diff --git a/.oxlintrc.json b/.oxlintrc.json
index abc2e07..9e9e855 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -34,6 +34,30 @@
     "builtin": true
   },
   "overrides": [
+    {
+      // Deno resolves relative specifiers literally in deployed edge bundles.
+      "files": [
+        "src/{audit,shared}/**/*.ts",
+        "netlify/edge-functions/**/*.ts",
+        "netlify/_shared/**/*.ts",
+        "db/{index,schema}.ts"
+      ],
+      "excludeFiles": ["**/*.test.ts"],
+      "rules": {
+        "import/no-nodejs-modules": "error",
+        "no-restricted-imports": [
+          "error",
+          {
+            "patterns": [
+              {
+                "group": ["./**", "../**", "!./**/*.ts", "!../**/*.ts"],
+                "message": "Edge-reachable relative imports must use a literal .ts specifier."
+              }
+            ]
+          }
+        ]
+      }
+    },
     // Don't enable e18e perf rules in test files
     {
       "files": ["**/*.{js,jsx,ts,tsx}"],
diff --git a/AGENTS.md b/AGENTS.md
index 5e46711..641de70 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -27,20 +27,35 @@ snapshots render through `SharedReport.svelte` and reuse
 
 ## Runtime boundaries
 
-The server-side audit graph under `src/lib/` runs in both Deno edge functions
-and Node scheduled functions. Anything reachable from `runAudit` or
-`runUserPublishes` must use APIs available in both runtimes: no `node:` builtins
-and no browser-only globals. Use Web Crypto, not `node:crypto`.
+Runtime ownership is explicit in the source tree:
+
+- `src/client/` is browser-only.
+- `src/shared/` contains contracts and utilities usable in the browser, Deno,
+  and Node.
+- `src/audit/` is the server-side audit graph shared by Deno edge functions and
+  Node scheduled functions.
+
+Anything in `src/shared/` or `src/audit/` must use APIs available in every
+declared runtime: no `node:` builtins or browser-only globals. Use Web Crypto,
+not `node:crypto`.
 
 Cross-runtime Netlify helpers live in `netlify/_shared/`;
 `netlify/functions/_shared/` is reserved for Node-only function helpers.
 
+Internal modules use the `package.json#imports` namespaces `#client/*`,
+`#shared/*`, `#audit/*`, `#server/*`, `#node/*`, and `#db/*`. Prefer these over
+cross-directory relative imports; the namespace makes runtime ownership visible.
+Every edge-reachable alias must also have an exact `.ts` mapping in
+`import_map.json`: Netlify's deploy-time Deno bundler does not resolve the
+`package.json` wildcard mappings.
+
 Netlify edge bundling has stricter rules than Vite or local development:
 
 - Edge-reachable relative imports require explicit `.ts` extensions. Node-only
   serverless files use `.js` and must not enter an edge bundle.
-- `valibot` and `packumeta` are mapped to pinned esm.sh builds in
-  `import_map.json`. A new edge-reachable dependency may need the same treatment.
+- Edge-reachable internal aliases, `valibot`, and `packumeta` are mapped in
+  `import_map.json`. Keep internal mappings synchronized with their
+  `package.json#imports` targets and pin third-party esm.sh builds.
 - `@netlify/database` is Netlify-first-party and deliberately not mapped. Use
   its native tagged-SQL client; validate returned rows with `db/schema.ts`.
 - Never put tests in `netlify/edge-functions/`: Netlify treats every `.ts` or
@@ -51,7 +66,7 @@ Netlify edge bundling has stricter rules than Vite or local development:
 
 ### npm access and failure handling
 
-Fetch npm directly through `src/lib/npmClient.ts`:
+Fetch npm directly through `src/audit/npmClient.ts`:
 
 - `registry.npmjs.org`: packuments and per-version manifests.
 - `api.npmjs.org`: weekly downloads.
@@ -142,7 +157,7 @@ Clipboard and Web Crypto APIs, `matchMedia`, semantic live regions,
 by default and progressive enhancement for newer ones; do not add JS polyfills
 for CSS anchor positioning.
 
-Human-facing dates and times go through `src/lib/dateFormatting.ts` and follow
+Human-facing dates and times go through `src/client/dateFormatting.ts` and follow
 the viewer's locale and timezone. Persistence, APIs, sorting, report ids,
 exports, and `<time datetime>` retain ISO-8601 values. Date-only values are
 calendar dates and must not shift across timezones. If visible text omits part
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index fe7cc53..1403011 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -88,7 +88,7 @@ TypeScript validation.
 ## Pull Request checklist
 
 - Any new npm fetch path preserves retry/backoff and `FailureLog` semantics.
-- Audit request, response, or SSE changes keep `src/lib/schemas.ts`, the edge functions, and the
+- Audit request, response, or SSE changes keep `src/shared/schemas.ts`, the edge functions, and the
   client stream wrappers in sync.
 - Edge-reachable changes follow the runtime and bundling rules in `AGENTS.md` and pass the
   deploy-time edge build.
diff --git a/db/seed-local.ts b/db/seed-local.ts
index 844c93d..40b9a63 100644
--- a/db/seed-local.ts
+++ b/db/seed-local.ts
@@ -5,7 +5,7 @@ import {
   EXAMPLE_ORG,
   EXAMPLE_TOTAL_PACKAGES,
   EXAMPLE_TRUST_HISTORY,
-} from "../src/lib/exampleTrustHistory.ts";
+} from "#shared/exampleTrustHistory";
 
 function snapshotValues(): string {
   return EXAMPLE_TRUST_HISTORY.map(
diff --git a/import_map.json b/import_map.json
index 2768e6f..aa41ccd 100644
--- a/import_map.json
+++ b/import_map.json
@@ -1,6 +1,21 @@
 {
   "imports": {
-    "valibot": "https://esm.sh/valibot@1.4.2",
-    "packumeta": "https://esm.sh/packumeta@0.4.1"
+    "#audit/concurrency": "./src/audit/concurrency.ts",
+    "#audit/discovery": "./src/audit/discovery.ts",
+    "#audit/downloads": "./src/audit/downloads.ts",
+    "#audit/npmClient": "./src/audit/npmClient.ts",
+    "#audit/reports": "./src/audit/reports.ts",
+    "#audit/runAudit": "./src/audit/runAudit.ts",
+    "#audit/trust": "./src/audit/trust.ts",
+    "#db/index": "./db/index.ts",
+    "#db/schema": "./db/schema.ts",
+    "#server/audit-jobs": "./netlify/_shared/audit-jobs.ts",
+    "#server/report-persistence": "./netlify/_shared/report-persistence.ts",
+    "#shared/auditDefaults": "./src/shared/auditDefaults.ts",
+    "#shared/reportHistory": "./src/shared/reportHistory.ts",
+    "#shared/schemas": "./src/shared/schemas.ts",
+    "#shared/types": "./src/shared/types.ts",
+    "packumeta": "https://esm.sh/packumeta@0.4.1",
+    "valibot": "https://esm.sh/valibot@1.4.2"
   }
 }
diff --git a/netlify/_shared/audit-jobs.ts b/netlify/_shared/audit-jobs.ts
index 77b4643..ba73697 100644
--- a/netlify/_shared/audit-jobs.ts
+++ b/netlify/_shared/audit-jobs.ts
@@ -1,4 +1,4 @@
-import { getDb } from "../../db/index.ts";
+import { getDb } from "#db/index";
 import {
   type AuditJobLine,
   type AuditJobRow,
@@ -7,7 +7,7 @@ import {
   IdRowSchema,
   parseRows,
   serializeJson,
-} from "../../db/schema.ts";
+} from "#db/schema";
 
 // Persistence for a resumable interactive audit (see the `auditJobs` table). The
 // audit-stream edge function is the only writer; a reconnecting client reads
diff --git a/netlify/_shared/report-persistence.ts b/netlify/_shared/report-persistence.ts
index c72479a..768ecaa 100644
--- a/netlify/_shared/report-persistence.ts
+++ b/netlify/_shared/report-persistence.ts
@@ -1,5 +1,5 @@
-import { getDb } from "../../db/index.ts";
-import { type ReportTrustHistoryRow, serializeJson } from "../../db/schema.ts";
+import { getDb } from "#db/index";
+import { type ReportTrustHistoryRow, serializeJson } from "#db/schema";
 import {
   extractTrustHistory,
   scopeLabelFor,
@@ -7,7 +7,7 @@ import {
   type ReportTrustHistoryPoint,
   type SharedReportScope,
   type TrustHistorySnapshot,
-} from "../../src/lib/reportHistory.ts";
+} from "#shared/reportHistory";
 
 export interface SaveReportSnapshotInput {
   orgs: string[];
diff --git a/netlify/edge-functions/audit-stream.ts b/netlify/edge-functions/audit-stream.ts
index c23924d..0bbb09b 100644
--- a/netlify/edge-functions/audit-stream.ts
+++ b/netlify/edge-functions/audit-stream.ts
@@ -1,13 +1,13 @@
 /* eslint-disable no-await-in-loop -- The reconnect tail polls the stored log sequentially until the run reaches a terminal state. */
 import type { Config } from "@netlify/edge-functions";
-import { FETCH_CONCURRENCY, blockedOrgMessage, isBlockedOrg } from "../../src/lib/auditDefaults.ts";
-import { scopeLabelFor, type SharedReportScope } from "../../src/lib/reportHistory.ts";
-import { AuditRequestSchema, parseOrNull } from "../../src/lib/schemas.ts";
-import { type AuditResult, runAudit } from "../../src/lib/runAudit.ts";
-import type { AuditConfig, ReportKind } from "../../src/lib/types.ts";
-import { saveReportSnapshot } from "../_shared/report-persistence.ts";
-import { createJobIfAbsent, finishJob, getJob, updateJobLog } from "../_shared/audit-jobs.ts";
-import type { AuditJobLine } from "../../db/schema.ts";
+import { runAudit } from "#audit/runAudit";
+import type { AuditJobLine } from "#db/schema";
+import { createJobIfAbsent, finishJob, getJob, updateJobLog } from "#server/audit-jobs";
+import { saveReportSnapshot } from "#server/report-persistence";
+import { FETCH_CONCURRENCY, blockedOrgMessage, isBlockedOrg } from "#shared/auditDefaults";
+import { scopeLabelFor, type SharedReportScope } from "#shared/reportHistory";
+import { AuditRequestSchema, parseOrNull } from "#shared/schemas";
+import type { AuditConfig, AuditResult, ReportKind } from "#shared/types";
 
 // Interactive audits run HERE, server-side, and stream progress to the browser
 // over SSE (the progress log consumes `log` events). Because the server runs the
diff --git a/netlify/edge-functions/user-publishes-stream.ts b/netlify/edge-functions/user-publishes-stream.ts
index ce25102..9298f4d 100644
--- a/netlify/edge-functions/user-publishes-stream.ts
+++ b/netlify/edge-functions/user-publishes-stream.ts
@@ -1,8 +1,8 @@
 import type { Config } from "@netlify/edge-functions";
-import { FETCH_CONCURRENCY } from "../../src/lib/auditDefaults.ts";
-import { FailureLog } from "../../src/lib/npmClient.ts";
-import { runUserPublishes } from "../../src/lib/reports.ts";
-import { UserPublishRequestSchema, parseOrNull } from "../../src/lib/schemas.ts";
+import { FailureLog } from "#audit/npmClient";
+import { runUserPublishes } from "#audit/reports";
+import { FETCH_CONCURRENCY } from "#shared/auditDefaults";
+import { UserPublishRequestSchema, parseOrNull } from "#shared/schemas";
 
 // Per-user publish history, run server-side and streamed over SSE — same shape
 // as audit-stream. Runs in the Deno edge runtime; `npmClient` fetches npm
diff --git a/netlify/functions/_shared/report-schedules.ts b/netlify/functions/_shared/report-schedules.ts
index 231593b..fadc98b 100644
--- a/netlify/functions/_shared/report-schedules.ts
+++ b/netlify/functions/_shared/report-schedules.ts
@@ -1,18 +1,17 @@
 /* eslint-disable no-await-in-loop -- Due schedules run sequentially to avoid stacking full org audits against npm APIs. */
-import { getDb } from "../../../db/index.js";
+import { runAudit } from "#audit/runAudit";
+import { getDb } from "#db/index";
 import {
   parseRows,
   type ReportRerunScheduleRow,
   ReportRerunScheduleRowSchema,
   ReportTrustHistoryRowSchema,
   serializeJson,
-} from "../../../db/schema.js";
-import { FETCH_CONCURRENCY } from "../../../src/lib/auditDefaults.js";
-import type { ReportRerunScheduleStatus } from "../../../src/lib/reportHistory.js";
-import type { AuditResult } from "../../../src/lib/runAudit.js";
-import { runAudit } from "../../../src/lib/runAudit.js";
-import type { AuditConfig } from "../../../src/lib/types.js";
-import { saveReportSnapshot } from "../../_shared/report-persistence.js";
+} from "#db/schema";
+import { saveReportSnapshot } from "#server/report-persistence";
+import { FETCH_CONCURRENCY } from "#shared/auditDefaults";
+import type { ReportRerunScheduleStatus } from "#shared/reportHistory";
+import type { AuditConfig, AuditResult } from "#shared/types";
 
 const DAY_MS = 24 * 60 * 60 * 1000;
 const HOUR_MS = 60 * 60 * 1000;
diff --git a/netlify/functions/audit-jobs-cleanup-background.ts b/netlify/functions/audit-jobs-cleanup-background.ts
index 1530f75..5a2efd9 100644
--- a/netlify/functions/audit-jobs-cleanup-background.ts
+++ b/netlify/functions/audit-jobs-cleanup-background.ts
@@ -1,5 +1,5 @@
 import type { Config } from "@netlify/functions";
-import { deleteExpiredJobs } from "../_shared/audit-jobs.js";
+import { deleteExpiredJobs } from "#server/audit-jobs";
 
 // Prune throwaway `audit_jobs` rows. Interactive audits persist their resumable
 // progress there, but the durable artifact is the saved report in `reports`, so a
diff --git a/netlify/functions/reports.ts b/netlify/functions/reports.ts
index 0331bdd..9fc7aa4 100644
--- a/netlify/functions/reports.ts
+++ b/netlify/functions/reports.ts
@@ -1,13 +1,9 @@
 import type { Config } from "@netlify/functions";
-import { getDb } from "../../db/index.js";
-import { parseRows, ReportTrustHistoryRowSchema, SharedReportRowSchema } from "../../db/schema.js";
-import {
-  normalizeOrgs,
-  orgKeyFor,
-  type RecentTrustReportLink,
-} from "../../src/lib/reportHistory.js";
-import { historyPointFromRow, recentReportLinkFromRow } from "../_shared/report-persistence.js";
-import { scheduleDailyTrustReport } from "./_shared/report-schedules.js";
+import { getDb } from "#db/index";
+import { parseRows, ReportTrustHistoryRowSchema, SharedReportRowSchema } from "#db/schema";
+import { scheduleDailyTrustReport } from "#node/report-schedules";
+import { historyPointFromRow, recentReportLinkFromRow } from "#server/report-persistence";
+import { normalizeOrgs, orgKeyFor, type RecentTrustReportLink } from "#shared/reportHistory";
 
 const RECENT_REPORT_LIMIT = 5;
 
diff --git a/netlify/functions/trust-reruns-background.ts b/netlify/functions/trust-reruns-background.ts
index 88b05e7..2734bff 100644
--- a/netlify/functions/trust-reruns-background.ts
+++ b/netlify/functions/trust-reruns-background.ts
@@ -1,5 +1,5 @@
 import type { Config } from "@netlify/functions";
-import { processDueTrustReruns } from "./_shared/report-schedules.js";
+import { processDueTrustReruns } from "#node/report-schedules";
 
 export default async () => {
   const result = await processDueTrustReruns();
diff --git a/netlify/tests/edge-functions/audit-stream.test.ts b/netlify/tests/edge-functions/audit-stream.test.ts
index ce632ed..3a240a2 100644
--- a/netlify/tests/edge-functions/audit-stream.test.ts
+++ b/netlify/tests/edge-functions/audit-stream.test.ts
@@ -3,25 +3,24 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { AuditJobRow } from "../../../db/schema.ts";
 
 const mocked = vi.hoisted(() => ({
-  createJobIfAbsent: vi.fn<typeof import("../../_shared/audit-jobs.ts").createJobIfAbsent>(),
-  finishJob: vi.fn<typeof import("../../_shared/audit-jobs.ts").finishJob>(),
-  getJob: vi.fn<typeof import("../../_shared/audit-jobs.ts").getJob>(),
-  runAudit: vi.fn<typeof import("../../../src/lib/runAudit.ts").runAudit>(),
-  saveReportSnapshot:
-    vi.fn<typeof import("../../_shared/report-persistence.ts").saveReportSnapshot>(),
-  updateJobLog: vi.fn<typeof import("../../_shared/audit-jobs.ts").updateJobLog>(),
+  createJobIfAbsent: vi.fn<typeof import("#server/audit-jobs").createJobIfAbsent>(),
+  finishJob: vi.fn<typeof import("#server/audit-jobs").finishJob>(),
+  getJob: vi.fn<typeof import("#server/audit-jobs").getJob>(),
+  runAudit: vi.fn<typeof import("#audit/runAudit").runAudit>(),
+  saveReportSnapshot: vi.fn<typeof import("#server/report-persistence").saveReportSnapshot>(),
+  updateJobLog: vi.fn<typeof import("#server/audit-jobs").updateJobLog>(),
 }));
 
-vi.mock("../../_shared/audit-jobs.ts", () => ({
+vi.mock("#server/audit-jobs", () => ({
   createJobIfAbsent: mocked.createJobIfAbsent,
   finishJob: mocked.finishJob,
   getJob: mocked.getJob,
   updateJobLog: mocked.updateJobLog,
 }));
-vi.mock("../../_shared/report-persistence.ts", () => ({
+vi.mock("#server/report-persistence", () => ({
   saveReportSnapshot: mocked.saveReportSnapshot,
 }));
-vi.mock("../../../src/lib/runAudit.ts", () => ({ runAudit: mocked.runAudit }));
+vi.mock("#audit/runAudit", () => ({ runAudit: mocked.runAudit }));
 
 import handler, { config } from "../../edge-functions/audit-stream.ts";
 
diff --git a/netlify/tests/edge-functions/user-publishes-stream.test.ts b/netlify/tests/edge-functions/user-publishes-stream.test.ts
index 6d614a9..63df583 100644
--- a/netlify/tests/edge-functions/user-publishes-stream.test.ts
+++ b/netlify/tests/edge-functions/user-publishes-stream.test.ts
@@ -2,10 +2,10 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const runUserPublishes = vi.hoisted(() =>
-  vi.fn<typeof import("../../../src/lib/reports.ts").runUserPublishes>(),
+  vi.fn<typeof import("#audit/reports").runUserPublishes>(),
 );
 
-vi.mock("../../../src/lib/reports.ts", () => ({ runUserPublishes }));
+vi.mock("#audit/reports", () => ({ runUserPublishes }));
 
 import handler, { config } from "../../edge-functions/user-publishes-stream.ts";
 
diff --git a/netlify/tests/functions/audit-jobs.test.ts b/netlify/tests/functions/audit-jobs.test.ts
index caab746..97d9e6a 100644
--- a/netlify/tests/functions/audit-jobs.test.ts
+++ b/netlify/tests/functions/audit-jobs.test.ts
@@ -6,7 +6,7 @@ import { resetTestDatabase, startTestDatabase, stopTestDatabase } from "../datab
 
 let database: DatabaseConnection;
 let local: NetlifyDB;
-let jobs: typeof import("../../_shared/audit-jobs.js");
+let jobs: typeof import("#server/audit-jobs");
 
 beforeAll(async () => {
   const started = await startTestDatabase();
@@ -14,8 +14,8 @@ beforeAll(async () => {
   vi.stubEnv("NETLIFY_DB_URL", started.connectionString);
   vi.stubEnv("NETLIFY_DB_DRIVER", "server");
   vi.resetModules();
-  database = (await import("../../../db/index.js")).getDb();
-  jobs = await import("../../_shared/audit-jobs.js");
+  database = (await import("#db/index")).getDb();
+  jobs = await import("#server/audit-jobs");
 });
 
 beforeEach(async () => {
diff --git a/netlify/tests/functions/local-seed.test.ts b/netlify/tests/functions/local-seed.test.ts
index f8f986f..72e4577 100644
--- a/netlify/tests/functions/local-seed.test.ts
+++ b/netlify/tests/functions/local-seed.test.ts
@@ -7,10 +7,10 @@ import {
   ReportRerunScheduleRowSchema,
   ReportRowSchema,
   ReportTrustHistoryRowSchema,
-} from "../../../db/schema.js";
+} from "#db/schema";
+import { EXAMPLE_TRUST_HISTORY } from "#shared/exampleTrustHistory";
+import { parseOrNull, AuditResultSchema } from "#shared/schemas";
 import { buildExampleSeedSql } from "../../../db/seed-local.js";
-import { EXAMPLE_TRUST_HISTORY } from "../../../src/lib/exampleTrustHistory.js";
-import { parseOrNull, AuditResultSchema } from "../../../src/lib/schemas.js";
 import { resetTestDatabase, startTestDatabase, stopTestDatabase } from "../database.js";
 
 let database: DatabaseConnection;
diff --git a/netlify/tests/functions/report-persistence.test.ts b/netlify/tests/functions/report-persistence.test.ts
index 9e1c8c8..4a8a1fd 100644
--- a/netlify/tests/functions/report-persistence.test.ts
+++ b/netlify/tests/functions/report-persistence.test.ts
@@ -2,13 +2,13 @@
 import type { DatabaseConnection } from "@netlify/database";
 import type { NetlifyDB } from "@netlify/database-dev";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
-import { parseRows, ReportRowSchema, ReportTrustHistoryRowSchema } from "../../../db/schema.js";
-import type { AuditResult } from "../../../src/lib/runAudit.js";
+import { parseRows, ReportRowSchema, ReportTrustHistoryRowSchema } from "#db/schema";
+import type { AuditResult } from "#shared/types";
 import { resetTestDatabase, startTestDatabase, stopTestDatabase } from "../database.js";
 
 let database: DatabaseConnection;
 let local: NetlifyDB;
-let persistence: typeof import("../../_shared/report-persistence.js");
+let persistence: typeof import("#server/report-persistence");
 
 beforeAll(async () => {
   const started = await startTestDatabase();
@@ -16,8 +16,8 @@ beforeAll(async () => {
   vi.stubEnv("NETLIFY_DB_URL", started.connectionString);
   vi.stubEnv("NETLIFY_DB_DRIVER", "server");
   vi.resetModules();
-  database = (await import("../../../db/index.js")).getDb();
-  persistence = await import("../../_shared/report-persistence.js");
+  database = (await import("#db/index")).getDb();
+  persistence = await import("#server/report-persistence");
 });
 
 beforeEach(async () => {
diff --git a/netlify/tests/functions/reports.test.ts b/netlify/tests/functions/reports.test.ts
index 3598b79..5441476 100644
--- a/netlify/tests/functions/reports.test.ts
+++ b/netlify/tests/functions/reports.test.ts
@@ -2,7 +2,7 @@
 import type { DatabaseConnection } from "@netlify/database";
 import type { NetlifyDB } from "@netlify/database-dev";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
-import { serializeJson } from "../../../db/schema.js";
+import { serializeJson } from "#db/schema";
 import { resetTestDatabase, startTestDatabase, stopTestDatabase } from "../database.js";
 
 interface StoredReport {
@@ -110,7 +110,7 @@ beforeAll(async () => {
   vi.stubEnv("NETLIFY_DB_URL", started.connectionString);
   vi.stubEnv("NETLIFY_DB_DRIVER", "server");
   vi.resetModules();
-  database = (await import("../../../db/index.js")).getDb();
+  database = (await import("#db/index")).getDb();
   const reports = await import("../../functions/reports.js");
   handler = reports.default;
   config = reports.config;
diff --git a/netlify/tests/functions/trust-reruns.test.ts b/netlify/tests/functions/trust-reruns.test.ts
index e707c5f..87c0528 100644
--- a/netlify/tests/functions/trust-reruns.test.ts
+++ b/netlify/tests/functions/trust-reruns.test.ts
@@ -2,7 +2,7 @@
 import type { DatabaseConnection } from "@netlify/database";
 import type { NetlifyDB } from "@netlify/database-dev";
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
-import { serializeJson } from "../../../db/schema.js";
+import { serializeJson } from "#db/schema";
 import { resetTestDatabase, startTestDatabase, stopTestDatabase } from "../database.js";
 
 const defaultAuditResult = {
@@ -27,11 +27,11 @@ const defaultAuditResult = {
   failures: [],
 };
 
-const runAudit = vi.fn<typeof import("../../../src/lib/runAudit.js").runAudit>();
+const runAudit = vi.fn<typeof import("#audit/runAudit").runAudit>();
 
 let database: DatabaseConnection;
 let local: NetlifyDB;
-let schedules: typeof import("../../functions/_shared/report-schedules.js");
+let schedules: typeof import("#node/report-schedules");
 
 async function seedSchedule(): Promise<void> {
   await database.sql`
@@ -90,9 +90,9 @@ beforeAll(async () => {
   vi.stubEnv("NETLIFY_DB_URL", started.connectionString);
   vi.stubEnv("NETLIFY_DB_DRIVER", "server");
   vi.resetModules();
-  vi.doMock("../../../src/lib/runAudit.js", () => ({ runAudit }));
-  database = (await import("../../../db/index.js")).getDb();
-  schedules = await import("../../functions/_shared/report-schedules.js");
+  vi.doMock("#audit/runAudit", () => ({ runAudit }));
+  database = (await import("#db/index")).getDb();
+  schedules = await import("#node/report-schedules");
 });
 
 beforeEach(async () => {
@@ -108,7 +108,7 @@ afterEach(() => vi.useRealTimers());
 
 afterAll(async () => {
   await stopTestDatabase(local, database);
-  vi.doUnmock("../../../src/lib/runAudit.js");
+  vi.doUnmock("#audit/runAudit");
   vi.unstubAllEnvs();
 });
 
diff --git a/package.json b/package.json
index d642dae..0b4d7e8 100644
--- a/package.json
+++ b/package.json
@@ -5,6 +5,14 @@
   "description": "A browser-based supply-chain audit tool for npm organizations: trusted-publishing/provenance rollout, manual publishes, and external maintainers.",
   "license": "MIT",
   "type": "module",
+  "imports": {
+    "#audit/*": "./src/audit/*.ts",
+    "#client/*": "./src/client/*.ts",
+    "#db/*": "./db/*.ts",
+    "#node/*": "./netlify/functions/_shared/*.ts",
+    "#server/*": "./netlify/_shared/*.ts",
+    "#shared/*": "./src/shared/*.ts"
+  },
   "scripts": {
     "build": "vite build",
     "build:analyze": "rm -rf .sonda/ && SONDA=true vite build",
diff --git a/src/App.svelte b/src/App.svelte
index 7df9ef8..141a9fe 100644
--- a/src/App.svelte
+++ b/src/App.svelte
@@ -17,12 +17,11 @@
     MAX_ORGS,
     blockedOrgMessage,
     isBlockedOrg,
-  } from "./lib/auditDefaults";
-  import { streamAudit } from "./lib/auditStream";
-  import { parseMembers } from "./lib/members";
-  import type { AuditResult } from "./lib/runAudit";
-  import type { ReportKind, UserPublishReport } from "./lib/types";
-  import { streamUserPublishes } from "./lib/userPublishStream";
+  } from "#shared/auditDefaults";
+  import { streamAudit } from "#client/auditStream";
+  import { parseMembers } from "#client/members";
+  import type { AuditResult, ReportKind, UserPublishReport } from "#shared/types";
+  import { streamUserPublishes } from "#client/userPublishStream";
 
   type TerminalHandle = {
     writeLine: (line: string) => void;
diff --git a/src/App.test.ts b/src/App.test.ts
index 934d783..ba7fff4 100644
--- a/src/App.test.ts
+++ b/src/App.test.ts
@@ -3,18 +3,18 @@ import userEvent from "@testing-library/user-event";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import App from "./App.svelte";
 import { auditResult } from "./test/fixtures";
-import { streamAudit } from "./lib/auditStream";
-import { formatCompactDateTime } from "./lib/dateFormatting";
-import { streamUserPublishes } from "./lib/userPublishStream";
+import { streamAudit } from "#client/auditStream";
+import { formatCompactDateTime } from "#client/dateFormatting";
+import { streamUserPublishes } from "#client/userPublishStream";
 import { mockFetch, mockResolvedFetch } from "./test/mock";
 import { requestUrl } from "./test/request";
 
 // Both server-side workflows stream through these client adapters.
-vi.mock("./lib/auditStream", () => ({
-  streamAudit: vi.fn<typeof import("./lib/auditStream").streamAudit>(),
+vi.mock("#client/auditStream", () => ({
+  streamAudit: vi.fn<typeof import("#client/auditStream").streamAudit>(),
 }));
-vi.mock("./lib/userPublishStream", () => ({
-  streamUserPublishes: vi.fn<typeof import("./lib/userPublishStream").streamUserPublishes>(),
+vi.mock("#client/userPublishStream", () => ({
+  streamUserPublishes: vi.fn<typeof import("#client/userPublishStream").streamUserPublishes>(),
 }));
 
 const mockedStreamAudit = vi.mocked(streamAudit);
diff --git a/src/AppRouter.test.ts b/src/AppRouter.test.ts
index e7bc875..a27a501 100644
--- a/src/AppRouter.test.ts
+++ b/src/AppRouter.test.ts
@@ -2,7 +2,7 @@ import { render, screen, waitFor } from "@testing-library/svelte";
 import userEvent from "@testing-library/user-event";
 import { afterEach, describe, expect, test, vi } from "vitest";
 import AppRouter from "./AppRouter.svelte";
-import { formatDateTime } from "./lib/dateFormatting";
+import { formatDateTime } from "#client/dateFormatting";
 import { auditResult, trustReport } from "./test/fixtures";
 import { mockFetch, mockResolvedFetch } from "./test/mock";
 import { requestUrl } from "./test/request";
diff --git a/src/SharedReport.svelte b/src/SharedReport.svelte
index f3cfe5f..059f2d0 100644
--- a/src/SharedReport.svelte
+++ b/src/SharedReport.svelte
@@ -8,10 +8,10 @@
   import ThemeToggle from "./components/ThemeToggle.svelte";
   import TrustGlossary from "./components/TrustGlossary.svelte";
   import Logo from "./components/Logo.svelte";
-  import { formatDate, formatDateTime } from "./lib/dateFormatting";
-  import type { ReportHistoryResponse } from "./lib/reportHistory";
-  import type { AuditResult } from "./lib/runAudit";
-  import { parseOrNull, ReportHistoryResponseSchema, ReportRecordSchema } from "./lib/schemas";
+  import { formatDate, formatDateTime } from "#client/dateFormatting";
+  import type { ReportHistoryResponse } from "#shared/reportHistory";
+  import { parseOrNull, ReportHistoryResponseSchema, ReportRecordSchema } from "#shared/schemas";
+  import type { AuditResult } from "#shared/types";
 
   interface ReportRecord {
     id: string;
diff --git a/src/SharedReport.test.ts b/src/SharedReport.test.ts
index c43ca64..d3bc928 100644
--- a/src/SharedReport.test.ts
+++ b/src/SharedReport.test.ts
@@ -1,7 +1,7 @@
 import { render, screen, waitFor } from "@testing-library/svelte";
 import { afterEach, describe, expect, test, vi } from "vitest";
 import SharedReport from "./SharedReport.svelte";
-import { formatCompactDateTime, formatDate, formatDateTime } from "./lib/dateFormatting";
+import { formatCompactDateTime, formatDate, formatDateTime } from "#client/dateFormatting";
 import { auditResult, trustReport } from "./test/fixtures";
 import { mockFetch, mockResolvedFetch } from "./test/mock";
 import { requestUrl } from "./test/request";
diff --git a/src/lib/concurrency.test.ts b/src/audit/concurrency.test.ts
similarity index 100%
rename from src/lib/concurrency.test.ts
rename to src/audit/concurrency.test.ts
diff --git a/src/lib/concurrency.ts b/src/audit/concurrency.ts
similarity index 100%
rename from src/lib/concurrency.ts
rename to src/audit/concurrency.ts
diff --git a/src/lib/discovery.test.ts b/src/audit/discovery.test.ts
similarity index 100%
rename from src/lib/discovery.test.ts
rename to src/audit/discovery.test.ts
diff --git a/src/lib/discovery.ts b/src/audit/discovery.ts
similarity index 95%
rename from src/lib/discovery.ts
rename to src/audit/discovery.ts
index 211a492..2e15069 100644
--- a/src/lib/discovery.ts
+++ b/src/audit/discovery.ts
@@ -1,8 +1,8 @@
 /* eslint-disable no-await-in-loop -- Discovery intentionally resolves orgs and fast-npm-meta batches in a bounded sequence so failures stay attributable and upstream request shape matches the shell reference. */
 import * as v from "valibot";
-import { chunk } from "./concurrency.ts";
-import { FailureLog, npmGet, npmGetJson } from "./npmClient.ts";
-import type { PkgMeta } from "./types.ts";
+import { chunk } from "#audit/concurrency";
+import { FailureLog, npmGet, npmGetJson } from "#audit/npmClient";
+import type { PkgMeta } from "#shared/types";
 
 // ---------------------------------------------------------------------------
 // Org package discovery and fast-npm-meta batch metadata resolution.
diff --git a/src/lib/downloads.test.ts b/src/audit/downloads.test.ts
similarity index 100%
rename from src/lib/downloads.test.ts
rename to src/audit/downloads.test.ts
diff --git a/src/lib/downloads.ts b/src/audit/downloads.ts
similarity index 96%
rename from src/lib/downloads.ts
rename to src/audit/downloads.ts
index b94fd14..c788b7a 100644
--- a/src/lib/downloads.ts
+++ b/src/audit/downloads.ts
@@ -1,7 +1,7 @@
 /* eslint-disable no-await-in-loop -- api.npmjs.org has a strict token bucket; scoped downloads must remain sequential and paced. */
 import * as v from "valibot";
-import { chunk } from "./concurrency.ts";
-import { FailureLog, npmGetJson, sleep } from "./npmClient.ts";
+import { chunk } from "#audit/concurrency";
+import { FailureLog, npmGetJson, sleep } from "#audit/npmClient";
 
 // ---------------------------------------------------------------------------
 // Weekly download retrieval and pacing contract.
diff --git a/src/lib/npmClient.test.ts b/src/audit/npmClient.test.ts
similarity index 100%
rename from src/lib/npmClient.test.ts
rename to src/audit/npmClient.test.ts
diff --git a/src/lib/npmClient.ts b/src/audit/npmClient.ts
similarity index 99%
rename from src/lib/npmClient.ts
rename to src/audit/npmClient.ts
index 89c2c00..5e8be38 100644
--- a/src/lib/npmClient.ts
+++ b/src/audit/npmClient.ts
@@ -1,5 +1,5 @@
 /* eslint-disable no-await-in-loop -- Retry/backoff must wait between attempts; parallelizing retries would violate rate-limit handling. */
-import type { FetchFailure } from "./types.ts";
+import type { FetchFailure } from "#shared/types";
 import * as v from "valibot";
 
 // ---------------------------------------------------------------------------
diff --git a/src/lib/reports.test.ts b/src/audit/reports.test.ts
similarity index 99%
rename from src/lib/reports.test.ts
rename to src/audit/reports.test.ts
index 2ad690b..bb73aca 100644
--- a/src/lib/reports.test.ts
+++ b/src/audit/reports.test.ts
@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { FailureLog } from "./npmClient";
 import { discoverInScope, runExternal, runManual, runTrust, runUserPublishes } from "./reports";
-import type { AuditConfig } from "./types";
+import type { AuditConfig } from "#shared/types";
 import { requestUrl } from "../test/request";
 
 const config: AuditConfig = {
diff --git a/src/lib/reports.ts b/src/audit/reports.ts
similarity index 97%
rename from src/lib/reports.ts
rename to src/audit/reports.ts
index 27df0a5..f5dec76 100644
--- a/src/lib/reports.ts
+++ b/src/audit/reports.ts
@@ -1,10 +1,10 @@
 /* eslint-disable no-underscore-dangle -- npm packuments expose publisher metadata as the documented `_npmUser` field. */
 import * as v from "valibot";
-import { mapLimit } from "./concurrency.ts";
-import { resolveMeta, listOrgPackages } from "./discovery.ts";
-import { fetchWeeklyDownloads } from "./downloads.ts";
-import { FailureLog, npmGetJson, pkgUrl, toEpoch, versionUrl } from "./npmClient.ts";
-import { getTrustStatus } from "./trust.ts";
+import { mapLimit } from "#audit/concurrency";
+import { resolveMeta, listOrgPackages } from "#audit/discovery";
+import { fetchWeeklyDownloads } from "#audit/downloads";
+import { FailureLog, npmGetJson, pkgUrl, toEpoch, versionUrl } from "#audit/npmClient";
+import { getTrustStatus } from "#audit/trust";
 import type {
   AuditConfig,
   ExternalReport,
@@ -17,7 +17,7 @@ import type {
   TrustLevel,
   UserPublishReport,
   UserPublishRow,
-} from "./types.ts";
+} from "#shared/types";
 
 export type LogFn = (msg: string) => void;
 
diff --git a/src/lib/runAudit.test.ts b/src/audit/runAudit.test.ts
similarity index 98%
rename from src/lib/runAudit.test.ts
rename to src/audit/runAudit.test.ts
index 5175df9..9b5b5af 100644
--- a/src/lib/runAudit.test.ts
+++ b/src/audit/runAudit.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { runAudit } from "./runAudit";
 import { discoverInScope, runExternal, runManual, runTrust } from "./reports";
-import type { AuditConfig, PkgMeta } from "./types";
+import type { AuditConfig, PkgMeta } from "#shared/types";
 
 vi.mock("./reports", () => ({
   discoverInScope: vi.fn<typeof import("./reports").discoverInScope>(),
diff --git a/src/lib/runAudit.ts b/src/audit/runAudit.ts
similarity index 82%
rename from src/lib/runAudit.ts
rename to src/audit/runAudit.ts
index e62fb74..a242a2d 100644
--- a/src/lib/runAudit.ts
+++ b/src/audit/runAudit.ts
@@ -1,20 +1,6 @@
-import { FailureLog } from "./npmClient.ts";
-import { discoverInScope, runExternal, runManual, runTrust, type LogFn } from "./reports.ts";
-import type {
-  AuditConfig,
-  ExternalReport,
-  FetchFailure,
-  ManualReport,
-  TrustReport,
-  ReportKind,
-} from "./types.ts";
-
-export interface AuditResult {
-  trust?: TrustReport;
-  manual?: ManualReport;
-  external?: ExternalReport;
-  failures: FetchFailure[];
-}
+import { FailureLog } from "#audit/npmClient";
+import { discoverInScope, runExternal, runManual, runTrust, type LogFn } from "#audit/reports";
+import type { AuditConfig, AuditResult, ReportKind } from "#shared/types";
 
 /**
  * Top-level audit orchestration.
diff --git a/src/lib/trust.test.ts b/src/audit/trust.test.ts
similarity index 100%
rename from src/lib/trust.test.ts
rename to src/audit/trust.test.ts
diff --git a/src/lib/trust.ts b/src/audit/trust.ts
similarity index 95%
rename from src/lib/trust.ts
rename to src/audit/trust.ts
index e53f8a7..699a664 100644
--- a/src/lib/trust.ts
+++ b/src/audit/trust.ts
@@ -5,7 +5,7 @@ import {
   getTrustStatus as getPackumetaTrustStatus,
   type TrustStatus as PackumetaTrustStatus,
 } from "packumeta";
-import type { TrustLevel, TrustStatus } from "./types.ts";
+import type { TrustLevel, TrustStatus } from "#shared/types";
 
 function publisherOf(manifest: unknown): string {
   if (typeof manifest !== "object" || manifest === null) return "?";
diff --git a/src/lib/auditStream.test.ts b/src/client/auditStream.test.ts
similarity index 100%
rename from src/lib/auditStream.test.ts
rename to src/client/auditStream.test.ts
diff --git a/src/lib/auditStream.ts b/src/client/auditStream.ts
similarity index 95%
rename from src/lib/auditStream.ts
rename to src/client/auditStream.ts
index f7a7e00..23bdb5c 100644
--- a/src/lib/auditStream.ts
+++ b/src/client/auditStream.ts
@@ -10,10 +10,9 @@
 // resume. The server keeps the audit running headless across reconnects and
 // replays only newer lines, so the terminal keeps scrolling and the report stays
 // complete however long the audit runs.
-import { readSseStream } from "./sseStream.ts";
-import { AuditResultSchema, AuditStreamDoneSchema, parseOrNull } from "./schemas.ts";
-import type { AuditResult } from "./runAudit.ts";
-import type { ReportKind } from "./types.ts";
+import { readSseStream } from "#client/sseStream";
+import { AuditResultSchema, AuditStreamDoneSchema, parseOrNull } from "#shared/schemas";
+import type { AuditResult, ReportKind } from "#shared/types";
 
 export interface AuditStreamRequest {
   orgs: string[];
diff --git a/src/lib/dateFormatting.test.ts b/src/client/dateFormatting.test.ts
similarity index 100%
rename from src/lib/dateFormatting.test.ts
rename to src/client/dateFormatting.test.ts
diff --git a/src/lib/dateFormatting.ts b/src/client/dateFormatting.ts
similarity index 100%
rename from src/lib/dateFormatting.ts
rename to src/client/dateFormatting.ts
diff --git a/src/lib/export.test.ts b/src/client/export.test.ts
similarity index 100%
rename from src/lib/export.test.ts
rename to src/client/export.test.ts
diff --git a/src/lib/export.ts b/src/client/export.ts
similarity index 100%
rename from src/lib/export.ts
rename to src/client/export.ts
diff --git a/src/lib/historyGroups.test.ts b/src/client/historyGroups.test.ts
similarity index 95%
rename from src/lib/historyGroups.test.ts
rename to src/client/historyGroups.test.ts
index f582df9..dfecb94 100644
--- a/src/lib/historyGroups.test.ts
+++ b/src/client/historyGroups.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
-import type { TrustLevel } from "./types";
-import type { ReportTrustHistoryPoint } from "./reportHistory";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
+import type { TrustLevel } from "#shared/types";
 import { groupTrustHistoryPoints } from "./historyGroups";
 
 function point(
diff --git a/src/lib/historyGroups.ts b/src/client/historyGroups.ts
similarity index 96%
rename from src/lib/historyGroups.ts
rename to src/client/historyGroups.ts
index f82e691..3dad609 100644
--- a/src/lib/historyGroups.ts
+++ b/src/client/historyGroups.ts
@@ -1,4 +1,4 @@
-import type { ReportTrustHistoryPoint } from "./reportHistory.ts";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
 
 export interface TrustHistoryPointGroup {
   start: ReportTrustHistoryPoint;
diff --git a/src/lib/members.test.ts b/src/client/members.test.ts
similarity index 100%
rename from src/lib/members.test.ts
rename to src/client/members.test.ts
diff --git a/src/lib/members.ts b/src/client/members.ts
similarity index 100%
rename from src/lib/members.ts
rename to src/client/members.ts
diff --git a/src/lib/sseStream.ts b/src/client/sseStream.ts
similarity index 100%
rename from src/lib/sseStream.ts
rename to src/client/sseStream.ts
diff --git a/src/lib/theme.svelte.ts b/src/client/theme.svelte.ts
similarity index 100%
rename from src/lib/theme.svelte.ts
rename to src/client/theme.svelte.ts
diff --git a/src/lib/theme.test.ts b/src/client/theme.test.ts
similarity index 100%
rename from src/lib/theme.test.ts
rename to src/client/theme.test.ts
diff --git a/src/lib/trustTrend.test.ts b/src/client/trustTrend.test.ts
similarity index 96%
rename from src/lib/trustTrend.test.ts
rename to src/client/trustTrend.test.ts
index 5572420..c50671b 100644
--- a/src/lib/trustTrend.test.ts
+++ b/src/client/trustTrend.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import type { ReportTrustHistoryPoint } from "./reportHistory";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
 import { spacedTrendDateIndices, trendDateCandidates } from "./trustTrend";
 
 function point(day: number, strong: number, any: number): ReportTrustHistoryPoint {
diff --git a/src/lib/trustTrend.ts b/src/client/trustTrend.ts
similarity index 98%
rename from src/lib/trustTrend.ts
rename to src/client/trustTrend.ts
index 3a42c26..143e515 100644
--- a/src/lib/trustTrend.ts
+++ b/src/client/trustTrend.ts
@@ -3,7 +3,7 @@ import {
   strongTrustCount,
   trustPercent,
   type ReportTrustHistoryPoint,
-} from "./reportHistory.ts";
+} from "#shared/reportHistory";
 
 export interface TrendDateCandidate {
   index: number;
diff --git a/src/lib/userPublishStream.test.ts b/src/client/userPublishStream.test.ts
similarity index 100%
rename from src/lib/userPublishStream.test.ts
rename to src/client/userPublishStream.test.ts
diff --git a/src/lib/userPublishStream.ts b/src/client/userPublishStream.ts
similarity index 87%
rename from src/lib/userPublishStream.ts
rename to src/client/userPublishStream.ts
index a6b5e7a..20f24e8 100644
--- a/src/lib/userPublishStream.ts
+++ b/src/client/userPublishStream.ts
@@ -1,9 +1,9 @@
 // Client side of the server-run user-publishes lookup: POST to
 // /api/user-publishes-stream and consume its SSE stream (`log` → terminal,
 // `result` → the UserPublishReport). Runs server-side like the main audit.
-import { readSseStream } from "./sseStream.ts";
-import { UserPublishReportSchema, parseOrNull } from "./schemas.ts";
-import type { UserPublishReport } from "./types.ts";
+import { readSseStream } from "#client/sseStream";
+import { UserPublishReportSchema, parseOrNull } from "#shared/schemas";
+import type { UserPublishReport } from "#shared/types";
 
 export interface UserPublishStreamRequest {
   user: string;
diff --git a/src/components/DailyTrackingButton.svelte b/src/components/DailyTrackingButton.svelte
index 4e0f0ca..4653e27 100644
--- a/src/components/DailyTrackingButton.svelte
+++ b/src/components/DailyTrackingButton.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import { CalendarClock } from "@lucide/svelte";
-  import { formatCompactDateTime, formatDateTime } from "../lib/dateFormatting";
-  import type { ReportRerunScheduleStatus } from "../lib/reportHistory";
-  import { parseOrNull, ReportRerunScheduleStatusSchema } from "../lib/schemas";
+  import { formatCompactDateTime, formatDateTime } from "#client/dateFormatting";
+  import type { ReportRerunScheduleStatus } from "#shared/reportHistory";
+  import { parseOrNull, ReportRerunScheduleStatusSchema } from "#shared/schemas";
 
   interface Props {
     reportId: string | null;
diff --git a/src/components/DailyTrackingButton.test.ts b/src/components/DailyTrackingButton.test.ts
index a0b84a9..cb67811 100644
--- a/src/components/DailyTrackingButton.test.ts
+++ b/src/components/DailyTrackingButton.test.ts
@@ -1,7 +1,7 @@
 import { render, screen } from "@testing-library/svelte";
 import userEvent from "@testing-library/user-event";
 import { afterEach, describe, expect, test, vi } from "vitest";
-import { formatCompactDateTime, formatDateTime } from "../lib/dateFormatting";
+import { formatCompactDateTime, formatDateTime } from "#client/dateFormatting";
 import { mockFetch, mockResolvedFetch } from "../test/mock";
 import DailyTrackingButton from "./DailyTrackingButton.svelte";
 
diff --git a/src/components/ExportButtons.svelte b/src/components/ExportButtons.svelte
index ec95667..c804d3d 100644
--- a/src/components/ExportButtons.svelte
+++ b/src/components/ExportButtons.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { copyJson, downloadCsv, toCsv } from "../lib/export";
+  import { copyJson, downloadCsv, toCsv } from "#client/export";
 
   interface Props {
     label: string;
diff --git a/src/components/ExternalView.svelte b/src/components/ExternalView.svelte
index 9ed8736..69af6a3 100644
--- a/src/components/ExternalView.svelte
+++ b/src/components/ExternalView.svelte
@@ -3,7 +3,7 @@
   import type { Column } from "./dataTableTypes";
   import ExportButtons from "./ExportButtons.svelte";
   import Stat from "./Stat.svelte";
-  import type { ExternalReport } from "../lib/types";
+  import type { ExternalReport } from "#shared/types";
 
   interface Props {
     report: ExternalReport;
diff --git a/src/components/HistoryPanel.svelte b/src/components/HistoryPanel.svelte
index b5e18e9..14cdbd7 100644
--- a/src/components/HistoryPanel.svelte
+++ b/src/components/HistoryPanel.svelte
@@ -3,16 +3,16 @@
   import HistoryStack from "./HistoryStack.svelte";
   import Stat from "./Stat.svelte";
   import TrustTrend from "./TrustTrend.svelte";
-  import { formatDate, formatDateTime } from "../lib/dateFormatting";
-  import { groupTrustHistoryPoints } from "../lib/historyGroups";
+  import { formatDate, formatDateTime } from "#client/dateFormatting";
+  import { groupTrustHistoryPoints } from "#client/historyGroups";
   import {
     anyTrustCount,
     strongTrustCount,
     trustPercent,
     type ReportHistoryResponse,
     type ReportTrustHistoryPoint,
-  } from "../lib/reportHistory";
-  import { parseOrNull, ReportHistoryResponseSchema } from "../lib/schemas";
+  } from "#shared/reportHistory";
+  import { parseOrNull, ReportHistoryResponseSchema } from "#shared/schemas";
 
   interface Props {
     orgs: string[];
diff --git a/src/components/HistoryPanel.test.ts b/src/components/HistoryPanel.test.ts
index a36b069..0b17197 100644
--- a/src/components/HistoryPanel.test.ts
+++ b/src/components/HistoryPanel.test.ts
@@ -2,8 +2,8 @@ import { fireEvent, render, screen, within } from "@testing-library/svelte";
 import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { mockFetch, mockResolvedFetch } from "../test/mock";
-import { formatDate, formatDateTime } from "../lib/dateFormatting";
-import type { ReportHistoryResponse, ReportTrustHistoryPoint } from "../lib/reportHistory";
+import { formatDate, formatDateTime } from "#client/dateFormatting";
+import type { ReportHistoryResponse, ReportTrustHistoryPoint } from "#shared/reportHistory";
 import HistoryPanel from "./HistoryPanel.svelte";
 
 function mockHistory(body: ReportHistoryResponse) {
diff --git a/src/components/HistoryStack.svelte b/src/components/HistoryStack.svelte
index e8164e5..02404fe 100644
--- a/src/components/HistoryStack.svelte
+++ b/src/components/HistoryStack.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
-  import { formatDate } from "../lib/dateFormatting";
-  import type { ReportTrustHistoryPoint } from "../lib/reportHistory";
-  import type { TrustLevel } from "../lib/types";
+  import { formatDate } from "#client/dateFormatting";
+  import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
+  import type { TrustLevel } from "#shared/types";
 
   interface Props {
     point: ReportTrustHistoryPoint;
diff --git a/src/components/HistoryStack.test.ts b/src/components/HistoryStack.test.ts
index 7e477de..eb8dff2 100644
--- a/src/components/HistoryStack.test.ts
+++ b/src/components/HistoryStack.test.ts
@@ -1,7 +1,7 @@
 import { fireEvent, render, screen } from "@testing-library/svelte";
 import { describe, expect, test } from "vitest";
-import { formatDate } from "../lib/dateFormatting";
-import type { ReportTrustHistoryPoint } from "../lib/reportHistory";
+import { formatDate } from "#client/dateFormatting";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
 import HistoryStack from "./HistoryStack.svelte";
 
 const point: ReportTrustHistoryPoint = {
diff --git a/src/components/ManualView.svelte b/src/components/ManualView.svelte
index 5834623..173b367 100644
--- a/src/components/ManualView.svelte
+++ b/src/components/ManualView.svelte
@@ -3,8 +3,8 @@
   import type { Column } from "./dataTableTypes";
   import ExportButtons from "./ExportButtons.svelte";
   import Stat from "./Stat.svelte";
-  import { formatDateTime } from "../lib/dateFormatting";
-  import type { ManualReport, ManualRow } from "../lib/types";
+  import { formatDateTime } from "#client/dateFormatting";
+  import type { ManualReport, ManualRow } from "#shared/types";
 
   interface Props {
     report: ManualReport;
diff --git a/src/components/RecentReports.svelte b/src/components/RecentReports.svelte
index 46ec47e..7c142f9 100644
--- a/src/components/RecentReports.svelte
+++ b/src/components/RecentReports.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
-  import { formatDate, formatDateTime } from "../lib/dateFormatting";
-  import type { RecentTrustReportLink, RecentTrustReportsResponse } from "../lib/reportHistory";
-  import { parseOrNull, RecentTrustReportsResponseSchema } from "../lib/schemas";
+  import { formatDate, formatDateTime } from "#client/dateFormatting";
+  import type { RecentTrustReportLink, RecentTrustReportsResponse } from "#shared/reportHistory";
+  import { parseOrNull, RecentTrustReportsResponseSchema } from "#shared/schemas";
 
   let reports = $state<RecentTrustReportLink[]>([]);
   let loading = $state(true);
diff --git a/src/components/RecentReports.test.ts b/src/components/RecentReports.test.ts
index c1a5013..7ccf3cb 100644
--- a/src/components/RecentReports.test.ts
+++ b/src/components/RecentReports.test.ts
@@ -1,8 +1,8 @@
 import { render, screen } from "@testing-library/svelte";
 import { beforeEach, describe, expect, test, vi } from "vitest";
 import { mockFetch, mockResolvedFetch } from "../test/mock";
-import { formatDate, formatDateTime } from "../lib/dateFormatting";
-import type { RecentTrustReportsResponse } from "../lib/reportHistory";
+import { formatDate, formatDateTime } from "#client/dateFormatting";
+import type { RecentTrustReportsResponse } from "#shared/reportHistory";
 import RecentReports from "./RecentReports.svelte";
 
 function mockRecentReports(body: RecentTrustReportsResponse) {
diff --git a/src/components/ResultsView.svelte b/src/components/ResultsView.svelte
index 9eb8d95..bd8e36c 100644
--- a/src/components/ResultsView.svelte
+++ b/src/components/ResultsView.svelte
@@ -2,8 +2,7 @@
   import ExternalView from "./ExternalView.svelte";
   import ManualView from "./ManualView.svelte";
   import TrustView from "./TrustView.svelte";
-  import type { AuditResult } from "../lib/runAudit";
-  import type { ReportKind } from "../lib/types";
+  import type { AuditResult, ReportKind } from "#shared/types";
 
   const TAB_META: { kind: ReportKind; title: string }[] = [
     { kind: "trust", title: "package trust level" },
diff --git a/src/components/ResultsView.test.ts b/src/components/ResultsView.test.ts
index 7cbdaf8..5e57df6 100644
--- a/src/components/ResultsView.test.ts
+++ b/src/components/ResultsView.test.ts
@@ -1,7 +1,7 @@
 import { render, screen } from "@testing-library/svelte";
 import userEvent from "@testing-library/user-event";
 import { afterEach, describe, expect, test, vi } from "vitest";
-import { formatDate, formatDateTime } from "../lib/dateFormatting";
+import { formatDate, formatDateTime } from "#client/dateFormatting";
 import ResultsView from "./ResultsView.svelte";
 import { auditResult, trustReport } from "../test/fixtures";
 
diff --git a/src/components/SamplePreview.svelte b/src/components/SamplePreview.svelte
index fd8808f..63f3ed4 100644
--- a/src/components/SamplePreview.svelte
+++ b/src/components/SamplePreview.svelte
@@ -1,10 +1,10 @@
 <script lang="ts">
   import Stat from "./Stat.svelte";
   import TrustTrend from "./TrustTrend.svelte";
-  import { formatDate } from "../lib/dateFormatting";
-  import { EXAMPLE_TRUST_HISTORY_POINTS } from "../lib/exampleTrustHistory.ts";
-  import { anyTrustCount, strongTrustCount, trustPercent } from "../lib/reportHistory";
-  import type { TrustLevel } from "../lib/types";
+  import { formatDate } from "#client/dateFormatting";
+  import { EXAMPLE_TRUST_HISTORY_POINTS } from "#shared/exampleTrustHistory";
+  import { anyTrustCount, strongTrustCount, trustPercent } from "#shared/reportHistory";
+  import type { TrustLevel } from "#shared/types";
 
   // A static, illustrative report so first-time visitors see what npm.report
   // produces before running one. It reuses the real Stat tiles and trust-level
diff --git a/src/components/ThemeToggle.svelte b/src/components/ThemeToggle.svelte
index 5c8c9eb..9ece737 100644
--- a/src/components/ThemeToggle.svelte
+++ b/src/components/ThemeToggle.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { Monitor, Moon, Sun } from "@lucide/svelte";
-  import { initTheme, setThemeMode, themeState, type ThemeMode } from "../lib/theme.svelte";
+  import { initTheme, setThemeMode, themeState, type ThemeMode } from "#client/theme.svelte";
 
   const MODES: { mode: ThemeMode; label: string }[] = [
     { mode: "system", label: "System" },
diff --git a/src/components/ThemeToggle.test.ts b/src/components/ThemeToggle.test.ts
index bb1a5b1..aa94c22 100644
--- a/src/components/ThemeToggle.test.ts
+++ b/src/components/ThemeToggle.test.ts
@@ -1,7 +1,7 @@
 import { render, screen } from "@testing-library/svelte";
 import userEvent from "@testing-library/user-event";
 import { describe, expect, test, vi } from "vitest";
-import { THEME_STORAGE_KEY } from "../lib/theme.svelte";
+import { THEME_STORAGE_KEY } from "#client/theme.svelte";
 import ThemeToggle from "./ThemeToggle.svelte";
 
 function stubMatchMedia(matches: boolean) {
diff --git a/src/components/TrustTrend.svelte b/src/components/TrustTrend.svelte
index b0f010d..79daa92 100644
--- a/src/components/TrustTrend.svelte
+++ b/src/components/TrustTrend.svelte
@@ -1,12 +1,12 @@
 <script lang="ts">
-  import { formatChartDate, formatDate, formatDateTime } from "../lib/dateFormatting";
+  import { formatChartDate, formatDate, formatDateTime } from "#client/dateFormatting";
   import {
     anyTrustCount,
     strongTrustCount,
     trustPercent,
     type ReportTrustHistoryPoint,
-  } from "../lib/reportHistory";
-  import { spacedTrendDateIndices, trendDateCandidates } from "../lib/trustTrend";
+  } from "#shared/reportHistory";
+  import { spacedTrendDateIndices, trendDateCandidates } from "#client/trustTrend";
 
   interface Props {
     points: ReportTrustHistoryPoint[];
diff --git a/src/components/TrustTrend.test.ts b/src/components/TrustTrend.test.ts
index 8ef16ce..2e69014 100644
--- a/src/components/TrustTrend.test.ts
+++ b/src/components/TrustTrend.test.ts
@@ -1,7 +1,7 @@
 import { fireEvent, render, screen } from "@testing-library/svelte";
 import { describe, expect, test } from "vitest";
-import { formatChartDate, formatDateTime } from "../lib/dateFormatting";
-import type { ReportTrustHistoryPoint } from "../lib/reportHistory";
+import { formatChartDate, formatDateTime } from "#client/dateFormatting";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
 import TrustTrend from "./TrustTrend.svelte";
 
 const points: ReportTrustHistoryPoint[] = [
diff --git a/src/components/TrustView.svelte b/src/components/TrustView.svelte
index e5d73de..9dcf3f5 100644
--- a/src/components/TrustView.svelte
+++ b/src/components/TrustView.svelte
@@ -3,8 +3,8 @@
   import type { Column } from "./dataTableTypes";
   import ExportButtons from "./ExportButtons.svelte";
   import Stat from "./Stat.svelte";
-  import { formatDate, formatDateTime } from "../lib/dateFormatting";
-  import type { TrustReport, TrustRow } from "../lib/types";
+  import { formatDate, formatDateTime } from "#client/dateFormatting";
+  import type { TrustReport, TrustRow } from "#shared/types";
   import { LEVEL_LABEL, LEVEL_ORDER, yn } from "./reportFormatting";
 
   interface Props {
diff --git a/src/components/UserPublishView.svelte b/src/components/UserPublishView.svelte
index 92588fc..bbf87db 100644
--- a/src/components/UserPublishView.svelte
+++ b/src/components/UserPublishView.svelte
@@ -3,8 +3,8 @@
   import type { Column } from "./dataTableTypes";
   import ExportButtons from "./ExportButtons.svelte";
   import Stat from "./Stat.svelte";
-  import { formatDateTime } from "../lib/dateFormatting";
-  import type { UserPublishReport, UserPublishRow } from "../lib/types";
+  import { formatDateTime } from "#client/dateFormatting";
+  import type { UserPublishReport, UserPublishRow } from "#shared/types";
 
   interface Props {
     report: UserPublishReport;
diff --git a/src/components/UserPublishView.test.ts b/src/components/UserPublishView.test.ts
index 003ffd5..e71c889 100644
--- a/src/components/UserPublishView.test.ts
+++ b/src/components/UserPublishView.test.ts
@@ -1,6 +1,6 @@
 import { render, screen } from "@testing-library/svelte";
 import { describe, expect, test, vi } from "vitest";
-import { formatDateTime } from "../lib/dateFormatting";
+import { formatDateTime } from "#client/dateFormatting";
 import UserPublishView from "./UserPublishView.svelte";
 
 describe("UserPublishView", () => {
diff --git a/src/components/reportFormatting.ts b/src/components/reportFormatting.ts
index 5725ec6..22c092f 100644
--- a/src/components/reportFormatting.ts
+++ b/src/components/reportFormatting.ts
@@ -1,4 +1,4 @@
-import type { TrustLevel } from "../lib/types";
+import type { TrustLevel } from "#shared/types";
 
 export const LEVEL_ORDER: Record<TrustLevel, number> = {
   none: 0,
diff --git a/src/lib/auditDefaults.ts b/src/shared/auditDefaults.ts
similarity index 100%
rename from src/lib/auditDefaults.ts
rename to src/shared/auditDefaults.ts
diff --git a/src/lib/exampleTrustHistory.ts b/src/shared/exampleTrustHistory.ts
similarity index 95%
rename from src/lib/exampleTrustHistory.ts
rename to src/shared/exampleTrustHistory.ts
index 6fd1e96..a23f8ca 100644
--- a/src/lib/exampleTrustHistory.ts
+++ b/src/shared/exampleTrustHistory.ts
@@ -1,4 +1,4 @@
-import type { ReportTrustHistoryPoint } from "./reportHistory.ts";
+import type { ReportTrustHistoryPoint } from "#shared/reportHistory";
 
 export interface ExampleTrustHistorySnapshot {
   capturedAt: string;
diff --git a/src/lib/reportHistory.test.ts b/src/shared/reportHistory.test.ts
similarity index 100%
rename from src/lib/reportHistory.test.ts
rename to src/shared/reportHistory.test.ts
diff --git a/src/lib/reportHistory.ts b/src/shared/reportHistory.ts
similarity index 96%
rename from src/lib/reportHistory.ts
rename to src/shared/reportHistory.ts
index 2c4bd16..4289ca8 100644
--- a/src/lib/reportHistory.ts
+++ b/src/shared/reportHistory.ts
@@ -1,5 +1,5 @@
-import { parseOrNull, TrustHistoryPayloadSchema } from "./schemas.ts";
-import type { TrustLevel } from "./types.ts";
+import { parseOrNull, TrustHistoryPayloadSchema } from "#shared/schemas";
+import type { TrustLevel } from "#shared/types";
 
 export type SharedReportScope = "all" | { months: number };
 
diff --git a/src/lib/schemas.ts b/src/shared/schemas.ts
similarity index 99%
rename from src/lib/schemas.ts
rename to src/shared/schemas.ts
index 702d762..b19e687 100644
--- a/src/lib/schemas.ts
+++ b/src/shared/schemas.ts
@@ -7,7 +7,7 @@
 // Objects use `looseObject` so unknown/extra keys pass through — we validate the
 // fields the app actually reads, not the exact shape.
 import * as v from "valibot";
-import { MAX_ORGS } from "./auditDefaults.ts";
+import { MAX_ORGS } from "#shared/auditDefaults";
 
 const TrustLevel = v.picklist(["stagedPublish", "trustedPublisher", "provenance", "none"]);
 
diff --git a/src/lib/types.ts b/src/shared/types.ts
similarity index 94%
rename from src/lib/types.ts
rename to src/shared/types.ts
index b367252..1514575 100644
--- a/src/lib/types.ts
+++ b/src/shared/types.ts
@@ -105,3 +105,10 @@ export interface FetchFailure {
   url: string;
   reason: string;
 }
+
+export interface AuditResult {
+  trust?: TrustReport;
+  manual?: ManualReport;
+  external?: ExternalReport;
+  failures: FetchFailure[];
+}
diff --git a/src/test/fixtures.ts b/src/test/fixtures.ts
index 8e6f5eb..e9da7bc 100644
--- a/src/test/fixtures.ts
+++ b/src/test/fixtures.ts
@@ -1,5 +1,4 @@
-import type { AuditResult } from "../lib/runAudit";
-import type { TrustReport } from "../lib/types";
+import type { AuditResult, TrustReport } from "#shared/types";
 
 export const trustReport: TrustReport = {
   summary: {
diff --git a/src/test/setup.ts b/src/test/setup.ts
index b12f043..47ff7b0 100644
--- a/src/test/setup.ts
+++ b/src/test/setup.ts
@@ -2,7 +2,7 @@
 import "@testing-library/jest-dom/vitest";
 import { cleanup } from "@testing-library/svelte";
 import { afterEach, beforeEach, vi } from "vitest";
-import { resetThemeForTests, THEME_STORAGE_KEY } from "../lib/theme.svelte";
+import { resetThemeForTests, THEME_STORAGE_KEY } from "#client/theme.svelte";
 
 function createMemoryStorage(): Storage {
   const items = new Map<string, string>();
diff --git a/tsconfig.json b/tsconfig.json
index 6dc4c2d..5f19f55 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -18,9 +18,6 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
-    "noUncheckedSideEffectImports": true,
-    "paths": {
-      "@/*": ["./src/*"]
-    }
+    "noUncheckedSideEffectImports": true
   }
 }
diff --git a/vite.config.ts b/vite.config.ts
index afb32c3..e789d38 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -55,7 +55,7 @@ export default defineConfig({
         "src/**/*.{test,spec}.svelte.ts",
         "src/test/**",
         "src/vite-env.d.ts",
-        "src/lib/types.ts",
+        "src/shared/types.ts",
         "src/components/dataTableTypes.ts",
         "netlify/database/**",
       ],