@kaelen-ai/cli 0.1.14 → 0.1.16

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import chalk11 from 'chalk';
+import chalk12 from 'chalk';
 import { writeFile, readFile, mkdtemp, rm, mkdir, stat, readdir } from 'fs/promises';
 import { join, resolve, dirname, relative, basename, extname, isAbsolute } from 'path';
 import * as acorn from 'acorn';
@@ -9,16 +9,16 @@ import { transform, build } from 'esbuild';
 import { spawn } from 'child_process';
 import { createRequire } from 'module';
 import { URL as URL$1, pathToFileURL } from 'url';
+import { randomBytes, createHash } from 'crypto';
 import { tmpdir, homedir } from 'os';
 import { createWriteStream } from 'fs';
 import archiver from 'archiver';
 import { createInterface } from 'readline';
-import open from 'open';
-import { createServer } from 'http';
-import { randomBytes, createHash } from 'crypto';
 import WebSocket from 'ws';
 import { Socket } from 'phoenix';
 import * as AbsintheSocket from '@absinthe/socket';
+import open from 'open';
+import { createServer } from 'http';
 
 // src/errors.ts
 var CliError = class extends Error {
@@ -159,7 +159,14 @@ function validChannelPattern(value) {
 
 // src/build/parser.ts
 var SDK_PACKAGES = /* @__PURE__ */ new Set(["@io/sdk", "@kaelen-ai/sdk", "@eleven-am/sdk"]);
-var EXECUTION_KEYS = /* @__PURE__ */ new Set(["memory", "timeout", "retries", "concurrency"]);
+var EXECUTION_KEYS = /* @__PURE__ */ new Set([
+  "memory",
+  "timeout",
+  "maxToolCalls",
+  "rateBudget",
+  "retries",
+  "concurrency"
+]);
 function loc(node, file) {
   const position = node.loc?.start;
   return {
@@ -311,7 +318,7 @@ function extractOnField(propValue, file, sdkImports) {
     loc(propValue, file)
   );
 }
-function extractExecutionConfig(properties) {
+function extractExecutionConfig(properties, file) {
   const config = {};
   for (const prop of properties) {
     if (prop.type === "SpreadElement") {
@@ -321,10 +328,7 @@ function extractExecutionConfig(properties) {
     if (!keyName || !EXECUTION_KEYS.has(keyName)) {
       continue;
     }
-    const value = prop.value;
-    if (value.type === "Literal") {
-      config[keyName] = value.value;
-    }
+    config[keyName] = extractStaticValue(prop.value, file);
   }
   return Object.keys(config).length > 0 ? config : void 0;
 }
@@ -364,7 +368,6 @@ function parseBehaviorCall(node, args, ancestors, file, out, sdkImports) {
   const properties = spec.properties;
   let onRaw;
   let hasRun = false;
-  let messageHistory;
   for (const prop of properties) {
     if (prop.type === "SpreadElement") {
       continue;
@@ -377,23 +380,6 @@ function parseBehaviorCall(node, args, ancestors, file, out, sdkImports) {
       onRaw = extractOnField(prop.value, file, sdkImports);
     } else if (keyName === "run") {
       hasRun = true;
-    } else if (keyName === "trackingId") {
-      const value = prop.value;
-      if (value.type !== "ArrowFunctionExpression" && value.type !== "FunctionExpression") {
-        throw new BuildError(
-          `behavior '${name}' trackingId must be a function in ${file}:${location.line}`,
-          location
-        );
-      }
-    } else if (keyName === "messageHistory") {
-      const value = prop.value;
-      if (value.type !== "Literal" || typeof value.value !== "number" || !Number.isInteger(value.value) || value.value <= 0) {
-        throw new BuildError(
-          `behavior '${name}' messageHistory must be a positive integer literal in ${file}:${location.line}`,
-          location
-        );
-      }
-      messageHistory = value.value;
     }
   }
   if (!onRaw) {
@@ -402,14 +388,13 @@ function parseBehaviorCall(node, args, ancestors, file, out, sdkImports) {
   if (!hasRun) {
     throw new BuildError(`behavior '${name}' is missing a run function`, location);
   }
-  const execution = extractExecutionConfig(properties);
+  const execution = extractExecutionConfig(properties, file);
   const bounds = findStatementBounds(ancestors);
   out.push({
     name,
     onRaw,
     on: "",
     execution,
-    messageHistory,
     location,
     statementStart: bounds.start,
     statementEnd: bounds.end
@@ -490,7 +475,7 @@ function parseConversationCall(node, args, ancestors, file, out) {
       location
     );
   }
-  const execution = extractExecutionConfig(properties);
+  const execution = extractExecutionConfig(properties, file);
   const bounds = findStatementBounds(ancestors);
   out.push({
     name,
@@ -565,11 +550,7 @@ var MEMORY_EVENT_MAP = {
   onTensionEmerged: "knowledge:tension.emerged",
   onTensionEscalated: "knowledge:tension.escalated",
   onTrajectoryDeteriorated: "knowledge:trajectory.deteriorated",
-  onRoutineBroken: "knowledge:routine.broken",
-  onContradiction: "knowledge:contradiction",
-  onDeadlinePassed: "knowledge:deadline_passed",
-  onIntentionExpired: "knowledge:intention_expired",
-  onTemporalDueSoon: "knowledge:temporal_due_soon"
+  onRoutineBroken: "knowledge:routine.broken"
 };
 function resolveAll(files) {
   const signalVarMap = /* @__PURE__ */ new Map();
@@ -854,6 +835,228 @@ function validateEndpointsSection(endpoints, errors) {
 var RESERVED_BUNDLE_PREFIX = "__kaelen.";
 var BINDING_SCOPES = /* @__PURE__ */ new Set(["project", "principal"]);
 var CREDENTIAL_SOURCES = /* @__PURE__ */ new Set(["none", "platform", "secret_bundle"]);
+var TARGET_EXECUTION_KEYS = /* @__PURE__ */ new Set([
+  "applications",
+  "endpoints",
+  "secret_names",
+  "timeout_ms",
+  "memory_mb",
+  "max_tool_calls",
+  "rate_budget"
+]);
+var SECRET_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "proxy-authenticate",
+  "www-authenticate",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-auth-token",
+  "x-access-token",
+  "x-secret",
+  "x-secret-key",
+  "x-amz-security-token"
+]);
+var HTTP_LIKE_KINDS = /* @__PURE__ */ new Set(["http", "graphql", "httpApi", "graphqlApi"]);
+var OP_RESOURCE_KINDS = /* @__PURE__ */ new Set(["httpApi", "graphqlApi"]);
+function countPlaceholders(format) {
+  let count = 0;
+  let idx = 0;
+  while ((idx = format.indexOf("{}", idx)) !== -1) {
+    count++;
+    idx += 2;
+  }
+  return count;
+}
+function validateStaticHeaders(owner, headers, errors) {
+  if (headers === void 0) return;
+  if (!isRecord2(headers)) {
+    errors.push(`${owner} headers must be an object`);
+    return;
+  }
+  for (const name of Object.keys(headers)) {
+    if (SECRET_HEADER_NAMES.has(name.toLowerCase())) {
+      errors.push(
+        `${owner} headers entry "${name}" is secret-bearing; declare it via credentialHeaders instead`
+      );
+    }
+  }
+}
+function validateCredentialHeadersBlock(owner, declared, errors, secretBundleNames, resourceSecretBundle, secretBundleSlots) {
+  if (declared === void 0) return;
+  if (!Array.isArray(declared)) {
+    errors.push(`${owner} credentialHeaders must be an array`);
+    return;
+  }
+  for (const entry of declared) {
+    if (!isRecord2(entry)) {
+      errors.push(`${owner} credentialHeaders entry must be an object`);
+      continue;
+    }
+    const name = stringField2(entry, "name");
+    if (!name) {
+      errors.push(`${owner} credentialHeaders entry is missing a string name`);
+      continue;
+    }
+    if (SECRET_HEADER_NAMES.has(name.toLowerCase())) ;
+    const source = entry.source;
+    if (!isRecord2(source)) {
+      errors.push(
+        `${owner} credentialHeaders "${name}" source must be an object`
+      );
+      continue;
+    }
+    const kind = stringField2(source, "kind");
+    if (kind === "credential") {
+      const field = stringField2(source, "field");
+      if (!field) {
+        errors.push(
+          `${owner} credentialHeaders "${name}" credential source missing field`
+        );
+        continue;
+      }
+      if (resourceSecretBundle === void 0) {
+        errors.push(
+          `${owner} credentialHeaders "${name}" uses credential source but resource declares no auth/secret_bundle`
+        );
+      } else if (!resourceSecretBundle.startsWith(RESERVED_BUNDLE_PREFIX)) {
+        const slots = secretBundleSlots.get(resourceSecretBundle);
+        if (slots && !slots.has(field)) {
+          errors.push(
+            `${owner} credentialHeaders "${name}" credential field "${field}" is not declared in secret bundle "${resourceSecretBundle}"`
+          );
+        }
+      }
+    } else if (kind === "rawSecret" || kind === "raw_secret") {
+      const secretName = stringField2(source, "name");
+      if (!secretName) {
+        errors.push(
+          `${owner} credentialHeaders "${name}" raw_secret source missing name`
+        );
+        continue;
+      }
+      if (!secretName.startsWith(RESERVED_BUNDLE_PREFIX) && !secretBundleNames.has(secretName)) {
+        errors.push(
+          `${owner} credentialHeaders "${name}" references unknown raw_secret "${secretName}"`
+        );
+      }
+    } else {
+      errors.push(
+        `${owner} credentialHeaders "${name}" source.kind must be credential or rawSecret`
+      );
+      continue;
+    }
+    const format = entry.format;
+    if (format !== void 0) {
+      if (typeof format !== "string" || countPlaceholders(format) !== 1) {
+        errors.push(
+          `${owner} credentialHeaders "${name}" format must contain exactly one {} placeholder`
+        );
+      }
+    }
+  }
+}
+function validateRequestMappingBlock(owner, declared, errors) {
+  if (declared === void 0) return;
+  if (!isRecord2(declared)) {
+    errors.push(`${owner} requestMapping must be an object`);
+    return;
+  }
+  for (const key of ["pathParams", "query"]) {
+    const value = declared[key];
+    if (value === void 0) continue;
+    if (!Array.isArray(value)) {
+      errors.push(`${owner} requestMapping.${key} must be an array`);
+      continue;
+    }
+    for (const entry of value) {
+      if (typeof entry === "string") {
+        if (!entry.trim()) {
+          errors.push(
+            `${owner} requestMapping.${key} entries must be non-empty strings or {from, as?} objects`
+          );
+        }
+        continue;
+      }
+      if (isRecord2(entry)) {
+        if (!stringField2(entry, "from")) {
+          errors.push(
+            `${owner} requestMapping.${key} entry.from must be a non-empty string`
+          );
+          continue;
+        }
+        if (entry.as !== void 0 && (typeof entry.as !== "string" || !entry.as.trim())) {
+          errors.push(
+            `${owner} requestMapping.${key} entry.as must be a non-empty string when provided`
+          );
+        }
+        continue;
+      }
+      errors.push(
+        `${owner} requestMapping.${key} entries must be strings or {from, as?} objects`
+      );
+    }
+  }
+  if (declared.body !== void 0 && typeof declared.body !== "string" && declared.body !== null) {
+    errors.push(`${owner} requestMapping.body must be a string or null`);
+  }
+}
+function validateHttpLikeConfig(appName, resourceName, resourceKind, config, secretBundleNames, resourceSecretBundle, secretBundleSlots, errors) {
+  if (!HTTP_LIKE_KINDS.has(resourceKind)) return;
+  if (!isRecord2(config)) return;
+  const base = `resource "${appName}/${resourceName}"`;
+  validateStaticHeaders(base, config.headers, errors);
+  validateCredentialHeadersBlock(
+    base,
+    config.credentialHeaders,
+    errors,
+    secretBundleNames,
+    resourceSecretBundle,
+    secretBundleSlots
+  );
+  if (resourceKind === "http") {
+    validateRequestMappingBlock(base, config.requestMapping, errors);
+  }
+  if (resourceKind === "graphql") {
+    if (config.variablesMapping !== void 0 && typeof config.variablesMapping !== "string") {
+      errors.push(`${base} variablesMapping must be a string`);
+    }
+  }
+  if (OP_RESOURCE_KINDS.has(resourceKind)) {
+    const ops = config.operations;
+    if (ops !== void 0 && !isRecord2(ops)) {
+      errors.push(`${base} operations must be an object`);
+      return;
+    }
+    if (isRecord2(ops)) {
+      for (const [opName, opSpec] of Object.entries(ops)) {
+        const owner = `${base} operation "${opName}"`;
+        if (!isRecord2(opSpec)) {
+          errors.push(`${owner} must be an object`);
+          continue;
+        }
+        validateStaticHeaders(owner, opSpec.headers, errors);
+        validateCredentialHeadersBlock(
+          owner,
+          opSpec.credentialHeaders,
+          errors,
+          secretBundleNames,
+          resourceSecretBundle,
+          secretBundleSlots
+        );
+        if (resourceKind === "httpApi") {
+          validateRequestMappingBlock(owner, opSpec.requestMapping, errors);
+        }
+        if (resourceKind === "graphqlApi") {
+          if (opSpec.variablesMapping !== void 0 && typeof opSpec.variablesMapping !== "string") {
+            errors.push(`${owner} variablesMapping must be a string`);
+          }
+        }
+      }
+    }
+  }
+}
 function isRecord2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -865,12 +1068,6 @@ function stringField2(record, key) {
   const value = record[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function scopeListField(record, key) {
-  const value = record[key];
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((entry) => scopeEntryName(entry) ?? []);
-}
 function scopeEntryName(entry) {
   if (typeof entry === "string" && entry.trim()) return entry;
   if (isRecord2(entry)) return stringField2(entry, "name");
@@ -916,6 +1113,11 @@ function validateTargetExecution(target, declaredApps, declaredEndpoints, errors
     return;
   }
   const executionRecord = isRecord2(execution) ? execution : {};
+  for (const key of Object.keys(executionRecord)) {
+    if (!TARGET_EXECUTION_KEYS.has(key)) {
+      errors.push(`${owner} execution contains unsupported key "${key}"`);
+    }
+  }
   const applicationRefs = validateScopeList(
     owner,
     "execution.applications",
@@ -938,31 +1140,60 @@ function validateTargetExecution(target, declaredApps, declaredEndpoints, errors
       errors.push(`${owner} references undeclared endpoint "${ref}"`);
     }
   }
-  for (const field of ["secret_names", "raw_secrets"]) {
-    const refs = validateScopeList(owner, `execution.${field}`, executionRecord[field], errors);
-    for (const ref of refs) {
-      if (ref.startsWith(RESERVED_BUNDLE_PREFIX)) {
-        errors.push(
-          `${owner} execution.${field} entry "${ref}" uses the reserved "${RESERVED_BUNDLE_PREFIX}" prefix`
-        );
-      }
+  const secretRefs = validateScopeList(
+    owner,
+    "execution.secret_names",
+    executionRecord.secret_names,
+    errors
+  );
+  for (const ref of secretRefs) {
+    if (ref.startsWith(RESERVED_BUNDLE_PREFIX)) {
+      errors.push(
+        `${owner} execution.secret_names entry "${ref}" uses the reserved "${RESERVED_BUNDLE_PREFIX}" prefix`
+      );
     }
   }
-  const legacyEndpointRefs = scopeListField(target, "endpoints");
-  if (target.endpoints !== void 0 && legacyEndpointRefs === void 0) {
-    errors.push(`${owner} endpoints must be an array of strings`);
-  } else if (target.endpoints !== void 0) {
-    if (endpointRefs.length === 0) {
-      errors.push(`${owner} must declare endpoint scope under execution.endpoints`);
-    }
-    for (const ref of legacyEndpointRefs ?? []) {
-      if (!declaredEndpoints.has(ref)) {
-        errors.push(`${owner} references undeclared endpoint "${ref}"`);
-      }
-      if (endpointRefs.length > 0 && !endpointRefs.includes(ref)) {
-        errors.push(`${owner} legacy endpoints entry "${ref}" is missing from execution.endpoints`);
-      }
+  validatePositiveInteger(owner, "execution.timeout_ms", executionRecord.timeout_ms, errors);
+  validatePositiveInteger(owner, "execution.memory_mb", executionRecord.memory_mb, errors);
+  validateNonNegativeInteger(owner, "execution.max_tool_calls", executionRecord.max_tool_calls, errors);
+  validateRateBudget(owner, executionRecord.rate_budget, errors);
+  if (target.endpoints !== void 0) {
+    errors.push(`${owner} endpoints is no longer supported; use execution.endpoints`);
+  }
+}
+function validateRateBudget(owner, value, errors) {
+  if (value === void 0) return;
+  if (!isRecord2(value)) {
+    errors.push(`${owner} execution.rate_budget must be an object`);
+    return;
+  }
+  validateBudgetMap(owner, "execution.rate_budget.per_application", value.per_application, errors);
+  validateBudgetMap(owner, "execution.rate_budget.per_capability", value.per_capability, errors);
+}
+function validateBudgetMap(owner, field, value, errors) {
+  if (value === void 0) return;
+  if (!isRecord2(value)) {
+    errors.push(`${owner} ${field} must be an object`);
+    return;
+  }
+  for (const [key, budget] of Object.entries(value)) {
+    if (!key.trim()) {
+      errors.push(`${owner} ${field} keys must be non-empty strings`);
+      continue;
     }
+    validateNonNegativeInteger(owner, `${field}.${key}`, budget, errors);
+  }
+}
+function validatePositiveInteger(owner, field, value, errors) {
+  if (value === void 0) return;
+  if (!Number.isInteger(value) || value <= 0) {
+    errors.push(`${owner} ${field} must be a positive integer`);
+  }
+}
+function validateNonNegativeInteger(owner, field, value, errors) {
+  if (value === void 0) return;
+  if (!Number.isInteger(value) || value < 0) {
+    errors.push(`${owner} ${field} must be a non-negative integer`);
   }
 }
 function capabilityId(applicationName, resourceName, toolName) {
@@ -1056,11 +1287,11 @@ function validateManifest(manifest) {
   const root = isRecord2(manifest) ? manifest : {};
   const errors = [];
   const seenCapabilities = /* @__PURE__ */ new Set();
-  if (root.contract_version !== "io.invocation.v1") {
-    errors.push("contract_version must be io.invocation.v1");
+  if (root.contract_version !== "io.invocation.v2") {
+    errors.push("contract_version must be io.invocation.v2");
   }
-  if (root.snapshot_version !== "io_runtime.snapshot.v1") {
-    errors.push("snapshot_version must be io_runtime.snapshot.v1");
+  if (root.snapshot_version !== "io_runtime.snapshot.v2") {
+    errors.push("snapshot_version must be io_runtime.snapshot.v2");
   }
   const secretBundles = arrayField(root, "secret_bundles").filter(isRecord2);
   duplicateNames(secretBundles, "secret bundle", errors);
@@ -1075,6 +1306,14 @@ function validateManifest(manifest) {
   const secretNames = new Set(
     secretBundles.map((entry) => stringField2(entry, "name")).filter((name) => !!name)
   );
+  const secretBundleSlots = /* @__PURE__ */ new Map();
+  for (const bundle of secretBundles) {
+    const bundleName = stringField2(bundle, "name");
+    if (!bundleName) continue;
+    const slots = bundle.slots;
+    if (!isRecord2(slots)) continue;
+    secretBundleSlots.set(bundleName, new Set(Object.keys(slots)));
+  }
   const declaredEndpoints = validateEndpointsSection(
     arrayField(root, "endpoints"),
     errors
@@ -1121,6 +1360,17 @@ function validateManifest(manifest) {
       } else {
         validateResourceCapability(appName, resourceName, capability, errors);
       }
+      const resourceKindForConfig = stringField2(resource, "kind") ?? "";
+      validateHttpLikeConfig(
+        appName,
+        resourceName,
+        resourceKindForConfig,
+        resource.config,
+        secretNames,
+        secretBundle,
+        secretBundleSlots,
+        errors
+      );
       const tools = toolEntries.filter(isRecord2);
       duplicateNames(tools, `resource "${appName}/${resourceName}" tool`, errors);
       for (const tool of tools) {
@@ -1588,6 +1838,12 @@ var RUNTIME_MEMORY_SIGNALS = {
   onTrajectoryDeteriorated: "knowledge:trajectory.deteriorated",
   onRoutineBroken: "knowledge:routine.broken"
 };
+var RUNTIME_SDK_PASSTHROUGH_EXPORTS = /* @__PURE__ */ new Set([
+  "google",
+  "microsoft",
+  "httpApi",
+  "graphqlApi"
+]);
 var RUNTIME_SDK_EXPORTS = /* @__PURE__ */ new Set([
   "ioSchema",
   "zodSchema",
@@ -1608,7 +1864,8 @@ var RUNTIME_SDK_EXPORTS = /* @__PURE__ */ new Set([
   "graphql",
   "http",
   "calendar",
-  "contacts"
+  "contacts",
+  ...RUNTIME_SDK_PASSTHROUGH_EXPORTS
 ]);
 var COMPILED_AWAY_EXPORTS = /* @__PURE__ */ new Set(["behavior", "conversation"]);
 function normalizeSdkSpecifier(specifier) {
@@ -1870,6 +2127,29 @@ ${entries.map(([key, value]) => `  ${key}: Object.freeze({ name: ${JSON.stringif
 }`
     );
   }
+  const needsPassthroughHelper = [...RUNTIME_SDK_PASSTHROUGH_EXPORTS].some(
+    (name) => usage.exports.has(name)
+  );
+  if (needsPassthroughHelper) {
+    lines.push(
+      `function passthroughFrozen(options) {
+  if (options && typeof options === "object" && !Array.isArray(options)) {
+    return Object.freeze({ ...options });
+  }
+  return Object.freeze({});
+}`
+    );
+    for (const passthrough of RUNTIME_SDK_PASSTHROUGH_EXPORTS) {
+      if (!usage.exports.has(passthrough)) {
+        continue;
+      }
+      lines.push(
+        `export function ${passthrough}(options) {
+  return passthroughFrozen(options);
+}`
+      );
+    }
+  }
   return lines.join("\n\n");
 }
 function sdkAliasPlugin() {
@@ -2208,65 +2488,514 @@ async function generateManifest(input) {
   );
   return m;
 }
-var INTERNAL_CONFIG = "__io_cli_compiled_config";
-var INTERNAL_RUN = "__io_cli_compiled_run";
-var INTERNAL_TRACKING_ID = "__io_cli_compiled_tracking_id";
-var INTERNAL_ON_START = "__io_cli_compiled_on_start";
-var INTERNAL_ON_MESSAGE = "__io_cli_compiled_on_message";
-var INTERNAL_ON_END = "__io_cli_compiled_on_end";
-var INTERNAL_APPLICATIONS = "__io_cli_compiled_applications";
-function conversationChannel(name) {
-  return `session:${name}`;
-}
-function parseModule2(source) {
-  return acorn.parse(source, {
-    ecmaVersion: "latest",
-    sourceType: "module"
-  });
+
+// src/build/stable-json.ts
+function stableStringify(value, indent) {
+  return JSON.stringify(canonicalize(value), null, indent);
 }
-function rootStatementFor(source, statementStart, kind, name) {
-  let ast;
-  try {
-    ast = parseModule2(source);
-  } catch (error) {
-    throw new BuildError(
-      `failed to parse compiled target source: ${error instanceof Error ? error.message : String(error)}`
-    );
+function canonicalize(value) {
+  if (value === null) return null;
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
   }
-  const body = ast.body;
-  const stmt = body.find(
-    (candidate) => candidate.start === statementStart
-  );
-  if (stmt) {
-    return stmt;
+  if (typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = canonicalize(obj[key]);
+    }
+    return sorted;
   }
-  const fallback = body.find((candidate) => {
-    if (candidate.type !== "ExpressionStatement") {
-      return false;
+  return value;
+}
+
+// src/build/catalog.ts
+var CATALOG_CONTRACT_VERSION = "io.invocation.v2";
+var CATALOG_SNAPSHOT_VERSION = "io_runtime.snapshot.v2";
+var WEBHOOK_RESOURCE_KIND = "webhook";
+var PLATFORM_TOOL_KINDS = /* @__PURE__ */ new Set(["email", "calendar", "contacts"]);
+var STREAM_PUBLISH_KINDS = /* @__PURE__ */ new Set([
+  "kafka",
+  "rabbitmq",
+  "redis",
+  "pubsub",
+  "sqs",
+  "websocket"
+]);
+function sha256Hex(value) {
+  return `sha256:${createHash("sha256").update(stableStringify(value)).digest("hex")}`;
+}
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function getString(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : void 0;
+}
+function getRecord(record, key) {
+  const value = record[key];
+  return isRecord3(value) ? value : void 0;
+}
+function getArray(record, key) {
+  const value = record[key];
+  return Array.isArray(value) ? value : [];
+}
+function getNumber(record, key) {
+  const value = record[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function countPlaceholders2(format) {
+  let count = 0;
+  let idx = 0;
+  while ((idx = format.indexOf("{}", idx)) !== -1) {
+    count++;
+    idx += 2;
+  }
+  return count;
+}
+function deriveAuditRequirement(effect) {
+  return effect === "write" ? "pre_call" : "finish_only";
+}
+function deriveEffect(toolMode) {
+  return toolMode === "read" ? "read" : "write";
+}
+function normalizeCredentialHeaders(declared, resourceId, context, warnings) {
+  if (!Array.isArray(declared)) return [];
+  const out = [];
+  for (const entry of declared) {
+    if (!isRecord3(entry)) {
+      warnings.push(`${context}: skipped non-object credential header entry`);
+      continue;
     }
-    const expression = candidate.expression;
-    if (expression.type !== "CallExpression") {
-      return false;
+    const name = getString(entry, "name");
+    if (!name) {
+      warnings.push(`${context}: credential header missing name`);
+      continue;
     }
-    const args = expression.arguments;
-    if (args.length < 2 || args[0]?.type !== "Literal" || args[1]?.type !== "ObjectExpression") {
-      return false;
+    const source = getRecord(entry, "source");
+    if (!source) {
+      warnings.push(`${context}: credential header "${name}" missing source`);
+      continue;
     }
-    const callee = expression.callee;
-    if (callee.type !== "Identifier") {
-      return false;
+    const sourceKind = getString(source, "kind");
+    let normalizedSource;
+    if (sourceKind === "credential") {
+      const field = getString(source, "field");
+      if (!field) {
+        warnings.push(
+          `${context}: credential header "${name}" credential source missing field`
+        );
+        continue;
+      }
+      normalizedSource = { kind: "credential", resource_id: resourceId, field };
+    } else if (sourceKind === "rawSecret" || sourceKind === "raw_secret") {
+      const secretName = getString(source, "name");
+      if (!secretName) {
+        warnings.push(
+          `${context}: credential header "${name}" raw_secret source missing name`
+        );
+        continue;
+      }
+      normalizedSource = { kind: "raw_secret", name: secretName };
+    } else {
+      warnings.push(
+        `${context}: credential header "${name}" has unsupported source kind "${sourceKind}"`
+      );
+      continue;
     }
-    return callee.name === kind && args[0].value === name;
-  });
-  if (!fallback) {
-    throw new BuildError(
-      `failed to locate compiled ${kind} root '${name}' at byte offset ${statementStart}`
-    );
+    const format = getString(entry, "format") ?? "{}";
+    if (countPlaceholders2(format) !== 1) {
+      warnings.push(
+        `${context}: credential header "${name}" format must contain exactly one {} placeholder`
+      );
+      continue;
+    }
+    out.push({ name, source: normalizedSource, format });
   }
-  return fallback;
+  return out;
 }
-function rootSpecNode(stmt) {
-  if (stmt.type !== "ExpressionStatement") {
+function normalizeRequestMapping(declared) {
+  if (!isRecord3(declared)) {
+    return { path_params: [], query: [] };
+  }
+  const pathParams = collectMappingValues(declared["pathParams"]);
+  const query = collectMappingValues(declared["query"]);
+  const body = declared["body"];
+  const bodyValue = typeof body === "string" ? body : body === null ? null : void 0;
+  return {
+    path_params: pathParams,
+    query,
+    ...bodyValue !== void 0 ? { body: bodyValue } : {}
+  };
+}
+function collectMappingValues(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const entry of value) {
+    if (typeof entry === "string" && entry.trim()) {
+      out.push(entry);
+    } else if (isRecord3(entry)) {
+      const from = getString(entry, "from");
+      if (!from?.trim()) continue;
+      const alias = getString(entry, "as");
+      out.push(alias?.trim() ? { from, as: alias } : from);
+    }
+  }
+  return out;
+}
+function buildExecutor(ctx) {
+  if (PLATFORM_TOOL_KINDS.has(ctx.resourceKind)) {
+    return {
+      kind: "platform_tool",
+      provider_kind: ctx.providerKind,
+      backend_kind: ctx.backendKind,
+      operation: ctx.toolName
+    };
+  }
+  if (ctx.resourceKind === WEBHOOK_RESOURCE_KIND && ctx.toolName === "respond") {
+    return { kind: "webhook_response" };
+  }
+  if (STREAM_PUBLISH_KINDS.has(ctx.resourceKind)) {
+    return {
+      kind: "stream_publish",
+      provider_kind: ctx.providerKind,
+      backend_kind: ctx.backendKind,
+      destination_ref: ctx.configHash
+    };
+  }
+  if (ctx.resourceKind === "http") {
+    return buildHttpRequestExecutor(ctx);
+  }
+  if (ctx.resourceKind === "graphql") {
+    return buildGraphQlRequestExecutor(ctx);
+  }
+  if (ctx.resourceKind === "httpApi") {
+    return buildHttpOperationExecutor(ctx);
+  }
+  if (ctx.resourceKind === "graphqlApi") {
+    return buildGraphQlOperationExecutor(ctx);
+  }
+  return {
+    kind: "unsupported",
+    reason: `unknown_resource_kind:${ctx.resourceKind}`
+  };
+}
+function buildHttpRequestExecutor(ctx) {
+  const config = ctx.resourceConfig;
+  const url = getString(config, "url") ?? "";
+  const method = (getString(config, "method") ?? "GET").toUpperCase();
+  const headers = getRecord(config, "headers") ?? {};
+  const queryParams = getRecord(config, "queryParams") ?? {};
+  const body = config["body"];
+  const credentialHeaders = normalizeCredentialHeaders(
+    config["credentialHeaders"],
+    ctx.resourceId,
+    `tool "${ctx.resourceId}.${ctx.toolName}"`,
+    ctx.warnings
+  );
+  return {
+    kind: "http_request",
+    url,
+    method,
+    headers_ref: ctx.registerBlob(headers),
+    credential_headers: credentialHeaders,
+    query_params_ref: ctx.registerBlob(queryParams),
+    body_ref: ctx.registerBlob(body ?? null),
+    timeout_seconds: getNumber(config, "timeoutSeconds") ?? null
+  };
+}
+function buildGraphQlRequestExecutor(ctx) {
+  const config = ctx.resourceConfig;
+  const endpoint = getString(config, "endpoint") ?? "";
+  const query = getString(config, "query") ?? "";
+  const headers = getRecord(config, "headers") ?? {};
+  const variables = getRecord(config, "variables") ?? {};
+  const operationName = getString(config, "operationName") ?? null;
+  const credentialHeaders = normalizeCredentialHeaders(
+    config["credentialHeaders"],
+    ctx.resourceId,
+    `tool "${ctx.resourceId}.${ctx.toolName}"`,
+    ctx.warnings
+  );
+  return {
+    kind: "graphql_request",
+    endpoint,
+    query_ref: ctx.registerBlob(query),
+    operation_name: operationName,
+    variables_ref: ctx.registerBlob(variables),
+    headers_ref: ctx.registerBlob(headers),
+    credential_headers: credentialHeaders,
+    timeout_seconds: getNumber(config, "timeoutSeconds") ?? null
+  };
+}
+function buildHttpOperationExecutor(ctx) {
+  const config = ctx.resourceConfig;
+  const ops = getRecord(config, "operations") ?? {};
+  const opSpec = getRecord(ops, ctx.toolName);
+  if (!opSpec) {
+    ctx.warnings.push(
+      `tool "${ctx.resourceId}.${ctx.toolName}" has no matching operation in resource config`
+    );
+    return {
+      kind: "unsupported",
+      reason: `httpApi_missing_op:${ctx.toolName}`
+    };
+  }
+  const baseUrl = getString(config, "baseUrl") ?? "";
+  const resourceHeaders = getRecord(config, "headers") ?? {};
+  const opHeaders = getRecord(opSpec, "headers") ?? {};
+  const mergedHeaders = { ...resourceHeaders, ...opHeaders };
+  const opCredentialHeaders = opSpec["credentialHeaders"];
+  const resourceCredentialHeaders = config["credentialHeaders"];
+  const credentialHeaders = normalizeCredentialHeaders(
+    opCredentialHeaders ?? resourceCredentialHeaders,
+    ctx.resourceId,
+    `tool "${ctx.resourceId}.${ctx.toolName}"`,
+    ctx.warnings
+  );
+  const method = (getString(opSpec, "method") ?? "GET").toUpperCase();
+  const path = getString(opSpec, "path") ?? "";
+  const timeoutSeconds = getNumber(opSpec, "timeoutSeconds") ?? getNumber(config, "timeoutSeconds") ?? null;
+  return {
+    kind: "http_operation",
+    base_url: baseUrl,
+    method,
+    path,
+    headers_ref: ctx.registerBlob(mergedHeaders),
+    credential_headers: credentialHeaders,
+    timeout_seconds: timeoutSeconds,
+    request_mapping: normalizeRequestMapping(opSpec["requestMapping"])
+  };
+}
+function buildGraphQlOperationExecutor(ctx) {
+  const config = ctx.resourceConfig;
+  const ops = getRecord(config, "operations") ?? {};
+  const opSpec = getRecord(ops, ctx.toolName);
+  if (!opSpec) {
+    ctx.warnings.push(
+      `tool "${ctx.resourceId}.${ctx.toolName}" has no matching operation in resource config`
+    );
+    return {
+      kind: "unsupported",
+      reason: `graphqlApi_missing_op:${ctx.toolName}`
+    };
+  }
+  const endpoint = getString(config, "endpoint") ?? "";
+  const resourceHeaders = getRecord(config, "headers") ?? {};
+  const opHeaders = getRecord(opSpec, "headers") ?? {};
+  const mergedHeaders = { ...resourceHeaders, ...opHeaders };
+  const opCredentialHeaders = opSpec["credentialHeaders"];
+  const resourceCredentialHeaders = config["credentialHeaders"];
+  const credentialHeaders = normalizeCredentialHeaders(
+    opCredentialHeaders ?? resourceCredentialHeaders,
+    ctx.resourceId,
+    `tool "${ctx.resourceId}.${ctx.toolName}"`,
+    ctx.warnings
+  );
+  const query = getString(opSpec, "query") ?? "";
+  const operationName = getString(opSpec, "operationName") ?? null;
+  const variablesMapping = getString(opSpec, "variablesMapping") ?? "input";
+  const timeoutSeconds = getNumber(opSpec, "timeoutSeconds") ?? getNumber(config, "timeoutSeconds") ?? null;
+  return {
+    kind: "graphql_operation",
+    endpoint,
+    query_ref: ctx.registerBlob(query),
+    operation_name: operationName,
+    headers_ref: ctx.registerBlob(mergedHeaders),
+    credential_headers: credentialHeaders,
+    timeout_seconds: timeoutSeconds,
+    variables_mapping: variablesMapping
+  };
+}
+function generateCatalog(manifest) {
+  const warnings = [];
+  const resources = {};
+  const signals2 = {};
+  const tools = {};
+  const schemas = {};
+  const registerBlob = (value) => {
+    const hash = sha256Hex(value ?? {});
+    if (!(hash in schemas)) {
+      schemas[hash] = value ?? {};
+    }
+    return hash;
+  };
+  const apps = getArray(manifest, "apps").filter(isRecord3);
+  for (const app of apps) {
+    const appName = getString(app, "name");
+    if (!appName) continue;
+    const appResources2 = getArray(app, "resources").filter(isRecord3);
+    for (const resource of appResources2) {
+      const resourceName = getString(resource, "name");
+      const resourceKind = getString(resource, "kind") ?? "";
+      const backend = getString(resource, "backend") ?? "";
+      const providerKind = getString(resource, "provider_kind") ?? resourceKind;
+      if (!resourceName) continue;
+      const resourceId = `${appName}.${resourceName}`;
+      const config = getRecord(resource, "config") ?? {};
+      const configHash = registerBlob(config);
+      const capability = getRecord(resource, "capability") ?? {};
+      const bindingScope = getString(capability, "binding_scope") ?? "project";
+      const credentialSource = getString(capability, "credential_source") ?? "none";
+      const requiresBindingValue = capability.requires_binding;
+      const credentialExposure = requiresBindingValue === true ? "stdlib" : "none";
+      const resourceSignals = getArray(resource, "signals").filter(isRecord3);
+      const resourceTools2 = getArray(resource, "tools").filter(isRecord3);
+      const emittedSignalIds = [];
+      for (const signal of resourceSignals) {
+        const signalName = getString(signal, "name");
+        if (!signalName) continue;
+        const signalId = `${resourceId}.${signalName}`;
+        const signalScope = getString(signal, "scope") === "principal" ? "principal" : "project";
+        const signalSchema = getRecord(signal, "schema") ?? {};
+        const schemaRef = registerBlob(signalSchema);
+        signals2[signalId] = {
+          id: signalId,
+          resource_id: resourceId,
+          name: signalName,
+          event_name: getString(signal, "event_name") ?? "",
+          scope: signalScope,
+          mode: getString(signal, "mode") ?? "",
+          schema_ref: schemaRef
+        };
+        emittedSignalIds.push(signalId);
+      }
+      const emittedToolIds = [];
+      for (const tool of resourceTools2) {
+        const toolName = getString(tool, "name");
+        if (!toolName) continue;
+        const toolId = `${resourceId}.${toolName}`;
+        const effect = deriveEffect(tool.mode);
+        const toolCapability = getRecord(tool, "capability") ?? {};
+        const toolBackendKind = getString(toolCapability, "backend_kind") ?? backend;
+        const toolProviderKind = getString(toolCapability, "provider_kind") ?? providerKind;
+        const toolCredentialExposure = getString(toolCapability, "credential_exposure") ?? "none";
+        const argsSchemaRef = registerBlob(
+          getRecord(tool, "args_schema") ?? {}
+        );
+        const resultSchemaRef = registerBlob(
+          getRecord(tool, "result_schema") ?? {}
+        );
+        const executor = buildExecutor({
+          resourceId,
+          resourceKind,
+          providerKind: toolProviderKind,
+          backendKind: toolBackendKind,
+          toolName,
+          resourceConfig: config,
+          configHash,
+          registerBlob,
+          warnings
+        });
+        if (executor.kind === "unsupported") {
+          warnings.push(
+            `tool "${toolId}" executor deferred: ${executor.reason}`
+          );
+        }
+        tools[toolId] = {
+          id: toolId,
+          resource_id: resourceId,
+          name: toolName,
+          effect,
+          audit_requirement: deriveAuditRequirement(effect),
+          credential_exposure: toolCredentialExposure,
+          args_schema_ref: argsSchemaRef,
+          result_schema_ref: resultSchemaRef,
+          executor
+        };
+        emittedToolIds.push(toolId);
+      }
+      resources[resourceId] = {
+        id: resourceId,
+        application_name: appName,
+        resource_name: resourceName,
+        resource_kind: resourceKind,
+        provider_kind: providerKind,
+        backend_kind: backend,
+        binding_scope: bindingScope,
+        credential_source: credentialSource,
+        credential_exposure: credentialExposure,
+        config_ref: configHash,
+        signals: emittedSignalIds,
+        tools: emittedToolIds
+      };
+    }
+  }
+  const catalogBody = {
+    contract_version: CATALOG_CONTRACT_VERSION,
+    snapshot_version: CATALOG_SNAPSHOT_VERSION,
+    resources,
+    signals: signals2,
+    tools,
+    schemas
+  };
+  const catalogHash = sha256Hex(catalogBody);
+  return {
+    catalog: {
+      ...catalogBody,
+      catalog_hash: catalogHash
+    },
+    warnings
+  };
+}
+var INTERNAL_CONFIG = "__io_cli_compiled_config";
+var INTERNAL_RUN = "__io_cli_compiled_run";
+var INTERNAL_ON_START = "__io_cli_compiled_on_start";
+var INTERNAL_ON_MESSAGE = "__io_cli_compiled_on_message";
+var INTERNAL_ON_END = "__io_cli_compiled_on_end";
+var INTERNAL_APPLICATIONS = "__io_cli_compiled_applications";
+function conversationChannel(name) {
+  return `session:${name}`;
+}
+function parseModule2(source) {
+  return acorn.parse(source, {
+    ecmaVersion: "latest",
+    sourceType: "module"
+  });
+}
+function rootStatementFor(source, statementStart, kind, name) {
+  let ast;
+  try {
+    ast = parseModule2(source);
+  } catch (error) {
+    throw new BuildError(
+      `failed to parse compiled target source: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const body = ast.body;
+  const stmt = body.find(
+    (candidate) => candidate.start === statementStart
+  );
+  if (stmt) {
+    return stmt;
+  }
+  const fallback = body.find((candidate) => {
+    if (candidate.type !== "ExpressionStatement") {
+      return false;
+    }
+    const expression = candidate.expression;
+    if (expression.type !== "CallExpression") {
+      return false;
+    }
+    const args = expression.arguments;
+    if (args.length < 2 || args[0]?.type !== "Literal" || args[1]?.type !== "ObjectExpression") {
+      return false;
+    }
+    const callee = expression.callee;
+    if (callee.type !== "Identifier") {
+      return false;
+    }
+    return callee.name === kind && args[0].value === name;
+  });
+  if (!fallback) {
+    throw new BuildError(
+      `failed to locate compiled ${kind} root '${name}' at byte offset ${statementStart}`
+    );
+  }
+  return fallback;
+}
+function rootSpecNode(stmt) {
+  if (stmt.type !== "ExpressionStatement") {
     throw new BuildError("compiled target root must be an expression statement");
   }
   const expression = stmt.expression;
@@ -2567,13 +3296,90 @@ function pruneUnusedTopLevel(source, seeds) {
   }
   return applyEdits2(source, edits);
 }
+function parseDurationMs(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "number") {
+    if (Number.isInteger(value) && value > 0) return value;
+    throw new BuildError("execution.timeout must be a positive integer number of milliseconds");
+  }
+  if (typeof value !== "string") {
+    throw new BuildError("execution.timeout must be a duration string or milliseconds");
+  }
+  const match = value.trim().toLowerCase().match(/^(\d+)\s*(ms|s|m|h)$/);
+  if (!match) {
+    throw new BuildError("execution.timeout must use ms, s, m, or h units");
+  }
+  const amount = Number(match[1]);
+  const unit = match[2];
+  const multiplier = unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : 36e5;
+  return amount * multiplier;
+}
+function parseMemoryMb(value) {
+  if (value === void 0) return void 0;
+  if (typeof value === "number") {
+    if (Number.isInteger(value) && value > 0) return value;
+    throw new BuildError("execution.memory must be a positive integer number of megabytes");
+  }
+  if (typeof value !== "string") {
+    throw new BuildError("execution.memory must be a size string or megabytes");
+  }
+  const match = value.trim().toLowerCase().match(/^(\d+)\s*(mb|m|gb|g)$/);
+  if (!match) {
+    throw new BuildError("execution.memory must use mb or gb units");
+  }
+  const amount = Number(match[1]);
+  const unit = match[2];
+  return unit === "gb" || unit === "g" ? amount * 1024 : amount;
+}
+function nonNegativeInteger(value, field) {
+  if (value === void 0) return void 0;
+  if (Number.isInteger(value) && value >= 0) return value;
+  throw new BuildError(`${field} must be a non-negative integer`);
+}
+function normalizeBudgetMap(value, field) {
+  if (value === void 0) return void 0;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new BuildError(`${field} must be an object`);
+  }
+  const out = {};
+  for (const [key, budget] of Object.entries(value)) {
+    if (!key.trim()) {
+      throw new BuildError(`${field} keys must be non-empty strings`);
+    }
+    out[key] = nonNegativeInteger(budget, `${field}.${key}`);
+  }
+  return out;
+}
+function normalizeRateBudget(rateBudget) {
+  if (rateBudget === void 0) return void 0;
+  const perApplication = normalizeBudgetMap(
+    rateBudget.perApplication,
+    "execution.rateBudget.perApplication"
+  );
+  const perCapability = normalizeBudgetMap(
+    rateBudget.perCapability,
+    "execution.rateBudget.perCapability"
+  );
+  const out = {
+    ...perApplication ? { per_application: perApplication } : {},
+    ...perCapability ? { per_capability: perCapability } : {}
+  };
+  return Object.keys(out).length > 0 ? out : void 0;
+}
 function compactExecution(execution) {
   if (!execution) {
     return void 0;
   }
-  const compact = Object.fromEntries(
-    Object.entries(execution).filter(([, value]) => value !== void 0)
-  );
+  const timeoutMs = parseDurationMs(execution.timeout);
+  const memoryMb = parseMemoryMb(execution.memory);
+  const maxToolCalls = nonNegativeInteger(execution.maxToolCalls, "execution.maxToolCalls");
+  const rateBudget = normalizeRateBudget(execution.rateBudget);
+  const compact = {
+    ...timeoutMs !== void 0 ? { timeout_ms: timeoutMs } : {},
+    ...memoryMb !== void 0 ? { memory_mb: memoryMb } : {},
+    ...maxToolCalls !== void 0 ? { max_tool_calls: maxToolCalls } : {},
+    ...rateBudget !== void 0 ? { rate_budget: rateBudget } : {}
+  };
   return Object.keys(compact).length > 0 ? compact : void 0;
 }
 function buildBehaviorReplacement(source, spec, behavior) {
@@ -2583,8 +3389,6 @@ function buildBehaviorReplacement(source, spec, behavior) {
   }
   const execution = compactExecution(behavior.execution);
   const runSource = functionSourceFromProperty(source, run, "run");
-  const trackingId = findProperty(spec, "trackingId");
-  const trackingIdSource = trackingId ? functionSourceFromProperty(source, trackingId, "trackingId") : void 0;
   const applications = findProperty(spec, "applications");
   const applicationsSource = applications ? expressionSourceFromProperty(source, applications, "applications") : void 0;
   const configEntries = [
@@ -2595,9 +3399,6 @@ function buildBehaviorReplacement(source, spec, behavior) {
   if (execution) {
     configEntries.push(`execution: ${JSON.stringify(execution)}`);
   }
-  if (behavior.messageHistory !== void 0) {
-    configEntries.push(`messageHistory: ${JSON.stringify(behavior.messageHistory)}`);
-  }
   if (applicationsSource) {
     configEntries.push(`applications: ${INTERNAL_APPLICATIONS}`);
   }
@@ -2606,17 +3407,14 @@ function buildBehaviorReplacement(source, spec, behavior) {
     replacement: [
       ...applicationsSource ? [`const ${INTERNAL_APPLICATIONS} = ${applicationsSource};`] : [],
       `const ${INTERNAL_CONFIG} = ${configSource};`,
-      `const ${INTERNAL_TRACKING_ID} = ${trackingIdSource ?? "undefined"};`,
       `const ${INTERNAL_RUN} = ${runSource};`,
-      `export { ${INTERNAL_CONFIG} as config, ${INTERNAL_TRACKING_ID} as trackingId, ${INTERNAL_RUN} as run };`
+      `export { ${INTERNAL_CONFIG} as config, ${INTERNAL_RUN} as run };`
     ].join("\n"),
     refs: /* @__PURE__ */ new Set([
       INTERNAL_CONFIG,
-      INTERNAL_TRACKING_ID,
       INTERNAL_RUN,
       ...applicationsSource ? [INTERNAL_APPLICATIONS] : [],
       ...refsFromExpressionSource(runSource),
-      ...trackingIdSource ? refsFromExpressionSource(trackingIdSource) : [],
       ...applicationsSource ? refsFromExpressionSource(applicationsSource) : []
     ])
   };
@@ -2756,7 +3554,15 @@ async function buildPipeline(config, cwd = process.cwd(), minify = false, buildD
     conversationBundles
   });
   validateManifest(manifest);
-  return { manifest, outDir };
+  const { catalog: catalog2, warnings } = generateCatalog(manifest);
+  if (warnings.length > 0) {
+    throw new BuildError(
+      `Catalog generation produced ${warnings.length} unrecoverable issue${warnings.length === 1 ? "" : "s"} \u2014 refusing to ship a partial catalog:
+${warnings.map((w) => `  - ${w}`).join("\n")}`
+    );
+  }
+  await writeFile(join(outDir, "catalog.json"), stableStringify(catalog2, 2), "utf-8");
+  return { manifest, catalog: catalog2, outDir };
 }
 async function createStagingDir() {
   return mkdtemp(join(tmpdir(), "io-cli-"));
@@ -2776,7 +3582,7 @@ async function buildCommand(options) {
     const config = await loadConfig({
       dir: options.dir
     });
-    console.log(chalk11.gray("Validating deployment..."));
+    console.log(chalk12.gray("Validating deployment..."));
     stagingDir = await createStagingDir();
     const { manifest } = await buildPipeline(
       config,
@@ -2806,10 +3612,10 @@ async function buildCommand(options) {
       `${subscriptions.length} subscription${subscriptions.length === 1 ? "" : "s"}`,
       `${secretBundles.length} secret bundle${secretBundles.length === 1 ? "" : "s"}`
     ];
-    console.log(chalk11.green(`\u2713 Build succeeded (${parts.join(", ")})`));
+    console.log(chalk12.green(`\u2713 Build succeeded (${parts.join(", ")})`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -2820,8 +3626,8 @@ async function buildCommand(options) {
 async function zipBuildOutput(buildDir, outPath) {
   const output = createWriteStream(outPath);
   const archive = archiver("zip", { zlib: { level: 9 } });
-  const done = new Promise((resolve4, reject) => {
-    output.on("close", resolve4);
+  const done = new Promise((resolve5, reject) => {
+    output.on("close", resolve5);
     archive.on("error", reject);
   });
   archive.pipe(output);
@@ -2850,13 +3656,13 @@ async function addDirectory(archive, baseDir, prefix, skipRelativePath) {
 }
 
 // src/deploy/diff.ts
-function stableStringify(value) {
+function stableStringify2(value) {
   if (Array.isArray(value)) {
-    return `[${value.map(stableStringify).join(",")}]`;
+    return `[${value.map(stableStringify2).join(",")}]`;
   }
   if (value && typeof value === "object") {
     const record = value;
-    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`).join(",")}}`;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify2(record[key])}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
@@ -2882,7 +3688,7 @@ function diffEntries(local, remote) {
   for (const { name, value } of local) {
     if (!remoteMap.has(name)) {
       entries.push({ name, kind: "added" });
-    } else if (stableStringify(value) !== stableStringify(remoteMap.get(name))) {
+    } else if (stableStringify2(value) !== stableStringify2(remoteMap.get(name))) {
       entries.push({ name, kind: "changed" });
     }
   }
@@ -2995,10 +3801,81 @@ function diffManifests(local, remote) {
     hasChanges
   };
 }
+
+// src/deploy/catalog-diff.ts
+function stableStringify3(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify3).join(",")}]`;
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify3(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function diffSection(local, remote) {
+  const localMap = local ?? {};
+  const remoteMap = remote ?? {};
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const id of Object.keys(localMap).sort()) {
+    seen.add(id);
+    if (!(id in remoteMap)) {
+      entries.push({ id, kind: "added" });
+    } else if (stableStringify3(localMap[id]) !== stableStringify3(remoteMap[id])) {
+      entries.push({ id, kind: "changed" });
+    }
+  }
+  for (const id of Object.keys(remoteMap).sort()) {
+    if (!seen.has(id) && !(id in localMap)) {
+      entries.push({ id, kind: "removed" });
+    }
+  }
+  return entries;
+}
+function schemaDiffCounts(local, remote) {
+  const localKeys = new Set(Object.keys(local ?? {}));
+  const remoteKeys = new Set(Object.keys(remote ?? {}));
+  let added = 0;
+  let removed = 0;
+  for (const k of localKeys) {
+    if (!remoteKeys.has(k)) added++;
+  }
+  for (const k of remoteKeys) {
+    if (!localKeys.has(k)) removed++;
+  }
+  return { added, removed };
+}
+function diffCatalogs(local, remote) {
+  const localResources = local?.resources ?? {};
+  const remoteResources = remote?.resources ?? {};
+  const localSignals = local?.signals ?? {};
+  const remoteSignals = remote?.signals ?? {};
+  const localTools = local?.tools ?? {};
+  const remoteTools = remote?.tools ?? {};
+  const localSchemas = local?.schemas ?? {};
+  const remoteSchemas = remote?.schemas ?? {};
+  const resources = diffSection(localResources, remoteResources);
+  const signals2 = diffSection(localSignals, remoteSignals);
+  const tools = diffSection(localTools, remoteTools);
+  const schemas = schemaDiffCounts(localSchemas, remoteSchemas);
+  const localHash = local?.catalog_hash ?? null;
+  const remoteHash = remote?.catalog_hash ?? null;
+  const hashChanged = (localHash ?? remoteHash) !== null && localHash !== remoteHash;
+  const hasChanges = resources.length > 0 || signals2.length > 0 || tools.length > 0 || schemas.added > 0 || schemas.removed > 0 || hashChanged;
+  return {
+    hashChanged,
+    resources,
+    signals: signals2,
+    tools,
+    schemas,
+    hasChanges
+  };
+}
 var SYMBOLS = {
-  added: chalk11.green("+ "),
-  changed: chalk11.yellow("~ "),
-  removed: chalk11.red("- ")
+  added: chalk12.green("+ "),
+  changed: chalk12.yellow("~ "),
+  removed: chalk12.red("- ")
 };
 var LABELS = {
   added: "new",
@@ -3014,30 +3891,64 @@ var SECTIONS = [
   { key: "targets", label: "Targets" },
   { key: "subscriptions", label: "Subscriptions" }
 ];
-function formatPlan(diff) {
+var CATALOG_SECTIONS = [
+  { key: "resources", label: "Catalog resources" },
+  { key: "signals", label: "Catalog signals" },
+  { key: "tools", label: "Catalog tools" }
+];
+function formatPlan(diff, catalogDiff) {
   const lines = [];
   for (const { key, label } of SECTIONS) {
     const entries = diff[key];
     lines.push(`  ${label}:`);
     if (entries.length === 0) {
-      lines.push(chalk11.gray("    (no changes)"));
+      lines.push(chalk12.gray("    (no changes)"));
     } else {
       for (const e of entries) {
         lines.push(
-          `    ${SYMBOLS[e.kind]}${e.name}  ${chalk11.gray(`(${LABELS[e.kind]})`)}`
+          `    ${SYMBOLS[e.kind]}${e.name}  ${chalk12.gray(`(${LABELS[e.kind]})`)}`
         );
       }
     }
   }
+  if (catalogDiff) {
+    lines.push("");
+    lines.push(
+      chalk12.bold(
+        catalogDiff.hashChanged ? "  Catalog (hash changed):" : "  Catalog:"
+      )
+    );
+    for (const { key, label } of CATALOG_SECTIONS) {
+      const entries = catalogDiff[key];
+      lines.push(`    ${label}:`);
+      if (entries.length === 0) {
+        lines.push(chalk12.gray("      (no changes)"));
+      } else {
+        for (const e of entries) {
+          lines.push(
+            `      ${SYMBOLS[e.kind]}${e.id}  ${chalk12.gray(`(${LABELS[e.kind]})`)}`
+          );
+        }
+      }
+    }
+    const schemaLine = catalogDiff.schemas;
+    if (schemaLine.added > 0 || schemaLine.removed > 0) {
+      lines.push(
+        `    ${chalk12.gray("Schemas:")} ${chalk12.green(`+${schemaLine.added}`)} ${chalk12.red(`-${schemaLine.removed}`)}`
+      );
+    } else {
+      lines.push(`    ${chalk12.gray("Schemas: (no changes)")}`);
+    }
+  }
   return lines.join("\n");
 }
 async function confirmPlan(skip) {
   if (skip) return true;
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question("\nApply these changes? (y/n) ", (answer) => {
       rl.close();
-      resolve4(answer.trim().toLowerCase() === "y");
+      resolve5(answer.trim().toLowerCase() === "y");
     });
   });
 }
@@ -3111,40 +4022,6 @@ function socketAuthParams(creds) {
   return { authorization: `Bearer ${creds.token}` };
 }
 
-// src/build/stable-json.ts
-function stableStringify2(value, indent) {
-  return JSON.stringify(canonicalize(value), null, indent);
-}
-function canonicalize(value) {
-  if (value === null) return null;
-  if (Array.isArray(value)) {
-    return value.map(canonicalize);
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    const sorted = {};
-    for (const key of Object.keys(obj).sort()) {
-      sorted[key] = canonicalize(obj[key]);
-    }
-    return sorted;
-  }
-  return value;
-}
-
-// src/runtime-signal-name.ts
-var EVENT_NAME_REGEX2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-var SIGNAL_NAME_REGEX = /^signal:[A-Za-z0-9][A-Za-z0-9._-]*$/;
-function normalizeRuntimeSignalName2(value) {
-  const trimmed = value.trim();
-  if (EVENT_NAME_REGEX2.test(trimmed)) {
-    return `signal:${trimmed}`;
-  }
-  if (SIGNAL_NAME_REGEX.test(trimmed)) {
-    return trimmed;
-  }
-  return null;
-}
-
 // src/api/client.ts
 var REFRESH_MUTATION = `
   mutation Refresh($input: RefreshAuthInput!) {
@@ -3245,8 +4122,32 @@ function graphqlErrorMessage(errors) {
   }
   return null;
 }
-function isMissingSnapshotJsonFieldError(error) {
-  return error instanceof ApiError && error.message.includes("snapshotJson") && error.message.includes("Cannot query field");
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isCatalogShape(value) {
+  if (!isPlainObject(value)) return false;
+  return value.contract_version === "io.invocation.v2" && value.snapshot_version === "io_runtime.snapshot.v2" && typeof value.catalog_hash === "string" && isPlainObject(value.resources) && isPlainObject(value.signals) && isPlainObject(value.tools) && isPlainObject(value.schemas);
+}
+function isManifestShape(value) {
+  if (!isPlainObject(value)) return false;
+  return value.contract_version === "io.invocation.v2" && value.snapshot_version === "io_runtime.snapshot.v2" && Array.isArray(value.secret_bundles) && Array.isArray(value.apps) && Array.isArray(value.endpoints) && Array.isArray(value.targets) && Array.isArray(value.subscriptions);
+}
+function parseRemoteCatalog(catalogJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(catalogJson);
+  } catch (err) {
+    throw new ConfigError(
+      `Remote deployment catalog was not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!isCatalogShape(parsed)) {
+    throw new ConfigError(
+      "Remote deployment catalog does not match the io.invocation.v2 catalog shape."
+    );
+  }
+  return parsed;
 }
 function parseRemoteManifest(snapshotJson) {
   let parsed;
@@ -3257,11 +4158,22 @@ function parseRemoteManifest(snapshotJson) {
       `Remote deployment snapshot was not valid JSON: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new ConfigError("Remote deployment snapshot was not a JSON object.");
+  if (!isManifestShape(parsed)) {
+    throw new ConfigError(
+      "Remote deployment snapshot does not match the io_runtime.snapshot.v2 manifest shape."
+    );
   }
   return parsed;
 }
+var EMPTY_MANIFEST = {
+  contract_version: "io.invocation.v2",
+  snapshot_version: "io_runtime.snapshot.v2",
+  secret_bundles: [],
+  apps: [],
+  endpoints: [],
+  targets: [],
+  subscriptions: []
+};
 async function executeGraphQLUnauth(apiUrl, query, variables, headers = {}) {
   const response = await fetch(`${trimBaseUrl(apiUrl)}/graphql`, {
     method: "POST",
@@ -3478,14 +4390,33 @@ function createClient(config) {
     );
     return data.createProject;
   }
-  async function listSecrets(projectIdValue) {
+  async function deleteProject(organizationId, projectIdValue) {
     const data = await graphql(
       `
-        query Secrets($projectId: ID!) {
-          secrets(projectId: $projectId) {
+        mutation DeleteProject($organizationId: ID!, $id: ID!) {
+          deleteProject(organizationId: $organizationId, id: $id) {
+            id
             name
+            slug
+            description
+            organizationId
+          }
+        }
+      `,
+      { organizationId, id: projectIdValue }
+    );
+    return data.deleteProject;
+  }
+  async function principals2(projectIdValue) {
+    const data = await graphql(
+      `
+        query Principals($projectId: ID!) {
+          principals(projectId: $projectId) {
+            id
+            externalId
+            state
+            metadata
             projectId
-            hasValue
             insertedAt
             updatedAt
           }
@@ -3493,9 +4424,83 @@ function createClient(config) {
       `,
       { projectId: projectIdValue }
     );
-    return data.secrets ?? [];
+    return data.principals ?? [];
   }
-  async function putSecret(projectIdValue, input) {
+  async function createPrincipal(projectIdValue, input) {
+    const data = await graphql(
+      `
+        mutation CreatePrincipal($projectId: ID!, $input: CreatePrincipalInput!) {
+          createPrincipal(projectId: $projectId, input: $input) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, input }
+    );
+    return data.createPrincipal;
+  }
+  async function updatePrincipal(projectIdValue, id, input) {
+    const data = await graphql(
+      `
+        mutation UpdatePrincipal($projectId: ID!, $id: ID!, $input: UpdatePrincipalInput!) {
+          updatePrincipal(projectId: $projectId, id: $id, input: $input) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, id, input }
+    );
+    return data.updatePrincipal ?? null;
+  }
+  async function deletePrincipal(projectIdValue, id) {
+    const data = await graphql(
+      `
+        mutation DeletePrincipal($projectId: ID!, $id: ID!) {
+          deletePrincipal(projectId: $projectId, id: $id) {
+            id
+            externalId
+            state
+            metadata
+            projectId
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, id }
+    );
+    return data.deletePrincipal ?? null;
+  }
+  async function listSecrets(projectIdValue) {
+    const data = await graphql(
+      `
+        query Secrets($projectId: ID!) {
+          secrets(projectId: $projectId) {
+            name
+            projectId
+            hasValue
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue }
+    );
+    return data.secrets ?? [];
+  }
+  async function putSecret(projectIdValue, input) {
     const data = await graphql(
       `
         mutation PutSecret($input: PutSecretInput!) {
@@ -3531,28 +4536,34 @@ function createClient(config) {
     return data.deleteSecret === true;
   }
   async function fetchRemoteManifest(projectIdValue) {
-    let data;
-    try {
-      data = await graphql(
-        `
+    const data = await graphql(
+      `
           query ActiveDeploymentSnapshot($projectId: ID!) {
             activeDeployment(projectId: $projectId) {
               snapshotJson
             }
           }
         `,
-        { projectId: projectIdValue }
-      );
-    } catch (err) {
-      if (isMissingSnapshotJsonFieldError(err)) {
-        return {};
-      }
-      throw err;
-    }
+      { projectId: projectIdValue }
+    );
     const snapshotJson = data.activeDeployment?.snapshotJson;
-    return typeof snapshotJson === "string" && snapshotJson.trim() !== "" ? parseRemoteManifest(snapshotJson) : {};
+    return typeof snapshotJson === "string" && snapshotJson.trim() !== "" ? parseRemoteManifest(snapshotJson) : EMPTY_MANIFEST;
   }
-  async function deployBundle(bundlePath, manifest) {
+  async function fetchRemoteCatalog(projectIdValue) {
+    const data = await graphql(
+      `
+          query ActiveDeploymentCatalog($projectId: ID!) {
+            activeDeployment(projectId: $projectId) {
+              catalogJson
+            }
+          }
+        `,
+      { projectId: projectIdValue }
+    );
+    const catalogJson = data.activeDeployment?.catalogJson;
+    return typeof catalogJson === "string" && catalogJson.trim() !== "" ? parseRemoteCatalog(catalogJson) : null;
+  }
+  async function deployBundle(bundlePath, manifest, catalog2) {
     const MAX_BUNDLE_BYTES = 100 * 1024 * 1024;
     const fileStat = await stat(bundlePath);
     if (fileStat.size > MAX_BUNDLE_BYTES) {
@@ -3590,7 +4601,8 @@ function createClient(config) {
           projectId: projectIdValue,
           bundleHash: upload.bundleHash,
           revision: nextRevision,
-          snapshotJson: stableStringify2(manifest)
+          snapshotJson: stableStringify(manifest),
+          catalogJson: stableStringify(catalog2)
         }
       }
     );
@@ -3598,7 +4610,10 @@ function createClient(config) {
   }
   async function emitSignal(input) {
     const projectIdValue = input.projectId ?? projectId();
-    const eventName = normalizeRuntimeSignalName2(input.signal);
+    if (!input.principalId || input.principalId.trim() === "") {
+      throw new ConfigError("principalId is required to emit a signal");
+    }
+    const eventName = normalizeRuntimeSignalName(input.signal);
     if (!eventName) {
       throw new ConfigError(
         "signal name must be a bare event name like smoke.start or use the signal: namespace"
@@ -3625,6 +4640,7 @@ function createClient(config) {
       {
         input: {
           projectId: projectIdValue,
+          principalId: input.principalId,
           eventName,
           payloadJson: JSON.stringify(input.payload ?? {}),
           metadataJson: JSON.stringify(input.metadata ?? {}),
@@ -3650,6 +4666,37 @@ function createClient(config) {
     );
     return data.activeRevision;
   }
+  async function reconcileProject(projectIdValue) {
+    const data = await graphql(
+      `
+        mutation ReconcileProject($projectId: ID!) {
+          reconcileProject(projectId: $projectId)
+        }
+      `,
+      { projectId: projectIdValue }
+    );
+    return data.reconcileProject === true;
+  }
+  async function deploymentStatus(projectIdValue, revision) {
+    const data = await graphql(
+      `
+        query DeploymentStatus($projectId: ID!, $revision: Int!) {
+          deploymentStatus(projectId: $projectId, revision: $revision) {
+            id
+            projectId
+            revision
+            bundleHash
+            status
+            activatedAt
+            insertedAt
+            updatedAt
+          }
+        }
+      `,
+      { projectId: projectIdValue, revision }
+    );
+    return data.deploymentStatus;
+  }
   async function quotaStatuses() {
     const data = await graphql(
       `
@@ -3701,27 +4748,263 @@ function createClient(config) {
     organizations,
     projects: projects2,
     createProject,
+    deleteProject,
+    principals: principals2,
+    createPrincipal,
+    updatePrincipal,
+    deletePrincipal,
     listSecrets,
     putSecret,
     deleteSecret,
     fetchRemoteManifest,
+    fetchRemoteCatalog,
     deployBundle,
+    deploymentStatus,
+    reconcileProject,
     emitSignal,
     quotaStatuses,
     projectEvents
   };
 }
+Object.assign(globalThis, { WebSocket });
+var SessionTokenNotSupportedError = class extends Error {
+  constructor(message) {
+    super(
+      message ?? "WebSocket subscriptions require API key authentication on the current io_runtime socket contract."
+    );
+    this.name = "SessionTokenNotSupportedError";
+  }
+};
+function buildSocketUrl(apiUrl) {
+  const url = new URL(apiUrl);
+  const basePath = url.pathname.replace(/\/+$/, "");
+  const socketBase = basePath.endsWith("/graphql") ? basePath.slice(0, -"/graphql".length) : basePath;
+  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+  url.pathname = `${socketBase === "/" ? "" : socketBase}/socket`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function createSocketClient(options) {
+  let phoenixSocket = null;
+  let absintheSocket = null;
+  const notifiers = /* @__PURE__ */ new Set();
+  function ensureConnection() {
+    if (!options.credentials.apiKey) {
+      throw new SessionTokenNotSupportedError();
+    }
+    if (!phoenixSocket || !absintheSocket) {
+      phoenixSocket = new Socket(buildSocketUrl(options.apiUrl), {
+        params: socketAuthParams(options.credentials),
+        timeout: options.timeoutMs ?? 1e4
+      });
+      absintheSocket = AbsintheSocket.create(phoenixSocket);
+      phoenixSocket.connect();
+    }
+    return { absintheSocket };
+  }
+  function tearDownIfIdle() {
+    if (notifiers.size === 0 && phoenixSocket) {
+      phoenixSocket.disconnect();
+      phoenixSocket = null;
+      absintheSocket = null;
+    }
+  }
+  return {
+    subscribe(operation, variables, observer) {
+      const conn = ensureConnection();
+      const notifier = AbsintheSocket.send(conn.absintheSocket, {
+        operation,
+        variables
+      });
+      notifiers.add(notifier);
+      AbsintheSocket.observe(conn.absintheSocket, notifier, {
+        onAbort: (err) => {
+          notifiers.delete(notifier);
+          if (observer.onAbort) {
+            observer.onAbort(err);
+          } else {
+            observer.onError?.(err);
+          }
+          tearDownIfIdle();
+        },
+        onCancel: () => {
+          notifiers.delete(notifier);
+          tearDownIfIdle();
+        },
+        onError: (err) => {
+          observer.onError?.(err);
+        },
+        onResult: (result) => {
+          observer.onResult?.(result);
+        },
+        onStart: () => {
+          observer.onStart?.();
+        }
+      });
+      return () => {
+        if (!notifiers.has(notifier)) return;
+        notifiers.delete(notifier);
+        try {
+          AbsintheSocket.cancel(conn.absintheSocket, notifier);
+        } catch {
+        }
+        tearDownIfIdle();
+      };
+    },
+    close() {
+      notifiers.clear();
+      if (phoenixSocket) {
+        phoenixSocket.disconnect();
+      }
+      phoenixSocket = null;
+      absintheSocket = null;
+    }
+  };
+}
+
+// src/api/watcher.ts
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_SEEN_ID_LIMIT = 1e3;
+var DEFAULT_POLL_SAFETY_LOOPS = 10;
+function installSigintHandler(onTerminate) {
+  const handler = () => {
+    onTerminate();
+  };
+  process.once("SIGINT", handler);
+  return () => {
+    process.removeListener("SIGINT", handler);
+  };
+}
+async function watch(plan, handlers) {
+  const seenIds = /* @__PURE__ */ new Set();
+  const seenOrder = [];
+  const seenLimit = plan.seenIdLimit ?? DEFAULT_SEEN_ID_LIMIT;
+  function rememberId(id) {
+    if (seenIds.has(id)) return;
+    seenIds.add(id);
+    seenOrder.push(id);
+    while (seenOrder.length > seenLimit) {
+      const evicted = seenOrder.shift();
+      if (evicted) seenIds.delete(evicted);
+    }
+  }
+  function handle(event) {
+    const id = plan.getId(event);
+    if (seenIds.has(id)) return false;
+    rememberId(id);
+    handlers.onEvent(event);
+    return true;
+  }
+  let cursor = plan.initialSince ?? (/* @__PURE__ */ new Date()).toISOString();
+  function advanceCursor(event) {
+    if (!plan.getCursor) return;
+    const next = plan.getCursor(event);
+    if (next > cursor) cursor = next;
+  }
+  if (plan.snapshot) {
+    const initial = await plan.snapshot();
+    for (const event of initial) {
+      handle(event);
+      advanceCursor(event);
+      if (plan.isTerminal?.(event)) return;
+    }
+  }
+  return new Promise((resolve5, reject) => {
+    let cleanupSigint;
+    let subscribeHandle;
+    let pollTimer;
+    let terminated = false;
+    function finalize(action) {
+      if (terminated) return;
+      terminated = true;
+      subscribeHandle?.unsubscribe();
+      if (pollTimer) clearTimeout(pollTimer);
+      cleanupSigint?.();
+      action();
+    }
+    cleanupSigint = installSigintHandler(() => {
+      finalize(() => resolve5());
+    });
+    function processLiveEvent(event) {
+      const accepted = handle(event);
+      if (accepted) advanceCursor(event);
+      if (plan.isTerminal?.(event)) finalize(() => resolve5());
+    }
+    async function startPolling() {
+      if (!plan.poll) {
+        finalize(() => reject(new Error("No polling fallback configured for this watch.")));
+        return;
+      }
+      handlers.onConnected?.("polling");
+      const interval = plan.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+      const safetyLoops = plan.pollBatchSafetyLoops ?? DEFAULT_POLL_SAFETY_LOOPS;
+      const loop = async () => {
+        if (terminated) return;
+        try {
+          for (let i = 0; i < safetyLoops; i += 1) {
+            const batch = await plan.poll(cursor);
+            let anyNew = false;
+            for (const event of batch) {
+              if (handle(event)) anyNew = true;
+              advanceCursor(event);
+              if (plan.isTerminal?.(event)) {
+                finalize(() => resolve5());
+                return;
+              }
+            }
+            if (!anyNew) break;
+          }
+        } catch (err) {
+          finalize(
+            () => reject(err instanceof Error ? err : new Error(String(err)))
+          );
+          return;
+        }
+        pollTimer = setTimeout(loop, interval);
+      };
+      void loop();
+    }
+    if (!plan.subscribe) {
+      void startPolling();
+      return;
+    }
+    try {
+      subscribeHandle = plan.subscribe(
+        processLiveEvent,
+        (err) => {
+          if (err instanceof SessionTokenNotSupportedError && plan.poll) {
+            subscribeHandle = void 0;
+            void startPolling();
+            return;
+          }
+          finalize(() => reject(err));
+        },
+        () => handlers.onConnected?.("subscription")
+      );
+    } catch (err) {
+      if (err instanceof SessionTokenNotSupportedError && plan.poll) {
+        void startPolling();
+        return;
+      }
+      finalize(() => reject(err instanceof Error ? err : new Error(String(err))));
+    }
+  });
+}
 
 // src/commands/deploy.ts
+var TERMINAL_STATUSES = /* @__PURE__ */ new Set(["active", "failed", "superseded"]);
+var WATCH_POLL_INTERVAL_MS = 2e3;
+var WATCH_DEADLINE_MS = 5 * 6e4;
 async function deployCommand(options) {
   let stagingDir;
   try {
     const config = await loadConfig({
       dir: options.dir
     });
-    console.log(chalk11.gray("Planning deployment..."));
+    console.log(chalk12.gray("Planning deployment..."));
     stagingDir = await createStagingDir();
-    const { manifest } = await buildPipeline(
+    const { manifest, catalog: catalog2 } = await buildPipeline(
       config,
       process.cwd(),
       options.minify ?? true,
@@ -3729,7 +5012,7 @@ async function deployCommand(options) {
     );
     if (!config.apiUrl || !config.projectId) {
       console.log(
-        chalk11.yellow(
+        chalk12.yellow(
           "\nNo apiUrl or projectId configured. Skipping upload."
         )
       );
@@ -3739,30 +5022,37 @@ async function deployCommand(options) {
       apiUrl: config.apiUrl,
       projectId: config.projectId
     });
-    console.log(chalk11.gray("\nComparing with remote..."));
-    const remoteManifest = await client.fetchRemoteManifest(client.projectId());
+    console.log(chalk12.gray("\nComparing with remote..."));
+    const remoteManifest = await client.fetchRemoteManifest(
+      client.projectId()
+    );
+    const remoteCatalog = await client.fetchRemoteCatalog(client.projectId());
     const diff = diffManifests(manifest, remoteManifest);
-    if (!diff.hasChanges) {
-      console.log(chalk11.green("\n\u2713 No changes to deploy."));
+    const catalogDiff = diffCatalogs(catalog2, remoteCatalog);
+    if (!diff.hasChanges && !catalogDiff.hasChanges) {
+      console.log(chalk12.green("\n\u2713 No changes to deploy."));
       return;
     }
-    console.log("\n" + formatPlan(diff));
+    console.log("\n" + formatPlan(diff, catalogDiff));
     const confirmed = await confirmPlan(options.yes ?? false);
     if (!confirmed) {
-      console.log(chalk11.yellow("Deploy cancelled."));
+      console.log(chalk12.yellow("Deploy cancelled."));
       return;
     }
-    console.log(chalk11.gray("\nApplying deployment..."));
+    console.log(chalk12.gray("\nApplying deployment..."));
     const zipPath = join(stagingDir, "deploy.zip");
     await zipBuildOutput(stagingDir, zipPath);
-    const revision = await client.deployBundle(zipPath, manifest);
+    const revision = await client.deployBundle(zipPath, manifest, catalog2);
     console.log(
-      chalk11.green(`
-\u2713 Deployment complete (revision ${revision.revision}, ${revision.status})`)
+      chalk12.green(`
+\u2713 Deployment submitted (revision ${revision.revision}, ${revision.status})`)
     );
+    if (options.watch) {
+      await watchDeployment(client, revision);
+    }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -3770,6 +5060,72 @@ async function deployCommand(options) {
     await cleanupStagingDir(stagingDir);
   }
 }
+function colorStatus(status) {
+  switch (status) {
+    case "active":
+      return chalk12.green(status);
+    case "failed":
+      return chalk12.red(status);
+    case "superseded":
+      return chalk12.yellow(status);
+    case "staged":
+      return chalk12.cyan(status);
+    case "draft":
+    default:
+      return chalk12.gray(status);
+  }
+}
+async function watchDeployment(client, initial) {
+  if (TERMINAL_STATUSES.has(initial.status)) {
+    return;
+  }
+  console.log(chalk12.gray(`
+Watching revision ${initial.revision}\u2026`));
+  let lastStatus = initial.status;
+  const startedAt = Date.now();
+  await watch(
+    {
+      poll: async () => {
+        if (Date.now() - startedAt > WATCH_DEADLINE_MS) {
+          throw new Error(
+            `Deployment did not reach a terminal status within ${WATCH_DEADLINE_MS / 1e3}s.`
+          );
+        }
+        const next = await client.deploymentStatus(
+          client.projectId(),
+          initial.revision
+        );
+        return next ? [next] : [];
+      },
+      pollIntervalMs: WATCH_POLL_INTERVAL_MS,
+      getId: (rev) => `${rev.revision}:${rev.status}:${rev.updatedAt}`,
+      isTerminal: (rev) => TERMINAL_STATUSES.has(rev.status)
+    },
+    {
+      onEvent: (rev) => {
+        if (rev.status !== lastStatus) {
+          console.log(
+            `  revision ${rev.revision} \u2192 ${colorStatus(rev.status)}`
+          );
+          lastStatus = rev.status;
+        }
+      }
+    }
+  );
+  if (lastStatus === "active") {
+    console.log(chalk12.green(`
+\u2713 Deployment active (revision ${initial.revision}).`));
+  } else if (lastStatus === "failed") {
+    console.log(chalk12.red(`
+\u2717 Deployment failed (revision ${initial.revision}).`));
+    process.exit(1);
+  } else if (lastStatus === "superseded") {
+    console.log(
+      chalk12.yellow(`
+! Revision ${initial.revision} was superseded by a later deploy.`)
+    );
+  }
+}
 var SUCCESS_HTML = `<!DOCTYPE html>
 <html>
 <head><title>IO CLI</title><style>
@@ -3873,7 +5229,7 @@ async function loginCommand(options) {
   try {
     if (options.token) {
       await saveToken(options.token, true);
-      console.log(chalk11.green("\u2713 API key saved"));
+      console.log(chalk12.green("\u2713 API key saved"));
       return;
     }
     const config = await loadConfig();
@@ -3884,7 +5240,7 @@ async function loginCommand(options) {
     }
     const existing = await loadToken();
     if (existing) {
-      console.log(chalk11.gray("Existing session found. Re-authenticating..."));
+      console.log(chalk12.gray("Existing session found. Re-authenticating..."));
     }
     const callbackServer = await startCallbackServer();
     const pkce = generatePkcePair();
@@ -3894,12 +5250,12 @@ async function loginCommand(options) {
       callbackServer.state,
       pkce.challenge
     );
-    console.log(chalk11.gray("Opening your browser for sign-in..."));
+    console.log(chalk12.gray("Opening your browser for sign-in..."));
     try {
       await open(authorizationUrl);
     } catch {
-      console.log(chalk11.yellow("Could not open the browser automatically."));
-      console.log(chalk11.gray(`Open this URL manually:
+      console.log(chalk12.yellow("Could not open the browser automatically."));
+      console.log(chalk12.gray(`Open this URL manually:
 ${authorizationUrl}`));
     }
     try {
@@ -3923,10 +5279,10 @@ ${authorizationUrl}`));
     } finally {
       callbackServer.close();
     }
-    console.log(chalk11.green("\n\u2713 Authenticated successfully"));
+    console.log(chalk12.green("\n\u2713 Authenticated successfully"));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -3936,10 +5292,10 @@ async function logoutCommand() {
   const creds = await loadCredentials();
   await clearToken();
   if (!creds) {
-    console.log(chalk11.yellow("Not logged in."));
+    console.log(chalk12.yellow("Not logged in."));
     return;
   }
-  console.log(chalk11.green("\u2713 Logged out"));
+  console.log(chalk12.green("\u2713 Logged out"));
 }
 async function hydrateIdentity() {
   const creds = await loadCredentials();
@@ -3983,35 +5339,35 @@ async function hydrateIdentity() {
 async function whoamiCommand() {
   const { creds, sessionName, sessionEmail } = await hydrateIdentity();
   if (!creds) {
-    console.log(chalk11.yellow("Not logged in. Run `io login` to authenticate."));
+    console.log(chalk12.yellow("Not logged in. Run `io login` to authenticate."));
     return;
   }
-  console.log(chalk11.green("\u2713 Logged in"));
+  console.log(chalk12.green("\u2713 Logged in"));
   const displayUser = sessionName ?? sessionEmail ?? creds.userId;
   if (displayUser) {
-    console.log(chalk11.gray(`  User:         ${displayUser}`));
+    console.log(chalk12.gray(`  User:         ${displayUser}`));
   }
   if (sessionEmail && sessionEmail !== displayUser) {
-    console.log(chalk11.gray(`  Email:        ${sessionEmail}`));
+    console.log(chalk12.gray(`  Email:        ${sessionEmail}`));
   }
   if (creds.organizationId) {
-    console.log(chalk11.gray(`  Organization: ${creds.organizationId}`));
+    console.log(chalk12.gray(`  Organization: ${creds.organizationId}`));
   }
   if (creds.apiKey) {
-    console.log(chalk11.gray("  Session:      API key"));
+    console.log(chalk12.gray("  Session:      API key"));
   } else if (creds.refreshToken) {
-    console.log(chalk11.gray("  Session:      refresh token stored"));
+    console.log(chalk12.gray("  Session:      refresh token stored"));
   } else {
-    console.log(chalk11.gray("  Session:      token only (no refresh)"));
+    console.log(chalk12.gray("  Session:      token only (no refresh)"));
   }
 }
 var CONFIG_FILE = "io.config.json";
 async function prompt(question) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve4(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
@@ -4032,13 +5388,13 @@ async function selectOrganization(organizations, preferredId) {
   if (organizations.length === 1) {
     return organizations[0];
   }
-  console.log(chalk11.gray("\nAvailable organizations:"));
+  console.log(chalk12.gray("\nAvailable organizations:"));
   organizations.forEach((organization, index2) => {
     console.log(
-      `  ${chalk11.green(String(index2 + 1))}. ${organization.name}  ${chalk11.gray(organization.id)}`
+      `  ${chalk12.green(String(index2 + 1))}. ${organization.name}  ${chalk12.gray(organization.id)}`
     );
   });
-  const choice = await prompt(chalk11.gray("\nSelect an organization (number or ID): "));
+  const choice = await prompt(chalk12.gray("\nSelect an organization (number or ID): "));
   const index = Number(choice);
   if (index > 0 && index <= organizations.length) {
     return organizations[index - 1];
@@ -4051,16 +5407,16 @@ async function initCommand(options) {
     const existing = await readExistingConfig(cwd);
     if (existing.projectId && !options.yes) {
       const overwrite = await prompt(
-        chalk11.yellow(`io.config.json already has projectId "${existing.projectId}". Overwrite? (y/n) `)
+        chalk12.yellow(`io.config.json already has projectId "${existing.projectId}". Overwrite? (y/n) `)
       );
       if (overwrite.toLowerCase() !== "y") {
-        console.log(chalk11.gray("Cancelled."));
+        console.log(chalk12.gray("Cancelled."));
         return;
       }
     }
     const config = { ...existing };
     if (!config.apiUrl) {
-      const apiUrl = await prompt(chalk11.gray("API URL (leave blank for default): "));
+      const apiUrl = await prompt(chalk12.gray("API URL (leave blank for default): "));
       if (apiUrl) {
         config.apiUrl = apiUrl;
       }
@@ -4082,7 +5438,7 @@ async function initCommand(options) {
       try {
         organizations = await client.organizations();
       } catch {
-        console.log(chalk11.yellow("Could not fetch organizations. Enter project ID manually."));
+        console.log(chalk12.yellow("Could not fetch organizations. Enter project ID manually."));
       }
       const selectedOrganization = await selectOrganization(
         organizations,
@@ -4091,14 +5447,14 @@ async function initCommand(options) {
       if (selectedOrganization) {
         const projects2 = await client.projects(selectedOrganization.id);
         if (projects2.length > 0) {
-          console.log(chalk11.gray("\nAvailable projects:"));
+          console.log(chalk12.gray("\nAvailable projects:"));
           projects2.forEach((project, index2) => {
             console.log(
-              `  ${chalk11.green(String(index2 + 1))}. ${project.name}  ${chalk11.gray(project.id)}`
+              `  ${chalk12.green(String(index2 + 1))}. ${project.name}  ${chalk12.gray(project.id)}`
             );
           });
           const choice = await prompt(
-            chalk11.gray("\nSelect a project (number) or enter a project ID: ")
+            chalk12.gray("\nSelect a project (number) or enter a project ID: ")
           );
           const index = Number(choice);
           if (index > 0 && index <= projects2.length) {
@@ -4108,26 +5464,26 @@ async function initCommand(options) {
           }
         } else {
           const createNew = await prompt(
-            chalk11.gray("No projects found. Create one? (y/n) ")
+            chalk12.gray("No projects found. Create one? (y/n) ")
           );
           if (createNew.toLowerCase() === "y") {
-            const name = await prompt(chalk11.gray("Project name: "));
+            const name = await prompt(chalk12.gray("Project name: "));
             if (name) {
               const project = await client.createProject(selectedOrganization.id, name);
               config.projectId = project.id;
-              console.log(chalk11.green(`\u2713 Created project: ${project.name}`));
+              console.log(chalk12.green(`\u2713 Created project: ${project.name}`));
             }
           }
         }
       } else {
-        const projectId = await prompt(chalk11.gray("Project ID (or leave blank): "));
+        const projectId = await prompt(chalk12.gray("Project ID (or leave blank): "));
         if (projectId) {
           config.projectId = projectId;
         }
       }
     } else {
-      console.log(chalk11.yellow("Not logged in. Run `io login` first to select a project."));
-      const projectId = await prompt(chalk11.gray("Project ID (or leave blank): "));
+      console.log(chalk12.yellow("Not logged in. Run `io login` first to select a project."));
+      const projectId = await prompt(chalk12.gray("Project ID (or leave blank): "));
       if (projectId) {
         config.projectId = projectId;
       }
@@ -4137,14 +5493,14 @@ async function initCommand(options) {
       JSON.stringify(config, null, 2) + "\n",
       "utf-8"
     );
-    console.log(chalk11.green(`
+    console.log(chalk12.green(`
 \u2713 Wrote ${CONFIG_FILE}`));
     if (config.projectId) {
-      console.log(chalk11.gray(`  Project: ${config.projectId}`));
+      console.log(chalk12.gray(`  Project: ${config.projectId}`));
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4172,16 +5528,65 @@ async function projectsListCommand() {
     const organizationId = await resolveOrganizationId(client);
     const projects2 = await client.projects(organizationId);
     if (!projects2 || projects2.length === 0) {
-      console.log(chalk11.gray("No projects found. Create one with `io projects create <name>`."));
+      console.log(chalk12.gray("No projects found. Create one with `io projects create <name>`."));
       return;
     }
     for (const p of projects2) {
-      const current = p.id === config.projectId ? chalk11.green(" (current)") : "";
-      console.log(`  ${p.name}  ${chalk11.gray(p.id)}${current}`);
+      const current = p.id === config.projectId ? chalk12.green(" (current)") : "";
+      console.log(`  ${p.name}  ${chalk12.gray(p.id)}${current}`);
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      console.error(chalk12.red(err.message));
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+async function confirmDelete(projectName, projectId) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve5) => {
+    rl.question(
+      `Delete project "${projectName}" (${projectId})? Type the project name to confirm: `,
+      (answer) => {
+        rl.close();
+        resolve5(answer.trim() === projectName);
+      }
+    );
+  });
+}
+async function projectsDeleteCommand(id, options = {}) {
+  try {
+    const config = await loadConfig();
+    const client = createClient(config);
+    const organizationId = options.organizationId ?? await resolveOrganizationId(client);
+    const projects2 = await client.projects(organizationId);
+    const target = projects2.find((p) => p.id === id);
+    if (!target) {
+      throw new ConfigError(
+        `Project "${id}" not found under organization ${organizationId}.`
+      );
+    }
+    if (!options.yes) {
+      const confirmed = await confirmDelete(target.name, target.id);
+      if (!confirmed) {
+        console.log(chalk12.yellow("Delete cancelled (name did not match)."));
+        return;
+      }
+    }
+    const deleted = await client.deleteProject(organizationId, target.id);
+    console.log(chalk12.green(`\u2713 Deleted project: ${deleted.name}`));
+    console.log(chalk12.gray(`  ID: ${deleted.id}`));
+    if (config.projectId === deleted.id) {
+      console.log(
+        chalk12.yellow(
+          "\n  io.config.json still references this project \u2014 clear the projectId field before redeploying."
+        )
+      );
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4193,10 +5598,10 @@ async function projectsCreateCommand(name) {
     const client = createClient(config);
     const organizationId = await resolveOrganizationId(client);
     const project = await client.createProject(organizationId, name);
-    console.log(chalk11.green(`\u2713 Created project: ${project.name}`));
-    console.log(chalk11.gray(`  ID: ${project.id}`));
+    console.log(chalk12.green(`\u2713 Created project: ${project.name}`));
+    console.log(chalk12.gray(`  ID: ${project.id}`));
     console.log(
-      chalk11.gray(
+      chalk12.gray(
         `
   Add to io.config.json:
   { "projectId": "${project.id}" }`
@@ -4204,7 +5609,7 @@ async function projectsCreateCommand(name) {
     );
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4216,10 +5621,10 @@ async function secretsSetCommand(name, value) {
     const client = createClient(config);
     const pid = client.projectId();
     await client.putSecret(pid, { name, value });
-    console.log(chalk11.green(`\u2713 Set secret: ${name}`));
+    console.log(chalk12.green(`\u2713 Set secret: ${name}`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4231,16 +5636,16 @@ async function secretsListCommand() {
     const client = createClient(config);
     const secrets2 = await client.listSecrets(client.projectId());
     if (!secrets2 || secrets2.length === 0) {
-      console.log(chalk11.gray("No secrets configured."));
+      console.log(chalk12.gray("No secrets configured."));
       return;
     }
     for (const s of secrets2) {
-      const value = s.hasValue ? "" : chalk11.gray(" (no value)");
+      const value = s.hasValue ? "" : chalk12.gray(" (no value)");
       console.log(`  ${s.name}${value}`);
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4252,25 +5657,123 @@ async function secretsRemoveCommand(name) {
     const client = createClient(config);
     const removed = await client.deleteSecret(client.projectId(), name);
     if (!removed) {
-      console.log(chalk11.yellow(`Secret "${name}" not found.`));
+      console.log(chalk12.yellow(`Secret "${name}" not found.`));
       return;
     }
-    console.log(chalk11.green(`\u2713 Removed secret: ${name}`));
+    console.log(chalk12.green(`\u2713 Removed secret: ${name}`));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
   }
 }
+function parseMetadata(input) {
+  if (!input) return void 0;
+  try {
+    const parsed = JSON.parse(input);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+  }
+  throw new ConfigError("metadata must be a JSON object");
+}
+function validateState(state) {
+  if (!state) return void 0;
+  if (state === "active" || state === "inactive" || state === "archived") return state;
+  throw new ConfigError("state must be active, inactive, or archived");
+}
+async function withClient(options) {
+  const config = await loadConfig({ projectId: options.projectId });
+  const client = createClient(config);
+  return { client, projectId: client.projectId() };
+}
+function handleError(err) {
+  if (err instanceof CliError) {
+    console.error(chalk12.red(err.message));
+    process.exit(1);
+  }
+  throw err;
+}
+async function principalsListCommand(options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principals2 = await client.principals(projectId);
+    if (principals2.length === 0) {
+      console.log(chalk12.gray("No principals found. Create one with `io principals create <external-id>`."));
+      return;
+    }
+    for (const principal of principals2) {
+      console.log(
+        `  ${principal.externalId}  ${chalk12.gray(principal.id)}  ${chalk12.gray(principal.state)}`
+      );
+    }
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsCreateCommand(externalId, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principal = await client.createPrincipal(projectId, {
+      externalId,
+      state: validateState(options.state),
+      metadata: parseMetadata(options.metadata)
+    });
+    console.log(chalk12.green(`\u2713 Created principal: ${principal.externalId}`));
+    console.log(chalk12.gray(`  ID:      ${principal.id}`));
+    console.log(chalk12.gray(`  Project: ${principal.projectId}`));
+    console.log(chalk12.gray(`  State:   ${principal.state}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsUpdateCommand(id, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const input = {
+      externalId: options.externalId,
+      state: validateState(options.state),
+      metadata: parseMetadata(options.metadata)
+    };
+    if (!input.externalId && !input.state && !input.metadata) {
+      throw new ConfigError("nothing to update; pass --external-id, --state, or --metadata");
+    }
+    const principal = await client.updatePrincipal(projectId, id, input);
+    if (!principal) {
+      console.log(chalk12.yellow(`Principal "${id}" not found.`));
+      return;
+    }
+    console.log(chalk12.green(`\u2713 Updated principal: ${principal.externalId}`));
+    console.log(chalk12.gray(`  ID:      ${principal.id}`));
+    console.log(chalk12.gray(`  Project: ${principal.projectId}`));
+    console.log(chalk12.gray(`  State:   ${principal.state}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
+async function principalsDeleteCommand(id, options) {
+  try {
+    const { client, projectId } = await withClient(options);
+    const principal = await client.deletePrincipal(projectId, id);
+    if (!principal) {
+      console.log(chalk12.yellow(`Principal "${id}" not found.`));
+      return;
+    }
+    console.log(chalk12.green(`\u2713 Deleted principal: ${principal.externalId}`));
+  } catch (err) {
+    handleError(err);
+  }
+}
 function meterBar(used, limit, width = 20) {
-  if (limit === 0) return chalk11.gray("\u2591".repeat(width));
+  if (limit === 0) return chalk12.gray("\u2591".repeat(width));
   const ratio = Math.min(used / limit, 1);
   const filled = Math.round(ratio * width);
   const empty = width - filled;
-  const color = ratio >= 0.9 ? chalk11.red : ratio >= 0.7 ? chalk11.yellow : chalk11.green;
-  return color("\u2588".repeat(filled)) + chalk11.gray("\u2591".repeat(empty));
+  const color = ratio >= 0.9 ? chalk12.red : ratio >= 0.7 ? chalk12.yellow : chalk12.green;
+  return color("\u2588".repeat(filled)) + chalk12.gray("\u2591".repeat(empty));
 }
 function formatNumber(n) {
   if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
@@ -4280,9 +5783,11 @@ function formatNumber(n) {
 var METER_LABELS = {
   events: "Events",
   ingest_tokens: "Ingest Tokens",
+  query_tokens: "Query Tokens",
   voice_seconds: "Voice Seconds",
   compute_gb_sec: "Compute (GB\xB7s)",
-  storage_gb: "Storage (GB)"
+  storage_gb: "Memory Storage (GB)",
+  artifact_storage_gb: "Artifact Storage (GB)"
 };
 async function quotaCommand() {
   try {
@@ -4290,29 +5795,30 @@ async function quotaCommand() {
     const client = createClient(config);
     const statuses = await client.quotaStatuses();
     if (statuses.length === 0) {
-      console.log(chalk11.gray("No quota data available."));
+      console.log(chalk12.gray("No quota data available."));
       return;
     }
-    console.log(chalk11.bold("\nQuota Usage\n"));
+    console.log(chalk12.bold("\nQuota Usage\n"));
     for (const status of statuses) {
       const label = METER_LABELS[status.meter] ?? status.meter;
       const bar = meterBar(status.used, status.limit);
       const pct = status.limit > 0 ? `${status.percentageUsed.toFixed(1)}%` : "\u2014";
       const usage = `${formatNumber(status.used)} / ${formatNumber(status.limit)}`;
-      const enforcement = status.enforcement === "hard_cap" ? chalk11.red("hard") : chalk11.yellow("soft");
-      console.log(`  ${label.padEnd(18)} ${bar}  ${usage.padStart(16)}  ${pct.padStart(6)}  ${enforcement}`);
+      const enforcement = status.enforcement === "hard_cap" ? chalk12.red("hard") : chalk12.yellow("soft");
+      console.log(`  ${label.padEnd(22)} ${bar}  ${usage.padStart(16)}  ${pct.padStart(6)}  ${enforcement}`);
     }
     console.log();
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
   }
 }
-Object.assign(globalThis, { WebSocket });
-var ACTIVITY_SUBSCRIPTION = `
+
+// src/api/subscription.ts
+var ACTIVITY_EVENT_SUBSCRIPTION = `
   subscription ActivityEventReceived($projectId: ID!, $input: ActivityEventFilterInput) {
     activityEventReceived(projectId: $projectId, input: $input) {
       id
@@ -4333,56 +5839,6 @@ var ACTIVITY_SUBSCRIPTION = `
     }
   }
 `;
-function buildActivityEventsSocketUrl(apiUrl) {
-  const url = new URL(apiUrl);
-  const basePath = url.pathname.replace(/\/+$/, "");
-  const socketBase = basePath.endsWith("/graphql") ? basePath.slice(0, -"/graphql".length) : basePath;
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  url.pathname = `${socketBase === "/" ? "" : socketBase}/socket`;
-  url.search = "";
-  url.hash = "";
-  return url.toString();
-}
-function subscribeToActivityEvents(options) {
-  if (!options.credentials.apiKey) {
-    throw new ConfigError(
-      "Live activity subscriptions require API key authentication on the current io_beam socket contract."
-    );
-  }
-  const phoenixSocket = new Socket(buildActivityEventsSocketUrl(options.apiUrl), {
-    params: socketAuthParams(options.credentials),
-    timeout: 1e4
-  });
-  const absintheSocket = AbsintheSocket.create(phoenixSocket);
-  const notifier = AbsintheSocket.send(absintheSocket, {
-    operation: ACTIVITY_SUBSCRIPTION,
-    variables: { projectId: options.projectId, input: options.input }
-  });
-  const observer = {
-    onAbort: (error) => {
-      options.onError?.(error);
-    },
-    onCancel: () => {
-    },
-    onError: (error) => {
-      options.onError?.(error);
-    },
-    onResult: (result) => {
-      const event = result.data?.activityEventReceived;
-      if (event) {
-        options.onEvent(event);
-      }
-    },
-    onStart: () => {
-      options.onConnected?.();
-    }
-  };
-  AbsintheSocket.observe(absintheSocket, notifier, observer);
-  phoenixSocket.connect();
-  return () => {
-    phoenixSocket.disconnect();
-  };
-}
 
 // src/activity/presentation.ts
 var DISPLAY_NAME_NAMESPACES = /* @__PURE__ */ new Set([
@@ -4701,18 +6157,17 @@ function inferActivityPrincipalLabel(event) {
 
 // src/commands/logs.ts
 var LEVEL_COLORS = {
-  error: chalk11.red,
-  warning: chalk11.yellow,
-  info: chalk11.blue,
-  success: chalk11.green,
-  scheduled: chalk11.magenta
+  error: chalk12.red,
+  warning: chalk12.yellow,
+  info: chalk12.blue,
+  success: chalk12.green,
+  scheduled: chalk12.magenta
 };
 var FOLLOW_POLL_INTERVAL_MS = 2e3;
-var FOLLOW_SEEN_ID_LIMIT = 1e3;
 var FOLLOW_BATCH_LIMIT = 200;
 function colorLevel(level) {
-  if (!level) return chalk11.gray("\u2014");
-  const colorFn = LEVEL_COLORS[level] ?? chalk11.gray;
+  if (!level) return chalk12.gray("\u2014");
+  const colorFn = LEVEL_COLORS[level] ?? chalk12.gray;
   return colorFn(level.padEnd(7));
 }
 function pad(value, width) {
@@ -4725,8 +6180,8 @@ function formatTime(isoString) {
 }
 function formatDuration(ms) {
   if (ms == null) return "";
-  if (ms < 1e3) return chalk11.gray(`${ms}ms`);
-  return chalk11.gray(`${(ms / 1e3).toFixed(1)}s`);
+  if (ms < 1e3) return chalk12.gray(`${ms}ms`);
+  return chalk12.gray(`${(ms / 1e3).toFixed(1)}s`);
 }
 function truncate(value, width) {
   if (value.length <= width) return value;
@@ -4734,19 +6189,19 @@ function truncate(value, width) {
 }
 function formatHeader() {
   return [
-    `  ${chalk11.gray(pad("TIME", 10))}`,
-    chalk11.gray(pad("STATUS", 9)),
-    chalk11.gray(pad("CATEGORY", 14)),
-    chalk11.gray(pad("NAME", 24)),
-    chalk11.gray(pad("DURATION", 10)),
-    chalk11.gray("DETAIL")
+    `  ${chalk12.gray(pad("TIME", 10))}`,
+    chalk12.gray(pad("STATUS", 9)),
+    chalk12.gray(pad("CATEGORY", 14)),
+    chalk12.gray(pad("NAME", 24)),
+    chalk12.gray(pad("DURATION", 10)),
+    chalk12.gray("DETAIL")
   ].join("  ");
 }
 function formatEvent(event) {
-  const time = chalk11.gray(formatTime(event.occurredAt));
+  const time = chalk12.gray(formatTime(event.occurredAt));
   const statusKey = inferActivityEventStatus(event);
   const status = colorLevel(statusKey);
-  const category = chalk11.cyan(pad(inferActivityEventCategory(event), 14));
+  const category = chalk12.cyan(pad(inferActivityEventCategory(event), 14));
   const name = pad(truncate(inferActivityEventName(event), 24), 24);
   const duration = formatDuration(event.durationMs);
   const detail = inferActivityEventDetail(event) || inferActivityPrincipalLabel(event) || "";
@@ -4756,77 +6211,16 @@ function formatEvent(event) {
     category,
     name,
     pad(duration || "", 10),
-    detail ? chalk11.gray(detail) : ""
+    detail ? chalk12.gray(detail) : ""
   ].join("  ").trimEnd();
 }
-function latestOccurredAt(events, fallback) {
-  return events.reduce((latest, event) => {
-    return event.occurredAt > latest ? event.occurredAt : latest;
-  }, fallback);
-}
-function trimSeenIds(seenIds, order) {
-  while (order.length > FOLLOW_SEEN_ID_LIMIT) {
-    const evicted = order.shift();
-    if (evicted) {
-      seenIds.delete(evicted);
-    }
-  }
-}
-function orderEvents(events) {
-  return [...events].sort((left, right) => {
-    if (left.occurredAt === right.occurredAt) {
-      return left.id.localeCompare(right.id);
-    }
-    return left.occurredAt.localeCompare(right.occurredAt);
-  });
-}
-function wait(ms) {
-  return new Promise((resolve4) => {
-    setTimeout(resolve4, ms);
-  });
-}
-function followBatchInput(input, since) {
+function followPollInput(input, since) {
   return {
     ...input,
     since,
     limit: Math.max(input?.limit ?? 0, FOLLOW_BATCH_LIMIT)
   };
 }
-async function drainFollowEvents(client, projectId, input, since, seenIds, seenOrder) {
-  let cursor = since;
-  const events = [];
-  for (let i = 0; i < 10; i += 1) {
-    const batch = orderEvents(
-      await client.projectEvents(projectId, followBatchInput(input, cursor))
-    );
-    const unseen = batch.filter((event) => !seenIds.has(event.id));
-    if (unseen.length === 0) {
-      return { events, since: cursor };
-    }
-    events.push(...unseen);
-    cursor = latestOccurredAt(unseen, cursor);
-    for (const event of unseen) {
-      seenIds.add(event.id);
-      seenOrder.push(event.id);
-    }
-    trimSeenIds(seenIds, seenOrder);
-    if (batch.length < FOLLOW_BATCH_LIMIT) {
-      return { events, since: cursor };
-    }
-  }
-  return { events, since: cursor };
-}
-function installSigintHandler(onExit) {
-  const handleSigint = () => {
-    console.log(chalk11.gray("\n  Disconnected."));
-    onExit();
-    process.exit(0);
-  };
-  process.once("SIGINT", handleSigint);
-  return () => {
-    process.removeListener("SIGINT", handleSigint);
-  };
-}
 async function logsCommand(options) {
   try {
     const config = await loadConfig();
@@ -4842,18 +6236,18 @@ async function logsCommand(options) {
       const since = parseSince(options.since);
       if (since) input.since = since;
     }
-    const events = await client.projectEvents(pid, input);
-    if (events.length === 0 && !options.follow) {
-      console.log(chalk11.gray("No events found."));
+    const initialEvents = await client.projectEvents(pid, input);
+    if (initialEvents.length === 0 && !options.follow) {
+      console.log(chalk12.gray("No events found."));
       return;
     }
-    if (events.length > 0) {
-      console.log(chalk11.bold(`
-Activity Log \u2014 ${events.length} events
+    if (initialEvents.length > 0) {
+      console.log(chalk12.bold(`
+Activity Log \u2014 ${initialEvents.length} events
 `));
       console.log(formatHeader());
-      console.log(chalk11.gray(`  ${"\u2500".repeat(92)}`));
-      for (const event of events) {
+      console.log(chalk12.gray(`  ${"\u2500".repeat(92)}`));
+      for (const event of initialEvents) {
         console.log(formatEvent(event));
       }
     }
@@ -4863,7 +6257,7 @@ Activity Log \u2014 ${events.length} events
         client,
         pid,
         input,
-        events,
+        initialEvents,
         followStartedAt ?? (/* @__PURE__ */ new Date()).toISOString()
       );
     } else {
@@ -4871,7 +6265,7 @@ Activity Log \u2014 ${events.length} events
     }
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -4882,89 +6276,69 @@ async function tailEvents(apiUrl, client, projectId, input, initialEvents, follo
   if (!creds || !creds.token) {
     throw new ConfigError("Not authenticated. Run `io login` first.");
   }
-  console.log(chalk11.gray("\n  Waiting for events... (Ctrl+C to stop)\n"));
-  if (creds.apiKey) {
-    return new Promise((_resolve, reject) => {
-      let disconnect;
-      const seenIds2 = new Set(initialEvents.map((event) => event.id));
-      const seenOrder2 = initialEvents.map((event) => event.id);
-      const removeSigintHandler2 = installSigintHandler(() => {
-        disconnect?.();
-      });
-      disconnect = subscribeToActivityEvents({
-        apiUrl,
-        credentials: creds,
-        projectId,
-        input,
+  console.log(chalk12.gray("\n  Waiting for events... (Ctrl+C to stop)\n"));
+  const initialSince = initialEvents.reduce(
+    (latest, event) => event.occurredAt > latest ? event.occurredAt : latest,
+    followStartedAt
+  );
+  const socketClient = createSocketClient({ apiUrl, credentials: creds });
+  const subscriptionVars = input;
+  let liveStarted = false;
+  try {
+    await watch(
+      {
+        subscribe: (onEvent, onError, onConnected) => {
+          const unsubscribe = socketClient.subscribe(
+            ACTIVITY_EVENT_SUBSCRIPTION,
+            { projectId, input: subscriptionVars },
+            {
+              onStart: onConnected,
+              onResult: (result) => {
+                const event = result.data?.activityEventReceived;
+                if (event) onEvent(event);
+              },
+              onError,
+              onAbort: onError
+            }
+          );
+          return { unsubscribe };
+        },
+        poll: async (since) => {
+          return client.projectEvents(projectId, followPollInput(input, since));
+        },
+        pollIntervalMs: FOLLOW_POLL_INTERVAL_MS,
+        initialSince,
+        getId: (event) => event.id,
+        getCursor: (event) => event.occurredAt,
+        seenIdLimit: 1e3
+      },
+      {
         onEvent: (event) => {
-          if (seenIds2.has(event.id)) {
-            return;
+          if (!liveStarted) {
+            liveStarted = true;
           }
           console.log(formatEvent(event));
-          seenIds2.add(event.id);
-          seenOrder2.push(event.id);
-          trimSeenIds(seenIds2, seenOrder2);
         },
-        onConnected: () => {
-          console.log(chalk11.green("  \u25CF Connected \u2014 tailing live events\n"));
-          void drainFollowEvents(
-            client,
-            projectId,
-            input,
-            followStartedAt,
-            seenIds2,
-            seenOrder2
-          ).then(({ events }) => {
-            for (const event of events) {
-              console.log(formatEvent(event));
-            }
-          }).catch((error) => {
-            console.error(chalk11.red(`
-  Connection error: ${error.message}`));
-            removeSigintHandler2();
-            disconnect?.();
-            reject(error);
-          });
+        onConnected: (mode) => {
+          if (mode === "subscription") {
+            console.log(chalk12.green("  \u25CF Connected \u2014 tailing live events\n"));
+          } else {
+            console.log(
+              chalk12.green(
+                "  \u25CF Connected \u2014 polling for live events with your authenticated session\n"
+              )
+            );
+          }
         },
-        onError: (error) => {
-          console.error(chalk11.red(`
-  Connection error: ${error.message}`));
-          removeSigintHandler2();
-          disconnect?.();
-          reject(error);
+        onError: (err) => {
+          console.error(chalk12.red(`
+  Connection error: ${err.message}`));
         }
-      });
-    });
-  }
-  console.log(
-    chalk11.green("  \u25CF Connected \u2014 polling for live events with your authenticated session\n")
-  );
-  const seenIds = new Set(initialEvents.map((event) => event.id));
-  const seenOrder = initialEvents.map((event) => event.id);
-  let since = latestOccurredAt(initialEvents, followStartedAt);
-  const removeSigintHandler = installSigintHandler(() => {
-  });
-  try {
-    for (; ; ) {
-      const batch = await drainFollowEvents(
-        client,
-        projectId,
-        input,
-        since,
-        seenIds,
-        seenOrder
-      );
-      const nextEvents = batch.events;
-      for (const event of nextEvents) {
-        console.log(formatEvent(event));
-      }
-      if (nextEvents.length > 0) {
-        since = batch.since;
       }
-      await wait(FOLLOW_POLL_INTERVAL_MS);
-    }
+    );
+    console.log(chalk12.gray("\n  Disconnected."));
   } finally {
-    removeSigintHandler();
+    socketClient.close();
   }
 }
 function parseSince(value) {
@@ -4997,16 +6371,20 @@ async function signalEmitCommand(name, options) {
   try {
     const config = await loadConfig({ projectId: options.projectId });
     const client = createClient(config);
-    const signal = normalizeRuntimeSignalName2(name);
+    const signal = normalizeRuntimeSignalName(name);
     if (!signal) {
       throw new ConfigError(
         "signal name must be a bare event name like smoke.start or use the signal: namespace"
       );
     }
+    if (!options.principalId || options.principalId.trim() === "") {
+      throw new ConfigError("signals emit requires --principal-id <id>");
+    }
     const payload = parseJsonObject(options.payload, "payload");
     const metadata = parseJsonObject(options.metadata, "metadata");
     const event = await client.emitSignal({
       signal,
+      principalId: options.principalId,
       payload,
       metadata,
       correlationId: options.correlationId,
@@ -5018,18 +6396,266 @@ async function signalEmitCommand(name, options) {
       console.log(JSON.stringify(event, null, 2));
       return;
     }
-    console.log(chalk11.green(`\u2713 Emitted ${event.name}`));
-    console.log(chalk11.gray(`  Event:    ${event.id}`));
-    console.log(chalk11.gray(`  Project:  ${event.projectId}`));
+    console.log(chalk12.green(`\u2713 Emitted ${event.name}`));
+    console.log(chalk12.gray(`  Event:    ${event.id}`));
+    console.log(chalk12.gray(`  Project:  ${event.projectId}`));
     if (event.dispatchStatus) {
-      console.log(chalk11.gray(`  Dispatch: ${event.dispatchStatus}`));
+      console.log(chalk12.gray(`  Dispatch: ${event.dispatchStatus}`));
     }
     if (event.occurredAt) {
-      console.log(chalk11.gray(`  At:       ${event.occurredAt}`));
+      console.log(chalk12.gray(`  At:       ${event.occurredAt}`));
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      console.error(chalk12.red(err.message));
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+var POLL_INTERVAL_MS = 2e3;
+var POLL_BATCH_LIMIT = 200;
+function formatEvent2(event) {
+  const time = new Date(event.occurredAt).toLocaleTimeString("en-GB", {
+    hour12: false
+  });
+  const status = inferActivityEventStatus(event);
+  const category = inferActivityEventCategory(event);
+  const name = inferActivityEventName(event);
+  const detail = inferActivityEventDetail(event) ?? "";
+  return `  ${chalk12.gray(time)}  ${chalk12.cyan(category)}  ${name}${detail ? `  ${chalk12.gray(detail)}` : ""}${status ? `  ${chalk12.gray(`(${status})`)}` : ""}`;
+}
+async function reconcileCommand(options) {
+  try {
+    const config = await loadConfig();
+    const client = createClient(config);
+    const projectId = options.projectId ?? client.projectId();
+    console.log(chalk12.gray(`Requesting reconciliation for project ${projectId}\u2026`));
+    const accepted = await client.reconcileProject(projectId);
+    if (!accepted) {
+      throw new CliError(
+        "Runtime rejected the reconcile request.",
+        "RECONCILE_REJECTED"
+      );
+    }
+    console.log(chalk12.green("\u2713 Reconcile requested."));
+    if (!options.watch) {
+      return;
+    }
+    const creds = await loadCredentials();
+    if (!creds?.token) {
+      throw new ConfigError("Not authenticated. Run `io login` first.");
+    }
+    console.log(
+      chalk12.gray("\nTailing activity for this project (Ctrl+C to stop)\u2026\n")
+    );
+    const socketClient = createSocketClient({
+      apiUrl: config.apiUrl,
+      credentials: creds
+    });
+    const initialSince = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      await watch(
+        {
+          subscribe: (onEvent, onError, onConnected) => {
+            const unsubscribe = socketClient.subscribe(
+              ACTIVITY_EVENT_SUBSCRIPTION,
+              { projectId, input: { limit: POLL_BATCH_LIMIT } },
+              {
+                onStart: onConnected,
+                onResult: (result) => {
+                  const event = result.data?.activityEventReceived;
+                  if (event) onEvent(event);
+                },
+                onError,
+                onAbort: onError
+              }
+            );
+            return { unsubscribe };
+          },
+          poll: async (since) => {
+            return client.projectEvents(projectId, {
+              since,
+              limit: POLL_BATCH_LIMIT
+            });
+          },
+          pollIntervalMs: POLL_INTERVAL_MS,
+          initialSince,
+          getId: (event) => event.id,
+          getCursor: (event) => event.occurredAt
+        },
+        {
+          onEvent: (event) => console.log(formatEvent2(event)),
+          onConnected: (mode) => {
+            if (mode === "subscription") {
+              console.log(chalk12.green("  \u25CF Connected \u2014 tailing live events\n"));
+            } else {
+              console.log(
+                chalk12.green(
+                  "  \u25CF Connected \u2014 polling for live events with your authenticated session\n"
+                )
+              );
+            }
+          }
+        }
+      );
+      console.log(chalk12.gray("\nDisconnected."));
+    } finally {
+      socketClient.close();
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      console.error(chalk12.red(err.message));
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+function isRecord4(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isCatalogShape2(value) {
+  if (!isRecord4(value)) return false;
+  return value.contract_version === "io.invocation.v2" && value.snapshot_version === "io_runtime.snapshot.v2" && typeof value.catalog_hash === "string" && isRecord4(value.resources) && isRecord4(value.signals) && isRecord4(value.tools) && isRecord4(value.schemas);
+}
+async function readLocalCatalog(buildDir) {
+  const path = resolve(process.cwd(), buildDir, "catalog.json");
+  let raw;
+  try {
+    raw = await readFile(path, "utf-8");
+  } catch (err) {
+    if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      throw new CliError(
+        `Local catalog not found at ${path}. Run \`io build\` or \`io deploy\` first.`,
+        "CATALOG_NOT_FOUND"
+      );
+    }
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new CliError(
+      `Local catalog at ${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+      "CATALOG_INVALID_JSON"
+    );
+  }
+  if (!isCatalogShape2(parsed)) {
+    throw new CliError(
+      `Local catalog at ${path} does not match the io.invocation.v2 catalog shape.`,
+      "CATALOG_SHAPE_MISMATCH"
+    );
+  }
+  return parsed;
+}
+function describeExecutor(executor) {
+  switch (executor.kind) {
+    case "platform_tool":
+      return `${executor.provider_kind}.${executor.backend_kind}.${executor.operation}`;
+    case "stream_publish":
+      return `${executor.provider_kind}.${executor.backend_kind} \u2192 ${executor.destination_ref.slice(0, 19)}\u2026`;
+    case "webhook_response":
+      return "webhook response";
+    case "http_request":
+      return `${executor.method} ${executor.url}`;
+    case "graphql_request":
+      return `POST ${executor.endpoint}${executor.operation_name ? ` (${executor.operation_name})` : ""}`;
+    case "http_operation":
+      return `${executor.method} ${executor.base_url}${executor.path}`;
+    case "graphql_operation":
+      return `POST ${executor.endpoint}${executor.operation_name ? ` (${executor.operation_name})` : ""}`;
+    case "unsupported":
+      return chalk12.red(`unsupported (${executor.reason})`);
+  }
+}
+function formatCatalog(catalog2, label) {
+  const lines = [];
+  lines.push(chalk12.bold(`
+Catalog (${label})`));
+  lines.push(
+    `  ${chalk12.gray("contract_version:")} ${catalog2.contract_version}`
+  );
+  lines.push(
+    `  ${chalk12.gray("snapshot_version:")} ${catalog2.snapshot_version}`
+  );
+  lines.push(`  ${chalk12.gray("catalog_hash:    ")} ${catalog2.catalog_hash}`);
+  lines.push("");
+  lines.push(chalk12.bold("  Counts"));
+  lines.push(`    resources: ${Object.keys(catalog2.resources).length}`);
+  lines.push(`    signals:   ${Object.keys(catalog2.signals).length}`);
+  lines.push(`    tools:     ${Object.keys(catalog2.tools).length}`);
+  lines.push(`    schemas:   ${Object.keys(catalog2.schemas).length}`);
+  const resourceIds = Object.keys(catalog2.resources).sort();
+  if (resourceIds.length > 0) {
+    lines.push("");
+    lines.push(chalk12.bold("  Resources"));
+    for (const id of resourceIds) {
+      const resource = catalog2.resources[id];
+      lines.push(
+        `  ${chalk12.cyan(resource.id)}  ${chalk12.gray(
+          `${resource.resource_kind}/${resource.backend_kind}  scope=${resource.binding_scope}  cred=${resource.credential_source}`
+        )}`
+      );
+      for (const signalId of resource.signals) {
+        const signal = catalog2.signals[signalId];
+        if (!signal) continue;
+        lines.push(
+          `    ${chalk12.magenta("signal")}  ${signal.name}  ${chalk12.gray(
+            `(${signal.mode}, scope=${signal.scope})`
+          )}`
+        );
+      }
+      for (const toolId of resource.tools) {
+        const tool = catalog2.tools[toolId];
+        if (!tool) continue;
+        lines.push(
+          `    ${chalk12.yellow("tool  ")}  ${tool.name}  ${chalk12.gray(
+            `(${tool.effect}, audit=${tool.audit_requirement})  ${describeExecutor(tool.executor)}`
+          )}`
+        );
+      }
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function catalogShowCommand(options) {
+  try {
+    let catalog2;
+    let label;
+    if (options.remote) {
+      const config = await loadConfig();
+      if (!config.apiUrl || !config.projectId) {
+        throw new CliError(
+          "No apiUrl or projectId configured. Run `io login` and set a project first.",
+          "CONFIG_MISSING"
+        );
+      }
+      const client = createClient(config);
+      const remote = await client.fetchRemoteCatalog(client.projectId());
+      if (!remote) {
+        console.log(
+          chalk12.gray("No active deployment catalog for this project yet.")
+        );
+        return;
+      }
+      catalog2 = remote;
+      label = `remote: project ${client.projectId()}`;
+    } else {
+      const buildDir = options.buildDir ?? ".io";
+      catalog2 = await readLocalCatalog(buildDir);
+      label = `local: ${join(buildDir, "catalog.json")}`;
+    }
+    if (options.json) {
+      process.stdout.write(stableStringify(catalog2, 2));
+      process.stdout.write("\n");
+      return;
     }
+    process.stdout.write(formatCatalog(catalog2, label));
   } catch (err) {
     if (err instanceof CliError) {
-      console.error(chalk11.red(err.message));
+      console.error(chalk12.red(err.message));
       process.exit(1);
     }
     throw err;
@@ -5038,24 +6664,33 @@ async function signalEmitCommand(name, options) {
 
 // src/index.ts
 var program = new Command();
-program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.14");
+program.name("io").description("IO CLI \u2014 build and deploy behaviors").version("0.1.16");
 program.command("init").description("Initialize io.config.json for the current project").option("--yes", "Overwrite existing config without prompting").action(initCommand);
 program.command("build").description("Build behaviors from the io/ directory").option("--dir <path>", "Source directory", "io").option("--minify", "Minify bundles", false).action(buildCommand);
-program.command("deploy").description("Build and package for deployment").option("--dir <path>", "Source directory", "io").option("--no-minify", "Skip minification").option("--yes", "Skip confirmation prompt").action(deployCommand);
+program.command("deploy").description("Build and package for deployment").option("--dir <path>", "Source directory", "io").option("--no-minify", "Skip minification").option("--yes", "Skip confirmation prompt").option("--watch", "Tail deployment status until it reaches a terminal state").action(deployCommand);
 program.command("login").description("Authenticate with the IO platform").option("--token <value>", "API token for CI/CD environments").action(loginCommand);
 program.command("logout").description("Remove stored credentials").action(logoutCommand);
 program.command("whoami").description("Show current authentication status").action(whoamiCommand);
 var projects = program.command("projects").description("Manage projects");
 projects.command("list").description("List all projects").action(projectsListCommand);
 projects.command("create <name>").description("Create a new project").action(projectsCreateCommand);
+projects.command("delete <id>").description("Delete a project (requires typing the project name)").option("--yes", "Skip the name confirmation prompt").option("--organization-id <id>", "Organization that owns the project").action(projectsDeleteCommand);
 var secrets = program.command("secrets").description("Manage project secrets");
 secrets.command("set <name> <value>").description("Set a secret value").option("--target <targets...>", "Restrict to specific targets").action(secretsSetCommand);
 secrets.command("list").description("List all secrets").action(secretsListCommand);
 secrets.command("remove <name>").description("Remove a secret").action(secretsRemoveCommand);
+var principals = program.command("principals").description("Manage project principals");
+principals.command("list").description("List principals in the active project").option("--project-id <id>", "Override the configured project ID").action(principalsListCommand);
+principals.command("create <external-id>").description("Create a principal in the active project").option("--project-id <id>", "Override the configured project ID").option("--state <state>", "Principal state: active, inactive, or archived").option("--metadata <json>", "Principal metadata as a JSON object").action(principalsCreateCommand);
+principals.command("update <id>").description("Update a principal").option("--project-id <id>", "Override the configured project ID").option("--external-id <external-id>", "Replace the external ID").option("--state <state>", "Principal state: active, inactive, or archived").option("--metadata <json>", "Replace principal metadata with a JSON object").action(principalsUpdateCommand);
+principals.command("delete <id>").description("Delete a principal").option("--project-id <id>", "Override the configured project ID").action(principalsDeleteCommand);
 var signals = program.command("signals").description("Emit runtime signals");
-signals.command("emit <name>").description("Emit a signal into the active project's event stream").option("--payload <json>", "Signal payload as a JSON object", "{}").option("--metadata <json>", "Signal metadata as a JSON object", "{}").option("--project-id <id>", "Override the configured project ID").option("--correlation-id <id>", "Correlation ID to attach to the signal").option("--causation-id <id>", "Causation ID to attach to the signal").option("--idempotency-key <key>", "Optional idempotency key").option("--source-name <name>", "Optional source name for the emitted signal").option("--json", "Print the raw emitted event as JSON", false).action(signalEmitCommand);
+signals.command("emit <name>").description("Emit a signal into the active project's event stream").option("--payload <json>", "Signal payload as a JSON object", "{}").option("--metadata <json>", "Signal metadata as a JSON object", "{}").option("--project-id <id>", "Override the configured project ID").requiredOption("--principal-id <id>", "Project principal ID for the emitted signal").option("--correlation-id <id>", "Correlation ID to attach to the signal").option("--causation-id <id>", "Causation ID to attach to the signal").option("--idempotency-key <key>", "Optional idempotency key").option("--source-name <name>", "Optional source name for the emitted signal").option("--json", "Print the raw emitted event as JSON", false).action(signalEmitCommand);
 program.command("quota").description("Show current quota usage for the active organization").action(quotaCommand);
 program.command("logs").description("Show recent activity events").option("--limit <count>", "Number of events to show", "50").option("--type <types...>", "Filter by event types").option("--since <duration>", "Show events since (e.g. 15m, 1h, 7d)").option("--follow", "Tail events in real-time").action(logsCommand);
+program.command("reconcile").description("Force runtime to reconcile resources for the active project").option("--project-id <id>", "Override the configured project ID").option("--watch", "Tail activity events after the reconcile request").action(reconcileCommand);
+var catalog = program.command("catalog").description("Inspect the v2 deployment catalog");
+catalog.command("show").description("Print the local or remote deployment catalog").option("--remote", "Show the active deployment catalog from runtime").option("--json", "Print the raw catalog JSON").option("--build-dir <path>", "Local build directory", ".io").action(catalogShowCommand);
 program.parse();
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map