@lorekit/cli 1.20.1 → 1.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.20.1",
+  "version": "1.21.0",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/src/mcp.mjs

@@ -87,3 +87,69 @@ function parseBody(text) {
     return null;
   }
 }
+
+/**
+ * Derive the REST API base URL from an MCP endpoint URL.
+ * e.g. 'https://ref.supabase.co/functions/v1/mcp?token=...'
+ *   → 'https://ref.supabase.co/functions/v1'
+ */
+export function mcpToRestBase(mcpEndpointUrl) {
+  if (!mcpEndpointUrl) return null;
+  try {
+    const u = new URL(mcpEndpointUrl);
+    u.searchParams.delete('token');
+    // Strip /mcp suffix (with or without trailing slash)
+    const restPath = u.pathname.replace(/\/mcp\/?$/, '');
+    return `${u.origin}${restPath || '/'}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Minimal REST fetch for LoreKit REST API endpoints.
+ * Returns { ok, httpStatus, data, error, networkError } — same shape as mcpCall.
+ *
+ * @param {string} baseUrl - REST base URL (from mcpToRestBase)
+ * @param {string} token   - Bearer token
+ * @param {string} path    - e.g. '/memories' or '/memories/search'
+ * @param {object} [opts]
+ * @param {string} [opts.method='GET']
+ * @param {object} [opts.body] - JSON body for POST/PATCH/DELETE
+ * @param {number} [opts.timeoutMs=10000]
+ * @param {string} [opts.traceparent] - W3C traceparent header value
+ */
+export async function restFetch(baseUrl, token, path, { method = 'GET', body, timeoutMs = 10000, traceparent } = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const url = `${baseUrl}${path}`;
+    const headers = {
+      accept: 'application/json',
+      ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+      ...(token ? { authorization: `Bearer ${token}` } : {}),
+      ...(traceparent ? { traceparent } : {}),
+    };
+    const res = await fetch(url, {
+      method,
+      headers,
+      ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+      signal: controller.signal,
+    });
+    const text = await res.text();
+    let data = null;
+    try { data = text ? JSON.parse(text) : null; } catch { /* non-JSON body */ }
+    if (!res.ok) {
+      return {
+        ok: false,
+        httpStatus: res.status,
+        error: data?.error ? { message: data.error, code: data.code } : { code: res.status, message: text.slice(0, 200) || res.statusText },
+      };
+    }
+    return { ok: true, httpStatus: res.status, data };
+  } catch (e) {
+    return { ok: false, networkError: String(e?.message ?? e) };
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/store/remote.mjs

@@ -1,25 +1,14 @@
-// Remote store: wraps the LoreKit MCP `memory.*` tools behind the common store
-// contract. Behaviour is identical to the previous direct `mcpCall` usage —
-// this only relocates it behind the interface. Zero-dependency.
-import { mcpCall } from '../mcp.mjs';
-
-// LoreKit returns tool output as { content: [{ type:'text', text:'<json>' }] }.
-function unwrap(result) {
-  if (!result) return null;
-  if (Array.isArray(result.content)) {
-    const text = result.content.map((c) => (c && c.text) || '').join('');
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  }
-  return result;
-}
-
-// Drop undefined/null args so the JSON-RPC payload matches the old direct calls
-// (e.g. `memory.list` with only { scope, limit }).
-function clean(obj) {
+// Remote store: wraps the LoreKit REST API `memory.*` endpoints behind the
+// common store contract. Memory operations use the REST API for lower overhead
+// and W3C traceparent propagation. Org operations remain on MCP because org
+// RPCs require a Supabase JWT session (auth.uid() via SECURITY DEFINER
+// functions), which is incompatible with the lk_* api_key tokens that CLI
+// users have. Zero-dependency.
+import { mcpCall, restFetch, mcpToRestBase } from '../mcp.mjs';
+import { getActiveTraceparent } from '../telemetry.mjs';
+
+// Drop undefined/null args so JSON payloads stay tidy.
+function stripUndefined(obj) {
   const out = {};
   for (const [k, v] of Object.entries(obj || {})) if (v !== undefined && v !== null) out[k] = v;
   return out;
@@ -31,8 +20,9 @@ export function createRemoteStore({ endpoint, token } = {}) {
 
 class RemoteStore {
   constructor(endpoint, token) {
-    this.endpoint = endpoint;
+    this.endpoint = endpoint; // MCP URL (kept for org ops)
     this.token = token;
+    this.restBase = mcpToRestBase(endpoint); // REST base URL for memory ops
     this.mode = 'remote';
   }
 
@@ -40,82 +30,135 @@ class RemoteStore {
     return Boolean(this.endpoint && this.token && !String(this.endpoint).includes('<project-ref>'));
   }
 
-  async _call(name, args) {
+  _tp() { return getActiveTraceparent(); }
+
+  async _rest(path, opts = {}) {
+    if (!this.usable()) return { ok: false, unusable: true };
+    return restFetch(this.restBase, this.token, path, { ...opts, traceparent: this._tp() });
+  }
+
+  async _mcp(name, args) {
     if (!this.usable()) return { ok: false, unusable: true };
     return mcpCall(this.endpoint, this.token, 'tools/call', { name, arguments: args });
   }
 
-  _entries(res) {
+  _mcpEntries(res) {
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    const payload = unwrap(res.result);
-    const entries = payload && Array.isArray(payload.entries) ? payload.entries : [];
-    return { ok: true, entries };
+    // MCP wraps results in { content: [{ type: 'text', text: '<json>' }] }
+    let payload = null;
+    if (Array.isArray(res.result?.content)) {
+      const text = res.result.content.map((c) => c?.text ?? '').join('');
+      try { payload = JSON.parse(text); } catch { /* ignore */ }
+    } else { payload = res.result; }
+    return { ok: true, entries: Array.isArray(payload?.entries) ? payload.entries : [] };
   }
 
+  // ── Memory operations → REST ──────────────────────────────────────────────
+
   async list({ scope, tags, limit } = {}) {
-    return this._entries(await this._call('memory.list', clean({ scope, tags, limit })));
+    const p = new URLSearchParams();
+    if (scope) p.set('scope', scope);
+    if (tags?.length) p.set('tags', Array.isArray(tags) ? tags.join(',') : tags);
+    if (limit) p.set('limit', String(limit));
+    const res = await this._rest(`/memories?${p}`);
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    return { ok: true, entries: res.data?.entries ?? [] };
   }
 
   async search({ q, scopes, tags } = {}) {
-    return this._entries(await this._call('memory.search', clean({ q, scopes, tags })));
+    const body = {};
+    if (q) body.q = q;
+    if (scopes?.length) body.scopes = scopes;
+    if (tags?.length) body.tags = tags;
+    const res = await this._rest('/memories/search', { method: 'POST', body });
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    return { ok: true, entries: res.data?.entries ?? [] };
   }
 
   async read({ scope, key } = {}) {
-    const res = await this._call('memory.read', { scope, key });
+    const p = new URLSearchParams();
+    if (scope) p.set('scope', scope);
+    if (key) p.set('key', key);
+    const res = await this._rest(`/memories?${p}`);
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    const payload = unwrap(res.result);
-    return { ok: true, entry: payload && payload.entry ? payload.entry : payload };
+    const entries = res.data?.entries ?? [];
+    return { ok: true, entry: entries[0] ?? null };
   }
 
   async write(args = {}) {
-    const res = await this._call('memory.write', clean(args));
-    return { ok: res.ok, error: res.error, networkError: res.networkError, result: res.result };
+    const { scope, key, value, tags, source_agent, trigger, org, ttl_days, clear_ttl, created_at } = args;
+    const body = { scope, key, value };
+    if (tags !== undefined) body.tags = tags;
+    if (source_agent !== undefined) body.source_agent = source_agent;
+    if (trigger !== undefined) body.trigger = trigger;
+    if (org !== undefined) body.org = org;
+    if (ttl_days !== undefined) body.ttl_days = ttl_days;
+    if (clear_ttl !== undefined) body.clear_ttl = clear_ttl;
+    if (created_at !== undefined) body.created_at = created_at;
+    const res = await this._rest('/memories', { method: 'POST', body });
+    return { ok: res.ok, error: res.error, networkError: res.networkError };
   }
 
-  async delete({ scope, key, force } = {}) {
-    const res = await this._call('memory.delete', { scope, key, force: Boolean(force) });
+  async delete({ scope, key, force = false } = {}) {
+    if (force) {
+      // Hard-delete requires MCP — REST only supports soft-archive (archived_at)
+      const res = await this._mcp('memory.delete', { scope, key, force: true });
+      return { ok: res.ok, error: res.error, networkError: res.networkError };
+    }
+    // Soft-archive via natural-key REST endpoint
+    const p = new URLSearchParams({ scope, key });
+    const res = await this._rest(`/memories?${p}`, { method: 'DELETE' });
     return { ok: res.ok, error: res.error, networkError: res.networkError };
   }
 
   async archive({ scope, key } = {}) {
-    const res = await this._call('memory.archive', { scope, key });
-    return { ok: res.ok, error: res.error, networkError: res.networkError };
+    // Soft-archive = DELETE without force
+    return this.delete({ scope, key, force: false });
   }
 
-  // ── Org management ─────────────────────────────────────────────────────────
-  // These proxy to the hosted MCP endpoint's org.* tools. Auth is resolved
-  // server-side from the Bearer token; no user-id is passed by the caller.
+  // ── Org operations ─────────────────────────────────────────────────────────
+  // Org RPCs (lorekit_org_*) use auth.uid() server-side via SECURITY DEFINER
+  // functions, which only works with a Supabase JWT session. CLI uses lk_*
+  // api_key tokens which provide no JWT context, so the REST /orgs endpoint
+  // returns 403 for api_key callers. Org ops stay on the MCP endpoint which
+  // handles this correctly (the Deno edge function has its own auth path).
+  // TODO: if org RPCs ever gain api_key support, switch these to REST too.
 
   async orgCreate({ slug, name } = {}) {
-    const res = await this._call('org.create', clean({ slug, name }));
+    const res = await this._mcp('org.create', { slug, name });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    const payload = unwrap(res.result);
+    let payload = null;
+    if (Array.isArray(res.result?.content)) {
+      try { payload = JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')); } catch {}
+    } else { payload = res.result; }
     return { ok: true, org: payload };
   }
 
   async orgList() {
-    const res = await this._call('org.list', {});
-    return this._entries(res);
+    const res = await this._mcp('org.list', {});
+    return this._mcpEntries(res);
   }
 
   async orgRename({ slug, name } = {}) {
-    const res = await this._call('org.rename', clean({ slug, name }));
+    const res = await this._mcp('org.rename', { slug, name });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    const payload = unwrap(res.result);
-    return { ok: true, ...payload };
+    let payload = null;
+    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
+    return { ok: true, ...(payload ?? {}) };
   }
 
   async orgDelete({ slug } = {}) {
-    const res = await this._call('org.delete', clean({ slug }));
+    const res = await this._mcp('org.delete', { slug });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    const payload = unwrap(res.result);
-    return { ok: true, ...payload };
+    let payload = null;
+    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
+    return { ok: true, ...(payload ?? {}) };
   }
 
-  // Store-wide scope enumeration is NOT possible against the hosted MCP surface:
-  // every read tool (memory.list / memory.search / memory.read) REQUIRES a
-  // scope, and there is no "list all scopes" tool. Signal that honestly so the
-  // `scopes` command shows a clear note rather than faking an inventory.
+  // Store-wide scope enumeration is NOT possible against the hosted REST surface:
+  // every read tool requires a scope, and there is no "list all scopes" endpoint.
+  // Signal that honestly so the `scopes` command shows a clear note rather than
+  // faking an inventory.
   async listScopes() {
     return { ok: false, unsupported: true };
   }
@@ -123,6 +166,16 @@ class RemoteStore {
   // Connectivity probe for doctor — a transport check, not a memory op.
   async ping() {
     if (!this.usable()) return { ok: false, unusable: true };
+    // Use the /health function as a connectivity probe (public, no auth)
+    const healthUrl = this.restBase
+      ? `${this.restBase.replace(/\/functions\/v1$/, '')}/functions/v1/health`
+      : null;
+    if (healthUrl) {
+      try {
+        const res = await fetch(healthUrl, { signal: AbortSignal.timeout(5000) });
+        return { ok: res.ok, httpStatus: res.status };
+      } catch (e) { return { ok: false, networkError: String(e?.message ?? e) }; }
+    }
     return mcpCall(this.endpoint, this.token, 'tools/list', {});
   }
 }

package/src/telemetry.mjs

@@ -40,6 +40,22 @@ const FLAG_ATTRS = ['global', 'project', 'deep', 'yes', 'force', 'no-hooks', 'js
 
 const OFF_VALUES = new Set(['0', 'off', 'false', 'no', 'disable', 'disabled']);
 
+// ── Active trace context (for traceparent propagation to REST calls) ──────────
+// Set at the start of each traced command run; used by RemoteStore to
+// forward the CLI span's trace identity to outgoing REST requests.
+let _activeTraceId = null;
+let _activeSpanId = null;
+
+/**
+ * Get the W3C traceparent for the currently-running CLI command, or null.
+ * Called by RemoteStore to inject the header into REST fetches so CLI spans
+ * are linked to REST API spans in Dash0.
+ */
+export function getActiveTraceparent() {
+  if (!_activeTraceId || !_activeSpanId) return null;
+  return `00-${_activeTraceId}-${_activeSpanId}-01`;
+}
+
 // ── Config resolution ─────────────────────────────────────────────────────────
 
 /**
@@ -155,7 +171,7 @@ export function commandAttributes({ command, args = {}, outcome, exitCode, extra
   return attrs;
 }
 
-export function buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage }) {
+export function buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage, traceId, spanId }) {
   return {
     resourceSpans: [
       {
@@ -165,8 +181,8 @@ export function buildTracePayload({ version, name, attributes, startMs, endMs, s
             scope: { name: 'lorekit-cli', version: String(version) },
             spans: [
               {
-                traceId: randHex(16),
-                spanId: randHex(8),
+                traceId: traceId ?? randHex(16),
+                spanId: spanId ?? randHex(8),
                 name,
                 kind: 1, // INTERNAL
                 startTimeUnixNano: String(startMs * 1_000_000),
@@ -243,9 +259,9 @@ async function post(url, headers, payload, timeoutMs) {
  * can never delay or fail the CLI. Awaited before process exit (Node would
  * otherwise drop the in-flight request), but capped at timeoutMs.
  */
-export async function exportInvocation(config, { version, name, attributes, startMs, endMs, status, statusMessage }, { timeoutMs = 1500 } = {}) {
+export async function exportInvocation(config, { version, name, attributes, startMs, endMs, status, statusMessage, traceId, spanId }, { timeoutMs = 1500 } = {}) {
   if (!config || !config.enabled) return;
-  const trace = buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage });
+  const trace = buildTracePayload({ version, name, attributes, startMs, endMs, status, statusMessage, traceId, spanId });
   const metric = buildMetricsPayload({ version, attributes, startMs, endMs });
   await Promise.all([
     post(`${config.endpoint}/v1/traces`, config.headers, trace, timeoutMs),
@@ -305,6 +321,11 @@ export async function traceCommand(command, args, version, run) {
   // (exit 1) for every user without an OTLP endpoint configured.
   if (!config.enabled) return normalizeExitCode(await run());
 
+  // Generate trace context before run() so REST calls can forward it as traceparent.
+  // The same IDs are reused in exportInvocation() to link the CLI span to REST spans.
+  _activeTraceId = randHex(16);
+  _activeSpanId = randHex(8);
+
   const startMs = Date.now();
   let exitCode = 0;
   let status = 'ok';
@@ -360,9 +381,14 @@ export async function traceCommand(command, args, version, run) {
         endMs: Date.now(),
         status,
         statusMessage,
+        traceId: _activeTraceId,
+        spanId: _activeSpanId,
       });
     } catch {
       // never let telemetry break the CLI
+    } finally {
+      _activeTraceId = null;
+      _activeSpanId = null;
     }
   }
 }