@tokenoftrust/storefront-runner 2.4.88 → 2.4.90

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id]/address.ts

@@ -3,7 +3,7 @@
  * The read runs only after the owner gate admits the caller.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/fulfillment/orders/[id].ts

@@ -3,7 +3,7 @@
  * The response is state codes and the fulfillment view. It never returns an address.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   fulfillmentResultResponse,
   isOpaqueId,

package/apps/storefront/src/pages/api/admin/interaction-insights.ts

@@ -28,8 +28,8 @@
  * scoping) — see the unit's completion report for the reasoning.
  */
 import type { APIContext } from "astro";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
-import { readD1 } from "@/lib/env";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { resolveTenantStore, trackingNamePrefix } from "@/lib/measurement/tracking/tenantD1Registry";
 import { readD1Control } from "@/lib/measurement/tracking/d1Control";

package/apps/storefront/src/pages/api/admin/orders/[id].ts

@@ -7,8 +7,8 @@
  * Read-only.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { readEnv } from "@/lib/publication/shared/env";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   commerceActorForAdmin,
   createCheckoutOrderClient,

package/apps/storefront/src/pages/api/admin/orders.ts

@@ -10,8 +10,8 @@
  * host/approver layer) — same posture as `api/evidence.json.ts`; no new gate here.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
-import { requireAdminApiEntry } from "@/lib/auth/adminApiGuard";
+import { readEnv } from "@/lib/publication/shared/env";
+import { requireAdminApiEntry } from "@/lib/access/auth/adminApiGuard";
 import {
   createCheckoutOrderClient,
   orderApiBaseUrl,

package/apps/storefront/src/pages/api/auth/logout.ts

@@ -7,8 +7,8 @@
  * sign out.
  */
 import type { APIContext } from "astro";
-import { getSessionStore, clearSessionCookie } from "@/lib/auth/route";
-import { revokeSession, SESSION_COOKIE } from "@/lib/auth/session";
+import { getSessionStore, clearSessionCookie } from "@/lib/access/auth/route";
+import { revokeSession, SESSION_COOKIE } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/magic-exchange.ts

@@ -18,15 +18,15 @@ import {
   getSessionStore,
   setSessionCookie,
   safeNext,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { acceptDeveloperInvite } from "@/lib/shared/developerInvites";
-import { explainDeveloperAccess } from "@/lib/shared/accessExplain";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { acceptDeveloperInvite } from "@/lib/access/shared/developerInvites";
+import { explainDeveloperAccess } from "@/lib/access/shared/accessExplain";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/send.ts

@@ -9,19 +9,19 @@
  * redirect to the "enter your code" step. Accepts an HTML form post (no JS needed).
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   EMAIL_RE,
   getAccessClient,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   devAuthEnabled,
   devAuthCode,
   storeDevCode,
   DEV_AUTH_CODE_TTL_SECONDS,
-} from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-send.ts

@@ -13,7 +13,7 @@
  * but also accepts a plain form post so a no-JS fallback stays possible.
  */
 import type { APIContext } from "astro";
-import { getAccessClient } from "@/lib/auth/route";
+import { getAccessClient } from "@/lib/access/auth/route";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/step-up-verify.ts

@@ -22,9 +22,9 @@ import {
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
-import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
+} from "@/lib/access/auth/route";
+import { getFederatedVerifier, sessionFromFederatedClaims } from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/auth/verify.ts

@@ -14,20 +14,20 @@
  * flat JSON). See `@/lib/auth/identityToken`.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   getAccessClient,
   getSessionStore,
   setSessionCookie,
   safeNext,
   loginRedirect,
-} from "@/lib/auth/route";
+} from "@/lib/access/auth/route";
 import {
   getFederatedVerifier,
   sessionFromFederatedClaims,
-} from "@/lib/auth/identityToken";
-import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/auth/session";
-import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/auth/devAuth";
+} from "@/lib/access/auth/identityToken";
+import { createSession, DEFAULT_SESSION_TTL_SECONDS } from "@/lib/access/auth/session";
+import { devAuthEnabled, consumeDevCode, devSessionFields } from "@/lib/access/auth/devAuth";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/blog/[collection]/[slug]/react.ts

@@ -12,14 +12,14 @@
  *     itself best-effort and never throws.
  */
 import type { APIRoute } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   getReactionCounts,
   isReaction,
   recordReaction,
   type Reaction,
 } from "@/lib/content/blog/reactions";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/checkout-style.css.ts

@@ -16,7 +16,7 @@
  */
 import type { APIContext } from "astro";
 import { buildCheckoutStyleCss } from "@tot/public-runtime";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/cli/policy.ts

@@ -21,7 +21,7 @@
  * the idiomatic write path today. See docs/architecture/dev-experience-hosted-vs-local.md.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -18,7 +18,7 @@ import {
   type StockState,
 } from "@tot/public-runtime";
 import { fromD1, listAllActiveProducts } from "@/lib/catalog/d1/catalog.js";
-import { readD1, readEnv } from "@/lib/env";
+import { readD1, readEnv } from "@/lib/publication/shared/env";
 import { evaluateFinalCart, type SeamView } from "@/lib/checkout/commerce/finalCartAuthorization.js";
 import { d1CommerceRunner, mirrorOnHand, reserveAllocation } from "@/lib/inventory/allocations.js";
 import { POST as compliancePreflight } from "../compliance/preflight.js";

package/apps/storefront/src/pages/api/newsletter/[collection]/subscribe.ts

@@ -15,9 +15,9 @@
  *     is redirected back to the referrer so the page can show its own thanks.
  */
 import type { APIRoute } from "astro";
-import { readD1, readKv, readEnv } from "@/lib/env";
+import { readD1, readKv, readEnv } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
-import { checkRateLimit } from "@/lib/rate/kvWindow";
+import { checkRateLimit } from "@/lib/access/rate/kvWindow";
 import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
 import { randomToken, hashConsentIp } from "@/lib/engagement/newsletter/consent";
 import { sendConfirmationEmail } from "@/lib/engagement/newsletter/confirmationEmail";

package/apps/storefront/src/pages/api/newsletter/confirm.ts

@@ -10,7 +10,7 @@
  * stale token renders a clean "invalid link" page — never a 500.
  */
 import type { APIRoute } from "astro";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { NewsletterSubscribersStore } from "@/lib/engagement/newsletter/subscribers";
 

package/apps/storefront/src/pages/api/newsletter/unsubscribe.ts

@@ -14,12 +14,12 @@
  * (re-unsubscribing is a no-op success) and NON-LEAKING: an unknown token gets the exact
  * same response as a real one, so an observer can't probe which tokens exist.
  *
- * NOTE (integration): The front door.s cross-site form check (lib/cdnForward.ts `crossSiteFormRefusal`,
+ * NOTE (integration): The front door.s cross-site form check (lib/publication/shared/cdnForward.ts `crossSiteFormRefusal`,
  * the rule Astro.s `security.checkOrigin` applies) 403s a cross-origin form-encoded POST before it reaches this handler, which
  * would break the RFC 8058 one-click POST from a mailbox provider. See the unit report.
  */
 import type { APIContext } from "astro";
-import { readD1 } from "@/lib/env";
+import { readD1 } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { unsubscribeByToken } from "@/lib/engagement/newsletter/subscribers";
 

package/apps/storefront/src/pages/api/newsletter.ts

@@ -15,8 +15,8 @@
  * 500. All failures degrade to a friendly thank-you.
  */
 import type { APIContext } from "astro";
-import { readKv } from "@/lib/env";
-import { withBase } from "@/lib/basePath";
+import { readKv } from "@/lib/publication/shared/env";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 // Minimal, permissive email shape check — we are not the source of truth for
 // deliverability; the ESP validates properly downstream.

package/apps/storefront/src/pages/api/request-access.ts

@@ -21,7 +21,7 @@
  * this must work on the storefront marketing tenant.
  */
 import type { APIContext } from "astro";
-import { readEnv } from "@/lib/env";
+import { readEnv } from "@/lib/publication/shared/env";
 
 export const prerender = false;
 

package/apps/storefront/src/pages/api/rum/vitals.ts

@@ -13,8 +13,8 @@
  * store/forward is the documented follow-up; the SHAPE it stores is fixed here.
  */
 import type { APIRoute } from "astro";
-import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/analytics/webVitals";
-import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { rateMetric, type WebVitalName, type WebVitalsSample } from "@/lib/observability/performance/webVitals";
+import { readKv, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { recordBlogView } from "@/lib/content/blog/viewCounts";
 
 export const prerender = false;

package/apps/storefront/src/pages/api/tracking/interaction.ts

@@ -37,7 +37,7 @@
  * stream is ever added.
  */
 import type { APIContext } from "astro";
-import { readD1, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/env";
+import { readD1, readAnalytics, runAfterResponse, type CfExecutionContextLike } from "@/lib/publication/shared/env";
 import { fromD1 } from "@/lib/catalog/d1/catalog";
 import { ingestInteractions, type StampedInteractionEvent } from "@/lib/measurement/tracking/collectorIngest";
 import { readD1Control } from "@/lib/measurement/tracking/d1Control";

package/apps/storefront/src/pages/auth/login.astro

@@ -10,8 +10,8 @@
  * (tot20 sends/verifies the code, the storefront mints the session). No secrets
  * reach the browser. Inline style carries the per-request CSP nonce.
  */
-import { normalizeEmailHint } from "@/lib/privacy/emailHint";
-import { safeNext } from "@/lib/auth/route";
+import { normalizeEmailHint } from "@/lib/access/privacy/emailHint";
+import { safeNext } from "@/lib/access/auth/route";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.
@@ -62,7 +62,7 @@ const showCodeStep = sent && errorCode !== "expired" && errorCode !== "too_many_
 const devMode = import.meta.env.DEV;
 let devAuthOn = false;
 if (devMode) {
-  const { readEnv } = await import("@/lib/env");
+  const { readEnv } = await import("@/lib/publication/shared/env");
   devAuthOn = (await readEnv("DEV_AUTH")) === "1";
 }
 ---

package/apps/storefront/src/pages/auth/magic.astro

@@ -9,7 +9,7 @@
  * the token before the user ever clicked. So: NEVER exchange on GET. The token rides
  * in a hidden form field and leaves only via the POST.
  */
-import { normalizeEmailHint, redactEmailForHint } from "@/lib/privacy/emailHint";
+import { normalizeEmailHint, redactEmailForHint } from "@/lib/access/privacy/emailHint";
 // Self-hosted web fonts (audit finding 6) — same-origin @fontsource, replacing
 // the render-blocking fonts.googleapis.com stylesheet. Covers Plus Jakarta Sans,
 // Inter, and JetBrains Mono used by this page's inline styles.

package/apps/storefront/src/pages/capabilities.astro

@@ -18,7 +18,7 @@
  */
 export const prerender = false;
 
-import { readKv } from "@/lib/env";
+import { readKv } from "@/lib/publication/shared/env";
 import {
   readPublishedArtifact,
   capabilitiesArtifactPath,

package/apps/storefront/src/pages/collections/[handle].astro

@@ -15,12 +15,12 @@ import ActiveFilters from "@/components/catalog/storefront/plp/ActiveFilters.ast
 import SortSelect from "@/components/catalog/storefront/plp/SortSelect.astro";
 import Pagination from "@/components/catalog/storefront/plp/Pagination.astro";
 import Img from "@/components/assets/storefront/Img.astro";
-import { parseQuery, buildQueryString } from "@/lib/url";
+import { parseQuery, buildQueryString } from "@/lib/publication/shared/url";
 import { breadcrumbLd, itemListLd } from "@/lib/content/shared/jsonld";
 import { truncate } from "@/lib/content/shared/format";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import { sourceSeoTitle } from "@/lib/content/seo/documentTitle";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { isBlankDescriptionHtml, sanitizeDescriptionHtml } from "@/lib/content/sanitizeDescriptionHtml";
 
 const { handle } = Astro.params;

package/apps/storefront/src/pages/feed.json.ts

@@ -7,7 +7,7 @@
  */
 import type { APIContext } from "astro";
 import { compileRouteTierIndexV1 } from "@tot/public-runtime";
-import { readKv } from "@/lib/runtimeEnv.js";
+import { readKv } from "@/lib/publication/shared/runtimeEnv.js";
 import {
   declaresMountedSpacesV1,
   feedInstantV1,

package/apps/storefront/src/pages/index.astro

@@ -18,7 +18,7 @@ import TrustStrip from "@/components/content/storefront/content/TrustStrip.astro
 import Faq from "@/components/content/storefront/marketing/Faq.astro";
 import MarketingBlocks from "@/components/content/storefront/marketing/MarketingBlocks.astro";
 import TierCards from "@/components/membership/storefront/membership/TierCards.astro";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { rawHtmlPolicy, rawHtmlResponse } from "@/lib/content/shared/rawMarketingHtml";
 import { renderRawComplianceTop, renderRawComplianceBottom } from "@/lib/compliance/rawComplianceNotices";
 import AppWidgetFrame from "@/components/integrations/storefront/apps/AppWidgetFrame.astro";

package/apps/storefront/src/pages/llms.txt.ts

@@ -13,7 +13,7 @@ import type { APIContext } from "astro";
 import { nonEmptyCollections } from "@/lib/catalog/tot/query.js";
 import { getBlogSettings, listBlogPosts } from "@/lib/content/blog/provider.js";
 import { compileRouteTierIndexV1 } from "@tot/public-runtime";
-import { readKv } from "@/lib/runtimeEnv.js";
+import { readKv } from "@/lib/publication/shared/runtimeEnv.js";
 import {
   declaresMountedSpacesV1,
   mountedDiscoveryUrlV1,

package/apps/storefront/src/pages/products/[handle].astro

@@ -44,7 +44,7 @@ import { resolveMemberContext } from "@/lib/membership/eligibility";
 import { truncate } from "@/lib/content/shared/format";
 import { productLd, breadcrumbLd, reviewLd } from "@/lib/content/shared/jsonld";
 import { isUsableImageUrl } from "@/lib/content/shared/placeholder";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 import { productPageType, structuredDataProfile } from "@/lib/content/seo/structuredData";
 import { pageUrlForm } from "@/lib/content/seo/urlForm";
 import { sourceSeoTitle } from "@/lib/content/seo/documentTitle";

package/apps/storefront/src/pages/search-index.json.ts

@@ -6,7 +6,7 @@
  */
 import type { APIContext } from "astro";
 import { compileRouteTierIndexV1 } from "@tot/public-runtime";
-import { readKv } from "@/lib/runtimeEnv.js";
+import { readKv } from "@/lib/publication/shared/runtimeEnv.js";
 import {
   declaresMountedSpacesV1,
   mountedDiscoveryUrlV1,

package/apps/storefront/src/pages/search.astro

@@ -17,7 +17,7 @@ import EmptyState from "@/components/content/storefront/EmptyState.astro";
 import Section from "@/components/content/storefront/Section.astro";
 import { toTypeaheadDoc } from "@/lib/catalog/search/index";
 import { breadcrumbLd } from "@/lib/content/shared/jsonld";
-import { withBase } from "@/lib/basePath";
+import { withBase } from "@/lib/publication/shared/basePath";
 
 const { tenant, tot, canonicalBase, basePath } = Astro.locals;
 // Commerce-only route (page + typeahead JSON): off for marketing tenants.

package/apps/storefront/src/pages/sitemap.xml.ts

@@ -17,7 +17,7 @@ import { getTheBuildSettings, listBuildPosts } from "@/lib/content/the-build/pro
 import { resolveTheBuildIndexCopy } from "@/lib/content/the-build/pagination.js";
 import { isIndexableHtml, rawPageCanonicalUrl } from "@/lib/content/shared/rawMarketingHtml.js";
 import { compileRouteTierIndexV1 } from "@tot/public-runtime";
-import { readKv } from "@/lib/runtimeEnv.js";
+import { readKv } from "@/lib/publication/shared/runtimeEnv.js";
 import {
   declaresMountedSpacesV1,
   mountedDiscoveryUrlV1,

package/apps/storefront/src/pages/tenants/[id]/[...path].ts

@@ -43,7 +43,7 @@ import {
 } from "@tot/public-runtime";
 import { publicationRecoveryActiveV1, publicationRecoveryKeyV1 } from "@tot/public-runtime/publication-recovery";
 import { readWithImagePreviewRewriteOverlay } from "@tot/public-runtime/image-preview-rewrite-overlay";
-import { readR2, readKv, readEnv } from "@/lib/env";
+import { readR2, readKv, readEnv } from "@/lib/publication/shared/env";
 import {
   resolvePreviewVersionFromCookies,
   resolveSharedPreviewAssetVersion,

package/apps/storefront/test/pipeline/fake-preview-services.ts

@@ -22,13 +22,13 @@
  * A fault fires `times` times (0 = every time); its firing is persisted before it acts.
  */
 import type { DurableObjectState } from "cloudflare:workers";
-import { ForgeToolError, ForgeTransportError } from "../../src/lib/forge/errors";
+import { ForgeToolError, ForgeTransportError } from "../../src/lib/publication/forge/errors";
 import {
   BUILD_CHECKPOINT_EVERY,
   type MembershipEntry,
   type MergeCandidate,
   type PreviewJobServices,
-} from "../../src/lib/pipeline/preview-jobs";
+} from "../../src/lib/publication/pipeline/preview-jobs";
 
 /** Files a fake build materializes. */
 export const FAKE_FILE_COUNT = 250;

package/apps/storefront/test/pipeline/harness.ts

@@ -1,7 +1,7 @@
 /** Shared helpers for the TenantPipeline harness tests (run inside workerd). */
 import { env } from "cloudflare:test";
 import { expect } from "vitest";
-import type { JobState, JobView, TransitionView } from "../../src/lib/pipeline/job-runner";
+import type { JobState, JobView, TransitionView } from "../../src/lib/publication/pipeline/job-runner";
 import type { TenantPipeline } from "./pipeline-host";
 import { S3_CHUNKS, SYNTHETIC_KIND, type Fault } from "./synthetic-job";
 

package/apps/storefront/test/pipeline/matrix-faults.ts

@@ -26,10 +26,10 @@
  * engine's live record — a kill that leaves them apart with no compensation armed is a finding.
  */
 import type { DurableObjectState } from "cloudflare:workers";
-import { JobKindRegistry, type JobKindDefinition, type StepContext, type StepDefinition } from "../../src/lib/pipeline/job-runner";
-import type { PreviewJobServices } from "../../src/lib/pipeline/preview-jobs";
-import { readLivePointer } from "../../src/lib/pipeline/publish/live-pointer";
-import { projectionStore, type TestKv } from "../../src/lib/pipeline/publish/publish-test-support";
+import { JobKindRegistry, type JobKindDefinition, type StepContext, type StepDefinition } from "../../src/lib/publication/pipeline/job-runner";
+import type { PreviewJobServices } from "../../src/lib/publication/pipeline/preview-jobs";
+import { readLivePointer } from "../../src/lib/publication/pipeline/publish/live-pointer";
+import { projectionStore, type TestKv } from "../../src/lib/publication/pipeline/publish/publish-test-support";
 
 export type MatrixMode = "before" | "after" | "resume" | "effect" | "hold";
 

package/apps/storefront/test/pipeline/pipeline-host.ts

@@ -8,25 +8,25 @@
  * fault matrix's kill points (`./matrix-faults.ts`), inert until a test arms one.
  */
 import type { DurableObjectState } from "cloudflare:workers";
-import { TenantPipeline as DeployedTenantPipeline } from "../../src/lib/pipeline/tenant-pipeline";
-import { submitIntent, tenantPipeline, type TenantPipelineNamespace } from "../../src/lib/pipeline/intake";
-import { submitPreviewSync } from "../../src/lib/pipeline/preview-sync-intake";
-import { JobKindRegistry, StaleExecutionError, type PipelineIntent } from "../../src/lib/pipeline/job-runner";
+import { TenantPipeline as DeployedTenantPipeline } from "../../src/lib/publication/pipeline/tenant-pipeline";
+import { submitIntent, tenantPipeline, type TenantPipelineNamespace } from "../../src/lib/publication/pipeline/intake";
+import { submitPreviewSync } from "../../src/lib/publication/pipeline/preview-sync-intake";
+import { JobKindRegistry, StaleExecutionError, type PipelineIntent } from "../../src/lib/publication/pipeline/job-runner";
 import { abandonedContexts, syntheticJobKinds, syntheticSpans } from "./synthetic-job";
-import { registerPreviewJobKinds, type PreviewJobTiming } from "../../src/lib/pipeline/preview-jobs";
+import { registerPreviewJobKinds, type PreviewJobTiming } from "../../src/lib/publication/pipeline/preview-jobs";
 import { configureFake, fakePreviewServices, readFakeState, type FakeFault, type FakeState } from "./fake-preview-services";
 import { MatrixFaults, previewServicesWithEffects, type Landed, type MatrixFault } from "./matrix-faults";
-import { kvAbandonServices, legacyOperationKey, registerSeedJobKind, type SeedServices } from "../../src/lib/pipeline/seed-from-legacy";
+import { kvAbandonServices, legacyOperationKey, registerSeedJobKind, type SeedServices } from "../../src/lib/publication/pipeline/seed-from-legacy";
 import { readAssetsPointer } from "@tot/public-runtime";
-import { readLivePointer } from "../../src/lib/pipeline/publish/live-pointer";
+import { readLivePointer } from "../../src/lib/publication/pipeline/publish/live-pointer";
 import {
   listIntegrationRuns,
   listReleaseReceipts,
   readReleaseTruth,
   writeIntegrationRun,
   type ReleaseModelKv,
-} from "../../src/lib/change/store/aggregate-release-store";
-import { projectionStore, seedGreenAggregate, testVersionStore, type TestKv } from "../../src/lib/pipeline/publish/publish-test-support";
+} from "../../src/lib/publication/change/store/aggregate-release-store";
+import { projectionStore, seedGreenAggregate, testVersionStore, type TestKv } from "../../src/lib/publication/pipeline/publish/publish-test-support";
 import {
   armPublishFault,
   firedPublishFaults,

package/apps/storefront/test/pipeline/publish-kinds.ts

@@ -1,6 +1,6 @@
 /**
  * The REAL publish / rollback / hotfix job kinds for the TenantPipeline fault harness, over the
- * stand-in world (`src/lib/pipeline/publish/publish-test-support.ts`: GitHub Actions, CloudFront,
+ * stand-in world (`src/lib/publication/pipeline/publish/publish-test-support.ts`: GitHub Actions, CloudFront,
  * the Cloudflare edge, the MCP promotion ledger). Test-only.
  *
  * Every byte of state — the job's KV (release ledger, version store, `live` pointer) and the
@@ -19,8 +19,8 @@
  * SQLite record, projected to the harness KV) — the production writer.
  */
 import type { DurableObjectState } from "cloudflare:workers";
-import { JobKindRegistry, type JobKindDefinition, type StepDefinition } from "../../src/lib/pipeline/job-runner";
-import { registerPublishJobKinds, type PublishKindTuning, type PublishTiming } from "../../src/lib/pipeline/publish/publish-job";
+import { JobKindRegistry, type JobKindDefinition, type StepDefinition } from "../../src/lib/publication/pipeline/job-runner";
+import { registerPublishJobKinds, type PublishKindTuning, type PublishTiming } from "../../src/lib/publication/pipeline/publish/publish-job";
 import {
   PublishWorld,
   movePreview,
@@ -29,7 +29,7 @@ import {
   type CiDispatch,
   type TestKv,
   type WorldDesignation,
-} from "../../src/lib/pipeline/publish/publish-test-support";
+} from "../../src/lib/publication/pipeline/publish/publish-test-support";
 import type { Landed } from "./matrix-faults";
 
 type SiteVersionStore = ReturnType<typeof testVersionStore>;

package/apps/storefront/test/pipeline/synthetic-job.ts

@@ -1,6 +1,6 @@
 /**
  * A synthetic 5-step job kind for the TenantPipeline fault harness. Test-only: the deployed
- * registry (`src/lib/pipeline/job-kinds.ts`) never contains it.
+ * registry (`src/lib/publication/pipeline/job-kinds.ts`) never contains it.
  *
  * Steps s1..s5. s3 works in three chunks and checkpoints after each one. s2 records a commit
  * fact, s4 evidence, s5 the live state, so retried fact writes are exercised too. Every step
@@ -14,7 +14,7 @@
  * persisted before it acts so it survives the eviction it causes.
  */
 import type { DurableObjectState } from "cloudflare:workers";
-import { PipelineRefusal } from "../../src/lib/pipeline/classify";
+import { PipelineRefusal } from "../../src/lib/publication/pipeline/classify";
 import {
   InvalidJobInput,
   JobKindRegistry,
@@ -23,7 +23,7 @@ import {
   type StepContext,
   type StepDefinition,
   type StepOutcome,
-} from "../../src/lib/pipeline/job-runner";
+} from "../../src/lib/publication/pipeline/job-runner";
 
 export type FaultMode = "throw" | "hang" | "evict" | "refuse" | "crash";
 

package/apps/storefront/test/pipeline-faults/matrix-lib.ts

@@ -11,9 +11,9 @@
  * a CI dispatch is completed and its callback delivered, a hotfix's static prebuild is staged and
  * reported. The cell's outcome is then held against the scenario's unfaulted run (`baselineOf`).
  */
-import type { JobView, TransitionView } from "../../src/lib/pipeline/job-runner";
+import type { JobView, TransitionView } from "../../src/lib/publication/pipeline/job-runner";
 import type { MatrixEffect, MatrixFault, MatrixKill } from "../pipeline/matrix-faults";
-import type { CiDispatch } from "../../src/lib/pipeline/publish/publish-test-support";
+import type { CiDispatch } from "../../src/lib/publication/pipeline/publish/publish-test-support";
 import { pipelineFor, uniqueTenant } from "../pipeline/harness";
 
 export type Provider = "worker-r2-pointer" | "s3-overwrite";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.88",
+  "version": "2.4.90",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",

package/packages/public-runtime/src/hosted-image-media-types.ts

@@ -4,7 +4,7 @@
  * These used to be independent literal objects copy-pasted across the S3 and
  * R2 publish paths -- which is exactly how one of them silently fell out of
  * sync (the SVG entry landed in scripts/publish/lib/hosted-original-publication.mjs's
- * EXT map but not apps/storefront/src/lib/change/publication/hostedOriginalPoolStage.ts's
+ * EXT map but not apps/storefront/src/lib/publication/change/publication/hostedOriginalPoolStage.ts's
  * MEDIA_TYPES map, so a tenant with a pinned SVG favicon staged to CloudFront but
  * was silently rejected on the Cloudflare/R2 mirror). Importing from here instead
  * of re-declaring the literal is what makes that class of drift impossible, not just