@pmate/cli 0.29.11 → 0.30.1

package/README.md

@@ -234,3 +234,15 @@ Notes:
 - `pmate vercel` is a thin wrapper around the installed `vercel` CLI.
 - v1 only supports `vercel.scope` in PMate config.
 - `pmate vercel deploys` requires `--project <name>`.
+# App-scoped access logs
+
+Developers access logs use the same authenticated API as `dev.pmate.chat`, so CLI users cannot bypass App-Service associations or `pmate:dev` authorization by reading the Indexer directly.
+
+```sh
+pmate service log pmate:developers-api --app pmate:developers --page 0 --json
+pmate service log pmate:developers-api --app pmate:developers --search http.access --since-ms 1790000000000 --json
+```
+
+Pages are zero-based. `--search` searches the last 24 hours; the ordinary list follows the Indexer's retention window (currently seven days). `--since-ms` is an epoch-millisecond lower bound. This mode does not accept `--env`, `--follow`, `--history`, or `--base-url`: environment filtering and follow are not implemented by the shared API and are never silently ignored. Without `--app`, the existing operational service-log command is unchanged.
+
+A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are not changed. If login is required, run `pmate login --app pmate:developers`. Access denial never falls back to anonymous log reads. Neither source nor exchanged tokens are printed.

package/dist/index.d.ts

@@ -957,6 +957,8 @@ type ServiceCommandArgs = {
 } | {
     type: Command.Service;
     action: "log";
+    app?: string;
+    sinceMs?: number;
     namespace: string;
     name: string;
     baseUrl?: string;