.ts).
+ * Used for the magic-link invite email (see lib/access/grants/magicLinkInvite.ts).
  *
  *   POST <core>/api/messages
  *   { channel:"email", to, subject, html, totApiKey, totSecretKey }  → 200 { sent:true, id? }
@@ -15,7 +15,7 @@
  *
  * Built like `@/lib/grants/developerInvites` (interface + Http impl + Mock + env factory).
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export interface InlineEmail {
   /** Recipient address. */

package/apps/storefront/src/lib/engagement/newsletter/resendClient.ts

@@ -5,7 +5,7 @@
  * (`POST /emails/batch`, up to 100 messages/call); audience/consent/unsubscribe
  * state stays first-party in our D1, never in a vendor list.
  */
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 
 /** Resend's batch limit: at most 100 messages per `/emails/batch` call. */
 export const RESEND_BATCH_LIMIT = 100;

package/apps/storefront/src/lib/engagement/social/tokenStore.ts

@@ -19,7 +19,7 @@
  * `null` when either binding is absent so callers degrade rather than throw.
  */
 import type { Queryable } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv } from "../../env.js";
+import { readD1, readEnv } from "../../publication/shared/env.js";
 
 /** The decrypted token material we persist as one JSON blob under AES-GCM. */
 export interface SocialTokenPayload {

package/apps/storefront/src/lib/fulfillment/fulfillmentService.ts

@@ -30,10 +30,10 @@ import {
   type ProviderOutcome,
   type StockState,
 } from "@tot/public-runtime";
-import { readD1 } from "@/lib/env";
-import { decideAdminApiAccess } from "@/lib/auth/adminApiGuard";
-import { readViewerSession } from "@/lib/auth/route";
-import type { SessionRecord } from "@/lib/auth/session";
+import { readD1 } from "@/lib/publication/shared/env";
+import { decideAdminApiAccess } from "@/lib/access/auth/adminApiGuard";
+import { readViewerSession } from "@/lib/access/auth/route";
+import type { SessionRecord } from "@/lib/access/auth/session";
 import {
   canRelease,
   carrierPolicyForTenant,

package/apps/storefront/src/lib/integrations/apps/gatewayKeys.ts

@@ -19,7 +19,7 @@
  * shape change.
  */
 import { importPKCS8, exportJWK, type CryptoKey, type JWK, type JSONWebKeySet } from "jose";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** The only algorithm the gateway signs with (verifiers reject anything else). */
 export const APP_GATEWAY_ALG = "RS256";

package/apps/storefront/src/lib/integrations/apps/registryAccess.ts

@@ -17,7 +17,7 @@ import { AppRegistryService } from "./registryService.js";
 import { D1CredentialStore } from "./credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "./gatewayKeys.js";
 import { fromD1 } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv } from "../../env.js";
+import { readD1, readEnv } from "../../publication/shared/env.js";
 
 /**
  * No-store JSON response — install/rotate bodies carry a one-time client

package/apps/storefront/src/lib/integrations/integration/browserEnvironment.ts

@@ -19,7 +19,7 @@ import {
   type IntegrationSiteSurface,
   type ObligationTenant,
 } from "@tot/public-runtime";
-import { isAdminPath } from "@/lib/auth/loginGate";
+import { isAdminPath } from "@/lib/access/auth/loginGate";
 import {
   resolveIntegrationRenderState,
   type IntegrationRenderState,

package/apps/storefront/src/lib/integrations/webhooks/emit.ts

@@ -51,7 +51,7 @@ import { getDispatcher } from "./getDispatcher.js";
 import { getRegistryService } from "../apps/registryAccess.js";
 import type { AppInstall } from "../apps/registryService.js";
 import { fromD1 } from "../../catalog/d1/catalog.js";
-import { readD1 } from "../../env.js";
+import { readD1 } from "../../publication/shared/env.js";
 
 /** Contract-scoped payload schema version — `asyncapi.yaml`'s `dataschemaversion` is `const: "1"` for V1. */
 const DATASCHEMA_VERSION = "1";

package/apps/storefront/src/lib/integrations/webhooks/getDispatcher.ts

@@ -23,7 +23,7 @@ import { D1CredentialStore } from "../apps/credentials.js";
 import { DEFAULT_APP_GATEWAY_KID, APP_GATEWAY_KID_ENV } from "../apps/gatewayKeys.js";
 import { json } from "../apps/registryAccess.js";
 import { fromD1, type Queryable } from "../../catalog/d1/catalog.js";
-import { readD1, readEnv, readQueue } from "../../env.js";
+import { readD1, readEnv, readQueue } from "../../publication/shared/env.js";
 import { COMMERCE_SCHEDULER } from "@tot/public-runtime";
 
 /** Binding name `getDispatcher()` checks to pick the Cloudflare Queues adapter. Not yet declared in `wrangler.toml`. */

package/apps/storefront/src/lib/measurement/attribution/orderConversionD1.ts

@@ -16,7 +16,7 @@
  * in-memory `node:sqlite` in tests unchanged.
  */
 import type { Queryable } from "../../catalog/d1/catalog.js";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 import {
   computeOrderConversion,
   resolveConversionEnvironment,

package/apps/storefront/src/lib/measurement/tracking/d1Control.ts

@@ -21,7 +21,7 @@
  * stores use (`d1/catalog.ts`), so the insert code in `interactionStore.ts` is
  * transport-agnostic and unit-testable against an in-memory sqlite.
  */
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 import type { Queryable, QueryStatement } from "../../catalog/d1/catalog.js";
 
 const CF_API_BASE = "https://api.cloudflare.com/client/v4";

package/apps/storefront/src/lib/measurement/tracking/interactionCollector.ts

@@ -26,7 +26,7 @@
  * violate either.
  */
 import type { TotInteraction } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** Where the browser beacon POSTs interaction batches. */
 export const INTERACTION_BEACON_PATH = "/api/tracking/interaction";

package/apps/storefront/src/lib/measurement/tracking/tenantD1Registry.ts

@@ -31,7 +31,7 @@
  * never fail because storage is unconfigured.
  */
 import { sha256Hex } from "@tot/public-runtime";
-import { readEnv } from "../../env.js";
+import { readEnv } from "../../publication/shared/env.js";
 import type { Queryable } from "../../catalog/d1/catalog.js";
 import {
   ensureDatabase,

package/apps/storefront/src/lib/{monitoring → observability/monitoring}/manifest.ts

@@ -10,7 +10,7 @@
  * `needs-external` / `needs-secret`.
  *
  * Signal sources are named against real code where it exists in this repo
- * (`/health` → lib/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
+ * (`/health` → lib/observability/shared/health.ts, CSP → pages/api/csp-report.ts + CSP_REPORT_PATH,
  * commerce events → lib/analytics). Signals owned by sibling units are referenced
  * by CONTRACT NAME, not imported — Core Web Vitals come from the RUM beacon,
  * and age-verification / restricted-state denials come from the compliance
@@ -99,7 +99,7 @@ export const MONITORS: readonly Monitor[] = [
     title: "Storefront uptime / liveness",
     category: "availability",
     signal: {
-      source: "GET /health (lib/health.ts — answered before tenant/gate/cache)",
+      source: "GET /health (lib/observability/shared/health.ts — answered before tenant/gate/cache)",
       observe: "external synthetic probe hits /health across regions; expects 200 {status:'ok'}",
     },
     threshold: "2 consecutive probe failures (or >1% of probes failing over 5m)",

package/apps/storefront/src/lib/{analytics → observability/performance}/budgets.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/analytics/perfBudgets.ts (parsePerfBudgets).",
+  "$comment": "F14 performance budgets manifest — the checked-in, tool-neutral source of truth for the storefront go-live framework's perf gate. Consumed by (1) the lab budget-assertion harness (perf/assert-budgets.ts), (2) the Lighthouse budgets exporter (toLighthouseBudgets), and (3) the field RUM regression-alert contract (rumAlert.ts). Edit HERE — everything else derives from it. Shape + validation: src/lib/observability/performance/perfBudgets.ts (parsePerfBudgets).",
   "version": 1,
   "webVitals": {
     "$comment": "Core Web Vitals thresholds, evaluated at the 75th percentile (p75) of the field distribution — the same percentile Google's CrUX / the RUM alert contract use.",

package/apps/storefront/src/lib/{analytics → observability/performance}/webVitals.ts

@@ -34,7 +34,7 @@ import {
   isPurposeEligible,
   parseConsentSnapshot,
 } from "@tot/public-runtime";
-import { withClientApiBase } from "@/lib/basePath";
+import { withClientApiBase } from "@/lib/publication/shared/basePath";
 
 /** The three field metrics we collect. INP is field-only (no lab equivalent). */
 export type WebVitalName = "lcp" | "inp" | "cls";

package/apps/storefront/src/lib/orders/fixtures/orders.ts

@@ -1,5 +1,5 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { MOCK_ANCHOR_ISO, offsetIso, pick, randomBool, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type {
   OrderDetail,
   OrderEvidenceEvent,
@@ -8,8 +8,8 @@ import type {
   OrderRow,
   OrdersViewModel,
 } from "../admin/viewmodels/orders";
-import { tenantProfile } from "../../admin/services/mock/tenants";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import { tenantProfile } from "../../access/fixtures/tenants";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 
 // Must stay index-aligned with customers.ts's NAMES: an order's customerId is
 // derived from the picked name's position here, and customers.ts assigns each

package/apps/storefront/src/lib/orders/providers/foxyOrderClient.ts

@@ -23,7 +23,7 @@
  * `messagesClient.ts`, is a shared singleton that multiple callers (read
  * routes, event receiver) each independently resolve.
  */
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 /** One order line item, as tot-foxycart's `buildOrderPayload()` returns it. */
 export interface FoxyOrderLineItem {

package/apps/storefront/src/lib/{basePath.ts → publication/shared/basePath.ts}

@@ -2,7 +2,7 @@
  * Tenant base-path helpers.
  *
  * When a request selects its tenant via a `/<domain>/` path prefix (see
- * lib/tenantRouting.ts), every same-origin link must carry that prefix or the
+ * lib/access/shared/tenantRouting.ts), every same-origin link must carry that prefix or the
  * visitor falls out of the tenant. Host-routed requests have an empty base path
  * and links are returned unchanged.
  *

package/apps/storefront/src/lib/{env.ts → publication/shared/env.ts}

@@ -12,7 +12,7 @@
  * all, so a request-time D1 handle is unobtainable there rather than merely
  * unused.
  */
-import type { D1Like } from "./catalog/d1/catalog.js";
+import type { D1Like } from "../../catalog/d1/catalog.js";
 
 export * from "./runtimeEnv.js";
 

package/apps/storefront/src/lib/{previewReload.ts → publication/shared/previewReload.ts}

@@ -6,7 +6,7 @@
  * A tiny live-reload client is injected (by src/middleware) into `test`-env HTML
  * pages ONLY — never `live`. It polls `GET /api/preview/version?tenant=<id>` (the
  * per-tenant edge cache-version integer, which bumps on every reconcile/publish;
- * see lib/edgeCache.ts + api/preview/reconcile.ts) and reloads the page when the
+ * see lib/publication/shared/edgeCache.ts + api/preview/reconcile.ts) and reloads the page when the
  * version changes. Poll-based v1; an SSE / Durable-Object PUSH is the later
  * upgrade (TODO below) that removes the ~1s poll latency.
  *

package/apps/storefront/src/lib/{runtimeEnv.ts → publication/shared/runtimeEnv.ts}

@@ -22,7 +22,7 @@ let workerEnv: Record<string, unknown> | null | undefined;
 export async function getWorkerEnv(): Promise<Record<string, unknown> | null> {
   if (workerEnv !== undefined) return workerEnv;
   try {
-    // Only resolvable in the Workers runtime; types in lib/cloudflare-workers.d.ts.
+    // Only resolvable in the Workers runtime; types in lib/developer-experience/types/cloudflare-workers.d.ts.
     const mod = await import("cloudflare:workers");
     workerEnv = (mod.env ?? null) as Record<string, unknown> | null;
   } catch {

package/apps/storefront/src/lib/{url.ts → publication/shared/url.ts}

@@ -8,7 +8,7 @@
  *   &opt.Size=M&tag=sale&priceMin=50&priceMax=200&q=wool
  */
 import type { ListProductsQuery } from "@tot/public-runtime";
-import type { PriceBucket } from "./catalog/shared/priceBuckets.js";
+import type { PriceBucket } from "../../catalog/shared/priceBuckets.js";
 
 export function parseQuery(url: URL): ListProductsQuery {
   const sp = url.searchParams;

package/apps/storefront/src/lib/reporting/fixtures/reporting.ts

@@ -1,6 +1,6 @@
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
-import { pick, randomInt, seededRandom } from "../../admin/seed";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
+import { pick, randomInt, seededRandom } from "../../developer-experience/admin/seed";
 import type { AnalysisBriefItem, ReportingCategory, ReportingSummary, ReportingViewModel } from "../admin/viewmodels/reporting";
 
 const CATEGORY_DEFS: { category: ReportingCategory; label: string; drilldownHref: string }[] = [

package/apps/storefront/src/lib/subscriptions/fixtures/subscriptions.ts

@@ -7,14 +7,14 @@ import {
   isSubscriptionFrequency,
   purchaseOptionPrice,
 } from "@tot/public-runtime";
-import type { AdminTenantEnvelope } from "../../admin/envelope";
-import { memoizeByEnvelope } from "../../admin/memoizeByEnvelope";
+import type { AdminTenantEnvelope } from "../../access/admin/envelope";
+import { memoizeByEnvelope } from "../../developer-experience/admin/memoizeByEnvelope";
 import {
   MOCK_ANCHOR_ISO,
   offsetIso,
   randomInt,
   seededRandom,
-} from "../../admin/seed";
+} from "../../developer-experience/admin/seed";
 import type { CustomerRow } from "../../customers/admin/viewmodels/customers";
 import type { ProductDetail, ProductRow } from "../../catalog/admin/viewmodels/products";
 import type {

package/apps/storefront/src/middleware/candidatePin.ts

@@ -8,7 +8,7 @@
  * `hasCandidatePin` means the same thing at both: a pin this tenant actually
  * verified, never the mere presence of a query param a client can type.
  */
-import { readEnv } from "@/lib/runtimeEnv";
+import { readEnv } from "@/lib/publication/shared/runtimeEnv";
 import { CANDIDATE_CONTENT_PIN_PARAM, verifyContentPinToken } from "@tot/public-runtime";
 
 export interface CandidateContentPin {

package/apps/storefront/src/middleware/controlPlane.ts

@@ -7,7 +7,7 @@
  * then delegates to the shared render chain with those values supplied.
  */
 import type { APIContext, MiddlewareNext } from "astro";
-import { readEnv, readD1, readKv } from "@/lib/env";
+import { readEnv, readD1, readKv } from "@/lib/publication/shared/env";
 import { fromD1, type D1Like } from "@/lib/catalog/d1/catalog";
 import { readCurrentTenantConsentConfig } from "@/lib/measurement/consent/consentConfigRead";
 import { loadActiveManagedInstallDeclarations } from "@/lib/integrations/integration/managedInstallDeclarations";
@@ -30,14 +30,14 @@ import {
   sessionAdmitsHost,
   sessionHostCapability,
   type GateMode,
-} from "@/lib/auth/loginGate";
-import { resolveAdminLanding, isAdminSelectPath } from "@/lib/auth/adminLanding";
-import { resolveAdminTenantMode } from "@/lib/adminTenantEnvelope";
-import { gatedApiResponse, gatedHoldingResponse } from "@/lib/auth/gatePage";
-import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
+} from "@/lib/access/auth/loginGate";
+import { resolveAdminLanding, isAdminSelectPath } from "@/lib/access/auth/adminLanding";
+import { resolveAdminTenantMode } from "@/lib/access/shared/adminTenantEnvelope";
+import { gatedApiResponse, gatedHoldingResponse } from "@/lib/access/auth/gatePage";
+import { readSession, KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
 import { runRenderChain } from "./renderChain.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import type { InternalContentGrant } from "@/lib/auth/internalContentAuthority";
+import type { InternalContentGrant } from "@/lib/access/auth/internalContentAuthority";
 
 export interface ControlPlaneInput {
   context: APIContext;
@@ -209,7 +209,7 @@ export async function serveControlPlane(input: ControlPlaneInput): Promise<Respo
       // with no standing here (staff browsing without a selection) carries none —
       // the session's standing on any other store never appears on this host.
       // Authorization never reads this chrome: admission resolves standing from the
-      // session record for the routed tenant (lib/pipeline/admission-request).
+      // session record for the routed tenant (lib/publication/pipeline/admission-request).
       //
       // On an admin path, "the host" a staff viewer is really acting on is the
       // ?asTenant= impersonation target (mirrors admin.astro/AdminPublishTab.astro's

package/apps/storefront/src/middleware/index.ts

@@ -22,20 +22,20 @@
 import { defineMiddleware } from "astro:middleware";
 import type { APIContext, MiddlewareNext } from "astro";
 import { getTenantResolver } from "@/config/resolver";
-import { readEnv, readKv, readR2 } from "@/lib/runtimeEnv";
-import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/tenantRouting";
-import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/cdnForward";
+import { readEnv, readKv, readR2 } from "@/lib/publication/shared/runtimeEnv";
+import { resolveCdnForwardRouting, resolveTenantRouting } from "@/lib/access/shared/tenantRouting";
+import { crossSiteFormRefusal, verifyCdnForward } from "@/lib/publication/shared/cdnForward";
 import { compileRouteTierIndexV1, resolvePublicationRoutePlanV1, type RouteTierIndexV1 , storefrontModeRequiresSignIn } from "@tot/public-runtime";
 import type { PublicationArtifactBucketV1, TenantConfig } from "@tot/public-runtime";
-import { DEV_DRAFT_COOKIE } from "@/lib/dev/devDraft";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
+import { DEV_DRAFT_COOKIE } from "@/lib/developer-experience/dev/devDraft";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
 import { visitorRegionFor, withVisitorRegionCookie } from "@/lib/compliance/shared/visitorRegionCookie";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { resolveCandidateContentPin } from "./candidatePin.js";
-import { parseGateMode } from "@/lib/auth/loginGate";
-import { evaluateDemoGate, hostInGateList } from "@/lib/demoGate";
-import { isMaintenanceOn, maintenanceResponse } from "@/lib/maintenance";
-import { HEALTH_PATH, healthResponse } from "@/lib/health";
+import { parseGateMode } from "@/lib/access/auth/loginGate";
+import { evaluateDemoGate, hostInGateList } from "@/lib/access/shared/demoGate";
+import { isMaintenanceOn, maintenanceResponse } from "@/lib/access/shared/maintenance";
+import { HEALTH_PATH, healthResponse } from "@/lib/observability/shared/health";
 import { observeDeployVersion } from "@/lib/activity/deployVersion";
 import { primeActivityKillSwitch } from "@/lib/activity/killSwitch";
 import {
@@ -46,13 +46,13 @@ import {
 } from "./routeBranch.js";
 import { servePublicRender } from "./publicRender.js";
 import { serveControlPlane } from "./controlPlane.js";
-import { KvSessionStore, SESSION_COOKIE } from "@/lib/auth/session";
-import { mintOpaqueBrokerAssertion } from "@/lib/auth/brokerAssertion";
+import { KvSessionStore, SESSION_COOKIE } from "@/lib/access/auth/session";
+import { mintOpaqueBrokerAssertion } from "@/lib/access/auth/brokerAssertion";
 import {
   applyInternalContentResponsePolicy,
   authorizeInternalContentRequest,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 /**
  * Compiled once per tenant-config object, as the resolver's contract asks —
@@ -109,7 +109,7 @@ async function serveRequest(
   // ---- /health — liveness + deploy-identity probe ---------------------------
   // Answered FIRST: before tenant resolution, the access gate, the maintenance
   // kill-switch, and the edge cache — so it reports the running build's commit SHA
-  // regardless of Host, an unresolved tenant, or a closed site. See lib/health.
+  // regardless of Host, an unresolved tenant, or a closed site. See lib/observability/shared/health.
   if (url.pathname === HEALTH_PATH) {
     return healthResponse();
   }

package/apps/storefront/src/middleware/publicRender.ts

@@ -7,8 +7,8 @@
  * accident. That absence is the contract, and it is held structurally rather
  * than by review: `public-render-no-request-time-d1` (.dependency-cruiser.cjs)
  * fails `pnpm run check` if ANY module reachable from this one reaches
- * `lib/env.ts`, the sole accessor for a live D1 handle. The public path reaches
- * `lib/runtimeEnv.ts` instead — readEnv/readKv/readR2, the substrate that serves
+ * `lib/publication/shared/env.ts`, the sole accessor for a live D1 handle. The public path reaches
+ * `lib/publication/shared/runtimeEnv.ts` instead — readEnv/readKv/readR2, the substrate that serves
  * published bytes.
  *
  * Two companions cover what a forward graph walk from this module cannot see:

package/apps/storefront/src/middleware/renderChain.ts

@@ -12,24 +12,24 @@ import type { APIContext, MiddlewareNext } from "astro";
 import { referenceTheme } from "@/themes/reference";
 import { mergeTheme, themeToCssVars } from "@/themes/schema";
 import { createToTClient } from "@/lib/catalog/tot/ToTClient";
-import { readEnv, readR2 } from "@/lib/runtimeEnv";
+import { readEnv, readR2 } from "@/lib/publication/shared/runtimeEnv";
 import { tryServeStaticBundle } from "./staticBundle.js";
 import { isPlatformPublicDiscoveryPath } from "./routeBranch.js";
 import { resolveCandidateContentPin, type CandidateContentPin } from "./candidatePin.js";
 import { createContentProvider, DevDraftContentProvider } from "@/lib/content/storyblok/provider";
 import { bindPublicationSpaceContentProviderV1 } from "@/lib/publication/contentProvider.js";
 import { resolvePublicationRuntimeSourceV1 } from "@/lib/publication/runtimeSource.js";
-import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/dev/devDraft";
+import { DEV_DRAFT_COOKIE, devDraftKey, verifyDevDraftToken } from "@/lib/developer-experience/dev/devDraft";
 import {
   isCacheablePath,
   pageCacheKey,
   readCacheVersion,
   getCachedPage,
   putCachedPage,
-} from "@/lib/edgeCache";
-import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/cspStaticHashes";
-import { applySecurityHeaders } from "@/lib/securityHeaders";
-import { maybeInjectPreviewReload } from "@/lib/previewReload";
+} from "@/lib/publication/shared/edgeCache";
+import { STATIC_SCRIPT_HASHES, STATIC_STYLE_HASHES } from "@/lib/access/shared/cspStaticHashes";
+import { applySecurityHeaders } from "@/lib/access/shared/securityHeaders";
+import { maybeInjectPreviewReload } from "@/lib/publication/shared/previewReload";
 import {
   resolveCustomizationEnv,
   buildCsp,
@@ -104,13 +104,13 @@ import {
 } from "@/lib/integrations/integration/renderIntegrationState";
 import { recordActivity } from "@/lib/activity/recordActivity";
 import { middlewareRewriteTargetV1 } from "./routeBranch.js";
-import { declaredTenantOrigins } from "@/lib/tenantOrigins";
+import { declaredTenantOrigins } from "@/lib/access/shared/tenantOrigins";
 import { withDeclaredTenantConfig } from "@/config/declaredTenantConfig";
 import {
   applyInternalContentResponsePolicy,
   internalContentGrantMatchesPlan,
   type InternalContentGrant,
-} from "@/lib/auth/internalContentAuthority";
+} from "@/lib/access/auth/internalContentAuthority";
 
 export interface RenderChainInput {
   context: APIContext;
@@ -178,7 +178,7 @@ export async function runRenderChain(input: RenderChainInput): Promise<Response>
 
   // Candidate-render CONTENT PIN (`__tot_candidate_pin`): a signed, tenant- and
   // expiry-bound token minted ONLY by the control-plane candidate/revision
-  // renderers (`src/lib/preview/pinnedRouteRender.ts`, never client-forgeable)
+  // renderers (`src/lib/publication/preview/pinnedRouteRender.ts`, never client-forgeable)
   // that pins THIS one render's content resolution to an exact immutable
   // `versionId`, bypassing the shared `{live,test}` channel entirely. It rides
   // an in-process `context.rewrite()` from those renderers so a real Astro

package/apps/storefront/src/middleware/staticBundle.ts

@@ -7,8 +7,8 @@
  * hashed names exist only inside a tenant's bundle, never in the Worker's own
  * build output). It reads R2 and KV and never D1.
  */
-import { readR2 } from "@/lib/runtimeEnv";
-import { getCachedPage, putCachedPage, staticBundleCacheKey } from "@/lib/edgeCache";
+import { readR2 } from "@/lib/publication/shared/runtimeEnv";
+import { getCachedPage, putCachedPage, staticBundleCacheKey } from "@/lib/publication/shared/edgeCache";
 import {
   resolveChannelDigest,
   serveStaticBundle,

package/apps/storefront/src/pages/404.astro

@@ -13,7 +13,7 @@ export const prerender = false;
 
 import Layout from "@/layouts/Layout.astro";
 import CollectionCard from "@/components/catalog/storefront/CollectionCard.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 const { tenant, tot, basePath, features } = Astro.locals;
 

package/apps/storefront/src/pages/api/activity.ts

@@ -28,7 +28,7 @@
  * origin check, so the server-to-server callers work.
  */
 import type { APIContext } from "astro";
-import { readD1, readEnv, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { readD1, readEnv, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { verifyIngestAuth } from "@/lib/activity/ingestAuth";
 import { ingestEvents, type IngestRejection } from "@/lib/activity/ingest";

package/apps/storefront/src/pages/api/admin/activity-alerts.ts

@@ -25,8 +25,8 @@
  * ops-timeline; never a URL/query value.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
-import { readD1 } from "@/lib/env";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { checkActivityAlerts } from "@/lib/activity/alerts";
 

package/apps/storefront/src/pages/api/admin/commerce-readiness.ts

@@ -9,7 +9,7 @@
  * surface has no ledger, so configured, absent, and unreadable stay unhealthy.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import { workerCommit } from "@/lib/activity/workerCommit";
 import {
   COMMERCE_SCHEDULER,

package/apps/storefront/src/pages/api/admin/fulfillment/batches.ts

@@ -2,7 +2,7 @@
  * Authenticated owner API for whole-order batch claim and batch read.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,