@calimero-network/registry-cli 1.24.0 → 1.26.0

package/dist/index.js

@@ -4,8 +4,8 @@ import chalk4 from 'chalk';
 import { createRequire } from 'module';
 import ora4 from 'ora';
 import axios from 'axios';
-import fs7, { existsSync, writeFileSync } from 'fs';
-import path6 from 'path';
+import fs8, { existsSync, writeFileSync } from 'fs';
+import path7 from 'path';
 import os2 from 'os';
 import fastify from 'fastify';
 import crypto2 from 'crypto';
@@ -19,7 +19,7 @@ var RemoteConfig = class _RemoteConfig {
   configPath;
   config;
   constructor() {
-    this.configPath = path6.join(
+    this.configPath = path7.join(
       os2.homedir(),
       ".calimero-registry",
       "remote-config.json"
@@ -28,10 +28,10 @@ var RemoteConfig = class _RemoteConfig {
   }
   loadConfig() {
     const defaults = defaultConfig();
-    if (fs7.existsSync(this.configPath)) {
+    if (fs8.existsSync(this.configPath)) {
       try {
         const existingConfig = JSON.parse(
-          fs7.readFileSync(this.configPath, "utf8")
+          fs8.readFileSync(this.configPath, "utf8")
         );
         return {
           registry: {
@@ -46,9 +46,9 @@ var RemoteConfig = class _RemoteConfig {
     return defaults;
   }
   saveConfig() {
-    const configDir = path6.dirname(this.configPath);
-    if (!fs7.existsSync(configDir)) {
-      fs7.mkdirSync(configDir, { recursive: true });
+    const configDir = path7.dirname(this.configPath);
+    if (!fs8.existsSync(configDir)) {
+      fs8.mkdirSync(configDir, { recursive: true });
     }
     const configToSave = {
       registry: {
@@ -57,11 +57,11 @@ var RemoteConfig = class _RemoteConfig {
         ...this.config.registry.apiKey ? { apiKey: this.config.registry.apiKey } : {}
       }
     };
-    fs7.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2), {
+    fs8.writeFileSync(this.configPath, JSON.stringify(configToSave, null, 2), {
       mode: 384
     });
     try {
-      fs7.chmodSync(this.configPath, 384);
+      fs8.chmodSync(this.configPath, 384);
     } catch {
     }
   }
@@ -177,11 +177,11 @@ function defaultConfig2() {
       publicHost: "host.docker.internal"
     },
     data: {
-      dir: path6.join(os2.homedir(), ".calimero-registry", "data"),
-      artifactsDir: path6.join(os2.homedir(), ".calimero-registry", "artifacts")
+      dir: path7.join(os2.homedir(), ".calimero-registry", "data"),
+      artifactsDir: path7.join(os2.homedir(), ".calimero-registry", "artifacts")
     },
     artifacts: {
-      storageDir: path6.join(os2.homedir(), ".calimero-registry", "artifacts"),
+      storageDir: path7.join(os2.homedir(), ".calimero-registry", "artifacts"),
       serveLocal: true,
       copyArtifacts: true,
       maxFileSize: "100MB",
@@ -194,20 +194,20 @@ var LocalConfig = class {
   dataDir;
   config;
   constructor() {
-    this.configPath = path6.join(
+    this.configPath = path7.join(
       os2.homedir(),
       ".calimero-registry",
       "config.json"
     );
-    this.dataDir = path6.join(os2.homedir(), ".calimero-registry");
+    this.dataDir = path7.join(os2.homedir(), ".calimero-registry");
     this.config = this.loadConfig();
   }
   loadConfig() {
     const defaults = defaultConfig2();
-    if (fs7.existsSync(this.configPath)) {
+    if (fs8.existsSync(this.configPath)) {
       try {
         const existingConfig = JSON.parse(
-          fs7.readFileSync(this.configPath, "utf8")
+          fs8.readFileSync(this.configPath, "utf8")
         );
         return {
           server: {
@@ -230,11 +230,11 @@ var LocalConfig = class {
     return defaults;
   }
   saveConfig() {
-    const configDir = path6.dirname(this.configPath);
-    if (!fs7.existsSync(configDir)) {
-      fs7.mkdirSync(configDir, { recursive: true });
+    const configDir = path7.dirname(this.configPath);
+    if (!fs8.existsSync(configDir)) {
+      fs8.mkdirSync(configDir, { recursive: true });
     }
-    fs7.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
+    fs8.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2));
   }
   // Server configuration
   getPort() {
@@ -264,8 +264,8 @@ var LocalConfig = class {
   }
   setDataDir(dir) {
     this.config.data.dir = dir;
-    this.config.data.artifactsDir = path6.join(dir, "artifacts");
-    this.config.artifacts.storageDir = path6.join(dir, "artifacts");
+    this.config.data.artifactsDir = path7.join(dir, "artifacts");
+    this.config.artifacts.storageDir = path7.join(dir, "artifacts");
     this.saveConfig();
   }
   getArtifactsDir() {
@@ -289,12 +289,12 @@ var LocalConfig = class {
     const dirs = [
       this.getDataDir(),
       this.getArtifactsDir(),
-      path6.join(this.getDataDir(), "backups"),
-      path6.join(this.getDataDir(), "logs")
+      path7.join(this.getDataDir(), "backups"),
+      path7.join(this.getDataDir(), "logs")
     ];
     dirs.forEach((dir) => {
-      if (!fs7.existsSync(dir)) {
-        fs7.mkdirSync(dir, { recursive: true });
+      if (!fs8.existsSync(dir)) {
+        fs8.mkdirSync(dir, { recursive: true });
       }
     });
   }
@@ -430,12 +430,12 @@ var LocalDataStore = class {
   artifactsFile;
   constructor(config) {
     this.config = config;
-    this.appsFile = path6.join(config.getDataDir(), "apps.json");
-    this.bundleManifestsFile = path6.join(
+    this.appsFile = path7.join(config.getDataDir(), "apps.json");
+    this.bundleManifestsFile = path7.join(
       config.getDataDir(),
       "bundle_manifests.json"
     );
-    this.artifactsFile = path6.join(config.getDataDir(), "artifacts.json");
+    this.artifactsFile = path7.join(config.getDataDir(), "artifacts.json");
     this.data = {
       apps: /* @__PURE__ */ new Map(),
       bundleManifests: /* @__PURE__ */ new Map(),
@@ -445,21 +445,21 @@ var LocalDataStore = class {
   }
   loadData() {
     try {
-      if (fs7.existsSync(this.appsFile)) {
-        const appsData = JSON.parse(fs7.readFileSync(this.appsFile, "utf8"));
+      if (fs8.existsSync(this.appsFile)) {
+        const appsData = JSON.parse(fs8.readFileSync(this.appsFile, "utf8"));
         this.data.apps = new Map(Object.entries(appsData));
       }
-      if (fs7.existsSync(this.bundleManifestsFile)) {
+      if (fs8.existsSync(this.bundleManifestsFile)) {
         const bundleManifestsData = JSON.parse(
-          fs7.readFileSync(this.bundleManifestsFile, "utf8")
+          fs8.readFileSync(this.bundleManifestsFile, "utf8")
         );
         this.data.bundleManifests = new Map(
           Object.entries(bundleManifestsData)
         );
       }
-      if (fs7.existsSync(this.artifactsFile)) {
+      if (fs8.existsSync(this.artifactsFile)) {
         const artifactsData = JSON.parse(
-          fs7.readFileSync(this.artifactsFile, "utf8")
+          fs8.readFileSync(this.artifactsFile, "utf8")
         );
         this.data.artifacts = new Map(Object.entries(artifactsData));
       }
@@ -471,14 +471,14 @@ var LocalDataStore = class {
     try {
       this.config.ensureDirectories();
       const appsObj = Object.fromEntries(this.data.apps);
-      fs7.writeFileSync(this.appsFile, JSON.stringify(appsObj, null, 2));
+      fs8.writeFileSync(this.appsFile, JSON.stringify(appsObj, null, 2));
       const bundleManifestsObj = Object.fromEntries(this.data.bundleManifests);
-      fs7.writeFileSync(
+      fs8.writeFileSync(
         this.bundleManifestsFile,
         JSON.stringify(bundleManifestsObj, null, 2)
       );
       const artifactsObj = Object.fromEntries(this.data.artifacts);
-      fs7.writeFileSync(
+      fs8.writeFileSync(
         this.artifactsFile,
         JSON.stringify(artifactsObj, null, 2)
       );
@@ -556,14 +556,14 @@ var LocalDataStore = class {
   // Backup and restore
   async backup(outputPath) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-    const backupPath = outputPath || path6.join(
+    const backupPath = outputPath || path7.join(
       this.config.getDataDir(),
       "backups",
       `backup-${timestamp}.json`
     );
-    const backupDir = path6.dirname(backupPath);
-    if (!fs7.existsSync(backupDir)) {
-      fs7.mkdirSync(backupDir, { recursive: true });
+    const backupDir = path7.dirname(backupPath);
+    if (!fs8.existsSync(backupDir)) {
+      fs8.mkdirSync(backupDir, { recursive: true });
     }
     const backupData = {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -571,14 +571,14 @@ var LocalDataStore = class {
       bundleManifests: Object.fromEntries(this.data.bundleManifests),
       artifacts: Object.fromEntries(this.data.artifacts)
     };
-    fs7.writeFileSync(backupPath, JSON.stringify(backupData, null, 2));
+    fs8.writeFileSync(backupPath, JSON.stringify(backupData, null, 2));
     return backupPath;
   }
   async restore(backupPath) {
-    if (!fs7.existsSync(backupPath)) {
+    if (!fs8.existsSync(backupPath)) {
       throw new Error(`Backup file not found: ${backupPath}`);
     }
-    const backupData = JSON.parse(fs7.readFileSync(backupPath, "utf8"));
+    const backupData = JSON.parse(fs8.readFileSync(backupPath, "utf8"));
     this.data.apps = new Map(Object.entries(backupData.apps || {}));
     this.data.bundleManifests = new Map(
       Object.entries(backupData.bundleManifests || {})
@@ -649,8 +649,8 @@ var LocalArtifactServer = class {
     this.ensureArtifactsDir();
   }
   ensureArtifactsDir() {
-    if (!fs7.existsSync(this.artifactsDir)) {
-      fs7.mkdirSync(this.artifactsDir, { recursive: true });
+    if (!fs8.existsSync(this.artifactsDir)) {
+      fs8.mkdirSync(this.artifactsDir, { recursive: true });
     }
   }
   /**
@@ -660,24 +660,24 @@ var LocalArtifactServer = class {
    * request read or write outside the artifact store (path traversal).
    */
   resolveArtifactPath(...segments) {
-    const base = path6.resolve(this.artifactsDir);
-    const resolved = path6.resolve(base, ...segments);
-    if (resolved !== base && !resolved.startsWith(base + path6.sep)) {
+    const base = path7.resolve(this.artifactsDir);
+    const resolved = path7.resolve(base, ...segments);
+    if (resolved !== base && !resolved.startsWith(base + path7.sep)) {
       throw new Error("Invalid artifact path: escapes artifacts directory");
     }
     return resolved;
   }
   // Copy artifact to local storage
   async copyArtifactToLocal(sourcePath, appId, version2, filename) {
-    if (!fs7.existsSync(sourcePath)) {
+    if (!fs8.existsSync(sourcePath)) {
       throw new Error(`Source file not found: ${sourcePath}`);
     }
     const targetPath = this.resolveArtifactPath(appId, version2, filename);
-    const appVersionDir = path6.dirname(targetPath);
-    if (!fs7.existsSync(appVersionDir)) {
-      fs7.mkdirSync(appVersionDir, { recursive: true });
+    const appVersionDir = path7.dirname(targetPath);
+    if (!fs8.existsSync(appVersionDir)) {
+      fs8.mkdirSync(appVersionDir, { recursive: true });
     }
-    fs7.copyFileSync(sourcePath, targetPath);
+    fs8.copyFileSync(sourcePath, targetPath);
     const fileHash = await this.calculateFileHash(targetPath);
     this.dataStore.setArtifactPath(fileHash, targetPath);
     return targetPath;
@@ -685,26 +685,26 @@ var LocalArtifactServer = class {
   // Serve artifact by app ID, version, and filename
   async serveArtifact(appId, version2, filename) {
     const artifactPath = this.resolveArtifactPath(appId, version2, filename);
-    if (!fs7.existsSync(artifactPath)) {
+    if (!fs8.existsSync(artifactPath)) {
       throw new Error(`Artifact not found: ${artifactPath}`);
     }
-    return fs7.readFileSync(artifactPath);
+    return fs8.readFileSync(artifactPath);
   }
   // Serve artifact by hash
   async serveByHash(hash) {
     const artifactPath = this.dataStore.getArtifactPath(hash);
-    if (!artifactPath || !fs7.existsSync(artifactPath)) {
+    if (!artifactPath || !fs8.existsSync(artifactPath)) {
       throw new Error(`Artifact not found for hash: ${hash}`);
     }
-    return fs7.readFileSync(artifactPath);
+    return fs8.readFileSync(artifactPath);
   }
   // Validate artifact file
   async validateArtifact(filePath) {
-    if (!fs7.existsSync(filePath)) {
+    if (!fs8.existsSync(filePath)) {
       throw new Error(`File not found: ${filePath}`);
     }
-    const stats = fs7.statSync(filePath);
-    const fileBuffer = fs7.readFileSync(filePath);
+    const stats = fs8.statSync(filePath);
+    const fileBuffer = fs8.readFileSync(filePath);
     const sha256 = crypto2.createHash("sha256").update(fileBuffer).digest("hex");
     return {
       size: stats.size,
@@ -713,7 +713,7 @@ var LocalArtifactServer = class {
   }
   // Calculate file hash
   async calculateFileHash(filePath) {
-    const fileBuffer = fs7.readFileSync(filePath);
+    const fileBuffer = fs8.readFileSync(filePath);
     return crypto2.createHash("sha256").update(fileBuffer).digest("hex");
   }
   // Get artifact URL for local serving
@@ -731,10 +731,10 @@ var LocalArtifactServer = class {
     const now = Date.now();
     const getAllFiles = (dir) => {
       let files = [];
-      const items = fs7.readdirSync(dir);
+      const items = fs8.readdirSync(dir);
       for (const item of items) {
-        const fullPath = path6.join(dir, item);
-        const stat = fs7.statSync(fullPath);
+        const fullPath = path7.join(dir, item);
+        const stat = fs8.statSync(fullPath);
         if (stat.isDirectory()) {
           files = files.concat(getAllFiles(fullPath));
         } else {
@@ -745,10 +745,10 @@ var LocalArtifactServer = class {
     };
     const allFiles = getAllFiles(this.artifactsDir);
     for (const file of allFiles) {
-      const stats = fs7.statSync(file);
+      const stats = fs8.statSync(file);
       const age = now - stats.mtime.getTime();
       if (age > maxAge) {
-        fs7.unlinkSync(file);
+        fs8.unlinkSync(file);
         console.log(`Cleaned up old artifact: ${file}`);
       }
     }
@@ -760,10 +760,10 @@ var LocalArtifactServer = class {
     let oldestFile = null;
     const getAllFiles = (dir) => {
       let files = [];
-      const items = fs7.readdirSync(dir);
+      const items = fs8.readdirSync(dir);
       for (const item of items) {
-        const fullPath = path6.join(dir, item);
-        const stat = fs7.statSync(fullPath);
+        const fullPath = path7.join(dir, item);
+        const stat = fs8.statSync(fullPath);
         if (stat.isDirectory()) {
           files = files.concat(getAllFiles(fullPath));
         } else {
@@ -772,10 +772,10 @@ var LocalArtifactServer = class {
       }
       return files;
     };
-    if (fs7.existsSync(this.artifactsDir)) {
+    if (fs8.existsSync(this.artifactsDir)) {
       const allFiles = getAllFiles(this.artifactsDir);
       for (const file of allFiles) {
-        const stats = fs7.statSync(file);
+        const stats = fs8.statSync(file);
         totalFiles++;
         totalSize += stats.size;
         if (!oldestFile || stats.mtime < oldestFile) {
@@ -913,8 +913,8 @@ var LocalRegistryServer = class {
   async reset() {
     this.dataStore.reset();
     const artifactsDir = this.config.getArtifactsDir();
-    if (fs7.existsSync(artifactsDir)) {
-      fs7.rmSync(artifactsDir, { recursive: true, force: true });
+    if (fs8.existsSync(artifactsDir)) {
+      fs8.rmSync(artifactsDir, { recursive: true, force: true });
     }
   }
   async backup(outputPath) {
@@ -933,9 +933,9 @@ var LocalRegistryServer = class {
    * arbitrary filesystem locations.
    */
   confineToDataDir(candidate) {
-    const dataDir = path6.resolve(this.config.getDataDir());
-    const resolved = path6.resolve(dataDir, candidate);
-    if (resolved !== dataDir && !resolved.startsWith(dataDir + path6.sep)) {
+    const dataDir = path7.resolve(this.config.getDataDir());
+    const resolved = path7.resolve(dataDir, candidate);
+    if (resolved !== dataDir && !resolved.startsWith(dataDir + path7.sep)) {
       throw new Error("Path escapes data directory");
     }
     return resolved;
@@ -1254,7 +1254,7 @@ localCommand.addCommand(
   new Command("restore").description("Restore local registry data from backup").argument("<backup-file>", "Path to backup file").action(async (backupFile) => {
     const spinner2 = ora4("Restoring from backup...").start();
     try {
-      if (!fs7.existsSync(backupFile)) {
+      if (!fs8.existsSync(backupFile)) {
         spinner2.fail("Backup file not found");
         console.error(chalk4.red(`File not found: ${backupFile}`));
         process.exit(1);
@@ -1298,8 +1298,6 @@ localCommand.addCommand(
     }
   })
 );
-
-// src/lib/services.ts
 var SERVICE_NAME_RE = /^[a-z0-9][a-z0-9_-]*$/;
 function validateServiceName(name) {
   if (typeof name !== "string" || !SERVICE_NAME_RE.test(name)) {
@@ -1403,6 +1401,18 @@ function collectBundleFiles(manifest) {
   files.forEach(assertSafeBundlePath);
   return [...new Set(files)];
 }
+function assertFilesInsideDir(dir, files) {
+  const root = fs8.realpathSync(dir);
+  for (const f of files) {
+    const full = path7.join(dir, f);
+    const inside = fs8.existsSync(full) && fs8.lstatSync(full).isFile() && fs8.realpathSync(full) === path7.join(root, f);
+    if (!inside) {
+      throw new Error(
+        `Bundle file referenced by manifest is missing, not a regular file, or outside the bundle directory: ${f}`
+      );
+    }
+  }
+}
 
 // src/commands/bundle.ts
 var bundleCommand = new Command("bundle").description("Manage application bundles (V2)").addCommand(createCreateCommand()).addCommand(createPushCommand()).addCommand(createGetCommand()).addCommand(createEditCommand());
@@ -1473,13 +1483,13 @@ Note:
     try {
       let manifestConfig = {};
       if (options.manifest) {
-        const manifestPath = path6.resolve(options.manifest);
-        if (!fs7.existsSync(manifestPath)) {
+        const manifestPath = path7.resolve(options.manifest);
+        if (!fs8.existsSync(manifestPath)) {
           console.error(`\u274C Manifest file not found: ${options.manifest}`);
           process.exit(1);
         }
         try {
-          const manifestContent = fs7.readFileSync(manifestPath, "utf8");
+          const manifestContent = fs8.readFileSync(manifestPath, "utf8");
           const parsed = JSON.parse(manifestContent);
           if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
             console.error(`\u274C Invalid manifest file: ${options.manifest}`);
@@ -1550,13 +1560,13 @@ Note:
         );
         process.exit(1);
       }
-      const wasmPath = path6.resolve(wasmFile);
-      if (!fs7.existsSync(wasmPath)) {
+      const wasmPath = path7.resolve(wasmFile);
+      if (!fs8.existsSync(wasmPath)) {
         console.error(`\u274C WASM file not found: ${wasmFile}`);
         process.exit(1);
       }
-      console.log(`\u{1F4E6} Creating MPK bundle from: ${path6.basename(wasmPath)}`);
-      const wasmContent = fs7.readFileSync(wasmPath);
+      console.log(`\u{1F4E6} Creating MPK bundle from: ${path7.basename(wasmPath)}`);
+      const wasmContent = fs8.readFileSync(wasmPath);
       const wasmSize = wasmContent.length;
       const wasmHash = crypto2.createHash("sha256").update(wasmContent).digest("hex");
       let abiArtifact = void 0;
@@ -1565,17 +1575,17 @@ Note:
       const abiPathFromManifest = typeof manifestConfig.abi === "string" ? manifestConfig.abi : null;
       const abiFilePath = abiPathFromOption || abiPathFromManifest;
       if (abiFilePath) {
-        const abiResolvedPath = abiPathFromOption ? path6.resolve(abiFilePath) : options.manifest && abiPathFromManifest ? path6.resolve(
-          path6.dirname(path6.resolve(options.manifest)),
+        const abiResolvedPath = abiPathFromOption ? path7.resolve(abiFilePath) : options.manifest && abiPathFromManifest ? path7.resolve(
+          path7.dirname(path7.resolve(options.manifest)),
           abiFilePath
-        ) : path6.resolve(abiFilePath);
-        if (!fs7.existsSync(abiResolvedPath)) {
+        ) : path7.resolve(abiFilePath);
+        if (!fs8.existsSync(abiResolvedPath)) {
           console.error(`\u274C ABI file not found: ${abiFilePath}`);
           console.error(`   Resolved path: ${abiResolvedPath}`);
           process.exit(1);
         }
         try {
-          abiContent = fs7.readFileSync(abiResolvedPath);
+          abiContent = fs8.readFileSync(abiResolvedPath);
           JSON.parse(abiContent.toString("utf8"));
           const abiHash = crypto2.createHash("sha256").update(abiContent).digest("hex");
           abiArtifact = {
@@ -1584,7 +1594,7 @@ Note:
             size: abiContent.length
           };
           console.log(
-            `   Including ABI file: ${path6.basename(abiResolvedPath)}`
+            `   Including ABI file: ${path7.basename(abiResolvedPath)}`
           );
         } catch (error) {
           console.error(
@@ -1608,7 +1618,7 @@ Note:
       const manifestServices = Array.isArray(
         manifestConfig.services
       ) ? manifestConfig.services : [];
-      const manifestDir = options.manifest ? path6.dirname(path6.resolve(options.manifest)) : process.cwd();
+      const manifestDir = options.manifest ? path7.dirname(path7.resolve(options.manifest)) : process.cwd();
       const allServiceSources = [
         ...cliServices.map((src) => ({ src, baseDir: process.cwd() })),
         ...manifestServices.map((src) => ({ src, baseDir: manifestDir }))
@@ -1642,15 +1652,15 @@ Note:
           );
           process.exit(1);
         }
-        const svcWasmPath = path6.resolve(baseDir, src.wasm);
-        if (!fs7.existsSync(svcWasmPath)) {
+        const svcWasmPath = path7.resolve(baseDir, src.wasm);
+        if (!fs8.existsSync(svcWasmPath)) {
           console.error(
             `\u274C Service "${src.name}" WASM not found: ${src.wasm}`
           );
           console.error(`   Resolved path: ${svcWasmPath}`);
           process.exit(1);
         }
-        const svcWasmContent = fs7.readFileSync(svcWasmPath);
+        const svcWasmContent = fs8.readFileSync(svcWasmPath);
         const svcWasmHash = crypto2.createHash("sha256").update(svcWasmContent).digest("hex");
         const wasmArchivePath = serviceWasmPath(src.name);
         const entry = {
@@ -1666,15 +1676,15 @@ Note:
           content: svcWasmContent
         });
         if (src.abi) {
-          const svcAbiPath = path6.resolve(baseDir, src.abi);
-          if (!fs7.existsSync(svcAbiPath)) {
+          const svcAbiPath = path7.resolve(baseDir, src.abi);
+          if (!fs8.existsSync(svcAbiPath)) {
             console.error(
               `\u274C Service "${src.name}" ABI not found: ${src.abi}`
             );
             console.error(`   Resolved path: ${svcAbiPath}`);
             process.exit(1);
           }
-          const svcAbiContent = fs7.readFileSync(svcAbiPath);
+          const svcAbiContent = fs8.readFileSync(svcAbiPath);
           try {
             JSON.parse(svcAbiContent.toString("utf8"));
           } catch (error) {
@@ -1700,7 +1710,7 @@ Note:
         }
         serviceArtifacts.push(entry);
         console.log(
-          `   Including service: ${src.name} (${path6.basename(svcWasmPath)})`
+          `   Including service: ${src.name} (${path7.basename(svcWasmPath)})`
         );
       }
       const metadata = {
@@ -1733,30 +1743,30 @@ Note:
         links: Object.keys(links).length > 0 ? links : void 0,
         signature: void 0
       };
-      let outputDir = finalOutput ? path6.resolve(finalOutput) : path6.join(process.cwd(), finalPackage, finalVersion);
-      if (!fs7.existsSync(outputDir)) {
-        fs7.mkdirSync(outputDir, { recursive: true });
+      let outputDir = finalOutput ? path7.resolve(finalOutput) : path7.join(process.cwd(), finalPackage, finalVersion);
+      if (!fs8.existsSync(outputDir)) {
+        fs8.mkdirSync(outputDir, { recursive: true });
       }
-      fs7.writeFileSync(
-        path6.join(outputDir, "manifest.json"),
+      fs8.writeFileSync(
+        path7.join(outputDir, "manifest.json"),
         JSON.stringify(manifest, null, 2)
       );
-      fs7.writeFileSync(path6.join(outputDir, "app.wasm"), wasmContent);
+      fs8.writeFileSync(path7.join(outputDir, "app.wasm"), wasmContent);
       if (abiContent) {
-        fs7.writeFileSync(path6.join(outputDir, "abi.json"), abiContent);
+        fs8.writeFileSync(path7.join(outputDir, "abi.json"), abiContent);
       }
-      const servicesDir = path6.join(outputDir, "services");
+      const servicesDir = path7.join(outputDir, "services");
       for (const { relPath, content } of serviceFilesToWrite) {
-        const dest = path6.join(outputDir, relPath);
-        const rel = path6.relative(servicesDir, dest);
-        if (rel.startsWith("..") || path6.isAbsolute(rel)) {
+        const dest = path7.join(outputDir, relPath);
+        const rel = path7.relative(servicesDir, dest);
+        if (rel.startsWith("..") || path7.isAbsolute(rel)) {
           console.error(
             `\u274C Refusing to write service file outside services/: ${relPath}`
           );
           process.exit(1);
         }
-        fs7.mkdirSync(path6.dirname(dest), { recursive: true });
-        fs7.writeFileSync(dest, content);
+        fs8.mkdirSync(path7.dirname(dest), { recursive: true });
+        fs8.writeFileSync(dest, content);
       }
       console.log(`\u2705 Bundle files written to: ${outputDir}`);
       console.log(`   Package: ${finalPackage}`);
@@ -1773,7 +1783,7 @@ Note:
       console.log("");
       console.log("Next steps:");
       console.log(
-        `  1. Sign the manifest:  mero-sign sign ${path6.join(outputDir, "manifest.json")} --key key.json`
+        `  1. Sign the manifest:  mero-sign sign ${path7.join(outputDir, "manifest.json")} --key key.json`
       );
       console.log(
         `  2. Push the bundle:    calimero-registry bundle push ${outputDir} --remote`
@@ -1806,7 +1816,7 @@ Examples:
 Configuration:
   Set defaults using the config command:
   $ calimero-registry config set registry-url https://apps.calimero.network
-  $ calimero-registry config set api-key your-api-key
+  $ calimero-registry config set api-key   # paste the key when asked
   
   Or use environment variables:
   $ export CALIMERO_REGISTRY_URL=https://apps.calimero.network
@@ -1843,30 +1853,30 @@ Note:
         );
         process.exit(1);
       }
-      const fullPath = path6.resolve(bundleFile);
-      if (!fs7.existsSync(fullPath)) {
+      const fullPath = path7.resolve(bundleFile);
+      if (!fs8.existsSync(fullPath)) {
         console.error(`\u274C File not found: ${bundleFile}`);
         process.exit(1);
       }
       mpkPath = fullPath;
-      if (fs7.statSync(fullPath).isDirectory()) {
-        const manifestInDir = path6.join(fullPath, "manifest.json");
-        const wasmInDir = path6.join(fullPath, "app.wasm");
-        if (!fs7.existsSync(manifestInDir)) {
+      if (fs8.statSync(fullPath).isDirectory()) {
+        const manifestInDir = path7.join(fullPath, "manifest.json");
+        const wasmInDir = path7.join(fullPath, "app.wasm");
+        if (!fs8.existsSync(manifestInDir)) {
           console.error(
             `\u274C manifest.json not found in directory: ${fullPath}`
           );
           process.exit(1);
         }
-        if (!fs7.existsSync(wasmInDir)) {
+        if (!fs8.existsSync(wasmInDir)) {
           console.error(`\u274C app.wasm not found in directory: ${fullPath}`);
           process.exit(1);
         }
-        tempMpk = path6.join(fullPath, `.temp-push-${Date.now()}.mpk`);
+        tempMpk = path7.join(fullPath, `.temp-push-${Date.now()}.mpk`);
         let dirManifest;
         try {
           dirManifest = JSON.parse(
-            fs7.readFileSync(manifestInDir, "utf8")
+            fs8.readFileSync(manifestInDir, "utf8")
           );
         } catch (e) {
           console.error(
@@ -1898,13 +1908,11 @@ Note:
           console.error(`\u274C ${e instanceof Error ? e.message : String(e)}`);
           process.exit(1);
         }
-        for (const f of archiveFiles) {
-          if (!fs7.existsSync(path6.join(fullPath, f))) {
-            console.error(
-              `\u274C Bundle file referenced by manifest not found: ${f}`
-            );
-            process.exit(1);
-          }
+        try {
+          assertFilesInsideDir(fullPath, archiveFiles);
+        } catch (e) {
+          console.error(`${e instanceof Error ? e.message : String(e)}`);
+          process.exit(1);
         }
         await tar.create(
           { gzip: true, file: tempMpk, cwd: fullPath },
@@ -1915,7 +1923,7 @@ Note:
           `\u{1F4E6} Packed directory into temporary bundle (${archiveFiles.length} files)`
         );
       }
-      console.log(`\u{1F4E6} Processing bundle: ${path6.basename(mpkPath)}`);
+      console.log(`\u{1F4E6} Processing bundle: ${path7.basename(mpkPath)}`);
       const manifest = await extractManifest(mpkPath);
       if (!manifest) {
         console.error("\u274C manifest.json not found in bundle");
@@ -1963,8 +1971,8 @@ Note:
       console.error("\u274C Failed to push bundle:", message);
       process.exit(1);
     } finally {
-      if (tempMpk && fs7.existsSync(tempMpk)) {
-        fs7.rmSync(tempMpk);
+      if (tempMpk && fs8.existsSync(tempMpk)) {
+        fs8.rmSync(tempMpk);
       }
     }
   });
@@ -2034,12 +2042,12 @@ Examples:
       };
       if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
       if (options.manifest) {
-        const manifestPath = path6.resolve(options.manifest);
-        if (!fs7.existsSync(manifestPath)) {
+        const manifestPath = path7.resolve(options.manifest);
+        if (!fs8.existsSync(manifestPath)) {
           console.error(`\u274C Manifest file not found: ${options.manifest}`);
           process.exit(1);
         }
-        const raw = fs7.readFileSync(manifestPath, "utf8");
+        const raw = fs8.readFileSync(manifestPath, "utf8");
         let manifest2;
         try {
           manifest2 = JSON.parse(raw);
@@ -2126,8 +2134,8 @@ Examples:
         if (!manifest.links) manifest.links = {};
         manifest.links.docs = options.docs;
       }
-      const outputPath = path6.resolve(options.output || "manifest.json");
-      fs7.writeFileSync(outputPath, JSON.stringify(manifest, null, 2));
+      const outputPath = path7.resolve(options.output || "manifest.json");
+      fs8.writeFileSync(outputPath, JSON.stringify(manifest, null, 2));
       console.log(`\u2705 Wrote modified manifest to: ${outputPath}`);
       console.log("");
       console.log("Next steps:");
@@ -2147,7 +2155,7 @@ Examples:
 async function pushToRemote(bundlePath, manifest, registryUrl, apiKey) {
   try {
     console.log(`\u{1F4E4} Pushing to remote registry: ${registryUrl}`);
-    const bundleBuffer = fs7.readFileSync(bundlePath);
+    const bundleBuffer = fs8.readFileSync(bundlePath);
     const bundleSize = bundleBuffer.length;
     console.log(`   Bundle size: ${bundleSize} bytes`);
     const bundleHex = bundleBuffer.toString("hex");
@@ -2302,25 +2310,25 @@ async function extractManifest(bundlePath) {
       if (entry.path === "manifest.json") ;
     }
   });
-  const extractDir = path6.join(path6.dirname(bundlePath), `.temp-${Date.now()}`);
-  if (!fs7.existsSync(extractDir)) {
-    fs7.mkdirSync(extractDir);
+  const extractDir = path7.join(path7.dirname(bundlePath), `.temp-${Date.now()}`);
+  if (!fs8.existsSync(extractDir)) {
+    fs8.mkdirSync(extractDir);
   }
   try {
     await tar.x({
       file: bundlePath,
       cwd: extractDir,
-      filter: (path7) => path7 === "manifest.json"
+      filter: (path8) => path8 === "manifest.json"
     });
-    const manifestPath = path6.join(extractDir, "manifest.json");
-    if (fs7.existsSync(manifestPath)) {
-      const content = fs7.readFileSync(manifestPath, "utf8");
+    const manifestPath = path7.join(extractDir, "manifest.json");
+    if (fs8.existsSync(manifestPath)) {
+      const content = fs8.readFileSync(manifestPath, "utf8");
       manifestContent = content;
     }
   } catch {
   } finally {
-    if (fs7.existsSync(extractDir)) {
-      fs7.rmSync(extractDir, { recursive: true, force: true });
+    if (fs8.existsSync(extractDir)) {
+      fs8.rmSync(extractDir, { recursive: true, force: true });
     }
   }
   if (manifestContent) {
@@ -2335,13 +2343,17 @@ async function extractManifest(bundlePath) {
 }
 var configCommand = new Command("config").description("Manage CLI configuration for remote registry").addCommand(createConfigSetCommand()).addCommand(createConfigGetCommand()).addCommand(createConfigListCommand()).addCommand(createConfigResetCommand());
 function createConfigSetCommand() {
-  return new Command("set").description("Set a configuration value").argument("<key>", "Configuration key (registry-url, api-key)").argument("<value>", "Configuration value").action((key, value) => {
+  return new Command("set").description("Set a configuration value").argument("<key>", "Configuration key (registry-url, api-key)").argument(
+    "[value]",
+    "Configuration value; for api-key, omit it to read the key from stdin"
+  ).action(async (key, value) => {
     try {
       const config = new RemoteConfig();
       switch (key) {
         case "registry-url":
         case "registryUrl":
         case "url":
+          if (!value) throw new Error("registry-url needs a value");
           config.setRegistryUrl(value);
           console.log(
             chalk4.green(`\u2705 Registry URL set to: ${chalk4.bold(value)}`)
@@ -2349,7 +2361,7 @@ function createConfigSetCommand() {
           break;
         case "api-key":
         case "apiKey":
-          config.setApiKey(value);
+          config.setApiKey(value ?? await readApiKey());
           console.log(chalk4.green("\u2705 API key set successfully"));
           console.log(
             chalk4.yellow(
@@ -2371,6 +2383,17 @@ function createConfigSetCommand() {
     }
   });
 }
+async function readApiKey() {
+  if (process.stdin.isTTY) process.stderr.write("Paste the API key: ");
+  let input = "";
+  for await (const chunk of process.stdin) {
+    input += chunk;
+    if (process.stdin.isTTY && input.includes("\n")) break;
+  }
+  const key = input.trim();
+  if (!key) throw new Error("No API key on stdin");
+  return key;
+}
 function createConfigGetCommand() {
   return new Command("get").description("Get a configuration value").argument("<key>", "Configuration key (registry-url, api-key)").action((key) => {
     try {
@@ -2417,7 +2440,7 @@ function createConfigListCommand() {
       const config = new RemoteConfig();
       console.log(chalk4.blue("\n\u{1F4CB} Remote Registry Configuration\n"));
       const configPath = config.getConfigPath();
-      const configFileExists = fs7.existsSync(configPath);
+      const configFileExists = fs8.existsSync(configPath);
       const url = config.getRegistryUrl();
       let urlSource;
       if (process.env.CALIMERO_REGISTRY_URL) {
@@ -2498,7 +2521,7 @@ function getAuthHeaders(url) {
   const apiKey = remoteConfig.getApiKey();
   if (!apiKey) {
     throw new Error(
-      "API token required for org write operations.\nGet a token from the Organizations page in the web UI, then run:\n  calimero-registry config set api-key <token>"
+      "API token required for org write operations.\nGet a token from the Organizations page in the web UI, then run:\n  calimero-registry config set api-key   (paste the token when asked)"
     );
   }
   RemoteConfig.assertApiKeyTransport(url, apiKey);