@kaelen-ai/cli 0.1.13 → 0.1.15

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import chalk11 from 'chalk';
+import chalk12 from 'chalk';
 import { writeFile, readFile, mkdtemp, rm, mkdir, stat, readdir } from 'fs/promises';
 import { join, resolve, dirname, relative, basename, extname, isAbsolute } from 'path';
 import * as acorn from 'acorn';
@@ -2387,19 +2387,26 @@ function analyzeTopLevel2(body) {
   const imports = [];
   const rootCalls = [];
   for (const stmt of body) {
-    if (stmt.type === "ExportNamedDeclaration" || stmt.type === "ExportDefaultDeclaration" || stmt.type === "ExportAllDeclaration") {
+    let candidate = stmt;
+    if (stmt.type === "ExportNamedDeclaration") {
+      const declaration = stmt.declaration;
+      if (!declaration) {
+        continue;
+      }
+      candidate = declaration;
+    } else if (stmt.type === "ExportDefaultDeclaration" || stmt.type === "ExportAllDeclaration") {
       continue;
     }
-    if (stmt.type === "ImportDeclaration") {
-      const specifiers = stmt.specifiers;
+    if (candidate.type === "ImportDeclaration") {
+      const specifiers = candidate.specifiers;
       if (specifiers.length === 0) {
         continue;
       }
       const info = {
         specifiers: [],
-        source: stmt.source.value,
-        start: stmt.start,
-        end: stmt.end
+        source: candidate.source.value,
+        start: candidate.start,
+        end: candidate.end
       };
       for (const spec of specifiers) {
         const local = spec.local.name;
@@ -2415,20 +2422,20 @@ function analyzeTopLevel2(body) {
       imports.push(info);
       continue;
     }
-    if (isRootTargetCall(stmt)) {
+    if (isRootTargetCall(candidate)) {
       rootCalls.push({
-        start: stmt.start,
-        end: stmt.end
+        start: candidate.start,
+        end: candidate.end
       });
       continue;
     }
     const names = /* @__PURE__ */ new Set();
-    if (stmt.type === "VariableDeclaration") {
-      for (const declaration of stmt.declarations) {
+    if (candidate.type === "VariableDeclaration") {
+      for (const declaration of candidate.declarations) {
         collectBindingNames2(declaration.id, names);
       }
-    } else if (stmt.type === "FunctionDeclaration" || stmt.type === "ClassDeclaration") {
-      const id = stmt.id;
+    } else if (candidate.type === "FunctionDeclaration" || candidate.type === "ClassDeclaration") {
+      const id = candidate.id;
       if (id?.type === "Identifier") {
         names.add(id.name);
       }
@@ -2438,7 +2445,7 @@ function analyzeTopLevel2(body) {
     if (names.size === 0) {
       continue;
     }
-    const refs = collectRefs2(stmt);
+    const refs = collectRefs2(candidate);
     for (const name of names) {
       refs.delete(name);
     }
@@ -2769,7 +2776,7 @@ async function buildCommand(options) {
     const config = await loadConfig({
       dir: options.dir
     });
-    console.log(chalk11.gray("Validating deployment..."));
+    console.log(chalk12.gray("Validating deployment..."));
     stagingDir = await createStagingDir();
     const { manifest } = await buildPipeline(
       config,
@@ -2799,10 +2806,10 @@ async function buildCommand(options) {
       `${subscriptions.length} subscription${subscriptions.length === 1 ? "" : "s"}`,
       `${secretBundles.length} secret bundle${secretBundles.length === 1 ? "" : "s"}`
     ];
-    console.log(chalk11.green(`\u2713 Build succeeded (${parts.join(", ")})`));
+    console.log(chalk12.green(`\u2713 Build succeeded (${parts.join(", ")})`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -2989,9 +2996,9 @@ function diffManifests(local, remote) {
   };
 }
 var SYMBOLS = {
-  added: chalk11.green("+ "),
-  changed: chalk11.yellow("~ "),
-  removed: chalk11.red("- ")
+  added: chalk12.green("+ "),
+  changed: chalk12.yellow("~ "),
+  removed: chalk12.red("- ")
 };
 var LABELS = {
   added: "new",
@@ -3013,11 +3020,11 @@ function formatPlan(diff) {
     const entries = diff[key];
     lines.push(`  ${label}:`);
     if (entries.length === 0) {
-      lines.push(chalk11.gray("    (no changes)"));
+      lines.push(chalk12.gray("    (no changes)"));
     } else {
       for (const e of entries) {
         lines.push(
-          `    ${SYMBOLS[e.kind]}${e.name}  ${chalk11.gray(`(${LABELS[e.kind]})`)}`
+          `    ${SYMBOLS[e.kind]}${e.name}  ${chalk12.gray(`(${LABELS[e.kind]})`)}`
         );
       }
     }
@@ -3471,6 +3478,82 @@ function createClient(config) {
     );
     return data.createProject;
   }
+  async function principals2(projectIdValue) {
+    const data = await graphql(
+      `
+        query Principals($projectId: ID!) {
+          principals(projectId: $projectId) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue }
+    );
+    return data.principals ?? [];
+  }
+  async function createPrincipal(projectIdValue, input) {
+    const data = await graphql(
+      `
+        mutation CreatePrincipal($projectId: ID!, $input: CreatePrincipalInput!) {
+          createPrincipal(projectId: $projectId, input: $input) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, input }
+    );
+    return data.createPrincipal;
+  }
+  async function updatePrincipal(projectIdValue, id, input) {
+    const data = await graphql(
+      `
+        mutation UpdatePrincipal($projectId: ID!, $id: ID!, $input: UpdatePrincipalInput!) {
+          updatePrincipal(projectId: $projectId, id: $id, input: $input) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, id, input }
+    );
+    return data.updatePrincipal ?? null;
+  }
+  async function deletePrincipal(projectIdValue, id) {
+    const data = await graphql(
+      `
+        mutation DeletePrincipal($projectId: ID!, $id: ID!) {
+          deletePrincipal(projectId: $projectId, id: $id) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, id }
+    );
+    return data.deletePrincipal ?? null;
+  }
   async function listSecrets(projectIdValue) {
     const data = await graphql(
       `
@@ -3591,6 +3674,9 @@ function createClient(config) {
   }
   async function emitSignal(input) {
     const projectIdValue = input.projectId ?? projectId();
+    if (!input.principalId || input.principalId.trim() === "") {
+      throw new ConfigError("principalId is required to emit a signal");
+    }
     const eventName = normalizeRuntimeSignalName2(input.signal);
     if (!eventName) {
       throw new ConfigError(
@@ -3618,6 +3704,7 @@ function createClient(config) {
       {
         input: {
           projectId: projectIdValue,
+          principalId: input.principalId,
           eventName,
           payloadJson: JSON.stringify(input.payload ?? {}),
           metadataJson: JSON.stringify(input.metadata ?? {}),
@@ -3694,6 +3781,10 @@ function createClient(config) {
     organizations,
     projects: projects2,
     createProject,
+    principals: principals2,
+    createPrincipal,
+    updatePrincipal,
+    deletePrincipal,
     listSecrets,
     putSecret,
     deleteSecret,
@@ -3712,7 +3803,7 @@ async function deployCommand(options) {
     const config = await loadConfig({
       dir: options.dir
     });
-    console.log(chalk11.gray("Planning deployment..."));
+    console.log(chalk12.gray("Planning deployment..."));
     stagingDir = await createStagingDir();
     const { manifest } = await buildPipeline(
       config,
@@ -3722,7 +3813,7 @@ async function deployCommand(options) {
     );
     if (!config.apiUrl || !config.projectId) {
       console.log(
-        chalk11.yellow(
+        chalk12.yellow(
           "\nNo apiUrl or projectId configured. Skipping upload."
         )
       );
@@ -3732,30 +3823,30 @@ async function deployCommand(options) {
       apiUrl: config.apiUrl,
       projectId: config.projectId
     });
-    console.log(chalk11.gray("\nComparing with remote..."));
+    console.log(chalk12.gray("\nComparing with remote..."));
     const remoteManifest = await client.fetchRemoteManifest(client.projectId());
     const diff = diffManifests(manifest, remoteManifest);
     if (!diff.hasChanges) {
-      console.log(chalk11.green("\n\u2713 No changes to deploy."));
+      console.log(chalk12.green("\n\u2713 No changes to deploy."));
       return;
     }
     console.log("\n" + formatPlan(diff));
     const confirmed = await confirmPlan(options.yes ?? false);
     if (!confirmed) {
-      console.log(chalk11.yellow("Deploy cancelled."));
+      console.log(chalk12.yellow("Deploy cancelled."));
       return;
     }
-    console.log(chalk11.gray("\nApplying deployment..."));
+    console.log(chalk12.gray("\nApplying deployment..."));
     const zipPath = join(stagingDir, "deploy.zip");
     await zipBuildOutput(stagingDir, zipPath);
     const revision = await client.deployBundle(zipPath, manifest);
     console.log(
-      chalk11.green(`
+      chalk12.green(`
 \u2713 Deployment complete (revision ${revision.revision}, ${revision.status})`)
     );
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -3866,7 +3957,7 @@ async function loginCommand(options) {
   try {
     if (options.token) {
       await saveToken(options.token, true);
-      console.log(chalk11.green("\u2713 API key saved"));
+      console.log(chalk12.green("\u2713 API key saved"));
       return;
     }
     const config = await loadConfig();
@@ -3877,7 +3968,7 @@ async function loginCommand(options) {
     }
     const existing = await loadToken();
     if (existing) {
-      console.log(chalk11.gray("Existing session found. Re-authenticating..."));
+      console.log(chalk12.gray("Existing session found. Re-authenticating..."));
     }
     const callbackServer = await startCallbackServer();
     const pkce = generatePkcePair();
@@ -3887,12 +3978,12 @@ async function loginCommand(options) {
       callbackServer.state,
       pkce.challenge
     );
-    console.log(chalk11.gray("Opening your browser for sign-in..."));
+    console.log(chalk12.gray("Opening your browser for sign-in..."));
     try {
       await open(authorizationUrl);
     } catch {
-      console.log(chalk11.yellow("Could not open the browser automatically."));
-      console.log(chalk11.gray(`Open this URL manually:
+      console.log(chalk12.yellow("Could not open the browser automatically."));
+      console.log(chalk12.gray(`Open this URL manually:
 ${authorizationUrl}`));
     }
     try {
@@ -3916,10 +4007,10 @@ ${authorizationUrl}`));
     } finally {
       callbackServer.close();
     }
-    console.log(chalk11.green("\n\u2713 Authenticated successfully"));
+    console.log(chalk12.green("\n\u2713 Authenticated successfully"));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -3929,10 +4020,10 @@ async function logoutCommand() {
   const creds = await loadCredentials();
   await clearToken();
   if (!creds) {
-    console.log(chalk11.yellow("Not logged in."));
+    console.log(chalk12.yellow("Not logged in."));
     return;
   }
-  console.log(chalk11.green("\u2713 Logged out"));
+  console.log(chalk12.green("\u2713 Logged out"));
 }
 async function hydrateIdentity() {
   const creds = await loadCredentials();
@@ -3976,26 +4067,26 @@ async function hydrateIdentity() {
 async function whoamiCommand() {
   const { creds, sessionName, sessionEmail } = await hydrateIdentity();
   if (!creds) {
-    console.log(chalk11.yellow("Not logged in. Run `io login` to authenticate."));
+    console.log(chalk12.yellow("Not logged in. Run `io login` to authenticate."));
     return;
   }
-  console.log(chalk11.green("\u2713 Logged in"));
+  console.log(chalk12.green("\u2713 Logged in"));
   const displayUser = sessionName ?? sessionEmail ?? creds.userId;
   if (displayUser) {
-    console.log(chalk11.gray(`  User:         ${displayUser}`));
+    console.log(chalk12.gray(`  User:         ${displayUser}`));
   }
   if (sessionEmail && sessionEmail !== displayUser) {
-    console.log(chalk11.gray(`  Email:        ${sessionEmail}`));
+    console.log(chalk12.gray(`  Email:        ${sessionEmail}`));
   }
   if (creds.organizationId) {
-    console.log(chalk11.gray(`  Organization: ${creds.organizationId}`));
+    console.log(chalk12.gray(`  Organization: ${creds.organizationId}`));
   }
   if (creds.apiKey) {
-    console.log(chalk11.gray("  Session:      API key"));
+    console.log(chalk12.gray("  Session:      API key"));
   } else if (creds.refreshToken) {
-    console.log(chalk11.gray("  Session:      refresh token stored"));
+    console.log(chalk12.gray("  Session:      refresh token stored"));
   } else {
-    console.log(chalk11.gray("  Session:      token only (no refresh)"));
+    console.log(chalk12.gray("  Session:      token only (no refresh)"));
   }
 }
 var CONFIG_FILE = "io.config.json";
@@ -4025,13 +4116,13 @@ async function selectOrganization(organizations, preferredId) {
   if (organizations.length === 1) {
     return organizations[0];
   }
-  console.log(chalk11.gray("\nAvailable organizations:"));
+  console.log(chalk12.gray("\nAvailable organizations:"));
   organizations.forEach((organization, index2) => {
     console.log(
-      `  ${chalk11.green(String(index2 + 1))}. ${organization.name}  ${chalk11.gray(organization.id)}`
+      `  ${chalk12.green(String(index2 + 1))}. ${organization.name}  ${chalk12.gray(organization.id)}`
     );
   });
-  const choice = await prompt(chalk11.gray("\nSelect an organization (number or ID): "));
+  const choice = await prompt(chalk12.gray("\nSelect an organization (number or ID): "));
   const index = Number(choice);
   if (index > 0 && index <= organizations.length) {
     return organizations[index - 1];
@@ -4044,16 +4135,16 @@ async function initCommand(options) {
     const existing = await readExistingConfig(cwd);
     if (existing.projectId && !options.yes) {
       const overwrite = await prompt(
-        chalk11.yellow(`io.config.json already has projectId "${existing.projectId}". Overwrite? (y/n) `)
+        chalk12.yellow(`io.config.json already has projectId "${existing.projectId}". Overwrite? (y/n) `)
       );
       if (overwrite.toLowerCase() !== "y") {
-        console.log(chalk11.gray("Cancelled."));
+        console.log(chalk12.gray("Cancelled."));
         return;
       }
     }
     const config = { ...existing };
     if (!config.apiUrl) {
-      const apiUrl = await prompt(chalk11.gray("API URL (leave blank for default): "));
+      const apiUrl = await prompt(chalk12.gray("API URL (leave blank for default): "));
       if (apiUrl) {
         config.apiUrl = apiUrl;
       }
@@ -4075,7 +4166,7 @@ async function initCommand(options) {
       try {
         organizations = await client.organizations();
       } catch {
-        console.log(chalk11.yellow("Could not fetch organizations. Enter project ID manually."));
+        console.log(chalk12.yellow("Could not fetch organizations. Enter project ID manually."));
       }
       const selectedOrganization = await selectOrganization(
         organizations,
@@ -4084,14 +4175,14 @@ async function initCommand(options) {
       if (selectedOrganization) {
         const projects2 = await client.projects(selectedOrganization.id);
         if (projects2.length > 0) {
-          console.log(chalk11.gray("\nAvailable projects:"));
+          console.log(chalk12.gray("\nAvailable projects:"));
           projects2.forEach((project, index2) => {
             console.log(
-              `  ${chalk11.green(String(index2 + 1))}. ${project.name}  ${chalk11.gray(project.id)}`
+              `  ${chalk12.green(String(index2 + 1))}. ${project.name}  ${chalk12.gray(project.id)}`
             );
           });
           const choice = await prompt(
-            chalk11.gray("\nSelect a project (number) or enter a project ID: ")
+            chalk12.gray("\nSelect a project (number) or enter a project ID: ")
           );
           const index = Number(choice);
           if (index > 0 && index <= projects2.length) {
@@ -4101,26 +4192,26 @@ async function initCommand(options) {
           }
         } else {
           const createNew = await prompt(
-            chalk11.gray("No projects found. Create one? (y/n) ")
+            chalk12.gray("No projects found. Create one? (y/n) ")
           );
           if (createNew.toLowerCase() === "y") {
-            const name = await prompt(chalk11.gray("Project name: "));
+            const name = await prompt(chalk12.gray("Project name: "));
             if (name) {
               const project = await client.createProject(selectedOrganization.id, name);
               config.projectId = project.id;
-              console.log(chalk11.green(`\u2713 Created project: ${project.name}`));
+              console.log(chalk12.green(`\u2713 Created project: ${project.name}`));
             }
           }
         }
       } else {
-        const projectId = await prompt(chalk11.gray("Project ID (or leave blank): "));
+        const projectId = await prompt(chalk12.gray("Project ID (or leave blank): "));
         if (projectId) {
           config.projectId = projectId;
         }
       }
     } else {
-      console.log(chalk11.yellow("Not logged in. Run `io login` first to select a project."));
-      const projectId = await prompt(chalk11.gray("Project ID (or leave blank): "));
+      console.log(chalk12.yellow("Not logged in. Run `io login` first to select a project."));
+      const projectId = await prompt(chalk12.gray("Project ID (or leave blank): "));
       if (projectId) {
         config.projectId = projectId;
       }
@@ -4130,14 +4221,14 @@ async function initCommand(options) {
       JSON.stringify(config, null, 2) + "\n",
       "utf-8"
     );
-    console.log(chalk11.green(`
+    console.log(chalk12.green(`
 \u2713 Wrote ${CONFIG_FILE}`));
     if (config.projectId) {
-      console.log(chalk11.gray(`  Project: ${config.projectId}`));
+      console.log(chalk12.gray(`  Project: ${config.projectId}`));
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4165,16 +4256,16 @@ async function projectsListCommand() {
     const organizationId = await resolveOrganizationId(client);
     const projects2 = await client.projects(organizationId);
     if (!projects2 || projects2.length === 0) {
-      console.log(chalk11.gray("No projects found. Create one with `io projects create <name>`."));
+      console.log(chalk12.gray("No projects found. Create one with `io projects create <name>`."));
       return;
     }
     for (const p of projects2) {
-      const current = p.id === config.projectId ? chalk11.green(" (current)") : "";
-      console.log(`  ${p.name}  ${chalk11.gray(p.id)}${current}`);
+      const current = p.id === config.projectId ? chalk12.green(" (current)") : "";
+      console.log(`  ${p.name}  ${chalk12.gray(p.id)}${current}`);
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4186,10 +4277,10 @@ async function projectsCreateCommand(name) {
     const client = createClient(config);
     const organizationId = await resolveOrganizationId(client);
     const project = await client.createProject(organizationId, name);
-    console.log(chalk11.green(`\u2713 Created project: ${project.name}`));
-    console.log(chalk11.gray(`  ID: ${project.id}`));
+    console.log(chalk12.green(`\u2713 Created project: ${project.name}`));
+    console.log(chalk12.gray(`  ID: ${project.id}`));
     console.log(
-      chalk11.gray(
+      chalk12.gray(
         `
   Add to io.config.json:
   { "projectId": "${project.id}" }`
@@ -4197,7 +4288,7 @@ async function projectsCreateCommand(name) {
     );
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4209,10 +4300,10 @@ async function secretsSetCommand(name, value) {
     const client = createClient(config);
     const pid = client.projectId();
     await client.putSecret(pid, { name, value });
-    console.log(chalk11.green(`\u2713 Set secret: ${name}`));
+    console.log(chalk12.green(`\u2713 Set secret: ${name}`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4224,16 +4315,16 @@ async function secretsListCommand() {
     const client = createClient(config);
     const secrets2 = await client.listSecrets(client.projectId());
     if (!secrets2 || secrets2.length === 0) {
-      console.log(chalk11.gray("No secrets configured."));
+      console.log(chalk12.gray("No secrets configured."));
       return;
     }
     for (const s of secrets2) {
-      const value = s.hasValue ? "" : chalk11.gray(" (no value)");
+      const value = s.hasValue ? "" : chalk12.gray(" (no value)");
       console.log(`  ${s.name}${value}`);
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4245,25 +4336,123 @@ async function secretsRemoveCommand(name) {
     const client = createClient(config);
     const removed = await client.deleteSecret(client.projectId(), name);
     if (!removed) {
-      console.log(chalk11.yellow(`Secret "${name}" not found.`));
+      console.log(chalk12.yellow(`Secret "${name}" not found.`));
       return;
     }
-    console.log(chalk11.green(`\u2713 Removed secret: ${name}`));
+    console.log(chalk12.green(`\u2713 Removed secret: ${name}`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
   }
 }
+function parseMetadata(input) {
+  if (!input) return void 0;
+  try {
+    const parsed = JSON.parse(input);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  throw new ConfigError("metadata must be a JSON object");
+}
+function validateState(state) {
+  if (!state) return void 0;
+  if (state === "active" || state === "inactive" || state === "archived") return state;
+  throw new ConfigError("state must be active, inactive, or archived");
+}
+async function withClient(options) {
+  const config = await loadConfig({ projectId: options.projectId });
+  const client = createClient(config);
+  return { client, projectId: client.projectId() };
+}
+function handleError(err) {
+  if (err instanceof CliError) {
+    console.error(chalk12.red(err.message));
+    process.exit(1);
+  }
+  throw err;
+}
+async function principalsListCommand(options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principals2 = await client.principals(projectId);
+    if (principals2.length === 0) {
+      console.log(chalk12.gray("No principals found. Create one with `io principals create <external-id>`."));
+      return;
+    }
+    for (const principal of principals2) {
+      console.log(
+        `  ${principal.externalId}  ${chalk12.gray(principal.id)}  ${chalk12.gray(principal.state)}`
+      );
+    }
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsCreateCommand(externalId, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principal = await client.createPrincipal(projectId, {
+      externalId,
+      state: validateState(options.state),
+      metadata: parseMetadata(options.metadata)
+    });
+    console.log(chalk12.green(`\u2713 Created principal: ${principal.externalId}`));
+    console.log(chalk12.gray(`  ID:      ${principal.id}`));
+    console.log(chalk12.gray(`  Project: ${principal.projectId}`));
+    console.log(chalk12.gray(`  State:   ${principal.state}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsUpdateCommand(id, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const input = {
+      externalId: options.externalId,
+      state: validateState(options.state),
+      metadata: parseMetadata(options.metadata)
+    };
+    if (!input.externalId && !input.state && !input.metadata) {
+      throw new ConfigError("nothing to update; pass --external-id, --state, or --metadata");
+    }
+    const principal = await client.updatePrincipal(projectId, id, input);
+    if (!principal) {
+      console.log(chalk12.yellow(`Principal "${id}" not found.`));
+      return;
+    }
+    console.log(chalk12.green(`\u2713 Updated principal: ${principal.externalId}`));
+    console.log(chalk12.gray(`  ID:      ${principal.id}`));
+    console.log(chalk12.gray(`  Project: ${principal.projectId}`));
+    console.log(chalk12.gray(`  State:   ${principal.state}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsDeleteCommand(id, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principal = await client.deletePrincipal(projectId, id);
+    if (!principal) {
+      console.log(chalk12.yellow(`Principal "${id}" not found.`));
+      return;
+    }
+    console.log(chalk12.green(`\u2713 Deleted principal: ${principal.externalId}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
 function meterBar(used, limit, width = 20) {
-  if (limit === 0) return chalk11.gray("\u2591".repeat(width));
+  if (limit === 0) return chalk12.gray("\u2591".repeat(width));
   const ratio = Math.min(used / limit, 1);
   const filled = Math.round(ratio * width);
   const empty = width - filled;
-  const color = ratio >= 0.9 ? chalk11.red : ratio >= 0.7 ? chalk11.yellow : chalk11.green;
-  return color("\u2588".repeat(filled)) + chalk11.gray("\u2591".repeat(empty));
+  const color = ratio >= 0.9 ? chalk12.red : ratio >= 0.7 ? chalk12.yellow : chalk12.green;
+  return color("\u2588".repeat(filled)) + chalk12.gray("\u2591".repeat(empty));
 }
 function formatNumber(n) {
   if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
@@ -4273,9 +4462,11 @@ function formatNumber(n) {
 var METER_LABELS = {
   events: "Events",
   ingest_tokens: "Ingest Tokens",
+  query_tokens: "Query Tokens",
   voice_seconds: "Voice Seconds",
   compute_gb_sec: "Compute (GB\xB7s)",
-  storage_gb: "Storage (GB)"
+  storage_gb: "Memory Storage (GB)",
+  artifact_storage_gb: "Artifact Storage (GB)"
 };
 async function quotaCommand() {
   try {
@@ -4283,22 +4474,22 @@ async function quotaCommand() {
     const client = createClient(config);
     const statuses = await client.quotaStatuses();
     if (statuses.length === 0) {
-      console.log(chalk11.gray("No quota data available."));
+      console.log(chalk12.gray("No quota data available."));
       return;
     }
-    console.log(chalk11.bold("\nQuota Usage\n"));
+    console.log(chalk12.bold("\nQuota Usage\n"));
     for (const status of statuses) {
       const label = METER_LABELS[status.meter] ?? status.meter;
       const bar = meterBar(status.used, status.limit);
       const pct = status.limit > 0 ? `${status.percentageUsed.toFixed(1)}%` : "\u2014";
       const usage = `${formatNumber(status.used)} / ${formatNumber(status.limit)}`;
-      const enforcement = status.enforcement === "hard_cap" ? chalk11.red("hard") : chalk11.yellow("soft");
-      console.log(`  ${label.padEnd(18)} ${bar}  ${usage.padStart(16)}  ${pct.padStart(6)}  ${enforcement}`);
+      const enforcement = status.enforcement === "hard_cap" ? chalk12.red("hard") : chalk12.yellow("soft");
+      console.log(`  ${label.padEnd(22)} ${bar}  ${usage.padStart(16)}  ${pct.padStart(6)}  ${enforcement}`);
     }
     console.log();
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4694,18 +4885,18 @@ function inferActivityPrincipalLabel(event) {
 
 // src/commands/logs.ts
 var LEVEL_COLORS = {
-  error: chalk11.red,
-  warning: chalk11.yellow,
-  info: chalk11.blue,
-  success: chalk11.green,
-  scheduled: chalk11.magenta
+  error: chalk12.red,
+  warning: chalk12.yellow,
+  info: chalk12.blue,
+  success: chalk12.green,
+  scheduled: chalk12.magenta
 };
 var FOLLOW_POLL_INTERVAL_MS = 2e3;
 var FOLLOW_SEEN_ID_LIMIT = 1e3;
 var FOLLOW_BATCH_LIMIT = 200;
 function colorLevel(level) {
-  if (!level) return chalk11.gray("\u2014");
-  const colorFn = LEVEL_COLORS[level] ?? chalk11.gray;
+  if (!level) return chalk12.gray("\u2014");
+  const colorFn = LEVEL_COLORS[level] ?? chalk12.gray;
   return colorFn(level.padEnd(7));
 }
 function pad(value, width) {
@@ -4718,8 +4909,8 @@ function formatTime(isoString) {
 }
 function formatDuration(ms) {
   if (ms == null) return "";
-  if (ms < 1e3) return chalk11.gray(`${ms}ms`);
-  return chalk11.gray(`${(ms / 1e3).toFixed(1)}s`);
+  if (ms < 1e3) return chalk12.gray(`${ms}ms`);
+  return chalk12.gray(`${(ms / 1e3).toFixed(1)}s`);
 }
 function truncate(value, width) {
   if (value.length <= width) return value;
@@ -4727,19 +4918,19 @@ function truncate(value, width) {
 }
 function formatHeader() {
   return [
-    `  ${chalk11.gray(pad("TIME", 10))}`,
-    chalk11.gray(pad("STATUS", 9)),
-    chalk11.gray(pad("CATEGORY", 14)),
-    chalk11.gray(pad("NAME", 24)),
-    chalk11.gray(pad("DURATION", 10)),
-    chalk11.gray("DETAIL")
+    `  ${chalk12.gray(pad("TIME", 10))}`,
+    chalk12.gray(pad("STATUS", 9)),
+    chalk12.gray(pad("CATEGORY", 14)),
+    chalk12.gray(pad("NAME", 24)),
+    chalk12.gray(pad("DURATION", 10)),
+    chalk12.gray("DETAIL")
   ].join("  ");
 }
 function formatEvent(event) {
-  const time = chalk11.gray(formatTime(event.occurredAt));
+  const time = chalk12.gray(formatTime(event.occurredAt));
   const statusKey = inferActivityEventStatus(event);
   const status = colorLevel(statusKey);
-  const category = chalk11.cyan(pad(inferActivityEventCategory(event), 14));
+  const category = chalk12.cyan(pad(inferActivityEventCategory(event), 14));
   const name = pad(truncate(inferActivityEventName(event), 24), 24);
   const duration = formatDuration(event.durationMs);
   const detail = inferActivityEventDetail(event) || inferActivityPrincipalLabel(event) || "";
@@ -4749,7 +4940,7 @@ function formatEvent(event) {
     category,
     name,
     pad(duration || "", 10),
-    detail ? chalk11.gray(detail) : ""
+    detail ? chalk12.gray(detail) : ""
   ].join("  ").trimEnd();
 }
 function latestOccurredAt(events, fallback) {
@@ -4811,7 +5002,7 @@ async function drainFollowEvents(client, projectId, input, since, seenIds, seenO
 }
 function installSigintHandler(onExit) {
   const handleSigint = () => {
-    console.log(chalk11.gray("\n  Disconnected."));
+    console.log(chalk12.gray("\n  Disconnected."));
     onExit();
     process.exit(0);
   };
@@ -4837,15 +5028,15 @@ async function logsCommand(options) {
     }
     const events = await client.projectEvents(pid, input);
     if (events.length === 0 && !options.follow) {
-      console.log(chalk11.gray("No events found."));
+      console.log(chalk12.gray("No events found."));
       return;
     }
     if (events.length > 0) {
-      console.log(chalk11.bold(`
+      console.log(chalk12.bold(`
 Activity Log \u2014 ${events.length} events
 `));
       console.log(formatHeader());
-      console.log(chalk11.gray(`  ${"\u2500".repeat(92)}`));
+      console.log(chalk12.gray(`  ${"\u2500".repeat(92)}`));
       for (const event of events) {
         console.log(formatEvent(event));
       }
@@ -4864,7 +5055,7 @@ Activity Log \u2014 ${events.length} events
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4875,7 +5066,7 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
   if (!creds || !creds.token) {
     throw new ConfigError("Not authenticated. Run `io login` first.");
   }
-  console.log(chalk11.gray("\n  Waiting for events... (Ctrl+C to stop)\n"));
+  console.log(chalk12.gray("\n  Waiting for events... (Ctrl+C to stop)\n"));
   if (creds.apiKey) {
     return new Promise((_resolve, reject) => {
       let disconnect;
@@ -4899,7 +5090,7 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
           trimSeenIds(seenIds2, seenOrder2);
         },
         onConnected: () => {
-          console.log(chalk11.green("  \u25CF Connected \u2014 tailing live events\n"));
+          console.log(chalk12.green("  \u25CF Connected \u2014 tailing live events\n"));
           void drainFollowEvents(
             client,
             projectId,
@@ -4912,7 +5103,7 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
               console.log(formatEvent(event));
             }
           }).catch((error) => {
-            console.error(chalk11.red(`
+            console.error(chalk12.red(`
   Connection error: ${error.message}`));
             removeSigintHandler2();
             disconnect?.();
@@ -4920,7 +5111,7 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
           });
         },
         onError: (error) => {
-          console.error(chalk11.red(`
+          console.error(chalk12.red(`
   Connection error: ${error.message}`));
           removeSigintHandler2();
           disconnect?.();
@@ -4930,7 +5121,7 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
     });
   }
   console.log(
-    chalk11.green("  \u25CF Connected \u2014 polling for live events with your authenticated session\n")
+    chalk12.green("  \u25CF Connected \u2014 polling for live events with your authenticated session\n")
   );
   const seenIds = new Set(initialEvents.map((event) => event.id));
   const seenOrder = initialEvents.map((event) => event.id);
@@ -4996,10 +5187,14 @@ async function signalEmitCommand(name, options) {
         "signal name must be a bare event name like smoke.start or use the signal: namespace"
       );
     }
+    if (!options.principalId || options.principalId.trim() === "") {
+      throw new ConfigError("signals emit requires --principal-id <id>");
+    }
     const payload = parseJsonObject(options.payload, "payload");
     const metadata = parseJsonObject(options.metadata, "metadata");
     const event = await client.emitSignal({
       signal,
+      principalId: options.principalId,
       payload,
       metadata,
       correlationId: options.correlationId,
@@ -5011,18 +5206,18 @@ async function signalEmitCommand(name, options) {
       console.log(JSON.stringify(event, null, 2));
       return;
     }
-    console.log(chalk11.green(`\u2713 Emitted ${event.name}`));
-    console.log(chalk11.gray(`  Event:    ${event.id}`));
-    console.log(chalk11.gray(`  Project:  ${event.projectId}`));
+    console.log(chalk12.green(`\u2713 Emitted ${event.name}`));
+    console.log(chalk12.gray(`  Event:    ${event.id}`));
+    console.log(chalk12.gray(`  Project:  ${event.projectId}`));
     if (event.dispatchStatus) {
-      console.log(chalk11.gray(`  Dispatch: ${event.dispatchStatus}`));
+      console.log(chalk12.gray(`  Dispatch: ${event.dispatchStatus}`));
     }
     if (event.occurredAt) {
-      console.log(chalk11.gray(`  At:       ${event.occurredAt}`));
+      console.log(chalk12.gray(`  At:       ${event.occurredAt}`));
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -5031,7 +5226,7 @@ async function signalEmitCommand(name, options) {
 
 // src/index.ts
 var program = new Command();
-program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.13");
+program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.15");
 program.command("init").description("Initialize io.config.json for the current project").option("--yes", "Overwrite existing config without prompting").action(initCommand);
 program.command("build").description("Build behaviors from the io/ directory").option("--dir <path>", "Source directory", "io").option("--minify", "Minify bundles", false).action(buildCommand);
 program.command("deploy").description("Build and package for deployment").option("--dir <path>", "Source directory", "io").option("--no-minify", "Skip minification").option("--yes", "Skip confirmation prompt").action(deployCommand);
@@ -5045,8 +5240,13 @@ var secrets = program.command("secrets").description("Manage project secrets");
 secrets.command("set <name> <value>").description("Set a secret value").option("--target <targets...>", "Restrict to specific targets").action(secretsSetCommand);
 secrets.command("list").description("List all secrets").action(secretsListCommand);
 secrets.command("remove <name>").description("Remove a secret").action(secretsRemoveCommand);
+var principals = program.command("principals").description("Manage project principals");
+principals.command("list").description("List principals in the active project").option("--project-id <id>", "Override the configured project ID").action(principalsListCommand);
+principals.command("create <external-id>").description("Create a principal in the active project").option("--project-id <id>", "Override the configured project ID").option("--state <state>", "Principal state: active, inactive, or archived").option("--metadata <json>", "Principal metadata as a JSON object").action(principalsCreateCommand);
+principals.command("update <id>").description("Update a principal").option("--project-id <id>", "Override the configured project ID").option("--external-id <external-id>", "Replace the external ID").option("--state <state>", "Principal state: active, inactive, or archived").option("--metadata <json>", "Replace principal metadata with a JSON object").action(principalsUpdateCommand);
+principals.command("delete <id>").description("Delete a principal").option("--project-id <id>", "Override the configured project ID").action(principalsDeleteCommand);
 var signals = program.command("signals").description("Emit runtime signals");
-signals.command("emit <name>").description("Emit a signal into the active project's event stream").option("--payload <json>", "Signal payload as a JSON object", "{}").option("--metadata <json>", "Signal metadata as a JSON object", "{}").option("--project-id <id>", "Override the configured project ID").option("--correlation-id <id>", "Correlation ID to attach to the signal").option("--causation-id <id>", "Causation ID to attach to the signal").option("--idempotency-key <key>", "Optional idempotency key").option("--source-name <name>", "Optional source name for the emitted signal").option("--json", "Print the raw emitted event as JSON", false).action(signalEmitCommand);
+signals.command("emit <name>").description("Emit a signal into the active project's event stream").option("--payload <json>", "Signal payload as a JSON object", "{}").option("--metadata <json>", "Signal metadata as a JSON object", "{}").option("--project-id <id>", "Override the configured project ID").requiredOption("--principal-id <id>", "Project principal ID for the emitted signal").option("--correlation-id <id>", "Correlation ID to attach to the signal").option("--causation-id <id>", "Causation ID to attach to the signal").option("--idempotency-key <key>", "Optional idempotency key").option("--source-name <name>", "Optional source name for the emitted signal").option("--json", "Print the raw emitted event as JSON", false).action(signalEmitCommand);
 program.command("quota").description("Show current quota usage for the active organization").action(quotaCommand);
 program.command("logs").description("Show recent activity events").option("--limit <count>", "Number of events to show", "50").option("--type <types...>", "Filter by event types").option("--since <duration>", "Show events since (e.g. 15m, 1h, 7d)").option("--follow", "Tail events in real-time").action(logsCommand);
 program.parse();