diff --git a/src/cmd/cli/command/cd.go b/src/cmd/cli/command/cd.go
index dd7435bed..956191a00 100644
--- a/src/cmd/cli/command/cd.go
+++ b/src/cmd/cli/command/cd.go
@@ -5,7 +5,7 @@ import (
 	"os"
 
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/aws"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -42,7 +42,7 @@ func bootstrapCommand(cmd *cobra.Command, args []string, command string) error {
 	}
 
 	if len(args) == 0 {
-		projectName, err := cliClient.LoadProjectNameWithFallback(ctx, loader, provider)
+		projectName, err := client.LoadProjectNameWithFallback(ctx, loader, provider)
 		if err != nil {
 			return err
 		}
diff --git a/src/cmd/cli/command/commands.go b/src/cmd/cli/command/commands.go
index f59e00fd3..7052b64bf 100644
--- a/src/cmd/cli/command/commands.go
+++ b/src/cmd/cli/command/commands.go
@@ -18,12 +18,11 @@ import (
 	"github.com/DefangLabs/defang/src/pkg/agent"
 	"github.com/DefangLabs/defang/src/pkg/auth"
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/gcp"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/clouds/aws"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
 	"github.com/DefangLabs/defang/src/pkg/debug"
 	"github.com/DefangLabs/defang/src/pkg/dryrun"
 	"github.com/DefangLabs/defang/src/pkg/github"
@@ -58,7 +57,7 @@ func getTenantSelection() types.TenantNameOrID {
 	if global.Tenant != "" {
 		return types.TenantNameOrID(global.Tenant)
 	}
-	if token := cluster.GetExistingToken(global.Cluster); token != "" {
+	if token := client.GetExistingToken(global.Cluster); token != "" {
 		if t := cli.TenantFromToken(token); t.IsSet() {
 			return t
 		}
@@ -75,7 +74,7 @@ func Execute(ctx context.Context) error {
 
 	if err := RootCmd.ExecuteContext(ctx); err != nil {
 		if !(errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded)) {
-			term.Error("Error:", cliClient.PrettyError(err))
+			term.Error("Error:", client.PrettyError(err))
 		}
 
 		if err == dryrun.ErrDryRun {
@@ -186,10 +185,10 @@ func SetupCommands(ctx context.Context, version string) {
 	RootCmd.PersistentFlags().StringVar(&global.Cluster, "cluster", global.Cluster, "Defang cluster to connect to")
 	RootCmd.PersistentFlags().MarkHidden("cluster") // only for Defang use
 	RootCmd.PersistentFlags().StringVar(&global.Tenant, "workspace", global.Tenant, "workspace to use (tenant name or ID)")
-	RootCmd.PersistentFlags().VarP(&global.Stack.Provider, "provider", "P", fmt.Sprintf(`bring-your-own-cloud provider; one of %v`, cliClient.AllProviders()))
+	RootCmd.PersistentFlags().VarP(&global.Stack.Provider, "provider", "P", fmt.Sprintf(`bring-your-own-cloud provider; one of %v`, client.AllProviders()))
 	RootCmd.RegisterFlagCompletionFunc("provider", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		var completions []cobra.Completion
-		for _, provider := range cliClient.AllProviders() {
+		for _, provider := range client.AllProviders() {
 			completions = append(completions, provider.String())
 		}
 		return completions, cobra.ShellCompDirectiveNoFileComp
@@ -558,7 +557,7 @@ var whoamiCmd = &cobra.Command{
 			term.Debug("unable to get provider:", err)
 		}
 
-		token := cluster.GetExistingToken(global.Cluster)
+		token := client.GetExistingToken(global.Cluster)
 
 		userInfo, err := auth.FetchUserInfo(cmd.Context(), token)
 		if err != nil {
@@ -798,7 +797,7 @@ var configSetCmd = &cobra.Command{
 			return err
 		}
 
-		projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+		projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 		if err != nil {
 			return err
 		}
@@ -929,7 +928,7 @@ var configDeleteCmd = &cobra.Command{
 			return err
 		}
 
-		projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+		projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 		if err != nil {
 			return err
 		}
@@ -937,7 +936,7 @@ var configDeleteCmd = &cobra.Command{
 		if err := cli.ConfigDelete(cmd.Context(), projectName, provider, names...); err != nil {
 			// Show a warning (not an error) if the config was not found
 			if connect.CodeOf(err) == connect.CodeNotFound {
-				term.Warn(cliClient.PrettyError(err))
+				term.Warn(client.PrettyError(err))
 				return nil
 			}
 			return err
@@ -962,7 +961,7 @@ var configListCmd = &cobra.Command{
 			return err
 		}
 
-		projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+		projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 		if err != nil {
 			return err
 		}
@@ -1042,7 +1041,7 @@ var deleteCmd = &cobra.Command{
 			return err
 		}
 
-		projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+		projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 		if err != nil {
 			return err
 		}
@@ -1057,7 +1056,7 @@ var deleteCmd = &cobra.Command{
 		if err != nil {
 			if connect.CodeOf(err) == connect.CodeNotFound {
 				// Show a warning (not an error) if the service was not found
-				term.Warn(cliClient.PrettyError(err))
+				term.Warn(client.PrettyError(err))
 				return nil
 			}
 			return err
@@ -1236,7 +1235,7 @@ func configureLoader(cmd *cobra.Command) *compose.Loader {
 	}
 
 	// Avoid common mistakes
-	var prov cliClient.ProviderID
+	var prov client.ProviderID
 	if prov.Set(projectName) == nil && !cmd.Flag("provider").Changed {
 		// using -p with a provider name instead of -P
 		term.Warnf("Project name %q looks like a provider name; did you mean to use -P=%s instead of -p?", projectName, projectName)
@@ -1292,14 +1291,14 @@ func isUpgradeCommand(cmd *cobra.Command) bool {
 	return cmd.Name() == "upgrade"
 }
 
-var providerDescription = map[cliClient.ProviderID]string{
-	cliClient.ProviderDefang: "The Defang Playground is a free platform intended for testing purposes only.",
-	cliClient.ProviderAWS:    "Deploy to AWS using the AWS_* environment variables or the AWS CLI configuration.",
-	cliClient.ProviderDO:     "Deploy to DigitalOcean using the DIGITALOCEAN_TOKEN, SPACES_ACCESS_KEY_ID, and SPACES_SECRET_ACCESS_KEY environment variables.",
-	cliClient.ProviderGCP:    "Deploy to Google Cloud Platform using gcloud Application Default Credentials.",
+var providerDescription = map[client.ProviderID]string{
+	client.ProviderDefang: "The Defang Playground is a free platform intended for testing purposes only.",
+	client.ProviderAWS:    "Deploy to AWS using the AWS_* environment variables or the AWS CLI configuration.",
+	client.ProviderDO:     "Deploy to DigitalOcean using the DIGITALOCEAN_TOKEN, SPACES_ACCESS_KEY_ID, and SPACES_SECRET_ACCESS_KEY environment variables.",
+	client.ProviderGCP:    "Deploy to Google Cloud Platform using gcloud Application Default Credentials.",
 }
 
-func updateProviderID(ctx context.Context, loader cliClient.Loader) error {
+func updateProviderID(ctx context.Context, loader client.Loader) error {
 	extraMsg := ""
 	whence := "default project"
 
@@ -1309,13 +1308,13 @@ func updateProviderID(ctx context.Context, loader cliClient.Loader) error {
 	} else if val, ok := os.LookupEnv("DEFANG_PROVIDER"); ok {
 		// Sanitize the provider value from the environment variable
 		if err := global.Stack.Provider.Set(val); err != nil {
-			return fmt.Errorf("invalid provider '%v' in environment variable DEFANG_PROVIDER, supported providers are: %v", val, cliClient.AllProviders())
+			return fmt.Errorf("invalid provider '%v' in environment variable DEFANG_PROVIDER, supported providers are: %v", val, client.AllProviders())
 		}
 		whence = "environment variable"
 	}
 
 	switch global.Stack.Provider {
-	case cliClient.ProviderAuto:
+	case client.ProviderAuto:
 		if global.NonInteractive {
 			// Defaults to defang provider in non-interactive mode
 			if awsInEnv() {
@@ -1327,26 +1326,26 @@ func updateProviderID(ctx context.Context, loader cliClient.Loader) error {
 			if gcpInEnv() {
 				term.Warn("Using Defang playground, but GCP_PROJECT_ID/CLOUDSDK_CORE_PROJECT environment variable was detected; did you forget --provider=gcp or DEFANG_PROVIDER=gcp?")
 			}
-			global.Stack.Provider = cliClient.ProviderDefang
+			global.Stack.Provider = client.ProviderDefang
 		} else {
 			var err error
 			if whence, err = determineProviderID(ctx, loader); err != nil {
 				return err
 			}
 		}
-	case cliClient.ProviderAWS:
+	case client.ProviderAWS:
 		if !awsInConfig(ctx) {
 			term.Warn("AWS provider was selected, but AWS environment is not set")
 		}
-	case cliClient.ProviderDO:
+	case client.ProviderDO:
 		if !doInEnv() {
 			term.Warn("DigitalOcean provider was selected, but DIGITALOCEAN_TOKEN environment variable is not set")
 		}
-	case cliClient.ProviderGCP:
+	case client.ProviderGCP:
 		if !gcpInEnv() {
 			term.Warn("GCP provider was selected, but GCP_PROJECT_ID environment variable is not set")
 		}
-	case cliClient.ProviderDefang:
+	case client.ProviderDefang:
 		// Ignore any env vars when explicitly using the Defang playground provider
 		extraMsg = "; consider using BYOC (https://s.defang.io/byoc)"
 	}
@@ -1355,7 +1354,7 @@ func updateProviderID(ctx context.Context, loader cliClient.Loader) error {
 	return nil
 }
 
-func newProvider(ctx context.Context, loader cliClient.Loader) (cliClient.Provider, error) {
+func newProvider(ctx context.Context, loader client.Loader) (client.Provider, error) {
 	if err := updateProviderID(ctx, loader); err != nil {
 		return nil, err
 	}
@@ -1364,7 +1363,7 @@ func newProvider(ctx context.Context, loader cliClient.Loader) (cliClient.Provid
 	return provider, nil
 }
 
-func newProviderChecked(ctx context.Context, loader cliClient.Loader) (cliClient.Provider, error) {
+func newProviderChecked(ctx context.Context, loader client.Loader) (client.Provider, error) {
 	provider, err := newProvider(ctx, loader)
 	if err != nil {
 		return nil, err
@@ -1373,11 +1372,11 @@ func newProviderChecked(ctx context.Context, loader cliClient.Loader) (cliClient
 	return provider, err
 }
 
-func canIUseProvider(ctx context.Context, provider cliClient.Provider, projectName string, serviceCount int) error {
-	return cliClient.CanIUseProvider(ctx, global.Client, provider, projectName, global.Stack.Name, serviceCount)
+func canIUseProvider(ctx context.Context, provider client.Provider, projectName string, serviceCount int) error {
+	return client.CanIUseProvider(ctx, global.Client, provider, projectName, global.Stack.Name, serviceCount)
 }
 
-func determineProviderID(ctx context.Context, loader cliClient.Loader) (string, error) {
+func determineProviderID(ctx context.Context, loader client.Loader) (string, error) {
 	var projectName string
 	if loader != nil {
 		var err error
@@ -1397,7 +1396,7 @@ func determineProviderID(ctx context.Context, loader cliClient.Loader) (string,
 		}
 	}
 
-	whence, err := interactiveSelectProvider(cliClient.AllProviders())
+	whence, err := interactiveSelectProvider(client.AllProviders())
 
 	// Save the selected provider to the fabric
 	if projectName != "" {
@@ -1411,7 +1410,7 @@ func determineProviderID(ctx context.Context, loader cliClient.Loader) (string,
 	return whence, err
 }
 
-func interactiveSelectProvider(providers []cliClient.ProviderID) (string, error) {
+func interactiveSelectProvider(providers []client.ProviderID) (string, error) {
 	if len(providers) < 2 {
 		panic("interactiveSelectProvider called with less than 2 providers")
 	}
@@ -1423,11 +1422,11 @@ func interactiveSelectProvider(providers []cliClient.ProviderID) (string, error)
 	// Default to the provider in the environment if available
 	var defaultOption any // not string!
 	if awsInEnv() {
-		defaultOption = cliClient.ProviderAWS.String()
+		defaultOption = client.ProviderAWS.String()
 	} else if doInEnv() {
-		defaultOption = cliClient.ProviderDO.String()
+		defaultOption = client.ProviderDO.String()
 	} else if gcpInEnv() {
-		defaultOption = cliClient.ProviderGCP.String()
+		defaultOption = client.ProviderGCP.String()
 	}
 	var optionValue string
 	if err := survey.AskOne(&survey.Select{
@@ -1436,7 +1435,7 @@ func interactiveSelectProvider(providers []cliClient.ProviderID) (string, error)
 		Options: options,
 		Help:    "The provider you choose will be used for deploying services.",
 		Description: func(value string, i int) string {
-			return providerDescription[cliClient.ProviderID(value)]
+			return providerDescription[client.ProviderID(value)]
 		},
 	}, &optionValue, survey.WithStdio(term.DefaultTerm.Stdio())); err != nil {
 		return "", fmt.Errorf("failed to select provider: %w", err)
diff --git a/src/cmd/cli/command/commands_test.go b/src/cmd/cli/command/commands_test.go
index a328015fd..3a4dad512 100644
--- a/src/cmd/cli/command/commands_test.go
+++ b/src/cmd/cli/command/commands_test.go
@@ -11,11 +11,11 @@ import (
 	"testing"
 
 	"github.com/DefangLabs/defang/src/pkg/auth"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/aws"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/gcp"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
-	pkg "github.com/DefangLabs/defang/src/pkg/clouds/aws"
+	awsdriver "github.com/DefangLabs/defang/src/pkg/clouds/aws"
 	gcpdriver "github.com/DefangLabs/defang/src/pkg/clouds/gcp"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
@@ -30,7 +30,7 @@ import (
 )
 
 type MockSsmClient struct {
-	pkg.SsmParametersAPI
+	awsdriver.SsmParametersAPI
 }
 
 func (m *MockSsmClient) PutParameter(ctx context.Context, params *ssm.PutParameterInput, optFns ...func(*ssm.Options)) (*ssm.PutParameterOutput, error) {
@@ -200,7 +200,7 @@ func TestCommandGates(t *testing.T) {
 	for _, tt := range testData {
 		t.Run(tt.name, func(t *testing.T) {
 			aws.StsClient = &mockStsProviderAPI{}
-			pkg.SsmClientOverride = &MockSsmClient{}
+			awsdriver.SsmClientOverride = &MockSsmClient{}
 			mockService.canIUseIsCalled = false
 
 			err := testCommand(tt.command, server.URL)
@@ -260,13 +260,13 @@ func (f *FakeStdout) Fd() uintptr {
 }
 
 func TestGetProvider(t *testing.T) {
-	mockClient := cliClient.GrpcClient{}
+	mockClient := client.GrpcClient{}
 	mockCtrl := &MockFabricControllerClient{
 		canIUseResponse: defangv1.CanIUseResponse{},
 	}
 	mockClient.SetClient(mockCtrl)
 	global.Client = &mockClient
-	loader := cliClient.MockLoader{Project: compose.Project{Name: "empty"}}
+	loader := client.MockLoader{Project: compose.Project{Name: "empty"}}
 	oldRootCmd := RootCmd
 	t.Cleanup(func() {
 		RootCmd = oldRootCmd
@@ -291,8 +291,8 @@ func TestGetProvider(t *testing.T) {
 		if err != nil {
 			t.Fatalf("getProvider() failed: %v", err)
 		}
-		if _, ok := p.(*cliClient.PlaygroundProvider); !ok {
-			t.Errorf("Expected provider to be of type *cliClient.PlaygroundProvider, got %T", p)
+		if _, ok := p.(*client.PlaygroundProvider); !ok {
+			t.Errorf("Expected provider to be of type *client.PlaygroundProvider, got %T", p)
 		}
 	})
 
diff --git a/src/cmd/cli/command/compose.go b/src/cmd/cli/command/compose.go
index c2c57d318..23e80e2fe 100644
--- a/src/cmd/cli/command/compose.go
+++ b/src/cmd/cli/command/compose.go
@@ -12,10 +12,9 @@ import (
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/DefangLabs/defang/src/pkg"
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
-	pcluster "github.com/DefangLabs/defang/src/pkg/cluster"
 	"github.com/DefangLabs/defang/src/pkg/debug"
 	"github.com/DefangLabs/defang/src/pkg/dryrun"
 	"github.com/DefangLabs/defang/src/pkg/logs"
@@ -35,7 +34,7 @@ const SERVICE_PORTAL_URL = "https://" + DEFANG_PORTAL_HOST + "/service"
 
 func printPlaygroundPortalServiceURLs(serviceInfos []*defangv1.ServiceInfo) {
 	// We can only show services deployed to the prod1 defang SaaS environment.
-	if global.Stack.Provider == cliClient.ProviderDefang && global.Cluster == pcluster.DefaultCluster {
+	if global.Stack.Provider == client.ProviderDefang && global.Cluster == client.DefaultCluster {
 		term.Info("Monitor your services' status in the defang portal")
 		for _, serviceInfo := range serviceInfos {
 			term.Println("   -", SERVICE_PORTAL_URL+"/"+serviceInfo.Service.Name)
@@ -215,13 +214,13 @@ func makeComposeUpCmd() *cobra.Command {
 	_ = composeUpCmd.Flags().MarkHidden("tail")
 	composeUpCmd.Flags().VarP(&global.Stack.Mode, "mode", "m", fmt.Sprintf("deployment mode; one of %v", modes.AllDeploymentModes()))
 	composeUpCmd.Flags().Bool("build", true, "build the image before starting the service") // docker-compose compatibility
-	composeUpCmd.Flags().Bool("wait", true, "wait for services to be running|healthy") // docker-compose compatibility
+	composeUpCmd.Flags().Bool("wait", true, "wait for services to be running|healthy")      // docker-compose compatibility
 	_ = composeUpCmd.Flags().MarkHidden("wait")
 	composeUpCmd.Flags().Int("wait-timeout", -1, "maximum duration to wait for the project to be running|healthy") // docker-compose compatibility
 	return composeUpCmd
 }
 
-func handleExistingDeployments(existingDeployments []*defangv1.Deployment, accountInfo *cliClient.AccountInfo, projectName string) error {
+func handleExistingDeployments(existingDeployments []*defangv1.Deployment, accountInfo *client.AccountInfo, projectName string) error {
 	samePlace := slices.ContainsFunc(existingDeployments, func(dep *defangv1.Deployment) bool {
 		// Old deployments may not have a region or account ID, so we check for empty values too
 		return dep.Provider == global.Stack.Provider.Value() && (dep.ProviderAccountId == accountInfo.AccountID || dep.ProviderAccountId == "") && (dep.Region == accountInfo.Region || dep.Region == "")
@@ -253,9 +252,9 @@ func printExistingDeployments(existingDeployments []*defangv1.Deployment) {
 	term.Info("This project was previously deployed to the following locations:")
 	deploymentStrings := make([]string, 0, len(existingDeployments))
 	for _, dep := range existingDeployments {
-		var providerId cliClient.ProviderID
+		var providerId client.ProviderID
 		providerId.SetValue(dep.Provider)
-		deploymentStrings = append(deploymentStrings, fmt.Sprintf(" - %v", cliClient.AccountInfo{Provider: providerId, AccountID: dep.ProviderAccountId, Region: dep.Region}))
+		deploymentStrings = append(deploymentStrings, fmt.Sprintf(" - %v", client.AccountInfo{Provider: providerId, AccountID: dep.ProviderAccountId, Region: dep.Region}))
 	}
 	// sort and remove duplicates
 	slices.Sort(deploymentStrings)
@@ -299,7 +298,7 @@ func promptToCreateStack(ctx context.Context, params stacks.StackParameters) err
 	return nil
 }
 
-func handleComposeUpErr(ctx context.Context, debugger *debug.Debugger, project *compose.Project, provider cliClient.Provider, err error) error {
+func handleComposeUpErr(ctx context.Context, debugger *debug.Debugger, project *compose.Project, provider client.Provider, err error) error {
 	if errors.Is(err, types.ErrComposeFileNotFound) {
 		// TODO: generate a compose file based on the current project
 		printDefangHint("To start a new project, do:", "new")
@@ -311,7 +310,7 @@ func handleComposeUpErr(ctx context.Context, debugger *debug.Debugger, project *
 
 	if strings.Contains(err.Error(), "maximum number of projects") {
 		if projectName, err2 := provider.RemoteProjectName(ctx); err2 == nil {
-			term.Error("Error:", cliClient.PrettyError(err))
+			term.Error("Error:", client.PrettyError(err))
 			if _, err := cli.InteractiveComposeDown(ctx, provider, projectName); err != nil {
 				term.Debug("ComposeDown failed:", err)
 				printDefangHint("To deactivate a project, do:", "compose down --project-name "+projectName)
@@ -324,14 +323,14 @@ func handleComposeUpErr(ctx context.Context, debugger *debug.Debugger, project *
 		return err
 	}
 
-	term.Error("Error:", cliClient.PrettyError(err))
+	term.Error("Error:", client.PrettyError(err))
 	return debugger.DebugDeploymentError(ctx, debug.DebugConfig{
 		Project: project,
 	}, err)
 }
 
 func handleTailAndMonitorErr(ctx context.Context, err error, debugger *debug.Debugger, debugConfig debug.DebugConfig) {
-	var errDeploymentFailed cliClient.ErrDeploymentFailed
+	var errDeploymentFailed client.ErrDeploymentFailed
 	if errors.As(err, &errDeploymentFailed) {
 		// Tail got canceled because of deployment failure: prompt to show the debugger
 		term.Warn(errDeploymentFailed)
@@ -443,7 +442,7 @@ func makeComposeDownCmd() *cobra.Command {
 				return err
 			}
 
-			projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+			projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 			if err != nil {
 				return err
 			}
@@ -458,7 +457,7 @@ func makeComposeDownCmd() *cobra.Command {
 			if err != nil {
 				if connect.CodeOf(err) == connect.CodeNotFound {
 					// Show a warning (not an error) if the service was not found
-					term.Warn(cliClient.PrettyError(err))
+					term.Warn(client.PrettyError(err))
 					return nil
 				}
 				return err
@@ -596,7 +595,7 @@ func makeComposePsCmd() *cobra.Command {
 				return err
 			}
 
-			projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+			projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 			if err != nil {
 				return err
 			}
@@ -721,7 +720,7 @@ func handleLogsCmd(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	projectName, err := cliClient.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
+	projectName, err := client.LoadProjectNameWithFallback(cmd.Context(), loader, provider)
 	if err != nil {
 		return err
 	}
diff --git a/src/cmd/cli/command/compose_test.go b/src/cmd/cli/command/compose_test.go
index 4512cbd38..5a7a78bc7 100644
--- a/src/cmd/cli/command/compose_test.go
+++ b/src/cmd/cli/command/compose_test.go
@@ -5,8 +5,7 @@ import (
 	"os"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
-	pcluster "github.com/DefangLabs/defang/src/pkg/cluster"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 )
@@ -31,8 +30,8 @@ func TestPrintPlaygroundPortalServiceURLs(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	term.DefaultTerm = term.NewTerm(os.Stdin, &stdout, &stderr)
 
-	global.Stack.Provider = cliClient.ProviderDefang
-	global.Cluster = pcluster.DefaultCluster
+	global.Stack.Provider = client.ProviderDefang
+	global.Cluster = client.DefaultCluster
 	printPlaygroundPortalServiceURLs([]*defangv1.ServiceInfo{
 		{
 			Service: &defangv1.Service{Name: "service1"},
diff --git a/src/cmd/cli/command/estimate.go b/src/cmd/cli/command/estimate.go
index 5a18ea5bd..0bba71702 100644
--- a/src/cmd/cli/command/estimate.go
+++ b/src/cmd/cli/command/estimate.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	"github.com/spf13/cobra"
@@ -26,24 +26,24 @@ func makeEstimateCmd() *cobra.Command {
 				return err
 			}
 
-			if global.Stack.Provider == cliClient.ProviderAuto {
-				_, err = interactiveSelectProvider([]cliClient.ProviderID{
-					cliClient.ProviderAWS,
-					cliClient.ProviderGCP,
+			if global.Stack.Provider == client.ProviderAuto {
+				_, err = interactiveSelectProvider([]client.ProviderID{
+					client.ProviderAWS,
+					client.ProviderGCP,
 				})
 				if err != nil {
 					return fmt.Errorf("failed to select provider: %w", err)
 				}
 			}
 
-			var previewProvider cliClient.Provider = &cliClient.PlaygroundProvider{FabricClient: global.Client}
+			var previewProvider client.Provider = &client.PlaygroundProvider{FabricClient: global.Client}
 
 			// default to development mode if not specified; TODO: when mode is not specified, show an interactive prompt
 			if global.Stack.Mode == modes.ModeUnspecified {
 				global.Stack.Mode = modes.ModeAffordable
 			}
 			if region == "" {
-				region = cliClient.GetRegion(global.Stack.Provider) // This sets the default region based on the provider
+				region = client.GetRegion(global.Stack.Provider) // This sets the default region based on the provider
 			}
 
 			estimate, err := cli.RunEstimate(ctx, project, global.Client, previewProvider, global.Stack.Provider, region, global.Stack.Mode)
diff --git a/src/cmd/cli/command/globals.go b/src/cmd/cli/command/globals.go
index 7e5da8feb..25a83d8ac 100644
--- a/src/cmd/cli/command/globals.go
+++ b/src/cmd/cli/command/globals.go
@@ -6,8 +6,8 @@ import (
 	"sort"
 	"strconv"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
+	"github.com/DefangLabs/defang/src/pkg"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/migrate"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
@@ -68,7 +68,7 @@ Note: Ensure the flag name, environment variable name, and struct field name are
 and follow the established naming conventions.
 */
 type GlobalConfig struct {
-	Client         *cliClient.GrpcClient
+	Client         *client.GrpcClient
 	Cluster        string
 	ColorMode      ColorMode
 	Debug          bool
@@ -90,12 +90,12 @@ variables, and command-line flags).
 */
 var global GlobalConfig = GlobalConfig{
 	ColorMode:      ColorAuto,
-	Cluster:        cluster.DefangFabric,
-	Debug:          false,
+	Cluster:        client.DefangFabric,
+	Debug:          pkg.GetenvBool("DEFANG_DEBUG"),
 	HasTty:         term.IsTerminal(),
 	HideUpdate:     false,
 	NonInteractive: !term.IsTerminal(),
-	Stack:          stacks.StackParameters{Provider: cliClient.ProviderAuto, Mode: modes.ModeUnspecified},
+	Stack:          stacks.StackParameters{Provider: client.ProviderAuto, Mode: modes.ModeUnspecified},
 	SourcePlatform: migrate.SourcePlatformUnspecified, // default to auto-detecting the source platform
 	Verbose:        false,
 }
diff --git a/src/cmd/cli/command/globals_test.go b/src/cmd/cli/command/globals_test.go
index 567a4fb03..2b27f7d49 100644
--- a/src/cmd/cli/command/globals_test.go
+++ b/src/cmd/cli/command/globals_test.go
@@ -6,8 +6,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/migrate"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
@@ -51,7 +50,7 @@ func Test_configurationPrecedence(t *testing.T) {
 		NonInteractive: false, // set to false just for test instead of !term.IsTerminal() for consistency
 		SourcePlatform: migrate.SourcePlatformUnspecified,
 		Verbose:        false,
-		Stack:          stacks.StackParameters{Provider: cliClient.ProviderAuto, Mode: modes.ModeUnspecified},
+		Stack:          stacks.StackParameters{Provider: client.ProviderAuto, Mode: modes.ModeUnspecified},
 		Cluster:        "",
 		Tenant:         "",
 	}
@@ -116,7 +115,7 @@ func Test_configurationPrecedence(t *testing.T) {
 				Debug:   true,
 				Stack: stacks.StackParameters{
 					Name:     "from-flags",
-					Provider: cliClient.ProviderAWS,
+					Provider: client.ProviderAWS,
 					Mode:     modes.ModeHighAvailability,
 				},
 				Cluster:        "from-flags-cluster",
@@ -164,7 +163,7 @@ func Test_configurationPrecedence(t *testing.T) {
 				Debug:   false,
 				Stack: stacks.StackParameters{
 					Name:     "from-env",
-					Provider: cliClient.ProviderGCP,
+					Provider: client.ProviderGCP,
 					Mode:     modes.ModeBalanced,
 				},
 				Cluster:        "from-env-cluster",
@@ -200,7 +199,7 @@ func Test_configurationPrecedence(t *testing.T) {
 				Debug:   false,
 				Stack: stacks.StackParameters{
 					Name:     "from-env",
-					Provider: cliClient.ProviderDefang,
+					Provider: client.ProviderDefang,
 					Mode:     modes.ModeAffordable,
 				},
 				Cluster:        "from-env-cluster",
@@ -368,7 +367,7 @@ func Test_configurationPrecedence(t *testing.T) {
 
 func TestTenantFlagWinsOverEnv(t *testing.T) {
 	cfg := GlobalConfig{
-		Cluster: cluster.DefangFabric,
+		Cluster: client.DefangFabric,
 	}
 	flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
 	flags.StringVar(&cfg.Tenant, "workspace", cfg.Tenant, "workspace name")
@@ -438,7 +437,7 @@ func TestTenantEnvSources(t *testing.T) {
 				t.Fatalf("failed to create .defang directory: %v", err)
 			}
 			cfg := GlobalConfig{
-				Cluster: cluster.DefangFabric,
+				Cluster: client.DefangFabric,
 			}
 			flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
 			flags.StringVar(&cfg.Tenant, "workspace", cfg.Tenant, "workspace name")
diff --git a/src/cmd/cli/command/mcp.go b/src/cmd/cli/command/mcp.go
index c824ec60f..a0959350f 100644
--- a/src/cmd/cli/command/mcp.go
+++ b/src/cmd/cli/command/mcp.go
@@ -6,7 +6,7 @@ import (
 	"path/filepath"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/tools"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/mcp"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	"github.com/mark3labs/mcp-go/server"
@@ -37,7 +37,7 @@ var mcpServerCmd = &cobra.Command{
 		}
 
 		term.Debug("Creating log file")
-		logFile, err := os.OpenFile(filepath.Join(cliClient.StateDir, "defang-mcp.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+		logFile, err := os.OpenFile(filepath.Join(client.StateDir, "defang-mcp.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 		if err != nil {
 			term.Warnf("Failed to open log file: %v", err)
 		} else {
diff --git a/src/cmd/cli/command/stack_test.go b/src/cmd/cli/command/stack_test.go
index e1dceca4d..340a18e0f 100644
--- a/src/cmd/cli/command/stack_test.go
+++ b/src/cmd/cli/command/stack_test.go
@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -42,13 +42,13 @@ func TestStackListCmd(t *testing.T) {
 			stacks: []stacks.StackParameters{
 				{
 					Name:     "teststack1",
-					Provider: cliClient.ProviderAWS,
+					Provider: client.ProviderAWS,
 					Region:   "us-west-2",
 					Mode:     modes.ModeAffordable,
 				},
 				{
 					Name:     "teststack2",
-					Provider: cliClient.ProviderGCP,
+					Provider: client.ProviderGCP,
 					Region:   "us-central1",
 					Mode:     modes.ModeBalanced,
 				},
@@ -89,7 +89,7 @@ func TestNonInteractiveStackNewCmd(t *testing.T) {
 			name: "valid parameters",
 			parameters: stacks.StackParameters{
 				Name:     "teststack",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-2",
 				Mode:     modes.ModeAffordable,
 			},
@@ -99,7 +99,7 @@ func TestNonInteractiveStackNewCmd(t *testing.T) {
 			name: "missing stack name",
 			parameters: stacks.StackParameters{
 				Name:     "",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-2",
 				Mode:     modes.ModeAffordable,
 			},
diff --git a/src/cmd/cli/command/workspace.go b/src/cmd/cli/command/workspace.go
index fcda42889..5af4bbb57 100644
--- a/src/cmd/cli/command/workspace.go
+++ b/src/cmd/cli/command/workspace.go
@@ -7,7 +7,7 @@ import (
 	"github.com/DefangLabs/defang/src/pkg"
 	"github.com/DefangLabs/defang/src/pkg/auth"
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	"github.com/spf13/cobra"
 )
@@ -16,7 +16,7 @@ func ListWorkspaces(cmd *cobra.Command, args []string) error {
 	jsonMode, _ := cmd.Flags().GetBool("json")
 	verbose := global.Verbose
 
-	token := cluster.GetExistingToken(global.Cluster)
+	token := client.GetExistingToken(global.Cluster)
 	if token == "" {
 		return errors.New("no access token found; please log in with `defang login`")
 	}
diff --git a/src/pkg/agent/agent.go b/src/pkg/agent/agent.go
index 3517e30ee..08a1c6a82 100644
--- a/src/pkg/agent/agent.go
+++ b/src/pkg/agent/agent.go
@@ -14,7 +14,7 @@ import (
 	"github.com/DefangLabs/defang/src/pkg"
 	"github.com/DefangLabs/defang/src/pkg/agent/plugins/fabric"
 	"github.com/DefangLabs/defang/src/pkg/agent/tools"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -34,10 +34,10 @@ type Agent struct {
 }
 
 func New(ctx context.Context, clusterAddr string, stack *stacks.StackParameters) (*Agent, error) {
-	accessToken := cluster.GetExistingToken(clusterAddr)
+	accessToken := client.GetExistingToken(clusterAddr)
 	aiProvider := "fabric"
 	var providerPlugin api.Plugin
-	addr := cluster.NormalizeHost(clusterAddr)
+	addr := client.NormalizeHost(clusterAddr)
 	// Generate a random session ID prepended with timestamp for easier sorting
 	sessionID := fmt.Sprintf("%s-%s", time.Now().Format("20060102T150405Z"), pkg.RandomID())
 	providerPlugin = &fabric.OpenAI{
diff --git a/src/pkg/agent/tools/create_aws_stack.go b/src/pkg/agent/tools/create_aws_stack.go
index d6a397da5..656506b42 100644
--- a/src/pkg/agent/tools/create_aws_stack.go
+++ b/src/pkg/agent/tools/create_aws_stack.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 )
@@ -33,7 +33,7 @@ func HandleCreateAWSStackTool(ctx context.Context, params CreateAWSStackParams,
 	newStack := stacks.StackParameters{
 		Name:       params.Name,
 		AWSProfile: params.AWS_Profile,
-		Provider:   cliClient.ProviderAWS,
+		Provider:   client.ProviderAWS,
 		Region:     params.Region,
 		Mode:       mode,
 	}
diff --git a/src/pkg/agent/tools/create_gcp_stack.go b/src/pkg/agent/tools/create_gcp_stack.go
index 40ca2726e..423531d52 100644
--- a/src/pkg/agent/tools/create_gcp_stack.go
+++ b/src/pkg/agent/tools/create_gcp_stack.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 )
@@ -33,7 +33,7 @@ func HandleCreateGCPStackTool(ctx context.Context, params CreateGCPStackParams,
 	newStack := stacks.StackParameters{
 		Name:         params.Name,
 		GCPProjectID: params.GCPProjectID,
-		Provider:     cliClient.ProviderGCP,
+		Provider:     client.ProviderGCP,
 		Region:       params.Region,
 		Mode:         mode,
 	}
diff --git a/src/pkg/agent/tools/default_tool_cli.go b/src/pkg/agent/tools/default_tool_cli.go
index 0e13e6ba4..795437eb4 100644
--- a/src/pkg/agent/tools/default_tool_cli.go
+++ b/src/pkg/agent/tools/default_tool_cli.go
@@ -7,7 +7,7 @@ import (
 	"strconv"
 
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/login"
 	"github.com/DefangLabs/defang/src/pkg/modes"
@@ -27,48 +27,48 @@ type StackConfig struct {
 
 type DefaultToolCLI struct{}
 
-func (DefaultToolCLI) CanIUseProvider(ctx context.Context, client *cliClient.GrpcClient, projectName, stackName string, provider cliClient.Provider, serviceCount int) error {
-	return cliClient.CanIUseProvider(ctx, client, provider, projectName, stackName, serviceCount)
+func (DefaultToolCLI) CanIUseProvider(ctx context.Context, fabric *client.GrpcClient, projectName, stackName string, provider client.Provider, serviceCount int) error {
+	return client.CanIUseProvider(ctx, fabric, provider, projectName, stackName, serviceCount)
 }
 
-func (DefaultToolCLI) ConfigSet(ctx context.Context, projectName string, provider cliClient.Provider, name, value string) error {
+func (DefaultToolCLI) ConfigSet(ctx context.Context, projectName string, provider client.Provider, name, value string) error {
 	return cli.ConfigSet(ctx, projectName, provider, name, value)
 }
 
-func (DefaultToolCLI) RunEstimate(ctx context.Context, project *compose.Project, client *cliClient.GrpcClient, provider cliClient.Provider, providerId cliClient.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error) {
-	return cli.RunEstimate(ctx, project, client, provider, providerId, region, mode)
+func (DefaultToolCLI) RunEstimate(ctx context.Context, project *compose.Project, fabric *client.GrpcClient, provider client.Provider, providerId client.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error) {
+	return cli.RunEstimate(ctx, project, fabric, provider, providerId, region, mode)
 }
 
-func (DefaultToolCLI) ListConfig(ctx context.Context, provider cliClient.Provider, projectName string) (*defangv1.Secrets, error) {
+func (DefaultToolCLI) ListConfig(ctx context.Context, provider client.Provider, projectName string) (*defangv1.Secrets, error) {
 	req := &defangv1.ListConfigsRequest{Project: projectName}
 	return provider.ListConfig(ctx, req)
 }
 
-func (DefaultToolCLI) Connect(ctx context.Context, cluster string) (*cliClient.GrpcClient, error) {
+func (DefaultToolCLI) Connect(ctx context.Context, cluster string) (*client.GrpcClient, error) {
 	return cli.Connect(ctx, cluster)
 }
 
-func (DefaultToolCLI) ComposeUp(ctx context.Context, client *cliClient.GrpcClient, provider cliClient.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
-	return cli.ComposeUp(ctx, client, provider, params)
+func (DefaultToolCLI) ComposeUp(ctx context.Context, fabric *client.GrpcClient, provider client.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
+	return cli.ComposeUp(ctx, fabric, provider, params)
 }
 
-func (DefaultToolCLI) Tail(ctx context.Context, provider cliClient.Provider, projectName string, options cli.TailOptions) error {
+func (DefaultToolCLI) Tail(ctx context.Context, provider client.Provider, projectName string, options cli.TailOptions) error {
 	return cli.Tail(ctx, provider, projectName, options)
 }
 
-func (DefaultToolCLI) ComposeDown(ctx context.Context, projectName string, client *cliClient.GrpcClient, provider cliClient.Provider) (string, error) {
-	return cli.ComposeDown(ctx, projectName, client, provider)
+func (DefaultToolCLI) ComposeDown(ctx context.Context, projectName string, fabric *client.GrpcClient, provider client.Provider) (string, error) {
+	return cli.ComposeDown(ctx, projectName, fabric, provider)
 }
 
-func (DefaultToolCLI) LoadProjectNameWithFallback(ctx context.Context, loader cliClient.Loader, provider cliClient.Provider) (string, error) {
-	return cliClient.LoadProjectNameWithFallback(ctx, loader, provider)
+func (DefaultToolCLI) LoadProjectNameWithFallback(ctx context.Context, loader client.Loader, provider client.Provider) (string, error) {
+	return client.LoadProjectNameWithFallback(ctx, loader, provider)
 }
 
-func (DefaultToolCLI) ConfigDelete(ctx context.Context, projectName string, provider cliClient.Provider, name string) error {
+func (DefaultToolCLI) ConfigDelete(ctx context.Context, projectName string, provider client.Provider, name string) error {
 	return cli.ConfigDelete(ctx, projectName, provider, name)
 }
 
-func (DefaultToolCLI) GetServices(ctx context.Context, projectName string, provider cliClient.Provider) ([]*cli.Service, error) {
+func (DefaultToolCLI) GetServices(ctx context.Context, projectName string, provider client.Provider) ([]*cli.Service, error) {
 	servicesResponse, err := cli.GetServices(ctx, projectName, provider)
 	if err != nil {
 		return nil, err
@@ -94,16 +94,16 @@ func (DefaultToolCLI) PrintEstimate(mode modes.Mode, estimate *defangv1.Estimate
 	return stdout.String()
 }
 
-func (DefaultToolCLI) LoadProject(ctx context.Context, loader cliClient.Loader) (*compose.Project, error) {
+func (DefaultToolCLI) LoadProject(ctx context.Context, loader client.Loader) (*compose.Project, error) {
 	return loader.LoadProject(ctx)
 }
 
-func (DefaultToolCLI) CreatePlaygroundProvider(client *cliClient.GrpcClient) cliClient.Provider {
-	return &cliClient.PlaygroundProvider{FabricClient: client}
+func (DefaultToolCLI) CreatePlaygroundProvider(fabric *client.GrpcClient) client.Provider {
+	return &client.PlaygroundProvider{FabricClient: fabric}
 }
 
-func (DefaultToolCLI) NewProvider(ctx context.Context, providerId cliClient.ProviderID, client cliClient.FabricClient, stack string) cliClient.Provider {
-	return cli.NewProvider(ctx, providerId, client, stack)
+func (DefaultToolCLI) NewProvider(ctx context.Context, providerId client.ProviderID, fabric client.FabricClient, stack string) client.Provider {
+	return cli.NewProvider(ctx, providerId, fabric, stack)
 }
 
 func (DefaultToolCLI) GenerateAuthURL(authPort int) string {
@@ -111,6 +111,6 @@ func (DefaultToolCLI) GenerateAuthURL(authPort int) string {
 	return "Please open this URL in your browser: http://127.0.0.1:" + strconv.Itoa(authPort) + " to login"
 }
 
-func (DefaultToolCLI) InteractiveLoginMCP(ctx context.Context, client *cliClient.GrpcClient, cluster string, mcpClient string) error {
-	return login.InteractiveLoginMCP(ctx, client, cluster, mcpClient)
+func (DefaultToolCLI) InteractiveLoginMCP(ctx context.Context, fabric *client.GrpcClient, cluster string, mcpClient string) error {
+	return login.InteractiveLoginMCP(ctx, fabric, cluster, mcpClient)
 }
diff --git a/src/pkg/agent/tools/deploy.go b/src/pkg/agent/tools/deploy.go
index 5518af254..5a2e03445 100644
--- a/src/pkg/agent/tools/deploy.go
+++ b/src/pkg/agent/tools/deploy.go
@@ -10,7 +10,6 @@ import (
 	"github.com/DefangLabs/defang/src/pkg/auth"
 	cliTypes "github.com/DefangLabs/defang/src/pkg/cli"
 	"github.com/DefangLabs/defang/src/pkg/cli/client"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/modes"
@@ -22,7 +21,7 @@ type DeployParams struct {
 	common.LoaderParams
 }
 
-func HandleDeployTool(ctx context.Context, loader cliClient.ProjectLoader, params DeployParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
+func HandleDeployTool(ctx context.Context, loader client.ProjectLoader, params DeployParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
 	term.Debug("Function invoked: loader.LoadProject")
 	project, err := cli.LoadProject(ctx, loader)
 	if err != nil {
diff --git a/src/pkg/agent/tools/deploy_test.go b/src/pkg/agent/tools/deploy_test.go
index d81fab71d..41af4fe67 100644
--- a/src/pkg/agent/tools/deploy_test.go
+++ b/src/pkg/agent/tools/deploy_test.go
@@ -56,7 +56,7 @@ func (m *MockDeployCLI) NewProvider(ctx context.Context, providerId client.Provi
 	return nil
 }
 
-func (m *MockDeployCLI) InteractiveLoginMCP(ctx context.Context, client *client.GrpcClient, cluster string, mcpClient string) error {
+func (m *MockDeployCLI) InteractiveLoginMCP(ctx context.Context, fabric *client.GrpcClient, cluster string, mcpClient string) error {
 	m.CallLog = append(m.CallLog, "InteractiveLoginMCP")
 	return m.InteractiveLoginMCPError
 }
@@ -77,7 +77,7 @@ func (m *MockDeployCLI) LoadProject(ctx context.Context, loader client.Loader) (
 	return m.Project, nil
 }
 
-func (m *MockDeployCLI) CanIUseProvider(ctx context.Context, client *client.GrpcClient, projectName, stackName string, provider client.Provider, serviceCount int) error {
+func (m *MockDeployCLI) CanIUseProvider(ctx context.Context, fabric *client.GrpcClient, projectName, stackName string, provider client.Provider, serviceCount int) error {
 	m.CallLog = append(m.CallLog, "CanIUseProvider")
 	return nil
 }
diff --git a/src/pkg/agent/tools/destroy.go b/src/pkg/agent/tools/destroy.go
index b0af31a84..c99ea6e23 100644
--- a/src/pkg/agent/tools/destroy.go
+++ b/src/pkg/agent/tools/destroy.go
@@ -6,7 +6,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -17,7 +17,7 @@ type DestroyParams struct {
 	common.LoaderParams
 }
 
-func HandleDestroyTool(ctx context.Context, loader cliClient.ProjectLoader, params DestroyParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
+func HandleDestroyTool(ctx context.Context, loader client.ProjectLoader, params DestroyParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
 	term.Debug("Function invoked: cli.Connect")
 	client, err := cli.Connect(ctx, config.Cluster)
 	if err != nil {
@@ -30,7 +30,7 @@ func HandleDestroyTool(ctx context.Context, loader cliClient.ProjectLoader, para
 	if err != nil {
 		return "", fmt.Errorf("failed to setup provider: %w", err)
 	}
-	term.Debug("Function invoked: cliClient.LoadProjectNameWithFallback")
+	term.Debug("Function invoked: cli.LoadProjectNameWithFallback")
 	projectName, err := cli.LoadProjectNameWithFallback(ctx, loader, provider)
 	if err != nil {
 		return "", fmt.Errorf("failed to load project name: %w", err)
diff --git a/src/pkg/agent/tools/estimate.go b/src/pkg/agent/tools/estimate.go
index 17bbad552..c735776a4 100644
--- a/src/pkg/agent/tools/estimate.go
+++ b/src/pkg/agent/tools/estimate.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/DefangLabs/defang/src/pkg/term"
 )
@@ -17,7 +17,7 @@ type EstimateParams struct {
 	Region         string `json:"region,omitempty" jsonschema:"description=The region in which to estimate costs."`
 }
 
-func HandleEstimateTool(ctx context.Context, loader cliClient.ProjectLoader, params EstimateParams, cli CLIInterface, sc StackConfig) (string, error) {
+func HandleEstimateTool(ctx context.Context, loader client.ProjectLoader, params EstimateParams, cli CLIInterface, sc StackConfig) (string, error) {
 	term.Debug("Function invoked: loader.LoadProject")
 	project, err := cli.LoadProject(ctx, loader)
 	if err != nil {
@@ -26,14 +26,14 @@ func HandleEstimateTool(ctx context.Context, loader cliClient.ProjectLoader, par
 	}
 
 	term.Debug("Function invoked: cli.Connect")
-	client, err := cli.Connect(ctx, sc.Cluster)
+	fabric, err := cli.Connect(ctx, sc.Cluster)
 	if err != nil {
 		return "", fmt.Errorf("could not connect: %w", err)
 	}
 
-	defangProvider := cli.CreatePlaygroundProvider(client)
+	defangProvider := cli.CreatePlaygroundProvider(fabric)
 
-	var providerID cliClient.ProviderID
+	var providerID client.ProviderID
 	err = providerID.Set(params.Provider)
 	if err != nil {
 		return "", err
@@ -46,7 +46,7 @@ func HandleEstimateTool(ctx context.Context, loader cliClient.ProjectLoader, par
 	}
 
 	term.Debug("Function invoked: cli.RunEstimate")
-	estimate, err := cli.RunEstimate(ctx, project, client, defangProvider, providerID, params.Region, deploymentMode)
+	estimate, err := cli.RunEstimate(ctx, project, fabric, defangProvider, providerID, params.Region, deploymentMode)
 	if err != nil {
 		return "", fmt.Errorf("failed to run estimate: %w", err)
 	}
diff --git a/src/pkg/agent/tools/interfaces.go b/src/pkg/agent/tools/interfaces.go
index 03ffa6bc5..75712ba30 100644
--- a/src/pkg/agent/tools/interfaces.go
+++ b/src/pkg/agent/tools/interfaces.go
@@ -5,28 +5,28 @@ import (
 	"context"
 
 	"github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 )
 
 type CLIInterface interface {
-	CanIUseProvider(ctx context.Context, client *cliClient.GrpcClient, projectName, stackName string, provider cliClient.Provider, serviceCount int) error
-	ComposeDown(ctx context.Context, projectName string, client *cliClient.GrpcClient, provider cliClient.Provider) (string, error)
-	ComposeUp(ctx context.Context, client *cliClient.GrpcClient, provider cliClient.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error)
-	ConfigDelete(ctx context.Context, projectName string, provider cliClient.Provider, name string) error
-	ConfigSet(ctx context.Context, projectName string, provider cliClient.Provider, name, value string) error
-	Connect(ctx context.Context, cluster string) (*cliClient.GrpcClient, error)
-	CreatePlaygroundProvider(client *cliClient.GrpcClient) cliClient.Provider
+	CanIUseProvider(ctx context.Context, fabric *client.GrpcClient, projectName, stackName string, provider client.Provider, serviceCount int) error
+	ComposeDown(ctx context.Context, projectName string, fabric *client.GrpcClient, provider client.Provider) (string, error)
+	ComposeUp(ctx context.Context, fabric *client.GrpcClient, provider client.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error)
+	ConfigDelete(ctx context.Context, projectName string, provider client.Provider, name string) error
+	ConfigSet(ctx context.Context, projectName string, provider client.Provider, name, value string) error
+	Connect(ctx context.Context, cluster string) (*client.GrpcClient, error)
+	CreatePlaygroundProvider(fabric *client.GrpcClient) client.Provider
 	GenerateAuthURL(authPort int) string
-	GetServices(ctx context.Context, projectName string, provider cliClient.Provider) ([]*cli.Service, error)
-	InteractiveLoginMCP(ctx context.Context, client *cliClient.GrpcClient, cluster string, mcpClient string) error
-	ListConfig(ctx context.Context, provider cliClient.Provider, projectName string) (*defangv1.Secrets, error)
-	LoadProject(ctx context.Context, loader cliClient.Loader) (*compose.Project, error)
-	LoadProjectNameWithFallback(ctx context.Context, loader cliClient.Loader, provider cliClient.Provider) (string, error)
-	NewProvider(ctx context.Context, providerId cliClient.ProviderID, client cliClient.FabricClient, stack string) cliClient.Provider
+	GetServices(ctx context.Context, projectName string, provider client.Provider) ([]*cli.Service, error)
+	InteractiveLoginMCP(ctx context.Context, fabric *client.GrpcClient, cluster string, mcpClient string) error
+	ListConfig(ctx context.Context, provider client.Provider, projectName string) (*defangv1.Secrets, error)
+	LoadProject(ctx context.Context, loader client.Loader) (*compose.Project, error)
+	LoadProjectNameWithFallback(ctx context.Context, loader client.Loader, provider client.Provider) (string, error)
+	NewProvider(ctx context.Context, providerId client.ProviderID, client client.FabricClient, stack string) client.Provider
 	PrintEstimate(mode modes.Mode, estimate *defangv1.EstimateResponse) string
-	RunEstimate(ctx context.Context, project *compose.Project, client *cliClient.GrpcClient, provider cliClient.Provider, providerId cliClient.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error)
-	Tail(ctx context.Context, provider cliClient.Provider, projectName string, options cli.TailOptions) error
+	RunEstimate(ctx context.Context, project *compose.Project, fabric *client.GrpcClient, provider client.Provider, providerId client.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error)
+	Tail(ctx context.Context, provider client.Provider, projectName string, options cli.TailOptions) error
 }
diff --git a/src/pkg/agent/tools/listConfig.go b/src/pkg/agent/tools/listConfig.go
index cd2688975..21f7dd9a8 100644
--- a/src/pkg/agent/tools/listConfig.go
+++ b/src/pkg/agent/tools/listConfig.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -17,7 +17,7 @@ type ListConfigParams struct {
 }
 
 // HandleListConfigTool handles the list config tool logic
-func HandleListConfigTool(ctx context.Context, loader cliClient.ProjectLoader, params ListConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
+func HandleListConfigTool(ctx context.Context, loader client.ProjectLoader, params ListConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
 	term.Debug("Function invoked: cli.Connect")
 	client, err := cli.Connect(ctx, sc.Cluster)
 	if err != nil {
@@ -30,7 +30,7 @@ func HandleListConfigTool(ctx context.Context, loader cliClient.ProjectLoader, p
 		return "", fmt.Errorf("failed to setup provider: %w", err)
 	}
 
-	term.Debug("Function invoked: cliClient.LoadProjectNameWithFallback")
+	term.Debug("Function invoked: cli.LoadProjectNameWithFallback")
 	projectName, err := cli.LoadProjectNameWithFallback(ctx, loader, provider)
 	if err != nil {
 		return "", fmt.Errorf("failed to load project name: %w", err)
diff --git a/src/pkg/agent/tools/logs.go b/src/pkg/agent/tools/logs.go
index 3640f5e72..17663b84d 100644
--- a/src/pkg/agent/tools/logs.go
+++ b/src/pkg/agent/tools/logs.go
@@ -7,7 +7,7 @@ import (
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
 	cliTypes "github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/logs"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
@@ -22,7 +22,7 @@ type LogsParams struct {
 	Until        string `json:"until,omitempty" jsonschema:"description=Optional: Retrieve logs written before this time. Format as RFC3339 or duration (e.g., '2023-10-01T15:04:05Z' or '1h')."`
 }
 
-func HandleLogsTool(ctx context.Context, loader cliClient.ProjectLoader, params LogsParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
+func HandleLogsTool(ctx context.Context, loader client.ProjectLoader, params LogsParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
 	var sinceTime, untilTime time.Time
 	var err error
 	now := time.Now()
diff --git a/src/pkg/agent/tools/provider.go b/src/pkg/agent/tools/provider.go
index c9f089649..68b5a5b1f 100644
--- a/src/pkg/agent/tools/provider.go
+++ b/src/pkg/agent/tools/provider.go
@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -14,17 +14,17 @@ import (
 const CreateNewStack = "Create new stack"
 
 type ProviderCreator interface {
-	NewProvider(ctx context.Context, providerId cliClient.ProviderID, client cliClient.FabricClient, stack string) cliClient.Provider
+	NewProvider(ctx context.Context, providerId client.ProviderID, client client.FabricClient, stack string) client.Provider
 }
 
 type providerPreparer struct {
 	pc ProviderCreator
 	ec elicitations.Controller
-	fc cliClient.FabricClient
+	fc client.FabricClient
 	sm stacks.Manager
 }
 
-func NewProviderPreparer(pc ProviderCreator, ec elicitations.Controller, fc cliClient.FabricClient, sm stacks.Manager) *providerPreparer {
+func NewProviderPreparer(pc ProviderCreator, ec elicitations.Controller, fc client.FabricClient, sm stacks.Manager) *providerPreparer {
 	return &providerPreparer{
 		pc: pc,
 		ec: ec,
@@ -33,8 +33,8 @@ func NewProviderPreparer(pc ProviderCreator, ec elicitations.Controller, fc cliC
 	}
 }
 
-func (pp *providerPreparer) SetupProvider(ctx context.Context, stack *stacks.StackParameters) (*cliClient.ProviderID, cliClient.Provider, error) {
-	var providerID cliClient.ProviderID
+func (pp *providerPreparer) SetupProvider(ctx context.Context, stack *stacks.StackParameters) (*client.ProviderID, client.Provider, error) {
+	var providerID client.ProviderID
 	var err error
 	if stack.Name == "" {
 		newStack, err := pp.setupStack(ctx)
diff --git a/src/pkg/agent/tools/removeConfig.go b/src/pkg/agent/tools/removeConfig.go
index 0d5e279b9..1b994603b 100644
--- a/src/pkg/agent/tools/removeConfig.go
+++ b/src/pkg/agent/tools/removeConfig.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -18,7 +18,7 @@ type RemoveConfigParams struct {
 }
 
 // HandleRemoveConfigTool handles the remove config tool logic
-func HandleRemoveConfigTool(ctx context.Context, loader cliClient.ProjectLoader, params RemoveConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
+func HandleRemoveConfigTool(ctx context.Context, loader client.ProjectLoader, params RemoveConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
 	term.Debug("Function invoked: cli.Connect")
 	client, err := cli.Connect(ctx, sc.Cluster)
 	if err != nil {
@@ -31,7 +31,7 @@ func HandleRemoveConfigTool(ctx context.Context, loader cliClient.ProjectLoader,
 	if err != nil {
 		return "", fmt.Errorf("failed to setup provider: %w", err)
 	}
-	term.Debug("Function invoked: cliClient.LoadProjectNameWithFallback")
+	term.Debug("Function invoked: cli.LoadProjectNameWithFallback")
 	projectName, err := cli.LoadProjectNameWithFallback(ctx, loader, provider)
 	if err != nil {
 		return "", fmt.Errorf("failed to load project name: %w", err)
diff --git a/src/pkg/agent/tools/services.go b/src/pkg/agent/tools/services.go
index 6c589db03..c99799bee 100644
--- a/src/pkg/agent/tools/services.go
+++ b/src/pkg/agent/tools/services.go
@@ -8,8 +8,8 @@ import (
 	"strings"
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	defangcli "github.com/DefangLabs/defang/src/pkg/cli"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	cliTypes "github.com/DefangLabs/defang/src/pkg/cli"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -20,7 +20,7 @@ type ServicesParams struct {
 	common.LoaderParams
 }
 
-func HandleServicesTool(ctx context.Context, loader cliClient.ProjectLoader, params ServicesParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
+func HandleServicesTool(ctx context.Context, loader client.ProjectLoader, params ServicesParams, cli CLIInterface, ec elicitations.Controller, config StackConfig) (string, error) {
 	term.Debug("Function invoked: cli.Connect")
 	client, err := cli.Connect(ctx, config.Cluster)
 	if err != nil {
@@ -44,7 +44,7 @@ func HandleServicesTool(ctx context.Context, loader cliClient.ProjectLoader, par
 
 	serviceResponse, err := cli.GetServices(ctx, projectName, provider)
 	if err != nil {
-		var noServicesErr defangcli.ErrNoServices
+		var noServicesErr cliTypes.ErrNoServices
 		if errors.As(err, &noServicesErr) {
 			return noServicesErr.Error(), nil
 		}
diff --git a/src/pkg/agent/tools/services_test.go b/src/pkg/agent/tools/services_test.go
index b19dfd7be..a6235bd05 100644
--- a/src/pkg/agent/tools/services_test.go
+++ b/src/pkg/agent/tools/services_test.go
@@ -66,11 +66,11 @@ func (m *MockCLI) GetServices(ctx context.Context, projectName string, provider
 	return m.MockServices, nil
 }
 
-func (m *MockCLI) ComposeDown(ctx context.Context, projectName string, client *client.GrpcClient, provider client.Provider) (string, error) {
+func (m *MockCLI) ComposeDown(ctx context.Context, projectName string, fabric *client.GrpcClient, provider client.Provider) (string, error) {
 	return "", nil
 }
 
-func (m *MockCLI) ComposeUp(ctx context.Context, client *client.GrpcClient, provider client.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
+func (m *MockCLI) ComposeUp(ctx context.Context, fabric *client.GrpcClient, provider client.Provider, params cli.ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
 	return nil, nil, nil
 }
 
@@ -82,7 +82,7 @@ func (m *MockCLI) ConfigSet(ctx context.Context, projectName string, provider cl
 	return nil
 }
 
-func (m *MockCLI) CreatePlaygroundProvider(client *client.GrpcClient) client.Provider {
+func (m *MockCLI) CreatePlaygroundProvider(fabric *client.GrpcClient) client.Provider {
 	return m.MockProvider
 }
 
@@ -90,7 +90,7 @@ func (m *MockCLI) GenerateAuthURL(authPort int) string {
 	return ""
 }
 
-func (m *MockCLI) InteractiveLoginMCP(ctx context.Context, client *client.GrpcClient, cluster string, mcpClient string) error {
+func (m *MockCLI) InteractiveLoginMCP(ctx context.Context, fabric *client.GrpcClient, cluster string, mcpClient string) error {
 	return nil
 }
 
@@ -106,7 +106,7 @@ func (m *MockCLI) PrintEstimate(mode modes.Mode, estimate *defangv1.EstimateResp
 	return ""
 }
 
-func (m *MockCLI) RunEstimate(ctx context.Context, project *compose.Project, client *client.GrpcClient, provider client.Provider, providerId client.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error) {
+func (m *MockCLI) RunEstimate(ctx context.Context, project *compose.Project, fabric *client.GrpcClient, provider client.Provider, providerId client.ProviderID, region string, mode modes.Mode) (*defangv1.EstimateResponse, error) {
 	return nil, nil
 }
 
diff --git a/src/pkg/agent/tools/setConfig.go b/src/pkg/agent/tools/setConfig.go
index 0ecc11764..f41971f2f 100644
--- a/src/pkg/agent/tools/setConfig.go
+++ b/src/pkg/agent/tools/setConfig.go
@@ -6,7 +6,7 @@ import (
 
 	"github.com/DefangLabs/defang/src/pkg"
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/stacks"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -18,7 +18,7 @@ type SetConfigParams struct {
 	Value string `json:"value" jsonschema:"required"`
 }
 
-func HandleSetConfig(ctx context.Context, loader cliClient.ProjectLoader, params SetConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
+func HandleSetConfig(ctx context.Context, loader client.ProjectLoader, params SetConfigParams, cli CLIInterface, ec elicitations.Controller, sc StackConfig) (string, error) {
 	term.Debug("Function invoked: cli.Connect")
 	client, err := cli.Connect(ctx, sc.Cluster)
 	if err != nil {
@@ -33,7 +33,7 @@ func HandleSetConfig(ctx context.Context, loader cliClient.ProjectLoader, params
 	}
 
 	if params.ProjectName == "" {
-		term.Debug("Function invoked: cliClient.LoadProjectNameWithFallback")
+		term.Debug("Function invoked: cli.LoadProjectNameWithFallback")
 		projectName, err := cli.LoadProjectNameWithFallback(ctx, loader, provider)
 		if err != nil {
 			return "", fmt.Errorf("failed to load project name: %w", err)
diff --git a/src/pkg/cluster/cluster.go b/src/pkg/cli/client/cluster.go
similarity index 68%
rename from src/pkg/cluster/cluster.go
rename to src/pkg/cli/client/cluster.go
index 1c940847e..f522510cf 100644
--- a/src/pkg/cluster/cluster.go
+++ b/src/pkg/cli/client/cluster.go
@@ -1,4 +1,4 @@
-package cluster
+package client
 
 import (
 	"fmt"
@@ -8,7 +8,6 @@ import (
 	"strings"
 
 	"github.com/DefangLabs/defang/src/pkg"
-	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 )
 
@@ -26,35 +25,35 @@ func NormalizeHost(cluster string) string {
 	return cluster
 }
 
-func tokenStorageName(fabric string) string {
+func tokenStorageName(cluster string) string {
 	// Token files are keyed by normalized host (no tenant prefix, no port) to avoid duplication.
-	if at := strings.LastIndex(fabric, "@"); at >= 0 && at < len(fabric)-1 {
-		fabric = fabric[at+1:] // drop legacy tenant prefix
+	if at := strings.LastIndex(cluster, "@"); at >= 0 && at < len(cluster)-1 {
+		cluster = cluster[at+1:] // drop legacy tenant prefix
 	}
-	host := NormalizeHost(fabric)
+	host := NormalizeHost(cluster)
 	if parsedHost, _, err := net.SplitHostPort(host); err == nil && parsedHost != "" {
 		host = parsedHost
 	}
 	return host
 }
 
-func GetTokenFile(fabric string) string {
-	return filepath.Join(client.StateDir, tokenStorageName(fabric))
+func GetTokenFile(cluster string) string {
+	return filepath.Join(StateDir, tokenStorageName(cluster))
 }
 
-func GetExistingToken(fabric string) string {
+func GetExistingToken(cluster string) string {
 	var accessToken = os.Getenv("DEFANG_ACCESS_TOKEN")
 
 	if accessToken != "" {
 		term.Debug("Using access token from env DEFANG_ACCESS_TOKEN")
 	} else {
-		tokenFile := GetTokenFile(fabric)
+		tokenFile := GetTokenFile(cluster)
 
 		term.Debug("Reading access token from file", tokenFile)
 		all, _ := os.ReadFile(tokenFile)
 		accessToken = string(all) // might be empty
 
-		if jwtPath, err := GetWebIdentityTokenFile(fabric); err == nil {
+		if jwtPath, err := GetWebIdentityTokenFile(cluster); err == nil {
 			if os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE") == "" {
 				term.Debugf("using web identity token from %s", jwtPath)
 				// Set AWS env vars for this CLI invocation
@@ -69,16 +68,16 @@ func GetExistingToken(fabric string) string {
 	return accessToken
 }
 
-func GetWebIdentityTokenFile(fabric string) (string, error) {
-	jwtPath := GetTokenFile(fabric) + ".jwt"
+func GetWebIdentityTokenFile(cluster string) (string, error) {
+	jwtPath := GetTokenFile(cluster) + ".jwt"
 	_, err := os.Stat(jwtPath)
 	return jwtPath, err
 }
 
-func SaveAccessToken(fabric, token string) error {
-	tokenFile := GetTokenFile(fabric)
+func SaveAccessToken(cluster, token string) error {
+	tokenFile := GetTokenFile(cluster)
 	term.Debug("Saving access token to", tokenFile)
-	os.MkdirAll(client.StateDir, 0700)
+	os.MkdirAll(StateDir, 0700)
 	if err := os.WriteFile(tokenFile, []byte(token), 0600); err != nil {
 		return fmt.Errorf("failed to save access token: %w", err)
 	}
diff --git a/src/pkg/cluster/cluster_test.go b/src/pkg/cli/client/cluster_test.go
similarity index 98%
rename from src/pkg/cluster/cluster_test.go
rename to src/pkg/cli/client/cluster_test.go
index 11a6c9b38..bce0fd3e1 100644
--- a/src/pkg/cluster/cluster_test.go
+++ b/src/pkg/cli/client/cluster_test.go
@@ -1,4 +1,4 @@
-package cluster
+package client
 
 import (
 	"os"
diff --git a/src/pkg/cli/composeUp.go b/src/pkg/cli/composeUp.go
index 4a31c8a0d..224a6cde7 100644
--- a/src/pkg/cli/composeUp.go
+++ b/src/pkg/cli/composeUp.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 
 	"github.com/DefangLabs/defang/src/pkg/cli/client"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/dryrun"
 	"github.com/DefangLabs/defang/src/pkg/modes"
@@ -30,7 +29,7 @@ type ComposeUpParams struct {
 }
 
 // ComposeUp validates a compose project and uploads the services using the client
-func ComposeUp(ctx context.Context, fabric client.FabricClient, provider cliClient.Provider, params ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
+func ComposeUp(ctx context.Context, fabric client.FabricClient, provider client.Provider, params ComposeUpParams) (*defangv1.DeployResponse, *compose.Project, error) {
 	upload := params.UploadMode
 	project := params.Project
 	mode := params.Mode
diff --git a/src/pkg/cli/configList_test.go b/src/pkg/cli/configList_test.go
index 858927e94..9c35ffa4d 100644
--- a/src/pkg/cli/configList_test.go
+++ b/src/pkg/cli/configList_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 	"github.com/DefangLabs/defang/src/protos/io/defang/v1/defangv1connect"
@@ -51,7 +51,7 @@ func TestConfigList(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	provider := cliClient.PlaygroundProvider{FabricClient: grpcClient}
+	provider := client.PlaygroundProvider{FabricClient: grpcClient}
 
 	t.Run("no configs", func(t *testing.T) {
 		stdout, _ := term.SetupTestTerm(t)
diff --git a/src/pkg/cli/connect.go b/src/pkg/cli/connect.go
index be5657a00..749386078 100644
--- a/src/pkg/cli/connect.go
+++ b/src/pkg/cli/connect.go
@@ -7,7 +7,6 @@ import (
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/aws"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/do"
 	"github.com/DefangLabs/defang/src/pkg/cli/client/byoc/gcp"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	"github.com/DefangLabs/defang/src/pkg/track"
 	"github.com/DefangLabs/defang/src/pkg/types"
@@ -21,8 +20,8 @@ func Connect(ctx context.Context, addr string) (*client.GrpcClient, error) {
 // ConnectWithTenant builds a client carrying the requested tenant (name or ID),
 // falling back to the token subject when unset so the server can resolve the personal tenant.
 func ConnectWithTenant(ctx context.Context, addr string, requestedTenant types.TenantNameOrID) (*client.GrpcClient, error) {
-	host := cluster.NormalizeHost(addr)
-	accessToken := cluster.GetExistingToken(host)
+	host := client.NormalizeHost(addr)
+	accessToken := client.GetExistingToken(host)
 	tokenTenant := TenantFromToken(accessToken)
 	effectiveTenant := requestedTenant
 	if !effectiveTenant.IsSet() {
diff --git a/src/pkg/cli/destroy_test.go b/src/pkg/cli/destroy_test.go
index 8c2e91851..0b3641d46 100644
--- a/src/pkg/cli/destroy_test.go
+++ b/src/pkg/cli/destroy_test.go
@@ -6,7 +6,7 @@ import (
 	"strings"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 	"github.com/DefangLabs/defang/src/protos/io/defang/v1/defangv1connect"
 	"github.com/bufbuild/connect-go"
@@ -54,7 +54,7 @@ func TestDestroy(t *testing.T) {
 	ctx := t.Context()
 	url := strings.TrimPrefix(server.URL, "http://")
 	grpcClient, _ := Connect(ctx, url)
-	client := cliClient.PlaygroundProvider{FabricClient: grpcClient}
+	client := client.PlaygroundProvider{FabricClient: grpcClient}
 
 	etag, err := client.Destroy(ctx, &defangv1.DestroyRequest{Project: "test-project"})
 	if err != nil {
diff --git a/src/pkg/cli/getServices_test.go b/src/pkg/cli/getServices_test.go
index f8846540c..af87c128a 100644
--- a/src/pkg/cli/getServices_test.go
+++ b/src/pkg/cli/getServices_test.go
@@ -8,7 +8,7 @@ import (
 	"testing"
 	"time"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 	"github.com/DefangLabs/defang/src/protos/io/defang/v1/defangv1connect"
@@ -68,7 +68,7 @@ func TestPrintServices(t *testing.T) {
 
 	url := strings.TrimPrefix(server.URL, "http://")
 	grpcClient, _ := Connect(ctx, url)
-	provider := cliClient.PlaygroundProvider{FabricClient: grpcClient}
+	provider := client.PlaygroundProvider{FabricClient: grpcClient}
 
 	t.Run("no services", func(t *testing.T) {
 		err := PrintServices(ctx, "empty", &provider, false)
diff --git a/src/pkg/cli/preview.go b/src/pkg/cli/preview.go
index 72a91fe10..d379aa916 100644
--- a/src/pkg/cli/preview.go
+++ b/src/pkg/cli/preview.go
@@ -3,12 +3,12 @@ package cli
 import (
 	"context"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/cli/compose"
 	"github.com/DefangLabs/defang/src/pkg/logs"
 )
 
-func Preview(ctx context.Context, project *compose.Project, fabric cliClient.FabricClient, provider cliClient.Provider, params ComposeUpParams) error {
+func Preview(ctx context.Context, project *compose.Project, fabric client.FabricClient, provider client.Provider, params ComposeUpParams) error {
 	resp, project, err := ComposeUp(ctx, fabric, provider, params)
 	if err != nil {
 		return err
diff --git a/src/pkg/cli/tail.go b/src/pkg/cli/tail.go
index 54b65df15..17a11c290 100644
--- a/src/pkg/cli/tail.go
+++ b/src/pkg/cli/tail.go
@@ -139,7 +139,7 @@ func Tail(ctx context.Context, provider client.Provider, projectName string, opt
 				case connect.CodeUnknown:
 					// Ignore unknown (nil) errors
 				default:
-					term.Warn(err) // TODO: use cliClient.PrettyError(…)
+					term.Warn(err) // TODO: use client.PrettyError(…)
 				}
 			}
 		}
diff --git a/src/pkg/cli/whoami_test.go b/src/pkg/cli/whoami_test.go
index 393734ae7..055bac20a 100644
--- a/src/pkg/cli/whoami_test.go
+++ b/src/pkg/cli/whoami_test.go
@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"github.com/DefangLabs/defang/src/pkg/auth"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/types"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 	"github.com/DefangLabs/defang/src/protos/io/defang/v1/defangv1connect"
@@ -39,7 +39,7 @@ func TestWhoami(t *testing.T) {
 	url := strings.TrimPrefix(server.URL, "http://")
 	const requestedTenant = "tenant-1"
 	grpcClient, _ := ConnectWithTenant(ctx, url, requestedTenant)
-	client := cliClient.PlaygroundProvider{FabricClient: grpcClient}
+	provider := client.PlaygroundProvider{FabricClient: grpcClient}
 
 	userInfo := &auth.UserInfo{
 		AllTenants: []auth.WorkspaceInfo{
@@ -51,13 +51,13 @@ func TestWhoami(t *testing.T) {
 		},
 	}
 
-	got, err := Whoami(ctx, grpcClient, &client, userInfo, types.TenantNameOrID(requestedTenant))
+	got, err := Whoami(ctx, grpcClient, &provider, userInfo, types.TenantNameOrID(requestedTenant))
 	if err != nil {
 		t.Fatal(err)
 	}
 
 	want := ShowAccountData{
-		Provider:       cliClient.ProviderDefang,
+		Provider:       client.ProviderDefang,
 		SubscriberTier: defangv1.SubscriptionTier_PRO,
 		Region:         "us-west-2",
 		Workspace:      "Tenant One",
diff --git a/src/pkg/login/login.go b/src/pkg/login/login.go
index f710c324e..d59837ecb 100644
--- a/src/pkg/login/login.go
+++ b/src/pkg/login/login.go
@@ -9,7 +9,6 @@ import (
 	"github.com/DefangLabs/defang/src/pkg/auth"
 	"github.com/DefangLabs/defang/src/pkg/cli"
 	"github.com/DefangLabs/defang/src/pkg/cli/client"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
 	"github.com/DefangLabs/defang/src/pkg/dryrun"
 	"github.com/DefangLabs/defang/src/pkg/github"
 	"github.com/DefangLabs/defang/src/pkg/term"
@@ -21,16 +20,16 @@ import (
 type LoginFlow = auth.LoginFlow
 
 type AuthService interface {
-	login(ctx context.Context, client client.FabricClient, fabric string, flow LoginFlow, mcpClient string) (string, error)
+	login(ctx context.Context, client client.FabricClient, cluster string, flow LoginFlow, mcpClient string) (string, error)
 }
 
 type OpenAuthService struct{}
 
-func (OpenAuthService) login(ctx context.Context, client client.FabricClient, fabric string, flow LoginFlow, mcpClient string) (string, error) {
-	term.Debug("Logging in to", fabric)
+func (OpenAuthService) login(ctx context.Context, fabric client.FabricClient, cluster string, flow LoginFlow, mcpClient string) (string, error) {
+	term.Debug("Logging in to", cluster)
 
 	code, err := auth.StartAuthCodeFlow(ctx, flow, func(token string) {
-		cluster.SaveAccessToken(fabric, token)
+		client.SaveAccessToken(cluster, token)
 	}, mcpClient)
 	if err != nil {
 		return "", err
@@ -41,25 +40,25 @@ func (OpenAuthService) login(ctx context.Context, client client.FabricClient, fa
 
 var authService AuthService = OpenAuthService{}
 
-func InteractiveLogin(ctx context.Context, client client.FabricClient, fabric string) error {
-	return interactiveLogin(ctx, client, fabric, auth.CliFlow, "CLI-Flow")
+func InteractiveLogin(ctx context.Context, fabric client.FabricClient, cluster string) error {
+	return interactiveLogin(ctx, fabric, cluster, auth.CliFlow, "CLI-Flow")
 }
 
-func InteractiveLoginMCP(ctx context.Context, client client.FabricClient, fabric string, mcpClient string) error {
-	return interactiveLogin(ctx, client, fabric, auth.McpFlow, mcpClient)
+func InteractiveLoginMCP(ctx context.Context, fabric client.FabricClient, cluster string, mcpClient string) error {
+	return interactiveLogin(ctx, fabric, cluster, auth.McpFlow, mcpClient)
 }
 
-func interactiveLogin(ctx context.Context, client client.FabricClient, fabric string, flow LoginFlow, mcpClient string) error {
-	token, err := authService.login(ctx, client, fabric, flow, mcpClient)
+func interactiveLogin(ctx context.Context, fabric client.FabricClient, cluster string, flow LoginFlow, mcpClient string) error {
+	token, err := authService.login(ctx, fabric, cluster, flow, mcpClient)
 	if err != nil {
 		return err
 	}
 
 	tenant := cli.TenantFromToken(token) // show the tenant implied by the freshly issued token
-	host := cluster.NormalizeHost(fabric)
+	host := client.NormalizeHost(cluster)
 	term.Info("Successfully logged in to", host, "("+tenant.String()+" tenant)")
 
-	if err := cluster.SaveAccessToken(fabric, token); err != nil {
+	if err := client.SaveAccessToken(cluster, token); err != nil {
 		term.Warn(err)
 		var pathError *os.PathError
 		if errors.As(err, &pathError) {
@@ -71,20 +70,20 @@ func interactiveLogin(ctx context.Context, client client.FabricClient, fabric st
 		return dryrun.ErrDryRun
 	}
 	// The new login page shows the ToS so a successful login implies the user agreed
-	if err := NonInteractiveAgreeToS(ctx, client); err != nil {
+	if err := NonInteractiveAgreeToS(ctx, fabric); err != nil {
 		term.Debug("unable to agree to terms:", err) // not fatal
 	}
 	return nil
 }
 
-func NonInteractiveGitHubLogin(ctx context.Context, client client.FabricClient, fabric string) error {
+func NonInteractiveGitHubLogin(ctx context.Context, fabric client.FabricClient, cluster string) error {
 	term.Debug("Non-interactive login using GitHub Actions id-token")
 	idToken, err := github.GetIdToken(ctx, "") // default audience (ie. https://github.com/ORG)
 	if err != nil {
 		return fmt.Errorf("non-interactive login failed: %w", err)
 	}
 	term.Debug("Got GitHub Actions id-token")
-	resp, err := client.Token(ctx, &defangv1.TokenRequest{
+	resp, err := fabric.Token(ctx, &defangv1.TokenRequest{
 		Assertion: idToken,
 		Scope:     []string{"admin", "read", "delete", "tail"},
 	})
@@ -92,13 +91,13 @@ func NonInteractiveGitHubLogin(ctx context.Context, client client.FabricClient,
 		return err
 	}
 
-	err = cluster.SaveAccessToken(fabric, resp.AccessToken) // creates the state folder too
+	err = client.SaveAccessToken(cluster, resp.AccessToken) // creates the state folder too
 
 	if roleArn := os.Getenv("AWS_ROLE_ARN"); roleArn != "" {
 		// If AWS_ROLE_ARN is set, we're doing "Assume Role with Web Identity"
 		if os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE") == "" {
 			// AWS_ROLE_ARN is set, but AWS_WEB_IDENTITY_TOKEN_FILE is empty: write the token to a new file
-			jwtPath, _ := cluster.GetWebIdentityTokenFile(fabric)
+			jwtPath, _ := client.GetWebIdentityTokenFile(cluster)
 			term.Debugf("writing web identity token to %s for role %s", jwtPath, roleArn)
 			if err := os.WriteFile(jwtPath, []byte(idToken), 0600); err != nil {
 				return fmt.Errorf("failed to save web identity token: %w", err)
diff --git a/src/pkg/login/login_test.go b/src/pkg/login/login_test.go
index 32df68cb2..0c06935e7 100644
--- a/src/pkg/login/login_test.go
+++ b/src/pkg/login/login_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/DefangLabs/defang/src/pkg/cli/client"
-	"github.com/DefangLabs/defang/src/pkg/cluster"
 	defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1"
 )
 
@@ -20,7 +19,7 @@ func TestGetExistingToken(t *testing.T) {
 		expectedToken := "env-token"
 		t.Setenv("DEFANG_ACCESS_TOKEN", expectedToken)
 
-		accessToken := cluster.GetExistingToken(fabric)
+		accessToken := client.GetExistingToken(fabric)
 		if accessToken != expectedToken {
 			t.Errorf("expected %s, got: %s", expectedToken, accessToken)
 		}
@@ -28,14 +27,14 @@ func TestGetExistingToken(t *testing.T) {
 
 	t.Run("Get access token from file", func(t *testing.T) {
 		expectedToken := "file-token"
-		tokenFile := cluster.GetTokenFile(fabric)
+		tokenFile := client.GetTokenFile(fabric)
 		os.WriteFile(tokenFile, []byte(expectedToken), 0600)
 
 		t.Cleanup(func() {
 			os.Remove(tokenFile)
 		})
 
-		accessToken := cluster.GetExistingToken(fabric)
+		accessToken := client.GetExistingToken(fabric)
 		if accessToken != expectedToken {
 			t.Errorf("expected %s, got: %s", expectedToken, accessToken)
 		}
@@ -47,7 +46,7 @@ type mockGitHubAuthService struct {
 	err         error
 }
 
-func (g mockGitHubAuthService) login(ctx context.Context, client client.FabricClient, fabric string, prompt LoginFlow, mcpClient string) (string, error) {
+func (g mockGitHubAuthService) login(ctx context.Context, client client.FabricClient, cluster string, prompt LoginFlow, mcpClient string) (string, error) {
 	return g.accessToken, g.err
 }
 
@@ -64,7 +63,7 @@ func TestInteractiveLogin(t *testing.T) {
 		client.StateDir = prevStateDir
 	})
 
-	tokenFile := cluster.GetTokenFile(fabric)
+	tokenFile := client.GetTokenFile(fabric)
 
 	t.Run("Expect accessToken to be stored when InteractiveLogin() succeeds", func(t *testing.T) {
 		authService = mockGitHubAuthService{accessToken: accessToken}
@@ -123,7 +122,7 @@ func TestNonInteractiveLogin(t *testing.T) {
 			t.Fatalf("expected no error, got %v", err)
 		}
 
-		tokenFile := cluster.GetTokenFile(fabric)
+		tokenFile := client.GetTokenFile(fabric)
 		savedToken, err := os.ReadFile(tokenFile)
 		if err != nil {
 			t.Fatalf("expected no error, got %v", err)
diff --git a/src/pkg/mcp/mcp_server.go b/src/pkg/mcp/mcp_server.go
index c8cd5f6ce..13076fef7 100644
--- a/src/pkg/mcp/mcp_server.go
+++ b/src/pkg/mcp/mcp_server.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/DefangLabs/defang/src/pkg/agent/common"
 	agentTools "github.com/DefangLabs/defang/src/pkg/agent/tools"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 	"github.com/DefangLabs/defang/src/pkg/mcp/resources"
 	"github.com/DefangLabs/defang/src/pkg/mcp/tools"
@@ -13,9 +14,6 @@ import (
 	"github.com/DefangLabs/defang/src/pkg/track"
 	"github.com/mark3labs/mcp-go/mcp"
 	"github.com/mark3labs/mcp-go/server"
-
-	// NewDefangMCPServer returns a new MCPServer instance with all resources, tools registered.
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
 )
 
 func prepareInstructions() string {
@@ -24,7 +22,7 @@ func prepareInstructions() string {
 }
 
 type ToolTracker struct {
-	providerId *cliClient.ProviderID
+	providerId *client.ProviderID
 	cluster    string
 	client     string
 }
@@ -47,6 +45,7 @@ func (t *ToolTracker) TrackTool(name string, handler server.ToolHandlerFunc) ser
 
 type StackConfig = tools.StackConfig
 
+// NewDefangMCPServer returns a new MCPServer instance with all resources, tools registered.
 func NewDefangMCPServer(version string, client MCPClient, cli agentTools.CLIInterface, config StackConfig) (*server.MCPServer, error) {
 	// Setup knowledge base
 	if err := SetupKnowledgeBase(); err != nil {
diff --git a/src/pkg/mcp/setup_test.go b/src/pkg/mcp/setup_test.go
index 0bb3f5477..b451a0c86 100644
--- a/src/pkg/mcp/setup_test.go
+++ b/src/pkg/mcp/setup_test.go
@@ -764,10 +764,6 @@ func TestWriteConfig(t *testing.T) {
 					t.Errorf("Expected error for %s but got none", client)
 				}
 				return // Don't continue with file comparison if we expected an error
-			} else {
-				if err != nil {
-					t.Fatalf("Unexpected error for %s: %v", client, err)
-				}
 			}
 
 			if err != nil {
diff --git a/src/pkg/stacks/stacks_test.go b/src/pkg/stacks/stacks_test.go
index caf2c60ab..87a95c258 100644
--- a/src/pkg/stacks/stacks_test.go
+++ b/src/pkg/stacks/stacks_test.go
@@ -5,20 +5,20 @@ import (
 	"path/filepath"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/modes"
 	"github.com/stretchr/testify/assert"
 )
 
 func TestMakeDefaultName(t *testing.T) {
 	tests := []struct {
-		provider cliClient.ProviderID
+		provider client.ProviderID
 		region   string
 		expected string
 	}{
-		{cliClient.ProviderAWS, "us-west-2", "awsuswest2"},
-		{cliClient.ProviderGCP, "us-central1", "gcpuscentral1"},
-		{cliClient.ProviderDO, "NYC3", "digitaloceannyc3"},
+		{client.ProviderAWS, "us-west-2", "awsuswest2"},
+		{client.ProviderGCP, "us-central1", "gcpuscentral1"},
+		{client.ProviderDO, "NYC3", "digitaloceannyc3"},
 	}
 
 	for _, tt := range tests {
@@ -45,7 +45,7 @@ func TestCreate(t *testing.T) {
 			name: "valid parameters",
 			parameters: StackParameters{
 				Name:     "teststack",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-2",
 				Mode:     modes.ModeAffordable,
 			},
@@ -56,7 +56,7 @@ func TestCreate(t *testing.T) {
 			name: "missing stack name",
 			parameters: StackParameters{
 				Name:     "",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-2",
 				Mode:     modes.ModeAffordable,
 			},
@@ -66,7 +66,7 @@ func TestCreate(t *testing.T) {
 			name: "name with whitespaces",
 			parameters: StackParameters{
 				Name:     "invalid stack",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-2",
 				Mode:     modes.ModeAffordable,
 			},
@@ -115,7 +115,7 @@ func TestRepeatCreate(t *testing.T) {
 	t.Chdir(t.TempDir())
 	params := StackParameters{
 		Name:     "repeattest",
-		Provider: cliClient.ProviderGCP,
+		Provider: client.ProviderGCP,
 		Region:   "us-central1",
 		Mode:     modes.ModeBalanced,
 	}
@@ -202,7 +202,7 @@ func TestMarshal(t *testing.T) {
 			name: "GCP provider",
 			params: StackParameters{
 				Name:     "teststack",
-				Provider: cliClient.ProviderGCP,
+				Provider: client.ProviderGCP,
 				Region:   "us-central1",
 				Mode:     modes.ModeBalanced,
 			},
@@ -212,7 +212,7 @@ func TestMarshal(t *testing.T) {
 			name: "AWS provider",
 			params: StackParameters{
 				Name:     "awsstack",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-east-1",
 				Mode:     modes.ModeAffordable,
 			},
@@ -222,7 +222,7 @@ func TestMarshal(t *testing.T) {
 			name: "Unspecified mode",
 			params: StackParameters{
 				Name:     "nomodestack",
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-west-1",
 				Mode:     modes.ModeUnspecified,
 			},
@@ -232,7 +232,7 @@ func TestMarshal(t *testing.T) {
 			name: "Empty region",
 			params: StackParameters{
 				Name:     "noregionstack",
-				Provider: cliClient.ProviderGCP,
+				Provider: client.ProviderGCP,
 				Region:   "",
 				Mode:     modes.ModeAffordable,
 			},
@@ -264,7 +264,7 @@ GCP_LOCATION=us-central1
 DEFANG_MODE=balanced
 `,
 			expectedParams: StackParameters{
-				Provider: cliClient.ProviderGCP,
+				Provider: client.ProviderGCP,
 				Region:   "us-central1",
 				Mode:     modes.ModeBalanced,
 			},
@@ -276,7 +276,7 @@ AWS_REGION=us-east-1
 DEFANG_MODE=affordable
 `,
 			expectedParams: StackParameters{
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "us-east-1",
 				Mode:     modes.ModeAffordable,
 			},
@@ -306,7 +306,7 @@ func TestRead(t *testing.T) {
 		stackName := "stacktoread"
 		expectedParams := StackParameters{
 			Name:     stackName,
-			Provider: cliClient.ProviderAWS,
+			Provider: client.ProviderAWS,
 			Region:   "us-west-2",
 			Mode:     modes.ModeAffordable,
 		}
@@ -337,7 +337,7 @@ func TestLoad(t *testing.T) {
 		stackName := "stacktoload"
 		expectedParams := StackParameters{
 			Name:     stackName,
-			Provider: cliClient.ProviderGCP,
+			Provider: client.ProviderGCP,
 			Region:   "us-central1",
 		}
 		_, err := Create(expectedParams)
@@ -362,7 +362,7 @@ func TestLoad(t *testing.T) {
 		stackName := "stacktoload"
 		stackParams := StackParameters{
 			Name:     stackName,
-			Provider: cliClient.ProviderGCP,
+			Provider: client.ProviderGCP,
 			Region:   "us-central1",
 		}
 		_, err := Create(stackParams)
diff --git a/src/pkg/stacks/wizard.go b/src/pkg/stacks/wizard.go
index b60472fb6..96dcd22a9 100644
--- a/src/pkg/stacks/wizard.go
+++ b/src/pkg/stacks/wizard.go
@@ -8,7 +8,7 @@ import (
 	"sort"
 	"strings"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/elicitations"
 )
 
@@ -36,9 +36,9 @@ func (w *Wizard) CollectParameters(ctx context.Context) (*StackParameters, error
 }
 
 func (w *Wizard) CollectRemainingParameters(ctx context.Context, params *StackParameters) (*StackParameters, error) {
-	if params.Provider == cliClient.ProviderAuto || params.Provider == "" {
+	if params.Provider == client.ProviderAuto || params.Provider == "" {
 		var providerNames []string
-		for _, p := range cliClient.AllProviders() {
+		for _, p := range client.AllProviders() {
 			providerNames = append(providerNames, p.Name())
 		}
 		providerName, err := w.ec.RequestEnum(
@@ -51,7 +51,7 @@ func (w *Wizard) CollectRemainingParameters(ctx context.Context, params *StackPa
 			return nil, fmt.Errorf("failed to elicit provider choice: %w", err)
 		}
 
-		var providerID cliClient.ProviderID
+		var providerID client.ProviderID
 		err = providerID.Set(providerName)
 		if err != nil {
 			return nil, err
@@ -59,10 +59,10 @@ func (w *Wizard) CollectRemainingParameters(ctx context.Context, params *StackPa
 		params.Provider = providerID
 	}
 
-	if params.Provider == cliClient.ProviderDefang {
+	if params.Provider == client.ProviderDefang {
 		params.Region = ""
 	} else if params.Region == "" {
-		defaultRegion := cliClient.GetRegion(params.Provider)
+		defaultRegion := client.GetRegion(params.Provider)
 		region, err := w.ec.RequestStringWithDefault(ctx, "Which region do you want to deploy to?", "region", defaultRegion)
 		if err != nil {
 			return nil, fmt.Errorf("failed to elicit region choice: %w", err)
@@ -81,7 +81,7 @@ func (w *Wizard) CollectRemainingParameters(ctx context.Context, params *StackPa
 	}
 
 	switch params.Provider {
-	case cliClient.ProviderAWS:
+	case client.ProviderAWS:
 		if params.AWSProfile == "" {
 			if os.Getenv("AWS_PROFILE") != "" {
 				profile, err := w.ec.RequestStringWithDefault(ctx, "Which AWS profile do you want to use?", "aws_profile", os.Getenv("AWS_PROFILE"))
@@ -106,7 +106,7 @@ func (w *Wizard) CollectRemainingParameters(ctx context.Context, params *StackPa
 				params.AWSProfile = profile
 			}
 		}
-	case cliClient.ProviderGCP:
+	case client.ProviderGCP:
 		if params.GCPProjectID == "" {
 			if os.Getenv("GCP_PROJECT_ID") != "" {
 				projectID, err := w.ec.RequestStringWithDefault(ctx, "Enter your GCP Project ID:", "gcp_project_id", os.Getenv("GCP_PROJECT_ID"))
diff --git a/src/pkg/stacks/wizard_test.go b/src/pkg/stacks/wizard_test.go
index 4e1effd4e..721cbfd63 100644
--- a/src/pkg/stacks/wizard_test.go
+++ b/src/pkg/stacks/wizard_test.go
@@ -6,7 +6,7 @@ import (
 	"os"
 	"testing"
 
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 )
 
 // mockElicitationsController is a mock implementation of elicitations.Controller
@@ -123,7 +123,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-east-1",
 				Name:       "awsuseast1",
 				AWSProfile: "test-profile",
@@ -149,7 +149,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-west-2",
 				Name:       "awsuswest2",
 				AWSProfile: "production",
@@ -177,7 +177,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "us-central1",
 				Name:         "gcpuscentral1",
 				GCPProjectID: "my-gcp-project",
@@ -203,7 +203,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "europe-west1",
 				Name:         "gcpeuropewest1",
 				GCPProjectID: "user-entered-project",
@@ -225,7 +225,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider: cliClient.ProviderDefang,
+				Provider: client.ProviderDefang,
 				Region:   "",
 				Name:     "defang",
 			},
@@ -245,7 +245,7 @@ func TestWizardCollectParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider: cliClient.ProviderDO,
+				Provider: client.ProviderDO,
 				Region:   "nyc3",
 				Name:     "digitaloceeannyc3",
 			},
@@ -480,7 +480,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-east-1",
 				Name:       "my-stack",
 				AWSProfile: "default",
@@ -489,7 +489,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Only region missing - AWS",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Name:     "my-stack",
 			},
 			setupMock: func(m *mockElicitationsController) {
@@ -501,7 +501,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-west-2",
 				Name:       "my-stack",
 				AWSProfile: "default",
@@ -510,7 +510,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Only stack name missing - GCP",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderGCP,
+				Provider: client.ProviderGCP,
 				Region:   "us-central1",
 			},
 			setupMock: func(m *mockElicitationsController) {
@@ -522,7 +522,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "us-central1",
 				Name:         "gcpuscentral1",
 				GCPProjectID: "my-project",
@@ -531,7 +531,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Only AWS profile missing - with AWS_PROFILE env",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 				Region:   "eu-west-1",
 				Name:     "my-aws-stack",
 			},
@@ -546,7 +546,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "eu-west-1",
 				Name:       "my-aws-stack",
 				AWSProfile: "production",
@@ -555,7 +555,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Only GCP project ID missing - with GCP_PROJECT_ID env",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderGCP,
+				Provider: client.ProviderGCP,
 				Region:   "europe-west1",
 				Name:     "my-gcp-stack",
 			},
@@ -570,7 +570,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "europe-west1",
 				Name:         "my-gcp-stack",
 				GCPProjectID: "env-project-123",
@@ -589,7 +589,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider: cliClient.ProviderDO,
+				Provider: client.ProviderDO,
 				Region:   "sfo3",
 				Name:     "do-stack",
 			},
@@ -607,7 +607,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider: cliClient.ProviderDefang,
+				Provider: client.ProviderDefang,
 				Region:   "",
 				Name:     "defang-playground",
 			},
@@ -615,7 +615,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Region and name missing - AWS",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderAWS,
+				Provider: client.ProviderAWS,
 			},
 			setupMock: func(m *mockElicitationsController) {
 				m.defaultResponses["region"] = "ap-southeast-1"
@@ -627,7 +627,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "ap-southeast-1",
 				Name:       "awsapsoutheast1",
 				AWSProfile: "staging",
@@ -636,7 +636,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "All parameters provided - AWS complete",
 			initialParams: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-west-1",
 				Name:       "complete-stack",
 				AWSProfile: "prod",
@@ -646,7 +646,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-west-1",
 				Name:       "complete-stack",
 				AWSProfile: "prod",
@@ -655,7 +655,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "All parameters provided - GCP complete",
 			initialParams: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "asia-east1",
 				Name:         "gcp-complete",
 				GCPProjectID: "my-complete-project",
@@ -665,7 +665,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "asia-east1",
 				Name:         "gcp-complete",
 				GCPProjectID: "my-complete-project",
@@ -674,7 +674,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 		{
 			name: "Defang provider with name - no region needed",
 			initialParams: &StackParameters{
-				Provider: cliClient.ProviderDefang,
+				Provider: client.ProviderDefang,
 				Name:     "my-defang-stack",
 			},
 			setupMock:   func(m *mockElicitationsController) {},
@@ -682,7 +682,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider: cliClient.ProviderDefang,
+				Provider: client.ProviderDefang,
 				Region:   "",
 				Name:     "my-defang-stack",
 			},
@@ -701,7 +701,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:   cliClient.ProviderAWS,
+				Provider:   client.ProviderAWS,
 				Region:     "us-east-1",
 				Name:       "awsuseast1",
 				AWSProfile: "default",
@@ -721,7 +721,7 @@ func TestWizardCollectRemainingParameters(t *testing.T) {
 			cleanupEnv:  func() {},
 			expectError: false,
 			expectedResult: &StackParameters{
-				Provider:     cliClient.ProviderGCP,
+				Provider:     client.ProviderGCP,
 				Region:       "us-central1",
 				Name:         "gcpuscentral1",
 				GCPProjectID: "my-gcp-project",
diff --git a/src/pkg/track/track.go b/src/pkg/track/track.go
index ea60eac79..3da23b161 100644
--- a/src/pkg/track/track.go
+++ b/src/pkg/track/track.go
@@ -5,7 +5,7 @@ import (
 	"sync"
 
 	"github.com/DefangLabs/defang/src/pkg"
-	cliClient "github.com/DefangLabs/defang/src/pkg/cli/client"
+	"github.com/DefangLabs/defang/src/pkg/cli/client"
 	"github.com/DefangLabs/defang/src/pkg/term"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -13,7 +13,7 @@ import (
 
 var disableAnalytics = pkg.GetenvBool("DEFANG_DISABLE_ANALYTICS")
 
-type Property = cliClient.Property
+type Property = client.Property
 
 // P creates a Property with the given name and value.
 func P(name string, value any) Property {