@pmate/cli 0.30.1 → 0.31.0

package/README.md

@@ -246,3 +246,32 @@ pmate service log pmate:developers-api --app pmate:developers --search http.acce
 Pages are zero-based. `--search` searches the last 24 hours; the ordinary list follows the Indexer's retention window (currently seven days). `--since-ms` is an epoch-millisecond lower bound. This mode does not accept `--env`, `--follow`, `--history`, or `--base-url`: environment filtering and follow are not implemented by the shared API and are never silently ignored. Without `--app`, the existing operational service-log command is unchanged.
 
 A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are not changed. If login is required, run `pmate login --app pmate:developers`. Access denial never falls back to anonymous log reads. Neither source nor exchanged tokens are printed.
+
+
+### Package a desktop app
+
+`pmate app build <ns:app> --target electron --config <file>` builds the configured web app, embeds its static output in an Electron ASAR, and produces a macOS DMG and ZIP. It does not require registry login. The first build downloads pinned Electron and electron-builder versions. Current targets: macOS `arm64` and `x64`, built on macOS.
+
+```sh
+pmate app build pmate:hello --target electron --config apps/hello/desktop.config.json --platform mac --arch arm64 --out-dir release/desktop
+```
+
+Config (paths relative to the config file, `web.dist` relative to `web.cwd`):
+
+```json
+{
+  "schemaVersion": 1,
+  "app": "pmate:hello",
+  "productName": "Going Merry",
+  "bundleId": "chat.pmate.goingmerry",
+  "version": "0.1.0",
+  "origin": "https://hello.pmate.chat",
+  "authOrigins": ["https://auth.pmate.chat"],
+  "icon": "desktop/icon.png",
+  "web": { "cwd": ".", "build": ["pnpm", "run", "build"], "dist": "dist" }
+}
+```
+
+Use `--dry-run` to inspect the plan, `--dir` for an unpacked `.app`, or `--signed` to require a configured macOS signing identity. Default builds are ad-hoc signed for local use; they are not notarized distribution releases. Signed builds use electron-builder's standard signing/notarization environment variables; verify notarization separately before distributing.
+
+The shell serves the bundled renderer under its existing exact HTTPS origin, preserving authentication callbacks and API CORS. Other origins remain normal network requests. Static resources are hashed and checked at launch; missing assets return 404. The renderer is sandboxed with Node disabled and no privileged preload bridge. Sign-in, chat and inference still require internet. Updates require a new package. Each build prints its artifact directory and a resource/signing report; no build uploads or auto-updates occur.

package/dist/index.d.ts

@@ -815,6 +815,19 @@ type StoreCommandArgs = ({
     filePath?: string;
 } & StoreSharedArgs);
 type AppCommandArgs = {
+    type: Command.App;
+    action: "build";
+    id: string;
+    target: "electron";
+    config: string;
+    platform: string;
+    arch: string;
+    outDir: string;
+    dryRun: boolean;
+    signed: boolean;
+    dir: boolean;
+    json: boolean;
+} | {
     type: Command.App;
     action: "list";
     namespace?: string;