@mesh-tech/mesh-cli 0.34.0 → 0.34.2

package/dist/bin/mesh.js

@@ -9,7 +9,7 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// libs/mesh-cli/src/utils/errors.ts
+// packages/mesh-cli/src/utils/errors.ts
 import chalk from "chalk";
 function renderErrorBody(err) {
   const message = err instanceof Error ? err.message : String(err);
@@ -53,7 +53,7 @@ function handleCliError(err) {
 }
 var MeshCliError, jsonPayloadEmitted;
 var init_errors = __esm({
-  "libs/mesh-cli/src/utils/errors.ts"() {
+  "packages/mesh-cli/src/utils/errors.ts"() {
     "use strict";
     MeshCliError = class extends Error {
       remediation;
@@ -69,7 +69,7 @@ var init_errors = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/log.ts
+// packages/mesh-cli/src/utils/log.ts
 import chalk2 from "chalk";
 function logPrefix(opts) {
   const enabled = opts.envFlag === "1" || opts.envFlag !== "0" && !opts.isTTY;
@@ -121,12 +121,12 @@ function startHeartbeat(label, intervalMs = 15e3) {
   };
 }
 var init_log = __esm({
-  "libs/mesh-cli/src/utils/log.ts"() {
+  "packages/mesh-cli/src/utils/log.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/mesh-json.ts
+// packages/mesh-cli/src/utils/mesh-json.ts
 import * as fs from "fs";
 import * as path from "path";
 function isValidTenantName(value) {
@@ -170,13 +170,13 @@ function writeMeshJson(rootDir, data) {
 }
 var MESH_JSON;
 var init_mesh_json = __esm({
-  "libs/mesh-cli/src/utils/mesh-json.ts"() {
+  "packages/mesh-cli/src/utils/mesh-json.ts"() {
     "use strict";
     MESH_JSON = "mesh.json";
   }
 });
 
-// libs/mesh-cli/src/utils/context.ts
+// packages/mesh-cli/src/utils/context.ts
 import * as fs2 from "fs";
 import * as path2 from "path";
 function findFileUpwardInRepo(filename, startDir = process.cwd()) {
@@ -488,7 +488,7 @@ function detectContext(stageArg, options = {}) {
   return { tenant, stage, platformEnv, detectedTenant };
 }
 var init_context = __esm({
-  "libs/mesh-cli/src/utils/context.ts"() {
+  "packages/mesh-cli/src/utils/context.ts"() {
     "use strict";
     init_errors();
     init_log();
@@ -496,7 +496,7 @@ var init_context = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/bastion.ts
+// packages/mesh-cli/src/utils/bastion.ts
 import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";
 async function getPlatformBastionInfo(tenant, platformEnv, region) {
   const ssm = new SSMClient(region ? { region } : {});
@@ -568,13 +568,13 @@ async function getPlatformBastionInfo(tenant, platformEnv, region) {
   }
 }
 var init_bastion = __esm({
-  "libs/mesh-cli/src/utils/bastion.ts"() {
+  "packages/mesh-cli/src/utils/bastion.ts"() {
     "use strict";
     init_log();
   }
 });
 
-// libs/mesh-cli/src/utils/credentials.ts
+// packages/mesh-cli/src/utils/credentials.ts
 import {
   SecretsManagerClient,
   GetSecretValueCommand
@@ -633,13 +633,13 @@ function rewriteDatabaseUrl(url, options) {
   }
 }
 var init_credentials = __esm({
-  "libs/mesh-cli/src/utils/credentials.ts"() {
+  "packages/mesh-cli/src/utils/credentials.ts"() {
     "use strict";
     init_log();
   }
 });
 
-// libs/mesh-cli/src/utils/pulumi.ts
+// packages/mesh-cli/src/utils/pulumi.ts
 import { execFileSync } from "child_process";
 import * as path3 from "path";
 import * as fs3 from "fs";
@@ -705,12 +705,12 @@ function pulumiStackOutput(appRoot, key, extraArgs, env) {
   }
 }
 var init_pulumi = __esm({
-  "libs/mesh-cli/src/utils/pulumi.ts"() {
+  "packages/mesh-cli/src/utils/pulumi.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/vpn.ts
+// packages/mesh-cli/src/utils/vpn.ts
 import { execFile, execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
 async function isVpnConnected() {
@@ -842,7 +842,7 @@ function unregisterDnsRecords(cfg, suffix) {
 }
 var TAILSCALE_PATHS, TAILSCALE_SOCKET_PATHS;
 var init_vpn = __esm({
-  "libs/mesh-cli/src/utils/vpn.ts"() {
+  "packages/mesh-cli/src/utils/vpn.ts"() {
     "use strict";
     TAILSCALE_PATHS = [
       "tailscale",
@@ -852,9 +852,9 @@ var init_vpn = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/index.ts
+// packages/mesh-cli/src/utils/index.ts
 var init_utils = __esm({
-  "libs/mesh-cli/src/utils/index.ts"() {
+  "packages/mesh-cli/src/utils/index.ts"() {
     "use strict";
     init_errors();
     init_log();
@@ -866,7 +866,7 @@ var init_utils = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/seed.ts
+// packages/mesh-cli/src/commands/local/seed.ts
 function localAwsEnv() {
   return {
     AWS_ENDPOINT_URL: LOCAL_AWS_ENDPOINT,
@@ -972,7 +972,7 @@ async function verifyFabric() {
         `Local AWS fabric failed the ${payload.length}-byte Advanced-tier SSM round-trip (got ${roundTrip.Parameter?.Value?.length ?? 0} bytes back).`,
         {
           remediation: {
-            docs: "libs/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
+            docs: "packages/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
           }
         }
       );
@@ -987,7 +987,7 @@ async function verifyFabric() {
         `Local AWS fabric's GetParametersByPath missed child parameter(s): ${missing.join(", ")} (splitKeys exports would not resolve).`,
         {
           remediation: {
-            docs: "libs/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
+            docs: "packages/mesh-cli/stack/docker-compose.yml \u2014 swap the ministack image for motoserver/moto (design \xA72.5 fallback)"
           }
         }
       );
@@ -1071,7 +1071,7 @@ async function seedLocalPlatform() {
 }
 var LOCAL_TENANT, LOCAL_ENV, LOCAL_AWS_ENDPOINT, LOCAL_AWS_REGION, ARTIFACTS_BUCKET, DATA_BUCKET, APP_TENANTS_PARAM, DATA_BUCKET_SEEDS, LOCAL_AWS_CONFIG, AWS_CONFIG, FABRIC_CHECK_PATH, TEMPORAL_NAMESPACE, TEMPORAL_ADDRESS;
 var init_seed = __esm({
-  "libs/mesh-cli/src/commands/local/seed.ts"() {
+  "packages/mesh-cli/src/commands/local/seed.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -1110,7 +1110,18 @@ var init_seed = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/helpers.ts
+// packages/mesh-cli/src/utils/aws-errors.ts
+function isAwsErrorCode(err, code) {
+  const e = err;
+  return e?.name === code || e?.__type === code || e?.Code === code || e?.code === code || typeof e?.message === "string" && e.message.includes(code);
+}
+var init_aws_errors = __esm({
+  "packages/mesh-cli/src/utils/aws-errors.ts"() {
+    "use strict";
+  }
+});
+
+// packages/mesh-cli/src/commands/local/helpers.ts
 import * as net from "net";
 import { execFileSync as execFileSync3 } from "child_process";
 async function upsertLocalSecret(secretId, value, client) {
@@ -1120,7 +1131,7 @@ async function upsertLocalSecret(secretId, value, client) {
   try {
     await sm.send(new CreateSecretCommand4({ Name: secretId, SecretString: secretString }));
   } catch (err) {
-    if (err?.name === "ResourceExistsException") {
+    if (isAwsErrorCode(err, "ResourceExistsException")) {
       await sm.send(new PutSecretValueCommand4({ SecretId: secretId, SecretString: secretString }));
     } else {
       throw err;
@@ -1199,9 +1210,10 @@ function describePortConflicts(conflicts, moveHints = /* @__PURE__ */ new Map())
 }
 var defaultPortConflictIo;
 var init_helpers = __esm({
-  "libs/mesh-cli/src/commands/local/helpers.ts"() {
+  "packages/mesh-cli/src/commands/local/helpers.ts"() {
     "use strict";
     init_seed();
+    init_aws_errors();
     defaultPortConflictIo = {
       dockerPs: () => {
         try {
@@ -1230,7 +1242,7 @@ var init_helpers = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/cache-home.ts
+// packages/mesh-cli/src/utils/cache-home.ts
 import fs4 from "node:fs";
 import os from "node:os";
 import path4 from "node:path";
@@ -1243,12 +1255,12 @@ function meshCacheDir(...segments) {
   return dir;
 }
 var init_cache_home = __esm({
-  "libs/mesh-cli/src/utils/cache-home.ts"() {
+  "packages/mesh-cli/src/utils/cache-home.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/commands/local/stack.ts
+// packages/mesh-cli/src/commands/local/stack.ts
 var stack_exports = {};
 __export(stack_exports, {
   BASE_COMPOSE_FILE: () => BASE_COMPOSE_FILE,
@@ -1585,7 +1597,7 @@ async function probeEndpoint(endpoint) {
 }
 var COMPOSE_PROJECT, STACK_ENDPOINTS, DEFAULT_HUB_PORT, BASE_COMPOSE_FILE, HUB_OVERLAY_FILE, IDPS_OVERLAY_FILE, overlayServicesCache, ONE_SHOT_SERVICES;
 var init_stack = __esm({
-  "libs/mesh-cli/src/commands/local/stack.ts"() {
+  "packages/mesh-cli/src/commands/local/stack.ts"() {
     "use strict";
     init_helpers();
     init_cache_home();
@@ -1696,7 +1708,7 @@ var init_stack = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/skills.ts
+// packages/mesh-cli/src/commands/skills.ts
 var skills_exports = {};
 __export(skills_exports, {
   INTENT_RANGE: () => INTENT_RANGE,
@@ -1996,7 +2008,7 @@ function registerSkillsCommands(program2) {
 }
 var MANAGED_MARKER, FENCE_START, HOOK_RELATIVE, INTENT_RANGE, BASE_SKILL_PACKAGE;
 var init_skills = __esm({
-  "libs/mesh-cli/src/commands/skills.ts"() {
+  "packages/mesh-cli/src/commands/skills.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -2009,7 +2021,7 @@ var init_skills = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/app-check-resolve.ts
+// packages/mesh-cli/src/commands/app-check-resolve.ts
 import * as fs7 from "node:fs";
 import * as path7 from "node:path";
 import { builtinModules } from "node:module";
@@ -2237,7 +2249,7 @@ function resolveProgramImports(appDir, options = {}) {
 }
 var CONDITIONS, EXTENSIONS, SCOPE, FILE_BUDGET, BUILTINS;
 var init_app_check_resolve = __esm({
-  "libs/mesh-cli/src/commands/app-check-resolve.ts"() {
+  "packages/mesh-cli/src/commands/app-check-resolve.ts"() {
     "use strict";
     CONDITIONS = /* @__PURE__ */ new Set(["source", "node", "import", "require", "module", "module-sync", "default"]);
     EXTENSIONS = ["", ".ts", ".tsx", ".js", ".mjs", ".cjs", "/index.ts", "/index.js", "/index.mjs"];
@@ -2247,7 +2259,7 @@ var init_app_check_resolve = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/first-party-contexts.ts
+// packages/mesh-cli/src/utils/first-party-contexts.ts
 function firstPartyDomainFor(context) {
   if (!Object.hasOwn(FIRST_PARTY_CONTEXTS, context)) return null;
   const domain = FIRST_PARTY_CONTEXTS[context];
@@ -2255,7 +2267,7 @@ function firstPartyDomainFor(context) {
 }
 var FIRST_PARTY_CONTEXTS;
 var init_first_party_contexts = __esm({
-  "libs/mesh-cli/src/utils/first-party-contexts.ts"() {
+  "packages/mesh-cli/src/utils/first-party-contexts.ts"() {
     "use strict";
     FIRST_PARTY_CONTEXTS = Object.freeze({
       // Verified 2026-08-14: https://cli.dev.platform.meshtech.io/.well-known/mesh.json
@@ -2269,7 +2281,7 @@ var init_first_party_contexts = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/pid.ts
+// packages/mesh-cli/src/utils/pid.ts
 function unsignalableReason(pid) {
   if (typeof pid !== "number") {
     return `expected an integer, got ${typeof pid} (${String(pid)})`;
@@ -2304,14 +2316,14 @@ function assertSignalablePid(pid, source) {
 }
 var MIN_SIGNALABLE_PID;
 var init_pid = __esm({
-  "libs/mesh-cli/src/utils/pid.ts"() {
+  "packages/mesh-cli/src/utils/pid.ts"() {
     "use strict";
     init_errors();
     MIN_SIGNALABLE_PID = 2;
   }
 });
 
-// libs/mesh-cli/src/utils/tailscale-targets.ts
+// packages/mesh-cli/src/utils/tailscale-targets.ts
 import { execFileSync as execFileSync6 } from "node:child_process";
 import * as fs8 from "node:fs";
 import * as path8 from "node:path";
@@ -2361,7 +2373,7 @@ function resolveElbIp(host) {
 }
 var PORT_BLOCK, TUNNEL_NAME_BY_BASTION_KEY;
 var init_tailscale_targets = __esm({
-  "libs/mesh-cli/src/utils/tailscale-targets.ts"() {
+  "packages/mesh-cli/src/utils/tailscale-targets.ts"() {
     "use strict";
     init_dev();
     init_login();
@@ -2374,7 +2386,7 @@ var init_tailscale_targets = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/socks-forward.ts
+// packages/mesh-cli/src/utils/socks-forward.ts
 import * as net2 from "node:net";
 function ipv4ToBytes(ip) {
   const parts = ip.split(".");
@@ -2435,7 +2447,7 @@ function createForwarder(opts) {
 }
 var SOCKS_REPLY_MESSAGES;
 var init_socks_forward = __esm({
-  "libs/mesh-cli/src/utils/socks-forward.ts"() {
+  "packages/mesh-cli/src/utils/socks-forward.ts"() {
     "use strict";
     SOCKS_REPLY_MESSAGES = {
       0: "succeeded",
@@ -2451,7 +2463,7 @@ var init_socks_forward = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/tunnel-ownership.ts
+// packages/mesh-cli/src/utils/tunnel-ownership.ts
 import * as crypto from "node:crypto";
 import * as fs9 from "node:fs";
 import * as net3 from "node:net";
@@ -2638,12 +2650,12 @@ function buildSquatterError(tenant, squatted, detail) {
   ].join("\n");
 }
 var init_tunnel_ownership = __esm({
-  "libs/mesh-cli/src/utils/tunnel-ownership.ts"() {
+  "packages/mesh-cli/src/utils/tunnel-ownership.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/tailscale.ts
+// packages/mesh-cli/src/utils/tailscale.ts
 import * as fs10 from "node:fs";
 import * as net4 from "node:net";
 import * as os2 from "node:os";
@@ -3285,7 +3297,7 @@ async function runTunnels(tenant) {
 }
 var sleep, _launchdAvailable;
 var init_tailscale = __esm({
-  "libs/mesh-cli/src/utils/tailscale.ts"() {
+  "packages/mesh-cli/src/utils/tailscale.ts"() {
     "use strict";
     init_login();
     init_aws_auth();
@@ -3300,7 +3312,7 @@ var init_tailscale = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/vpn/tunnel.ts
+// packages/mesh-cli/src/commands/vpn/tunnel.ts
 import * as net5 from "node:net";
 function deriveLoginServer(context) {
   const cfg = getContextConfig(context);
@@ -3433,7 +3445,7 @@ function registerTunnelSubcommands(vpn) {
   tunnel.command("__supervise <tenant>", { hidden: true }).action((tenant) => runTunnels(tenant));
 }
 var init_tunnel = __esm({
-  "libs/mesh-cli/src/commands/vpn/tunnel.ts"() {
+  "packages/mesh-cli/src/commands/vpn/tunnel.ts"() {
     "use strict";
     init_log();
     init_login();
@@ -3441,7 +3453,7 @@ var init_tunnel = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/vpn/index.ts
+// packages/mesh-cli/src/commands/vpn/index.ts
 import { execFileSync as execFileSync9 } from "child_process";
 import * as net6 from "node:net";
 function defaultNamespace(tenant, env) {
@@ -3871,7 +3883,7 @@ function registerVpnCommands(program2) {
 }
 var HEADSCALE_POD, HEADSCALE_CONTAINER;
 var init_vpn2 = __esm({
-  "libs/mesh-cli/src/commands/vpn/index.ts"() {
+  "packages/mesh-cli/src/commands/vpn/index.ts"() {
     "use strict";
     init_utils();
     init_login();
@@ -3882,7 +3894,7 @@ var init_vpn2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/login.ts
+// packages/mesh-cli/src/commands/login.ts
 var login_exports = {};
 __export(login_exports, {
   CONFIG_DIR: () => CONFIG_DIR,
@@ -4964,7 +4976,7 @@ async function discoverConfigForContext(context) {
 }
 var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, REDIRECT_PORT, REDIRECT_URI, BASE_SCOPES, atomicWriteCounter, MAX_DEVICE_CODES, RESERVED_REGISTRY_CONTEXT, NO_REGISTRY_DEPRECATED, REGISTRY_SEPARATE_HINT;
 var init_login = __esm({
-  "libs/mesh-cli/src/commands/login.ts"() {
+  "packages/mesh-cli/src/commands/login.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -4988,7 +5000,7 @@ var init_login = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/registry-broker.ts
+// packages/mesh-cli/src/utils/registry-broker.ts
 function deriveRegistryBroker(context, getCfg = getContextConfig) {
   const cfg = getCfg(context);
   if (!cfg?.issuer) return null;
@@ -5071,14 +5083,14 @@ function realGrantDeps() {
 }
 var PUBLISHED_BROKER_TIMEOUT_MS;
 var init_registry_broker = __esm({
-  "libs/mesh-cli/src/utils/registry-broker.ts"() {
+  "packages/mesh-cli/src/utils/registry-broker.ts"() {
     "use strict";
     init_login();
     PUBLISHED_BROKER_TIMEOUT_MS = 15e3;
   }
 });
 
-// libs/mesh-cli/src/utils/registry-identity.ts
+// packages/mesh-cli/src/utils/registry-identity.ts
 var registry_identity_exports = {};
 __export(registry_identity_exports, {
   REGISTRY_ALIAS: () => REGISTRY_ALIAS,
@@ -5253,7 +5265,7 @@ function logRegistryIdentity(identity) {
 }
 var REGISTRY_ALIAS, REGISTRY_DOMAIN, REGISTRY_CREDENTIAL_KEY, RegistryIdentityError;
 var init_registry_identity = __esm({
-  "libs/mesh-cli/src/utils/registry-identity.ts"() {
+  "packages/mesh-cli/src/utils/registry-identity.ts"() {
     "use strict";
     init_login();
     init_aws_auth();
@@ -5283,7 +5295,7 @@ var init_registry_identity = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/auth-preflight.ts
+// packages/mesh-cli/src/utils/auth-preflight.ts
 var auth_preflight_exports = {};
 __export(auth_preflight_exports, {
   REGISTRY_LOGIN_FIX: () => REGISTRY_LOGIN_FIX,
@@ -5465,7 +5477,7 @@ function appUsesMeshPackages(appRoot) {
 }
 var REGISTRY_LOGIN_FIX, REGISTRY_LOGIN_FIX_AWS, SSO_LOGIN_FIX, SSO_SESSION_SNIPPET;
 var init_auth_preflight = __esm({
-  "libs/mesh-cli/src/utils/auth-preflight.ts"() {
+  "packages/mesh-cli/src/utils/auth-preflight.ts"() {
     "use strict";
     REGISTRY_LOGIN_FIX = "mesh registry login";
     REGISTRY_LOGIN_FIX_AWS = "mesh registry login --profile mesh-dev";
@@ -5477,7 +5489,7 @@ sso_registration_scopes = sso:account:access`;
   }
 });
 
-// libs/mesh-cli/src/utils/aws-auth.ts
+// packages/mesh-cli/src/utils/aws-auth.ts
 import * as fs13 from "fs";
 import * as path13 from "path";
 import {
@@ -5801,7 +5813,7 @@ async function resolveAwsCredentials(roleArn, appRoot, stack) {
 }
 var DEFAULT_REGION, MANAGED_START_PREFIX, MANAGED_START, MANAGED_END;
 var init_aws_auth = __esm({
-  "libs/mesh-cli/src/utils/aws-auth.ts"() {
+  "packages/mesh-cli/src/utils/aws-auth.ts"() {
     "use strict";
     init_log();
     init_auth_preflight();
@@ -5813,7 +5825,7 @@ var init_aws_auth = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/vpn-join.ts
+// packages/mesh-cli/src/utils/vpn-join.ts
 function resolveVpnJoinBroker(context, getCfg = getContextConfig) {
   const cfg = getCfg(context);
   if (cfg?.vpnJoinBroker) return cfg.vpnJoinBroker;
@@ -5849,13 +5861,13 @@ async function mintPreAuthKey(context, brokerUrl, deps) {
   }
 }
 var init_vpn_join = __esm({
-  "libs/mesh-cli/src/utils/vpn-join.ts"() {
+  "packages/mesh-cli/src/utils/vpn-join.ts"() {
     "use strict";
     init_login();
   }
 });
 
-// libs/mesh-cli/src/utils/pulumi-run.ts
+// packages/mesh-cli/src/utils/pulumi-run.ts
 function credProbeToPreflightError(probe, context) {
   switch (probe.state) {
     case "ok":
@@ -5925,7 +5937,7 @@ async function resolvePulumiEnv(opts) {
   return { ...resolved.env };
 }
 var init_pulumi_run = __esm({
-  "libs/mesh-cli/src/utils/pulumi-run.ts"() {
+  "packages/mesh-cli/src/utils/pulumi-run.ts"() {
     "use strict";
     init_log();
     init_pulumi();
@@ -5934,7 +5946,7 @@ var init_pulumi_run = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/kubeconfig.ts
+// packages/mesh-cli/src/utils/kubeconfig.ts
 import * as fs14 from "fs";
 import * as os4 from "os";
 import * as path14 from "path";
@@ -6008,12 +6020,12 @@ async function ensureKubeconfig(platformName, env, sessionName, deps = {}) {
   return kubeconfigPath;
 }
 var init_kubeconfig = __esm({
-  "libs/mesh-cli/src/utils/kubeconfig.ts"() {
+  "packages/mesh-cli/src/utils/kubeconfig.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/temporal-auth.ts
+// packages/mesh-cli/src/utils/temporal-auth.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
 async function resolveTemporalAuth(tenant, env, platformName = tenant) {
   const { SSMClient: SSMClient5, GetParameterCommand: GetParameterCommand2 } = await import("@aws-sdk/client-ssm");
@@ -6140,13 +6152,13 @@ async function acquireTemporalBearer(vars = {}) {
   return data.access_token;
 }
 var init_temporal_auth = __esm({
-  "libs/mesh-cli/src/utils/temporal-auth.ts"() {
+  "packages/mesh-cli/src/utils/temporal-auth.ts"() {
     "use strict";
     init_log();
   }
 });
 
-// libs/mesh-cli/src/utils/reachability.ts
+// packages/mesh-cli/src/utils/reachability.ts
 import { createConnection } from "node:net";
 function probeTcpReachable(host, port, timeoutMs = 1500) {
   return new Promise((resolve21) => {
@@ -6186,12 +6198,12 @@ function probeConnectionHolds(host, port, timeoutMs = 800, holdMs = 25) {
   });
 }
 var init_reachability = __esm({
-  "libs/mesh-cli/src/utils/reachability.ts"() {
+  "packages/mesh-cli/src/utils/reachability.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/workflow-fingerprint.ts
+// packages/mesh-cli/src/utils/workflow-fingerprint.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync13, readFileSync as readFileSync13, readdirSync as readdirSync4 } from "node:fs";
 import { dirname as dirname13, isAbsolute as isAbsolute2, join as join13, relative as relative4 } from "node:path";
@@ -6254,7 +6266,7 @@ function fingerprintWorkflowSource(appRoot, services = {}) {
 }
 var WORKFLOW_PACKAGE_DIRS, EXCLUDE;
 var init_workflow_fingerprint = __esm({
-  "libs/mesh-cli/src/utils/workflow-fingerprint.ts"() {
+  "packages/mesh-cli/src/utils/workflow-fingerprint.ts"() {
     "use strict";
     WORKFLOW_PACKAGE_DIRS = [
       "packages/agent-sdk/src",
@@ -6265,7 +6277,7 @@ var init_workflow_fingerprint = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/dev-launch.ts
+// packages/mesh-cli/src/commands/dev-launch.ts
 import * as fs15 from "fs";
 import * as net7 from "net";
 import * as path15 from "path";
@@ -6325,14 +6337,14 @@ function tryConnect(host, port, timeoutMs) {
 }
 var ENV_FILE_MODE, ENV_KEY_RE;
 var init_dev_launch = __esm({
-  "libs/mesh-cli/src/commands/dev-launch.ts"() {
+  "packages/mesh-cli/src/commands/dev-launch.ts"() {
     "use strict";
     ENV_FILE_MODE = 384;
     ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
   }
 });
 
-// libs/mesh-cli/src/commands/local/mocks.ts
+// packages/mesh-cli/src/commands/local/mocks.ts
 import { execFileSync as execFileSync12 } from "child_process";
 import * as fs16 from "fs";
 import * as path16 from "path";
@@ -6823,7 +6835,7 @@ async function seedLocalMock(args) {
 }
 var EXTERNAL_MODES, DECL_DOCS, dockerProbes, SECRET_KEY_RE;
 var init_mocks = __esm({
-  "libs/mesh-cli/src/commands/local/mocks.ts"() {
+  "packages/mesh-cli/src/commands/local/mocks.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -6842,7 +6854,7 @@ var init_mocks = __esm({
   }
 });
 
-// libs/api-registry/src/hub-roles.ts
+// packages/api-registry/src/hub-roles.ts
 function restrictedRoleBase(roleKey) {
   const sep8 = roleKey.indexOf(HUB_ROLE_KEY_SEPARATOR);
   const base = sep8 === -1 ? roleKey : roleKey.slice(0, sep8);
@@ -6875,7 +6887,7 @@ function hubOperatorRoleKeys(tenants) {
 }
 var HUB_STAFF_ROLES, HUB_RESTRICTED_ROLES, HUB_VENDOR_DOCS_ROLE, HUB_ADDON_ROLES, HUB_TIER_ROLES, HUB_BASE_ROLES, HUB_ROLE_KEY_SEPARATOR, HUB_ROLE_APP_SEPARATOR, RESTRICTED, ADDONS;
 var init_hub_roles = __esm({
-  "libs/api-registry/src/hub-roles.ts"() {
+  "packages/api-registry/src/hub-roles.ts"() {
     "use strict";
     HUB_STAFF_ROLES = ["ops", "admin"];
     HUB_RESTRICTED_ROLES = ["developer", "auditor", "vendor", "docs"];
@@ -6896,11 +6908,11 @@ var init_hub_roles = __esm({
   }
 });
 
-// libs/api-registry/src/index.ts
+// packages/api-registry/src/index.ts
 import { z } from "zod";
 var rateLimitSpecSchema, rateLimitDefaultsSchema, integrationHealthSchema, apiSurfaceKindSchema, apiDocsSiteAudienceSchema, apiSurfaceSchema, apiRegistryEntrySchema, integrationStatusSchema, hubActAsExportsSchema;
 var init_src = __esm({
-  "libs/api-registry/src/index.ts"() {
+  "packages/api-registry/src/index.ts"() {
     "use strict";
     init_hub_roles();
     rateLimitSpecSchema = z.object({
@@ -6983,7 +6995,7 @@ var init_src = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/mock-idps.ts
+// packages/mesh-cli/src/commands/local/mock-idps.ts
 import { execFileSync as execFileSync13 } from "child_process";
 import * as fs17 from "fs";
 import * as path17 from "path";
@@ -7029,7 +7041,7 @@ function ensureMockSamlSigningKey() {
 }
 var MOCK_SAML_PORT, MOCK_OIDC_PORT, MOCK_OIDC_SERVICE, idpEndpoints, MOCK_SAML_IDP_NAME, MOCK_OIDC_IDP_NAME, MOCK_OIDC_CLIENT_ID, MOCK_OIDC_CLIENT_SECRET, mockSamlMetadataUrl, mockOidcEndpoints, keyDir, mockIdpComposeEnv, buildMockSamlIdpBody, buildMockOauthIdpBody, missingLoginPolicyIdps;
 var init_mock_idps = __esm({
-  "libs/mesh-cli/src/commands/local/mock-idps.ts"() {
+  "packages/mesh-cli/src/commands/local/mock-idps.ts"() {
     "use strict";
     init_cache_home();
     init_errors();
@@ -7116,7 +7128,7 @@ var init_mock_idps = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/seed-zitadel.ts
+// packages/mesh-cli/src/commands/local/seed-zitadel.ts
 import * as fs18 from "fs";
 import * as os5 from "os";
 import * as path18 from "path";
@@ -7620,7 +7632,7 @@ async function seedMockIdps() {
 }
 var ZITADEL_ISSUER, LOGIN_CONTEXT, PLATFORM_ORG, CLI_PROJECT_NAME, CLI_APP_NAME, CLI_REDIRECT_URI, HUB_PROJECT_NAME, HUB_APP_NAME, hubRedirectUri, HUB_DEFAULT_REDIRECT_URI, HUB_ROLES, ZITADEL_SSM_PARAM, TEST_USERS_SSM_PREFIX, TEST_USERS, isAlreadyExists, ensureCliProject, ensureHubProject, OPS_HUB_SECRET_ID, LOCAL_SMTP, IDP_SEARCH_PATH, pickIdpIdByName;
 var init_seed_zitadel = __esm({
-  "libs/mesh-cli/src/commands/local/seed-zitadel.ts"() {
+  "packages/mesh-cli/src/commands/local/seed-zitadel.ts"() {
     "use strict";
     init_src();
     init_log();
@@ -7679,7 +7691,7 @@ var init_seed_zitadel = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/auth-provision.ts
+// packages/mesh-cli/src/commands/local/auth-provision.ts
 function authSecretPath(tenant, app, service) {
   return `mesh/${tenant}/${LOCAL_ENV}/apps/${app}/zitadel/${service}`;
 }
@@ -8042,7 +8054,7 @@ async function ensureAppTenantAuth(args) {
 }
 var ensureProject;
 var init_auth_provision = __esm({
-  "libs/mesh-cli/src/commands/local/auth-provision.ts"() {
+  "packages/mesh-cli/src/commands/local/auth-provision.ts"() {
     "use strict";
     init_log();
     init_seed();
@@ -8052,7 +8064,7 @@ var init_auth_provision = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/dev-local.ts
+// packages/mesh-cli/src/commands/local/dev-local.ts
 import * as fs19 from "fs";
 import * as path19 from "path";
 function localAppNamespace(tenant, appName) {
@@ -8291,7 +8303,7 @@ async function ensureLocalPlatformRunning() {
 }
 var LOCAL_STACK_NAME, BASE_PORT;
 var init_dev_local = __esm({
-  "libs/mesh-cli/src/commands/local/dev-local.ts"() {
+  "packages/mesh-cli/src/commands/local/dev-local.ts"() {
     "use strict";
     init_mocks();
     init_helpers();
@@ -8308,7 +8320,7 @@ var init_dev_local = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/docker-runner.ts
+// packages/mesh-cli/src/commands/local/docker-runner.ts
 import { execFileSync as execFileSync14 } from "child_process";
 import * as fs20 from "fs";
 import * as path20 from "path";
@@ -8395,7 +8407,7 @@ function dockerDevRestart(sessionName, service) {
 }
 var DEV_RUNNER_IMAGE;
 var init_docker_runner = __esm({
-  "libs/mesh-cli/src/commands/local/docker-runner.ts"() {
+  "packages/mesh-cli/src/commands/local/docker-runner.ts"() {
     "use strict";
     init_dev_local();
     init_cache_home();
@@ -8403,7 +8415,7 @@ var init_docker_runner = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/stack-flag.ts
+// packages/mesh-cli/src/utils/stack-flag.ts
 function resolveStackSelector(opts) {
   if (opts.stack != null) return { stack: opts.stack, usedDeprecatedStage: false };
   if (opts.stage != null) return { stack: opts.stage, usedDeprecatedStage: true };
@@ -8421,14 +8433,14 @@ function resolveStackOption(opts) {
 }
 var warnedOnce;
 var init_stack_flag = __esm({
-  "libs/mesh-cli/src/utils/stack-flag.ts"() {
+  "packages/mesh-cli/src/utils/stack-flag.ts"() {
     "use strict";
     init_log();
     warnedOnce = false;
   }
 });
 
-// libs/mesh-cli/src/commands/peer-addressing.ts
+// packages/mesh-cli/src/commands/peer-addressing.ts
 function clusterHostPattern(serviceName) {
   const name = serviceName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`https?://${name}\\.[a-z0-9-]+\\.svc\\.cluster\\.local(?::\\d+)?`, "g");
@@ -8452,12 +8464,12 @@ function rewriteClusterHostsToLocal(devOutput) {
   }
 }
 var init_peer_addressing = __esm({
-  "libs/mesh-cli/src/commands/peer-addressing.ts"() {
+  "packages/mesh-cli/src/commands/peer-addressing.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/worktree-identity.ts
+// packages/mesh-cli/src/utils/worktree-identity.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
 import * as crypto3 from "node:crypto";
 import * as path21 from "node:path";
@@ -8523,7 +8535,7 @@ function resolveWorktreeIdentity(cwd = process.cwd(), gitRunner = defaultGitRunn
 }
 var NUM_PORT_BLOCKS, PORT_BLOCK_BASE, PORT_BLOCK_SIZE, PORT_BLOCK_SERVICE_SUBRANGE, STACK_SLUG_MAX, defaultGitRunner;
 var init_worktree_identity = __esm({
-  "libs/mesh-cli/src/utils/worktree-identity.ts"() {
+  "packages/mesh-cli/src/utils/worktree-identity.ts"() {
     "use strict";
     NUM_PORT_BLOCKS = 64;
     PORT_BLOCK_BASE = 4e4;
@@ -8534,7 +8546,7 @@ var init_worktree_identity = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/dev-token-server.ts
+// packages/mesh-cli/src/commands/dev-token-server.ts
 var dev_token_server_exports = {};
 __export(dev_token_server_exports, {
   handleTokenRequest: () => handleTokenRequest,
@@ -8583,7 +8595,7 @@ async function startTokenServer(port, context) {
 }
 var REFRESH_MARGIN_MS;
 var init_dev_token_server = __esm({
-  "libs/mesh-cli/src/commands/dev-token-server.ts"() {
+  "packages/mesh-cli/src/commands/dev-token-server.ts"() {
     "use strict";
     init_login();
     init_log();
@@ -8591,7 +8603,7 @@ var init_dev_token_server = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/dev.ts
+// packages/mesh-cli/src/commands/dev.ts
 import { execFileSync as execFileSync16, spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
 import * as fs21 from "fs";
 import * as net8 from "net";
@@ -10442,7 +10454,9 @@ function registerDevCommand(program2) {
               { remediation: { command: `docker compose -f ${decl.compose} up  # debug it directly` } }
             );
           }
-          logWarn(`External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err}`);
+          logWarn(
+            `External '${name}' credential seeding failed: ${err instanceof Error ? err.message : err} \u2014 the app will resolve whatever was seeded previously, which may point at a stale port.`
+          );
         }
       }
       if (dockerRunner) {
@@ -10938,7 +10952,7 @@ function registerDevCommand(program2) {
 }
 var MissingStackOutputError, AWS_STATIC_CREDENTIAL_ENV_KEYS, SSM_TUNNEL_BASE_PORT, TUNNEL_READY_TIMEOUT_MS;
 var init_dev = __esm({
-  "libs/mesh-cli/src/commands/dev.ts"() {
+  "packages/mesh-cli/src/commands/dev.ts"() {
     "use strict";
     init_utils();
     init_aws_auth();
@@ -10983,7 +10997,7 @@ var init_dev = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/dev-doctor.ts
+// packages/mesh-cli/src/commands/dev-doctor.ts
 import { execFileSync as execFileSync17 } from "node:child_process";
 import * as fs22 from "node:fs";
 import * as net9 from "node:net";
@@ -11201,7 +11215,7 @@ ${ICONS[status]} overall: ${status}`);
 }
 var ICONS, credsCheck, registryCheck, tmuxCheck, portsCheck, configStalenessCheck, worktreeCheck, tunnelsCheck, temporalCheck, ALL_CHECKS;
 var init_dev_doctor = __esm({
-  "libs/mesh-cli/src/commands/dev-doctor.ts"() {
+  "packages/mesh-cli/src/commands/dev-doctor.ts"() {
     "use strict";
     init_dev();
     init_auth_preflight();
@@ -11517,7 +11531,7 @@ var init_dev_doctor = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/app-check.ts
+// packages/mesh-cli/src/commands/app-check.ts
 import * as fs23 from "node:fs";
 import * as path24 from "node:path";
 function rel(root, abs) {
@@ -12145,7 +12159,7 @@ function registerAppCommands(program2) {
 }
 var APP_CHECK_RULES, APP_CHECK_CODES, SRC_EXT, SKIP_DIRS, NON_SERVICE_DIRS, RE_HTML, RE_OIDC, RE_COOKIE, RE_LOGGER, RE_EXPOSURE, RE_POINTER, RE_METADATA, RE_IAC_GRANT, RE_POINTER_OVERRIDE, RE_PASSWORD, RE_ALLOWLIST, RE_USERS_TABLE, RE_SURFACE_NEW, RE_APIDOCS_NEW, RE_IDENTITY_NEW, RE_EVENTS_NEW, EVENTS_PROJECT_ROLES, RE_IDENTITY_BINDING, DEFAULT_PARTNER_DOCS_ROLES, DOCS_SITE_FIELDS, DOCS_SITE_RETIRED_FIELDS, RE_PROPERTY;
 var init_app_check = __esm({
-  "libs/mesh-cli/src/commands/app-check.ts"() {
+  "packages/mesh-cli/src/commands/app-check.ts"() {
     "use strict";
     init_utils();
     init_errors();
@@ -12929,7 +12943,7 @@ var init_src2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/agent-api-client.ts
+// packages/mesh-cli/src/commands/agent-api-client.ts
 function resolveTarget(opts) {
   if (opts.apiUrl) {
     return { apiBaseUrl: stripSlash(opts.apiUrl), loginContext: opts.context || DEFAULT_AUTH_CONTEXT };
@@ -13036,7 +13050,7 @@ try: mesh temporal recover-conversation ${ctx.id}` : "";
 }
 var DEFAULT_AUTH_CONTEXT, LOCAL_URL_RE, TargetResolutionError, NO_REGISTRY_GUIDANCE, NETWORK_ERROR_PATTERN;
 var init_agent_api_client = __esm({
-  "libs/mesh-cli/src/commands/agent-api-client.ts"() {
+  "packages/mesh-cli/src/commands/agent-api-client.ts"() {
     "use strict";
     init_src2();
     init_login();
@@ -13050,7 +13064,7 @@ var init_agent_api_client = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/artifacts.ts
+// packages/mesh-cli/src/commands/artifacts.ts
 import * as fs24 from "fs";
 import * as path26 from "path";
 function parseRef(ref) {
@@ -13149,7 +13163,7 @@ Ref format: <conversationId>:<artifactId>
 }
 var DEFAULT_ARTIFACT_ID, DEFAULT_AUTH_CONTEXT2;
 var init_artifacts = __esm({
-  "libs/mesh-cli/src/commands/artifacts.ts"() {
+  "packages/mesh-cli/src/commands/artifacts.ts"() {
     "use strict";
     init_log();
     init_agent_api_client();
@@ -13158,7 +13172,7 @@ var init_artifacts = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/cluster.ts
+// packages/mesh-cli/src/commands/cluster.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
 async function resolveClusterAccess(opts) {
   const appRoot = findAppRoot(process.cwd());
@@ -13314,7 +13328,7 @@ Then: mesh logs <service>  (e.g. mesh logs demo-agent-worker)
 }
 var NS_FLAGS;
 var init_cluster = __esm({
-  "libs/mesh-cli/src/commands/cluster.ts"() {
+  "packages/mesh-cli/src/commands/cluster.ts"() {
     "use strict";
     init_log();
     init_pulumi();
@@ -13326,7 +13340,7 @@ var init_cluster = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/vcs-enrich.ts
+// packages/mesh-cli/src/commands/vcs-enrich.ts
 async function buildVcsEnricher(target) {
   const vcsBaseUrl = deriveVcsBaseUrl(target.apiBaseUrl);
   if (!vcsBaseUrl) {
@@ -13341,7 +13355,7 @@ async function buildVcsEnricher(target) {
   return createVcsFolderReader({ vcsBaseUrl, token });
 }
 var init_vcs_enrich = __esm({
-  "libs/mesh-cli/src/commands/vcs-enrich.ts"() {
+  "packages/mesh-cli/src/commands/vcs-enrich.ts"() {
     "use strict";
     init_src2();
     init_login();
@@ -13349,7 +13363,7 @@ var init_vcs_enrich = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/conversations.ts
+// packages/mesh-cli/src/commands/conversations.ts
 function truncate(s, max) {
   return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
 }
@@ -13517,7 +13531,7 @@ function registerConversationsCommands(program2) {
 }
 var MAX_TITLE_LEN;
 var init_conversations = __esm({
-  "libs/mesh-cli/src/commands/conversations.ts"() {
+  "packages/mesh-cli/src/commands/conversations.ts"() {
     "use strict";
     init_src2();
     init_vcs_enrich();
@@ -13527,7 +13541,7 @@ var init_conversations = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/scaffold-versions.ts
+// packages/mesh-cli/src/utils/scaffold-versions.ts
 import { execFileSync as execFileSync18 } from "child_process";
 function isPrerelease(range) {
   return /[-+]/.test(range.replace(/^\^/, ""));
@@ -13552,7 +13566,7 @@ function resolvePublishedRange(pkg, cwd) {
 }
 var SCAFFOLD_PACKAGE_LINES, SCAFFOLD_TOOLCHAIN;
 var init_scaffold_versions = __esm({
-  "libs/mesh-cli/src/utils/scaffold-versions.ts"() {
+  "packages/mesh-cli/src/utils/scaffold-versions.ts"() {
     "use strict";
     SCAFFOLD_PACKAGE_LINES = {
       "@mesh-tech/app-kit": "^1.45.0",
@@ -13572,7 +13586,7 @@ var init_scaffold_versions = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/create-app.ts
+// packages/mesh-cli/src/commands/create-app.ts
 var create_app_exports = {};
 __export(create_app_exports, {
   NO_REGISTRY_ACCESS_MESSAGE: () => NO_REGISTRY_ACCESS_MESSAGE,
@@ -14139,7 +14153,7 @@ function composableNextSteps(appDir, platform) {
 }
 var __filename, __dirname, packageRoot, TEMPLATES, REMOVED_TEMPLATES, PRIMITIVES, HUB_ACCOUNTS, PLATFORM_MONOREPO_NAME, VALID_PRIMITIVES, NO_REGISTRY_ACCESS_MESSAGE;
 var init_create_app = __esm({
-  "libs/mesh-cli/src/commands/create-app.ts"() {
+  "packages/mesh-cli/src/commands/create-app.ts"() {
     "use strict";
     init_utils();
     init_skills();
@@ -14181,7 +14195,7 @@ var init_create_app = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/axes.ts
+// packages/mesh-cli/src/commands/db/axes.ts
 function platformAxis(options, usage, detect = detectContext) {
   if (options.tenant && !options.env || !options.tenant && options.env) {
     throw new MeshCliError("Both --tenant and --env are required", {
@@ -14213,7 +14227,7 @@ function appAxis(options, platform) {
   };
 }
 var init_axes = __esm({
-  "libs/mesh-cli/src/commands/db/axes.ts"() {
+  "packages/mesh-cli/src/commands/db/axes.ts"() {
     "use strict";
     init_context();
     init_errors();
@@ -14221,7 +14235,7 @@ var init_axes = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/connect.ts
+// packages/mesh-cli/src/commands/db/connect.ts
 import { spawn as spawn4 } from "child_process";
 async function connectCommand(options) {
   const { tenant, env: platformEnv } = platformAxis(options, USAGE)();
@@ -14269,7 +14283,7 @@ async function connectCommand(options) {
 }
 var USAGE;
 var init_connect = __esm({
-  "libs/mesh-cli/src/commands/db/connect.ts"() {
+  "packages/mesh-cli/src/commands/db/connect.ts"() {
     "use strict";
     init_utils();
     init_axes();
@@ -14277,7 +14291,7 @@ var init_connect = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/credentials.ts
+// packages/mesh-cli/src/commands/db/credentials.ts
 async function credentialsCommand(options) {
   const platform = platformAxis(options, USAGE2);
   const app = appAxis(options, platform);
@@ -14307,7 +14321,7 @@ async function credentialsCommand(options) {
 }
 var USAGE2;
 var init_credentials2 = __esm({
-  "libs/mesh-cli/src/commands/db/credentials.ts"() {
+  "packages/mesh-cli/src/commands/db/credentials.ts"() {
     "use strict";
     init_utils();
     init_axes();
@@ -14315,7 +14329,7 @@ var init_credentials2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/env.ts
+// packages/mesh-cli/src/commands/db/env.ts
 async function envCommand(options) {
   const platform = platformAxis(options, USAGE3);
   const app = appAxis(options, platform);
@@ -14335,7 +14349,7 @@ async function envCommand(options) {
 }
 var USAGE3;
 var init_env = __esm({
-  "libs/mesh-cli/src/commands/db/env.ts"() {
+  "packages/mesh-cli/src/commands/db/env.ts"() {
     "use strict";
     init_utils();
     init_axes();
@@ -14343,7 +14357,7 @@ var init_env = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/psql.ts
+// packages/mesh-cli/src/commands/db/psql.ts
 import { spawn as spawn5 } from "child_process";
 import * as net10 from "net";
 async function startTunnelBackground(instanceId, rdsHost, rdsPort, localPort) {
@@ -14464,7 +14478,7 @@ async function psqlCommand(options) {
 }
 var USAGE4;
 var init_psql = __esm({
-  "libs/mesh-cli/src/commands/db/psql.ts"() {
+  "packages/mesh-cli/src/commands/db/psql.ts"() {
     "use strict";
     init_utils();
     init_axes();
@@ -14472,7 +14486,7 @@ var init_psql = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/exec.ts
+// packages/mesh-cli/src/commands/db/exec.ts
 import { spawn as spawn6 } from "child_process";
 import * as net11 from "net";
 import * as fs26 from "fs";
@@ -14731,7 +14745,7 @@ async function execCommand(commandArgs, options) {
 }
 var DEFAULT_LOCAL_PORT, MAX_RETRIES, RETRY_DELAY_MS;
 var init_exec = __esm({
-  "libs/mesh-cli/src/commands/db/exec.ts"() {
+  "packages/mesh-cli/src/commands/db/exec.ts"() {
     "use strict";
     init_utils();
     init_axes();
@@ -14741,7 +14755,7 @@ var init_exec = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/db/index.ts
+// packages/mesh-cli/src/commands/db/index.ts
 function registerDbCommands(program2) {
   const db = program2.command("db").description("Database utilities");
   db.command("connect").description("Start DB tunnel for manual psql access").option("-t, --tenant <tenant>", "Platform tenant (e.g., mesh)").option("-e, --env <env>", "Platform environment (e.g., dev-temporal)").action(connectCommand);
@@ -14751,7 +14765,7 @@ function registerDbCommands(program2) {
   db.command("exec").description("Run any command with database connection").option("-t, --tenant <tenant>", "Platform tenant for bastion lookup (e.g., mesh)").option("-e, --env <env>", "Platform environment for bastion lookup (e.g., dev-temporal)").option("-a, --app <app>", "App name for credentials path (e.g., rdc)").option("--app-tenant <tenant>", "Tenant for app credentials if different from platform (e.g., encore)").option("--app-stage <stage>", "Stage for app credentials (e.g., dev)").option("--secret <arn>", "Use secret ARN directly (skips SSM discovery)").option("--ssl <mode>", "SSL mode: require, no-verify, disable").option("--port <port>", "Local tunnel port (default: 5432)").argument("<command...>", "Command and arguments to run").action(execCommand);
 }
 var init_db = __esm({
-  "libs/mesh-cli/src/commands/db/index.ts"() {
+  "packages/mesh-cli/src/commands/db/index.ts"() {
     "use strict";
     init_connect();
     init_credentials2();
@@ -14761,7 +14775,7 @@ var init_db = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/deploy-preflight.ts
+// packages/mesh-cli/src/utils/deploy-preflight.ts
 import { existsSync as existsSync22, readFileSync as readFileSync23 } from "node:fs";
 import { dirname as dirname23, join as join27, relative as relative8 } from "node:path";
 import { parse as parseYaml4 } from "yaml";
@@ -14868,7 +14882,7 @@ function assertDeployDepsFresh(appRoot, op) {
 }
 var GATED_PREFIXES, PROGRAM_EVAL_OPS, SKIP_ENV;
 var init_deploy_preflight = __esm({
-  "libs/mesh-cli/src/utils/deploy-preflight.ts"() {
+  "packages/mesh-cli/src/utils/deploy-preflight.ts"() {
     "use strict";
     init_log();
     GATED_PREFIXES = ["@mesh-tech/"];
@@ -14877,7 +14891,7 @@ var init_deploy_preflight = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/deploy.ts
+// packages/mesh-cli/src/commands/deploy.ts
 import { execFileSync as execFileSync19 } from "child_process";
 function buildPulumiArgs(pulumiArgs, stack) {
   const base = pulumiArgs.length === 0 || pulumiArgs[0]?.startsWith("-") ? ["up", ...pulumiArgs] : [...pulumiArgs];
@@ -14953,7 +14967,7 @@ function registerDeployCommand(program2) {
 }
 var OPS_WITHOUT_STACK_FLAG, STACK_SUBCOMMANDS_WITHOUT_FLAG;
 var init_deploy = __esm({
-  "libs/mesh-cli/src/commands/deploy.ts"() {
+  "packages/mesh-cli/src/commands/deploy.ts"() {
     "use strict";
     init_log();
     init_pulumi();
@@ -14982,7 +14996,7 @@ var init_deploy = __esm({
   }
 });
 
-// libs/mesh-cli/src/docs/schema.ts
+// packages/mesh-cli/src/docs/schema.ts
 import { z as z3 } from "zod";
 function isReservedSegment(segment) {
   const lowered = segment.toLowerCase();
@@ -14996,7 +15010,7 @@ function slugify2(value) {
 }
 var RESERVED_SEGMENTS, docsJsonSchema;
 var init_schema2 = __esm({
-  "libs/mesh-cli/src/docs/schema.ts"() {
+  "packages/mesh-cli/src/docs/schema.ts"() {
     "use strict";
     RESERVED_SEGMENTS = [
       "plans",
@@ -15045,7 +15059,7 @@ var init_schema2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/docs/discover.ts
+// packages/mesh-cli/src/docs/discover.ts
 import { existsSync as existsSync23, readdirSync as readdirSync9, readFileSync as readFileSync24, statSync as statSync6 } from "node:fs";
 import path29 from "node:path";
 function routePathFor(relPath) {
@@ -15214,7 +15228,7 @@ function pathKind(candidate) {
 }
 var ROOT_WALK_SKIP;
 var init_discover = __esm({
-  "libs/mesh-cli/src/docs/discover.ts"() {
+  "packages/mesh-cli/src/docs/discover.ts"() {
     "use strict";
     init_schema2();
     ROOT_WALK_SKIP = /* @__PURE__ */ new Set([
@@ -15233,7 +15247,7 @@ var init_discover = __esm({
   }
 });
 
-// libs/mesh-cli/src/docs/assemble.ts
+// packages/mesh-cli/src/docs/assemble.ts
 import { execFileSync as execFileSync20 } from "node:child_process";
 import { mkdirSync as mkdirSync12, readFileSync as readFileSync25, rmSync as rmSync5, writeFileSync as writeFileSync15 } from "node:fs";
 import path30 from "node:path";
@@ -15736,7 +15750,7 @@ function currentCommit(repoRoot2) {
 function currentBaseline(repoRoot2) {
   try {
     const pkg = JSON.parse(
-      readFileSync25(path30.join(repoRoot2, "libs/app-kit/package.json"), "utf-8")
+      readFileSync25(path30.join(repoRoot2, "packages/app-kit/package.json"), "utf-8")
     );
     return pkg.version;
   } catch {
@@ -15814,7 +15828,7 @@ function renderPublishSetSummary(manifest, diff) {
 }
 var DEFAULT_REPO_URL, DEFAULT_IGNORE_LINK_PREFIXES;
 var init_assemble = __esm({
-  "libs/mesh-cli/src/docs/assemble.ts"() {
+  "packages/mesh-cli/src/docs/assemble.ts"() {
     "use strict";
     init_discover();
     init_schema2();
@@ -15823,7 +15837,7 @@ var init_assemble = __esm({
   }
 });
 
-// libs/mesh-cli/src/docs/cli-reference.ts
+// packages/mesh-cli/src/docs/cli-reference.ts
 var cli_reference_exports = {};
 __export(cli_reference_exports, {
   extractCliReference: () => extractCliReference,
@@ -15958,7 +15972,7 @@ function renderCliReferenceMarkdown(reference) {
   const lines = [
     "<!--",
     "  GENERATED FILE \u2014 do not edit by hand.",
-    "  Source: the commander tree in libs/mesh-cli/src/program.ts",
+    "  Source: the commander tree in packages/mesh-cli/src/program.ts",
     "  Rebuild: pnpm exec mesh docs cli-reference",
     "-->",
     "",
@@ -15983,12 +15997,12 @@ function renderCliReferenceMarkdown(reference) {
 `;
 }
 var init_cli_reference = __esm({
-  "libs/mesh-cli/src/docs/cli-reference.ts"() {
+  "packages/mesh-cli/src/docs/cli-reference.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/docs/portal.ts
+// packages/mesh-cli/src/docs/portal.ts
 import { spawn as spawn7 } from "node:child_process";
 import {
   appendFileSync,
@@ -16215,7 +16229,7 @@ async function cliReferenceStaleness(repoRoot2) {
 }
 var DOCS_APP_DIR, CONTENT_DIR, GENERATED_CONFIG, PUBLISH_MANIFEST, VERSION_JSON_DIR, VERSION_JSON, SITE_TITLE, SITE_DESCRIPTION;
 var init_portal = __esm({
-  "libs/mesh-cli/src/docs/portal.ts"() {
+  "packages/mesh-cli/src/docs/portal.ts"() {
     "use strict";
     init_log();
     init_assemble();
@@ -16231,7 +16245,7 @@ var init_portal = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/build-info.ts
+// packages/mesh-cli/src/utils/build-info.ts
 import { execFileSync as execFileSync21 } from "child_process";
 import * as fs27 from "fs";
 import * as path32 from "path";
@@ -16302,12 +16316,12 @@ function resolveCliRuntime(opts) {
   return info;
 }
 var init_build_info = __esm({
-  "libs/mesh-cli/src/utils/build-info.ts"() {
+  "packages/mesh-cli/src/utils/build-info.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/docs/serve.ts
+// packages/mesh-cli/src/docs/serve.ts
 import { createServer as createServer8 } from "node:http";
 import { readFile } from "node:fs/promises";
 import { extname as extname2, join as join29, normalize, sep as sep6 } from "node:path";
@@ -16362,7 +16376,7 @@ async function serveDocsSite(args) {
 }
 var CONTENT_TYPES;
 var init_serve = __esm({
-  "libs/mesh-cli/src/docs/serve.ts"() {
+  "packages/mesh-cli/src/docs/serve.ts"() {
     "use strict";
     CONTENT_TYPES = {
       ".html": "text/html; charset=utf-8",
@@ -16386,7 +16400,7 @@ var init_serve = __esm({
   }
 });
 
-// libs/mesh-cli/src/docs/registry-docs.ts
+// packages/mesh-cli/src/docs/registry-docs.ts
 import { execFileSync as execFileSync22 } from "node:child_process";
 import { existsSync as existsSync25, mkdirSync as mkdirSync14, readFileSync as readFileSync28, renameSync as renameSync3, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir7 } from "node:os";
@@ -16495,14 +16509,14 @@ async function fetchDocsArtifact(auth, version, cacheRoot = docsCacheRoot(), fet
 }
 var DOCS_PACKAGE;
 var init_registry_docs = __esm({
-  "libs/mesh-cli/src/docs/registry-docs.ts"() {
+  "packages/mesh-cli/src/docs/registry-docs.ts"() {
     "use strict";
     init_auth_preflight();
     DOCS_PACKAGE = "@mesh-tech/docs";
   }
 });
 
-// libs/mesh-cli/src/docs/start.ts
+// packages/mesh-cli/src/docs/start.ts
 var start_exports = {};
 __export(start_exports, {
   DOCS_TMUX_SESSION: () => DOCS_TMUX_SESSION,
@@ -16757,7 +16771,7 @@ async function runDocsStart(args) {
 }
 var DOCS_TMUX_SESSION;
 var init_start = __esm({
-  "libs/mesh-cli/src/docs/start.ts"() {
+  "packages/mesh-cli/src/docs/start.ts"() {
     "use strict";
     init_log();
     init_build_info();
@@ -16769,7 +16783,7 @@ var init_start = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/docs.ts
+// packages/mesh-cli/src/commands/docs.ts
 import * as fs28 from "fs";
 import * as path35 from "path";
 import { createRequire } from "module";
@@ -16991,7 +17005,7 @@ function registerDocsCommand(program2) {
 }
 var CLI_REFERENCE_PATH;
 var init_docs = __esm({
-  "libs/mesh-cli/src/commands/docs.ts"() {
+  "packages/mesh-cli/src/commands/docs.ts"() {
     "use strict";
     init_log();
     init_portal();
@@ -17000,7 +17014,7 @@ var init_docs = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/hub/index.ts
+// packages/mesh-cli/src/commands/hub/index.ts
 import { execFileSync as execFileSync24 } from "node:child_process";
 import * as fs29 from "node:fs";
 import * as net12 from "node:net";
@@ -17428,7 +17442,7 @@ function registerHubCommands(program2) {
 }
 var HUB_SESSION_PREFIX, HUB_SESSION_RE, DEFAULT_HUB_UI_PORT, DEFAULT_HUB_API_PORT, FORWARD_PREFIXES, localPlatformEnv2, SENSITIVE_RE;
 var init_hub = __esm({
-  "libs/mesh-cli/src/commands/hub/index.ts"() {
+  "packages/mesh-cli/src/commands/hub/index.ts"() {
     "use strict";
     init_dev_launch();
     init_dev();
@@ -17479,7 +17493,7 @@ var init_hub = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/init/platform-setup.ts
+// packages/mesh-cli/src/commands/init/platform-setup.ts
 var platform_setup_exports = {};
 __export(platform_setup_exports, {
   DOMAIN_REQUIRED_MESSAGE: () => DOMAIN_REQUIRED_MESSAGE,
@@ -17521,7 +17535,7 @@ function validateDomain(value) {
     return "a public domain you control, e.g. q2poc.pub";
   }
   if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
-    return `${domain} is a placeholder \u2014 the deploy stalls on an ACM certificate for a zone nobody can delegate. Use a domain you control.`;
+    return `${domain} is a placeholder \u2014 its ACM certificate can never validate, because nobody can delegate that zone to you. Use a domain you control.`;
   }
   return true;
 }
@@ -17633,7 +17647,7 @@ function renderPlatformNextSteps(setup, opts = {}) {
     `aws sso login --profile ${setup.profile}   # if this profile is SSO`,
     exportCredentialsCommand(setup.profile),
     `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`,
-    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain}; the deploy waits on the ACM certificate until you do`,
+    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain} at your registrar; the deploy stops at the mesh-gateway Ingress until ACM issues the certificate, then continues`,
     "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker \u2014 it builds service images)",
     `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`,
     "",
@@ -17667,7 +17681,7 @@ async function scaffoldPlatformRepo(setup) {
 }
 var PLATFORM_SETUP_DEFAULTS, DOMAIN_REQUIRED_MESSAGE, realStateBucketDeps;
 var init_platform_setup = __esm({
-  "libs/mesh-cli/src/commands/init/platform-setup.ts"() {
+  "packages/mesh-cli/src/commands/init/platform-setup.ts"() {
     "use strict";
     init_errors();
     PLATFORM_SETUP_DEFAULTS = {
@@ -17675,7 +17689,7 @@ var init_platform_setup = __esm({
       region: "us-east-2",
       profile: "default"
     };
-    DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone that can never validate (the deploy stalls on the ACM certificate).";
+    DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone whose certificate can never validate, so ingress never serves HTTPS.";
     realStateBucketDeps = {
       headBucket(setup) {
         try {
@@ -17700,7 +17714,7 @@ var init_platform_setup = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/registry-publish.ts
+// packages/mesh-cli/src/commands/registry-publish.ts
 import { execFileSync as execFileSync26, execSync } from "child_process";
 import * as fs31 from "fs";
 import * as path38 from "path";
@@ -17815,14 +17829,14 @@ Or always grab the newest dev build:
   });
 }
 var init_registry_publish = __esm({
-  "libs/mesh-cli/src/commands/registry-publish.ts"() {
+  "packages/mesh-cli/src/commands/registry-publish.ts"() {
     "use strict";
     init_log();
     init_registry();
   }
 });
 
-// libs/mesh-cli/src/commands/registry.ts
+// packages/mesh-cli/src/commands/registry.ts
 var registry_exports = {};
 __export(registry_exports, {
   CONTEXT_IGNORED_NOTICE: () => CONTEXT_IGNORED_NOTICE,
@@ -18491,7 +18505,7 @@ function registerRegistryCommands(program2) {
 }
 var CA_DOMAIN, CA_REPOSITORY, CA_NAMESPACE, CA_REGION, DEFAULT_REGISTRY_ROLE, RegistryNotAuthorizedError, NOT_AUTHORIZED_RERUN, CONTEXT_IGNORED_NOTICE;
 var init_registry = __esm({
-  "libs/mesh-cli/src/commands/registry.ts"() {
+  "packages/mesh-cli/src/commands/registry.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -18516,7 +18530,7 @@ var init_registry = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/init/wizard.ts
+// packages/mesh-cli/src/commands/init/wizard.ts
 var wizard_exports = {};
 __export(wizard_exports, {
   INIT_REPO_FIX: () => INIT_REPO_FIX,
@@ -18752,7 +18766,7 @@ async function runInitWizard(opts, deps = {}) {
 }
 var NO_SESSION_NO_TTY_MESSAGE, TENANT_REQUIRED_MESSAGE, REGISTRY_WHY, INTERRUPTED_EXIT_CODE, STEP_LABELS, PLATFORM_SETUP_LABEL, registryStep, newPlatformStep, platformStep, INIT_REPO_FIX, repoStep, skillsStep, WIZARD_STEPS;
 var init_wizard = __esm({
-  "libs/mesh-cli/src/commands/init/wizard.ts"() {
+  "packages/mesh-cli/src/commands/init/wizard.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -18987,7 +19001,7 @@ var init_wizard = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/init.ts
+// packages/mesh-cli/src/commands/init.ts
 import chalk5 from "chalk";
 import * as fs34 from "fs";
 import * as path41 from "path";
@@ -19182,7 +19196,7 @@ function registerInitCommands(program2) {
   ).option("--tenant <name>", "app tenant this repo belongs to (prompted when omitted on a TTY)").option("--local", "local only \u2014 mesh start / mesh dev, no deployed platform (the default)").option("--platform <env>", "a deployed platform's environment; signs in to `<tenant>.<env>`").option(
     "--new-platform [env]",
     `nothing deployed yet \u2014 scaffold a tenant platform repo for \`<tenant>.<env>\` (default env: ${PLATFORM_SETUP_DEFAULTS.env}) and print its deploy sequence`
-  ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain}. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
+  ).option("--region <region>", `--new-platform: AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option("--domain <domain>", "--new-platform: base public domain you control; the core stack creates the zone {env}.{domain} and stops at the mesh-gateway Ingress until you delegate its NS records. No default \u2014 a placeholder scaffolds a zone that can never validate").option("--state-bucket <bucket>", "--new-platform: Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "--new-platform: create the state bucket (versioned) if it does not exist").option("--no-create-state-bucket", "--new-platform: never create the state bucket; print the aws command instead").option("--dir <path>", "--new-platform: where to scaffold the platform repo (default: ./{tenant}-mesh-platform)").option("--device", "device-code sign-in for the registry and platform steps (headless / SSH)").option("--profile <aws-profile>", "AWS profile this machine uses: read the registry without the broker (deployers only), and the profile a --new-platform stack config references").option("--skip-repo", "do not bootstrap, check or record anything in the current repo", false).option("--yes", "accept every default and never prompt", false).option("--json", "one JSON document on stdout ({tenant, mode, steps, next}); human output on stderr", false).action(
     async (opts) => {
       const { runInitWizard: runInitWizard2 } = await Promise.resolve().then(() => (init_wizard(), wizard_exports));
       const code = await runInitWizard2(opts);
@@ -19193,7 +19207,7 @@ function registerInitCommands(program2) {
     "Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified \u2014 the proven mesh-sandbox shape, annotated. On a terminal it ASKS for the values that differ per install (env, region, domain, state bucket, AWS profile), each pre-filled with its default; every answer is also a flag."
   ).option("--env <env>", `environment the first stack targets (default: ${PLATFORM_SETUP_DEFAULTS.env})`).option("--region <region>", `AWS region (default: ${PLATFORM_SETUP_DEFAULTS.region})`).option(
     "--domain <domain>",
-    "base public domain you control \u2014 the core stack creates the Route 53 zone {env}.{domain} and waits on its NS delegation. Required: it has no default, because a placeholder scaffolds a zone that can never validate"
+    "base public domain you control \u2014 the core stack creates the Route 53 zone {env}.{domain}, whose NS records you then delegate at your registrar; the deploy stops at the mesh-gateway Ingress until that lets ACM issue the certificate. Required: it has no default, because a placeholder scaffolds a zone nobody can delegate to you"
   ).option("--profile <profile>", `AWS profile the stack config references (default: ${PLATFORM_SETUP_DEFAULTS.profile})`).option("--state-bucket <bucket>", "Pulumi state S3 bucket (default: {tenant}-mesh-platform-pulumi-state)").option("--create-state-bucket", "create the state bucket (versioned) if it does not exist \u2014 prompted on a terminal").option("--no-create-state-bucket", "never create the state bucket; print the aws command instead").option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)").option("--yes", "accept every default and never prompt", false).action(
     async (tenant, opts) => {
       if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
@@ -19264,7 +19278,7 @@ function registerInitCommands(program2) {
 }
 var LOCAL_HUB_API;
 var init_init = __esm({
-  "libs/mesh-cli/src/commands/init.ts"() {
+  "packages/mesh-cli/src/commands/init.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -19278,7 +19292,7 @@ var init_init = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/install-shim.ts
+// packages/mesh-cli/src/commands/install-shim.ts
 import { execFileSync as execFileSync29 } from "child_process";
 import * as fs35 from "fs";
 import * as os10 from "os";
@@ -19432,13 +19446,13 @@ function registerInstallShimCommand(program2) {
   });
 }
 var init_install_shim = __esm({
-  "libs/mesh-cli/src/commands/install-shim.ts"() {
+  "packages/mesh-cli/src/commands/install-shim.ts"() {
     "use strict";
     init_log();
   }
 });
 
-// libs/mesh-cli/src/commands/local/hub-local.ts
+// packages/mesh-cli/src/commands/local/hub-local.ts
 import { execFile as execFile3, execFileSync as execFileSync30 } from "child_process";
 import * as fs36 from "fs";
 import * as os11 from "os";
@@ -19720,7 +19734,7 @@ async function buildHubImagesFromSource(repoRoot2) {
 }
 var execFileAsync2, HUB_PACKAGE, HUB_IMAGES, LOCAL_IMAGE_REV, HUB_AUTH_IMAGE, HUB_COMPILED_AUTHZ_REL;
 var init_hub_local = __esm({
-  "libs/mesh-cli/src/commands/local/hub-local.ts"() {
+  "packages/mesh-cli/src/commands/local/hub-local.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -19736,7 +19750,7 @@ var init_hub_local = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/seed-hub-catalog.ts
+// packages/mesh-cli/src/commands/local/seed-hub-catalog.ts
 function withHubCatalogRefs(pointer, metadataRef) {
   return {
     spicedb: { instanceRefs: [] },
@@ -19787,7 +19801,7 @@ function catalogBundleNames(metadata) {
 }
 var HUB_AUTHZ_POINTER_PARAM, HUB_OPS_HUB_METADATA_PARAM;
 var init_seed_hub_catalog = __esm({
-  "libs/mesh-cli/src/commands/local/seed-hub-catalog.ts"() {
+  "packages/mesh-cli/src/commands/local/seed-hub-catalog.ts"() {
     "use strict";
     init_seed();
     HUB_AUTHZ_POINTER_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
@@ -19795,7 +19809,7 @@ var init_seed_hub_catalog = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/local/index.ts
+// packages/mesh-cli/src/commands/local/index.ts
 import * as fs37 from "fs";
 import * as path44 from "path";
 import chalk6 from "chalk";
@@ -20227,7 +20241,7 @@ Re-running start from here may recreate shared containers with this checkout's c
 }
 var WAIT_TIMEOUT_MS, WAIT_POLL_MS;
 var init_local = __esm({
-  "libs/mesh-cli/src/commands/local/index.ts"() {
+  "packages/mesh-cli/src/commands/local/index.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -20245,7 +20259,7 @@ var init_local = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/exec.ts
+// packages/mesh-cli/src/commands/secrets/exec.ts
 import { spawn as spawn8 } from "child_process";
 import {
   SecretsManagerClient as SecretsManagerClient4,
@@ -20361,12 +20375,12 @@ async function execCommand2(args) {
   });
 }
 var init_exec2 = __esm({
-  "libs/mesh-cli/src/commands/secrets/exec.ts"() {
+  "packages/mesh-cli/src/commands/secrets/exec.ts"() {
     "use strict";
   }
 });
 
-// libs/secrets/src/index.ts
+// packages/secrets/src/index.ts
 import {
   SecretsManagerClient as SecretsManagerClient5,
   GetSecretValueCommand as GetSecretValueCommand5
@@ -20404,25 +20418,25 @@ function buildInstanceIndexValue(keys) {
 }
 var INSTANCE_INDEX_SUFFIX;
 var init_src3 = __esm({
-  "libs/secrets/src/index.ts"() {
+  "packages/secrets/src/index.ts"() {
     "use strict";
     INSTANCE_INDEX_SUFFIX = ".index";
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/context.ts
+// packages/mesh-cli/src/commands/secrets/context.ts
 function resolveSecretsContext(opts, stackOpt = resolveStackOption(opts)) {
   return detectContext(stackOpt, { tenant: opts.tenant, stack: stackOpt });
 }
 var init_context2 = __esm({
-  "libs/mesh-cli/src/commands/secrets/context.ts"() {
+  "packages/mesh-cli/src/commands/secrets/context.ts"() {
     "use strict";
     init_context();
     init_stack_flag();
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/set.ts
+// packages/mesh-cli/src/commands/secrets/set.ts
 import {
   SSMClient as SSMClient2,
   GetParametersByPathCommand
@@ -20676,8 +20690,7 @@ Usage: mesh secrets set external/<name>`);
   console.error("");
 }
 function isResourceNotFound(err) {
-  const e = err;
-  return e?.name === "ResourceNotFoundException" || e?.__type === "ResourceNotFoundException" || e?.Code === "ResourceNotFoundException" || e?.code === "ResourceNotFoundException" || typeof e?.message === "string" && e.message.includes("ResourceNotFoundException");
+  return isAwsErrorCode(err, "ResourceNotFoundException");
 }
 function deepMerge(target, source) {
   const result = { ...target };
@@ -20805,7 +20818,7 @@ async function writeConfigMirror(client, secretId, schema, merged, meta) {
   }
 }
 var init_set = __esm({
-  "libs/mesh-cli/src/commands/secrets/set.ts"() {
+  "packages/mesh-cli/src/commands/secrets/set.ts"() {
     "use strict";
     init_src3();
     init_log();
@@ -20813,10 +20826,11 @@ var init_set = __esm({
     init_context2();
     init_pulumi();
     init_aws_auth();
+    init_aws_errors();
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/reindex.ts
+// packages/mesh-cli/src/commands/secrets/reindex.ts
 import { SSMClient as SSMClient3 } from "@aws-sdk/client-ssm";
 import {
   SecretsManagerClient as SecretsManagerClient7,
@@ -20941,7 +20955,7 @@ async function writeInstanceIndex(client, secretPrefix, serviceName, keys) {
   }
 }
 var init_reindex = __esm({
-  "libs/mesh-cli/src/commands/secrets/reindex.ts"() {
+  "packages/mesh-cli/src/commands/secrets/reindex.ts"() {
     "use strict";
     init_src3();
     init_log();
@@ -20951,7 +20965,7 @@ var init_reindex = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/migrate-config.ts
+// packages/mesh-cli/src/commands/secrets/migrate-config.ts
 import {
   SSMClient as SSMClient4,
   GetParametersByPathCommand as GetParametersByPathCommand2
@@ -21041,16 +21055,12 @@ function extractNonSecretFields2(fields, values) {
   }
   return result;
 }
-function isResourceNotFound2(err) {
-  const e = err;
-  return e?.name === "ResourceNotFoundException" || e?.__type === "ResourceNotFoundException" || e?.Code === "ResourceNotFoundException" || e?.code === "ResourceNotFoundException" || typeof e?.message === "string" && e.message.includes("ResourceNotFoundException");
-}
 async function readSecret(client, secretId) {
   try {
     const res = await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return res.SecretString ? JSON.parse(res.SecretString) : null;
   } catch (err) {
-    if (isResourceNotFound2(err)) return null;
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) return null;
     throw err;
   }
 }
@@ -21059,7 +21069,7 @@ async function writeSecret2(client, secretId, values, description) {
   try {
     await client.send(new PutSecretValueCommand3({ SecretId: secretId, SecretString: secretString }));
   } catch (err) {
-    if (isResourceNotFound2(err)) {
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) {
       await client.send(new CreateSecretCommand3({
         Name: secretId,
         Description: description,
@@ -21076,7 +21086,7 @@ async function secretExists(client, secretId) {
     await client.send(new GetSecretValueCommand8({ SecretId: secretId }));
     return true;
   } catch (err) {
-    if (isResourceNotFound2(err)) return false;
+    if (isAwsErrorCode(err, "ResourceNotFoundException")) return false;
     throw err;
   }
 }
@@ -21187,14 +21197,15 @@ Migrating: ${name}`);
   }
 }
 var init_migrate_config = __esm({
-  "libs/mesh-cli/src/commands/secrets/migrate-config.ts"() {
+  "packages/mesh-cli/src/commands/secrets/migrate-config.ts"() {
     "use strict";
     init_log();
     init_context2();
+    init_aws_errors();
   }
 });
 
-// libs/mesh-cli/src/commands/secrets/index.ts
+// packages/mesh-cli/src/commands/secrets/index.ts
 import { Option as Option2 } from "commander";
 function registerSecretsCommands(program2) {
   const secrets = program2.command("secrets").description("AWS Secrets Manager utilities");
@@ -21215,7 +21226,7 @@ function registerSecretsCommands(program2) {
   });
 }
 var init_secrets = __esm({
-  "libs/mesh-cli/src/commands/secrets/index.ts"() {
+  "packages/mesh-cli/src/commands/secrets/index.ts"() {
     "use strict";
     init_exec2();
     init_set();
@@ -21224,7 +21235,7 @@ var init_secrets = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/site.ts
+// packages/mesh-cli/src/commands/site.ts
 import { createHash as createHash4 } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { readdir, readFile as readFile2, stat } from "node:fs/promises";
@@ -21433,7 +21444,7 @@ function registerSiteCommands(program2) {
 }
 var DEFAULT_AUTH_CONTEXT3, UPLOAD_CONCURRENCY, SKIP_ENTRIES, targetOptions;
 var init_site = __esm({
-  "libs/mesh-cli/src/commands/site.ts"() {
+  "packages/mesh-cli/src/commands/site.ts"() {
     "use strict";
     init_log();
     init_agent_api_client();
@@ -21444,7 +21455,7 @@ var init_site = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/stack.ts
+// packages/mesh-cli/src/commands/stack.ts
 import { execFileSync as execFileSync31 } from "child_process";
 import * as path45 from "path";
 import * as fs38 from "fs";
@@ -21814,7 +21825,7 @@ Specify which to base on: mesh stack init --from <stack>`
   });
 }
 var init_stack2 = __esm({
-  "libs/mesh-cli/src/commands/stack.ts"() {
+  "packages/mesh-cli/src/commands/stack.ts"() {
     "use strict";
     init_log();
     init_pulumi();
@@ -21823,7 +21834,7 @@ var init_stack2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/recover-conversation.ts
+// packages/mesh-cli/src/utils/recover-conversation.ts
 async function classifyHistoryEvents(rawEvents, decodePayload) {
   const activityTypeByScheduledId = /* @__PURE__ */ new Map();
   const events = [];
@@ -22012,12 +22023,12 @@ function renderTranscriptMarkdown(turns) {
   return blocks.join("\n\n") + "\n";
 }
 var init_recover_conversation = __esm({
-  "libs/mesh-cli/src/utils/recover-conversation.ts"() {
+  "packages/mesh-cli/src/utils/recover-conversation.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/utils/temporal-codec.ts
+// packages/mesh-cli/src/utils/temporal-codec.ts
 import { execFileSync as execFileSync32 } from "child_process";
 import { webcrypto as crypto4 } from "node:crypto";
 function resolveTemporalEncodingKeyFromK8s(namespace) {
@@ -22217,7 +22228,7 @@ async function buildRawDecrypterForNamespace(namespace) {
 }
 var ENCRYPTED_ENCODING, IV_LENGTH;
 var init_temporal_codec = __esm({
-  "libs/mesh-cli/src/utils/temporal-codec.ts"() {
+  "packages/mesh-cli/src/utils/temporal-codec.ts"() {
     "use strict";
     init_log();
     ENCRYPTED_ENCODING = "binary/encrypted";
@@ -22225,7 +22236,7 @@ var init_temporal_codec = __esm({
   }
 });
 
-// libs/mesh-cli/src/utils/capture-history.ts
+// packages/mesh-cli/src/utils/capture-history.ts
 var capture_history_exports = {};
 __export(capture_history_exports, {
   decryptHistoryPayloads: () => decryptHistoryPayloads,
@@ -22265,12 +22276,12 @@ async function serializeHistoryToFixture(events, decrypter) {
   return { fixture, eventCount: events.length, decryptedPayloads };
 }
 var init_capture_history = __esm({
-  "libs/mesh-cli/src/utils/capture-history.ts"() {
+  "packages/mesh-cli/src/utils/capture-history.ts"() {
     "use strict";
   }
 });
 
-// libs/mesh-cli/src/commands/temporal.ts
+// packages/mesh-cli/src/commands/temporal.ts
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { writeFileSync as writeFileSync24, mkdirSync as mkdirSync20 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
@@ -22830,7 +22841,7 @@ function registerTemporalCommands(program2) {
 }
 var EVENT_TYPE_NAMES, STATUS_NAMES;
 var init_temporal = __esm({
-  "libs/mesh-cli/src/commands/temporal.ts"() {
+  "packages/mesh-cli/src/commands/temporal.ts"() {
     "use strict";
     init_log();
     init_recover_conversation();
@@ -22892,7 +22903,7 @@ var init_temporal = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/tenant.ts
+// packages/mesh-cli/src/commands/tenant.ts
 import chalk7 from "chalk";
 import * as fs39 from "fs";
 import * as path46 from "path";
@@ -23070,7 +23081,7 @@ function registerTenantCommands(program2) {
   });
 }
 var init_tenant = __esm({
-  "libs/mesh-cli/src/commands/tenant.ts"() {
+  "packages/mesh-cli/src/commands/tenant.ts"() {
     "use strict";
     init_log();
     init_errors();
@@ -23079,7 +23090,7 @@ var init_tenant = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/tunnel/index.ts
+// packages/mesh-cli/src/commands/tunnel/index.ts
 import { spawn as spawn9 } from "child_process";
 import * as fs40 from "fs";
 import * as os12 from "os";
@@ -23468,7 +23479,7 @@ function registerTunnelCommands(program2) {
 }
 var SERVICE_CONFIG, SERVICE_GROUPS;
 var init_tunnel2 = __esm({
-  "libs/mesh-cli/src/commands/tunnel/index.ts"() {
+  "packages/mesh-cli/src/commands/tunnel/index.ts"() {
     "use strict";
     init_utils();
     SERVICE_CONFIG = {
@@ -23495,7 +23506,7 @@ var init_tunnel2 = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/common.ts
+// packages/mesh-cli/src/commands/vcs/common.ts
 import { execFile as execFile4 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 function redactToken(err, token) {
@@ -23569,13 +23580,13 @@ async function vcsApi(baseUrl, token, path49, method = "GET", body) {
 }
 var execFileAsync3;
 var init_common = __esm({
-  "libs/mesh-cli/src/commands/vcs/common.ts"() {
+  "packages/mesh-cli/src/commands/vcs/common.ts"() {
     "use strict";
     execFileAsync3 = promisify3(execFile4);
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/clone.ts
+// packages/mesh-cli/src/commands/vcs/clone.ts
 async function cloneCommand(repo, dest, opts) {
   const baseUrl = (opts.url ?? process.env.VCS_URL)?.replace(/\/$/, "");
   if (!baseUrl) throw new Error("clone requires --url or VCS_URL");
@@ -23600,13 +23611,13 @@ async function cloneCommand(repo, dest, opts) {
   );
 }
 var init_clone = __esm({
-  "libs/mesh-cli/src/commands/vcs/clone.ts"() {
+  "packages/mesh-cli/src/commands/vcs/clone.ts"() {
     "use strict";
     init_common();
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/get.ts
+// packages/mesh-cli/src/commands/vcs/get.ts
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
 import { join as join45, dirname as dirname30 } from "node:path";
 async function getCommand(repo, path49, opts) {
@@ -23649,7 +23660,7 @@ async function getCommand(repo, path49, opts) {
   }
 }
 var init_get = __esm({
-  "libs/mesh-cli/src/commands/vcs/get.ts"() {
+  "packages/mesh-cli/src/commands/vcs/get.ts"() {
     "use strict";
     init_src2();
     init_agent_api_client();
@@ -23659,7 +23670,7 @@ var init_get = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/drafts.ts
+// packages/mesh-cli/src/commands/vcs/drafts.ts
 async function call(opts, repo, path49, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
@@ -23710,13 +23721,13 @@ async function draftsDiscardCommand(repo, draftId, opts) {
   console.log(`draft ${d.draftId} discarded`);
 }
 var init_drafts = __esm({
-  "libs/mesh-cli/src/commands/vcs/drafts.ts"() {
+  "packages/mesh-cli/src/commands/vcs/drafts.ts"() {
     "use strict";
     init_common();
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/propose.ts
+// packages/mesh-cli/src/commands/vcs/propose.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { join as join46 } from "node:path";
 function parseStatus(out) {
@@ -23808,13 +23819,13 @@ async function proposeCommand(opts) {
   );
 }
 var init_propose = __esm({
-  "libs/mesh-cli/src/commands/vcs/propose.ts"() {
+  "packages/mesh-cli/src/commands/vcs/propose.ts"() {
     "use strict";
     init_common();
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/rm.ts
+// packages/mesh-cli/src/commands/vcs/rm.ts
 import { mkdtemp as mkdtemp2, rm as rmrf } from "node:fs/promises";
 import { tmpdir as tmpdir10 } from "node:os";
 import { join as join47 } from "node:path";
@@ -23893,13 +23904,13 @@ async function rmCommand(repo, paths, opts) {
   }
 }
 var init_rm = __esm({
-  "libs/mesh-cli/src/commands/vcs/rm.ts"() {
+  "packages/mesh-cli/src/commands/vcs/rm.ts"() {
     "use strict";
     init_common();
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/review.ts
+// packages/mesh-cli/src/commands/vcs/review.ts
 async function call2(opts, repo, path49, method = "GET", body) {
   const target = await resolveTarget2({ ...opts, repo });
   const token = await resolveToken(opts);
@@ -23933,13 +23944,13 @@ async function requestChangesCommand(repo, id, opts) {
   console.log(`changes requested on ${id}`);
 }
 var init_review = __esm({
-  "libs/mesh-cli/src/commands/vcs/review.ts"() {
+  "packages/mesh-cli/src/commands/vcs/review.ts"() {
     "use strict";
     init_common();
   }
 });
 
-// libs/mesh-cli/src/commands/vcs/index.ts
+// packages/mesh-cli/src/commands/vcs/index.ts
 function withCommon(cmd) {
   return cmd.option("--url <url>", "vcs service URL (or VCS_URL, or derived from origin remote)").option("--token <token>", "bearer token (or VCS_TOKEN)").option("--context <context>", "mesh login context to mint a token from");
 }
@@ -23996,7 +24007,7 @@ function registerVcsCommands(program2) {
   );
 }
 var init_vcs = __esm({
-  "libs/mesh-cli/src/commands/vcs/index.ts"() {
+  "packages/mesh-cli/src/commands/vcs/index.ts"() {
     "use strict";
     init_clone();
     init_get();
@@ -24007,7 +24018,7 @@ var init_vcs = __esm({
   }
 });
 
-// libs/workflow-model/src/workflow-ir.ts
+// packages/workflow-model/src/workflow-ir.ts
 function computeHappyPath(nodes, edges) {
   const startNode = nodes.find((n) => n.type === "start");
   const endNodes = nodes.filter((n) => n.type === "end");
@@ -24568,7 +24579,7 @@ function validateWorkflowPatches(ir, patches) {
 }
 var WorkflowPatchError, WorkflowPatchStream;
 var init_workflow_ir = __esm({
-  "libs/workflow-model/src/workflow-ir.ts"() {
+  "packages/workflow-model/src/workflow-ir.ts"() {
     "use strict";
     WorkflowPatchError = class extends Error {
       constructor(message) {
@@ -24650,7 +24661,7 @@ var init_workflow_ir = __esm({
   }
 });
 
-// libs/workflow-model/src/workflow-ir-validate.ts
+// packages/workflow-model/src/workflow-ir-validate.ts
 function outgoingEdges(edges, nodeId) {
   return edges.filter((e) => e.from === nodeId);
 }
@@ -24762,12 +24773,12 @@ function collectDiagnostics(workflow, out, depth, maxDepth) {
   }
 }
 var init_workflow_ir_validate = __esm({
-  "libs/workflow-model/src/workflow-ir-validate.ts"() {
+  "packages/workflow-model/src/workflow-ir-validate.ts"() {
     "use strict";
   }
 });
 
-// libs/workflow-model/src/apply-preview-patch.ts
+// packages/workflow-model/src/apply-preview-patch.ts
 function applyPreviewPatch(ir, patch) {
   try {
     return applyWorkflowPatch(ir, patch);
@@ -24776,13 +24787,13 @@ function applyPreviewPatch(ir, patch) {
   }
 }
 var init_apply_preview_patch = __esm({
-  "libs/workflow-model/src/apply-preview-patch.ts"() {
+  "packages/workflow-model/src/apply-preview-patch.ts"() {
     "use strict";
     init_workflow_ir();
   }
 });
 
-// libs/workflow-model/src/change-counts.ts
+// packages/workflow-model/src/change-counts.ts
 function countChanges(changes) {
   if (!changes) return null;
   const counts = {
@@ -24816,13 +24827,13 @@ function describeChanges(counts) {
 }
 var zero;
 var init_change_counts = __esm({
-  "libs/workflow-model/src/change-counts.ts"() {
+  "packages/workflow-model/src/change-counts.ts"() {
     "use strict";
     zero = () => ({ extend: 0, add: 0, remove: 0, rewire: 0, total: 0 });
   }
 });
 
-// libs/workflow-model/src/process-artifact.ts
+// packages/workflow-model/src/process-artifact.ts
 import { z as z4 } from "zod";
 function outcomeTriggers(outcome) {
   const raw = Array.isArray(outcome.when) ? outcome.when : [outcome.when];
@@ -24964,7 +24975,7 @@ function parseProcessArtifact(json) {
 }
 var CURRENT_PROCESS_VERSION, SUPPORTED_PROCESS_VERSIONS, UNVERSIONED_REVISION, LEGACY_V1_ACTOR_CATEGORY, actorSchema, selectorSchema, substepBindSchema, substepSchema, outcomeTriggerSchema, outcomeWhenSchema, outcomeSchema, stageCompleteSchema, stageSchema, processBlockSchema, processArtifactSchema;
 var init_process_artifact = __esm({
-  "libs/workflow-model/src/process-artifact.ts"() {
+  "packages/workflow-model/src/process-artifact.ts"() {
     "use strict";
     CURRENT_PROCESS_VERSION = 2;
     SUPPORTED_PROCESS_VERSIONS = [1, 2];
@@ -25154,7 +25165,7 @@ var init_process_artifact = __esm({
   }
 });
 
-// libs/workflow-model/src/process-lint.ts
+// packages/workflow-model/src/process-lint.ts
 function stagePath(stageIndex) {
   return `process.stages[${stageIndex}]`;
 }
@@ -25313,13 +25324,13 @@ function lintProcess(artifact, inventory, predicateNames, options = {}) {
   return diagnostics;
 }
 var init_process_lint = __esm({
-  "libs/workflow-model/src/process-lint.ts"() {
+  "packages/workflow-model/src/process-lint.ts"() {
     "use strict";
     init_process_artifact();
   }
 });
 
-// libs/workflow-model/src/index.ts
+// packages/workflow-model/src/index.ts
 var src_exports2 = {};
 __export(src_exports2, {
   CURRENT_PROCESS_VERSION: () => CURRENT_PROCESS_VERSION,
@@ -25348,7 +25359,7 @@ __export(src_exports2, {
   walkProcessNodes: () => walkProcessNodes
 });
 var init_src4 = __esm({
-  "libs/workflow-model/src/index.ts"() {
+  "packages/workflow-model/src/index.ts"() {
     "use strict";
     init_workflow_ir();
     init_workflow_ir_validate();
@@ -25359,7 +25370,7 @@ var init_src4 = __esm({
   }
 });
 
-// libs/mesh-cli/src/commands/workflow.ts
+// packages/mesh-cli/src/commands/workflow.ts
 import * as fs41 from "fs";
 import * as path48 from "path";
 import { createRequire as createRequire2 } from "module";
@@ -25788,7 +25799,7 @@ ${inventory.workflowType} (${sourceFile})`);
 }
 var DISCOVERY_HELPERS_SRC;
 var init_workflow = __esm({
-  "libs/mesh-cli/src/commands/workflow.ts"() {
+  "packages/mesh-cli/src/commands/workflow.ts"() {
     "use strict";
     init_log();
     DISCOVERY_HELPERS_SRC = `
@@ -25884,7 +25895,7 @@ function discoverProcessArtifact(filePath, source) {
   }
 });
 
-// libs/mesh-cli/src/program.ts
+// packages/mesh-cli/src/program.ts
 var program_exports = {};
 __export(program_exports, {
   CLI_DESCRIPTION: () => CLI_DESCRIPTION,
@@ -25925,7 +25936,7 @@ function createProgram(options = {}) {
 }
 var CLI_NAME, CLI_DESCRIPTION;
 var init_program = __esm({
-  "libs/mesh-cli/src/program.ts"() {
+  "packages/mesh-cli/src/program.ts"() {
     "use strict";
     init_app_check();
     init_artifacts();
@@ -25957,7 +25968,7 @@ var init_program = __esm({
   }
 });
 
-// libs/mesh-cli/bin/mesh.ts
+// packages/mesh-cli/bin/mesh.ts
 init_program();
 init_errors();
 init_build_info();