@bitsocial/bitsocial-cli 0.19.64 → 0.19.65

package/README.md

@@ -304,6 +304,7 @@ $ bitsocial community edit mysub.bso '--roles["author-address.bso"]' null
 * [`bitsocial community create`](#bitsocial-community-create)
 * [`bitsocial community delete ADDRESSES`](#bitsocial-community-delete-addresses)
 * [`bitsocial community edit ADDRESS`](#bitsocial-community-edit-address)
+* [`bitsocial community export [ADDRESS]`](#bitsocial-community-export-address)
 * [`bitsocial community get [ADDRESS]`](#bitsocial-community-get-address)
 * [`bitsocial community list`](#bitsocial-community-list)
 * [`bitsocial community start ADDRESSES`](#bitsocial-community-start-addresses)
@@ -344,7 +345,7 @@ EXAMPLES
   $ bitsocial challenge install ./my-local-challenge
 ```
 
-_See code: [src/cli/commands/challenge/install.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/challenge/install.ts)_
+_See code: [src/cli/commands/challenge/install.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/challenge/install.ts)_
 
 ## `bitsocial challenge list`
 
@@ -367,7 +368,7 @@ EXAMPLES
   $ bitsocial challenge list -q
 ```
 
-_See code: [src/cli/commands/challenge/list.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/challenge/list.ts)_
+_See code: [src/cli/commands/challenge/list.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/challenge/list.ts)_
 
 ## `bitsocial challenge remove NAME`
 
@@ -392,7 +393,7 @@ EXAMPLES
   $ bitsocial challenge remove @scope/my-challenge
 ```
 
-_See code: [src/cli/commands/challenge/remove.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/challenge/remove.ts)_
+_See code: [src/cli/commands/challenge/remove.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/challenge/remove.ts)_
 
 ## `bitsocial community create`
 
@@ -422,7 +423,7 @@ EXAMPLES
     $ bitsocial community create --jsonFile ./create-options.json
 ```
 
-_See code: [src/cli/commands/community/create.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/create.ts)_
+_See code: [src/cli/commands/community/create.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/create.ts)_
 
 ## `bitsocial community delete ADDRESSES`
 
@@ -447,7 +448,7 @@ EXAMPLES
   $ bitsocial community delete 12D3KooWG3XbzoVyAE6Y9vHZKF64Yuuu4TjdgQKedk14iYmTEPWu
 ```
 
-_See code: [src/cli/commands/community/delete.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/delete.ts)_
+_See code: [src/cli/commands/community/delete.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/delete.ts)_
 
 ## `bitsocial community edit ADDRESS`
 
@@ -517,7 +518,48 @@ EXAMPLES
     $ bitsocial community edit bitsocial.bso --jsonFile ./edit-options.json
 ```
 
-_See code: [src/cli/commands/community/edit.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/edit.ts)_
+_See code: [src/cli/commands/community/edit.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/edit.ts)_
+
+## `bitsocial community export [ADDRESS]`
+
+Export a local community to a SQLite snapshot file. The export runs on the RPC server (daemon); once finished the snapshot is downloaded and its sha256 checksum is verified. Pass --includePrivateKey to produce a restorable backup that keeps the community's address.
+
+```
+USAGE
+  $ bitsocial community export [ADDRESS] --pkcRpcUrl <value> [--name <value>] [--publicKey <value>] [-o <value>]
+    [--includePrivateKey] [--force] [-q]
+
+ARGUMENTS
+  [ADDRESS]  Address of the community to export
+
+FLAGS
+  -o, --path=<value>       Destination file for the downloaded snapshot (default:
+                           <dataPath>/exports/<address>_<datetime>.sqlite)
+  -q, --quiet              Suppress progress output; only print the path of the downloaded snapshot
+      --force              Overwrite the destination file if it already exists
+      --includePrivateKey  Ask the RPC server to include the community signer's private key in the export. Required for
+                           a restorable backup that keeps the same community address. The daemon may refuse (see
+                           `bitsocial daemon --no-allowPrivateKeyExport`)
+      --name=<value>       Name of the community to export
+      --pkcRpcUrl=<value>  (required) [default: ws://localhost:9138/] URL to PKC RPC
+      --publicKey=<value>  Public key of the community to export
+
+DESCRIPTION
+  Export a local community to a SQLite snapshot file. The export runs on the RPC server (daemon); once finished the
+  snapshot is downloaded and its sha256 checksum is verified. Pass --includePrivateKey to produce a restorable backup
+  that keeps the community's address.
+
+EXAMPLES
+  $ bitsocial community export plebmusic.bso
+
+  $ bitsocial community export plebmusic.bso --includePrivateKey -o ./backups/plebmusic.sqlite
+
+  $ bitsocial community export --name my-community
+
+  $ bitsocial community export --publicKey 12D3KooWG3XbzoVyAE6Y9vHZKF64Yuuu4TjdgQKedk14iYmTEPWu
+```
+
+_See code: [src/cli/commands/community/export.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/export.ts)_
 
 ## `bitsocial community get [ADDRESS]`
 
@@ -548,7 +590,7 @@ EXAMPLES
   $ bitsocial community get --publicKey 12D3KooWG3XbzoVyAE6Y9vHZKF64Yuuu4TjdgQKedk14iYmTEPWu
 ```
 
-_See code: [src/cli/commands/community/get.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/get.ts)_
+_See code: [src/cli/commands/community/get.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/get.ts)_
 
 ## `bitsocial community list`
 
@@ -571,7 +613,7 @@ EXAMPLES
   $ bitsocial community list
 ```
 
-_See code: [src/cli/commands/community/list.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/list.ts)_
+_See code: [src/cli/commands/community/list.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/list.ts)_
 
 ## `bitsocial community start ADDRESSES`
 
@@ -605,7 +647,7 @@ EXAMPLES
     $ bitsocial community start $(bitsocial community list -q) --concurrency 1
 ```
 
-_See code: [src/cli/commands/community/start.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/start.ts)_
+_See code: [src/cli/commands/community/start.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/start.ts)_
 
 ## `bitsocial community stop ADDRESSES`
 
@@ -630,7 +672,7 @@ EXAMPLES
   $ bitsocial community stop Qmb99crTbSUfKXamXwZBe829Vf6w5w5TktPkb6WstC9RFW
 ```
 
-_See code: [src/cli/commands/community/stop.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/community/stop.ts)_
+_See code: [src/cli/commands/community/stop.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/community/stop.ts)_
 
 ## `bitsocial daemon`
 
@@ -639,8 +681,12 @@ Run a network-connected Bitsocial node. Once the daemon is running you can creat
 ```
 USAGE
   $ bitsocial daemon --pkcRpcUrl <value> --logPath <value> [--chainProviderUrls <value>...]
+    [--allowPrivateKeyExport]
 
 FLAGS
+  --[no-]allowPrivateKeyExport    Allow RPC clients to request community exports that include the community signer's
+                                  private key (`bitsocial community export --includePrivateKey`). Disable with
+                                  --no-allowPrivateKeyExport when exposing the RPC to untrusted clients
   --chainProviderUrls=<value>...  [default:
                                   https://eth.drpc.org,https://ethereum.publicnode.com,https://ethereum-rpc.publicnode.c
                                   om,https://rpc.mevblocker.io,https://1rpc.io/eth,https://eth-pokt.nodies.app] RPC
@@ -669,9 +715,11 @@ EXAMPLES
   $ bitsocial daemon --pkcOptions.kuboRpcClientsOptions[0] https://remoteipfsnode.com
 
   $ bitsocial daemon --chainProviderUrls https://mainnet.infura.io/v3/YOUR_KEY
+
+  $ bitsocial daemon --no-allowPrivateKeyExport
 ```
 
-_See code: [src/cli/commands/daemon.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/daemon.ts)_
+_See code: [src/cli/commands/daemon.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/daemon.ts)_
 
 ## `bitsocial help [COMMAND]`
 
@@ -737,7 +785,7 @@ EXAMPLES
   $ bitsocial logs --stdout -f
 ```
 
-_See code: [src/cli/commands/logs.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/logs.ts)_
+_See code: [src/cli/commands/logs.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/logs.ts)_
 
 ## `bitsocial update check`
 
@@ -754,7 +802,7 @@ EXAMPLES
   $ bitsocial update check
 ```
 
-_See code: [src/cli/commands/update/check.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/update/check.ts)_
+_See code: [src/cli/commands/update/check.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/update/check.ts)_
 
 ## `bitsocial update install [VERSION]`
 
@@ -786,7 +834,7 @@ EXAMPLES
   $ bitsocial update install --no-restart-daemons
 ```
 
-_See code: [src/cli/commands/update/install.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/update/install.ts)_
+_See code: [src/cli/commands/update/install.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/update/install.ts)_
 
 ## `bitsocial update versions`
 
@@ -808,7 +856,7 @@ EXAMPLES
   $ bitsocial update versions --limit 5
 ```
 
-_See code: [src/cli/commands/update/versions.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.64/src/cli/commands/update/versions.ts)_
+_See code: [src/cli/commands/update/versions.ts](https://github.com/bitsocialnet/bitsocial-cli/blob/v0.19.65/src/cli/commands/update/versions.ts)_
 <!-- commandsstop -->
 
 ## Contribution

package/dist/cli/ascii-banner.d.ts

@@ -1 +1,8 @@
-export declare function printBanner(): void;
+interface RenderBannerOptions {
+    env?: Record<string, string | undefined>;
+    forceColor?: boolean;
+    stdoutIsTTY?: boolean;
+}
+export declare function renderBanner(options?: RenderBannerOptions): string;
+export declare function printBanner(options?: RenderBannerOptions): void;
+export {};

package/dist/cli/ascii-banner.js

@@ -5,8 +5,8 @@
 //
 // COLORS is the paint map. Each character corresponds 1:1 to the character
 // at the same position in SHAPE:
-//   B = blue   (#1a4fd0) — the sphere
-//   S = silver (#e5e7eb) — the rings and the "Bitsocial" text
+//   B = blue accent — the sphere
+//   S = default foreground — the rings and the "Bitsocial" text
 //   . = no color (pass the glyph through as-is; use this for spaces)
 //
 // To retouch the art, find a glyph in SHAPE, then flip the character at the
@@ -15,7 +15,8 @@
 //
 // Both grids MUST have the same number of rows. Each row in COLORS must be at
 // least as wide as the corresponding SHAPE row (extra chars are ignored).
-// Palette sourced from bitsocialnet/bitsocial-web/about/tailwind.config.ts.
+// Use the terminal's default foreground for the wordmark/rings so the banner
+// stays readable on both light and dark terminal themes.
 const SHAPE = [
     "                ⢀⣴⣿⣿⣦⡀                                                                                       ",
     "                ⣾⣿⠁⠈⣿⣷⡀                                                                                      ",
@@ -56,39 +57,45 @@ const COLORS = [
     "...............SSSSSSSS......................................................................................",
     "................SSSSSS......................................................................................."
 ];
-const BLUE = "\x1b[38;2;26;79;208m";
-const SILVER = "\x1b[38;2;229;231;235m";
-const RESET = "\x1b[0m";
+const BLUE = "\x1b[94m";
+const DEFAULT_FOREGROUND = "\x1b[39m";
 function paint(shape, colors) {
     let out = "";
-    let current = ".";
+    let blueActive = false;
     for (let i = 0; i < shape.length; i++) {
         const glyph = shape[i];
         const want = colors[i] ?? ".";
-        if (want !== current) {
-            if (current !== ".")
-                out += RESET;
-            if (want === "B")
-                out += BLUE;
-            else if (want === "S")
-                out += SILVER;
-            current = want;
+        const wantBlue = want === "B";
+        if (wantBlue !== blueActive) {
+            out += wantBlue ? BLUE : DEFAULT_FOREGROUND;
+            blueActive = wantBlue;
         }
         out += glyph;
     }
-    if (current !== ".")
-        out += RESET;
+    if (blueActive)
+        out += DEFAULT_FOREGROUND;
     return out;
 }
-function supportsColor() {
-    if (process.env["NO_COLOR"])
+function envForcesColor(value) {
+    if (value === undefined)
         return false;
-    if (process.env["FORCE_COLOR"])
+    return value !== "0" && value.toLowerCase() !== "false";
+}
+function supportsColor(options = {}) {
+    const env = options.env ?? process.env;
+    if (env["NO_COLOR"] !== undefined)
+        return false;
+    if (options.forceColor)
         return true;
-    return Boolean(process.stdout.isTTY);
+    if (env["FORCE_COLOR"] !== undefined)
+        return envForcesColor(env["FORCE_COLOR"]);
+    return Boolean(options.stdoutIsTTY ?? process.stdout.isTTY);
 }
-export function printBanner() {
-    const useColor = supportsColor();
+export function renderBanner(options = {}) {
+    const useColor = supportsColor(options);
     const lines = SHAPE.map((row, i) => (useColor ? paint(row, COLORS[i] ?? "") : row));
-    process.stdout.write(lines.join("\n") + "\n\n");
+    return lines.join("\n") + "\n\n";
+}
+export function printBanner(options = {}) {
+    process.stdout.write(renderBanner(options));
 }

package/dist/cli/commands/community/export.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from "../../base-command.js";
+export default class Export extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        address: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        name: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        publicKey: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        path: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        includePrivateKey: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    private _printProgress;
+    run(): Promise<void>;
+    /** Start the export on the RPC server and resolve with the terminal record (progress === 1). */
+    private _runExport;
+    /** Download the finished snapshot to destPath, verifying its sha256 against the export record. */
+    private _downloadAndVerify;
+}

package/dist/cli/commands/community/export.js

@@ -0,0 +1,198 @@
+import { Args, Flags } from "@oclif/core";
+import { BaseCommand } from "../../base-command.js";
+import defaults from "../../../common-utils/defaults.js";
+import { PKCLogger } from "../../../util.js";
+import { createHash } from "node:crypto";
+import { createWriteStream } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+export default class Export extends BaseCommand {
+    static description = "Export a local community to a SQLite snapshot file. The export runs on the RPC server (daemon); once finished the snapshot is downloaded and its sha256 checksum is verified. Pass --includePrivateKey to produce a restorable backup that keeps the community's address.";
+    static examples = [
+        "bitsocial community export plebmusic.bso",
+        "bitsocial community export plebmusic.bso --includePrivateKey -o ./backups/plebmusic.sqlite",
+        "bitsocial community export --name my-community",
+        "bitsocial community export --publicKey 12D3KooWG3XbzoVyAE6Y9vHZKF64Yuuu4TjdgQKedk14iYmTEPWu"
+    ];
+    static args = {
+        address: Args.string({
+            name: "address",
+            required: false,
+            description: "Address of the community to export"
+        })
+    };
+    static flags = {
+        name: Flags.string({
+            description: "Name of the community to export"
+        }),
+        publicKey: Flags.string({
+            description: "Public key of the community to export"
+        }),
+        path: Flags.string({
+            char: "o",
+            description: "Destination file for the downloaded snapshot (default: <dataPath>/exports/<address>_<datetime>.sqlite)"
+        }),
+        includePrivateKey: Flags.boolean({
+            default: false,
+            description: "Ask the RPC server to include the community signer's private key in the export. Required for a restorable backup that keeps the same community address. The daemon may refuse (see `bitsocial daemon --no-allowPrivateKeyExport`)"
+        }),
+        force: Flags.boolean({
+            default: false,
+            description: "Overwrite the destination file if it already exists"
+        }),
+        quiet: Flags.boolean({
+            char: "q",
+            default: false,
+            description: "Suppress progress output; only print the path of the downloaded snapshot"
+        })
+    };
+    _printProgress(quiet, message) {
+        if (!quiet)
+            process.stderr.write(message);
+    }
+    async run() {
+        const { args, flags } = await this.parse(Export);
+        const log = PKCLogger("bitsocial-cli:commands:community:export");
+        log(`args: `, args);
+        log(`flags: `, flags);
+        const lookupParam = {};
+        if (args.address)
+            lookupParam.address = args.address;
+        if (flags.name)
+            lookupParam.name = flags.name;
+        if (flags.publicKey)
+            lookupParam.publicKey = flags.publicKey;
+        if (Object.keys(lookupParam).length === 0) {
+            this.error("At least one of address argument, --name, or --publicKey must be provided");
+        }
+        const pkc = await this._connectToPkcRpc(flags.pkcRpcUrl.toString());
+        // Cancel the in-flight export server-side on Ctrl+C. A second Ctrl+C force-exits
+        // (the handler is registered with `once`, so the default SIGINT behavior is restored).
+        const abortController = new AbortController();
+        const onSigint = () => {
+            this._printProgress(flags.quiet, "\nCancelling export... (Ctrl+C again to force exit)\n");
+            abortController.abort();
+        };
+        process.once("SIGINT", onSigint);
+        try {
+            const community = (await pkc.createCommunity(lookupParam));
+            if (typeof community.export !== "function") {
+                this.error(`Community is not local to the RPC server at ${flags.pkcRpcUrl}. Only communities created on this daemon can be exported`);
+            }
+            const exportableCommunity = community;
+            // Datetime in the filename matches the daemon log convention (ISO 8601 with ':' → '-')
+            // so repeated exports never collide and snapshots sort chronologically
+            const defaultFilename = `${exportableCommunity.address}_${new Date().toISOString().replace(/:/g, "-")}.sqlite`;
+            const destPath = path.resolve(flags.path ?? path.join(defaults.PKC_DATA_PATH, "exports", defaultFilename));
+            const destExists = await fs
+                .stat(destPath)
+                .then(() => true)
+                .catch(() => false);
+            if (destExists && !flags.force) {
+                this.error(`Destination file already exists: ${destPath}. Use --force to overwrite it`);
+            }
+            const finishedRecord = await this._runExport(exportableCommunity, flags.includePrivateKey, abortController.signal, flags.quiet);
+            log("Export finished on the RPC server", finishedRecord);
+            if (!finishedRecord.url) {
+                this.error(`Export ${finishedRecord.exportId} finished but the RPC server did not provide a download URL`);
+            }
+            // Mirrors pkc-js's rpcHttpOrigin: the ws[s]:// RPC URL with the protocol swapped to http[s]://
+            const parsedRpcUrl = new URL(flags.pkcRpcUrl.toString());
+            const expectedDownloadOrigin = `${parsedRpcUrl.protocol === "wss:" ? "https:" : "http:"}//${parsedRpcUrl.host}`;
+            await this._downloadAndVerify(finishedRecord, destPath, abortController.signal, flags.quiet, expectedDownloadOrigin);
+            this.log(destPath);
+        }
+        catch (e) {
+            console.error(e);
+            await pkc.destroy();
+            this.exit(1);
+        }
+        finally {
+            process.removeListener("SIGINT", onSigint);
+        }
+        await pkc.destroy();
+    }
+    /** Start the export on the RPC server and resolve with the terminal record (progress === 1). */
+    async _runExport(community, includePrivateKey, signal, quiet) {
+        const { exportId } = await community.export({ includePrivateKey, signal });
+        return new Promise((resolve, reject) => {
+            let lastPrintedPercent = -1;
+            const cleanup = () => {
+                community.removeListener("exportschange", checkRecords);
+                signal.removeEventListener("abort", onAbort);
+            };
+            // Don't wait for the server's terminal ERR_EXPORT_CANCELLED record — it never arrives if the
+            // daemon died or the connection dropped. pkc-js's own abort listener (registered inside
+            // community.export(), before this one) already dispatched cancelExport() to the server.
+            const onAbort = () => {
+                cleanup();
+                reject(new Error("Export cancelled"));
+            };
+            const checkRecords = (records) => {
+                const record = records.find((rec) => rec.exportId === exportId);
+                if (!record)
+                    return;
+                if (record.error) {
+                    cleanup();
+                    reject(new Error(`Export failed (${record.error.code}): ${record.error.message}`));
+                }
+                else if (record.progress === 1) {
+                    cleanup();
+                    this._printProgress(quiet, `\rExporting ${community.address}: 100%\n`);
+                    resolve(record);
+                }
+                else {
+                    const percent = Math.floor(record.progress * 100);
+                    if (percent !== lastPrintedPercent) {
+                        lastPrintedPercent = percent;
+                        this._printProgress(quiet, `\rExporting ${community.address}: ${percent}%`);
+                    }
+                }
+            };
+            community.on("exportschange", checkRecords);
+            signal.addEventListener("abort", onAbort, { once: true });
+            if (signal.aborted)
+                return onAbort();
+            // The terminal notification may have arrived before the listener was attached
+            checkRecords(community.exports);
+        });
+    }
+    /** Download the finished snapshot to destPath, verifying its sha256 against the export record. */
+    async _downloadAndVerify(record, destPath, signal, quiet, expectedOrigin) {
+        // The export download contract is GET <rpc-http-origin>/exports/<exportId> — refuse anything else
+        // so a misconfigured/compromised RPC server can't use the CLI to fetch arbitrary URLs
+        const downloadUrl = new URL(record.url);
+        if (downloadUrl.origin !== expectedOrigin || !downloadUrl.pathname.startsWith("/exports/")) {
+            this.error(`Refusing to download export from unexpected URL ${record.url} (expected ${expectedOrigin}/exports/<exportId>)`);
+        }
+        this._printProgress(quiet, `Downloading snapshot from ${downloadUrl}\n`);
+        const response = await fetch(downloadUrl, { signal });
+        if (!response.ok || !response.body) {
+            this.error(`Failed to download export from ${record.url}: HTTP ${response.status}`);
+        }
+        await fs.mkdir(path.dirname(destPath), { recursive: true });
+        // Download to a .partial file so an interrupted/corrupted download never clobbers destPath
+        const partialPath = destPath + ".partial";
+        const hash = createHash("sha256");
+        try {
+            await pipeline(Readable.fromWeb(response.body), async function* (source) {
+                for await (const chunk of source) {
+                    hash.update(chunk);
+                    yield chunk;
+                }
+            }, createWriteStream(partialPath));
+            const downloadedSha256 = hash.digest("hex");
+            if (record.sha256 && downloadedSha256 !== record.sha256) {
+                throw new Error(`sha256 mismatch for downloaded export: expected ${record.sha256} but downloaded file hashes to ${downloadedSha256}`);
+            }
+            await fs.rename(partialPath, destPath);
+        }
+        catch (e) {
+            await fs.rm(partialPath, { force: true }).catch(() => { });
+            throw e;
+        }
+        this._printProgress(quiet, `Verified sha256 (${record.sha256}) and saved snapshot${record.size ? ` (${record.size} bytes)` : ""}\n`);
+    }
+}

package/dist/cli/commands/daemon.d.ts

@@ -26,6 +26,7 @@ export default class Daemon extends Command {
         pkcRpcUrl: import("@oclif/core/interfaces").OptionFlag<import("url").URL, import("@oclif/core/interfaces").CustomOptions>;
         logPath: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         chainProviderUrls: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        allowPrivateKeyExport: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     static examples: string[];
     private _setupLogger;

package/dist/cli/commands/daemon.js

@@ -83,6 +83,11 @@ export default class Daemon extends Command {
             description: "RPC URL(s) for .bso name resolution. Can be specified multiple times.",
             multiple: true,
             default: DEFAULT_PROVIDERS
+        }),
+        allowPrivateKeyExport: Flags.boolean({
+            description: "Allow RPC clients to request community exports that include the community signer's private key (`bitsocial community export --includePrivateKey`). Disable with --no-allowPrivateKeyExport when exposing the RPC to untrusted clients",
+            allowNo: true,
+            default: true
         })
     };
     static examples = [
@@ -91,6 +96,7 @@ export default class Daemon extends Command {
         "bitsocial daemon --pkcOptions.dataPath /tmp/bitsocial-datapath/",
         "bitsocial daemon --pkcOptions.kuboRpcClientsOptions[0] https://remoteipfsnode.com",
         "bitsocial daemon --chainProviderUrls https://mainnet.infura.io/v3/YOUR_KEY",
+        "bitsocial daemon --no-allowPrivateKeyExport",
     ];
     _setupLogger(Logger) {
         setupDebugLogger(Logger, { enableDefaultNamespace: true });
@@ -187,7 +193,8 @@ export default class Daemon extends Command {
         return { logFilePath, stdoutWrite, fileLogger };
     }
     async run() {
-        printBanner();
+        // Daemon output is often viewed through Docker/systemd logs where stdout is not a TTY.
+        printBanner({ forceColor: true });
         // Non-blocking update check — fire-and-forget, won't delay startup
         import("../../update/npm-registry.js")
             .then(({ fetchLatestVersion }) => fetchLatestVersion().then(async (latest) => {
@@ -378,7 +385,9 @@ export default class Daemon extends Command {
                 const loadedChallenges = await loadChallengesIntoPKC(mergedPkcOptions.dataPath);
                 if (loadedChallenges.length > 0)
                     console.log(`Loaded challenge packages: ${loadedChallenges.join(", ")}`);
-                daemonServer = await startDaemonServer(pkcRpcUrl, ipfsGatewayEndpoint, mergedPkcOptions);
+                daemonServer = await startDaemonServer(pkcRpcUrl, ipfsGatewayEndpoint, mergedPkcOptions, {
+                    allowPrivateKeyExport: flags.allowPrivateKeyExport
+                });
                 startedOwnRpc = true;
                 console.log(`pkc rpc: listening on ${pkcRpcUrl} (local connections only)`);
                 console.log(`pkc rpc: listening on ${pkcRpcUrl}${daemonServer.rpcAuthKey} (secret auth key for remote connections)`);
@@ -399,10 +408,6 @@ export default class Daemon extends Command {
                         console.log(`WebUI (${webui.name}${desc}): http://${remoteIpAddress}:${rpcPort}${webui.endpointRemote}`);
                 }
             };
-            // RPC port was already verified free above (fail-fast); only the kuboRpcClientsOptions branch skips local kubo.
-            if (!pkcOptionsFromFlag?.kuboRpcClientsOptions)
-                await keepKuboUp();
-            await createOrConnectRpc();
             let keepKuboUpInterval;
             const { asyncExitHook } = await import("exit-hook");
             const killKuboProcessGroup = (pid, signal) => {
@@ -494,6 +499,10 @@ export default class Daemon extends Command {
                     killKuboProcessGroup(kuboProcess.pid, "SIGKILL");
                 }
             });
+            // RPC port was already verified free above (fail-fast); only the kuboRpcClientsOptions branch skips local kubo.
+            if (!pkcOptionsFromFlag?.kuboRpcClientsOptions)
+                await keepKuboUp();
+            await createOrConnectRpc();
             keepKuboUpInterval = setInterval(async () => {
                 if (mainProcessExited)
                     return;

package/dist/cli/commands/update/install.js

@@ -115,6 +115,7 @@ export default class Install extends Command {
         // Restart daemons with the new binary
         if (aliveDaemons.length > 0 && flags["restart-daemons"]) {
             await this._restartDaemons(aliveDaemons);
+            this.log("To see the daemon logs run `bitsocial logs --stdout`");
         }
     }
     async _restartDaemons(daemons) {

package/dist/webui/daemon-server.d.ts

@@ -1,4 +1,6 @@
-export declare function startDaemonServer(rpcUrl: URL, ipfsGatewayUrl: URL, pkcOptions: any): Promise<{
+export declare function startDaemonServer(rpcUrl: URL, ipfsGatewayUrl: URL, pkcOptions: any, rpcServerOptions?: {
+    allowPrivateKeyExport?: boolean;
+}): Promise<{
     rpcAuthKey: string;
     listedSub: string[];
     webuis: {

package/dist/webui/daemon-server.js

@@ -39,10 +39,23 @@ async function _generateRpcAuthKeyIfNotExisting(pkcDataPath) {
     return pkcRpcAuthKey;
 }
 // The daemon server will host both RPC and webui on the same port
-export async function startDaemonServer(rpcUrl, ipfsGatewayUrl, pkcOptions) {
+export async function startDaemonServer(rpcUrl, ipfsGatewayUrl, pkcOptions, rpcServerOptions) {
     // Start pkc-js RPC
     const log = PKCLogger("bitsocial-cli:daemon:startDaemonServer");
     const webuiExpressApp = express();
+    // GET /exports/<exportId> is streamed by pkc-js's own request listener, attached to this same
+    // http.Server inside PKCWsServer. Express must stay silent for those paths — its catch-all 404
+    // races the async pkc-js handler and clobbers the download (the CLI's `community export` would
+    // see HTTP 404). Other /exports/ paths fall through to express's 404 because pkc-js ignores
+    // them on a caller-supplied server and the request would otherwise hang unanswered.
+    // NOT mounted at "/exports": a mounted middleware strips the mount prefix from the shared
+    // req.url while the request is held, so pkc-js's listener would no longer recognize it.
+    webuiExpressApp.use((req, res, next) => {
+        const isExportDownload = /^\/exports\/[0-9a-fA-F-]{36}$/.test(req.path);
+        if (!isExportDownload)
+            return next();
+        // intentionally neither responds nor calls next(): pkc-js's listener owns this request
+    });
     // Wait for bind to actually complete before returning. Calling express.listen() without
     // awaiting 'listening' lets startup proceed before the port is accepting connections,
     // and without an 'error' handler a bind failure becomes an uncaughtException that kills
@@ -68,7 +81,8 @@ export async function startDaemonServer(rpcUrl, ipfsGatewayUrl, pkcOptions) {
     const rpcServer = await PKCRpc.default.PKCWsServer({
         server: httpServer,
         pkcOptions: pkcOptions,
-        authKey: rpcAuthKey
+        authKey: rpcAuthKey,
+        allowPrivateKeyExport: rpcServerOptions?.allowPrivateKeyExport
     });
     const webuisDir = path.join(__dirname, "..", "..", "dist", "webuis");
     const webUiNames = (await fs.readdir(webuisDir, { withFileTypes: true })).filter((file) => file.isDirectory()).map((file) => file.name);

package/oclif.manifest.json

@@ -9,7 +9,8 @@
         "bitsocial daemon --pkcRpcUrl ws://localhost:53812",
         "bitsocial daemon --pkcOptions.dataPath /tmp/bitsocial-datapath/",
         "bitsocial daemon --pkcOptions.kuboRpcClientsOptions[0] https://remoteipfsnode.com",
-        "bitsocial daemon --chainProviderUrls https://mainnet.infura.io/v3/YOUR_KEY"
+        "bitsocial daemon --chainProviderUrls https://mainnet.infura.io/v3/YOUR_KEY",
+        "bitsocial daemon --no-allowPrivateKeyExport"
       ],
       "flags": {
         "pkcRpcUrl": {
@@ -44,6 +45,12 @@
           "hasDynamicHelp": false,
           "multiple": true,
           "type": "option"
+        },
+        "allowPrivateKeyExport": {
+          "description": "Allow RPC clients to request community exports that include the community signer's private key (`bitsocial community export --includePrivateKey`). Disable with --no-allowPrivateKeyExport when exposing the RPC to untrusted clients",
+          "name": "allowPrivateKeyExport",
+          "allowNo": true,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
@@ -459,6 +466,91 @@
         "edit.js"
       ]
     },
+    "community:export": {
+      "aliases": [],
+      "args": {
+        "address": {
+          "description": "Address of the community to export",
+          "name": "address",
+          "required": false
+        }
+      },
+      "description": "Export a local community to a SQLite snapshot file. The export runs on the RPC server (daemon); once finished the snapshot is downloaded and its sha256 checksum is verified. Pass --includePrivateKey to produce a restorable backup that keeps the community's address.",
+      "examples": [
+        "bitsocial community export plebmusic.bso",
+        "bitsocial community export plebmusic.bso --includePrivateKey -o ./backups/plebmusic.sqlite",
+        "bitsocial community export --name my-community",
+        "bitsocial community export --publicKey 12D3KooWG3XbzoVyAE6Y9vHZKF64Yuuu4TjdgQKedk14iYmTEPWu"
+      ],
+      "flags": {
+        "pkcRpcUrl": {
+          "name": "pkcRpcUrl",
+          "required": true,
+          "summary": "URL to PKC RPC",
+          "default": "ws://localhost:9138/",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "name": {
+          "description": "Name of the community to export",
+          "name": "name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "publicKey": {
+          "description": "Public key of the community to export",
+          "name": "publicKey",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "path": {
+          "char": "o",
+          "description": "Destination file for the downloaded snapshot (default: <dataPath>/exports/<address>_<datetime>.sqlite)",
+          "name": "path",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "includePrivateKey": {
+          "description": "Ask the RPC server to include the community signer's private key in the export. Required for a restorable backup that keeps the same community address. The daemon may refuse (see `bitsocial daemon --no-allowPrivateKeyExport`)",
+          "name": "includePrivateKey",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "description": "Overwrite the destination file if it already exists",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "quiet": {
+          "char": "q",
+          "description": "Suppress progress output; only print the path of the downloaded snapshot",
+          "name": "quiet",
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "community:export",
+      "pluginAlias": "@bitsocial/bitsocial-cli",
+      "pluginName": "@bitsocial/bitsocial-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "cli",
+        "commands",
+        "community",
+        "export.js"
+      ]
+    },
     "community:get": {
       "aliases": [],
       "args": {
@@ -770,5 +862,5 @@
       ]
     }
   },
-  "version": "0.19.64"
+  "version": "0.19.65"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bitsocial/bitsocial-cli",
-    "version": "0.19.64",
+    "version": "0.19.65",
     "description": "Command line interface to Bitsocial API",
     "types": "./dist/index.d.ts",
     "homepage": "https://github.com/bitsocialnet/bitsocial-cli",
@@ -119,7 +119,7 @@
         "@oclif/plugin-help": "6.2.36",
         "@oclif/plugin-not-found": "3.2.73",
         "@oclif/table": "0.5.1",
-        "@pkcprotocol/pkc-js": "0.0.40",
+        "@pkcprotocol/pkc-js": "0.0.41",
         "dataobject-parser": "1.2.22",
         "decompress": "4.2.1",
         "env-paths": "2.2.1",