@pmate/cli 0.19.0 → 0.20.0

package/dist/index.js

@@ -34,24 +34,94 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/namespacedRef.ts
+function parseNamespacedRef(value, options = {}) {
+  const raw = value.trim();
+  const entityLabel = options.entityLabel || "ref";
+  if (!raw) {
+    throw new Error(`Invalid ${entityLabel}.`);
+  }
+  const colonIndex = raw.indexOf(":");
+  if (colonIndex > 0) {
+    const namespace2 = raw.slice(0, colonIndex).trim();
+    const objectId = raw.slice(colonIndex + 1).trim();
+    if (!namespace2 || !objectId) {
+      throw new Error(`Invalid ${entityLabel} "${value}". Use <ns:objectId>.`);
+    }
+    return {
+      namespace: namespace2,
+      objectId,
+      fullId: `${namespace2}:${objectId}`
+    };
+  }
+  const namespace = options.defaultNamespace?.trim();
+  if (namespace) {
+    return {
+      namespace,
+      objectId: raw,
+      fullId: `${namespace}:${raw}`
+    };
+  }
+  throw new Error(`Invalid ${entityLabel} "${value}". Use <ns:objectId>.`);
+}
+function composeNamespacedRef(namespace, objectId) {
+  const normalizedNamespace = namespace.trim();
+  const normalizedObjectId = objectId.trim();
+  return `${normalizedNamespace}:${normalizedObjectId}`;
+}
+function formatNamespacedDisplayId(namespace, objectIdOrFullId) {
+  const raw = objectIdOrFullId.trim();
+  if (raw.includes(":")) {
+    return raw;
+  }
+  const ns = namespace?.trim();
+  if (!ns) {
+    return raw;
+  }
+  return composeNamespacedRef(ns, raw);
+}
+var init_namespacedRef = __esm({
+  "src/namespacedRef.ts"() {
+    "use strict";
+  }
+});
+
 // src/sessionStore.ts
 function buildSessionStorePath() {
   return import_node_path3.default.join(import_node_os2.default.homedir(), ".pmate", "session.json");
 }
+function assertValidAppRef(appRef) {
+  return parseNamespacedRef(appRef, { entityLabel: "app ref" }).fullId;
+}
 function saveLoginSession(session, requestedApp = DEFAULT_APP_ID) {
   const store = loadExistingSessionStoreOrEmpty();
-  const app = resolveStoredAppId(session, requestedApp);
+  const app = assertValidAppRef(requestedApp);
+  const sessionApp = session.session?.app?.trim();
+  if (!sessionApp) {
+    throw new Error("Missing app in login session payload.");
+  }
+  const normalizedSessionApp = assertValidAppRef(sessionApp);
+  if (normalizedSessionApp !== app) {
+    throw new Error(
+      `Session app mismatch. requested=${app}, received=${normalizedSessionApp}`
+    );
+  }
+  const accountId = session.session.identity?.accountId?.trim();
+  const token = session.token?.trim();
+  const issuedAt = session.session.issuedAt?.trim();
+  const expiresAt = session.session.expiresAt?.trim();
+  if (!accountId || !token || !issuedAt || !expiresAt) {
+    throw new Error("Invalid login session payload.");
+  }
   const nextSession = {
-    ...session,
-    app,
-    session: {
-      ...session.session,
-      ...session.session.app ? {} : { app }
-    },
+    token,
+    accountId,
+    issuedAt,
+    expiresAt,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   store.sessions[app] = nextSession;
-  store.activeApp = app;
+  store.activeAppRef = app;
   writeSessionStore(store);
   return {
     app,
@@ -67,7 +137,9 @@ function readRequiredSession(options) {
   }
   const token = session.token?.trim();
   if (!token) {
-    throw new Error(`Missing token in ${sessionPath}. Run "pmate login --app ${resolvedApp}" again.`);
+    throw new Error(
+      `Missing token in ${sessionPath}. Run "pmate login --app ${resolvedApp}" again.`
+    );
   }
   return {
     ...session,
@@ -82,7 +154,7 @@ function loadExistingSessionStoreOrEmpty() {
   if (!(0, import_node_fs2.existsSync)(sessionPath)) {
     return {
       version: SESSION_STORE_VERSION,
-      activeApp: DEFAULT_APP_ID,
+      activeAppRef: DEFAULT_APP_ID,
       sessions: {}
     };
   }
@@ -104,31 +176,74 @@ function normalizeStore(value) {
       `Invalid session store format in ${buildSessionStorePath()}. Run "pmate login" again.`
     );
   }
-  return {
-    version: SESSION_STORE_VERSION,
-    activeApp: value.activeApp || DEFAULT_APP_ID,
-    sessions: value.sessions || {}
-  };
+  return value;
 }
 function isSessionStore(value) {
-  return !!value && typeof value === "object" && "version" in value && "sessions" in value && typeof value.sessions === "object";
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  if (candidate.version !== SESSION_STORE_VERSION) {
+    return false;
+  }
+  if (typeof candidate.activeAppRef !== "string") {
+    return false;
+  }
+  let normalizedActiveApp;
+  try {
+    normalizedActiveApp = assertValidAppRef(candidate.activeAppRef);
+  } catch {
+    return false;
+  }
+  if (normalizedActiveApp !== candidate.activeAppRef) {
+    return false;
+  }
+  if (!candidate.sessions || typeof candidate.sessions !== "object") {
+    return false;
+  }
+  if (!(normalizedActiveApp in candidate.sessions)) {
+    return false;
+  }
+  for (const [appRef, session] of Object.entries(candidate.sessions)) {
+    try {
+      if (assertValidAppRef(appRef) !== appRef) {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+    if (!isStoredSession(session)) {
+      return false;
+    }
+  }
+  return true;
 }
-function resolveStoredAppId(session, fallbackApp) {
-  return session.session?.app?.trim() || session.app?.trim() || fallbackApp.trim() || DEFAULT_APP_ID;
+function isStoredSession(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const session = value;
+  return typeof session.token === "string" && !!session.token.trim() && typeof session.accountId === "string" && !!session.accountId.trim() && typeof session.issuedAt === "string" && !!session.issuedAt.trim() && typeof session.expiresAt === "string" && !!session.expiresAt.trim() && typeof session.updatedAt === "string" && !!session.updatedAt.trim();
 }
 function resolveReadApp(store, options) {
   const requestedApp = options?.app?.trim();
   if (requestedApp) {
-    return requestedApp;
+    return assertValidAppRef(requestedApp);
   }
   const preferredApp = options?.preferredApp?.trim();
-  if (preferredApp && store.sessions[preferredApp]) {
-    return preferredApp;
+  if (preferredApp) {
+    const normalizedPreferred = assertValidAppRef(preferredApp);
+    if (store.sessions[normalizedPreferred]) {
+      return normalizedPreferred;
+    }
   }
-  if (options?.fallbackToActiveApp && store.activeApp && store.sessions[store.activeApp]) {
-    return store.activeApp;
+  if (options?.fallbackToActiveApp && store.sessions[store.activeAppRef]) {
+    return store.activeAppRef;
   }
-  return preferredApp || store.activeApp || DEFAULT_APP_ID;
+  if (preferredApp) {
+    return assertValidAppRef(preferredApp);
+  }
+  return store.activeAppRef;
 }
 function writeSessionStore(store) {
   const sessionPath = buildSessionStorePath();
@@ -154,8 +269,9 @@ var init_sessionStore = __esm({
     import_node_fs2 = require("fs");
     import_node_os2 = __toESM(require("os"));
     import_node_path3 = __toESM(require("path"));
-    DEFAULT_APP_ID = "@pmate/cli";
-    SESSION_STORE_VERSION = 2;
+    init_namespacedRef();
+    DEFAULT_APP_ID = "pmate:cli";
+    SESSION_STORE_VERSION = 3;
   }
 });
 
@@ -13025,23 +13141,24 @@ var ListCommandHandler = class {
 };
 
 // src/commands/LoginCommandHandler.ts
-var import_node_http = require("http");
 var import_node_child_process = require("child_process");
+var import_node_http = require("http");
 init_sessionStore();
 var AUTH_UI_BASE_URL = "https://auth.pmate.chat";
 var AUTH_API_BASE_URL = "https://auth-api-v2.pmate.chat";
 var CALLBACK_PATH = "/pmate-login-callback";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 function buildHostedLoginUrl(redirectUrl, appId = DEFAULT_APP_ID) {
+  const resolvedApp = assertValidAppRef(appId);
   const url = new URL(AUTH_UI_BASE_URL);
   url.searchParams.set("redirect", redirectUrl);
-  url.searchParams.set("app", appId);
+  url.searchParams.set("app", resolvedApp);
   return url.toString();
 }
 var LoginCommandHandler = class {
   async handle(args) {
     const callback = await this.startCallbackServer();
-    const appId = args.app?.trim() || DEFAULT_APP_ID;
+    const appId = assertValidAppRef(args.app?.trim() || DEFAULT_APP_ID);
     const loginUrl = buildHostedLoginUrl(callback.redirectUrl, appId);
     let savedSession = null;
     ui.info("Opening browser for login.", {
@@ -13058,7 +13175,7 @@ var LoginCommandHandler = class {
     });
     try {
       const token = await callback.waitForToken;
-      const loginResponse = await this.fetchSession(token, appId);
+      const loginResponse = await this.exchangeSession(token, appId);
       savedSession = saveLoginSession(loginResponse, appId);
     } finally {
       await callback.close();
@@ -13069,26 +13186,26 @@ var LoginCommandHandler = class {
       );
     }
   }
-  async fetchSession(token, appId) {
-    const url = new URL(`${AUTH_API_BASE_URL}/session`);
-    url.searchParams.set("app", appId);
-    const response = await fetch(url.toString(), {
-      method: "GET",
+  async exchangeSession(token, appId) {
+    const response = await fetch(`${AUTH_API_BASE_URL}/session/exchange`, {
+      method: "POST",
       headers: {
+        "Content-Type": "application/json",
         Authorization: `Bearer ${token}`
-      }
+      },
+      body: JSON.stringify({ app: appId })
     });
     if (!response.ok) {
       const detail = await response.text();
       throw new Error(
-        `Failed to validate session (${response.status}): ${detail || response.statusText}`
+        `Failed to exchange app session (${response.status}): ${detail || response.statusText}`
       );
     }
     const resp = await response.json();
-    return {
-      ...resp.data,
-      token
-    };
+    if (!resp?.data?.session?.app || resp.data.session.app !== appId) {
+      throw new Error("Invalid exchange response: app-scoped session mismatch.");
+    }
+    return resp.data;
   }
   async startCallbackServer() {
     let resolveToken;
@@ -18990,54 +19107,8 @@ var NamespaceRegistry = class {
   }
 };
 
-// src/namespacedRef.ts
-function parseNamespacedRef(value, options = {}) {
-  const raw = value.trim();
-  const entityLabel = options.entityLabel || "ref";
-  if (!raw) {
-    throw new Error(`Invalid ${entityLabel}.`);
-  }
-  const colonIndex = raw.indexOf(":");
-  if (colonIndex > 0) {
-    const namespace2 = raw.slice(0, colonIndex).trim();
-    const objectId = raw.slice(colonIndex + 1).trim();
-    if (!namespace2 || !objectId) {
-      throw new Error(`Invalid ${entityLabel} "${value}". Use <ns:objectId>.`);
-    }
-    return {
-      namespace: namespace2,
-      objectId,
-      fullId: `${namespace2}:${objectId}`
-    };
-  }
-  const namespace = options.defaultNamespace?.trim();
-  if (namespace) {
-    return {
-      namespace,
-      objectId: raw,
-      fullId: `${namespace}:${raw}`
-    };
-  }
-  throw new Error(`Invalid ${entityLabel} "${value}". Use <ns:objectId>.`);
-}
-function composeNamespacedRef(namespace, objectId) {
-  const normalizedNamespace = namespace.trim();
-  const normalizedObjectId = objectId.trim();
-  return `${normalizedNamespace}:${normalizedObjectId}`;
-}
-function formatNamespacedDisplayId(namespace, objectIdOrFullId) {
-  const raw = objectIdOrFullId.trim();
-  if (raw.includes(":")) {
-    return raw;
-  }
-  const ns = namespace?.trim();
-  if (!ns) {
-    return raw;
-  }
-  return composeNamespacedRef(ns, raw);
-}
-
 // src/commands/AgentCommandHandler.ts
+init_namespacedRef();
 var AgentCommandHandler = class {
   async handle(args) {
     const token = this.readToken();
@@ -19501,6 +19572,7 @@ var StoreCommandHandler = class {
 var import_node_fs13 = require("fs");
 var import_node_path18 = __toESM(require("path"));
 init_sessionStore();
+init_namespacedRef();
 var AppCommandHandler = class {
   async handle(args) {
     const token = this.readToken();
@@ -20208,6 +20280,7 @@ function normalizeRepository(repository) {
 }
 
 // src/commands/ServiceCommandHandler.ts
+init_namespacedRef();
 var ServiceCommandHandler = class {
   async handle(args) {
     const baseUrl = this.resolveBaseUrl(args.baseUrl);
@@ -20723,6 +20796,7 @@ var AccountCommandHandler = class {
 };
 
 // src/agentCommandParser.ts
+init_namespacedRef();
 var DEFAULT_AGENT_NAMESPACE = "pmate";
 function parseAgentArgs(tokens) {
   const rest = [...tokens];
@@ -21231,6 +21305,7 @@ function parsePage(value) {
 }
 
 // src/appCommandParser.ts
+init_namespacedRef();
 function parseAppArgs(tokens) {
   const rest = [...tokens];
   const rawAction = rest.shift();
@@ -21420,6 +21495,7 @@ function parseBareRenameId2(value, entityName) {
 }
 
 // src/serviceCommandParser.ts
+init_namespacedRef();
 function parseServiceArgs(tokens) {
   const rest = [...tokens];
   const rawAction = rest.shift();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {