@calimero-network/registry-cli 1.11.0 → 1.12.0

package/dist/index.js

@@ -12,9 +12,6 @@ import crypto from 'crypto';
 import fastify from 'fastify';
 import cors from '@fastify/cors';
 import * as tar from 'tar';
-import * as ed25519 from '@noble/ed25519';
-import canonicalize from 'canonicalize';
-import bs58 from 'bs58';
 
 var CalimeroRegistryClient = class {
   /**
@@ -2380,9 +2377,8 @@ Examples:
           console.log(`   Package: ${body.package || pkg}`);
           console.log(`   Version: ${body.version || version2}`);
         } else {
-          console.error(
-            `\u274C PATCH failed (${res2.status}): ${body.error ?? body.message ?? text}`
-          );
+          const errMsg = body.message && String(body.message).trim() || body.error || text;
+          console.error(`\u274C PATCH failed (${res2.status}): ${errMsg}`);
           process.exit(1);
         }
         return;
@@ -2641,7 +2637,7 @@ async function extractManifest(bundlePath) {
     await tar.x({
       file: bundlePath,
       cwd: extractDir,
-      filter: (path9) => path9 === "manifest.json"
+      filter: (path8) => path8 === "manifest.json"
     });
     const manifestPath = path7.join(extractDir, "manifest.json");
     if (fs9.existsSync(manifestPath)) {
@@ -2814,96 +2810,6 @@ function createConfigResetCommand() {
     }
   });
 }
-var ENV_KEYPAIR = "CALIMERO_REGISTRY_KEYPAIR";
-function base64urlEncode(bytes) {
-  const base64 = Buffer.from(bytes).toString("base64");
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function buildSignedPayload(method, pathname, body) {
-  const bodyObj = body != null && typeof body === "object" ? body : {};
-  const bodyStr = Object.keys(bodyObj).length > 0 ? canonicalize(bodyObj) : "";
-  return `${method}
-${pathname}
-${bodyStr}`;
-}
-function base64urlDecode(str) {
-  const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = base64.padEnd(
-    base64.length + (4 - base64.length % 4) % 4,
-    "="
-  );
-  return new Uint8Array(Buffer.from(padded, "base64"));
-}
-function loadKeypair(options) {
-  if (options?.keypairPath) {
-    const resolved = path7.resolve(options.keypairPath);
-    if (!fs9.existsSync(resolved)) {
-      throw new Error(`Keypair file not found: ${resolved}`);
-    }
-    const raw = fs9.readFileSync(resolved, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed) && parsed.private_key) {
-      const secretKey2 = base64urlDecode(parsed.private_key);
-      const publicKey2 = base64urlDecode(parsed.public_key);
-      if (secretKey2.length !== 32 || publicKey2.length !== 32) {
-        throw new Error(
-          "Invalid key file: private_key and public_key must be 32 bytes each"
-        );
-      }
-      return { publicKey: publicKey2, secretKey: secretKey2 };
-    }
-    if (Array.isArray(parsed) && parsed.length === 64) {
-      const bytes2 = new Uint8Array(parsed);
-      const secretKey2 = bytes2.slice(0, 32);
-      const publicKey2 = bytes2.slice(32, 64);
-      return { publicKey: publicKey2, secretKey: secretKey2 };
-    }
-    throw new Error(
-      "Unrecognised key file format. Expected mero-sign JSON ({ private_key, public_key, signer_id }) or a legacy array of 64 numbers."
-    );
-  }
-  const env = process.env[ENV_KEYPAIR];
-  if (!env || typeof env !== "string" || !env.trim()) {
-    throw new Error(
-      `Missing keypair: set ${ENV_KEYPAIR} (base58 64-byte keypair) or use -k <path>`
-    );
-  }
-  const decoded = bs58.decode(env.trim());
-  if (decoded.length !== 64) {
-    throw new Error(
-      `Invalid keypair: ${ENV_KEYPAIR} must decode to 64 bytes (got ${decoded.length})`
-    );
-  }
-  const bytes = new Uint8Array(decoded);
-  const secretKey = bytes.slice(0, 32);
-  const publicKey = bytes.slice(32, 64);
-  return { publicKey, secretKey };
-}
-async function signPayload(payload, secretKey, publicKey) {
-  const message = new TextEncoder().encode(payload);
-  const signature = await ed25519.signAsync(message, secretKey);
-  return {
-    pubkeyBase64url: base64urlEncode(publicKey),
-    signatureBase64url: base64urlEncode(signature)
-  };
-}
-async function getSignedHeaders(method, pathname, body, keypair) {
-  const payload = buildSignedPayload(method, pathname, body);
-  const { pubkeyBase64url, signatureBase64url } = await signPayload(
-    payload,
-    keypair.secretKey,
-    keypair.publicKey
-  );
-  return {
-    "X-Pubkey": pubkeyBase64url,
-    "X-Signature": signatureBase64url
-  };
-}
-function publicKeyToBase64url(publicKey) {
-  return base64urlEncode(publicKey);
-}
-
-// src/commands/org.ts
 var DEFAULT_TIMEOUT = 1e4;
 function getGlobalOpts(command) {
   const opts = command.parent?.parent?.opts() ?? {};
@@ -2914,9 +2820,15 @@ function getGlobalOpts(command) {
     timeout: parseInt(String(opts.timeout ?? DEFAULT_TIMEOUT), 10) || DEFAULT_TIMEOUT
   };
 }
-function getKeypairPath(command) {
-  const orgCmd = command.parent?.name() === "org" ? command.parent : command.parent?.parent;
-  return orgCmd?.opts()?.keypair;
+function getAuthHeaders() {
+  const remoteConfig = new RemoteConfig();
+  const apiKey = remoteConfig.getApiKey();
+  if (!apiKey) {
+    throw new Error(
+      "API token required for org write operations.\nGet a token from the Organizations page in the web UI, then run:\n  calimero-registry config set api-key <token>"
+    );
+  }
+  return { Authorization: `Bearer ${apiKey}` };
 }
 async function fetchJson(url, options = {}) {
   const { timeout = DEFAULT_TIMEOUT, ...init } = options;
@@ -2935,31 +2847,49 @@ async function fetchJson(url, options = {}) {
   const data = text ? JSON.parse(text) : void 0;
   return { data, status: res.status };
 }
-var orgCommand = new Command("org").description("Manage organizations (create, list, members, packages)").option(
-  "-k, --keypair <path>",
-  "Path to Ed25519 keypair JSON (64 bytes). Overrides CALIMERO_REGISTRY_KEYPAIR."
-).addCommand(
+var orgCommand = new Command("org").description("Manage organizations (create, list, members, packages)").addCommand(
   new Command("list").description(
-    "List organizations you belong to (uses keypair pubkey as member)"
+    "List organizations you belong to (uses API token to resolve identity)"
   ).action(async (_options, command) => {
     const { url, timeout } = getGlobalOpts(command);
-    const keypairPath = getKeypairPath(command);
-    const spinner2 = ora7("Loading keypair...").start();
-    let pubkey;
+    const spinner2 = ora7("Resolving identity...").start();
+    let authHeaders;
     try {
-      const kp = loadKeypair({ keypairPath });
-      pubkey = publicKeyToBase64url(kp.publicKey);
-      spinner2.text = "Fetching organizations...";
+      authHeaders = getAuthHeaders();
     } catch (e) {
-      spinner2.fail("Keypair required");
+      spinner2.fail("API token required");
       console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
       process.exit(1);
     }
     const base = url.replace(/\/$/, "");
-    const apiUrl = `${base}/api/v2/orgs?member=${encodeURIComponent(pubkey)}`;
+    let myEmail;
+    try {
+      const { data, status } = await fetchJson(`${base}/api/auth/me`, {
+        method: "GET",
+        headers: authHeaders,
+        timeout
+      });
+      if (status !== 200 || !data?.user?.email) {
+        spinner2.fail("Could not resolve identity from API token");
+        console.error(
+          chalk7.red(
+            "Ensure your API token is valid. Get a new one from the web UI."
+          )
+        );
+        process.exit(1);
+      }
+      myEmail = data.user.email;
+      spinner2.text = `Fetching organizations for ${myEmail}...`;
+    } catch (e) {
+      spinner2.fail("Request failed");
+      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+      process.exit(1);
+    }
+    const apiUrl = `${base}/api/v2/orgs?member=${encodeURIComponent(myEmail)}`;
     try {
       const { data, status } = await fetchJson(apiUrl, {
         method: "GET",
+        headers: authHeaders,
         timeout
       });
       if (status !== 200) {
@@ -2977,13 +2907,13 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
         orgs.map(
           (o) => fetchJson(
             `${base}/api/v2/orgs/${encodeURIComponent(o.id)}/members`,
-            { method: "GET", timeout }
+            { method: "GET", headers: authHeaders, timeout }
           ).catch(() => ({ data: { members: [] }, status: 0 }))
         )
       );
       const lines = orgs.map((o, i) => {
         const members = memberResults[i].data?.members ?? [];
-        const myMember = members.find((m) => m.pubkey === pubkey);
+        const myMember = members.find((m) => m.email === myEmail);
         const role = myMember?.role ?? "?";
         const count = members.length;
         const roleLabel = role === "admin" ? chalk7.yellow("admin") : chalk7.gray(role);
@@ -2997,25 +2927,23 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     }
   })
 ).addCommand(
-  new Command("create").description("Create a new organization").requiredOption("-n, --name <name>", "Organization display name").requiredOption("-s, --slug <slug>", "Organization slug (e.g. my-org)").action(
+  new Command("create").description("Create a new organization (requires API token)").requiredOption("-n, --name <name>", "Organization display name").requiredOption("-s, --slug <slug>", "Organization slug (e.g. my-org)").action(
     async (options, command) => {
       const { url, timeout } = getGlobalOpts(command);
-      const keypairPath = getKeypairPath(command);
       const spinner2 = ora7("Creating organization...").start();
       try {
-        const kp = loadKeypair({ keypairPath });
+        const authHeaders = getAuthHeaders();
         const pathname = "/api/v2/orgs";
         const body = {
           name: options.name.trim(),
           slug: options.slug.trim().toLowerCase()
         };
-        const headers = await getSignedHeaders("POST", pathname, body, kp);
         const base = url.replace(/\/$/, "");
         const { data, status } = await fetchJson(`${base}${pathname}`, {
           method: "POST",
           body: JSON.stringify(body),
           timeout,
-          headers: { ...headers }
+          headers: authHeaders
         });
         if (status >= 400) {
           const err = data;
@@ -3063,10 +2991,9 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
   new Command("update").description("Update organization (name, metadata)").argument("<orgId>", "Organization id or slug").option("-n, --name <name>", "New display name").option("-m, --metadata <json>", "Metadata JSON object").action(
     async (orgId, options, command) => {
       const { url, timeout } = getGlobalOpts(command);
-      const keypairPath = getKeypairPath(command);
       const spinner2 = ora7("Updating organization...").start();
       try {
-        const kp = loadKeypair({ keypairPath });
+        const authHeaders = getAuthHeaders();
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
         const body = {};
         if (options.name !== void 0) body.name = options.name;
@@ -3078,13 +3005,12 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
             process.exit(1);
           }
         }
-        const headers = await getSignedHeaders("PATCH", pathname, body, kp);
         const base = url.replace(/\/$/, "");
         const { data, status } = await fetchJson(`${base}${pathname}`, {
           method: "PATCH",
           body: Object.keys(body).length > 0 ? JSON.stringify(body) : void 0,
           timeout,
-          headers: { ...headers }
+          headers: authHeaders
         });
         if (status >= 400) {
           spinner2.fail(
@@ -3108,7 +3034,6 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
   new Command("delete").description("Delete an organization and all its data (irreversible)").argument("<orgId>", "Organization id or slug").option("-y, --yes", "Skip confirmation prompt").action(
     async (orgId, options, command) => {
       const { url, timeout } = getGlobalOpts(command);
-      const keypairPath = getKeypairPath(command);
       if (!options.yes) {
         const { createInterface } = await import('readline');
         const rl = createInterface({
@@ -3133,19 +3058,13 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
       const spinner2 = ora7("Deleting organization...").start();
       try {
-        const kp = loadKeypair({ keypairPath });
+        const authHeaders = getAuthHeaders();
         const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}`;
-        const headers = await getSignedHeaders(
-          "DELETE",
-          pathname,
-          void 0,
-          kp
-        );
         const base = url.replace(/\/$/, "");
         const { data, status } = await fetchJson(`${base}${pathname}`, {
           method: "DELETE",
           timeout,
-          headers: { ...headers }
+          headers: authHeaders
         });
         if (status >= 400) {
           spinner2.fail(
@@ -3190,30 +3109,23 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     })
   ).addCommand(
-    new Command("add").description("Add a member by pubkey").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").option("-r, --role <role>", "Role: member or admin", "member").action(
-      async (orgId, pubkey, options, command) => {
+    new Command("add").description("Add a member by email").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").option("-r, --role <role>", "Role: member or admin", "member").action(
+      async (orgId, email, options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const keypairPath = getKeypairPath(command);
         const spinner2 = ora7("Adding member...").start();
         try {
-          const kp = loadKeypair({ keypairPath });
+          const authHeaders = getAuthHeaders();
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members`;
           const body = {
-            pubkey: pubkey.trim(),
+            email: email.trim(),
             role: options.role === "admin" ? "admin" : "member"
           };
-          const headers = await getSignedHeaders(
-            "POST",
-            pathname,
-            body,
-            kp
-          );
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
             method: "POST",
             body: JSON.stringify(body),
             timeout,
-            headers: { ...headers }
+            headers: authHeaders
           });
           if (status >= 400) {
             spinner2.fail(
@@ -3233,28 +3145,21 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     )
   ).addCommand(
-    new Command("update").description("Update a member role (admin or member)").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").requiredOption("-r, --role <role>", "New role: admin or member").action(
-      async (orgId, pubkey, options, command) => {
+    new Command("update").description("Update a member role (admin or member)").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").requiredOption("-r, --role <role>", "New role: admin or member").action(
+      async (orgId, email, options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const keypairPath = getKeypairPath(command);
         const role = options.role === "admin" ? "admin" : "member";
         const spinner2 = ora7("Updating member role...").start();
         try {
-          const kp = loadKeypair({ keypairPath });
-          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(pubkey.trim())}`;
+          const authHeaders = getAuthHeaders();
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const body = { role };
-          const headers = await getSignedHeaders(
-            "PATCH",
-            pathname,
-            body,
-            kp
-          );
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
             method: "PATCH",
             body: JSON.stringify(body),
             timeout,
-            headers: { ...headers }
+            headers: authHeaders
           });
           if (status >= 400) {
             spinner2.fail(
@@ -3274,25 +3179,18 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
       }
     )
   ).addCommand(
-    new Command("remove").description("Remove a member by pubkey").argument("<orgId>", "Organization id or slug").argument("<pubkey>", "Member public key").action(
-      async (orgId, pubkey, _options, command) => {
+    new Command("remove").description("Remove a member by email").argument("<orgId>", "Organization id or slug").argument("<email>", "Member email address").action(
+      async (orgId, email, _options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const keypairPath = getKeypairPath(command);
         const spinner2 = ora7("Removing member...").start();
         try {
-          const kp = loadKeypair({ keypairPath });
-          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(pubkey.trim())}`;
-          const headers = await getSignedHeaders(
-            "DELETE",
-            pathname,
-            void 0,
-            kp
-          );
+          const authHeaders = getAuthHeaders();
+          const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/members/${encodeURIComponent(email.trim())}`;
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
             method: "DELETE",
             timeout,
-            headers: { ...headers }
+            headers: authHeaders
           });
           if (status >= 400) {
             spinner2.fail(
@@ -3317,24 +3215,17 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     new Command("link").description("Link a package to the organization").argument("<orgId>", "Organization id or slug").argument("<package>", "Package name").action(
       async (orgId, pkg, _options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const keypairPath = getKeypairPath(command);
         const spinner2 = ora7("Linking package...").start();
         try {
-          const kp = loadKeypair({ keypairPath });
+          const authHeaders = getAuthHeaders();
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages`;
           const body = { package: pkg.trim() };
-          const headers = await getSignedHeaders(
-            "POST",
-            pathname,
-            body,
-            kp
-          );
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
             method: "POST",
             body: JSON.stringify(body),
             timeout,
-            headers: { ...headers }
+            headers: authHeaders
           });
           if (status >= 400) {
             spinner2.fail(
@@ -3357,22 +3248,15 @@ var orgCommand = new Command("org").description("Manage organizations (create, l
     new Command("unlink").description("Unlink a package from the organization").argument("<orgId>", "Organization id or slug").argument("<package>", "Package name").action(
       async (orgId, pkg, _options, command) => {
         const { url, timeout } = getGlobalOpts(command);
-        const keypairPath = getKeypairPath(command);
         const spinner2 = ora7("Unlinking package...").start();
         try {
-          const kp = loadKeypair({ keypairPath });
+          const authHeaders = getAuthHeaders();
           const pathname = `/api/v2/orgs/${encodeURIComponent(orgId)}/packages/${encodeURIComponent(pkg.trim())}`;
-          const headers = await getSignedHeaders(
-            "DELETE",
-            pathname,
-            void 0,
-            kp
-          );
           const base = url.replace(/\/$/, "");
           const { data, status } = await fetchJson(`${base}${pathname}`, {
             method: "DELETE",
             timeout,
-            headers: { ...headers }
+            headers: authHeaders
           });
           if (status >= 400) {
             spinner2.fail(