@blocklet/cli 1.17.12 → 1.17.13-beta-20260512-004004-69bacba8

package/README.md

@@ -28,7 +28,7 @@ Powered By
   / ___ \| | | (__| |_) | | (_) | (__|   < 
  /_/   \_\_|  \___|____/|_|\___/ \___|_|\_\
                                            
-            Blocklet CLI v1.17.11
+            Blocklet CLI v1.17.12
 
 Usage: blocklet server [options] [command]
 

package/lib/commands/blocklet/add.js

@@ -52,7 +52,7 @@ const getSource = async (param, opts) => {
   const { url, name, version } = parseComponent(param);
   if (url) {
     const componentMeta = await getMeta(url);
-    // bundleName 必须为 blocklet 的 blocklet.yml 中的 name
+    // bundleName must match the 'name' field in the blocklet's blocklet.yml
     return { source: { url }, bundleName: componentMeta.name, bundleTitle: componentMeta.title || '' };
   }
 
@@ -68,7 +68,7 @@ const getSource = async (param, opts) => {
 
   const bundleMetaUrl = getMetaUrl(store, name, version);
   const componentMeta = await getMeta(bundleMetaUrl);
-  // NOTICE: 支持传入 blocklet-did 来进行安装
+  // NOTICE: Installing by blocklet DID is also supported
   if (componentMeta.name !== name && componentMeta.did !== name) {
     printError(`Failed validate component meta: invalid name. Expected ${name}, Got: ${componentMeta.name}`);
     process.exit(1);

package/lib/commands/blocklet/bundle/bundle.js

@@ -61,7 +61,7 @@ const createBlockletBundle = async ({
   compact = false,
   dependenciesDepth = 9,
 }) => {
-  // 新增 meta.files 支持 glob 后，需要将 glob 匹配的文件也进行复制放入 bundle 中
+  // After adding glob support to meta.files, all glob-matched files must also be copied into the bundle
   const metaFileList = meta.files || [];
   const distDir = path.join(blockletDir, BLOCKLET_BUNDLE_FOLDER);
 
@@ -161,7 +161,7 @@ const createBlockletBundle = async ({
 };
 
 /**
- * 获取所有 extraFiles，理论上所有 .js 都需要查出来，才能进一步去找到依赖
+ * Get all extraFiles. In theory, all .js files must be found here in order to subsequently resolve their dependencies.
  * @param {Object} meta blocklet meta
  * @returns Array
  */

package/lib/commands/blocklet/bundle/bundlers/blocklet.js

@@ -11,7 +11,7 @@ class BlockletMdBundler extends MarkdownBundler {
    * Creates an instance of BlockletMdBundler.
    * @param {{
    *  blockletDir: string,
-   *  blockletMdFileName: string, // 约定: blocklet.md的文件名是小写的
+   *  blockletMdFileName: string, // Convention: the blocklet.md filename must be lowercase
    *  backupMdFileNames?: string[];
    *  required?: boolean = false;
    *  duplicateMdFileName?: string;
@@ -72,16 +72,16 @@ class BlockletMdBundler extends MarkdownBundler {
 
   _findByBackupFileNames() {
     for (const backupMdFileName of this.backupMdFileNames) {
-      // 我们先来找找备份文件
+      // Try to find a backup file
       const foundByBackupMdFileName = fg.sync(backupMdFileName, this.fastGlobOptions);
 
       if (foundByBackupMdFileName.length === 1) {
-        // 找到了1个备份的文件
+        // Exactly one backup file found
         return foundByBackupMdFileName;
       }
 
       if (foundByBackupMdFileName.length > 1) {
-        // 备份文件太多了,我不知道选哪个好
+        // Multiple backup files found — ambiguous, cannot determine which one to use
         printError(
           `Only one ${chalk.red(backupMdFileName)}(not case sensitive) can exist in ${chalk.cyan(this.blockletDir)}`
         );
@@ -90,7 +90,7 @@ class BlockletMdBundler extends MarkdownBundler {
     }
 
     if (this.required) {
-      // 连备份文件也没找到,但是文件还是必要的,不能没有啊,故中断当前任务
+      // No backup file found either, but this file is required — abort the current task
       printError(
         `Either ${chalk.red(this.blockletMdFileName)} or ${this.backupMdFileNames
           .map((backupMdFileName) => chalk.red(backupMdFileName))
@@ -106,7 +106,7 @@ class BlockletMdBundler extends MarkdownBundler {
     const foundByDuplicateMdFileName = fg.sync(this.duplicateMdFileName, this.fastGlobOptions);
 
     if (foundByDuplicateMdFileName.length) {
-      // 我是故意这么换行的,不然warning信息和其他信息会显示在同一行,不太美观
+      // The blank line is intentional: without it, the warning would appear on the same line as other output
       print();
       printWarning(
         `File ${chalk.cyan(this.blockletMdFileName)} is currently in use, file ${chalk.yellow(

package/lib/commands/blocklet/bundle/bundlers/changelog.js

@@ -81,7 +81,7 @@ class ChangelogBundler {
       const ast = fromMarkdown(fs.readFileSync(changelogAbsolutePath));
       const children = ast?.children || [];
       children.forEach((element) => {
-        // 只支持 h1~h4
+        // Only h1–h4 headings are supported
         if (element.type === 'heading' && element.depth > 4) {
           const line = element.position?.start.line || 0;
           printError(`Just h1~h4 headings should be used in ${chalk.cyan(changelogAbsolutePath)} at line ${line}`);

package/lib/commands/blocklet/bundle/bundlers/markdown.js

@@ -48,7 +48,7 @@ class MarkdownBundler {
 
   /**
    *
-   * @description 从本地所有的blocklet.md提取本地静态文件到当前目录的media文件夹下面
+   * @description Extract local static assets from all blocklet.md files into the bundle's media folder
    * @param {*} blockletDir
    */
   async _bundle() {
@@ -63,7 +63,7 @@ class MarkdownBundler {
         const referenceFile = astNode?.url || astNode?.attrs?.src || astNode?.attrs?.href;
         const localUrl = this._getLocalUrl(referenceFile);
 
-        // FIXME: 后续jest mock做一个单测吧
+        // FIXME: Add a unit test for this using jest mock later
         if (!fs.existsSync(localUrl)) {
           printError(
             `Referenced file ${chalk.red(referenceFile)} not found when bundling ${chalk.cyan(
@@ -73,7 +73,7 @@ class MarkdownBundler {
           process.exit(1);
         }
 
-        // 如果路径指向了一个文件夹,应该通过报错告知用户,文件夹不能存在于markdown文件当中
+        // If the referenced path is a directory, report an error — directories are not valid in markdown references
         if (fs.statSync(localUrl).isDirectory()) {
           printError(
             `Only files links are allowed in ${chalk.cyan(
@@ -109,12 +109,13 @@ class MarkdownBundler {
         // eslint-disable-next-line no-await-in-loop
         await this.writeFile(path.join(this.bundleDir, path.basename(markdownAbsolutePath)), toMarkdown(mdAstNode));
       } else {
-        // 说明有些资源还没有计算好hash值和复制到bundle下,blocklet.md没处理完,当然也就不能直接修改blocklet.md里面的引用了
+        // Some assets have not yet had their hash computed or been copied into the bundle,
+        // so blocklet.md is not fully processed and its asset references cannot be rewritten yet.
         // eslint-disable-next-line no-await-in-loop
         await this._batchHash(cache);
         // eslint-disable-next-line no-await-in-loop
         await this._batchCopy(cache);
-        // 还没处理完成,等到下一轮再处理即可
+        // Not finished yet — push back for reprocessing in the next iteration
         markdownAbsolutePaths.push(markdownAbsolutePath);
       }
     }

package/lib/commands/blocklet/bundle/bundlers/screenshots.js

@@ -76,7 +76,7 @@ class ScreenshotsBundler {
   }
 
   /**
-   * @description 清理 screenshots bundle 的文件夹
+   * @description Clean up the screenshots bundle directory
    * @memberof ScreenshotsBundler
    */
   async _clean() {

package/lib/commands/blocklet/bundle/compact/index.js

@@ -62,7 +62,7 @@ exports.run = async ({
   externals: inputExternals = [],
   dependenciesDepth = 9,
 }) => {
-  // 合并所有外部依赖
+  // Merge all external dependencies (deduplicated)
   const externals = Array.from(new Set([...defaultExternals, ...inputExternals]));
 
   // eslint-disable-next-line no-param-reassign

package/lib/commands/blocklet/config.js

@@ -17,7 +17,7 @@ const whiteList = ['store', 'accessToken', 'registry', 'developerDid', 'name', '
 function validate(key, value) {
   const validatorMap = {
     store: (v) => {
-      // 校验是否为合法的url地址（必须是 http 或 https 协议）,例如：https://store.blocklet.dev/
+      // Validate that the value is a valid URL using http or https, e.g. https://store.blocklet.dev/
       if (/^((https?):\/\/)[\w-]+(\.[\w-]+)+([\w.,@?^=%&:/~+#-]*[\w@?^=%&/~+#-])?$/.test(v)) {
         return true;
       }

package/lib/commands/blocklet/connect.js

@@ -12,7 +12,8 @@ const { wrapSpinner } = require('../../ui');
 
 /**
  *
- * @description 确认是否要覆盖之前填写的store url,回车或输入y直接覆盖,输入其他字符就不覆盖
+ * @description Prompt the user to confirm whether to overwrite the existing store URL.
+ *              Pressing Enter or 'y' overwrites; any other input cancels.
  * @see https://www.npmjs.com/package/inquirer
  * @see https://github.com/SBoudrias/Inquirer.js/blob/0053e3f5694a4f75c4901512ab87e8906d1d7896/packages/inquirer/examples/pizza.js
  * @default false
@@ -32,7 +33,7 @@ async function confirmOverwriteStoreUrl() {
 }
 
 const run = async (store, { profile }) => {
-  // 校验是否为合法的url地址（必须是 http 或 https 协议）,例如：https://store.blocklet.dev/
+  // Validate that the URL is a valid web URI (must use http or https)
   if (!validUrl.isWebUri(store)) {
     printError('Invalid store url:', store);
     process.exit(1);
@@ -41,14 +42,14 @@ const run = async (store, { profile }) => {
   try {
     const storeUrl = await getStoreUrl(store);
 
-    // 读取配置
+    // Load configuration
     const config = new Config({
       configFile: process.env.ABT_NODE_CONFIG_FILE,
       section: profile === 'default' ? '' : profile,
     });
 
     const oldStoreUrl = config.get('store');
-    // 配置过store url,前后两次配置不一样,且选择不覆盖配置时,退出程序
+    // If a store URL was already configured, it differs from the new one, and the user declined to overwrite, exit
     if (!isUndefined(oldStoreUrl) && oldStoreUrl !== storeUrl && !(await confirmOverwriteStoreUrl())) {
       process.exit(0);
     }

package/lib/commands/blocklet/deploy.js

@@ -53,7 +53,7 @@ function getFilename(input) {
     // ignore invalid URL parsing
   }
 
-  // 处理本地路径或文件名
+  // Handle local path or filename — extract the base filename
   return path.basename(input);
 }
 

package/lib/commands/blocklet/dev.js

@@ -115,7 +115,8 @@ const getAccessibleUrl = async (urls) => {
 
   const ping = async (url) => {
     try {
-      // FIXME: 如果通过 ABT_NODE_HOST 指定了 Host IP 地址，这里通过 HTTP 服务检测有问题，所以暂时直接返回 true, 绕过检测
+      // FIXME: When a Host IP is specified via ABT_NODE_HOST, HTTP-based reachability checks fail,
+      // so temporarily return true to bypass the check when running inside Docker.
       if (isDocker()) {
         return true;
       }
@@ -136,7 +137,7 @@ const getAccessibleUrl = async (urls) => {
 
   let resultUrl = urls.find((url) => isDidDomain(url));
   if (!resultUrl) {
-    [resultUrl] = urls; // 假设没有可访问的地址，直接返回第一个
+    [resultUrl] = urls; // No accessible URL found; fall back to the first one
   }
 
   print('');
@@ -192,7 +193,7 @@ const getBlockletMetaWithTimeout = (urls, options, timeout = 5000) => {
 };
 
 const findMountPointConflicts = async (meta, existedApp) => {
-  // 收集待安装的组件，用于检测组件间 mountPoint 是否冲突
+  // Collect components to be installed, to detect mountPoint conflicts between them
   let components = meta.components || [];
   if (isEmpty(components)) {
     const { title, name, did } = meta;
@@ -202,7 +203,7 @@ const findMountPointConflicts = async (meta, existedApp) => {
       title: title || name || did,
     });
   }
-  // 已安装的组件
+  // Already-installed components
   components.unshift(
     ...(existedApp.children?.map((v) => ({
       mountPoint: v.mountPoint,
@@ -210,9 +211,9 @@ const findMountPointConflicts = async (meta, existedApp) => {
       title: v.meta.title || v.meta.name || v.meta.did,
     })) || [])
   );
-  // 忽略 mountPoint 缺失的组件
+  // Ignore components that have no mountPoint defined
   components = components.filter((x) => Boolean(x.mountPoint));
-  // 查询待安装组件的 did
+  // Resolve the DID for each component that is pending installation
   await pMap(
     components.filter((v) => !v.did),
     async (config) => {
@@ -227,12 +228,12 @@ const findMountPointConflicts = async (meta, existedApp) => {
       }
     }
   );
-  // 忽略 did 缺失的组件
+  // Ignore components whose DID could not be resolved
   components = components.filter((x) => Boolean(x.did));
 
   const conflictMsgs = [];
   components.reduce((acc, child) => {
-    // 不同的组件挂载到了同一个 mountPoint
+    // Two different components are attempting to mount at the same mountPoint
     if (acc[child.mountPoint] && acc[child.mountPoint].did !== child.did) {
       conflictMsgs.push(
         `mountPoint conflict: '${child.title}' attempted to mount on '${child.mountPoint}', but it is already occupied by '${acc[child.mountPoint].title}'`

package/lib/commands/blocklet/exec.js

@@ -35,7 +35,7 @@ const run = async (script, { appId: inputAppId, timeout } = {}) => {
       appId = process.env.BLOCKLET_DEV_APP_DID;
     }
 
-    // 确认 appId 是否有效
+    // Validate appId
     if (appId) {
       if (isValidDid(appId) === false) {
         printError(`${chalk.yellow('--app-id')} is not valid: ${appId}`);
@@ -48,7 +48,7 @@ const run = async (script, { appId: inputAppId, timeout } = {}) => {
 
     printInfo(`Try to run script for blocklet(${chalk.yellow(appId)}) (timeout: ${timeoutMs}ms)`);
 
-    // 确认 script 是否存在
+    // Check that the script file exists
     const scriptPath = path.join(appDir, script);
     if (fs.existsSync(scriptPath) === false) {
       printError(`Script ${chalk.cyan(scriptPath)} does not exist`);
@@ -56,7 +56,7 @@ const run = async (script, { appId: inputAppId, timeout } = {}) => {
     }
 
     try {
-      // 尝试从 blocklet.yml 中获取 meta 信息
+      // Try to read meta information from blocklet.yml
       if (fs.existsSync(path.join(appDir, 'blocklet.yml'))) {
         const meta = getBlockletMeta(appDir, { fix: false });
         componentDid = meta?.did;
@@ -92,7 +92,7 @@ const run = async (script, { appId: inputAppId, timeout } = {}) => {
         blocklet = await node.getBlocklet({ did: rootDid });
         const nodeEnvironments = await node.states.node.getEnvironments();
 
-        // 如果 componentDid 存在，则运行 component 的脚本
+        // If componentDid is present, run the script for that component
         if (componentDid) {
           component = blocklet.children.find((x) => x.meta.did === componentDid);
 

package/lib/commands/blocklet/rotate.js

@@ -0,0 +1,251 @@
+const chalk = require('chalk');
+const inquirer = require('inquirer');
+const { fromRandom, fromSecretKey } = require('@ocap/wallet');
+const { isValid: isValidDid } = require('@arcblock/did');
+const { getBlockletInfo } = require('@blocklet/meta/lib/info');
+const { getBlockletChainInfo } = require('@blocklet/meta/lib/util');
+const { getChainClient } = require('@abtnode/util/lib/get-chain-client');
+const { MAIN_CHAIN_ENDPOINT } = require('@abtnode/constant');
+
+const { printError, printInfo, printSuccess, printWarning, getCLIBinaryName } = require('../../util');
+const { getNode } = require('../../node');
+const { checkRunning } = require('../../manager');
+
+const sleep = (ms) =>
+  new Promise((r) => {
+    setTimeout(r, ms);
+  });
+
+const checkNodeRunning = async () => {
+  const isRunning = await checkRunning();
+  if (!isRunning) {
+    const startCommand = chalk.cyan(`${getCLIBinaryName()} server start`);
+    printError('Blocklet Server is not running, can not execute anything!');
+    printInfo(`To start Blocklet Server, use ${startCommand}`);
+    process.exit(1);
+  }
+};
+
+const waitForTx = async (client, hash, timeoutSec) => {
+  const deadline = Date.now() + timeoutSec * 1000;
+  let lastErr;
+  // Sequential polling is the intent here — every iteration must observe the
+  // chain state produced by the previous one's sleep, so parallelizing is
+  // semantically wrong. Disable the lint rule that bans await-in-loop.
+  /* eslint-disable no-await-in-loop */
+  while (Date.now() < deadline) {
+    try {
+      const { info } = await client.getTx({ hash });
+      if (info && info.code === 'OK') return;
+      if (info && info.code && info.code !== 'OK') {
+        throw new Error(`tx ${hash} rejected with code ${info.code}`);
+      }
+    } catch (err) {
+      lastErr = err;
+    }
+    await sleep(1000);
+  }
+  /* eslint-enable no-await-in-loop */
+  throw new Error(`timed out waiting for tx ${hash} (${timeoutSec}s)${lastErr ? ` — ${lastErr.message}` : ''}`);
+};
+
+const run = async ({
+  appDid = '',
+  newSk = '',
+  genNew = false,
+  yes = false,
+  skipConfirm = false,
+  dryRun = false,
+  skipChainMigrate = false,
+  skipConfigUpdate = false,
+  confirmTimeout = '60',
+} = {}) => {
+  // Either subcommand `--skip-confirm` or global `-y/--yes` suppresses the
+  // prompt. Both end up in the merged options bag via parseOptions.
+  const noPrompt = !!(skipConfirm || yes);
+  try {
+    await checkNodeRunning();
+
+    if (!appDid || isValidDid(appDid) === false) {
+      printError(`--app-did is not a valid DID: ${appDid}`);
+      process.exit(1);
+      return;
+    }
+
+    if (!newSk && !genNew) {
+      printError('Either --new-sk <hex> or --gen-new must be provided');
+      process.exit(1);
+      return;
+    }
+    if (newSk && genNew) {
+      printError('--new-sk and --gen-new are mutually exclusive');
+      process.exit(1);
+      return;
+    }
+    if (skipChainMigrate && skipConfigUpdate) {
+      printError('--skip-chain-migrate and --skip-config-update both set — nothing to do');
+      process.exit(1);
+      return;
+    }
+
+    const timeoutSec = Number(confirmTimeout);
+    if (!Number.isFinite(timeoutSec) || timeoutSec <= 0) {
+      printError(`--confirm-timeout must be a positive number, got ${confirmTimeout}`);
+      process.exit(1);
+      return;
+    }
+
+    const { node } = await getNode();
+    node.onReady(async () => {
+      try {
+        const blocklet = await node.getBlocklet({ did: appDid });
+        if (!blocklet) {
+          printError(`Blocklet ${appDid} not found on this server`);
+          process.exit(1);
+          return;
+        }
+
+        const nodeInfo = await node.getNodeInfo();
+        const { wallet: oldWallet } = getBlockletInfo(blocklet, nodeInfo.sk);
+        if (!oldWallet || !oldWallet.secretKey) {
+          printError('Cannot resolve old wallet — is BLOCKLET_APP_SK configured for this blocklet?');
+          process.exit(1);
+          return;
+        }
+
+        // Generate or accept new sk, keeping the old wallet's type so the
+        // address derivation stays in the same scheme (arcblock vs ethereum).
+        let resolvedNewSk = newSk;
+        if (genNew) {
+          const newW = fromRandom(oldWallet.type);
+          resolvedNewSk = newW.secretKey;
+        }
+        let newWallet;
+        try {
+          newWallet = fromSecretKey(resolvedNewSk, oldWallet.type);
+        } catch (err) {
+          printError(`Cannot derive new wallet from sk: ${err.message}`);
+          process.exit(1);
+          return;
+        }
+
+        if (newWallet.address === oldWallet.address) {
+          printError(`New sk derives the same address as the old one (${oldWallet.address}); refuse no-op`);
+          process.exit(1);
+          return;
+        }
+
+        // Resolve chain endpoint (same logic auth/lib/server.js#migrateAppDid uses).
+        let chainHost = getBlockletChainInfo(blocklet).host;
+        if (!chainHost || chainHost === 'none') chainHost = MAIN_CHAIN_ENDPOINT;
+
+        // Show plan.
+        printInfo(`Rotation plan for blocklet ${chalk.cyan(blocklet.meta?.title || appDid)}`);
+        printInfo(`  appDid (current):    ${oldWallet.address}`);
+        printInfo(`  appPid (meta DID):   ${blocklet.appPid}`);
+        printInfo(`  new appDid:          ${newWallet.address}`);
+        printInfo(`  chain endpoint:      ${chainHost}`);
+        printInfo('  steps:');
+        printInfo(`    1) chain migrate:  ${skipChainMigrate ? chalk.gray('SKIP') : chalk.green('YES')}`);
+        printInfo(`    2) local config:   ${skipConfigUpdate ? chalk.gray('SKIP') : chalk.green('YES')}`);
+        printInfo(`    3) restart blocklet: ${chalk.yellow('MANUAL after success')}`);
+
+        if (genNew) {
+          // Print the generated sk early — caller must save it before the
+          // command exits.
+          printWarning('Generated new sk (SAVE IT NOW; will not be shown again):');
+          printWarning(`  ${chalk.yellow(resolvedNewSk)}`);
+        }
+
+        if (dryRun) {
+          printSuccess('dry run — no changes made');
+          process.exit(0);
+          return;
+        }
+
+        if (!noPrompt) {
+          const { confirmed } = await inquirer.prompt([
+            {
+              type: 'confirm',
+              name: 'confirmed',
+              message: 'This rotates the blocklet appSk irreversibly on chain. Proceed?',
+              default: false,
+            },
+          ]);
+          if (!confirmed) {
+            printInfo('aborted by user');
+            process.exit(0);
+            return;
+          }
+        }
+
+        // Step 1: on-chain AccountMigrateTx.
+        if (!skipChainMigrate) {
+          const client = getChainClient(chainHost);
+
+          const { state: newOnChain } = await client.getAccountState({
+            address: newWallet.address,
+            traceMigration: false,
+          });
+          if (newOnChain) {
+            printError(`new account ${newWallet.address} already exists on chain — abort`);
+            process.exit(1);
+            return;
+          }
+          const { state: oldOnChain } = await client.getAccountState({
+            address: oldWallet.address,
+            traceMigration: false,
+          });
+          if (oldOnChain && oldOnChain.migratedTo && oldOnChain.migratedTo.length > 0) {
+            printError(
+              `old account ${oldWallet.address} already migrated to ${JSON.stringify(
+                oldOnChain.migratedTo
+              )} — refuse to migrate again`
+            );
+            process.exit(1);
+            return;
+          }
+
+          printInfo('sending AccountMigrateTx ...');
+          const hash = await client.migrateAccount({ from: oldWallet, to: newWallet });
+          printInfo(`  tx hash: ${chalk.cyan(hash)}`);
+          printInfo(`  waiting up to ${timeoutSec}s for confirmation ...`);
+          await waitForTx(client, hash, timeoutSec);
+          printSuccess('chain migration confirmed');
+        }
+
+        // Step 2: write BLOCKLET_APP_SK back to blocklet config.
+        if (!skipConfigUpdate) {
+          printInfo('updating BLOCKLET_APP_SK in blocklet config ...');
+          // NOTE: must use blocklet.appPid (= meta DID), NOT appDid — when sk
+          // changes, the appDid moves into alsoKnownAs and lookups by old
+          // appDid would fail. See env-config-manager.js:110-112.
+          await node.configBlocklet({
+            did: blocklet.appPid,
+            configs: [{ key: 'BLOCKLET_APP_SK', value: resolvedNewSk, secure: true, shared: false }],
+            skipHook: true,
+            skipDidDocument: false,
+          });
+          printSuccess('BLOCKLET_APP_SK updated. Blocklet must be restarted to pick up the new key.');
+        }
+
+        printSuccess('Rotation complete.');
+        printWarning(
+          'This command did NOT sync passport VC / owner.connectedAccount. ' +
+            'If this blocklet has user-facing auth, follow up via the server UI ' +
+            '("Transfer App Owner" / "Rotate Key Pair") or run the corresponding ' +
+            'node APIs manually (see receive-transfer-app-owner.js:317+).'
+        );
+        process.exit(0);
+      } catch (err) {
+        printError(`Rotation failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+  } catch (err) {
+    printError(err.message);
+    process.exit(1);
+  }
+};
+
+exports.run = run;

package/lib/commands/blocklet/upload.js

@@ -40,7 +40,7 @@ exports.run = async (originalMetaFile, { accessToken, profile }) => {
     realAccessToken = config.get('accessToken');
     debug('read access token from config');
     if (!realAccessToken) {
-      // TODO: 添加 accessToken 不存在情况下自动去获取 accessToken 的逻辑
+      // TODO: Add logic to automatically obtain accessToken when it is missing
       printError('accessToken is required to upload a blocklet');
       process.exit(1);
     }

package/lib/commands/index.js

@@ -48,6 +48,7 @@ const create = require('./blocklet/create');
 const connect = require('./blocklet/connect');
 const exec = require('./blocklet/exec');
 const $debug = require('./blocklet/debug');
+const rotate = require('./blocklet/rotate');
 const add = require('./blocklet/add');
 const remove = require('./blocklet/remove');
 const cleanup = require('./blocklet/cleanup');
@@ -261,6 +262,22 @@ program
   .description('Setting debug environment for blocklet')
   .action(parseArgsAndOptions($debug.run));
 
+program
+  .command('rotate')
+  .requiredOption('--app-did <did>', 'The appDid of the blocklet to rotate')
+  .option('--new-sk <hex>', 'New secret key in hex (e.g. 0x... or 64-byte hex)')
+  .option('--gen-new', 'Auto-generate a new random sk; prints the value once', false)
+  .option('--skip-chain-migrate', 'Skip on-chain AccountMigrateTx (local config only)', false)
+  .option('--skip-config-update', 'Skip local BLOCKLET_APP_SK update (chain migrate only)', false)
+  .option('--confirm-timeout <sec>', 'Seconds to wait for chain confirmation', '60')
+  .option('--skip-confirm', 'Skip interactive confirmation prompt (also honored via global -y/--yes)', false)
+  .option('--dry-run', 'Print plan only, do not execute', false)
+  .description(
+    'Rotate the BLOCKLET_APP_SK of a blocklet (on-chain AccountMigrate + local config update). ' +
+      'Does NOT sync passport VC / connectedAccount — use server UI for user-facing apps.'
+  )
+  .action(parseOptions(rotate.run));
+
 program
   .command('connect <store-url>')
   .option('--profile <profile>', 'Your config profile', 'default')

package/lib/commands/server/command.js

@@ -34,7 +34,7 @@ module.exports = (parentCommand = '') => {
     async (...args) => {
       printVersionTip();
 
-      // @note: 这里的 yes 我始终无法通过 commander.js 获取，所以做一下特殊处理
+      // @note: The --yes flag cannot be reliably read via commander.js, so it is parsed directly from process.argv
       const yes = process.argv.includes('--yes') || process.argv.includes('-y');
       Object.assign(args[0], { yes });
 

package/lib/commands/server/info.js

@@ -15,7 +15,7 @@ const getDockerStatusLog = require('../../util/docker-status-log');
 exports.run = ({ clipboard }) => {
   // Clipboard is not accessible when on a linux tty
   const copyToClipboard = process.platform === 'linux' && !process.env.DISPLAY ? false : clipboard;
-  // 收集需要复制到剪贴板的 printInfo 信息
+  // Accumulate printInfo output that will be copied to the clipboard
   const toPlainText = (str) => stripAnsi(str);
   let clipboardBuffer = `${getVersionInfo()}\n`;
   const bufferedPrintInfo = (...args) => {
@@ -96,7 +96,6 @@ exports.run = ({ clipboard }) => {
           ? `${canUseFileSystemIsolation ? chalk.green('on(available)') : chalk.yellow('on(unavailable, version must be >= 21.6.0)')}`
           : chalk.red('off')
       );
-      // 判断是否是mac
 
       getDockerStatusLog(bufferedPrintInfo, nodeInfo);
       bufferedPrintInfo('Server domain status:', correct ? chalk.green('correct') : chalk.red('mismatch'));

package/lib/commands/server/nginx.js

@@ -330,15 +330,15 @@ function ensureNginxServiceNotManaged() {
 }
 
 function setupNginxEnvironment() {
-  // 确保 nginx 安装
+  // Ensure nginx is installed
   installNginxIfNeeded();
-  // 确保 nginx 有 stream 模块
+  // Ensure nginx has the stream module
   ensureNginxStreamModule();
-  // 确保 nginx 有低端口权限
+  // Ensure nginx has permission to bind low-numbered ports
   configureNginxPortCapabilities();
-  // 确保 nginx 不被系统服务管理
+  // Ensure nginx is not managed by the system service manager
   ensureNginxServiceNotManaged();
-  // 确保 nginx 端口配置正确
+  // Ensure nginx port configuration is correct
   checkBlockletServerConfig();
 
   print();

package/lib/commands/server/start.js

@@ -85,7 +85,7 @@ const ABT_NODE_BINARY_NAME = getCLIBinaryName();
 const ABT_NODE_COMMAND_NAME = getCLICommandName();
 
 const parseMemoryLimit = () => {
-  // 默认读取 30% 的内存，最小限制在 800，最大 4096 MB
+  // Default to 30% of total memory; minimum 800 MB, maximum 4096 MB
   const totalMemInMB = os.totalmem() / (1024 * 1024);
   const memoryPercent = totalMemInMB * 0.3;
   const calculatedLimit = Math.floor(Math.max(Math.min(memoryPercent, 4096), DAEMON_MAX_MEM_LIMIT_IN_MB));
@@ -425,7 +425,7 @@ const prepareInitialData = async (node, config, dataDir) => {
     await fs.remove(dataDirBak);
   } catch (error) {
     await fs.move(dataDirBak, dataDir, { overwrite: true });
-    // FIXME: 这里可能会因错误导致节点无法启动, 进而导致节点在 ec2 上被无限重启
+    // FIXME: An error here can prevent the node from starting, which may cause it to restart infinitely on EC2
     throw error;
   }
 };
@@ -457,8 +457,8 @@ const exec = async ({ workingDir, config, dataDir, mode, updateDb, forceIntranet
 
   const blockletMaxMemoryLimit = get(config, 'node.runtimeConfig.blockletMaxMemoryLimit', BLOCKLET_MAX_MEM_LIMIT_IN_MB);
 
-  // 如果日志目录不存在，pm2 会启动可能会失败, 测试发现 docker 里的 Ubuntu 18.04.4 LTS 系统会失败,
-  // MAC OS 下正常，但是没搞明白为什么
+  // Ensure the log directory exists before starting pm2; without it pm2 may fail to start.
+  // Observed failure on Ubuntu 18.04.4 LTS inside Docker; macOS is unaffected — root cause unknown.
   const logDir = process.env.ABT_NODE_LOG_DIR || getDaemonLogDir(dataDir);
   fs.ensureDirSync(logDir);
 
@@ -792,7 +792,7 @@ const createStartLock = ({ lockFile, pid }) => fs.writeFileSync(lockFile, pid.to
 
 const clearStartLock = ({ pid, lockFile, enforceLock }) => {
   try {
-    // 如果使用了 autoInit, 只要存在 lock 文件则直接删除改文件
+    // If autoInit is enabled, delete the lock file whenever it exists
     if (!enforceLock && fs.existsSync(lockFile)) {
       fs.removeSync(lockFile);
       return;

package/lib/node.js

@@ -54,7 +54,7 @@ const readNodeConfig = async (dir) => {
     }
   } else {
     printConfigError();
-    process.exit(1); // TODO: 太讨厌这种提前 exit 的函数了，非常不好调试, polunzh
+    process.exit(1); // TODO: Hate early-exit functions like this — extremely hard to debug
   }
 
   const configFile = await getConfigFile(dir);

package/lib/process/daemon.js

@@ -102,11 +102,11 @@ node.onReady(async () => {
     try {
       const initialized = await node.isInitialized();
       if (initialized) {
-        // 无论之前是否 crash, 当启动 server (非热重启) 时，永远重启之前运行中的组件
+        // Regardless of whether the server previously crashed, always restart previously running components on server start (non-hot-reload)
         await node.updateNodeStatus(SERVER_STATUS.RUNNING);
         if (runningBefore) {
           logger.info('> Blocklet Server is restarted from running before');
-          // 如果之前是运行中, 直接跳过快速重启检查
+          // If the server was running before, skip the rapid-restart check
           ensureBlockletRunning.whenCycleCheck = true;
         } else {
           logger.info('> Blocklet Server is stopped from running before');

package/lib/util/blocklet/config.js

@@ -37,7 +37,7 @@ class Config {
   }
 
   get(key, defaultValue) {
-    // TODO: 是否需要保护一些关键信息（例如 secretKey）
+    // TODO: Consider whether sensitive fields (e.g. secretKey) should be protected/masked here
     return this._get(key, defaultValue);
   }
 

package/lib/util/clear-all-cache.js

@@ -6,7 +6,7 @@ const { stopDockerRedis } = require('@abtnode/core/lib/util/docker/ensure-docker
 const { CONFIG_FOLDER_NAME, CONFIG_FOLDER_NAME_OLD } = require('@abtnode/constant');
 
 const clearAllCache = async (printSuccess, printError) => {
-  // 停止 docker 中的 redis 容器
+  // Stop the Redis container in Docker
   await stopDockerRedis();
   try {
     let nowConfigFolder = '';
@@ -27,7 +27,7 @@ const clearAllCache = async (printSuccess, printError) => {
         forceType: 'sqlite',
       }));
 
-      // 清理 sqlite adapter 的缓存
+      // Flush the SQLite adapter cache
       await cache.flushAll();
     }
   } catch (error) {

package/lib/util/index.js

@@ -237,7 +237,8 @@ const startEventHub = async (logDir, maxMemoryRestart = BLOCKLET_MAX_MEM_LIMIT_I
     try {
       await wrapSpinner('Starting event hub...', async () => {
         await pm2.startAsync({
-          // 因为 pm2 的 bug, 子进程会继承 namespace 和众多参数, 所以这里的 namespace 会给 blocklets 用
+          // Due to a pm2 bug, child processes inherit the namespace and many other parameters,
+          // so the namespace here is intentionally set to 'blocklets' to be inherited by blocklet processes.
           namespace: 'blocklets',
           name: PROCESS_NAME_EVENT_HUB,
           script: './lib/process/event-hub.js',
@@ -442,7 +443,7 @@ const isDaemonIpAccessible = async ({ ip, port, adminPath }) => {
       }
     };
 
-    // 重试 2 次，总共 ping 3 次
+    // Retry 2 times, 3 total ping attempts
     await pRetry(ping, { retries: 2 });
     return true;
   } catch (error) {
@@ -459,7 +460,7 @@ const getAccessibleIps = async (info, forceIntranet = false) => {
   const port = getDaemonPort(nodeHttpPort, DEFAULT_HTTP_PORT);
   const result = { internal: ips.internal };
 
-  // 云环境下下完全相信获取到的 IP 信息
+  // In a cloud environment, fully trust the retrieved IP information
   if ((await cloud.isInCloud()) === true) {
     result.external = ips.external;
     return result;
@@ -546,7 +547,7 @@ const getDaemonAccessUrls = async ({ info, wallet, getBaseUrls, forceIntranet })
       );
 
       if (ips.external) {
-        accessibleIps.push(ips.external); // 如果公网 IP 可访问，那么它是 accessibleIps 的第一个元素
+        accessibleIps.push(ips.external); // If public IP is accessible, it is the first element of accessibleIps
       }
 
       if (ips.internal) {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@blocklet/cli",
-  "version": "1.17.12",
+  "version": "1.17.13-beta-20260512-004004-69bacba8",
   "description": "Command line tools to manage Blocklet Server",
-  "homepage": "https://www.arcblock.io/docs/blocklet-cli",
+  "homepage": "https://github.com/ArcBlock/blocklet-server/tree/main/core/cli#readme",
   "bin": {
     "blocklet": "bin/blocklet.js"
   },
@@ -20,9 +20,9 @@
     "bin"
   ],
   "author": {
-    "name": "wangshijun",
-    "email": "shijun@arcblock.io",
-    "url": "https://github.com/wangshijun"
+    "name": "ArcBlock",
+    "email": "blocklet@arcblock.io",
+    "url": "https://github.com/ArcBlock"
   },
   "license": "Apache-2.0",
   "repository": {
@@ -33,28 +33,28 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/blocklet-services": "1.17.12",
-    "@abtnode/constant": "1.17.12",
-    "@abtnode/core": "1.17.12",
-    "@abtnode/db-cache": "1.17.12",
-    "@abtnode/logger": "1.17.12",
-    "@abtnode/models": "1.17.12",
-    "@abtnode/router-provider": "1.17.12",
-    "@abtnode/util": "1.17.12",
-    "@abtnode/webapp": "1.17.12",
+    "@abtnode/blocklet-services": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/constant": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/core": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/db-cache": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/logger": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/models": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/router-provider": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/util": "1.17.13-beta-20260512-004004-69bacba8",
+    "@abtnode/webapp": "1.17.13-beta-20260512-004004-69bacba8",
     "@arcblock/did": "1.29.27",
     "@arcblock/event-hub": "1.29.27",
     "@arcblock/ipfs-only-hash": "^0.0.2",
     "@arcblock/jwt": "1.29.27",
     "@arcblock/ws": "1.29.27",
-    "@blocklet/constant": "1.17.12",
+    "@blocklet/constant": "1.17.13-beta-20260512-004004-69bacba8",
     "@blocklet/error": "^0.3.5",
     "@blocklet/form-collector": "^0.1.8",
-    "@blocklet/images": "1.17.12",
-    "@blocklet/meta": "1.17.12",
-    "@blocklet/resolver": "1.17.12",
-    "@blocklet/server-js": "1.17.12",
-    "@blocklet/store": "1.17.12",
+    "@blocklet/images": "1.17.13-beta-20260512-004004-69bacba8",
+    "@blocklet/meta": "1.17.13-beta-20260512-004004-69bacba8",
+    "@blocklet/resolver": "1.17.13-beta-20260512-004004-69bacba8",
+    "@blocklet/server-js": "1.17.13-beta-20260512-004004-69bacba8",
+    "@blocklet/store": "1.17.13-beta-20260512-004004-69bacba8",
     "@blocklet/theme-builder": "^0.4.8",
     "@ocap/client": "1.29.27",
     "@ocap/mcrypto": "1.29.27",
@@ -136,7 +136,7 @@
     "sqlite3": "^5.1.7",
     "ssri": "^8.0.1",
     "strip-ansi": "6.0.1",
-    "tar": "^6.1.11",
+    "tar": "^7.5.13",
     "terminal-link": "^2.1.1",
     "tweetnacl": "^1.0.3",
     "tweetnacl-sealedbox-js": "^1.2.0",
@@ -151,9 +151,9 @@
     "colors": "1.4.0"
   },
   "engines": {
-    "node": ">=14"
+    "node": ">=22"
   },
-  "gitHead": "a851c46d35a66372b7aa8fb5d7eed7d26980da8a",
+  "gitHead": "289f06c2f5a9390aa03cb942b29da0fc5bfdc745",
   "devDependencies": {
     "@types/fs-extra": "^11.0.4"
   }