@lorekit/cli 1.22.0 → 1.23.0

package/README.md

@@ -116,7 +116,7 @@ and `global`) — split into two clearly-labelled sections so you can see where
 each lesson lives:
 
 - **Offline** — the local two-tier store (`.lorekit/` in the repo + `~/.lorekit/`).
-- **Remote** — the hosted MCP store. When no token/endpoint is configured this
+- **Remote** — the hosted LoreKit store, reached over the REST API. When no token/endpoint is configured this
   section is a short note on how to set it up; it is **never an error** (the
   command still exits 0 and shows your offline lessons). A network/server error
   is likewise a per-scope warning, not a crash.
@@ -192,7 +192,7 @@ which is the point of an overview). An unconfigured remote degrades to a short
 note — never an error, always exit 0. `--endpoint` / `--token` / `--store`
 behave as in `list`. Remote counts reflect what the hosted `memory.list` returns
 per scope (the server's default page size); there is no cap-usage `N / limit`
-figure because the MCP surface exposes no total-count or cap tool.
+figure because the REST API exposes no total-count or cap endpoint.
 
 ### `lorekit scopes`
 
@@ -367,7 +367,7 @@ Memory has a controllable backend. Three **modes**:
 |------|--------------------|-------|
 | `off` | nowhere | Memory is disabled — every hook event and store op is a silent no-op. |
 | `local` | markdown files in two tiers (see below) | **Local means _not_ on the hosted website** — local lessons never sync to the LoreKit dashboard. That is the point of local: private-by-default, greppable, git-native. |
-| `remote` | the LoreKit MCP server (hosted) | The shared, cross-machine backend. Reads stay silent until an endpoint + token are configured. This is the default. |
+| `remote` | the hosted LoreKit API (REST) | The shared, cross-machine backend. Reads stay silent until an endpoint + token are configured. This is the default. |
 
 ### Local store layout — two tiers
 

package/bin/lorekit.mjs

@@ -45,10 +45,10 @@ ${c.bold('Commands')}
               the MCP server entry, and the lifecycle hooks for the chosen scope. Surgical —
               other servers, hooks, and settings are left untouched. Prompts
               project vs global; --project / --global choose non-interactively.
-  doctor      Verify the skill install, MCP connectivity, token, and scope.
+  doctor      Verify the skill install, remote connectivity, token, and scope.
   list (ls)   List the memories that apply to the current directory, split into
               an Offline section (local .lorekit/ + ~/.lorekit/) and a Remote
-              section (hosted MCP). Groups by scope (project/branch/repo/global).
+              section (the hosted LoreKit API). Groups by scope (project/branch/repo/global).
               --json for scripting, --scope <s> to narrow.
   search      Full-text search the applicable memories across both stores and all
     (grep)    scopes (case-insensitive, literal substring over key + value),
@@ -194,7 +194,7 @@ ${c.bold('Examples')}
 ${c.bold('Usage')}
   npx @lorekit/cli doctor [options]
 
-Checks the node runtime, skill install, resolved memory mode, MCP connectivity,
+Checks the node runtime, skill install, resolved memory mode, remote connectivity,
 token, and scope.
 
 ${c.bold('Options')}
@@ -217,8 +217,8 @@ ${c.bold('Usage')}
 
 Shows the memories for the scopes that resolve for the current directory
 (project/branch/repo/global), split into an Offline section (the local
-.lorekit/ + ~/.lorekit/ two-tier store) and a Remote section (the hosted MCP
-server). When no remote token/endpoint is configured the Remote section is a
+.lorekit/ + ~/.lorekit/ two-tier store) and a Remote section (the hosted LoreKit
+API). When no remote token/endpoint is configured the Remote section is a
 short note on how to set it up — never an error.
 
 ${c.bold('Options')}
@@ -320,7 +320,7 @@ ${c.bold('Usage')}
 
 Shows how many memories apply to the current directory's scopes (project/branch/
 repo/global), broken down per scope and per store (Offline = the local .lorekit/
-+ ~/.lorekit/ two-tier store; Remote = the hosted MCP server), with per-store and
++ ~/.lorekit/ two-tier store; Remote = the hosted LoreKit API), with per-store and
 grand totals. An unconfigured remote degrades to a short note, never an error.
 
 ${c.bold('Options')}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/src/mcp-server.mjs

@@ -11,10 +11,12 @@
 //   off    → advertise no tools; a call reports "disabled"
 //
 // org.* tools are always advertised regardless of memory mode. They proxy to
-// the remote endpoint because org management requires a server-side session
-// (JWT auth, SECURITY DEFINER RPCs). In local/off mode a transient RemoteStore
-// is built from the configured endpoint + token. If no remote is configured,
-// a clear error is returned.
+// the remote endpoint because orgs are server-side state — there is no local
+// equivalent to serve them from. (They no longer require a Supabase JWT: the
+// store calls the REST `/orgs` routes, which accept `lk_*` API tokens as of
+// 00041_org_actor_override.sql.) In local/off mode a transient RemoteStore is
+// built from the configured endpoint + token. If no remote is configured, a
+// clear error is returned.
 //
 // Machine-facing: ONLY JSON-RPC frames go to stdout — any diagnostics go to
 // stderr. The server never throws on malformed or partial input; a bad frame

package/src/store/remote.mjs

@@ -1,13 +1,24 @@
-// Remote store: wraps the LoreKit REST API `memory.*` endpoints behind the
-// common store contract. EVERY memory operation goes over REST — list, search,
-// read, write, delete (soft-archive AND `?force=true` hard-delete) and the
-// store-wide `listScopes()` enumeration — for lower overhead and W3C
-// traceparent propagation. MCP remains ONLY for the four `org.*` calls and the
-// `ping` fallback: org RPCs require a Supabase JWT session (they resolve the
-// actor via auth.uid() inside SECURITY DEFINER functions), which is
-// incompatible with the lk_* api_key tokens that CLI users have.
+// Remote store: wraps the LoreKit REST API behind the common store contract.
+// EVERY operation this store performs goes over REST — memory list, search,
+// read, write, delete (soft-archive AND `?force=true` hard-delete), the
+// store-wide `listScopes()` enumeration, all four `org.*` operations, and the
+// `ping` connectivity probe. There is NO MCP transport left here: the store
+// imports `restFetch`/`mcpToRestBase` and nothing else.
+//
+// Org ops used to be the one holdout. The org RPCs resolved their actor from
+// `auth.uid()`, which is NULL on the service-role connection an `lk_*` api_key
+// token gets, so `/orgs` 403'd every CLI caller and the store had to keep a
+// JSON-RPC transport alive purely for `org.create`/`org.list`/`org.rename`/
+// `org.delete`. `00041_org_actor_override.sql` added a `p_actor_user_id`
+// override that the RPCs honour only on a verified service_role connection,
+// and the `orgs` edge function now passes it plus its own tenant filters — so
+// every `/orgs*` route serves api_key tokens and the holdout is gone.
+//
+// `packages/cli/src/mcp.mjs` still exists and is still used: it backs the
+// `lorekit mcp` stdio server command and provides `mcpToRestBase`. It is just
+// no longer a transport for this store.
 // Zero-dependency.
-import { mcpCall, restFetch, mcpToRestBase } from '../mcp.mjs';
+import { restFetch, mcpToRestBase } from '../mcp.mjs';
 import { getActiveTraceparent } from '../telemetry.mjs';
 
 // Drop undefined/null args so JSON payloads stay tidy.
@@ -23,7 +34,12 @@ export function createRemoteStore({ endpoint, token } = {}) {
 
 class RemoteStore {
   constructor(endpoint, token) {
-    this.endpoint = endpoint; // MCP URL (kept for org ops)
+    // The configured endpoint is still spelled as the `/mcp` URL (that is what
+    // `.mcp.json` / LOREKIT_MCP_URL hold, and changing that config key is a
+    // separate migration). Nothing here speaks MCP: it exists only so
+    // `usable()` can judge the configuration and `mcpToRestBase` can derive the
+    // REST base from it.
+    this.endpoint = endpoint;
     this.token = token;
     this.restBase = mcpToRestBase(endpoint); // REST base URL for memory ops
     this.mode = 'remote';
@@ -40,22 +56,6 @@ class RemoteStore {
     return restFetch(this.restBase, this.token, path, { ...opts, traceparent: this._tp() });
   }
 
-  async _mcp(name, args) {
-    if (!this.usable()) return { ok: false, unusable: true };
-    return mcpCall(this.endpoint, this.token, 'tools/call', { name, arguments: args }, { traceparent: this._tp() });
-  }
-
-  _mcpEntries(res) {
-    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    // MCP wraps results in { content: [{ type: 'text', text: '<json>' }] }
-    let payload = null;
-    if (Array.isArray(res.result?.content)) {
-      const text = res.result.content.map((c) => c?.text ?? '').join('');
-      try { payload = JSON.parse(text); } catch { /* ignore */ }
-    } else { payload = res.result; }
-    return { ok: true, entries: Array.isArray(payload?.entries) ? payload.entries : [] };
-  }
-
   // ── Memory operations → REST ──────────────────────────────────────────────
 
   async list({ scope, tags, limit } = {}) {
@@ -119,43 +119,54 @@ class RemoteStore {
     return this.delete({ scope, key, force: false });
   }
 
-  // ── Org operations ─────────────────────────────────────────────────────────
-  // Org RPCs (lorekit_org_*) use auth.uid() server-side via SECURITY DEFINER
-  // functions, which only works with a Supabase JWT session. CLI uses lk_*
-  // api_key tokens which provide no JWT context, so the REST /orgs endpoint
-  // returns 403 for api_key callers. Org ops stay on the MCP endpoint which
-  // handles this correctly (the Deno edge function has its own auth path).
-  // TODO: if org RPCs ever gain api_key support, switch these to REST too.
-
+  // ── Org operations → REST ─────────────────────────────────────────────────
+  // `supabase/functions/orgs/` serves `lk_*` tokens on every route as of
+  // 00041_org_actor_override.sql (see the file header). Each method's RETURN
+  // SHAPE is unchanged from the MCP era — `packages/cli/src/mcp-server.mjs`
+  // serialises these objects straight into a `tools/call` result, so the shape
+  // is a published contract, not an internal detail.
+  //
+  // Slugs are interpolated into the PATH, so they must be encodeURIComponent'd.
+  // A slug is server-side constrained to `[a-z0-9-]`, but the CLI passes
+  // whatever the user typed and an un-encoded `../` or `?` would retarget the
+  // request at a different route entirely.
+
+  // POST /orgs → 201 with the created org object, `{ id, slug, name, created_at }`.
+  // The handler reads the row back after the RPC (`orgs/handlers/orgs/create.ts`);
+  // `created_at` is absent only on the read-back miss, where it falls back to
+  // `{ id, slug, name }`. A bare JSON id string is the LEGACY shape an older
+  // deployed backend can still return — that is what the string branch below is
+  // for, not the normal case. Either way this method reassembles the
+  // `{ id, slug, name }` triple, because `packages/cli/src/mcp-server.mjs`
+  // serialises it straight into a `tools/call` result and that shape is a
+  // published contract.
   async orgCreate({ slug, name } = {}) {
-    const res = await this._mcp('org.create', { slug, name });
+    const res = await this._rest('/orgs', { method: 'POST', body: { slug, name } });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    if (Array.isArray(res.result?.content)) {
-      try { payload = JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')); } catch {}
-    } else { payload = res.result; }
-    return { ok: true, org: payload };
+    const id = typeof res.data === 'string' ? res.data : (res.data?.id ?? null);
+    return { ok: true, org: { id, slug, name } };
   }
 
+  // GET /orgs → { entries: [{ id, slug, name, role, created_at }] }
   async orgList() {
-    const res = await this._mcp('org.list', {});
-    return this._mcpEntries(res);
+    const res = await this._rest('/orgs');
+    if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
+    return { ok: true, entries: Array.isArray(res.data?.entries) ? res.data.entries : [] };
   }
 
+  // PATCH /orgs/:slug → 200 { slug, name }
   async orgRename({ slug, name } = {}) {
-    const res = await this._mcp('org.rename', { slug, name });
+    const res = await this._rest(`/orgs/${encodeURIComponent(slug)}`, { method: 'PATCH', body: { name } });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
-    return { ok: true, ...(payload ?? {}) };
+    return { ok: true, ...(res.data ?? { slug, name }) };
   }
 
+  // DELETE /orgs/:slug → 204 with no body, so `deleted: true` is synthesised to
+  // preserve the `{ ok, deleted, slug }` shape the MCP tool returned.
   async orgDelete({ slug } = {}) {
-    const res = await this._mcp('org.delete', { slug });
+    const res = await this._rest(`/orgs/${encodeURIComponent(slug)}`, { method: 'DELETE' });
     if (!res.ok) return { ok: false, error: res.error, networkError: res.networkError };
-    let payload = null;
-    try { payload = Array.isArray(res.result?.content) ? JSON.parse(res.result.content.map((c) => c?.text ?? '').join('')) : res.result; } catch {}
-    return { ok: true, ...(payload ?? {}) };
+    return { ok: true, deleted: true, slug };
   }
 
   // Store-wide scope enumeration — every distinct scope the caller can see with
@@ -177,22 +188,25 @@ class RemoteStore {
   }
 
   // Connectivity probe for doctor — a transport check, not a memory op.
+  //
+  // There is no MCP fallback: a `restBase` we could not derive means the
+  // configured endpoint is not a URL, and a JSON-RPC POST to that same
+  // unparseable string could only fail in a less legible way. Report the
+  // configuration problem instead.
   async ping() {
     if (!this.usable()) return { ok: false, unusable: true };
     // Use the /health function as a connectivity probe (public, no auth)
-    const healthUrl = this.restBase
-      ? `${this.restBase.replace(/\/functions\/v1$/, '')}/functions/v1/health`
-      : null;
-    if (healthUrl) {
-      const tp = this._tp();
-      try {
-        const res = await fetch(healthUrl, {
-          signal: AbortSignal.timeout(5000),
-          ...(tp ? { headers: { traceparent: tp } } : {}),
-        });
-        return { ok: res.ok, httpStatus: res.status };
-      } catch (e) { return { ok: false, networkError: String(e?.message ?? e) }; }
+    if (!this.restBase) {
+      return { ok: false, error: { message: `Endpoint is not a valid URL: ${this.endpoint}` } };
     }
-    return mcpCall(this.endpoint, this.token, 'tools/list', {}, { traceparent: this._tp() });
+    const healthUrl = `${this.restBase.replace(/\/functions\/v1$/, '')}/functions/v1/health`;
+    const tp = this._tp();
+    try {
+      const res = await fetch(healthUrl, {
+        signal: AbortSignal.timeout(5000),
+        ...(tp ? { headers: { traceparent: tp } } : {}),
+      });
+      return { ok: res.ok, httpStatus: res.status };
+    } catch (e) { return { ok: false, networkError: String(e?.message ?? e) }; }
   }
 }