diff --git a/api/consent.js b/api/consent.js
index b463072..a673e1f 100644
--- a/api/consent.js
+++ b/api/consent.js
@@ -1,4 +1,4 @@
-import { recordAuditEvent, recordUserConsent } from "./_db.js";
+import { recordAuditEvent, recordUserConsent } from "../lib/db.js";
 
 function activeVersions() {
   return {
diff --git a/api/incident.js b/api/incident.js
index 2565d2a..c144186 100644
--- a/api/incident.js
+++ b/api/incident.js
@@ -1,4 +1,4 @@
-import { recordAuditEvent } from "./_db.js";
+import { recordAuditEvent } from "../lib/db.js";
 
 async function notifyIncidentWebhook(payload) {
   const url = process.env.INCIDENT_WEBHOOK_URL || process.env.SENTRY_WEBHOOK_URL;
diff --git a/api/liquidity.js b/api/liquidity.js
deleted file mode 100644
index cee07fc..0000000
--- a/api/liquidity.js
+++ /dev/null
@@ -1,18 +0,0 @@
-import { auditLiquidity } from "../lib/liquidity-audit.js";
-
-export default async function handler(req, res) {
-  if (req.method !== "GET") {
-    res.setHeader("Allow", "GET");
-    return res.status(405).json({ error: "method_not_allowed" });
-  }
-  try {
-    const report = await auditLiquidity({
-      marketLimit: Number(req.query.limit || 60),
-      minHoursToEnd: Number(req.query.min_hours || 48),
-    });
-    res.setHeader("Cache-Control", "s-maxage=60, stale-while-revalidate=120");
-    return res.status(200).json({ ok: true, ...report });
-  } catch (error) {
-    return res.status(502).json({ ok: false, error: "liquidity_audit_unavailable", detail: String(error && error.message || error) });
-  }
-}
diff --git a/api/live.js b/api/live.js
index 13811a9..d2aca1f 100644
--- a/api/live.js
+++ b/api/live.js
@@ -8,7 +8,8 @@ import {
   recordRealFill,
   updateRealPositionMark,
   updateTradeTicketStatus,
-} from "./_db.js";
+} from "../lib/db.js";
+import { auditLiquidity } from "../lib/liquidity-audit.js";
 import nodemailer from "nodemailer";
 
 const REQUIRED_ENV = [
@@ -731,6 +732,22 @@ export default async function handler(req, res) {
   res.setHeader("Cache-Control", "no-store");
 
   if (req.method === "GET") {
+    if (req.query?.action === "liquidity") {
+      try {
+        const report = await auditLiquidity({
+          marketLimit: Number(req.query.limit || 60),
+          minHoursToEnd: Number(req.query.min_hours || 48),
+        });
+        res.setHeader("Cache-Control", "s-maxage=60, stale-while-revalidate=120");
+        return res.status(200).json({ ok: true, ...report });
+      } catch (error) {
+        return res.status(502).json({
+          ok: false,
+          error: "liquidity_audit_unavailable",
+          detail: String(error?.message || error),
+        });
+      }
+    }
     if (req.query?.action === "tickets") {
       const userId = String(req.query?.user_id || "local-readiness-user").trim();
       const tickets = await listTradeTickets(userId, req.query?.limit || 50);
diff --git a/api/provider-events.js b/api/provider-events.js
index af791e7..87db59d 100644
--- a/api/provider-events.js
+++ b/api/provider-events.js
@@ -1,4 +1,4 @@
-import { hasDatabase, providerEventSummary } from "./_db.js";
+import { hasDatabase, providerEventSummary } from "../lib/db.js";
 
 export default async function handler(req, res) {
   res.setHeader("Cache-Control", "no-store");
diff --git a/api/risk-profile.js b/api/risk-profile.js
index 800d3ed..7eaf02b 100644
--- a/api/risk-profile.js
+++ b/api/risk-profile.js
@@ -1,4 +1,4 @@
-import { latestRiskProfile, recordAuditEvent, upsertRiskProfile } from "./_db.js";
+import { latestRiskProfile, recordAuditEvent, upsertRiskProfile } from "../lib/db.js";
 
 function validateProfile(profile) {
   const errors = [];
diff --git a/api/state.js b/api/state.js
index ab10304..12f0633 100644
--- a/api/state.js
+++ b/api/state.js
@@ -1,5 +1,5 @@
 import { get, list, put } from "@vercel/blob";
-import { databaseConnectionDiagnostics, hasDatabase, readSharedAppState, writeSharedAppState } from "./_db.js";
+import { databaseConnectionDiagnostics, hasDatabase, readSharedAppState, writeSharedAppState } from "../lib/db.js";
 
 const STATE_PATH = process.env.PMA_STATE_PATH || "shared/state.json";
 const STATE_VERSION_PREFIX = process.env.PMA_STATE_VERSION_PREFIX || "shared/state-versions/";
diff --git a/api/webhooks/circle.js b/api/webhooks/circle.js
index 6088035..7e69e5b 100644
--- a/api/webhooks/circle.js
+++ b/api/webhooks/circle.js
@@ -1,5 +1,5 @@
-import { recordProviderEvent } from "../_db.js";
-import { firstHeader, parseJson, rawBody, safeHeaders, sendMethodNotAllowed, verifyHmacSignature } from "../_webhook.js";
+import { recordProviderEvent } from "../../lib/db.js";
+import { firstHeader, parseJson, rawBody, safeHeaders, sendMethodNotAllowed, verifyHmacSignature } from "../../lib/webhook.js";
 
 const SIGNATURE_HEADERS = [
   "circle-signature",
diff --git a/api/webhooks/clerk.js b/api/webhooks/clerk.js
index 575db5c..3fc177a 100644
--- a/api/webhooks/clerk.js
+++ b/api/webhooks/clerk.js
@@ -1,6 +1,6 @@
 import { Webhook } from "svix";
-import { recordProviderEvent } from "../_db.js";
-import { rawBody, parseJson, safeHeaders, sendMethodNotAllowed } from "../_webhook.js";
+import { recordProviderEvent } from "../../lib/db.js";
+import { rawBody, parseJson, safeHeaders, sendMethodNotAllowed } from "../../lib/webhook.js";
 
 function eventType(payload) {
   return payload.type || "clerk.webhook";
diff --git a/api/webhooks/veriff.js b/api/webhooks/veriff.js
index 21faa63..06f75b7 100644
--- a/api/webhooks/veriff.js
+++ b/api/webhooks/veriff.js
@@ -1,5 +1,5 @@
-import { recordProviderEvent } from "../_db.js";
-import { firstHeader, parseJson, rawBody, safeHeaders, sendMethodNotAllowed, verifyHmacSignature } from "../_webhook.js";
+import { recordProviderEvent } from "../../lib/db.js";
+import { firstHeader, parseJson, rawBody, safeHeaders, sendMethodNotAllowed, verifyHmacSignature } from "../../lib/webhook.js";
 
 const SIGNATURE_HEADERS = [
   "x-hmac-signature",
diff --git a/api/_db.js b/lib/db.js
similarity index 100%
rename from api/_db.js
rename to lib/db.js
diff --git a/api/_webhook.js b/lib/webhook.js
similarity index 100%
rename from api/_webhook.js
rename to lib/webhook.js
diff --git a/scripts/test-server-state.mjs b/scripts/test-server-state.mjs
index 8a2841c..6e16956 100644
--- a/scripts/test-server-state.mjs
+++ b/scripts/test-server-state.mjs
@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { databaseConnectionDiagnostics, databaseUrl, databaseUrls, normalizeDatabaseUrl } from "../api/_db.js";
+import { databaseConnectionDiagnostics, databaseUrl, databaseUrls, normalizeDatabaseUrl } from "../lib/db.js";
 import { compactAgentState, compactSuggestion, providerErrorCode } from "../api/state.js";
 
 assert.equal(normalizeDatabaseUrl("psql 'postgresql://user:pass@example.test/db?sslmode=require'"),
diff --git a/vercel.json b/vercel.json
index 0083183..a31f431 100644
--- a/vercel.json
+++ b/vercel.json
@@ -1,4 +1,10 @@
 {
+  "rewrites": [
+    {
+      "source": "/api/liquidity",
+      "destination": "/api/live?action=liquidity"
+    }
+  ],
   "headers": [
     {
       "source": "/",