[scottlovegrove]

Short description

The package moves from @doist/comms-cli to @todoist/comms-cli. The existing release workflow publishes it via OIDC trusted publishing, so merging this releases 5.0.0 under the new name. It's a major version because anyone depending on the package has to switch their dependency and imports to @todoist/comms-cli, and anyone with the CLI installed globally has to uninstall @doist/comms-cli before installing the new one, since both install tdc. The old @doist/comms-cli package stays on npm for now and will be deprecated pointing at the new one.

Before merging: @todoist/comms-cli has to exist on npm with a trusted publisher pointing at this repo's release.yml. When this PR was opened, the registry returned 404 for @todoist/comms-cli, so the release would fail to publish if this merged first.

This is a plain rename. It supersedes the npm scope part of #116 and leaves its release redesign and comms-sdk 4 upgrade out.

• Package: package.json and package-lock.json now name @todoist/comms-cli. The version stays 4.1.3, and the feat!: commit makes semantic-release cut 5.0.0.
• cli-core: @doist/cli-core 1.10.0 is replaced by @todoist/cli-core 2.0.0, pinned exactly as before. It's the same code as @doist/cli-core 1.10.x, and the major is only the rename. Every import, subpath import (/auth, /commands, /testing, …), vi.mock and type import moves to the new name, as does the server.deps.inline entry in vitest.config.ts. The lockfile was regenerated with npm install --package-lock-only --ignore-scripts. Apart from the rename, the only change is that cli-core's optional @napi-rs/keyring dependency is now hoisted to the top-level node_modules, at the same versions and integrity hashes. Swapping the scope changed the import order in one file, so the changed files were formatted with the pinned oxfmt 0.72.0.
• Release workflow: the setup-node scope is now @todoist. Nothing else in release.yml changes.
• Docs: the README install and uninstall commands, the @next install in CONTRIBUTING, docs/SPEC.md, and the cli-core mentions in AGENTS.md, CODEBASE.md and the agent checks and skills. The README now says the package was previously published as @doist/comms-cli and that the old package needs to be uninstalled first, because both install tdc.
• Update checks: tdc update and the doctor update check read the package name from package.json at runtime, so they now check @todoist/comms-cli without any code changes.

These are left as they are:

• @doist/comms-sdk 3.11.0 and its imports. @todoist/comms-sdk is now 5.0.0 (the 4.x API line), a major version ahead of what this CLI uses, so it moves separately. The same goes for the update-comms-sdk workflow.
• The OAuth client identity: oauth/client-metadata.json and OAUTH_CLIENT_ID / LOGO_URI in src/lib/auth-constants.ts, along with their tests. Todoist binds tokens to these raw.githubusercontent.com/Doist/comms-cli/... URLs, which aren't package names.
• The tdc binary, the comms-cli skill name, the config path, and the DOIST_* secrets.
• CHANGELOG.md history and LICENSE.

[doistbot]

This PR updates feat!: publish as @todoist/comms-cli. No issues were flagged in the reviewed diff.

_{Share Feedback • Review Logs}

[doist-release-bot]

🎉 This PR is included in version 5.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀