refactor: relocate gateway/{ecs,elbv2} to domains/{ecs,elbv2}/awsapi

Mechanical ADR-0001 relocation of the ECS and ELBv2 AWS action adapters to their domain homes, as #1265 did for IAM, STS, EKS and RDS. APIs, NATS subjects, KV buckets and behaviour are unchanged. The root gateway dispatch still imports both packages, recorded as gateway (service registration) debt; the quota live ELBv2 counter import moves with it.
2026-10-26 22:17:29 +00:00 · 2026-10-27 08:07:11 +10:00
66 changed files with 248 additions and 248 deletions
@@ -41,7 +41,7 @@ var allowlist = []allowance{
 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/volume", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "describe adapter used as a counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/vpc", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "describe adapter used as a counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/instancetypes", Debt: "domains/admission/quota → domains/ec2/instancetypes", Reason: "DefaultVCPUs sizing; needs a consumer-owned capability or EC2 projection"},
-	{From: "domains/admission/quota", To: "gateway/elbv2", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live ELBv2 counter; needs a reader capability"},
+	{From: "domains/admission/quota", To: "domains/elbv2/awsapi", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live ELBv2 counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/rds/instance", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live RDS counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "runtime/compute/vm", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "instance-record vCPU sweep; needs a reader capability"},

@@ -125,6 +125,8 @@ var allowlist = []allowance{
 	{From: "gateway", To: "domains/iam/awsapi", Debt: "gateway (service registration)", Reason: "IAM, STS, EKS and RDS dispatch stays in gateway until the ingress registration seam"},
 	{From: "gateway", To: "domains/rds/awsapi", Debt: "gateway (service registration)", Reason: "IAM, STS, EKS and RDS dispatch stays in gateway until the ingress registration seam"},
 	{From: "gateway", To: "domains/sts/awsapi", Debt: "gateway (service registration)", Reason: "IAM, STS, EKS and RDS dispatch stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ecs/awsapi", Debt: "gateway (service registration)", Reason: "ECS and ELBv2 dispatch stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/elbv2/awsapi", Debt: "gateway (service registration)", Reason: "ECS and ELBv2 dispatch stays in gateway until the ingress registration seam"},
 	{From: "domains/ecs", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "domains/ecs", To: "domains/ec2/eip", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
 	{From: "domains/ecs", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
@@ -12,8 +12,6 @@ import (
 var frozenLegacyPackages = []string{
 	"accountteardown",
 	"gateway",
-	"gateway/ecs",
-	"gateway/elbv2",
 	"gateway/spx",
 }

@@ -350,6 +350,7 @@ while the branch is in flight; they do not describe the umbrella repository's
 | `spinifex#1268` | `spinifex/lbagent` | `spinifex/agents/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the load-balancer agent keeps its files, tests and current dependencies, and importers alias it `lbagent` so call sites are unchanged. No identifier, API, NATS subject, file path on the guest, metric, error string or behaviour changes; `cmd/lb-agent` stays the thin main. Q-30's data-plane boundary is deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
 | `spinifex#1269` | `spinifex/handlers/elbv2` | `spinifex/domains/elbv2` (package `elbv2`) | A mechanical whole-package relocation under the 2026-10-26 ADR-0001 amendment: the ELBv2 control plane keeps its files, tests and current dependencies, and importers alias it `elbv2domain`. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. Its allowlist entries are now sourced from `domains/elbv2`. Q-30's data-plane boundary stays deferred, recorded as `agents/elbv2` (Q-30 data-plane boundary) debt. |
 | `spinifex#1271` | `spinifex/handlers/ecs` | `spinifex/domains/ecs` (package `ecs`) | A mechanical whole-package relocation: ADR-0001's `handlers/ecs` row targets `domains/ecs`, the files are already organised by resource, and resource packages are introduced only where callers need a compiler boundary. The ECS control plane keeps its files, tests and current dependencies alongside the already-extracted `domains/ecs/taskdefinition`, and importers alias it `ecsdomain`. No identifier, API, NATS subject, KV bucket, metric, error string or behaviour changes. Its allowlist entries are now sourced from `domains/ecs`. `handlers` has no package left and is a retired legacy root; R5 holds `domains/ecs` to the interim rule's ban on importing the daemon. |
+| — | `spinifex/gateway/{ecs,elbv2}` | `spinifex/domains/{ecs,elbv2}/awsapi` (`awsapi`, imported as `ecsawsapi`, `elbv2awsapi`) | A mechanical relocation of the ECS and ELBv2 AWS action adapters to their ADR-0001 domain homes, as `spinifex#1265` did for IAM, STS, EKS and RDS; APIs, NATS subjects, KV buckets and behaviour are unchanged. The root `gateway` dispatch still imports each package, recorded as `gateway` (service registration) debt, and `domains/admission/quota` keeps its live ELBv2 counter import, now of `domains/elbv2/awsapi`. |
 The EC2 contract row is intentionally different from the directory moves: it creates
 a compatibility boundary. `ec2.cmd.*` retains its deployed one-token NATS
 subscription and permission shape, while callers use
@@ -456,10 +457,10 @@ These residuals were recorded by individual slices and must be resolved once the
 - `operator/cli` (dependency): the command tree still imports domain and service implementations directly (`handlers/{iam,eks}`, `domains/admission/quota`, `gateway`, `domains/ochre`, `vpcd`, `accountteardown`, the Viperblock adapter and runtime roles). The ADR's `cmd/spinifex` current-to-target map row requires command packages to reach domains through public capabilities; splitting supported use cases into `operator/*` packages is later work.
 - `providers/ebs/viperblock` → `runtime/compute/nbd` and `runtime/host/process` (dependency, moved unchanged from `services/viperblockd`): the adapter formats NBD endpoints and manages nbdkit processes through runtime packages. ADR-0001 does not list providers → runtime as forbidden and the layering test does not enforce it (same category as `providers/ebs/conformance` → `runtime/compute/nbd`), but a provider should not depend on node runtime. Clears when NBD endpoint naming has a provider-facing home (a candidate for `contracts/ebs/v1`) and process supervision is injected by the role. The adapter also imports `providers/objectstore`, a provider-to-provider edge that is allowed.
 - `gateway/ec2.go` (registration): the EC2 dispatch map stays a `GatewayConfig` method in `gateway` and imports every `domains/ec2/awsapi/*` package; `gateway/ec2_idempotency.go` also imports `domains/ec2/awsapi/idem` (`KVBucket`, `TTL`, `TokenAndParams`) for the dispatch-time idempotency wrapper. ADR-0001 makes the domain own its action registration; moving the map waits on the generic ingress registration seam and must not be done as a package move.
- `gateway` (service registration): the root `gateway` dispatch for IAM, STS, EKS and RDS imports `domains/{iam,sts,eks,rds}/awsapi`, which only AWSGW may wire. It clears when each service registers through the ADR-0002 ingress registration seam; as with EC2, moving the dispatch must not be done as a package move.
+- `gateway` (service registration): the root `gateway` dispatch for IAM, STS, EKS, RDS, ECS and ELBv2 imports `domains/{iam,sts,eks,rds,ecs,elbv2}/awsapi`, which only AWSGW may wire. It clears when each service registers through the ADR-0002 ingress registration seam; as with EC2, moving the dispatch must not be done as a package move.
 - `gateway/requestaudit.go`: the outermost request-audit middleware records AWS fields and is updated from four places in the gateway's authentication flow through the gateway's own context key. Moving it would export about seven names used only by that flow, so it stays in `gateway` until the generic ingress registration seam defines how ingress middleware receives authentication results.
 - `accountteardown` (dependency): its EC2 reapers call `domains/ec2/awsapi/*` action adapters directly, as they did under `gateway/ec2`. The ADR's `accountteardown` current-to-target map row replaces this with domain-owned cleanup capabilities before the package moves. It also holds a read-only consumer of the EC2 platform-inventory contract (`contracts/ec2/v1`, `ec2.v1.PlatformInventory`), served by `domains/ec2/accountinventory`; only the explicit dry run (`Engine.DryRun`) calls it, to log a shadow comparison, and the key-pair, placement-group and launch-template reapers still use the `awsapi` adapters. A domain-owned cleanup capability for the proven-safe subset of those three kinds (key pairs and empty placement groups no instance, spot request or live launch-template version names, and launch-template residue; never live launch templates) exists as `domains/ec2/accountcleanup` (a Go interface with injected owners and reference readers, no NATS subject); nothing calls it yet. It also holds the StageAccount settings-seal reaper, a consumer of `contracts/ec2/v1`'s `ec2.v1.SealAccountSettings` and per-node `ec2.v1.AccountSettingsSealCapability.<node>` subjects, served by `domains/ec2/account` through the daemon; the reaper reads no KV and imports no domain package, reaching both subjects only through NATS and the configured node set `NewClusterEngine` already receives.
- `domains/admission/quota` (dependency, moved from `handlers/quota` unchanged): `live.go` imports `gateway/elbv2` and `domains/rds/instance` for its live ELBv2 and RDS counters; `records.go` imports `runtime/compute/vm` for the instance-record vCPU sweep; `live.go`, `vcpu.go` and `storage.go` call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. The ADR's `handlers/quota` current-to-target map row replaces these with reader capabilities once their final locations exist.
+- `domains/admission/quota` (dependency, moved from `handlers/quota` unchanged): `live.go` imports `domains/elbv2/awsapi` and `domains/rds/instance` for its live ELBv2 and RDS counters; `records.go` imports `runtime/compute/vm` for the instance-record vCPU sweep; `live.go`, `vcpu.go` and `storage.go` call `domains/ec2/awsapi/{vpc,eip,volume}` describe adapters to count VPCs, subnets, addresses and volumes, as they did under `gateway/ec2`. The ADR's `handlers/quota` current-to-target map row replaces these with reader capabilities once their final locations exist.
 - `domains/ec2/awsapi/instance` (dependency): imports `domains/iam` (`IAMService` in `DescribeInstances.go`, `RunInstances.go` and `IamInstanceProfileAssociation.go`; `InstanceProfile` in the latter two), `runtime/compute/cache` (`NodeState`, `NodeUnknown`, `NodeLive`) and `runtime/compute/vm` (`VM`), both in `status_synthesis.go`. The IAM edge needs an IAM capability; the runtime edges are domain-to-runtime and need the instance record and node liveness exposed through an EC2-owned projection.
 - `domains/ec2/awsapi/spotinstance` (dependency): imports `domains/iam.IAMService` and `domains/admission/quota.Service` in `RequestSpotInstances.go`.
 - Instance adapter consumers outside EC2: `domains/rds/awsapi/enginecatalog.go`, `runtime/daemon/eks_cp_control.go`, `runtime/daemon/rds_deps.go`, `domains/admission/quota`'s `vcpu.go` and `gateway/iam.go` (`CountInstanceProfileAssociations`) call `domains/ec2/awsapi/instance` directly; each needs an EC2 capability rather than the AWS action adapter.
@@ -673,8 +674,7 @@ series above; "needs decision" is open.
 | `gateway` (root) | Generic HTTP route assembly, SigV4/registry authentication, the policy gate, request-audit middleware, request-context keys, and the legacy per-service dispatch switch for every service not yet registered. | Deferred: the ADR-0002 phases above (auth/IAM and request-context boundary design) gate moving the audit, context-key and legacy-dispatch mechanics. |
 | `gateway/bedrock` | — | Done. The whole package moved into `domains/ochre` in `spinifex#1266` with its package-private core and tests intact and no behaviour change. Separating the action adapters into `domains/ochre/awsapi` remains deferred, recorded as `domains/ochre` (action adapters) debt above. |
 | `gateway/{iam,sts,eks,rds}` | — | Done. The action adapters moved to `domains/{iam,sts,eks,rds}/awsapi` in `spinifex#1265` with no API, NATS subject, storage or behaviour change. ADR-0001 does not make ADR-0002 registration a prerequisite for relocating a domain's adapters, as the EC2 adapter moves already showed; the root `gateway` dispatch that still imports them is recorded `gateway` (service registration) debt. |
-| `gateway/ecs` | The ECS AWS action adapters and dispatch, not yet registered through ADR-0002. | Not moved. Its handler is now `domains/ecs`, so the follows-its-handler blocker no longer applies. |
-| `gateway/elbv2` | The ELBv2 AWS action adapters and dispatch, not yet registered through ADR-0002. | Not moved. Its handler is now `domains/elbv2`, so the follows-its-handler blocker no longer applies. |
+| `gateway/{ecs,elbv2}` | — | Done. The action adapters moved to `domains/{ecs,elbv2}/awsapi` with no API, NATS subject, storage or behaviour change; the root `gateway` dispatch that still imports them is recorded `gateway` (service registration) debt. |
 | `gateway/spx` | `promote_image.go` and `spx.go` dispatch (`storage.go` already consumes `contracts/operator/v1`). | Needs decision: which package owns operator-plane action dispatch registration — an `ingress/aws`-style seam for the operator plane, or `gateway` stays its home. |
 | `gateway/tagging` | — | Done. `domains/tagging` owns the read-only cross-resource `GetResources` aggregation and its API semantics (`0d830e901`, `aedd0b2c4`); AWSGW composes the owner listers, the EC2 tag index and ELBv2 (`f3545e3ea`); the root `gateway` keeps only the legacy dispatch in `gateway/tagging.go`. The package is removed, and its two allowlist rows and frozen-legacy entry are gone. Owner tag mutation capabilities remain future direction, so the RDS and ECS tag-writing edges above stay open. |
 | `services/viperblockd` | — | Done. The adapter is `providers/ebs/viperblock` (with the read-only `dirty` reader), the shared vocabulary is `contracts/viperblockd/legacy/v1`, and the role is `runtime/roles/viperblockd`. `services/` is empty. |
@@ -9,9 +9,9 @@ import (
 	"github.com/aws/aws-sdk-go/service/rds"
 	ec2eipapi "github.com/mulgadc/spinifex/spinifex/domains/ec2/awsapi/eip"
 	ec2vpcapi "github.com/mulgadc/spinifex/spinifex/domains/ec2/awsapi/vpc"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	rdsinstance "github.com/mulgadc/spinifex/spinifex/domains/rds/instance"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	"github.com/nats-io/nats.go"
 )

@@ -85,7 +85,7 @@ func (s *Service) EnforceLoadBalancers(ctx context.Context, natsConn *nats.Conn,
 	if s.Exempt(accountID) {
 		return nil
 	}
-	out, err := gateway_elbv2.DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{}, natsConn, accountID)
+	out, err := elbv2awsapi.DescribeLoadBalancers(ctx, &elbv2.DescribeLoadBalancersInput{}, natsConn, accountID)
 	if err != nil {
 		return err
 	}
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"errors"
@@ -1,12 +1,12 @@
-package gateway_ecs_test
+package awsapi_test

 import (
 	"encoding/json"
 	"strconv"
 	"testing"

+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -23,7 +23,7 @@ func ecsARN(resource string) string {

 func resolve(t *testing.T, action, body string) []string {
 	t.Helper()
-	resources, err := gateway_ecs.ResourceARNs(action, testRegion, testAccountID, []byte(body))
+	resources, err := ecsawsapi.ResourceARNs(action, testRegion, testAccountID, []byte(body))
 	require.NoError(t, err)
 	return resources
 }
@@ -32,14 +32,14 @@ func resolve(t *testing.T, action, body string) []string {
 // a silent account-wide grant. Both directions, so a scope left behind by a
 // deleted or renamed action fails too.
 func TestScopeTableIsExhaustive(t *testing.T) {
-	for action := range gateway_ecs.Actions {
-		assert.True(t, gateway_ecs.HasScope(action),
-			"ecs action %q has no resource scope entry: add one to ecsScopes in gateway/ecs/authz.go", action)
+	for action := range ecsawsapi.Actions {
+		assert.True(t, ecsawsapi.HasScope(action),
+			"ecs action %q has no resource scope entry: add one to ecsScopes in domains/ecs/awsapi/authz.go", action)
 	}
-	for _, action := range gateway_ecs.ScopedActions() {
-		_, served := gateway_ecs.Actions[action]
+	for _, action := range ecsawsapi.ScopedActions() {
+		_, served := ecsawsapi.Actions[action]
 		assert.True(t, served,
-			"ecsScopes has an entry for %q, which the dispatch table does not serve: remove it from gateway/ecs/authz.go", action)
+			"ecsScopes has an entry for %q, which the dispatch table does not serve: remove it from domains/ecs/awsapi/authz.go", action)
 	}
 }

@@ -122,7 +122,7 @@ func TestResourceARNs_AccountWideActionsStayAccountWide(t *testing.T) {
 // An action that is served but has no entry fails closed rather than defaulting
 // to an account-wide grant.
 func TestResourceARNs_UnknownActionIsRejected(t *testing.T) {
-	_, err := gateway_ecs.ResourceARNs("MadeUpAction", testRegion, testAccountID, nil)
+	_, err := ecsawsapi.ResourceARNs("MadeUpAction", testRegion, testAccountID, nil)
 	require.Error(t, err)
 }

@@ -171,11 +171,11 @@ func TestResourceARNs_OversizedListIsRejected(t *testing.T) {
 		return []byte(`{"clusters":` + string(names) + `}`)
 	}

-	_, err := gateway_ecs.ResourceARNs("DescribeClusters", testRegion, testAccountID,
+	_, err := ecsawsapi.ResourceARNs("DescribeClusters", testRegion, testAccountID,
 		clustersBody(query.MaxSliceLen+1))
 	require.EqualError(t, err, awserrors.ErrorMalformedQueryString)

-	resources, err := gateway_ecs.ResourceARNs("DescribeClusters", testRegion, testAccountID,
+	resources, err := ecsawsapi.ResourceARNs("DescribeClusters", testRegion, testAccountID,
 		clustersBody(query.MaxSliceLen))
 	require.NoError(t, err)
 	assert.Len(t, resources, query.MaxSliceLen)
@@ -186,7 +186,7 @@ func TestResourceARNs_OversizedListIsRejected(t *testing.T) {
 // different cluster than the handler acts on.
 func TestResourceARNs_FieldSpelledTwoWaysIsRejected(t *testing.T) {
 	for range 50 {
-		_, err := gateway_ecs.ResourceARNs("DeleteCluster", testRegion, testAccountID,
+		_, err := ecsawsapi.ResourceARNs("DeleteCluster", testRegion, testAccountID,
 			[]byte(`{"cluster":"dev","Cluster":"prod"}`))
 		require.EqualError(t, err, awserrors.ErrorInvalidParameterValue)
 	}
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"bytes"
@@ -1,4 +1,4 @@
-package gateway_ecs_test
+package awsapi_test

 import (
 	"encoding/json"
@@ -8,8 +8,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
 	"github.com/aws/aws-sdk-go/service/ecs"
+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -32,7 +32,7 @@ func TestCheckAZRebalancing(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			err := gateway_ecs.CheckAZRebalancing([]byte(tc.body))
+			err := ecsawsapi.CheckAZRebalancing([]byte(tc.body))
 			if !tc.wantErr {
 				require.NoError(t, err)
 				return
@@ -60,10 +60,10 @@ func TestAddSDKGapFields_DescribeServices(t *testing.T) {
 	var doc struct {
 		Services []map[string]any `json:"services"`
 	}
-	require.NoError(t, json.Unmarshal(gateway_ecs.AddSDKGapFields(out, body), &doc))
+	require.NoError(t, json.Unmarshal(ecsawsapi.AddSDKGapFields(out, body), &doc))
 	require.Len(t, doc.Services, 2)
 	for _, svc := range doc.Services {
-		assert.Equal(t, gateway_ecs.AZRebalancingDisabled, svc[gateway_ecs.AvailabilityZoneRebalancingField])
+		assert.Equal(t, ecsawsapi.AZRebalancingDisabled, svc[ecsawsapi.AvailabilityZoneRebalancingField])
 	}
 }

@@ -81,8 +81,8 @@ func TestAddSDKGapFields_SingleService(t *testing.T) {
 		var doc struct {
 			Service map[string]any `json:"service"`
 		}
-		require.NoError(t, json.Unmarshal(gateway_ecs.AddSDKGapFields(out, body), &doc))
-		assert.Equal(t, gateway_ecs.AZRebalancingDisabled, doc.Service[gateway_ecs.AvailabilityZoneRebalancingField])
+		require.NoError(t, json.Unmarshal(ecsawsapi.AddSDKGapFields(out, body), &doc))
+		assert.Equal(t, ecsawsapi.AZRebalancingDisabled, doc.Service[ecsawsapi.AvailabilityZoneRebalancingField])
 	}
 }

@@ -92,7 +92,7 @@ func TestAddSDKGapFields_LeavesOtherResponsesAlone(t *testing.T) {
 	out := &ecs.ListServicesOutput{ServiceArns: aws.StringSlice([]string{"arn:aws:ecs:::service/a"})}
 	body, err := jsonutil.BuildJSON(out)
 	require.NoError(t, err)
-	assert.Equal(t, string(body), string(gateway_ecs.AddSDKGapFields(out, body)))
+	assert.Equal(t, string(body), string(ecsawsapi.AddSDKGapFields(out, body)))
 }

 // The re-encode must not rewrite the epoch-second times jsonutil emitted: a
@@ -112,7 +112,7 @@ func TestAddSDKGapFields_PreservesTimeEncoding(t *testing.T) {
 	var after struct {
 		Services []map[string]json.RawMessage `json:"services"`
 	}
-	require.NoError(t, json.Unmarshal(gateway_ecs.AddSDKGapFields(out, body), &after))
+	require.NoError(t, json.Unmarshal(ecsawsapi.AddSDKGapFields(out, body), &after))

 	assert.Equal(t, string(before.Services[0]["createdAt"]), string(after.Services[0]["createdAt"]))
 }
@@ -126,6 +126,6 @@ func TestAddSDKGapFields_KeepsAnExistingValue(t *testing.T) {
 	var doc struct {
 		Services []map[string]any `json:"services"`
 	}
-	require.NoError(t, json.Unmarshal(gateway_ecs.AddSDKGapFields(out, body), &doc))
-	assert.Equal(t, "ENABLED", doc.Services[0][gateway_ecs.AvailabilityZoneRebalancingField])
+	require.NoError(t, json.Unmarshal(ecsawsapi.AddSDKGapFields(out, body), &doc))
+	assert.Equal(t, "ENABLED", doc.Services[0][ecsawsapi.AvailabilityZoneRebalancingField])
 }
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"context"
@@ -1,7 +1,7 @@
 //test:in-package — runTaskWithClientToken and runTaskParamHash are unexported,
 //and the rest of this package's tests are in-package for the same reason.

-package gateway_ecs
+package awsapi

 import (
 	"errors"
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 // Unexported hooks the external test package needs. The SDK-gap helpers are
 // deliberately unexported on the real surface: nothing outside this package
@@ -1,4 +1,4 @@
-// Package gateway_ecs is the HTTP-side glue for the ECS control plane: the AWS
+// Package awsapi is the HTTP-side glue for the ECS control plane: the AWS
 // JSON 1.1 surface dispatched by X-Amz-Target
 // (AmazonEC2ContainerServiceV20141113.<Action>), matching aws-sdk-go's
 // service/ecs request shape.
@@ -6,7 +6,7 @@
 // The full v1 action namespace (ecs-v1.md §1) is registered as the API contract.
 // Cluster, task-definition, container-instance and task actions dispatch to the
 // daemon over NATS; the remaining actions resolve to the NotImplemented stub.
-package gateway_ecs
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_ecs
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"strconv"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"errors"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,7 +1,7 @@
-// Package gateway_elbv2 implements the ELBv2 actions: it validates each
+// Package awsapi implements the ELBv2 actions: it validates each
 // request, resolves the resource ARNs it authorizes against, and forwards it to
 // the ELBv2 service over NATS.
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"errors"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,11 +1,11 @@
-package gateway_elbv2_test
+package awsapi_test

 import (
 	"testing"

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -26,7 +26,7 @@ func limitsByName(t *testing.T, out elbv2.DescribeAccountLimitsOutput) map[strin
 // A caller that reads limits before provisioning must find every name AWS
 // returns, because a missing entry sends it back to its own assumption.
 func TestDescribeAccountLimitsReportsEveryName(t *testing.T) {
-	out := gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)
+	out := elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)
 	byName := limitsByName(t, out)

 	for _, name := range []string{
@@ -57,7 +57,7 @@ func TestDescribeAccountLimitsReportsEveryName(t *testing.T) {
 // The whole point of sourcing from the quota service: the reported cap is the
 // one CreateLoadBalancer enforces, for both load balancer types.
 func TestDescribeAccountLimitsReportsTheEnforcedCap(t *testing.T) {
-	byName := limitsByName(t, gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 7))
+	byName := limitsByName(t, elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 7))

 	assert.Equal(t, "7", aws.StringValue(byName["application-load-balancers"].Max))
 	assert.Equal(t, "7", aws.StringValue(byName["network-load-balancers"].Max))
@@ -69,7 +69,7 @@ func TestDescribeAccountLimitsReportsTheEnforcedCap(t *testing.T) {
 // An uncapped account reports no maximum rather than a number that would cap a
 // caller which has no cap.
 func TestDescribeAccountLimitsOmitsMaxWhenUnlimited(t *testing.T) {
-	byName := limitsByName(t, gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, -1))
+	byName := limitsByName(t, elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, -1))

 	assert.Nil(t, byName["application-load-balancers"].Max)
 	assert.Nil(t, byName["network-load-balancers"].Max)
@@ -79,20 +79,20 @@ func TestDescribeAccountLimitsOmitsMaxWhenUnlimited(t *testing.T) {
 // The list is short and fixed, so the paging parameters are accepted and the
 // whole list comes back on one page with nothing to follow.
 func TestDescribeAccountLimitsReturnsOnePage(t *testing.T) {
-	out := gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{
+	out := elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{
 		Marker:   aws.String("2"),
 		PageSize: aws.Int64(1),
 	}, 50)

 	assert.Nil(t, out.NextMarker)
-	assert.Len(t, out.Limits, len(gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50).Limits))
+	assert.Len(t, out.Limits, len(elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50).Limits))
 }

 // A returned pointer must not be shared across calls, or one caller's response
 // could be mutated by another's.
 func TestDescribeAccountLimitsDoesNotShareEntries(t *testing.T) {
-	first := gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)
-	second := gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)
+	first := elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)
+	second := elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 50)

 	require.NotEmpty(t, first.Limits)
 	for i := range first.Limits {
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"errors"
@@ -1,4 +1,4 @@
-package gateway_elbv2_test
+package awsapi_test

 import (
 	"fmt"
@@ -6,9 +6,9 @@ import (

 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/arn"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -32,13 +32,13 @@ func listenerARN(lbName, lbID, id string) string {

 func resolveARNs(t *testing.T, action string, input any) []string {
 	t.Helper()
-	resources, err := gateway_elbv2.ResourceARNs(action, authzRegion, authzAccount, input)
+	resources, err := elbv2awsapi.ResourceARNs(action, authzRegion, authzAccount, input)
 	require.NoError(t, err)
 	return resources
 }

 func TestResourceARNs_UnknownAction(t *testing.T) {
-	_, err := gateway_elbv2.ResourceARNs("NotAnAction", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{})
+	_, err := elbv2awsapi.ResourceARNs("NotAnAction", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{})
 	require.Error(t, err)
 	assert.Equal(t, awserrors.ErrorInvalidAction, err.Error())
 }
@@ -164,7 +164,7 @@ func TestResourceARNs_BoundsNestedFanOut(t *testing.T) {
 		})
 	}

-	_, err := gateway_elbv2.ResourceARNs("CreateRule", authzRegion, authzAccount, &elbv2.CreateRuleInput{
+	_, err := elbv2awsapi.ResourceARNs("CreateRule", authzRegion, authzAccount, &elbv2.CreateRuleInput{
 		ListenerArn: aws.String(listenerARN("prod", "abc123", "l1")),
 		Actions:     actions,
 	})
@@ -212,7 +212,7 @@ func TestResourceARNs_AccountWideActions(t *testing.T) {
 		"DescribeLoadBalancers", "DescribeTargetGroups", "DescribeListeners",
 		"DescribeRules", "DescribeSSLPolicies", "LBAgentHeartbeat", "GetLBConfig",
 	} {
-		assert.True(t, gateway_elbv2.HasScope(action), action)
+		assert.True(t, elbv2awsapi.HasScope(action), action)
 		assert.Equal(t, []string{"*"}, resolveARNs(t, action, &elbv2.DescribeLoadBalancersInput{}), action)
 	}
 }
@@ -230,7 +230,7 @@ func TestResourceARNs_RejectsForeignARNs(t *testing.T) {
 		"no resource at all": "arn:aws:elasticloadbalancing:ap-southeast-2:123456789012:loadbalancer/",
 	}
 	for name, value := range rejected {
-		_, err := gateway_elbv2.ResourceARNs("DeleteLoadBalancer", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{
+		_, err := elbv2awsapi.ResourceARNs("DeleteLoadBalancer", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{
 			LoadBalancerArn: aws.String(value),
 		})
 		require.Error(t, err, name)
@@ -243,7 +243,7 @@ func TestResourceARNs_RejectsForeignARNs(t *testing.T) {
 // A parent of the wrong type cannot derive a child, and must not silently
 // produce an ARN naming a resource nobody asked for.
 func TestResourceARNs_DerivedChildRejectsWrongParent(t *testing.T) {
-	_, err := gateway_elbv2.ResourceARNs("CreateListener", authzRegion, authzAccount, &elbv2.CreateListenerInput{
+	_, err := elbv2awsapi.ResourceARNs("CreateListener", authzRegion, authzAccount, &elbv2.CreateListenerInput{
 		LoadBalancerArn: aws.String(tgARN("web", "def456")),
 	})
 	require.Error(t, err)
@@ -1,4 +1,4 @@
-package gateway_elbv2_test
+package awsapi_test

 import (
 	"context"
@@ -11,8 +11,8 @@ import (
 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/mulgadc/spinifex/internal/testkit"
 	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	"github.com/nats-io/nats.go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -156,210 +156,210 @@ func dispatchCases() []dispatchCase {
 			name: "CreateLoadBalancer", subject: "elbv2.CreateLoadBalancer",
 			input: lbIn, reply: lbOut, want: lbOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.CreateLoadBalancer(ctx, lbIn, nc, testAccountID)
+				return elbv2awsapi.CreateLoadBalancer(ctx, lbIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DeleteLoadBalancer", subject: "elbv2.DeleteLoadBalancer",
 			input: delLBIn, reply: elbv2.DeleteLoadBalancerOutput{}, want: elbv2.DeleteLoadBalancerOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DeleteLoadBalancer(ctx, delLBIn, nc, testAccountID)
+				return elbv2awsapi.DeleteLoadBalancer(ctx, delLBIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeLoadBalancers", subject: "elbv2.DescribeLoadBalancers",
 			input: descLBIn, reply: descLBOut, want: descLBOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeLoadBalancers(ctx, descLBIn, nc, testAccountID)
+				return elbv2awsapi.DescribeLoadBalancers(ctx, descLBIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "CreateTargetGroup", subject: "elbv2.CreateTargetGroup",
 			input: tgIn, reply: tgOut, want: tgOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.CreateTargetGroup(ctx, tgIn, nc, testAccountID)
+				return elbv2awsapi.CreateTargetGroup(ctx, tgIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "ModifyTargetGroup", subject: "elbv2.ModifyTargetGroup",
 			input: modTGIn, reply: modTGOut, want: modTGOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.ModifyTargetGroup(ctx, modTGIn, nc, testAccountID)
+				return elbv2awsapi.ModifyTargetGroup(ctx, modTGIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DeleteTargetGroup", subject: "elbv2.DeleteTargetGroup",
 			input: delTGIn, reply: elbv2.DeleteTargetGroupOutput{}, want: elbv2.DeleteTargetGroupOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DeleteTargetGroup(ctx, delTGIn, nc, testAccountID)
+				return elbv2awsapi.DeleteTargetGroup(ctx, delTGIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeTargetGroups", subject: "elbv2.DescribeTargetGroups",
 			input: descTGIn, reply: descTGOut, want: descTGOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeTargetGroups(ctx, descTGIn, nc, testAccountID)
+				return elbv2awsapi.DescribeTargetGroups(ctx, descTGIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "RegisterTargets", subject: "elbv2.RegisterTargets",
 			input: regIn, reply: elbv2.RegisterTargetsOutput{}, want: elbv2.RegisterTargetsOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.RegisterTargets(ctx, regIn, nc, testAccountID)
+				return elbv2awsapi.RegisterTargets(ctx, regIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DeregisterTargets", subject: "elbv2.DeregisterTargets",
 			input: deregIn, reply: elbv2.DeregisterTargetsOutput{}, want: elbv2.DeregisterTargetsOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DeregisterTargets(ctx, deregIn, nc, testAccountID)
+				return elbv2awsapi.DeregisterTargets(ctx, deregIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeTargetHealth", subject: "elbv2.DescribeTargetHealth",
 			input: healthIn, reply: healthOut, want: healthOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeTargetHealth(ctx, healthIn, nc, testAccountID)
+				return elbv2awsapi.DescribeTargetHealth(ctx, healthIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "CreateListener", subject: "elbv2.CreateListener",
 			input: createListenerIn, reply: createListenerOut, want: createListenerOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.CreateListener(ctx, createListenerIn, nc, testAccountID)
+				return elbv2awsapi.CreateListener(ctx, createListenerIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DeleteListener", subject: "elbv2.DeleteListener",
 			input: delListenerIn, reply: elbv2.DeleteListenerOutput{}, want: elbv2.DeleteListenerOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DeleteListener(ctx, delListenerIn, nc, testAccountID)
+				return elbv2awsapi.DeleteListener(ctx, delListenerIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "ModifyListener", subject: "elbv2.ModifyListener",
 			input: modListenerIn, reply: modListenerOut, want: modListenerOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.ModifyListener(ctx, modListenerIn, nc, testAccountID)
+				return elbv2awsapi.ModifyListener(ctx, modListenerIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeListeners", subject: "elbv2.DescribeListeners",
 			input: descListenersIn, reply: descListenersOut, want: descListenersOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeListeners(ctx, descListenersIn, nc, testAccountID)
+				return elbv2awsapi.DescribeListeners(ctx, descListenersIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "CreateRule", subject: "elbv2.CreateRule",
 			input: createRuleIn, reply: createRuleOut, want: createRuleOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.CreateRule(ctx, createRuleIn, nc, testAccountID)
+				return elbv2awsapi.CreateRule(ctx, createRuleIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "ModifyRule", subject: "elbv2.ModifyRule",
 			input: modRuleIn, reply: modRuleOut, want: modRuleOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.ModifyRule(ctx, modRuleIn, nc, testAccountID)
+				return elbv2awsapi.ModifyRule(ctx, modRuleIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DeleteRule", subject: "elbv2.DeleteRule",
 			input: delRuleIn, reply: elbv2.DeleteRuleOutput{}, want: elbv2.DeleteRuleOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DeleteRule(ctx, delRuleIn, nc, testAccountID)
+				return elbv2awsapi.DeleteRule(ctx, delRuleIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeRules", subject: "elbv2.DescribeRules",
 			input: descRulesIn, reply: descRulesOut, want: descRulesOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeRules(ctx, descRulesIn, nc, testAccountID)
+				return elbv2awsapi.DescribeRules(ctx, descRulesIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "SetRulePriorities", subject: "elbv2.SetRulePriorities",
 			input: prioIn, reply: prioOut, want: prioOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.SetRulePriorities(ctx, prioIn, nc, testAccountID)
+				return elbv2awsapi.SetRulePriorities(ctx, prioIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeTags", subject: "elbv2.DescribeTags",
 			input: descTagsIn, reply: descTagsOut, want: descTagsOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeTags(ctx, descTagsIn, nc, testAccountID)
+				return elbv2awsapi.DescribeTags(ctx, descTagsIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "AddTags", subject: "elbv2.AddTags",
 			input: addTagsIn, reply: elbv2.AddTagsOutput{}, want: elbv2.AddTagsOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.AddTags(ctx, addTagsIn, nc, testAccountID)
+				return elbv2awsapi.AddTags(ctx, addTagsIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "RemoveTags", subject: "elbv2.RemoveTags",
 			input: removeTagsIn, reply: elbv2.RemoveTagsOutput{}, want: elbv2.RemoveTagsOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.RemoveTags(ctx, removeTagsIn, nc, testAccountID)
+				return elbv2awsapi.RemoveTags(ctx, removeTagsIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "ModifyTargetGroupAttributes", subject: "elbv2.ModifyTargetGroupAttributes",
 			input: modTGAttrIn, reply: modTGAttrOut, want: modTGAttrOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.ModifyTargetGroupAttributes(ctx, modTGAttrIn, nc, testAccountID)
+				return elbv2awsapi.ModifyTargetGroupAttributes(ctx, modTGAttrIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeTargetGroupAttributes", subject: "elbv2.DescribeTargetGroupAttributes",
 			input: descTGAttrIn, reply: descTGAttrOut, want: descTGAttrOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeTargetGroupAttributes(ctx, descTGAttrIn, nc, testAccountID)
+				return elbv2awsapi.DescribeTargetGroupAttributes(ctx, descTGAttrIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "ModifyLoadBalancerAttributes", subject: "elbv2.ModifyLoadBalancerAttributes",
 			input: modLBAttrIn, reply: modLBAttrOut, want: modLBAttrOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.ModifyLoadBalancerAttributes(ctx, modLBAttrIn, nc, testAccountID)
+				return elbv2awsapi.ModifyLoadBalancerAttributes(ctx, modLBAttrIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeLoadBalancerAttributes", subject: "elbv2.DescribeLoadBalancerAttributes",
 			input: descLBAttrIn, reply: descLBAttrOut, want: descLBAttrOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeLoadBalancerAttributes(ctx, descLBAttrIn, nc, testAccountID)
+				return elbv2awsapi.DescribeLoadBalancerAttributes(ctx, descLBAttrIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "SetSecurityGroups", subject: "elbv2.SetSecurityGroups",
 			input: sgIn, reply: sgOut, want: sgOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.SetSecurityGroups(ctx, sgIn, nc, testAccountID)
+				return elbv2awsapi.SetSecurityGroups(ctx, sgIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "SetIpAddressType", subject: "elbv2.SetIpAddressType",
 			input: ipTypeIn, reply: ipTypeOut, want: ipTypeOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.SetIpAddressType(ctx, ipTypeIn, nc, testAccountID)
+				return elbv2awsapi.SetIpAddressType(ctx, ipTypeIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "SetSubnets", subject: "elbv2.SetSubnets",
 			input: subnetsIn, reply: subnetsOut, want: subnetsOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.SetSubnets(ctx, subnetsIn, nc, testAccountID)
+				return elbv2awsapi.SetSubnets(ctx, subnetsIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "AddListenerCertificates", subject: "elbv2.AddListenerCertificates",
 			input: addCertIn, reply: addCertOut, want: addCertOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.AddListenerCertificates(ctx, addCertIn, nc, testAccountID)
+				return elbv2awsapi.AddListenerCertificates(ctx, addCertIn, nc, testAccountID)
 			},
 		},
 		{
@@ -367,35 +367,35 @@ func dispatchCases() []dispatchCase {
 			input: removeCertIn, reply: elbv2.RemoveListenerCertificatesOutput{},
 			want: elbv2.RemoveListenerCertificatesOutput{},
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.RemoveListenerCertificates(ctx, removeCertIn, nc, testAccountID)
+				return elbv2awsapi.RemoveListenerCertificates(ctx, removeCertIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeListenerCertificates", subject: "elbv2.DescribeListenerCertificates",
 			input: descCertIn, reply: descCertOut, want: descCertOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeListenerCertificates(ctx, descCertIn, nc, testAccountID)
+				return elbv2awsapi.DescribeListenerCertificates(ctx, descCertIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "DescribeSSLPolicies", subject: "elbv2.DescribeSSLPolicies",
 			input: sslIn, reply: sslOut, want: sslOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.DescribeSSLPolicies(ctx, sslIn, nc, testAccountID)
+				return elbv2awsapi.DescribeSSLPolicies(ctx, sslIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "LBAgentHeartbeat", subject: "elbv2.LBAgentHeartbeat",
 			input: heartbeatIn, reply: heartbeatOut, want: heartbeatOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.LBAgentHeartbeat(ctx, heartbeatIn, nc, testAccountID)
+				return elbv2awsapi.LBAgentHeartbeat(ctx, heartbeatIn, nc, testAccountID)
 			},
 		},
 		{
 			name: "GetLBConfig", subject: "elbv2.GetLBConfig",
 			input: lbConfigIn, reply: lbConfigOut, want: lbConfigOut,
 			call: func(ctx context.Context, nc *nats.Conn) (any, error) {
-				return gateway_elbv2.GetLBConfig(ctx, lbConfigIn, nc, testAccountID)
+				return elbv2awsapi.GetLBConfig(ctx, lbConfigIn, nc, testAccountID)
 			},
 		},
 	}
@@ -455,136 +455,136 @@ func TestGatewayDispatch_ValidationGuards(t *testing.T) {
 		call    func() error
 	}{
 		{"CreateRule/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.CreateRule(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.CreateRule(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"CreateRule/MissingListenerArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.CreateRule(context.Background(), &elbv2.CreateRuleInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.CreateRule(context.Background(), &elbv2.CreateRuleInput{}, nil, testAccountID)
 			return err
 		}},
 		{"CreateRule/MissingPriority", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.CreateRule(context.Background(), &elbv2.CreateRuleInput{
+			_, err := elbv2awsapi.CreateRule(context.Background(), &elbv2.CreateRuleInput{
 				ListenerArn: aws.String(testLsnrArn),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"CreateRule/MissingConditions", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.CreateRule(context.Background(), &elbv2.CreateRuleInput{
+			_, err := elbv2awsapi.CreateRule(context.Background(), &elbv2.CreateRuleInput{
 				ListenerArn: aws.String(testLsnrArn), Priority: aws.Int64(1),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"CreateRule/MissingActions", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.CreateRule(context.Background(), &elbv2.CreateRuleInput{
+			_, err := elbv2awsapi.CreateRule(context.Background(), &elbv2.CreateRuleInput{
 				ListenerArn: aws.String(testLsnrArn), Priority: aws.Int64(1),
 				Conditions: []*elbv2.RuleCondition{{Field: aws.String("path-pattern")}},
 			}, nil, testAccountID)
 			return err
 		}},
 		{"ModifyRule/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.ModifyRule(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.ModifyRule(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"ModifyRule/MissingRuleArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.ModifyRule(context.Background(), &elbv2.ModifyRuleInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.ModifyRule(context.Background(), &elbv2.ModifyRuleInput{}, nil, testAccountID)
 			return err
 		}},
 		// Either conditions or actions satisfies the guard; neither does not.
 		{"ModifyRule/NoConditionsOrActions", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.ModifyRule(context.Background(), &elbv2.ModifyRuleInput{
+			_, err := elbv2awsapi.ModifyRule(context.Background(), &elbv2.ModifyRuleInput{
 				RuleArn: aws.String(testRuleArn),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"DeleteRule/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.DeleteRule(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.DeleteRule(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"DeleteRule/MissingRuleArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.DeleteRule(context.Background(), &elbv2.DeleteRuleInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.DeleteRule(context.Background(), &elbv2.DeleteRuleInput{}, nil, testAccountID)
 			return err
 		}},
 		{"DescribeRules/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.DescribeRules(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.DescribeRules(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"DescribeRules/NeitherListenerNorRules", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.DescribeRules(context.Background(), &elbv2.DescribeRulesInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.DescribeRules(context.Background(), &elbv2.DescribeRulesInput{}, nil, testAccountID)
 			return err
 		}},
 		{"SetRulePriorities/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.SetRulePriorities(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.SetRulePriorities(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"SetRulePriorities/MissingPriorities", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetRulePriorities(context.Background(), &elbv2.SetRulePrioritiesInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.SetRulePriorities(context.Background(), &elbv2.SetRulePrioritiesInput{}, nil, testAccountID)
 			return err
 		}},
 		{"AddTags/NilInput", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.AddTags(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.AddTags(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"AddTags/MissingTags", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.AddTags(context.Background(), &elbv2.AddTagsInput{
+			_, err := elbv2awsapi.AddTags(context.Background(), &elbv2.AddTagsInput{
 				ResourceArns: []*string{aws.String(testLBArn)},
 			}, nil, testAccountID)
 			return err
 		}},
 		{"RemoveTags/MissingTagKeys", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.RemoveTags(context.Background(), &elbv2.RemoveTagsInput{
+			_, err := elbv2awsapi.RemoveTags(context.Background(), &elbv2.RemoveTagsInput{
 				ResourceArns: []*string{aws.String(testLBArn)},
 			}, nil, testAccountID)
 			return err
 		}},
 		{"DescribeTags/MissingResourceArns", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.DescribeTags(context.Background(), &elbv2.DescribeTagsInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.DescribeTags(context.Background(), &elbv2.DescribeTagsInput{}, nil, testAccountID)
 			return err
 		}},
 		{"SetSecurityGroups/MissingLBArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetSecurityGroups(context.Background(), &elbv2.SetSecurityGroupsInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.SetSecurityGroups(context.Background(), &elbv2.SetSecurityGroupsInput{}, nil, testAccountID)
 			return err
 		}},
 		{"SetSecurityGroups/MissingGroups", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetSecurityGroups(context.Background(), &elbv2.SetSecurityGroupsInput{
+			_, err := elbv2awsapi.SetSecurityGroups(context.Background(), &elbv2.SetSecurityGroupsInput{
 				LoadBalancerArn: aws.String(testLBArn),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"SetIpAddressType/MissingLBArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetIpAddressType(context.Background(), &elbv2.SetIpAddressTypeInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.SetIpAddressType(context.Background(), &elbv2.SetIpAddressTypeInput{}, nil, testAccountID)
 			return err
 		}},
 		{"SetIpAddressType/MissingType", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetIpAddressType(context.Background(), &elbv2.SetIpAddressTypeInput{
+			_, err := elbv2awsapi.SetIpAddressType(context.Background(), &elbv2.SetIpAddressTypeInput{
 				LoadBalancerArn: aws.String(testLBArn),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"SetSubnets/MissingLBArn", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetSubnets(context.Background(), &elbv2.SetSubnetsInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.SetSubnets(context.Background(), &elbv2.SetSubnetsInput{}, nil, testAccountID)
 			return err
 		}},
 		// SubnetMappings is the accepted alternative to Subnets; neither fails.
 		{"SetSubnets/NoSubnetsOrMappings", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.SetSubnets(context.Background(), &elbv2.SetSubnetsInput{
+			_, err := elbv2awsapi.SetSubnets(context.Background(), &elbv2.SetSubnetsInput{
 				LoadBalancerArn: aws.String(testLBArn),
 			}, nil, testAccountID)
 			return err
 		}},
 		{"LBAgentHeartbeat/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.LBAgentHeartbeat(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.LBAgentHeartbeat(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"LBAgentHeartbeat/MissingLBID", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.LBAgentHeartbeat(context.Background(), &elbv2domain.LBAgentHeartbeatInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.LBAgentHeartbeat(context.Background(), &elbv2domain.LBAgentHeartbeatInput{}, nil, testAccountID)
 			return err
 		}},
 		{"GetLBConfig/NilInput", awserrors.ErrorInvalidParameterValue, func() error {
-			_, err := gateway_elbv2.GetLBConfig(context.Background(), nil, nil, testAccountID)
+			_, err := elbv2awsapi.GetLBConfig(context.Background(), nil, nil, testAccountID)
 			return err
 		}},
 		{"GetLBConfig/MissingLBID", awserrors.ErrorMissingParameter, func() error {
-			_, err := gateway_elbv2.GetLBConfig(context.Background(), &elbv2domain.GetLBConfigInput{}, nil, testAccountID)
+			_, err := elbv2awsapi.GetLBConfig(context.Background(), &elbv2domain.GetLBConfigInput{}, nil, testAccountID)
 			return err
 		}},
 	}
@@ -603,7 +603,7 @@ func TestGatewayDispatch_ErrorEnvelopePropagates(t *testing.T) {
 	serveOnce(t, nc, "elbv2.DeleteLoadBalancer",
 		awserrors.GenerateErrorPayload(awserrors.ErrorELBv2LoadBalancerNotFound))

-	_, err := gateway_elbv2.DeleteLoadBalancer(context.Background(),
+	_, err := elbv2awsapi.DeleteLoadBalancer(context.Background(),
 		&elbv2.DeleteLoadBalancerInput{LoadBalancerArn: aws.String(testLBArn)}, nc, testAccountID)
 	require.EqualError(t, err, awserrors.ErrorELBv2LoadBalancerNotFound)
 }
@@ -613,12 +613,12 @@ func TestGatewayDispatch_ErrorEnvelopePropagates(t *testing.T) {
 func TestGatewayDispatch_NoResponder(t *testing.T) {
 	_, nc := testutil.StartTestNATS(t)

-	_, err := gateway_elbv2.DescribeLoadBalancers(context.Background(), &elbv2.DescribeLoadBalancersInput{}, nc, testAccountID)
+	_, err := elbv2awsapi.DescribeLoadBalancers(context.Background(), &elbv2.DescribeLoadBalancersInput{}, nc, testAccountID)
 	require.ErrorIs(t, err, nats.ErrNoResponders)
 }

 // A nil connection is refused before any request is attempted.
 func TestGatewayDispatch_NilConnection(t *testing.T) {
-	_, err := gateway_elbv2.DescribeLoadBalancers(context.Background(), &elbv2.DescribeLoadBalancersInput{}, nil, testAccountID)
+	_, err := elbv2awsapi.DescribeLoadBalancers(context.Background(), &elbv2.DescribeLoadBalancersInput{}, nil, testAccountID)
 	require.ErrorIs(t, err, natsmsg.ErrClusterUnavailable)
 }
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -1,4 +1,4 @@
-package gateway_elbv2
+package awsapi

 import (
 	"context"
@@ -6,8 +6,8 @@ import (
 	"net/http"
 	"strings"

+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 )

 // ecsActionFromTarget extracts the action suffix from an X-Amz-Target header.
@@ -29,7 +29,7 @@ func (gw *GatewayConfig) ECS_Request(w http.ResponseWriter, r *http.Request) err
 		return errors.New(awserrors.ErrorMissingAction)
 	}

-	handler, ok := gateway_ecs.Actions[action]
+	handler, ok := ecsawsapi.Actions[action]
 	if !ok {
 		slog.DebugContext(r.Context(), "ECS: unknown action", "action", action)
 		return errors.New(awserrors.ErrorInvalidAction)
@@ -51,7 +51,7 @@ func (gw *GatewayConfig) ECS_Request(w http.ResponseWriter, r *http.Request) err
 		return err
 	}

-	resources, err := gateway_ecs.ResourceARNs(action, gw.Region, accountID, body)
+	resources, err := ecsawsapi.ResourceARNs(action, gw.Region, accountID, body)
 	if err != nil {
 		return err
 	}
@@ -71,10 +71,10 @@ func (gw *GatewayConfig) ECS_Request(w http.ResponseWriter, r *http.Request) err
 		return err
 	}

-	if gateway_ecs.RawJSONActions[action] {
-		gateway_ecs.WriteRawJSONResponse(w, output)
+	if ecsawsapi.RawJSONActions[action] {
+		ecsawsapi.WriteRawJSONResponse(w, output)
 		return nil
 	}
-	gateway_ecs.WriteJSONResponse(w, output)
+	ecsawsapi.WriteJSONResponse(w, output)
 	return nil
 }
@@ -3,7 +3,7 @@ package gateway_test
 import (
 	"testing"

-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/stretchr/testify/assert"
 )

@@ -11,14 +11,14 @@ import (
 // with a silent account-wide grant. It asserts both directions, so a scope left
 // behind by a deleted or renamed action fails too.
 func TestECSScopeTableIsExhaustive(t *testing.T) {
-	for action := range gateway_ecs.Actions {
-		assert.True(t, gateway_ecs.HasScope(action),
-			"ecs action %q has no resource scope entry: add one to ecsScopes in gateway/ecs/authz.go", action)
+	for action := range ecsawsapi.Actions {
+		assert.True(t, ecsawsapi.HasScope(action),
+			"ecs action %q has no resource scope entry: add one to ecsScopes in domains/ecs/awsapi/authz.go", action)
 	}

-	for _, action := range gateway_ecs.ScopedActions() {
-		_, ok := gateway_ecs.Actions[action]
+	for _, action := range ecsawsapi.ScopedActions() {
+		_, ok := ecsawsapi.Actions[action]
 		assert.True(t, ok,
-			"ecsScopes has an entry for %q, which the dispatch table does not serve: remove it from gateway/ecs/authz.go", action)
+			"ecsScopes has an entry for %q, which the dispatch table does not serve: remove it from domains/ecs/awsapi/authz.go", action)
 	}
 }
@@ -11,8 +11,8 @@ import (
 	"testing"

 	"github.com/mulgadc/bluebottle/pkg/sigv4"
+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -22,7 +22,7 @@ import (
 // check ran ahead of the resource existing at all.
 func dispatchECS(t *testing.T, gw *GatewayConfig, action, body string) error {
 	t.Helper()
-	req := setupECSRequest(gateway_ecs.TargetPrefix+"."+action, body)
+	req := setupECSRequest(ecsawsapi.TargetPrefix+"."+action, body)
 	return gw.ECS_Request(httptest.NewRecorder(), req)
 }

@@ -143,9 +143,9 @@ func TestECSRequest_AccountWideGrantStillPermitsEveryAction(t *testing.T) {
 		`"containerInstance":"ci-1","taskDefinition":"app:1","name":"cp","capacityProvider":"cp",` +
 		`"clusterName":"prod","resourceArn":"` + ecsResourceARN("cluster/prod") + `"}`)

-	for _, action := range gateway_ecs.ScopedActions() {
+	for _, action := range ecsawsapi.ScopedActions() {
 		t.Run(action, func(t *testing.T) {
-			resources, err := gateway_ecs.ResourceARNs(action, authzRegion, authzAccountID, body)
+			resources, err := ecsawsapi.ResourceARNs(action, authzRegion, authzAccountID, body)
 			require.NoError(t, err)
 			assert.NoError(t, gw.checkPolicyResources(req, "ecs", action, resources))
 		})
@@ -157,7 +157,7 @@ func TestECSRequest_AccountWideGrantStillPermitsEveryAction(t *testing.T) {
 func TestECSRequest_MissingAccountIDReturnsInternalError(t *testing.T) {
 	gw := scopedPolicyGateway(statement("Allow", "ecs:*", "*"))
 	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader("{}"))
-	req.Header.Set("X-Amz-Target", gateway_ecs.TargetPrefix+".ListClusters")
+	req.Header.Set("X-Amz-Target", ecsawsapi.TargetPrefix+".ListClusters")
 	req = withTestIdentity(req.WithContext(context.WithValue(req.Context(), ctxService, "ecs")))

 	err := gw.ECS_Request(httptest.NewRecorder(), req)
@@ -17,7 +17,7 @@ import (
 // TestECSRegisterTaskDefinition_PassRole exercises the full gw.ECS_Request
 // dispatch (X-Amz-Target parsing, action-level checkPolicy, then the
 // iam:PassRole resource check gateway/ecs.go builds and threads through
-// gateway_ecs.Handler) with a real authenticated user identity, so the IAM
+// ecsawsapi.Handler) with a real authenticated user identity, so the IAM
 // policy is actually evaluated rather than taking the pre-IAM bypass.
 const testECSPassRoleTargetARN = "arn:aws:iam::123456789012:role/ecs-task-role"

@@ -7,8 +7,8 @@ import (
 	"strings"
 	"testing"

+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -56,7 +56,7 @@ func TestECSActionsMap_NamespaceRegistered(t *testing.T) {
 		"TagResource", "UntagResource", "ListTagsForResource",
 	}
 	for _, action := range namespace {
-		_, ok := gateway_ecs.Actions[action]
+		_, ok := ecsawsapi.Actions[action]
 		assert.True(t, ok, "action %q should be registered", action)
 	}
 }
@@ -8,9 +8,9 @@ import (

 	"github.com/aws/aws-sdk-go/service/elbv2"
 	elbv2domain "github.com/mulgadc/spinifex/spinifex/domains/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	awsxml "github.com/mulgadc/spinifex/spinifex/foundation/aws/xml"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/query"
 )

@@ -56,134 +56,134 @@ var elbv2Actions = map[string]elbv2Action{
 		if err := gw.Quota.EnforceLoadBalancers(ctx, gw.NATSConn, accountID, 1); err != nil {
 			return nil, err
 		}
-		return gateway_elbv2.CreateLoadBalancer(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.CreateLoadBalancer(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DeleteLoadBalancer": elbv2Handler(func(ctx context.Context, input *elbv2.DeleteLoadBalancerInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DeleteLoadBalancer(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DeleteLoadBalancer(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeLoadBalancers": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeLoadBalancersInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeLoadBalancers(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeLoadBalancers(ctx, input, gw.NATSConn, accountID)
 	}),
 	"CreateTargetGroup": elbv2Handler(func(ctx context.Context, input *elbv2.CreateTargetGroupInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.CreateTargetGroup(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.CreateTargetGroup(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DeleteTargetGroup": elbv2Handler(func(ctx context.Context, input *elbv2.DeleteTargetGroupInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DeleteTargetGroup(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DeleteTargetGroup(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeTargetGroups": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeTargetGroupsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeTargetGroups(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeTargetGroups(ctx, input, gw.NATSConn, accountID)
 	}),
 	"RegisterTargets": elbv2Handler(func(ctx context.Context, input *elbv2.RegisterTargetsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.RegisterTargets(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.RegisterTargets(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DeregisterTargets": elbv2Handler(func(ctx context.Context, input *elbv2.DeregisterTargetsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DeregisterTargets(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DeregisterTargets(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeTargetHealth": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeTargetHealthInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeTargetHealth(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeTargetHealth(ctx, input, gw.NATSConn, accountID)
 	}),
 	"CreateListener": elbv2Handler(func(ctx context.Context, input *elbv2.CreateListenerInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.CreateListener(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.CreateListener(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DeleteListener": elbv2Handler(func(ctx context.Context, input *elbv2.DeleteListenerInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DeleteListener(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DeleteListener(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyListener": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyListenerInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyListener(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.ModifyListener(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeListeners": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeListenersInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeListeners(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeListeners(ctx, input, gw.NATSConn, accountID)
 	}),
 	"CreateRule": elbv2Handler(func(ctx context.Context, input *elbv2.CreateRuleInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.CreateRule(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.CreateRule(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyRule": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyRuleInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyRule(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.ModifyRule(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DeleteRule": elbv2Handler(func(ctx context.Context, input *elbv2.DeleteRuleInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DeleteRule(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DeleteRule(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeRules": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeRulesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeRules(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeRules(ctx, input, gw.NATSConn, accountID)
 	}),
 	"SetRulePriorities": elbv2Handler(func(ctx context.Context, input *elbv2.SetRulePrioritiesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.SetRulePriorities(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.SetRulePriorities(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeTags": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeTagsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeTags(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeTags(ctx, input, gw.NATSConn, accountID)
 	}),
 	"AddTags": elbv2Handler(func(ctx context.Context, input *elbv2.AddTagsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.AddTags(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.AddTags(ctx, input, gw.NATSConn, accountID)
 	}),
 	"RemoveTags": elbv2Handler(func(ctx context.Context, input *elbv2.RemoveTagsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.RemoveTags(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.RemoveTags(ctx, input, gw.NATSConn, accountID)
 	}),
 	"LBAgentHeartbeat": elbv2Handler(func(ctx context.Context, input *elbv2domain.LBAgentHeartbeatInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.LBAgentHeartbeat(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.LBAgentHeartbeat(ctx, input, gw.NATSConn, accountID)
 	}),
 	"GetLBConfig": elbv2Handler(func(ctx context.Context, input *elbv2domain.GetLBConfigInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.GetLBConfig(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.GetLBConfig(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyTargetGroup": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyTargetGroupInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyTargetGroup(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.ModifyTargetGroup(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyTargetGroupAttributes": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyTargetGroupAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyTargetGroupAttributes(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.ModifyTargetGroupAttributes(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeTargetGroupAttributes": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeTargetGroupAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeTargetGroupAttributes(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeTargetGroupAttributes(ctx, input, gw.NATSConn, accountID)
 	}),
 	"ModifyLoadBalancerAttributes": elbv2Handler(func(ctx context.Context, input *elbv2.ModifyLoadBalancerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyLoadBalancerAttributes(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.ModifyLoadBalancerAttributes(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeLoadBalancerAttributes": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeLoadBalancerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeLoadBalancerAttributes(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeLoadBalancerAttributes(ctx, input, gw.NATSConn, accountID)
 	}),
 	"SetSecurityGroups": elbv2Handler(func(ctx context.Context, input *elbv2.SetSecurityGroupsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.SetSecurityGroups(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.SetSecurityGroups(ctx, input, gw.NATSConn, accountID)
 	}),
 	"SetIpAddressType": elbv2Handler(func(ctx context.Context, input *elbv2.SetIpAddressTypeInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.SetIpAddressType(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.SetIpAddressType(ctx, input, gw.NATSConn, accountID)
 	}),
 	"SetSubnets": elbv2Handler(func(ctx context.Context, input *elbv2.SetSubnetsInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.SetSubnets(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.SetSubnets(ctx, input, gw.NATSConn, accountID)
 	}),
 	"AddListenerCertificates": elbv2Handler(func(ctx context.Context, input *elbv2.AddListenerCertificatesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.AddListenerCertificates(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.AddListenerCertificates(ctx, input, gw.NATSConn, accountID)
 	}),
 	"RemoveListenerCertificates": elbv2Handler(func(ctx context.Context, input *elbv2.RemoveListenerCertificatesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.RemoveListenerCertificates(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.RemoveListenerCertificates(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeListenerCertificates": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeListenerCertificatesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeListenerCertificates(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeListenerCertificates(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeSSLPolicies": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeSSLPoliciesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeSSLPolicies(ctx, input, gw.NATSConn, accountID)
+		return elbv2awsapi.DescribeSSLPolicies(ctx, input, gw.NATSConn, accountID)
 	}),
 	"DescribeAccountLimits": elbv2Handler(func(ctx context.Context, input *elbv2.DescribeAccountLimitsInput, gw *GatewayConfig, accountID string) (any, error) {
 		loadBalancers, err := accountLoadBalancerLimit(ctx, gw, accountID)
 		if err != nil {
 			return nil, err
 		}
-		return gateway_elbv2.DescribeAccountLimits(input, loadBalancers), nil
+		return elbv2awsapi.DescribeAccountLimits(input, loadBalancers), nil
 	}),
-	"DescribeListenerAttributes": elbv2Handler(func(ctx context.Context, input *gateway_elbv2.DescribeListenerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.DescribeListenerAttributes(input, accountID)
+	"DescribeListenerAttributes": elbv2Handler(func(ctx context.Context, input *elbv2awsapi.DescribeListenerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return elbv2awsapi.DescribeListenerAttributes(input, accountID)
 	}),
-	"ModifyListenerAttributes": elbv2Handler(func(ctx context.Context, input *gateway_elbv2.ModifyListenerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
-		return gateway_elbv2.ModifyListenerAttributes(input, accountID)
+	"ModifyListenerAttributes": elbv2Handler(func(ctx context.Context, input *elbv2awsapi.ModifyListenerAttributesInput, gw *GatewayConfig, accountID string) (any, error) {
+		return elbv2awsapi.ModifyListenerAttributes(input, accountID)
 	}),
 }

 // accountLoadBalancerLimit resolves the load balancer cap DescribeAccountLimits
 // reports. It is read here rather than in the operation file because
-// domains/admission/quota imports gateway/elbv2 to count live load balancers, so the
-// operation file cannot import it back.
+// domains/admission/quota imports domains/elbv2/awsapi to count live load
+// balancers, so the operation file cannot import it back.
 func accountLoadBalancerLimit(ctx context.Context, gw *GatewayConfig, accountID string) (int, error) {
 	// An exempt account has no cap enforced against it, so the AWS default is a
 	// truer answer than a configured limit nothing consults.
 	if gw.Quota.Exempt(accountID) {
-		return gateway_elbv2.DefaultLoadBalancerLimit, nil
+		return elbv2awsapi.DefaultLoadBalancerLimit, nil
 	}
 	_, limits, err := gw.Quota.GetAccountQuota(ctx, accountID)
 	if err != nil {
@@ -231,7 +231,7 @@ func (gw *GatewayConfig) ELBv2_Request(w http.ResponseWriter, r *http.Request) e
 		return err
 	}

-	resources, err := gateway_elbv2.ResourceARNs(action, gw.Region, accountID, input)
+	resources, err := elbv2awsapi.ResourceARNs(action, gw.Region, accountID, input)
 	if err != nil {
 		return err
 	}
@@ -9,8 +9,8 @@ import (

 	"github.com/aws/aws-sdk-go/service/elbv2"
 	"github.com/mulgadc/spinifex/spinifex/domains/admission/quota"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -119,7 +119,7 @@ func TestELBv2AccountLoadBalancerLimitDefaultsForExemptAccount(t *testing.T) {

 	limit, err := accountLoadBalancerLimit(t.Context(), gw, "000000000042")
 	require.NoError(t, err)
-	assert.Equal(t, gateway_elbv2.DefaultLoadBalancerLimit, limit)
+	assert.Equal(t, elbv2awsapi.DefaultLoadBalancerLimit, limit)
 }

 // A sealed override must refuse the load balancer cap with Blocked rather
@@ -153,6 +153,6 @@ func TestELBv2DescribeAccountLimitsAcceptsPaging(t *testing.T) {

 	var decoded accountLimitsResponse
 	require.NoError(t, xml.Unmarshal(body, &decoded))
-	assert.Len(t, decoded.Limits, len(gateway_elbv2.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 2).Limits))
+	assert.Len(t, decoded.Limits, len(elbv2awsapi.DescribeAccountLimits(&elbv2.DescribeAccountLimitsInput{}, 2).Limits))
 	assert.NotContains(t, string(body), "NextMarker")
 }
@@ -6,7 +6,7 @@ package gateway
 import (
 	"testing"

-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	"github.com/stretchr/testify/assert"
 )

@@ -15,13 +15,13 @@ import (
 // scope left behind by a deleted or renamed action fails too.
 func TestELBv2ScopeTableIsExhaustive(t *testing.T) {
 	for action := range elbv2Actions {
-		assert.True(t, gateway_elbv2.HasScope(action),
-			"elbv2 action %q has no resource scope entry: add one to elbv2Scopes in gateway/elbv2/authz.go", action)
+		assert.True(t, elbv2awsapi.HasScope(action),
+			"elbv2 action %q has no resource scope entry: add one to elbv2Scopes in domains/elbv2/awsapi/authz.go", action)
 	}

-	for _, action := range gateway_elbv2.ScopedActions() {
+	for _, action := range elbv2awsapi.ScopedActions() {
 		_, ok := elbv2Actions[action]
 		assert.True(t, ok,
-			"elbv2Scopes has an entry for %q, which the dispatch table does not serve: remove it from gateway/elbv2/authz.go", action)
+			"elbv2Scopes has an entry for %q, which the dispatch table does not serve: remove it from domains/elbv2/awsapi/authz.go", action)
 	}
 }
@@ -4,8 +4,8 @@ import (
 	"maps"
 	"slices"

+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	rdsawsapi "github.com/mulgadc/spinifex/spinifex/domains/rds/awsapi"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/dispatch"
 )

@@ -28,8 +28,8 @@ func AWSOperationInventory(registered map[string]dispatch.Inventory) map[string]
 			Registered: mapKeys(ec2Actions),
 		},
 		"ecs": {
-			Registered: mapKeys(gateway_ecs.Actions),
-			Stubbed:    gateway_ecs.StubbedActionNames(),
+			Registered: mapKeys(ecsawsapi.Actions),
+			Stubbed:    ecsawsapi.StubbedActionNames(),
 		},
 		"eks": {
 			Registered: eksActionNames(),
@@ -22,9 +22,9 @@ import (
 	awsapi "github.com/mulgadc/spinifex/spinifex/domains/ecr/awsapi"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/errors"
 	"github.com/mulgadc/spinifex/spinifex/foundation/aws/policy"
-	gateway_ecs "github.com/mulgadc/spinifex/spinifex/gateway/ecs"
+	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
 	eksawsapi "github.com/mulgadc/spinifex/spinifex/domains/eks/awsapi"
-	gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
+	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
 	iamawsapi "github.com/mulgadc/spinifex/spinifex/domains/iam/awsapi"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -342,7 +342,7 @@ func scopedServices() []scopedService {
 		// Every ECS identifier is folded through a ShortName/ShortID helper and
 		// rebuilt on the caller's account, so a full ARN is accepted wherever a
 		// name is. The two cases drive the tag and the cluster-list resolvers.
-		{name: "ecs", actions: gateway_ecs.ScopedActions(), uncased: map[string]string{
+		{name: "ecs", actions: ecsawsapi.ScopedActions(), uncased: map[string]string{
 			"TagResource":                   sameHelper("ListTagsForResource"),
 			"UntagResource":                 sameHelper("ListTagsForResource"),
 			"CreateCluster":                 sameHelper("DescribeClusters"),
@@ -390,7 +390,7 @@ func scopedServices() []scopedService {
 		// cluster, nodegroup or addon by path segment.
 		{name: "eks", actions: eksawsapi.ScopedActions(), uncased: eksUncased()},

-		{name: "elasticloadbalancing", actions: gateway_elbv2.ScopedActions(), uncased: elbv2Uncased()},
+		{name: "elasticloadbalancing", actions: elbv2awsapi.ScopedActions(), uncased: elbv2Uncased()},

 		{name: "iam", actions: iamawsapi.ScopedActions(), uncased: iamUncased()},
 	}