@lorekit/cli 1.55.2 → 1.55.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.55.2",
+  "version": "1.55.3",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/src/commands/mcp-server.mjs

@@ -365,7 +365,7 @@ export function advertise(dispatch) {
       if (!def) {
         throw new Error(
           `mcp-server dispatches "${name}", which the tool catalog does not declare. `
-          + 'Add it to packages/schemas/src/shared/tool-catalog.ts (and regenerate: node scripts/gen-surfaces.mjs).',
+          + 'Add it to packages/schemas/src/shared/tool-catalog.ts (and regenerate: node scripts/codegen/gen-surfaces.mjs).',
         );
       }
       return def;

package/src/commands/purge.mjs

@@ -19,7 +19,7 @@
 //    `--json`). An agent loop must not be able to trigger one by omission.
 //
 // 3. A SCOPED KEY IS REFUSED BY THE SERVER, and that refusal is passed through
-//    verbatim. `_shared/account-wide-tools.ts` refuses these two operations for
+//    verbatim. `_shared/auth/account-wide-tools.ts` refuses these two operations for
 //    any token carrying a scope allowlist — a key narrowed to one repo has no
 //    business sweeping the whole account. The CLI makes exactly one request and
 //    reports the server's answer; it never retries, never splits the sweep and

package/src/commands/show.mjs

@@ -10,7 +10,10 @@
 //                            you can copy-paste a key directly from list output)
 //   show <scope> <key>     — the explicit two-positional form
 //   show --scope <s> --key <k>
-//                          — flags win; the only way to name a key containing `::`
+//                          — flags win; an explicit override that skips the `::`
+//                            split (the shorthand already carries a namespaced
+//                            key, since the split lands at the first valid-scope
+//                            prefix — see `resolveScopeArg`)
 //
 // Uses each store's real `read({scope, key})` method (both stores expose it),
 // not a filtered `list` — a single-record lookup is what `read` is for, and it
@@ -60,8 +63,9 @@ export async function show(args) {
   // Positional shapes (all resolved by the shared, validity-gated parser):
   //   show <scope::key>            — canonical shorthand, mirrors `list` output
   //   show <scope> <key>           — explicit two-positional form
-  //   show --scope <s> --key <k>   — flags win; the escape hatch for a key
-  //                                  containing `::`
+  //   show --scope <s> --key <k>   — flags win; an explicit override that skips
+  //                                  the `::` split (the shorthand handles a
+  //                                  namespaced key on its own now)
   const positionals = args._.slice(1);
   const { scope, key, consumed } = resolveScopeKeyArgs(positionals, {
     scope: args.scope,

package/src/shared/lessons-pure.mjs

@@ -122,23 +122,29 @@ export function isScopeString(s) {
 // Split a single `<scope>::<key>` argument, or fall back to treating the whole
 // argument as a scope.
 //
-// The rule: split at the LAST `::` and take it as `<scope>::<key>` ONLY when the
-// left side is itself a COMPLETE valid scope — otherwise the whole arg is the
-// scope. Splitting on the last `::` (not the first) keeps a multi-segment scope
-// whole (`repo::owner/name::key` → scope `repo::owner/name`, key `key`); gating
-// on a valid left side means a bare `repo::owner/name` is NOT mis-split, because
-// its left part `repo` is not a valid scope. This is the fix for the prior
-// first-`::` split, which turned `link repo::acme/widget` into scope="repo" plus
-// a bogus `acme/widget` key — breaking the shorthand for EVERY non-`global`
-// scope. A malformed arg falls through to the scope, never a fabricated key.
+// The rule: scan the `::` boundaries left-to-right and split at the FIRST one
+// whose left side is a COMPLETE valid scope — otherwise the whole arg is the
+// scope. Because `::` is RESERVED as the segment separator (no scope segment may
+// contain it, enforced by `scopeIssue`), no valid scope is a `::`-boundary
+// prefix of another, so the earliest valid-scope prefix is unambiguously THE
+// scope and everything after it is the key — even a key that itself contains
+// `::` (a namespaced key like `implement-suggestion-lessons::documenting-…`).
+//
+// This first-valid scan superseded a plain last-`::` split, which broke exactly
+// that case: `global::foo-lessons::bar` split at the last `::` gave the left
+// side `global::foo-lessons`, not a valid scope, so the whole arg fell through
+// to the scope and `scopeIssue` rejected it. Gating on a valid left side is what
+// keeps a bare `repo::owner/name` from mis-splitting (its `repo` prefix is not a
+// valid scope) and a multi-segment scope whole (`branch::o/n::main::key` → scope
+// `branch::o/n::main`, key `key`, since the shorter prefixes are all invalid). A
+// malformed arg falls through to the scope, never a fabricated key.
 //
 // `isScope` is injected rather than closed over so the module stays trivially
 // testable with a stub predicate; callers pass `isScopeString`.
 export function resolveScopeArg(arg, isScope = isScopeString) {
   const s = typeof arg === 'string' ? arg.trim() : '';
   if (!s) return { scope: null, key: null };
-  const idx = s.lastIndexOf('::');
-  if (idx !== -1) {
+  for (let idx = s.indexOf('::'); idx !== -1; idx = s.indexOf('::', idx + 2)) {
     const left = s.slice(0, idx).trim();
     const right = s.slice(idx + 2).trim();
     if (right && isScope(left)) return { scope: left, key: right };

package/src/shared/mcp.mjs

@@ -159,7 +159,7 @@ export function mcpToRestBase(mcpEndpointUrl) {
 /**
  * Normalise a client-supplied usage correlation id (a PR ref, session id, or CI
  * job id). Bounded + charset-restricted to match the server's `parseCorrelationId`
- * (supabase/functions/_shared/usage-stats.ts); returns null for empty/over-long/
+ * (supabase/functions/_shared/telemetry/usage-stats.ts); returns null for empty/over-long/
  * out-of-charset input so a bad value is simply not sent. Zero-dep (the CLI does
  * not import mcp-core), so the small regex is duplicated intentionally.
  */

package/src/surfaces.generated.mjs

@@ -1,6 +1,6 @@
 // GENERATED — do not edit.
 // Source: packages/schemas/src/shared/tool-catalog.ts
-// Regenerate: node scripts/gen-surfaces.mjs
+// Regenerate: node scripts/codegen/gen-surfaces.mjs
 //
 // Edit the catalog's `surfaces` bindings, not this file. `--check` fails CI
 // when the two disagree.

package/src/telemetry/telemetry-token.mjs

@@ -4,7 +4,7 @@
 // source tree and nothing secret is ever committed to git. The release workflow
 // (.github/workflows/release.yml → publish-cli) overwrites this file at publish
 // time from the LOREKIT_TELEMETRY_TOKEN secret via
-// scripts/inject-telemetry-token.mjs, so only the *published npm tarball*
+// scripts/telemetry/inject-telemetry-token.mjs, so only the *published npm tarball*
 // carries the token.
 //
 // The token is public by design once published (anyone can unpack the tarball),

package/src/telemetry/telemetry.mjs

@@ -183,7 +183,7 @@ export function resolveTelemetryTokenSource(env = process.env) {
   return 'none';
 }
 
-// ── ID + value helpers (mirror _shared/otel.ts) ───────────────────────────────
+// ── ID + value helpers (mirror _shared/telemetry/otel.ts) ───────────────────────────────
 
 export function randHex(bytes) {
   const b = new Uint8Array(bytes);
@@ -236,7 +236,7 @@ export function normalizeHostArch(arch) {
  * the attribute by default. It is emitted ONLY when explicitly overridden via
  * `DEPLOYMENT_ENVIRONMENT` (falling back to `OTEL_DEPLOYMENT_ENVIRONMENT`) — the
  * same single, env-driven knob the edge honours, which the correlated-trace
- * harness (`scripts/emit-correlated-trace.mts`) uses to stamp `test`.
+ * harness (`scripts/telemetry/emit-correlated-trace.mts`) uses to stamp `test`.
  * @param {object} [env]  defaults to process.env
  */
 export function resolveDeploymentEnvironment(env = process.env) {