@calimero-network/registry-cli 1.10.0 → 1.11.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import chalk6 from 'chalk';
+import chalk7 from 'chalk';
 import { createRequire } from 'module';
-import ora6 from 'ora';
+import ora7 from 'ora';
 import { table } from 'table';
 import axios from 'axios';
 import fs9, { existsSync, writeFileSync } from 'fs';
@@ -12,6 +12,9 @@ import crypto from 'crypto';
 import fastify from 'fastify';
 import cors from '@fastify/cors';
 import * as tar from 'tar';
+import * as ed25519 from '@noble/ed25519';
+import canonicalize from 'canonicalize';
+import bs58 from 'bs58';
 
 var CalimeroRegistryClient = class {
   /**
@@ -1039,14 +1042,14 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
       globalOpts?.url,
       parseInt(globalOpts?.timeout || "10000")
     );
-    const spinner2 = ora6("Fetching applications...").start();
+    const spinner2 = ora7("Fetching applications...").start();
     try {
       const apps = await client.getApps({
         name: options.name
       });
       spinner2.succeed(`Found ${apps.length} application(s)`);
       if (apps.length === 0) {
-        console.log(chalk6.yellow("No applications found"));
+        console.log(chalk7.yellow("No applications found"));
         return;
       }
       const tableData = [
@@ -1063,7 +1066,7 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
     } catch (error) {
       spinner2.fail("Failed to fetch applications");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1077,12 +1080,12 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
       globalOpts?.url,
       parseInt(globalOpts?.timeout || "10000")
     );
-    const spinner2 = ora6(`Fetching versions for ${appId}...`).start();
+    const spinner2 = ora7(`Fetching versions for ${appId}...`).start();
     try {
       const versions = await client.getAppVersions(appId);
       spinner2.succeed(`Found ${versions.length} version(s)`);
       if (versions.length === 0) {
-        console.log(chalk6.yellow("No versions found"));
+        console.log(chalk7.yellow("No versions found"));
         return;
       }
       const tableData = [
@@ -1090,14 +1093,14 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
         ...versions.map((version2) => [
           version2.semver,
           version2.cid.substring(0, 12) + "...",
-          version2.yanked ? chalk6.red("Yes") : chalk6.green("No")
+          version2.yanked ? chalk7.red("Yes") : chalk7.green("No")
         ])
       ];
       console.log(table(tableData));
     } catch (error) {
       spinner2.fail("Failed to fetch versions");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1111,18 +1114,18 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
       globalOpts?.url,
       parseInt(globalOpts?.timeout || "10000")
     );
-    const spinner2 = ora6(
+    const spinner2 = ora7(
       `Fetching manifest for ${appId}@${version2}...`
     ).start();
     try {
       const manifest = await client.getAppManifest(appId, version2);
       spinner2.succeed("Manifest fetched successfully");
-      console.log(chalk6.blue("\nApplication Manifest:"));
+      console.log(chalk7.blue("\nApplication Manifest:"));
       console.log(JSON.stringify(manifest, null, 2));
     } catch (error) {
       spinner2.fail("Failed to fetch manifest");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1136,12 +1139,12 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
       globalOpts?.url,
       parseInt(globalOpts?.timeout || "10000")
     );
-    const spinner2 = ora6("Reading manifest file...").start();
+    const spinner2 = ora7("Reading manifest file...").start();
     try {
       const manifestPath = path7.resolve(manifestFile);
       if (!fs9.existsSync(manifestPath)) {
         spinner2.fail("Manifest file not found");
-        console.error(chalk6.red(`File not found: ${manifestFile}`));
+        console.error(chalk7.red(`File not found: ${manifestFile}`));
         process.exit(1);
       }
       const manifestContent = fs9.readFileSync(manifestPath, "utf8");
@@ -1149,20 +1152,20 @@ var appsCommand = new Command("apps").description("Manage self-sovereign applica
       spinner2.text = "Submitting application manifest...";
       const result = await client.submitAppManifest(manifest);
       spinner2.succeed("Application submitted successfully");
-      console.log(chalk6.green(`
+      console.log(chalk7.green(`
 \u2705 ${result.message}`));
       if (manifest.app?.name) {
-        console.log(chalk6.blue(`
+        console.log(chalk7.blue(`
 \u{1F4F1} App: ${manifest.app.name}`));
         console.log(
-          chalk6.blue(`\u{1F464} Developer: ${manifest.app.developer_pubkey}`)
+          chalk7.blue(`\u{1F464} Developer: ${manifest.app.developer_pubkey}`)
         );
-        console.log(chalk6.blue(`\u{1F4E6} Version: ${manifest.version?.semver}`));
+        console.log(chalk7.blue(`\u{1F4E6} Version: ${manifest.version?.semver}`));
       }
     } catch (error) {
       spinner2.fail("Failed to submit application");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1175,33 +1178,33 @@ var developersCommand = new Command("developers").description("Manage developer
       baseURL: globalOpts?.url || "http://localhost:8082",
       timeout: parseInt(globalOpts?.timeout || "10000")
     });
-    const spinner2 = ora6("Fetching developer profile...").start();
+    const spinner2 = ora7("Fetching developer profile...").start();
     try {
       const profile = await client.getDeveloper(pubkey);
       spinner2.succeed("Developer profile fetched successfully");
-      console.log(chalk6.blue("\nDeveloper Profile:"));
-      console.log(chalk6.green("Display Name:"), profile.display_name);
+      console.log(chalk7.blue("\nDeveloper Profile:"));
+      console.log(chalk7.green("Display Name:"), profile.display_name);
       if (profile.website) {
-        console.log(chalk6.green("Website:"), profile.website);
+        console.log(chalk7.green("Website:"), profile.website);
       }
       if (profile.proofs.length > 0) {
-        console.log(chalk6.green("\nProofs:"));
+        console.log(chalk7.green("\nProofs:"));
         const tableData = [
           ["Type", "Value", "Verified"],
           ...profile.proofs.map((proof) => [
             proof.type,
             proof.value.substring(0, 20) + "...",
-            proof.verified ? chalk6.green("Yes") : chalk6.red("No")
+            proof.verified ? chalk7.green("Yes") : chalk7.red("No")
           ])
         ];
         console.log(table(tableData));
       } else {
-        console.log(chalk6.yellow("\nNo proofs found"));
+        console.log(chalk7.yellow("\nNo proofs found"));
       }
     } catch (error) {
       spinner2.fail("Failed to fetch developer profile");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1213,7 +1216,7 @@ var developersCommand = new Command("developers").description("Manage developer
       baseURL: globalOpts?.url || "http://localhost:8082",
       timeout: parseInt(globalOpts?.timeout || "10000")
     });
-    const spinner2 = ora6("Creating developer profile...").start();
+    const spinner2 = ora7("Creating developer profile...").start();
     try {
       let proofs = [];
       if (options.proofs) {
@@ -1221,7 +1224,7 @@ var developersCommand = new Command("developers").description("Manage developer
           proofs = JSON.parse(options.proofs);
         } catch {
           spinner2.fail("Invalid proofs JSON format");
-          console.error(chalk6.red("Proofs must be a valid JSON array"));
+          console.error(chalk7.red("Proofs must be a valid JSON array"));
           process.exit(1);
         }
       }
@@ -1233,18 +1236,18 @@ var developersCommand = new Command("developers").description("Manage developer
       };
       const result = await client.submitDeveloperProfile(pubkey, profile);
       spinner2.succeed("Developer profile created successfully");
-      console.log(chalk6.green(`
+      console.log(chalk7.green(`
 \u2705 ${result.message}`));
-      console.log(chalk6.blue(`
+      console.log(chalk7.blue(`
 \u{1F464} Developer: ${displayName}`));
-      console.log(chalk6.blue(`\u{1F511} Public Key: ${pubkey}`));
+      console.log(chalk7.blue(`\u{1F511} Public Key: ${pubkey}`));
       if (options.website) {
-        console.log(chalk6.blue(`\u{1F310} Website: ${options.website}`));
+        console.log(chalk7.blue(`\u{1F310} Website: ${options.website}`));
       }
     } catch (error) {
       spinner2.fail("Failed to create developer profile");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1257,7 +1260,7 @@ var attestationsCommand = new Command("attestations").description("Manage applic
       baseURL: globalOpts?.url || "http://localhost:8082",
       timeout: parseInt(globalOpts?.timeout || "10000")
     });
-    const spinner2 = ora6(
+    const spinner2 = ora7(
       `Fetching attestation for ${name}@${version2}...`
     ).start();
     try {
@@ -1267,16 +1270,16 @@ var attestationsCommand = new Command("attestations").description("Manage applic
         version2
       );
       spinner2.succeed("Attestation fetched successfully");
-      console.log(chalk6.blue("\nAttestation:"));
-      console.log(chalk6.green("Status:"), attestation.status);
-      console.log(chalk6.green("Timestamp:"), attestation.timestamp);
+      console.log(chalk7.blue("\nAttestation:"));
+      console.log(chalk7.green("Status:"), attestation.status);
+      console.log(chalk7.green("Timestamp:"), attestation.timestamp);
       if (attestation.comment) {
-        console.log(chalk6.green("Comment:"), attestation.comment);
+        console.log(chalk7.green("Comment:"), attestation.comment);
       }
     } catch (error) {
       spinner2.fail("Failed to fetch attestation");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1290,15 +1293,15 @@ var healthCommand = new Command("health").description("Check the health of the C
     globalOpts?.url,
     parseInt(globalOpts?.timeout || "10000")
   );
-  const spinner2 = ora6("Checking API health...").start();
+  const spinner2 = ora7("Checking API health...").start();
   try {
     const health = await client.healthCheck();
     spinner2.succeed("API is healthy");
-    console.log(chalk6.green(`Status: ${health.status}`));
+    console.log(chalk7.green(`Status: ${health.status}`));
   } catch (error) {
     spinner2.fail("API health check failed");
     if (error instanceof Error) {
-      console.error(chalk6.red(`Error: ${error.message}`));
+      console.error(chalk7.red(`Error: ${error.message}`));
     }
     process.exit(1);
   }
@@ -1333,7 +1336,7 @@ This is a demo file that would normally contain the actual application data.`;
     );
   }
 }
-var spinner = (text) => ora6(text);
+var spinner = (text) => ora7(text);
 
 // src/commands/ipfs.ts
 var ipfsCommand = new Command("ipfs").description("IPFS operations").addCommand(
@@ -1585,7 +1588,7 @@ localCommand.addCommand(
     "Public host exposed in manifest artifact URLs",
     "host.docker.internal"
   ).action(async (options) => {
-    const spinner2 = ora6("Starting local registry...").start();
+    const spinner2 = ora7("Starting local registry...").start();
     try {
       const config = new LocalConfig();
       config.setHost(options.host);
@@ -1596,37 +1599,37 @@ localCommand.addCommand(
       spinner2.succeed(
         `Local registry started on http://${config.getHost()}:${config.getPort()}`
       );
-      console.log(chalk6.blue("\n\u{1F4F1} Local Registry Status:"));
+      console.log(chalk7.blue("\n\u{1F4F1} Local Registry Status:"));
       console.log(
-        chalk6.green(
+        chalk7.green(
           `\u2705 Server: http://${config.getHost()}:${config.getPort()}`
         )
       );
       console.log(
-        chalk6.green(
+        chalk7.green(
           `\u{1F310} Public URL: http://${config.getPublicHost()}:${config.getPort()}`
         )
       );
-      console.log(chalk6.green(`\u{1F4C1} Data: ${config.getDataDir()}`));
+      console.log(chalk7.green(`\u{1F4C1} Data: ${config.getDataDir()}`));
       console.log(
-        chalk6.green(
+        chalk7.green(
           `\u{1F4CB} Health: http://${config.getHost()}:${config.getPort()}/healthz`
         )
       );
       console.log(
-        chalk6.green(
+        chalk7.green(
           `\u{1F4CA} Stats: http://${config.getHost()}:${config.getPort()}/stats`
         )
       );
       console.log(
-        chalk6.blue(
+        chalk7.blue(
           "\n\u{1F4A1} Use --local flag with other commands to use local registry"
         )
       );
     } catch (error) {
       spinner2.fail("Failed to start local registry");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1634,7 +1637,7 @@ localCommand.addCommand(
 );
 localCommand.addCommand(
   new Command("stop").description("Stop local registry server").action(async () => {
-    const spinner2 = ora6("Stopping local registry...").start();
+    const spinner2 = ora7("Stopping local registry...").start();
     try {
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
@@ -1643,7 +1646,7 @@ localCommand.addCommand(
     } catch (error) {
       spinner2.fail("Failed to stop local registry");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1651,23 +1654,23 @@ localCommand.addCommand(
 );
 localCommand.addCommand(
   new Command("status").description("Check local registry status").action(async () => {
-    const spinner2 = ora6("Checking local registry status...").start();
+    const spinner2 = ora7("Checking local registry status...").start();
     try {
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
       const status = await server.getStatus();
       if (status.running) {
         spinner2.succeed("Local registry is running");
-        console.log(chalk6.green(`\u2705 Server: ${status.url}`));
-        console.log(chalk6.green(`\u{1F4C1} Data: ${status.dataDir}`));
-        console.log(chalk6.green(`\u{1F4CA} Apps: ${status.appsCount} applications`));
+        console.log(chalk7.green(`\u2705 Server: ${status.url}`));
+        console.log(chalk7.green(`\u{1F4C1} Data: ${status.dataDir}`));
+        console.log(chalk7.green(`\u{1F4CA} Apps: ${status.appsCount} applications`));
         console.log(
-          chalk6.green(`\u{1F4E6} Artifacts: ${status.artifactsCount} artifacts`)
+          chalk7.green(`\u{1F4E6} Artifacts: ${status.artifactsCount} artifacts`)
         );
       } else {
         spinner2.warn("Local registry is not running");
         console.log(
-          chalk6.yellow(
+          chalk7.yellow(
             '\u{1F4A1} Run "calimero-registry local start" to start the local registry'
           )
         );
@@ -1675,7 +1678,7 @@ localCommand.addCommand(
     } catch (error) {
       spinner2.fail("Failed to check local registry status");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1685,22 +1688,22 @@ localCommand.addCommand(
   new Command("reset").description("Reset local registry data").option("-f, --force", "Force reset without confirmation").action(async (options) => {
     if (!options.force) {
       console.log(
-        chalk6.yellow("\u26A0\uFE0F  This will delete all local registry data!")
+        chalk7.yellow("\u26A0\uFE0F  This will delete all local registry data!")
       );
-      console.log(chalk6.yellow("   Use --force flag to confirm"));
+      console.log(chalk7.yellow("   Use --force flag to confirm"));
       return;
     }
-    const spinner2 = ora6("Resetting local registry data...").start();
+    const spinner2 = ora7("Resetting local registry data...").start();
     try {
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
       await server.reset();
       spinner2.succeed("Local registry data reset");
-      console.log(chalk6.green("\u2705 All local data has been cleared"));
+      console.log(chalk7.green("\u2705 All local data has been cleared"));
     } catch (error) {
       spinner2.fail("Failed to reset local registry data");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1708,17 +1711,17 @@ localCommand.addCommand(
 );
 localCommand.addCommand(
   new Command("backup").description("Backup local registry data").option("-o, --output <file>", "Output file path").action(async (options) => {
-    const spinner2 = ora6("Creating backup...").start();
+    const spinner2 = ora7("Creating backup...").start();
     try {
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
       const backupPath = await server.backup(options.output);
       spinner2.succeed("Backup created successfully");
-      console.log(chalk6.green(`\u{1F4E6} Backup saved to: ${backupPath}`));
+      console.log(chalk7.green(`\u{1F4E6} Backup saved to: ${backupPath}`));
     } catch (error) {
       spinner2.fail("Failed to create backup");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1726,22 +1729,22 @@ localCommand.addCommand(
 );
 localCommand.addCommand(
   new Command("restore").description("Restore local registry data from backup").argument("<backup-file>", "Path to backup file").action(async (backupFile) => {
-    const spinner2 = ora6("Restoring from backup...").start();
+    const spinner2 = ora7("Restoring from backup...").start();
     try {
       if (!fs9.existsSync(backupFile)) {
         spinner2.fail("Backup file not found");
-        console.error(chalk6.red(`File not found: ${backupFile}`));
+        console.error(chalk7.red(`File not found: ${backupFile}`));
         process.exit(1);
       }
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
       await server.restore(backupFile);
       spinner2.succeed("Data restored successfully");
-      console.log(chalk6.green(`\u2705 Restored from: ${backupFile}`));
+      console.log(chalk7.green(`\u2705 Restored from: ${backupFile}`));
     } catch (error) {
       spinner2.fail("Failed to restore from backup");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -1749,24 +1752,24 @@ localCommand.addCommand(
 );
 localCommand.addCommand(
   new Command("seed").description("Seed local registry with sample data").action(async () => {
-    const spinner2 = ora6("Seeding local registry with sample data...").start();
+    const spinner2 = ora7("Seeding local registry with sample data...").start();
     try {
       const config = new LocalConfig();
       const server = new LocalRegistryServer(config);
       await server.seed();
       spinner2.succeed("Sample data seeded successfully");
       console.log(
-        chalk6.green("\u2705 Local registry populated with sample applications")
+        chalk7.green("\u2705 Local registry populated with sample applications")
       );
       console.log(
-        chalk6.blue(
+        chalk7.blue(
           '\u{1F4A1} Run "calimero-registry apps list --local" to see the sample apps'
         )
       );
     } catch (error) {
       spinner2.fail("Failed to seed sample data");
       if (error instanceof Error) {
-        console.error(chalk6.red(`Error: ${error.message}`));
+        console.error(chalk7.red(`Error: ${error.message}`));
       }
       process.exit(1);
     }
@@ -2101,65 +2104,33 @@ Note:
         links: Object.keys(links).length > 0 ? links : void 0,
         signature: void 0
       };
-      let outputPath = finalOutput;
-      if (!outputPath) {
-        const outputDir = path7.join(
-          process.cwd(),
-          finalPackage,
-          finalVersion
-        );
-        if (!fs9.existsSync(outputDir)) {
-          fs9.mkdirSync(outputDir, { recursive: true });
-        }
-        outputPath = path7.join(
-          outputDir,
-          `${finalPackage}-${finalVersion}.mpk`
-        );
-      } else {
-        outputPath = path7.resolve(outputPath);
-        const outputDir = path7.dirname(outputPath);
-        if (!fs9.existsSync(outputDir)) {
-          fs9.mkdirSync(outputDir, { recursive: true });
-        }
+      let outputDir = finalOutput ? path7.resolve(finalOutput) : path7.join(process.cwd(), finalPackage, finalVersion);
+      if (!fs9.existsSync(outputDir)) {
+        fs9.mkdirSync(outputDir, { recursive: true });
       }
-      const tempDir = path7.join(
-        path7.dirname(outputPath),
-        `.temp-bundle-${Date.now()}`
+      fs9.writeFileSync(
+        path7.join(outputDir, "manifest.json"),
+        JSON.stringify(manifest, null, 2)
       );
-      fs9.mkdirSync(tempDir, { recursive: true });
-      try {
-        fs9.writeFileSync(
-          path7.join(tempDir, "manifest.json"),
-          JSON.stringify(manifest, null, 2)
-        );
-        fs9.writeFileSync(path7.join(tempDir, "app.wasm"), wasmContent);
-        const archiveFiles = ["manifest.json", "app.wasm"];
-        if (abiContent) {
-          fs9.writeFileSync(path7.join(tempDir, "abi.json"), abiContent);
-          archiveFiles.push("abi.json");
-        }
-        await tar.create(
-          {
-            gzip: true,
-            file: outputPath,
-            cwd: tempDir
-          },
-          archiveFiles
-        );
-        const outputSize = fs9.statSync(outputPath).size;
-        console.log(`\u2705 Created MPK bundle: ${outputPath}`);
-        console.log(`   Package: ${finalPackage}`);
-        console.log(`   Version: ${finalVersion}`);
-        console.log(`   Size: ${outputSize} bytes`);
-        console.log(`   WASM Hash: ${wasmHash}`);
-        if (abiArtifact) {
-          console.log(`   ABI Hash: ${abiArtifact.hash}`);
-        }
-      } finally {
-        if (fs9.existsSync(tempDir)) {
-          fs9.rmSync(tempDir, { recursive: true, force: true });
-        }
+      fs9.writeFileSync(path7.join(outputDir, "app.wasm"), wasmContent);
+      if (abiContent) {
+        fs9.writeFileSync(path7.join(outputDir, "abi.json"), abiContent);
       }
+      console.log(`\u2705 Bundle files written to: ${outputDir}`);
+      console.log(`   Package: ${finalPackage}`);
+      console.log(`   Version: ${finalVersion}`);
+      console.log(`   WASM Hash: ${wasmHash}`);
+      if (abiArtifact) {
+        console.log(`   ABI Hash: ${abiArtifact.hash}`);
+      }
+      console.log("");
+      console.log("Next steps:");
+      console.log(
+        `  1. Sign the manifest:  mero-sign sign ${path7.join(outputDir, "manifest.json")} --key key.json`
+      );
+      console.log(
+        `  2. Push the bundle:    calimero-registry bundle push ${outputDir} --remote`
+      );
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       console.error("\u274C Failed to create bundle:", message);
@@ -2201,6 +2172,8 @@ Note:
   - Priority: flag > environment variable > config file > default
 `
   ).action(async (bundleFile, options) => {
+    let mpkPath = "";
+    let tempMpk = null;
     try {
       if (!options.remote && (options.url || options.apiKey)) {
         console.warn(
@@ -2227,8 +2200,34 @@ Note:
         console.error(`\u274C File not found: ${bundleFile}`);
         process.exit(1);
       }
-      console.log(`\u{1F4E6} Processing bundle: ${path7.basename(fullPath)}`);
-      const manifest = await extractManifest(fullPath);
+      mpkPath = fullPath;
+      if (fs9.statSync(fullPath).isDirectory()) {
+        const manifestInDir = path7.join(fullPath, "manifest.json");
+        const wasmInDir = path7.join(fullPath, "app.wasm");
+        if (!fs9.existsSync(manifestInDir)) {
+          console.error(
+            `\u274C manifest.json not found in directory: ${fullPath}`
+          );
+          process.exit(1);
+        }
+        if (!fs9.existsSync(wasmInDir)) {
+          console.error(`\u274C app.wasm not found in directory: ${fullPath}`);
+          process.exit(1);
+        }
+        tempMpk = path7.join(fullPath, `.temp-push-${Date.now()}.mpk`);
+        const archiveFiles = ["manifest.json", "app.wasm"];
+        if (fs9.existsSync(path7.join(fullPath, "abi.json"))) {
+          archiveFiles.push("abi.json");
+        }
+        await tar.create(
+          { gzip: true, file: tempMpk, cwd: fullPath },
+          archiveFiles
+        );
+        mpkPath = tempMpk;
+        console.log(`\u{1F4E6} Packed directory into temporary bundle`);
+      }
+      console.log(`\u{1F4E6} Processing bundle: ${path7.basename(mpkPath)}`);
+      const manifest = await extractManifest(mpkPath);
       if (!manifest) {
         console.error("\u274C manifest.json not found in bundle");
         process.exit(1);
@@ -2248,7 +2247,7 @@ Note:
         const artifactServer = new LocalArtifactServer(config, store);
         const bundleFilename = `${manifest.package}-${manifest.appVersion}.mpk`;
         const targetPath = await artifactServer.copyArtifactToLocal(
-          fullPath,
+          mpkPath,
           manifest.package,
           manifest.appVersion,
           bundleFilename
@@ -2267,12 +2266,16 @@ Note:
         const remoteConfig = new RemoteConfig();
         const registryUrl = options.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
         const apiKey = options.apiKey || process.env.CALIMERO_API_KEY || remoteConfig.getApiKey();
-        await pushToRemote(fullPath, manifest, registryUrl, apiKey);
+        await pushToRemote(mpkPath, manifest, registryUrl, apiKey);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       console.error("\u274C Failed to push bundle:", message);
       process.exit(1);
+    } finally {
+      if (tempMpk && fs9.existsSync(tempMpk)) {
+        fs9.rmSync(tempMpk);
+      }
     }
   });
 }
@@ -2638,7 +2641,7 @@ async function extractManifest(bundlePath) {
     await tar.x({
       file: bundlePath,
       cwd: extractDir,
-      filter: (path8) => path8 === "manifest.json"
+      filter: (path9) => path9 === "manifest.json"
     });
     const manifestPath = path7.join(extractDir, "manifest.json");
     if (fs9.existsSync(manifestPath)) {
@@ -2672,29 +2675,29 @@ function createConfigSetCommand() {
         case "url":
           config.setRegistryUrl(value);
           console.log(
-            chalk6.green(`\u2705 Registry URL set to: ${chalk6.bold(value)}`)
+            chalk7.green(`\u2705 Registry URL set to: ${chalk7.bold(value)}`)
           );
           break;
         case "api-key":
         case "apiKey":
           config.setApiKey(value);
-          console.log(chalk6.green("\u2705 API key set successfully"));
+          console.log(chalk7.green("\u2705 API key set successfully"));
           console.log(
-            chalk6.yellow(
+            chalk7.yellow(
               "\u{1F4A1} Note: API key is stored in plain text. Consider using CALIMERO_API_KEY environment variable for better security."
             )
           );
           break;
         default:
-          console.error(chalk6.red(`\u274C Unknown configuration key: ${key}`));
-          console.log(chalk6.blue("\nAvailable keys:"));
+          console.error(chalk7.red(`\u274C Unknown configuration key: ${key}`));
+          console.log(chalk7.blue("\nAvailable keys:"));
           console.log("  registry-url  - Default registry URL");
           console.log("  api-key       - API key for authentication");
           process.exit(1);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(chalk6.red("\u274C Failed to set configuration:"), message);
+      console.error(chalk7.red("\u274C Failed to set configuration:"), message);
       process.exit(1);
     }
   });
@@ -2716,7 +2719,7 @@ function createConfigGetCommand() {
             const masked = apiKey.length > 8 ? `${apiKey.substring(0, 4)}...${apiKey.substring(apiKey.length - 4)}` : "***";
             console.log(masked);
             console.log(
-              chalk6.yellow(
+              chalk7.yellow(
                 '\u{1F4A1} Note: API key is masked. Use "config list" to see source.'
               )
             );
@@ -2726,15 +2729,15 @@ function createConfigGetCommand() {
           break;
         }
         default:
-          console.error(chalk6.red(`\u274C Unknown configuration key: ${key}`));
-          console.log(chalk6.blue("\nAvailable keys:"));
+          console.error(chalk7.red(`\u274C Unknown configuration key: ${key}`));
+          console.log(chalk7.blue("\nAvailable keys:"));
           console.log("  registry-url  - Default registry URL");
           console.log("  api-key       - API key for authentication");
           process.exit(1);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(chalk6.red("\u274C Failed to get configuration:"), message);
+      console.error(chalk7.red("\u274C Failed to get configuration:"), message);
       process.exit(1);
     }
   });
@@ -2743,43 +2746,43 @@ function createConfigListCommand() {
   return new Command("list").description("List all configuration values").alias("ls").action(() => {
     try {
       const config = new RemoteConfig();
-      console.log(chalk6.blue("\n\u{1F4CB} Remote Registry Configuration\n"));
+      console.log(chalk7.blue("\n\u{1F4CB} Remote Registry Configuration\n"));
       const configPath = config.getConfigPath();
       const configFileExists = fs9.existsSync(configPath);
       const url = config.getRegistryUrl();
       let urlSource;
       if (process.env.CALIMERO_REGISTRY_URL) {
-        urlSource = chalk6.yellow("(from CALIMERO_REGISTRY_URL env var)");
+        urlSource = chalk7.yellow("(from CALIMERO_REGISTRY_URL env var)");
       } else if (configFileExists) {
-        urlSource = chalk6.gray("(from config file)");
+        urlSource = chalk7.gray("(from config file)");
       } else {
-        urlSource = chalk6.gray("(default)");
+        urlSource = chalk7.gray("(default)");
       }
-      console.log(`  ${chalk6.bold("Registry URL:")} ${url} ${urlSource}`);
+      console.log(`  ${chalk7.bold("Registry URL:")} ${url} ${urlSource}`);
       const apiKey = config.getApiKey();
       if (apiKey) {
         let apiKeySource;
         if (process.env.CALIMERO_API_KEY) {
-          apiKeySource = chalk6.yellow("(from CALIMERO_API_KEY env var)");
+          apiKeySource = chalk7.yellow("(from CALIMERO_API_KEY env var)");
         } else if (configFileExists) {
-          apiKeySource = chalk6.gray("(from config file)");
+          apiKeySource = chalk7.gray("(from config file)");
         } else {
-          apiKeySource = chalk6.gray("(default)");
+          apiKeySource = chalk7.gray("(default)");
         }
         const masked = apiKey.length > 8 ? `${apiKey.substring(0, 4)}...${apiKey.substring(apiKey.length - 4)}` : "***";
-        console.log(`  ${chalk6.bold("API Key:")} ${masked} ${apiKeySource}`);
+        console.log(`  ${chalk7.bold("API Key:")} ${masked} ${apiKeySource}`);
       } else {
-        console.log(`  ${chalk6.bold("API Key:")} ${chalk6.gray("(not set)")}`);
+        console.log(`  ${chalk7.bold("API Key:")} ${chalk7.gray("(not set)")}`);
       }
-      console.log(chalk6.blue(`
+      console.log(chalk7.blue(`
 \u{1F4C1} Config file: ${configPath}`));
       if (!configFileExists) {
-        console.log(chalk6.gray("   (file does not exist, using defaults)"));
+        console.log(chalk7.gray("   (file does not exist, using defaults)"));
       }
       console.log();
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(chalk6.red("\u274C Failed to list configuration:"), message);
+      console.error(chalk7.red("\u274C Failed to list configuration:"), message);
       process.exit(1);
     }
   });
@@ -2789,10 +2792,10 @@ function createConfigResetCommand() {
     try {
       if (!options.force) {
         console.error(
-          chalk6.red("\u274C Configuration reset requires --force flag")
+          chalk7.red("\u274C Configuration reset requires --force flag")
         );
         console.log(
-          chalk6.yellow(
+          chalk7.yellow(
             "\u26A0\uFE0F  This will reset all configuration to defaults. Use --force to confirm."
           )
         );
@@ -2800,17 +2803,596 @@ function createConfigResetCommand() {
       }
       const config = new RemoteConfig();
       config.reset();
-      console.log(chalk6.green("\u2705 Configuration reset to defaults"));
-      console.log(chalk6.blue("\nDefault values:"));
+      console.log(chalk7.green("\u2705 Configuration reset to defaults"));
+      console.log(chalk7.blue("\nDefault values:"));
       console.log("  Registry URL: https://apps.calimero.network");
       console.log("  API Key: (not set)");
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      console.error(chalk6.red("\u274C Failed to reset configuration:"), message);
+      console.error(chalk7.red("\u274C Failed to reset configuration:"), message);
       process.exit(1);
     }
   });
 }
+var ENV_KEYPAIR = "CALIMERO_REGISTRY_KEYPAIR";
+function base64urlEncode(bytes) {
+  const base64 = Buffer.from(bytes).toString("base64");
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function buildSignedPayload(method, pathname, body) {
+  const bodyObj = body != null && typeof body === "object" ? body : {};
+  const bodyStr = Object.keys(bodyObj).length > 0 ? canonicalize(bodyObj) : "";
+  return `${method}
+${pathname}
+${bodyStr}`;
+}
+function base64urlDecode(str) {
+  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.padEnd(
+    base64.length + (4 - base64.length % 4) % 4,
+    "="
+  );
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+function loadKeypair(options) {
+  if (options?.keypairPath) {
+    const resolved = path7.resolve(options.keypairPath);
+    if (!fs9.existsSync(resolved)) {
+      throw new Error(`Keypair file not found: ${resolved}`);
+    }
+    const raw = fs9.readFileSync(resolved, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.private_key) {
+      const secretKey2 = base64urlDecode(parsed.private_key);
+      const publicKey2 = base64urlDecode(parsed.public_key);
+      if (secretKey2.length !== 32 || publicKey2.length !== 32) {
+        throw new Error(
+          "Invalid key file: private_key and public_key must be 32 bytes each"
+        );
+      }
+      return { publicKey: publicKey2, secretKey: secretKey2 };
+    }
+    if (Array.isArray(parsed) && parsed.length === 64) {
+      const bytes2 = new Uint8Array(parsed);
+      const secretKey2 = bytes2.slice(0, 32);
+      const publicKey2 = bytes2.slice(32, 64);
+      return { publicKey: publicKey2, secretKey: secretKey2 };
+    }
+    throw new Error(
+      "Unrecognised key file format. Expected mero-sign JSON ({ private_key, public_key, signer_id }) or a legacy array of 64 numbers."
+    );
+  }
+  const env = process.env[ENV_KEYPAIR];
+  if (!env || typeof env !== "string" || !env.trim()) {
+    throw new Error(
+      `Missing keypair: set ${ENV_KEYPAIR} (base58 64-byte keypair) or use -k <path>`
+    );
+  }
+  const decoded = bs58.decode(env.trim());
+  if (decoded.length !== 64) {
+    throw new Error(
+      `Invalid keypair: ${ENV_KEYPAIR} must decode to 64 bytes (got ${decoded.length})`
+    );
+  }
+  const bytes = new Uint8Array(decoded);
+  const secretKey = bytes.slice(0, 32);
+  const publicKey = bytes.slice(32, 64);
+  return { publicKey, secretKey };
+}
+async function signPayload(payload, secretKey, publicKey) {
+  const message = new TextEncoder().encode(payload);
+  const signature = await ed25519.signAsync(message, secretKey);
+  return {
+    pubkeyBase64url: base64urlEncode(publicKey),
+    signatureBase64url: base64urlEncode(signature)
+  };
+}
+async function getSignedHeaders(method, pathname, body, keypair) {
+  const payload = buildSignedPayload(method, pathname, body);
+  const { pubkeyBase64url, signatureBase64url } = await signPayload(
+    payload,
+    keypair.secretKey,
+    keypair.publicKey
+  );
+  return {
+    "X-Pubkey": pubkeyBase64url,
+    "X-Signature": signatureBase64url
+  };
+}
+function publicKeyToBase64url(publicKey) {
+  return base64urlEncode(publicKey);
+}
+
+// src/commands/org.ts
+var DEFAULT_TIMEOUT = 1e4;
+function getGlobalOpts(command) {
+  const opts = command.parent?.parent?.opts() ?? {};
+  const remoteConfig = new RemoteConfig();
+  const url = opts.url || process.env.CALIMERO_REGISTRY_URL || remoteConfig.getRegistryUrl();
+  return {
+    url,
+    timeout: parseInt(String(opts.timeout ?? DEFAULT_TIMEOUT), 10) || DEFAULT_TIMEOUT
+  };
+}
+function getKeypairPath(command) {
+  const orgCmd = command.parent?.name() === "org" ? command.parent : command.parent?.parent;
+  return orgCmd?.opts()?.keypair;
+}
+async function fetchJson(url, options = {}) {
+  const { timeout = DEFAULT_TIMEOUT, ...init } = options;
+  const controller = new AbortController();
+  const id = setTimeout(() => controller.abort(), timeout);
+  const res = await fetch(url, {
+    ...init,
+    signal: controller.signal,
+    headers: {
+      "Content-Type": "application/json",
+      ...init.headers
+    }
+  });
+  clearTimeout(id);
+  const text = await res.text();
+  const data = text ? JSON.parse(text) : void 0;
+  return { data, status: res.status };
+}
+var orgCommand = new Command("org").description("Manage organizations (create, list, members, packages)").option(
+  "-k, --keypair <path>",
+  "Path to Ed25519 keypair JSON (64 bytes). Overrides CALIMERO_REGISTRY_KEYPAIR."
+).addCommand(
+  new Command("list").description(
+    "List organizations you belong to (uses keypair pubkey as member)"
+  ).action(async (_options, command) => {
+    const { url, timeout } = getGlobalOpts(command);
+    const keypairPath = getKeypairPath(command);
+    const spinner2 = ora7("Loading keypair...").start();
+    let pubkey;
+    try {
+      const kp = loadKeypair({ keypairPath });
+      pubkey = publicKeyToBase64url(kp.publicKey);
+      spinner2.text = "Fetching organizations...";
+    } catch (e) {
+      spinner2.fail("Keypair required");
+      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+      process.exit(1);
+    }
+    const base = url.replace(/\/$/, "");
+    const apiUrl = `${base}/api/v2/orgs?member=${encodeURIComponent(pubkey)}`;
+    try {
+      const { data, status } = await fetchJson(apiUrl, {
+        method: "GET",
+        timeout
+      });
+      if (status !== 200) {
+        spinner2.fail("Failed to list organizations");
+        console.error(chalk7.red(JSON.stringify(data)));
+        process.exit(1);
+      }
+      const orgs = Array.isArray(data) ? data : [];
+      spinner2.succeed(`Found ${orgs.length} organization(s)`);
+      if (orgs.length === 0) {
+        console.log(chalk7.yellow("No organizations found"));
+        return;
+      }
+      const memberResults = await Promise.all(
+        orgs.map(
+          (o) => fetchJson(
+            `${base}/api/v2/orgs/${encodeURIComponent(o.id)}/members`,
+            { method: "GET", timeout }
+          ).catch(() => ({ data: { members: [] }, status: 0 }))
+        )
+      );
+      const lines = orgs.map((o, i) => {
+        const members = memberResults[i].data?.members ?? [];
+        const myMember = members.find((m) => m.pubkey === pubkey);
+        const role = myMember?.role ?? "?";
+        const count = members.length;
+        const roleLabel = role === "admin" ? chalk7.yellow("admin") : chalk7.gray(role);
+        return `${chalk7.white(o.slug)}  ${chalk7.gray(o.name)}  ${chalk7.gray(`${count} member${count !== 1 ? "s" : ""}`)}  ${roleLabel}`;
+      });
+      console.log(lines.join("\n"));
+    } catch (e) {
+      spinner2.fail("Request failed");
+      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+      process.exit(1);
+    }
+  })
+).addCommand(
+  new Command("create").description("Create a new organization").requiredOption("-n, --name <name>", "Organization display name").requiredOption("-s, --slug <slug>", "Organization slug (e.g. my-org)").action(
+    async (options, command) => {
+      const { url, timeout } = getGlobalOpts(command);
+      const keypairPath = getKeypairPath(command);
+      const spinner2 = ora7("Creating organization...").start();
+      try {
+        const kp = loadKeypair({ keypairPath });
+        const pathname = "/api/v2/orgs";
+        const body = {
+          name: options.name.trim(),
+          slug: options.slug.trim().toLowerCase()
+        };
+        const headers = await getSignedHeaders("POST", pathname, body, kp);
+        const base = url.replace(/\/$/, "");
+        const { data, status } = await fetchJson(`${base}${pathname}`, {
+          method: "POST",
+          body: JSON.stringify(body),
+          timeout,
+          headers: { ...headers }
+        });
+        if (status >= 400) {
+          const err = data;
+          spinner2.fail(err?.message || `HTTP ${status}`);
+          console.error(chalk7.red(JSON.stringify(data)));
+          process.exit(1);
+        }
+        spinner2.succeed("Organization created");
+        console.log(chalk7.green(JSON.stringify(data, null, 2)));
+      } catch (e) {
+        spinner2.fail("Failed");
+        console.error(
+          chalk7.red(e instanceof Error ? e.message : String(e))
+        );
+        process.exit(1);
+      }
+    }
+  )
+).addCommand(
+  new Command("get").description("Get organization by id/slug").argument("<orgId>", "Organization id or slug").action(async (orgId, _options, command) => {
+    const { url, timeout } = getGlobalOpts(command);
+    const base = url.replace(/\/$/, "");
+    const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
+    const spinner2 = ora7("Fetching organization...").start();
+    try {
+      const { data, status } = await fetchJson(`${base}${pathname}`, { method: "GET", timeout });
+      if (status === 404) {
+        spinner2.fail("Organization not found");
+        process.exit(1);
+      }
+      if (status !== 200) {
+        spinner2.fail("Request failed");
+        console.error(chalk7.red(JSON.stringify(data)));
+        process.exit(1);
+      }
+      spinner2.succeed("OK");
+      console.log(JSON.stringify(data, null, 2));
+    } catch (e) {
+      spinner2.fail("Request failed");
+      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+      process.exit(1);
+    }
+  })
+).addCommand(
+  new Command("update").description("Update organization (name, metadata)").argument("<orgId>", "Organization id or slug").option("-n, --name <name>", "New display name").option("-m, --metadata <json>", "Metadata JSON object").action(
+    async (orgId, options, command) => {
+      const { url, timeout } = getGlobalOpts(command);
+      const keypairPath = getKeypairPath(command);
+      const spinner2 = ora7("Updating organization...").start();
+      try {
+        const kp = loadKeypair({ keypairPath });
+        const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
+        const body = {};
+        if (options.name !== void 0) body.name = options.name;
+        if (options.metadata !== void 0) {
+          try {
+            body.metadata = JSON.parse(options.metadata);
+          } catch {
+            spinner2.fail("--metadata must be valid JSON");
+            process.exit(1);
+          }
+        }
+        const headers = await getSignedHeaders("PATCH", pathname, body, kp);
+        const base = url.replace(/\/$/, "");
+        const { data, status } = await fetchJson(`${base}${pathname}`, {
+          method: "PATCH",
+          body: Object.keys(body).length > 0 ? JSON.stringify(body) : void 0,
+          timeout,
+          headers: { ...headers }
+        });
+        if (status >= 400) {
+          spinner2.fail(
+            data?.message || `HTTP ${status}`
+          );
+          console.error(chalk7.red(JSON.stringify(data)));
+          process.exit(1);
+        }
+        spinner2.succeed("Updated");
+        console.log(JSON.stringify(data, null, 2));
+      } catch (e) {
+        spinner2.fail("Failed");
+        console.error(
+          chalk7.red(e instanceof Error ? e.message : String(e))
+        );
+        process.exit(1);
+      }
+    }
+  )
+).addCommand(
+  new Command("delete").description("Delete an organization and all its data (irreversible)").argument("<orgId>", "Organization id or slug").option("-y, --yes", "Skip confirmation prompt").action(
+    async (orgId, options, command) => {
+      const { url, timeout } = getGlobalOpts(command);
+      const keypairPath = getKeypairPath(command);
+      if (!options.yes) {
+        const { createInterface } = await import('readline');
+        const rl = createInterface({
+          input: process.stdin,
+          output: process.stdout
+        });
+        const confirmed = await new Promise((resolve) => {
+          rl.question(
+            chalk7.yellow(
+              `Delete organization "${orgId}" and all its members/packages? This cannot be undone. Type "yes" to confirm: `
+            ),
+            (answer) => {
+              rl.close();
+              resolve(answer.trim().toLowerCase() === "yes");
+            }
+          );
+        });
+        if (!confirmed) {
+          console.log(chalk7.gray("Aborted."));
+          return;
+        }
+      }
+      const spinner2 = ora7("Deleting organization...").start();
+      try {
+        const kp = loadKeypair({ keypairPath });
+        const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
+        const headers = await getSignedHeaders(
+          "DELETE",
+          pathname,
+          void 0,
+          kp
+        );
+        const base = url.replace(/\/$/, "");
+        const { data, status } = await fetchJson(`${base}${pathname}`, {
+          method: "DELETE",
+          timeout,
+          headers: { ...headers }
+        });
+        if (status >= 400) {
+          spinner2.fail(
+            data?.message || `HTTP ${status}`
+          );
+          console.error(chalk7.red(JSON.stringify(data)));
+          process.exit(1);
+        }
+        spinner2.succeed("Organization deleted");
+      } catch (e) {
+        spinner2.fail("Failed");
+        console.error(
+          chalk7.red(e instanceof Error ? e.message : String(e))
+        );
+        process.exit(1);
+      }
+    }
+  )
+).addCommand(
+  new Command("members").description("List, add, or remove organization members").addCommand(
+    new Command("list").description("List members of an org").argument("<orgId>", "Organization id or slug").action(async (orgId, _options, command) => {
+      const { url, timeout } = getGlobalOpts(command);
+      const base = url.replace(/\/$/, "");
+      const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members`;
+      const spinner2 = ora7("Fetching members...").start();
+      try {
+        const { data, status } = await fetchJson(`${base}${pathname}`, { method: "GET", timeout });
+        if (status !== 200) {
+          spinner2.fail("Failed");
+          console.error(chalk7.red(JSON.stringify(data)));
+          process.exit(1);
+        }
+        spinner2.succeed("OK");
+        const members = data?.members ?? [];
+        console.log(JSON.stringify(members, null, 2));
+      } catch (e) {
+        spinner2.fail("Request failed");
+        console.error(
+          chalk7.red(e instanceof Error ? e.message : String(e))
+        );
+        process.exit(1);
+      }
+    })
+  ).addCommand(
+    new Command("add").description("Add a member by pubkey").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").option("-r, --role <role>", "Role: member or admin", "member").action(
+      async (orgId, pubkey, options, command) => {
+        const { url, timeout } = getGlobalOpts(command);
+        const keypairPath = getKeypairPath(command);
+        const spinner2 = ora7("Adding member...").start();
+        try {
+          const kp = loadKeypair({ keypairPath });
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members`;
+          const body = {
+            pubkey: pubkey.trim(),
+            role: options.role === "admin" ? "admin" : "member"
+          };
+          const headers = await getSignedHeaders(
+            "POST",
+            pathname,
+            body,
+            kp
+          );
+          const base = url.replace(/\/$/, "");
+          const { data, status } = await fetchJson(`${base}${pathname}`, {
+            method: "POST",
+            body: JSON.stringify(body),
+            timeout,
+            headers: { ...headers }
+          });
+          if (status >= 400) {
+            spinner2.fail(
+              data?.message || `HTTP ${status}`
+            );
+            console.error(chalk7.red(JSON.stringify(data)));
+            process.exit(1);
+          }
+          spinner2.succeed("Member added");
+        } catch (e) {
+          spinner2.fail("Failed");
+          console.error(
+            chalk7.red(e instanceof Error ? e.message : String(e))
+          );
+          process.exit(1);
+        }
+      }
+    )
+  ).addCommand(
+    new Command("update").description("Update a member role (admin or member)").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").requiredOption("-r, --role <role>", "New role: admin or member").action(
+      async (orgId, pubkey, options, command) => {
+        const { url, timeout } = getGlobalOpts(command);
+        const keypairPath = getKeypairPath(command);
+        const role = options.role === "admin" ? "admin" : "member";
+        const spinner2 = ora7("Updating member role...").start();
+        try {
+          const kp = loadKeypair({ keypairPath });
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(pubkey.trim())}`;
+          const body = { role };
+          const headers = await getSignedHeaders(
+            "PATCH",
+            pathname,
+            body,
+            kp
+          );
+          const base = url.replace(/\/$/, "");
+          const { data, status } = await fetchJson(`${base}${pathname}`, {
+            method: "PATCH",
+            body: JSON.stringify(body),
+            timeout,
+            headers: { ...headers }
+          });
+          if (status >= 400) {
+            spinner2.fail(
+              data?.message || `HTTP ${status}`
+            );
+            console.error(chalk7.red(JSON.stringify(data)));
+            process.exit(1);
+          }
+          spinner2.succeed(`Role updated to "${role}"`);
+        } catch (e) {
+          spinner2.fail("Failed");
+          console.error(
+            chalk7.red(e instanceof Error ? e.message : String(e))
+          );
+          process.exit(1);
+        }
+      }
+    )
+  ).addCommand(
+    new Command("remove").description("Remove a member by pubkey").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").action(
+      async (orgId, pubkey, _options, command) => {
+        const { url, timeout } = getGlobalOpts(command);
+        const keypairPath = getKeypairPath(command);
+        const spinner2 = ora7("Removing member...").start();
+        try {
+          const kp = loadKeypair({ keypairPath });
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(pubkey.trim())}`;
+          const headers = await getSignedHeaders(
+            "DELETE",
+            pathname,
+            void 0,
+            kp
+          );
+          const base = url.replace(/\/$/, "");
+          const { data, status } = await fetchJson(`${base}${pathname}`, {
+            method: "DELETE",
+            timeout,
+            headers: { ...headers }
+          });
+          if (status >= 400) {
+            spinner2.fail(
+              data?.message || `HTTP ${status}`
+            );
+            console.error(chalk7.red(JSON.stringify(data)));
+            process.exit(1);
+          }
+          spinner2.succeed("Member removed");
+        } catch (e) {
+          spinner2.fail("Failed");
+          console.error(
+            chalk7.red(e instanceof Error ? e.message : String(e))
+          );
+          process.exit(1);
+        }
+      }
+    )
+  )
+).addCommand(
+  new Command("packages").description("Link or unlink packages to the organization").addCommand(
+    new Command("link").description("Link a package to the organization").argument("<orgId>", "Organization id or slug").argument("<package>", "Package name").action(
+      async (orgId, pkg, _options, command) => {
+        const { url, timeout } = getGlobalOpts(command);
+        const keypairPath = getKeypairPath(command);
+        const spinner2 = ora7("Linking package...").start();
+        try {
+          const kp = loadKeypair({ keypairPath });
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages`;
+          const body = { package: pkg.trim() };
+          const headers = await getSignedHeaders(
+            "POST",
+            pathname,
+            body,
+            kp
+          );
+          const base = url.replace(/\/$/, "");
+          const { data, status } = await fetchJson(`${base}${pathname}`, {
+            method: "POST",
+            body: JSON.stringify(body),
+            timeout,
+            headers: { ...headers }
+          });
+          if (status >= 400) {
+            spinner2.fail(
+              data?.message || `HTTP ${status}`
+            );
+            console.error(chalk7.red(JSON.stringify(data)));
+            process.exit(1);
+          }
+          spinner2.succeed("Package linked");
+        } catch (e) {
+          spinner2.fail("Failed");
+          console.error(
+            chalk7.red(e instanceof Error ? e.message : String(e))
+          );
+          process.exit(1);
+        }
+      }
+    )
+  ).addCommand(
+    new Command("unlink").description("Unlink a package from the organization").argument("<orgId>", "Organization id or slug").argument("<package>", "Package name").action(
+      async (orgId, pkg, _options, command) => {
+        const { url, timeout } = getGlobalOpts(command);
+        const keypairPath = getKeypairPath(command);
+        const spinner2 = ora7("Unlinking package...").start();
+        try {
+          const kp = loadKeypair({ keypairPath });
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages/${encodeURIComponent(pkg.trim())}`;
+          const headers = await getSignedHeaders(
+            "DELETE",
+            pathname,
+            void 0,
+            kp
+          );
+          const base = url.replace(/\/$/, "");
+          const { data, status } = await fetchJson(`${base}${pathname}`, {
+            method: "DELETE",
+            timeout,
+            headers: { ...headers }
+          });
+          if (status >= 400) {
+            spinner2.fail(
+              data?.message || `HTTP ${status}`
+            );
+            console.error(chalk7.red(JSON.stringify(data)));
+            process.exit(1);
+          }
+          spinner2.succeed("Package unlinked");
+        } catch (e) {
+          spinner2.fail("Failed");
+          console.error(
+            chalk7.red(e instanceof Error ? e.message : String(e))
+          );
+          process.exit(1);
+        }
+      }
+    )
+  )
+);
 
 // src/index.ts
 var require2 = createRequire(import.meta.url);
@@ -2831,7 +3413,7 @@ Examples:
 For more information, visit: https://github.com/calimero-network/app-registry
 `
 );
-program.option("-u, --url <url>", "Registry API URL", "http://localhost:8082");
+program.option("-u, --url <url>", "Registry API URL (overrides saved config)");
 program.option(
   "-t, --timeout <timeout>",
   "Request timeout in milliseconds",
@@ -2846,14 +3428,18 @@ program.addCommand(ipfsCommand);
 program.addCommand(localCommand);
 program.addCommand(bundleCommand);
 program.addCommand(configCommand);
+program.addCommand(orgCommand);
 program.exitOverride();
 try {
   program.parse();
 } catch (err) {
+  if (err && typeof err === "object" && "exitCode" in err) {
+    process.exit(err.exitCode ?? 0);
+  }
   if (err instanceof Error) {
-    console.error(chalk6.red("Error:"), err.message);
+    console.error(chalk7.red("Error:"), err.message);
   } else {
-    console.error(chalk6.red("Unknown error occurred"));
+    console.error(chalk7.red("Unknown error occurred"));
   }
   process.exit(1);
 }