@pmate/cli 0.30.2 → 0.32.0

package/README.md

@@ -234,15 +234,44 @@ Notes:
 - `pmate vercel` is a thin wrapper around the installed `vercel` CLI.
 - v1 only supports `vercel.scope` in PMate config.
 - `pmate vercel deploys` requires `--project <name>`.
-# App-scoped access logs
+# Service logs
 
-Developers access logs use the same authenticated API as `dev.pmate.chat`, so CLI users cannot bypass App-Service associations or `pmate:dev` authorization by reading the Indexer directly.
+Service logs use the same authenticated API as `dev.pmate.chat`. Each registered Service has `app` (application/deployment) and `runtime` (PM2/Nginx) Table topics on the dedicated `log` chain.
 
 ```sh
-pmate service log pmate:developers-api --app pmate:developers --page 0 --json
-pmate service log pmate:developers-api --app pmate:developers --search http.access --since-ms 1790000000000 --json
+pmate service log pmate:issues-api --topic app --page 0 --json
+pmate service log pmate:issues-api --topic runtime --source nginx --level error --env prod
+pmate service log pmate:issues-api --request-id <id> --follow
 ```
 
-Pages are zero-based. `--search` searches the last 24 hours; the ordinary list follows the Indexer's retention window (currently seven days). `--since-ms` is an epoch-millisecond lower bound. This mode does not accept `--env`, `--follow`, `--history`, or `--base-url`: environment filtering and follow are not implemented by the shared API and are never silently ignored. Without `--app`, the existing operational service-log command is unchanged.
+Pages are zero-based. Lists and `--search` cover the chain's configured retention window (30 days in production). `--since-ms` adds an epoch-millisecond lower bound. `--type`, `--level`, `--source`, `--request-id` and `--env` filter on the server. The legacy `--app` argument is optional and does not select a different source.
 
-A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are not changed. If login is required, run `pmate login --app pmate:developers`. Access denial never falls back to anonymous log reads. Neither source nor exchanged tokens are printed.
+A current CLI session is exchanged in memory for `pmate:developers`; the active App and session file are unchanged. If needed, run `pmate login --app pmate:developers`. Permission denial never falls back to anonymous Indexer reads. Credentials are never printed.
+
+### Package a desktop app
+
+`pmate app build <ns:app> --target electron --config <file>` builds the configured web app, embeds its static output in an Electron ASAR, and produces a macOS DMG and ZIP. It does not require registry login. The first build downloads pinned Electron and electron-builder versions. Current targets: macOS `arm64` and `x64`, built on macOS.
+
+```sh
+pmate app build pmate:hello --target electron --config apps/hello/desktop.config.json --platform mac --arch arm64 --out-dir release/desktop
+```
+
+Config (paths relative to the config file, `web.dist` relative to `web.cwd`):
+
+```json
+{
+  "schemaVersion": 1,
+  "app": "pmate:hello",
+  "productName": "Going Merry",
+  "bundleId": "chat.pmate.goingmerry",
+  "version": "0.1.0",
+  "origin": "https://hello.pmate.chat",
+  "authOrigins": ["https://auth.pmate.chat"],
+  "icon": "desktop/icon.png",
+  "web": { "cwd": ".", "build": ["pnpm", "run", "build"], "dist": "dist" }
+}
+```
+
+Use `--dry-run` to inspect the plan, `--dir` for an unpacked `.app`, or `--signed` to require a configured macOS signing identity. Default builds are ad-hoc signed for local use; they are not notarized distribution releases. Signed builds use electron-builder's standard signing/notarization environment variables; verify notarization separately before distributing.
+
+The shell serves the bundled renderer under its existing exact HTTPS origin, preserving authentication callbacks and API CORS. Other origins remain normal network requests. Static resources are hashed and checked at launch; missing assets return 404. The renderer is sandboxed with Node disabled and no privileged preload bridge. Sign-in, chat and inference still require internet. Updates require a new package. Each build prints its artifact directory and a resource/signing report; no build uploads or auto-updates occur.

package/dist/index.d.ts

@@ -815,6 +815,19 @@ type StoreCommandArgs = ({
     filePath?: string;
 } & StoreSharedArgs);
 type AppCommandArgs = {
+    type: Command.App;
+    action: "build";
+    id: string;
+    target: "electron";
+    config: string;
+    platform: string;
+    arch: string;
+    outDir: string;
+    dryRun: boolean;
+    signed: boolean;
+    dir: boolean;
+    json: boolean;
+} | {
     type: Command.App;
     action: "list";
     namespace?: string;
@@ -957,6 +970,11 @@ type ServiceCommandArgs = {
 } | {
     type: Command.Service;
     action: "log";
+    topic?: "app" | "runtime";
+    level?: string;
+    source?: string;
+    requestId?: string;
+    logType?: string;
     app?: string;
     sinceMs?: number;
     namespace: string;