@pmate/cli 0.29.11 → 0.30.0

package/README.md

@@ -234,3 +234,15 @@ Notes:
 - `pmate vercel` is a thin wrapper around the installed `vercel` CLI.
 - v1 only supports `vercel.scope` in PMate config.
 - `pmate vercel deploys` requires `--project <name>`.
+# App-scoped access logs
+
+Developers access logs use the same authenticated API as `dev.pmate.chat`, so CLI users cannot bypass App-Service associations or `pmate:dev` authorization by reading the Indexer directly.
+
+```sh
+pmate service log pmate:developers-api --app pmate:developers --page 0 --json
+pmate service log pmate:developers-api --app pmate:developers --search http.access --since-ms 1790000000000 --json
+```
+
+Pages are zero-based. `--search` searches the last 24 hours; the ordinary list follows the Indexer's retention window (currently seven days). `--since-ms` is an epoch-millisecond lower bound. This mode does not accept `--env`, `--follow`, `--history`, or `--base-url`: environment filtering and follow are not implemented by the shared API and are never silently ignored. Without `--app`, the existing operational service-log command is unchanged.
+
+A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are not changed. If login is required, run `pmate login --app pmate:developers`. Access denial never falls back to anonymous log reads. Neither source nor exchanged tokens are printed.

package/dist/index.d.ts

@@ -957,6 +957,8 @@ type ServiceCommandArgs = {
 } | {
     type: Command.Service;
     action: "log";
+    app?: string;
+    sinceMs?: number;
     namespace: string;
     name: string;
     baseUrl?: string;

package/dist/index.js

@@ -90,8 +90,8 @@ var init_namespacedRef = __esm({
 function buildSessionStorePath() {
   return import_node_path4.default.join(import_node_os3.default.homedir(), ".pmate", "session.json");
 }
-function assertValidAppRef(appRef) {
-  return parseNamespacedRef(appRef, { entityLabel: "app ref" }).fullId;
+function assertValidAppRef(appRef2) {
+  return parseNamespacedRef(appRef2, { entityLabel: "app ref" }).fullId;
 }
 function saveLoginSession(session, requestedApp = DEFAULT_APP_ID) {
   const store = loadExistingSessionStoreOrEmpty();
@@ -222,9 +222,9 @@ function isSessionStore(value) {
   if (!(normalizedActiveApp in candidate.sessions)) {
     return false;
   }
-  for (const [appRef, session] of Object.entries(candidate.sessions)) {
+  for (const [appRef2, session] of Object.entries(candidate.sessions)) {
     try {
-      if (assertValidAppRef(appRef) !== appRef) {
+      if (assertValidAppRef(appRef2) !== appRef2) {
         return false;
       }
     } catch {
@@ -17751,11 +17751,11 @@ function isSupportedImageDataUrl(value) {
   const mimeType = match[1]?.toLowerCase();
   return mimeType === "image/png" || mimeType === "image/webp" || mimeType === "image/svg+xml" || mimeType === "image/x-icon";
 }
-async function withDefaultSvgIconVariant(icon, icons, cwd, appRef) {
+async function withDefaultSvgIconVariant(icon, icons, cwd, appRef2) {
   const variant = await renderAppIconVariant({
     icon,
     name: DEFAULT_APP_ICON_VARIANT_NAME,
-    appRef,
+    appRef: appRef2,
     width: 512,
     height: 512,
     format: "webp",
@@ -17796,7 +17796,7 @@ function buildAppIconVariantObjectKey(input) {
     `${resolveAppIconAssetStem(input.icon, input.appRef)}-${input.name}.${extensionForIconFormat(input.format)}`
   );
 }
-function resolveAppIconAssetStem(icon, appRef) {
+function resolveAppIconAssetStem(icon, appRef2) {
   if (icon) {
     try {
       const url = new URL(icon);
@@ -17809,8 +17809,8 @@ function resolveAppIconAssetStem(icon, appRef) {
     } catch {
     }
   }
-  if (appRef) {
-    const { objectId } = parseNamespacedRef(appRef, {
+  if (appRef2) {
+    const { objectId } = parseNamespacedRef(appRef2, {
       entityLabel: "app ref"
     });
     const normalized = sanitizeAppIconAssetStem(objectId);
@@ -18052,9 +18052,9 @@ var AppCommandHandler = class {
       throw new Error(`Invalid JSON in ${absolutePath}: ${message}`);
     }
   }
-  async preparePayload(filePath, appRef) {
+  async preparePayload(filePath, appRef2) {
     const absolutePath = this.resolveFilePath(filePath);
-    return prepareAppPayload(this.readJsonFile(filePath), import_node_path23.default.dirname(absolutePath), { appRef });
+    return prepareAppPayload(this.readJsonFile(filePath), import_node_path23.default.dirname(absolutePath), { appRef: appRef2 });
   }
   resolveFilePath(filePath) {
     return import_node_path23.default.resolve(process.cwd(), filePath);
@@ -20318,6 +20318,51 @@ function parseServiceRef(serviceId) {
 
 // src/commands/ServiceCommandHandler.ts
 init_namespacedRef();
+
+// src/services/DeveloperLogsClient.ts
+init_sessionStore();
+init_namespacedRef();
+var appRef = "pmate:developers";
+async function queryDeveloperLogs(input, fetcher = fetch) {
+  parseNamespacedRef(input.app, { entityLabel: "app ref" });
+  parseNamespacedRef(input.service, { entityLabel: "service ref" });
+  if (!Number.isSafeInteger(input.page) || input.page < 0) throw new Error("Invalid log page");
+  if (input.sinceMs !== void 0 && (!Number.isSafeInteger(input.sinceMs) || input.sinceMs < 0)) throw new Error("Invalid log time");
+  if (input.keyword && input.keyword.length > 256) throw new Error("Log search must be at most 256 characters");
+  const session = readRequiredSession({ preferredApp: appRef, fallbackToActiveApp: true });
+  if (Date.parse(session.expiresAt) <= Date.now() || !Number.isFinite(Date.parse(session.expiresAt)))
+    throw new Error("Session expired. Run pmate login --app pmate:developers");
+  async function request2(url, init) {
+    let response;
+    try {
+      response = await fetcher(url, { ...init, redirect: "error", signal: AbortSignal.timeout(3e4) });
+    } catch {
+      throw new Error("Developers log request failed; no anonymous fallback was attempted");
+    }
+    if (!response.ok) throw new Error(`Developers log request failed (HTTP ${response.status}); check login, pmate:dev role and App-Service access`);
+    let body;
+    try {
+      body = await response.json();
+    } catch {
+      throw new Error("Invalid Developers API response");
+    }
+    if (!body?.success) throw new Error("Developers API rejected the request");
+    return body.data;
+  }
+  const exchanged = await request2("https://auth-api-v2.pmate.chat/session/exchange", {
+    method: "POST",
+    headers: { Authorization: `Bearer ${session.token}`, "Content-Type": "application/json" },
+    body: JSON.stringify({ app: appRef })
+  });
+  if (exchanged?.session?.identity?.app !== appRef || exchanged.session.identity.accountId !== session.accountId || typeof exchanged.token !== "string" || !exchanged.token)
+    throw new Error("Developers session identity mismatch");
+  const params = new URLSearchParams({ app: input.app, service: input.service, page: String(input.page) });
+  if (input.keyword) params.set("keyword", input.keyword);
+  if (input.sinceMs !== void 0) params.set("sinceMs", String(input.sinceMs));
+  return request2(`https://dev-api.pmate.chat/api/logs?${params}`, { headers: { Authorization: `Bearer ${exchanged.token}` } });
+}
+
+// src/commands/ServiceCommandHandler.ts
 var ServiceCommandHandler = class {
   async handle(args) {
     const baseUrl = this.resolveBaseUrl(args.baseUrl);
@@ -20514,6 +20559,11 @@ var ServiceCommandHandler = class {
         return;
       }
       case "log": {
+        if (args.app) {
+          const result = await queryDeveloperLogs({ app: args.app, service: `${args.namespace}:${args.name}`, page: args.page, keyword: args.search, sinceMs: args.sinceMs });
+          console.log(JSON.stringify(result, null, args.json ? void 0 : 2));
+          return;
+        }
         const record = await registry.getService(args.namespace, args.name);
         const service = args.env ? await this.materializeServiceEnv(registry, record, args.env) : record;
         await runtime.log(service, {
@@ -23770,6 +23820,8 @@ function parseServiceArgs(tokens) {
     }
     let cwd;
     let page = 0;
+    let app;
+    let sinceMs;
     let history = false;
     let search;
     let follow = false;
@@ -23777,6 +23829,15 @@ function parseServiceArgs(tokens) {
     while (rest.length > 0) {
       const token = rest.shift();
       switch (token) {
+        case "--app":
+          if (action !== "log") throw new Error(`Unknown service ${action} option: ${token}`);
+          app = parseNamespacedRef(requireValue4(rest, token), { entityLabel: "app ref" }).fullId;
+          break;
+        case "--since-ms":
+          if (action !== "log") throw new Error(`Unknown service ${action} option: ${token}`);
+          sinceMs = Number(requireValue4(rest, token));
+          if (!Number.isSafeInteger(sinceMs) || sinceMs < 0) throw new Error("Invalid --since-ms");
+          break;
         case "--base-url":
           baseUrl = requireValue4(rest, token);
           break;
@@ -23793,7 +23854,8 @@ function parseServiceArgs(tokens) {
           env = requireValue4(rest, token);
           break;
         case "--page":
-          page = Number.parseInt(requireValue4(rest, token), 10);
+          page = Number(requireValue4(rest, token));
+          if (!Number.isSafeInteger(page) || page < 0) throw new Error("Invalid --page");
           break;
         case "--history":
           history = true;
@@ -23816,7 +23878,9 @@ function parseServiceArgs(tokens) {
     const namespace = parsedRef.namespace;
     const name = parsedRef.objectId;
     if (action === "log") {
-      return { type: "service" /* Service */, action, namespace, name, baseUrl, json, page, history, search, follow, env };
+      if (app && (history || follow || env || baseUrl)) throw new Error("App logs do not support --history, --follow, --env or --base-url; use --page, --search and --since-ms");
+      if (sinceMs !== void 0 && !app) throw new Error("--since-ms requires --app");
+      return { type: "service" /* Service */, action, namespace, name, baseUrl, json, page, history, search, follow, env, ...app ? { app } : {}, ...sinceMs !== void 0 ? { sinceMs } : {} };
     }
     if (action === "deploy-logs" || action === "deploy-history") {
       return { type: "service" /* Service */, action, namespace, name, env, page, baseUrl, json };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.29.11",
+  "version": "0.30.0",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {