diff --git a/e2e/playwright-utils.ts b/e2e/playwright-utils.ts
index 38311cbddf..07097cd2e4 100644
--- a/e2e/playwright-utils.ts
+++ b/e2e/playwright-utils.ts
@@ -6,7 +6,7 @@ import {
 	seedUserInE2eDatabase,
 } from './d1-utils.ts'
 import { ensurePrimaryUserExists, primaryTestUser } from './auth-test-user.ts'
-import { usernameFromEmail } from '../packages/worker/src/app/username.ts'
+import { usernameFromEmail } from '../packages/worker/src/identity/username.ts'
 
 export * from '@playwright/test'
 
diff --git a/packages/worker/client/app.tsx b/packages/worker/client/app.tsx
index 6c08c199e8..0cd4d6d3b4 100644
--- a/packages/worker/client/app.tsx
+++ b/packages/worker/client/app.tsx
@@ -24,7 +24,7 @@ import {
 	primaryLinkCss,
 } from './styles/style-primitives.ts'
 import { type AppLoaderData } from '#app/loader-data.ts'
-import { userHasRole } from '#app/permissions.ts'
+import { userHasRole } from '#worker/identity/permissions.ts'
 import { buildAuthLink } from './auth-links.ts'
 import { colors, mq, spacing, typography } from './styles/tokens.ts'
 import { WaitlistBanner } from './waitlist-banner.tsx'
diff --git a/packages/worker/client/routes/admin-users.tsx b/packages/worker/client/routes/admin-users.tsx
index 762d236e4d..4394e4e643 100644
--- a/packages/worker/client/routes/admin-users.tsx
+++ b/packages/worker/client/routes/admin-users.tsx
@@ -44,7 +44,7 @@ import {
 	formatMonthKeyLabel,
 	usageMetricSeries,
 } from '#client/charts/usage-metric-series.ts'
-import { type RoleName } from '#app/permissions.ts'
+import { type RoleName } from '#worker/identity/permissions.ts'
 import {
 	type AdminPlanName,
 	type AdminUserListItem,
diff --git a/packages/worker/client/session.ts b/packages/worker/client/session.ts
index 0202c26319..28dacb4a20 100644
--- a/packages/worker/client/session.ts
+++ b/packages/worker/client/session.ts
@@ -5,7 +5,7 @@ import {
 	roleNames,
 	type PermissionString,
 	type RoleName,
-} from '#app/permissions.ts'
+} from '#worker/identity/permissions.ts'
 import {
 	featureFlagKeys,
 	type FeatureFlagKey,
diff --git a/packages/worker/src/app/account-deletion-state.ts b/packages/worker/src/app/account-deletion-state.ts
deleted file mode 100644
index 945d18f16c..0000000000
--- a/packages/worker/src/app/account-deletion-state.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Compatibility re-export. Account deletion state and the account write lease
- * moved to `#worker/account/deletion-state.ts` so MCP capabilities and job
- * runners can take write leases without importing from the app layer.
- */
-export * from '#worker/account/deletion-state.ts'
diff --git a/packages/worker/src/app/account-package-invocation-tokens-data.ts b/packages/worker/src/app/account-package-invocation-tokens-data.ts
index 75c0ea6702..200e9509d3 100644
--- a/packages/worker/src/app/account-package-invocation-tokens-data.ts
+++ b/packages/worker/src/app/account-package-invocation-tokens-data.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { type AccountPackageInvocationTokensLoaderData } from '#app/loader-data.ts'
 import { type readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import {
diff --git a/packages/worker/src/app/app-base-url.ts b/packages/worker/src/app/app-base-url.ts
deleted file mode 100644
index 495e236360..0000000000
--- a/packages/worker/src/app/app-base-url.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Compatibility re-export. Public-origin resolution moved to
- * `#worker/app-base-url.ts` so MCP capabilities can resolve the app and
- * package-app origins without importing from the app layer.
- */
-export * from '#worker/app-base-url.ts'
diff --git a/packages/worker/src/app/audit-log.ts b/packages/worker/src/app/audit-log.ts
deleted file mode 100644
index 88f38456f6..0000000000
--- a/packages/worker/src/app/audit-log.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Compatibility re-export. The audit log sink moved to `#worker/audit-log.ts`
- * so MCP capabilities can record audit events without importing from the app
- * layer. Test doubles mock the canonical path, not this one — see
- * `#worker/test-support/audit-log-spy.ts`.
- */
-export * from '#worker/audit-log.ts'
diff --git a/packages/worker/src/app/handlers/account-jobs.node.test.ts b/packages/worker/src/app/handlers/account-jobs.node.test.ts
index f35c439be3..d3b425c6b5 100644
--- a/packages/worker/src/app/handlers/account-jobs.node.test.ts
+++ b/packages/worker/src/app/handlers/account-jobs.node.test.ts
@@ -118,7 +118,7 @@ vi.mock('#app/ssr-render.tsx', () => ({
 	renderAppPage: async () => new Response('ok'),
 }))
 
-vi.mock('#app/app-base-url.ts', () => ({
+vi.mock('#worker/app-base-url.ts', () => ({
 	getAppBaseUrl: (...args: Array<unknown>) => mockModule.getAppBaseUrl(...args),
 }))
 
diff --git a/packages/worker/src/app/handlers/account-jobs.ts b/packages/worker/src/app/handlers/account-jobs.ts
index 478d24cce8..708f16f9d2 100644
--- a/packages/worker/src/app/handlers/account-jobs.ts
+++ b/packages/worker/src/app/handlers/account-jobs.ts
@@ -5,7 +5,7 @@ import {
 	loadAccountJobsData,
 	type AccountJobsLoaderData,
 } from '#app/account-jobs-data.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import { type AccountJobsLoaderData as AppAccountJobsLoaderData } from '#app/loader-data.ts'
 import { requireAuthenticatedPageUser } from '#app/page-auth.ts'
diff --git a/packages/worker/src/app/handlers/account-mcp-servers.ts b/packages/worker/src/app/handlers/account-mcp-servers.ts
index 9ffaeb92d7..039101e43f 100644
--- a/packages/worker/src/app/handlers/account-mcp-servers.ts
+++ b/packages/worker/src/app/handlers/account-mcp-servers.ts
@@ -7,7 +7,7 @@ import { requireAuthenticatedPageUser } from '#app/page-auth.ts'
 import { readTrimmedStringOrEmpty } from '#app/request-body.ts'
 import { renderAppPage } from '#app/ssr-render.tsx'
 import { type routes } from '#app/routes.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { createMcpClientHubClient } from '#worker/mcp-client/hub-client.ts'
 import {
 	addMcpServer,
diff --git a/packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts b/packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
index 815e588a78..58161a31b4 100644
--- a/packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
+++ b/packages/worker/src/app/handlers/account-package-invocation-tokens.node.test.ts
@@ -82,7 +82,7 @@ vi.mock('#app/ssr-render.tsx', () => ({
 	renderAppPage: async () => new Response('ok'),
 }))
 
-vi.mock('#app/app-base-url.ts', () => ({
+vi.mock('#worker/app-base-url.ts', () => ({
 	getAppBaseUrl: (...args: Array<unknown>) => mockModule.getAppBaseUrl(...args),
 }))
 
diff --git a/packages/worker/src/app/handlers/account-profile.ts b/packages/worker/src/app/handlers/account-profile.ts
index 23294aa945..6a562caed6 100644
--- a/packages/worker/src/app/handlers/account-profile.ts
+++ b/packages/worker/src/app/handlers/account-profile.ts
@@ -4,7 +4,7 @@ import { jsonResponse } from '#worker/json-response.ts'
 import { type Action } from 'remix/router'
 import { getRequestIp, logAuditEvent } from '#worker/audit-log.ts'
 import { loadAccountProfileData } from '#app/account-profile-data.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import { getUniqueConstraintField } from '#worker/database-errors.ts'
 import { type ProfileVisibility } from '#app/loader-data.ts'
diff --git a/packages/worker/src/app/handlers/account-secrets.node.test.ts b/packages/worker/src/app/handlers/account-secrets.node.test.ts
index 1a24eea567..382793e188 100644
--- a/packages/worker/src/app/handlers/account-secrets.node.test.ts
+++ b/packages/worker/src/app/handlers/account-secrets.node.test.ts
@@ -105,7 +105,7 @@ vi.mock('#app/ssr-render.tsx', () => ({
 	renderAppPage: async () => new Response('ok'),
 }))
 
-vi.mock('#app/app-base-url.ts', () => ({
+vi.mock('#worker/app-base-url.ts', () => ({
 	getAppBaseUrl: (...args: Array<unknown>) => mockModule.getAppBaseUrl(...args),
 }))
 
diff --git a/packages/worker/src/app/handlers/account-secrets.ts b/packages/worker/src/app/handlers/account-secrets.ts
index 4d42347e0e..b1df5fc97e 100644
--- a/packages/worker/src/app/handlers/account-secrets.ts
+++ b/packages/worker/src/app/handlers/account-secrets.ts
@@ -13,7 +13,7 @@ import {
 	resolveApprovalRequest,
 	toPackageOptions,
 } from '#app/account-secrets-data.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import { loadConnectOauthNextSteps } from '#app/connect-oauth-next-steps.ts'
 import { renderAppPage } from '#app/ssr-render.tsx'
diff --git a/packages/worker/src/app/handlers/blog.tsx b/packages/worker/src/app/handlers/blog.tsx
index f49ff299b1..38c91ab66c 100644
--- a/packages/worker/src/app/handlers/blog.tsx
+++ b/packages/worker/src/app/handlers/blog.tsx
@@ -1,5 +1,5 @@
 import { type Action } from 'remix/router'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { type routes } from '#app/routes.ts'
 import { renderAppPage } from '#app/ssr-render.tsx'
 import {
diff --git a/packages/worker/src/app/handlers/community-install.ts b/packages/worker/src/app/handlers/community-install.ts
index 5cd4ef4910..1add24c86e 100644
--- a/packages/worker/src/app/handlers/community-install.ts
+++ b/packages/worker/src/app/handlers/community-install.ts
@@ -1,6 +1,6 @@
 import { z } from 'zod'
 import { type Action } from 'remix/router'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import {
 	buildInstallAdaptPrompt,
diff --git a/packages/worker/src/app/handlers/og-page-image.ts b/packages/worker/src/app/handlers/og-page-image.ts
index 70645cb0c5..2ebad2c551 100644
--- a/packages/worker/src/app/handlers/og-page-image.ts
+++ b/packages/worker/src/app/handlers/og-page-image.ts
@@ -1,5 +1,5 @@
 import { type Action } from 'remix/router'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { type routes } from '#app/routes.ts'
 import { getPublicOgPage } from '#worker/og/pages.ts'
 
diff --git a/packages/worker/src/app/handlers/package-app.node.test.ts b/packages/worker/src/app/handlers/package-app.node.test.ts
index 4524ec7bf0..050fcffaf8 100644
--- a/packages/worker/src/app/handlers/package-app.node.test.ts
+++ b/packages/worker/src/app/handlers/package-app.node.test.ts
@@ -73,7 +73,7 @@ vi.mock('#app/auth-redirect.ts', () => ({
 		mockModule.redirectToLogin(...args),
 }))
 
-vi.mock('#app/app-base-url.ts', () => ({
+vi.mock('#worker/app-base-url.ts', () => ({
 	getAppBaseUrl: (...args: Array<unknown>) => mockModule.getAppBaseUrl(...args),
 }))
 
diff --git a/packages/worker/src/app/handlers/package-app.ts b/packages/worker/src/app/handlers/package-app.ts
index bb0623a28a..879b47bbc7 100644
--- a/packages/worker/src/app/handlers/package-app.ts
+++ b/packages/worker/src/app/handlers/package-app.ts
@@ -3,7 +3,7 @@ import { html } from 'remix/html-template'
 import { createHtmlResponse } from 'remix/response/html'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import { redirectToLoginWhenUnauthenticated } from '#app/auth-redirect.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { type PackageAppOwner } from '#app/package-app-owner.ts'
 import { getUsernameFormatValidationError } from '#worker/identity/username.ts'
 import { getSavedPackageByKodyId } from '#worker/package-registry/repo.ts'
diff --git a/packages/worker/src/app/loader-data.ts b/packages/worker/src/app/loader-data.ts
index 579a66c43c..a9b164e23f 100644
--- a/packages/worker/src/app/loader-data.ts
+++ b/packages/worker/src/app/loader-data.ts
@@ -7,7 +7,10 @@ import {
 	type PublicCommunityStargazer,
 	type PublicProfilePackageItem,
 } from '#app/community-public-types.ts'
-import { type PermissionString, type RoleName } from '#app/permissions.ts'
+import {
+	type PermissionString,
+	type RoleName,
+} from '#worker/identity/permissions.ts'
 import { type AdminFeatureFlag } from '#worker/feature-flags/types.ts'
 
 export type { ProfileVisibility }
diff --git a/packages/worker/src/app/onboarding-data.ts b/packages/worker/src/app/onboarding-data.ts
index fb6bb607e4..25d1986306 100644
--- a/packages/worker/src/app/onboarding-data.ts
+++ b/packages/worker/src/app/onboarding-data.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { type OnboardingFeaturedListing } from '#app/community-public-types.ts'
 import { type OnboardingLoaderData } from '#app/loader-data.ts'
 
diff --git a/packages/worker/src/app/package-app-origin.ts b/packages/worker/src/app/package-app-origin.ts
index 4154c60e91..783fe4b949 100644
--- a/packages/worker/src/app/package-app-origin.ts
+++ b/packages/worker/src/app/package-app-origin.ts
@@ -1,6 +1,6 @@
 import { html } from 'remix/html-template'
 import { createHtmlResponse } from 'remix/response/html'
-import { getAppBaseUrl, getPackageAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl, getPackageAppBaseUrl } from '#worker/app-base-url.ts'
 import { redirectToLoginWhenUnauthenticated } from '#app/auth-redirect.ts'
 import { readAuthenticatedAppUser } from '#app/authenticated-user.ts'
 import { isSecureRequest } from '#app/auth-session.ts'
diff --git a/packages/worker/src/app/permissions.ts b/packages/worker/src/app/permissions.ts
deleted file mode 100644
index adb313fea1..0000000000
--- a/packages/worker/src/app/permissions.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * Compatibility re-export. The role/permission catalog moved to
- * `#worker/identity/permissions.ts` so MCP capabilities can enforce access
- * control without importing from the app layer. Client routes and loader-data
- * payload types still read the role names through this app-layer path.
- */
-export * from '#worker/identity/permissions.ts'
diff --git a/packages/worker/src/app/ssr-render.tsx b/packages/worker/src/app/ssr-render.tsx
index d92721081c..013f82e1de 100644
--- a/packages/worker/src/app/ssr-render.tsx
+++ b/packages/worker/src/app/ssr-render.tsx
@@ -7,7 +7,7 @@ import {
 	buildStylesheetHref,
 	getClientBuildId,
 } from '#app/client-build-id.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { setAuthSessionSecret } from '#app/auth-session.ts'
 import {
 	absolutizeDocumentHead,
diff --git a/packages/worker/src/app/user-lookup.ts b/packages/worker/src/app/user-lookup.ts
deleted file mode 100644
index 9249cc0928..0000000000
--- a/packages/worker/src/app/user-lookup.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Compatibility re-export. Public user identity lookups moved to
- * `#worker/identity/user-lookup.ts` so MCP capabilities can resolve usernames
- * without importing from the app layer.
- */
-export * from '#worker/identity/user-lookup.ts'
diff --git a/packages/worker/src/app/username.ts b/packages/worker/src/app/username.ts
deleted file mode 100644
index 04a3b542f9..0000000000
--- a/packages/worker/src/app/username.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-/**
- * Compatibility re-export. Username normalization and validation moved to
- * `#worker/identity/username.ts` so MCP capabilities and package runtimes can
- * validate usernames without importing from the app layer.
- */
-export * from '#worker/identity/username.ts'
diff --git a/packages/worker/src/community/activity-package-subscriptions.ts b/packages/worker/src/community/activity-package-subscriptions.ts
index 0c085f92e1..1dac0f386c 100644
--- a/packages/worker/src/community/activity-package-subscriptions.ts
+++ b/packages/worker/src/community/activity-package-subscriptions.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { dispatchAdminPackageSubscriptionEvent } from '#worker/package-invocations/admin-package-subscriptions.ts'
 import {
 	buildCommunityActivityRecordedEvent,
diff --git a/packages/worker/src/email/package-subscriptions.ts b/packages/worker/src/email/package-subscriptions.ts
index b2a5214038..3ef2e540b5 100644
--- a/packages/worker/src/email/package-subscriptions.ts
+++ b/packages/worker/src/email/package-subscriptions.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import {
 	dispatchAdminPackageSubscriptionEvent,
 	readPreExecutionPackageInvocationInfrastructureCode,
diff --git a/packages/worker/src/execute-maintenance.ts b/packages/worker/src/execute-maintenance.ts
index 90405717d4..a503c0bf13 100644
--- a/packages/worker/src/execute-maintenance.ts
+++ b/packages/worker/src/execute-maintenance.ts
@@ -1,5 +1,5 @@
 import { exports as workerExports } from 'cloudflare:workers'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { createExecuteExecutor } from '#mcp/executor.ts'
 import { handleSecretMaintenanceRequest } from './maintenance-handler.ts'
 import { getErrorMessage } from '@kody-internal/shared/error-message.ts'
diff --git a/packages/worker/src/index.ts b/packages/worker/src/index.ts
index 6932d3dce4..f3116ccc2b 100644
--- a/packages/worker/src/index.ts
+++ b/packages/worker/src/index.ts
@@ -40,7 +40,7 @@ import {
 import { withCors } from './utils.ts'
 import { normalizeRedirectTo } from '#app/auth-redirect.ts'
 import { checkRateLimit, authRateLimitConfig } from '#app/rate-limit.ts'
-import { getRequestIp } from '#app/audit-log.ts'
+import { getRequestIp } from '#worker/audit-log.ts'
 import { handleCapabilityReindexRequest } from './capability-maintenance.ts'
 import { handleExecuteSmokeRequest } from './execute-maintenance.ts'
 import { handleJobReindexRequest } from './job-maintenance.ts'
@@ -68,7 +68,7 @@ import { sweepStaleInboundDeliveries } from '#worker/email/reconcile-inbound-del
 import { pruneSystemEmailRetention } from '#worker/email/system-email.ts'
 import { refreshStaleStripePlans } from '#worker/billing/subscription-sync.ts'
 import { handleQueueBatch } from '#worker/queue-handler.ts'
-import { findPublicUserIdentityByUsername } from '#app/user-lookup.ts'
+import { findPublicUserIdentityByUsername } from '#worker/identity/user-lookup.ts'
 import { pruneRetention, shouldRunRetentionCron } from '#app/retention.ts'
 import { pruneJobRetention } from '#worker/jobs/job-retention-cleanup.ts'
 import {
diff --git a/packages/worker/src/jobs/service.ts b/packages/worker/src/jobs/service.ts
index 6bed5d9e49..d4b15cf4a0 100644
--- a/packages/worker/src/jobs/service.ts
+++ b/packages/worker/src/jobs/service.ts
@@ -1,6 +1,6 @@
 import { type McpCallerContext } from '@kody-internal/shared/chat.ts'
 import { type ExecuteResult } from '@cloudflare/codemode'
-import { withAccountWriteLease } from '#app/account-deletion-state.ts'
+import { withAccountWriteLease } from '#worker/account/deletion-state.ts'
 import { McpCallerError } from '#mcp/caller-error.ts'
 import { createMcpCallerContext, parseMcpCallerContext } from '#mcp/context.ts'
 import { buildJobEmbedText } from '#mcp/jobs-embed.ts'
diff --git a/packages/worker/src/mcp-auth.ts b/packages/worker/src/mcp-auth.ts
index 743af688dc..c6b9fb449f 100644
--- a/packages/worker/src/mcp-auth.ts
+++ b/packages/worker/src/mcp-auth.ts
@@ -3,7 +3,7 @@ import {
 	type TokenSummary,
 } from '@cloudflare/workers-oauth-provider'
 import { isAccountSuspended } from '#app/account-suspension.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { getRequestIp } from '#worker/audit-log.ts'
 import { isAccountEmailVerified } from '#worker/identity/email-verification-state.ts'
 import { buildMcpUserContextFromGrantProps } from './mcp-auth-user-context.ts'
diff --git a/packages/worker/src/oauth-handlers.ts b/packages/worker/src/oauth-handlers.ts
index 4adaec32d1..357180398d 100644
--- a/packages/worker/src/oauth-handlers.ts
+++ b/packages/worker/src/oauth-handlers.ts
@@ -25,7 +25,7 @@ import { invalidClientIdMismatchMessage } from '@kody-internal/shared/oauth-mess
 import { getUsernameFormatValidationError } from '#worker/identity/username.ts'
 import { getPkceValidationError } from '#worker/oauth-pkce.ts'
 import { oauthPaths } from '#app/oauth-paths.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { mcpResourcePath } from './mcp-auth.ts'
 
 export { oauthPaths }
diff --git a/packages/worker/src/package-invocations/http.ts b/packages/worker/src/package-invocations/http.ts
index 815cf680ee..6e91178026 100644
--- a/packages/worker/src/package-invocations/http.ts
+++ b/packages/worker/src/package-invocations/http.ts
@@ -1,6 +1,6 @@
 import { jsonResponse } from '#worker/json-response.ts'
 import { getRequestIp, logAuditEvent } from '#worker/audit-log.ts'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { findPublicUserIdentityByUsername } from '#worker/identity/user-lookup.ts'
 import {
 	AccountDeletionInProgressError,
diff --git a/packages/worker/src/package-runtime/package-workflows.ts b/packages/worker/src/package-runtime/package-workflows.ts
index 8095ac4ce3..a74a7abd2b 100644
--- a/packages/worker/src/package-runtime/package-workflows.ts
+++ b/packages/worker/src/package-runtime/package-workflows.ts
@@ -12,7 +12,7 @@ import {
 	type WorkflowEvent,
 	type WorkflowStep,
 } from 'cloudflare:workers'
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { createMcpCallerContext } from '#mcp/context.ts'
 import {
 	readPreExecutionPackageInvocationInfrastructureCode,
diff --git a/packages/worker/src/platform-feedback/package-subscriptions.ts b/packages/worker/src/platform-feedback/package-subscriptions.ts
index ba31c55a47..6a455bb48b 100644
--- a/packages/worker/src/platform-feedback/package-subscriptions.ts
+++ b/packages/worker/src/platform-feedback/package-subscriptions.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { dispatchAdminPackageSubscriptionEvent } from '#worker/package-invocations/admin-package-subscriptions.ts'
 import {
 	buildPlatformFeedbackSubmittedEvent,
diff --git a/packages/worker/src/run-records/package-subscriptions.ts b/packages/worker/src/run-records/package-subscriptions.ts
index 5295ca2a0d..2cef289037 100644
--- a/packages/worker/src/run-records/package-subscriptions.ts
+++ b/packages/worker/src/run-records/package-subscriptions.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { readPreExecutionPackageInvocationInfrastructureCode } from '#worker/package-invocations/admin-package-subscriptions.ts'
 import { invokePackageSubscription } from '#worker/package-invocations/service.ts'
 import { listPackageSubscriptions } from '#worker/package-registry/manifest.ts'
diff --git a/packages/worker/src/webhooks/http.ts b/packages/worker/src/webhooks/http.ts
index c5729a9042..14ba156e80 100644
--- a/packages/worker/src/webhooks/http.ts
+++ b/packages/worker/src/webhooks/http.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import {
 	AccountDeletionInProgressError,
 	assertAccountWritable,
diff --git a/packages/worker/src/webhooks/service.ts b/packages/worker/src/webhooks/service.ts
index 568b496513..98d444f23e 100644
--- a/packages/worker/src/webhooks/service.ts
+++ b/packages/worker/src/webhooks/service.ts
@@ -1,4 +1,4 @@
-import { getAppBaseUrl } from '#app/app-base-url.ts'
+import { getAppBaseUrl } from '#worker/app-base-url.ts'
 import { resolvePublicUsername } from '#worker/identity/user-lookup.ts'
 import {
 	listPackageWebhooks,
diff --git a/packages/worker/tsconfig-client.json b/packages/worker/tsconfig-client.json
index 1d489a3cf5..eb490e880f 100644
--- a/packages/worker/tsconfig-client.json
+++ b/packages/worker/tsconfig-client.json
@@ -20,7 +20,6 @@
 		"./client/**/*.tsx",
 		"./client/**/*.d.ts",
 		"./src/app/oauth-login-errors.ts",
-		"./src/app/permissions.ts",
 		"./src/app/routes.ts",
 		"./src/app/route-pattern.ts",
 		"./src/app/oauth-paths.ts",
diff --git a/tsconfig-tools.json b/tsconfig-tools.json
index a3490abc67..6eda72ec11 100644
--- a/tsconfig-tools.json
+++ b/tsconfig-tools.json
@@ -36,8 +36,8 @@
 		"./packages/worker/src/test-support/cloudflare-mock-server.ts",
 		"./tools/**/*.ts",
 		"./packages/shared/src/**/*.ts",
-		// Worker app modules imported by the seeding tools.
-		"./packages/worker/src/app/username.ts",
-		"./packages/worker/src/app/reserved-usernames.ts"
+		// Worker identity modules imported by the seeding tools.
+		"./packages/worker/src/identity/username.ts",
+		"./packages/worker/src/identity/reserved-usernames.ts"
 	]
 }