@pmate/cli 0.29.10 → 0.30.0

package/README.md

@@ -2,6 +2,12 @@
 
 A TypeScript-powered command-line tool scaffold for future pMate automation.
 
+## Deploy from an isolated checkout
+
+Local-build services can be released without modifying the conventional `~/dev/pmate` checkout. Use `pmate service deploy pmate:<service> --env prod --cwd /absolute/path/to/repo` for Vite, static or FC services. The registered service directory is resolved relative to that repository root; `--cwd` does not change the service's registered repository or environment.
+
+Remote Node/Python/Rust deployments still use the registered repository and reject `--cwd` instead of silently ignoring it. Merge and push the intended release to `main` before deployment. The normal service deploy-history and log flow is unchanged.
+
 ## Development
 
 ```bash
@@ -228,3 +234,15 @@ Notes:
 - `pmate vercel` is a thin wrapper around the installed `vercel` CLI.
 - v1 only supports `vercel.scope` in PMate config.
 - `pmate vercel deploys` requires `--project <name>`.
+# App-scoped access logs
+
+Developers access logs use the same authenticated API as `dev.pmate.chat`, so CLI users cannot bypass App-Service associations or `pmate:dev` authorization by reading the Indexer directly.
+
+```sh
+pmate service log pmate:developers-api --app pmate:developers --page 0 --json
+pmate service log pmate:developers-api --app pmate:developers --search http.access --since-ms 1790000000000 --json
+```
+
+Pages are zero-based. `--search` searches the last 24 hours; the ordinary list follows the Indexer's retention window (currently seven days). `--since-ms` is an epoch-millisecond lower bound. This mode does not accept `--env`, `--follow`, `--history`, or `--base-url`: environment filtering and follow are not implemented by the shared API and are never silently ignored. Without `--app`, the existing operational service-log command is unchanged.
+
+A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are not changed. If login is required, run `pmate login --app pmate:developers`. Access denial never falls back to anonymous log reads. Neither source nor exchanged tokens are printed.

package/dist/index.d.ts

@@ -942,6 +942,7 @@ type ServiceCommandArgs = {
     namespace: string;
     name: string;
     env?: string;
+    cwd?: string;
     baseUrl?: string;
     json: boolean;
 } | {
@@ -956,6 +957,8 @@ type ServiceCommandArgs = {
 } | {
     type: Command.Service;
     action: "log";
+    app?: string;
+    sinceMs?: number;
     namespace: string;
     name: string;
     baseUrl?: string;

package/dist/index.js

@@ -90,8 +90,8 @@ var init_namespacedRef = __esm({
 function buildSessionStorePath() {
   return import_node_path4.default.join(import_node_os3.default.homedir(), ".pmate", "session.json");
 }
-function assertValidAppRef(appRef) {
-  return parseNamespacedRef(appRef, { entityLabel: "app ref" }).fullId;
+function assertValidAppRef(appRef2) {
+  return parseNamespacedRef(appRef2, { entityLabel: "app ref" }).fullId;
 }
 function saveLoginSession(session, requestedApp = DEFAULT_APP_ID) {
   const store = loadExistingSessionStoreOrEmpty();
@@ -222,9 +222,9 @@ function isSessionStore(value) {
   if (!(normalizedActiveApp in candidate.sessions)) {
     return false;
   }
-  for (const [appRef, session] of Object.entries(candidate.sessions)) {
+  for (const [appRef2, session] of Object.entries(candidate.sessions)) {
     try {
-      if (assertValidAppRef(appRef) !== appRef) {
+      if (assertValidAppRef(appRef2) !== appRef2) {
         return false;
       }
     } catch {
@@ -17751,11 +17751,11 @@ function isSupportedImageDataUrl(value) {
   const mimeType = match[1]?.toLowerCase();
   return mimeType === "image/png" || mimeType === "image/webp" || mimeType === "image/svg+xml" || mimeType === "image/x-icon";
 }
-async function withDefaultSvgIconVariant(icon, icons, cwd, appRef) {
+async function withDefaultSvgIconVariant(icon, icons, cwd, appRef2) {
   const variant = await renderAppIconVariant({
     icon,
     name: DEFAULT_APP_ICON_VARIANT_NAME,
-    appRef,
+    appRef: appRef2,
     width: 512,
     height: 512,
     format: "webp",
@@ -17796,7 +17796,7 @@ function buildAppIconVariantObjectKey(input) {
     `${resolveAppIconAssetStem(input.icon, input.appRef)}-${input.name}.${extensionForIconFormat(input.format)}`
   );
 }
-function resolveAppIconAssetStem(icon, appRef) {
+function resolveAppIconAssetStem(icon, appRef2) {
   if (icon) {
     try {
       const url = new URL(icon);
@@ -17809,8 +17809,8 @@ function resolveAppIconAssetStem(icon, appRef) {
     } catch {
     }
   }
-  if (appRef) {
-    const { objectId } = parseNamespacedRef(appRef, {
+  if (appRef2) {
+    const { objectId } = parseNamespacedRef(appRef2, {
       entityLabel: "app ref"
     });
     const normalized = sanitizeAppIconAssetStem(objectId);
@@ -18052,9 +18052,9 @@ var AppCommandHandler = class {
       throw new Error(`Invalid JSON in ${absolutePath}: ${message}`);
     }
   }
-  async preparePayload(filePath, appRef) {
+  async preparePayload(filePath, appRef2) {
     const absolutePath = this.resolveFilePath(filePath);
-    return prepareAppPayload(this.readJsonFile(filePath), import_node_path23.default.dirname(absolutePath), { appRef });
+    return prepareAppPayload(this.readJsonFile(filePath), import_node_path23.default.dirname(absolutePath), { appRef: appRef2 });
   }
   resolveFilePath(filePath) {
     return import_node_path23.default.resolve(process.cwd(), filePath);
@@ -18866,6 +18866,9 @@ var ServiceRuntimeRunner = class {
     this.envProvider = envProvider;
   }
   async deploy(service, options = {}) {
+    if (options.cwd && !["vite", "static", "fc"].includes(this.getType(service))) {
+      throw new Error("--cwd is only supported for local-build vite, static and fc services; remote deployments use the registered repository");
+    }
     switch (this.getType(service)) {
       case "node-api":
         await this.deployNode(service, options);
@@ -19165,8 +19168,8 @@ var ServiceRuntimeRunner = class {
   async deployFc(service, options = {}) {
     const fc = this.getFc(service);
     this.validateFcConfig(service, fc);
-    const repoRoot = this.resolveRepoRoot(service);
-    const appDir = this.resolveLocalDir(service);
+    const repoRoot = this.resolveRepoRoot(service, options.cwd);
+    const appDir = this.resolveLocalDir(service, options.cwd);
     const packageJsonPath = import_node_path25.default.join(appDir, "package.json");
     if (!(0, import_node_fs20.existsSync)(packageJsonPath)) {
       throw new Error(`No package.json found at ${packageJsonPath}`);
@@ -20315,6 +20318,51 @@ function parseServiceRef(serviceId) {
 
 // src/commands/ServiceCommandHandler.ts
 init_namespacedRef();
+
+// src/services/DeveloperLogsClient.ts
+init_sessionStore();
+init_namespacedRef();
+var appRef = "pmate:developers";
+async function queryDeveloperLogs(input, fetcher = fetch) {
+  parseNamespacedRef(input.app, { entityLabel: "app ref" });
+  parseNamespacedRef(input.service, { entityLabel: "service ref" });
+  if (!Number.isSafeInteger(input.page) || input.page < 0) throw new Error("Invalid log page");
+  if (input.sinceMs !== void 0 && (!Number.isSafeInteger(input.sinceMs) || input.sinceMs < 0)) throw new Error("Invalid log time");
+  if (input.keyword && input.keyword.length > 256) throw new Error("Log search must be at most 256 characters");
+  const session = readRequiredSession({ preferredApp: appRef, fallbackToActiveApp: true });
+  if (Date.parse(session.expiresAt) <= Date.now() || !Number.isFinite(Date.parse(session.expiresAt)))
+    throw new Error("Session expired. Run pmate login --app pmate:developers");
+  async function request2(url, init) {
+    let response;
+    try {
+      response = await fetcher(url, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4) });
+    } catch {
+      throw new Error("Developers log request failed; no anonymous fallback was attempted");
+    }
+    if (!response.ok) throw new Error(`Developers log request failed (HTTP ${response.status}); check login, pmate:dev role and App-Service access`);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new Error("Invalid Developers API response");
+    }
+    if (!body?.success) throw new Error("Developers API rejected the request");
+    return body.data;
+  }
+  const exchanged = await request2("https://auth-api-v2.pmate.chat/session/exchange", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${session.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ app: appRef })
+  });
+  if (exchanged?.session?.identity?.app !== appRef || exchanged.session.identity.accountId !== session.accountId || typeof exchanged.token !== "string" || !exchanged.token)
+    throw new Error("Developers session identity mismatch");
+  const params = new URLSearchParams({ app: input.app, service: input.service, page: String(input.page) });
+  if (input.keyword) params.set("keyword", input.keyword);
+  if (input.sinceMs !== void 0) params.set("sinceMs", String(input.sinceMs));
+  return request2(`https://dev-api.pmate.chat/api/logs?${params}`, { headers: { Authorization: `Bearer ${exchanged.token}` } });
+}
+
+// src/commands/ServiceCommandHandler.ts
 var ServiceCommandHandler = class {
   async handle(args) {
     const baseUrl = this.resolveBaseUrl(args.baseUrl);
@@ -20480,7 +20528,7 @@ var ServiceCommandHandler = class {
         const record = await registry.getService(args.namespace, args.name);
         const service = await this.materializeServiceEnv(registry, record, args.env);
         try {
-          await runtime.deploy(service, { envName: args.env });
+          await runtime.deploy(service, { envName: args.env, ...args.cwd ? { cwd: args.cwd } : {} });
           await this.appendDeployHistory(registry, record.id, args.env, "success");
         } catch (error) {
           await this.appendDeployHistory(
@@ -20511,6 +20559,11 @@ var ServiceCommandHandler = class {
         return;
       }
       case "log": {
+        if (args.app) {
+          const result = await queryDeveloperLogs({ app: args.app, service: `${args.namespace}:${args.name}`, page: args.page, keyword: args.search, sinceMs: args.sinceMs });
+          console.log(JSON.stringify(result, null, args.json ? void 0 : 2));
+          return;
+        }
         const record = await registry.getService(args.namespace, args.name);
         const service = args.env ? await this.materializeServiceEnv(registry, record, args.env) : record;
         await runtime.log(service, {
@@ -23767,6 +23820,8 @@ function parseServiceArgs(tokens) {
     }
     let cwd;
     let page = 0;
+    let app;
+    let sinceMs;
     let history = false;
     let search;
     let follow = false;
@@ -23774,11 +23829,20 @@ function parseServiceArgs(tokens) {
     while (rest.length > 0) {
       const token = rest.shift();
       switch (token) {
+        case "--app":
+          if (action !== "log") throw new Error(`Unknown service ${action} option: ${token}`);
+          app = parseNamespacedRef(requireValue4(rest, token), { entityLabel: "app ref" }).fullId;
+          break;
+        case "--since-ms":
+          if (action !== "log") throw new Error(`Unknown service ${action} option: ${token}`);
+          sinceMs = Number(requireValue4(rest, token));
+          if (!Number.isSafeInteger(sinceMs) || sinceMs < 0) throw new Error("Invalid --since-ms");
+          break;
         case "--base-url":
           baseUrl = requireValue4(rest, token);
           break;
         case "--cwd":
-          if (action !== "init") {
+          if (action !== "init" && action !== "deploy") {
             throw new Error(`Unknown service ${action} option: ${token}`);
           }
           cwd = requireValue4(rest, token);
@@ -23790,7 +23854,8 @@ function parseServiceArgs(tokens) {
           env = requireValue4(rest, token);
           break;
         case "--page":
-          page = Number.parseInt(requireValue4(rest, token), 10);
+          page = Number(requireValue4(rest, token));
+          if (!Number.isSafeInteger(page) || page < 0) throw new Error("Invalid --page");
           break;
         case "--history":
           history = true;
@@ -23813,7 +23878,9 @@ function parseServiceArgs(tokens) {
     const namespace = parsedRef.namespace;
     const name = parsedRef.objectId;
     if (action === "log") {
-      return { type: "service" /* Service */, action, namespace, name, baseUrl, json, page, history, search, follow, env };
+      if (app && (history || follow || env || baseUrl)) throw new Error("App logs do not support --history, --follow, --env or --base-url; use --page, --search and --since-ms");
+      if (sinceMs !== void 0 && !app) throw new Error("--since-ms requires --app");
+      return { type: "service" /* Service */, action, namespace, name, baseUrl, json, page, history, search, follow, env, ...app ? { app } : {}, ...sinceMs !== void 0 ? { sinceMs } : {} };
     }
     if (action === "deploy-logs" || action === "deploy-history") {
       return { type: "service" /* Service */, action, namespace, name, env, page, baseUrl, json };
@@ -23822,7 +23889,7 @@ function parseServiceArgs(tokens) {
       if (action === "deploy" && !env) {
         throw new Error("Missing required option --env for service deploy");
       }
-      return { type: "service" /* Service */, action, namespace, name, env, baseUrl, json };
+      return { type: "service" /* Service */, action, namespace, name, env, ...cwd ? { cwd } : {}, baseUrl, json };
     }
     if (action === "init") {
       if (!env) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.29.10",
+  "version": "0.30.0",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {
@@ -11,16 +11,6 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "npm run clean && tsup --config tsup.config.ts && node scripts/copy-templates.js",
-    "clean": "rimraf dist",
-    "dev": "ts-node src/index.ts",
-    "release": "pnpm publish",
-    "start": "node dist/index.js",
-    "test": "vitest run src/tests",
-    "typecheck": "tsc --noEmit",
-    "prepare": "npm run build"
-  },
   "keywords": [
     "cli",
     "typescript",
@@ -67,10 +57,13 @@
     "typescript": "^5.9.3",
     "vitest": "^4.0.17"
   },
-  "pnpm": {
-    "overrides": {
-      "@pmate/meta": "^1.3.1",
-      "@pmate/utils": "^1.1.4"
-    }
+  "scripts": {
+    "build": "npm run clean && tsup --config tsup.config.ts && node scripts/copy-templates.js",
+    "clean": "rimraf dist",
+    "dev": "ts-node src/index.ts",
+    "release": "pnpm publish",
+    "start": "node dist/index.js",
+    "test": "vitest run src/tests",
+    "typecheck": "tsc --noEmit"
   }
-}
+}