create-rakomi-app 0.1.0 → 0.1.2

package/README.md

@@ -3,6 +3,8 @@
 Scaffold a [Rakomi](https://rakomi.com) quickstart app in seconds. Rakomi is EU-native
 authentication as a service.
 
+## Getting started
+
 ```sh
 npx create-rakomi-app@latest --template nextjs my-app
 ```
@@ -17,7 +19,7 @@ npm create @rakomi/rakomi-app@latest -- --template nextjs my-app
 > scoped package from the bare name. Use one of the two forms above. (An unscoped alias may be
 > offered in the future.)
 
-## Templates
+## Usage
 
 | Slug     | Description       |
 | -------- | ----------------- |
@@ -26,57 +28,40 @@ npm create @rakomi/rakomi-app@latest -- --template nextjs my-app
 | `node`   | Node quickstart    |
 | `expo`   | Expo quickstart    |
 
-The template list is **not** hardcoded — it is generated from a shared quickstart registry that is
-the single source of truth. Adding a quickstart there makes it available here automatically.
-
-## Options
-
-| Option                    | Meaning                                                    |
-| ------------------------- | --------------------------------------------------------- |
-| `--template <slug>`       | which quickstart to scaffold (required)                   |
-| `--region <value>`        | data region (default: `eu-central`)                       |
-| `--tenant-id <value>`     | your tenant id                                            |
-| `--template-source <url>` | override the archive base (mirror / offline)             |
-| `--yes`                   | accept defaults, never prompt (non-interactive)           |
-| `-h`, `--help`            | show help                                                 |
-| `-V`, `--version`         | print the version                                         |
+| Option                    | Meaning                                          |
+| ------------------------- | ------------------------------------------------- |
+| `--template <slug>`       | which quickstart to scaffold (required)            |
+| `--region <value>`        | data region (default: `eu-central`)                |
+| `--tenant-id <value>`     | your tenant id                                     |
+| `--template-source <url>` | override the archive base (mirror / offline)       |
+| `--yes`                   | accept defaults, never prompt (non-interactive)    |
+| `-h`, `--help`            | show help                                          |
+| `-V`, `--version`         | print the version                                  |
 
 The CLI prompts for `RAKOMI_REGION`, `RAKOMI_TENANT_ID`, and `RAKOMI_API_KEY` and writes them to a
 local `.env` in the new project. Value precedence is: flag > environment variable > prompt >
 default. In a non-interactive context (a pipe, a continuous-integration job, or `--yes`) it never
 blocks — it uses flags / environment values / defaults and leaves the rest for you to fill in.
 
-The `RAKOMI_API_KEY` is a credential: it is read only from the prompt or the environment (never a
-command-line flag, which would persist in shell history), is written only to your local `.env`, is
-never printed back, and the new project's `.gitignore` is updated so you do not commit it.
-
-### EU-region default
-
 `RAKOMI_REGION` defaults to `eu-central` — a visible data-residency stance, not a mandate. Override
 it with `--region` or the `RAKOMI_REGION` environment variable for any other region.
 
-## Intentional choices
+## Caveats
 
+- **`RAKOMI_API_KEY` is a credential.** It is read only from the prompt or the environment (never a
+  command-line flag, which would persist in shell history), is written only to your local `.env`,
+  is never printed back, and the new project's `.gitignore` is updated so you do not commit it.
 - **No telemetry.** The CLI collects nothing and phones home about nothing. There is no usage
   analytics and nothing to opt out of.
 - **Refuses to overwrite.** Scaffolding into a directory that already contains files is refused
   outright — your existing work is never clobbered. Pick a fresh directory name.
 - **Scoped package name.** The published name is scoped, which is why the bare `npm create
   rakomi-app` form does not resolve; use the two supported invocations above.
-
-## Data handling
-
-This tool **stores nothing and transmits nothing**. The only data involved is the values you type,
-written to your own local `.env` file on your own machine — exporting or deleting that data is
-simply reading or removing that file. Adoption is observable only through public package-registry
-download counts, which are first-party to the registry, not to this tool.
-
-## Continuity
-
-The package, its publishing credentials, and the shared template registry are company-held with a
-two-person backup, and the package is published by the release pipeline. The pipeline performs the
-public release once the public package registry serves the Rakomi SDK and the template repositories
-are public.
+- **Stores and transmits nothing else.** The only data involved is the values you type, written to
+  your own local `.env` file on your own machine — exporting or deleting that data is simply
+  reading or removing that file.
+- The template list above is generated from a shared quickstart registry; a new quickstart becomes
+  available here automatically once it is published.
 
 ## License
 

package/SECURITY.md

@@ -0,0 +1,206 @@
+# Security Policy
+
+## Supported Versions
+
+This policy covers the four JS-family SDK packages: `@rakomi/node`, `@rakomi/sdk-core`,
+`@rakomi/react`, and `@rakomi/react-native`.
+
+While these packages remain pre-1.0 (`0.x`), they carry **no stability or support guarantee**
+(SemVer 2.0.0 §4); the latest `0.x` line receives security updates on a best-effort basis.
+
+From version **1.0** onward, Rakomi maintains the current (N) and previous (N-1) MAJOR in parallel, with N-1 receiving
+security-only fixes. The CRA support period for each MAJOR is determined in accordance with
+**CRA Art. 13(8)** — at least five years, or the product's expected use time where shorter. The authoritative, machine-readable support windows are published at
+[`https://api.rakomi.com/.well-known/sdk-support.json`](https://api.rakomi.com/.well-known/sdk-support.json)
+and rendered for humans on the [SDK Support & Lifecycle page](https://rakomi.com/sdk-support). This
+document points at that single source rather than re-typing dated rows.
+
+Vulnerabilities in peer dependencies (e.g., React) are out of Rakomi's direct scope, but Rakomi will update minimum peer dependency versions when a peer dependency has a known critical CVE affecting SDK users.
+
+## Reporting a Vulnerability
+
+**Please do NOT open a public GitHub issue for security vulnerabilities.**
+
+We support two reporting channels:
+
+1. **Email:** security@rakomi.com (preferred for initial contact)
+2. **GitHub Private Vulnerability Reporting:** [Submit via GitHub Security](https://github.com/rakomidev/rakomi-js/security/advisories/new) — each report automatically receives a GHSA tracking identifier (GHSA-xxxx-xxxx-xxxx).
+
+For encrypted communication, a PGP public key is available at:
+`https://rakomi.com/rakomi-security-pgp-key.asc`
+
+Include the key fingerprint from this file (section 14) for out-of-band verification when sending encrypted reports.
+
+## Response Targets
+
+We strive to meet these response targets. Actual response times may vary based on issue complexity and team availability.
+
+| Severity | First Response | Fix Target | Disclosure |
+|----------|---------------|------------|------------|
+| Critical (actively exploited) | without undue delay (target: 24h) | 72h patch/mitigation | Designated EU authority notified within 24h (CRA Art. 14) |
+| High | without undue delay (target: 48h) | 14 days | Coordinated after fix |
+| Medium | 5 business days | 90 days | Coordinated after fix |
+| Low | 5 business days | Next release cycle | Changelog note |
+
+Severity is assessed using industry-standard vulnerability scoring criteria.
+
+Rakomi is maintained by a small team. During periods of reduced availability, the auto-reply from security@rakomi.com will confirm receipt and provide the PGP key. For actively exploited vulnerabilities, we will respond as quickly as humanly possible.
+
+## Coordinated Vulnerability Disclosure (CVD) Policy
+
+We follow a coordinated disclosure model with a **90-day embargo** period from the date of acknowledgment. During this time:
+
+- Rakomi will work to develop and release a fix
+- We will keep the reporter updated on progress at least every 7 business days for Critical/High severity issues
+- We will notify the reporter when a fix is released
+- After 90 days, we will publish a security advisory regardless of fix status
+
+We may request an extension if the fix requires significant infrastructure changes, and we will coordinate with the reporter before any deadline extension.
+
+## Safe Harbor
+
+We will not pursue legal action against researchers who follow this disclosure policy and act in good faith. We consider security research conducted in accordance with this policy to be:
+- Conducted lawfully and in good faith under applicable EU law
+- Not subject to legal action by CRE8EVE Sp. z o.o.
+
+Safe harbor **does not extend to**:
+- Accessing or modifying other users' data
+- Performing denial of service attacks
+- Social engineering employees or users
+- Exfiltrating data beyond what is necessary to demonstrate the vulnerability
+- Any activity that violates applicable law
+
+## Scope
+
+**In scope:**
+- `@rakomi/node`, `@rakomi/sdk-core`, `@rakomi/react`, and `@rakomi/react-native` SDK source code and published npm packages
+- Security properties of API interactions initiated by the SDKs (request signing, token verification, credential handling)
+- Authentication flow logic within the SDKs
+
+**Out of scope:**
+- Social engineering attacks against Rakomi employees or users
+- Denial of service attacks
+- Physical security
+- Vulnerabilities in third-party services used by Rakomi's backend
+- Vulnerabilities in peer dependencies (e.g., React) — reported to the relevant maintainer, but Rakomi will update minimum peer dependency versions when a peer dependency has a known critical CVE affecting SDK users
+
+This policy applies to the official `@rakomi/node`, `@rakomi/sdk-core`, `@rakomi/react`, and `@rakomi/react-native` packages distributed via npmjs.com. Forks and derivatives are maintained by their respective authors. Customers in regulated sectors (healthcare, finance) may have additional notification obligations beyond this general policy — contact security@rakomi.com for sector-specific compliance documentation.
+
+## EU Authority Reporting
+
+It is our **policy** to report actively exploited vulnerabilities and severe security incidents
+having an impact on the security of our products to the relevant EU authority in accordance with
+**CRA Art. 14**, on the statutory timeline: an early warning, followed by a fuller notification, and
+a final report.
+
+We report to the national coordinator CSIRT designated for our Member State of main establishment
+(Poland), which is our live reporting channel today; onboarding to the EU single reporting platform
+is in progress, and that platform is the documented onward path as it becomes available to
+manufacturers.
+
+## Security Update Notifications
+
+Consumers of Rakomi SDKs can receive security update notifications through:
+- **GitHub Security Advisories** on this repository (subscribe via GitHub "Watch" → "Security alerts")
+- **npm audit:** `npm audit` or `pnpm audit` will flag known vulnerabilities in installed versions
+
+In accordance with CRA Art. 14(8), after becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of our products, we will inform impacted users (and, where appropriate, all users) — together with any available risk-mitigation or corrective measures — through the above channels.
+
+## Manufacturer Identification
+
+**Legal entity:** CRE8EVE Sp. z o.o.
+**Registered address:** Tulipanowa 4, 72-003 Dobra, Poland (EU)
+**Contact:** security@rakomi.com (role-based — no personal mailbox or phone is published)
+**Products covered:** `@rakomi/node`, `@rakomi/sdk-core`, `@rakomi/react`, `@rakomi/react-native` (published on npmjs.com)
+
+The manufacturer is itself EU-established (Poland), so no CRA Art. 18 Authorised Representative is required (Art. 18 applies to manufacturers established outside the Union). CRA conformity assessment (Art. 32): these are Class I important products (Annex III). The internal-control procedure (Annex VIII, Module A — manufacturer self-assessment, no notified-body involvement) is available for a Class I product **only where harmonised standards, common specifications, or a European cybersecurity certification scheme at assurance level at least 'substantial' are applied in full** (Art. 32(2)); otherwise a third-party route — EU-type examination plus conformity to type (modules B+C), or full quality assurance (module H) — is required. The applicable route will be confirmed against the harmonised standards in force at the CRA application date. The EU Declaration of Conformity and CE marking attach at the CRA application date (Dec 2027) and are not yet issued. See the full manufacturer record at https://docs.rakomi.dev/compliance/manufacturer/.
+
+## Export Control / Cryptography Notice
+
+The four `@rakomi/*` SDK packages incorporate and invoke cryptography — they verify asymmetric
+digital signatures (JWT/token verification), compare key material in constant time, and rely on the
+host platform's TLS for transport security. They are distributed as **publicly available, mass-market
+software** with cryptographic functionality the end user cannot readily modify.
+
+- **EU — Regulation (EU) 2021/821 (Dual-Use):** the SDKs qualify for the **mass-market** treatment
+  under the Cryptography Note (Note 3) to Category 5, Part 2 of Annex I — generally available to the
+  public, sold without restriction, and not designed for the user to alter the cryptographic
+  functionality. No export authorisation is required for their distribution within or from the EU, and —
+  unlike the US path — the EU decontrol is **self-executing**, with no notification or filing step.
+- **US — Export Administration Regulations (EAR):** the cryptographic functionality is classifiable
+  under **ECCN 5D002**. As **publicly available** open-source software the source code is **not
+  subject to the EAR** (15 CFR §734.7(a)), and the corresponding object code is distributed under the
+  mass-market provisions. The one-time email notification of the public source-code URL to the U.S.
+  BIS and NSA is filed at first public release (15 CFR §742.15(b)).
+
+This notice is provided for transparency and is **not legal advice**. Downstream redistributors are
+responsible for their own export, import, and use obligations in their jurisdiction.
+
+## Post-Market Surveillance
+
+Rakomi monitors SDK health after release through:
+- Automated dependency vulnerability scanning (npm audit, Dependabot)
+- Runtime error patterns derived from API logs (SDK version reported in User-Agent header)
+- Periodic security review of SDK code per the internal security review process
+
+This constitutes the "effective and regular tests and reviews of the security of the product with digital elements" required under CRA Annex I, Part II, point (3). The coordinated-vulnerability-disclosure policy required under CRA Annex I, Part II, point (5) is set out in the "Coordinated Vulnerability Disclosure (CVD) Policy" section above.
+
+## No Bounty Program
+
+Rakomi does not currently operate a paid bug bounty program. We deeply appreciate responsible disclosure and will acknowledge researchers in security advisories (with their consent).
+
+## Reference: security.txt
+
+This policy is referenced in our machine-readable security contact file (RFC 9116):
+`/.well-known/security.txt` — deployed at `https://rakomi.com/.well-known/security.txt`
+
+---
+
+## What to Include in Your Report
+
+*(ISO/IEC 29147:2018 §6.5)*
+
+To help us triage efficiently, please include:
+
+1. **Affected package** name and version (e.g., @rakomi/node 0.2.0)
+2. **Reproduction steps** — a minimal, reproducible example
+3. **Impact assessment** — what an attacker could achieve
+4. **Proof of concept** — if available (do not use real user data)
+5. **Reporter contact** — so we can keep you updated
+
+Reports that do not include reproduction steps or fall outside the defined scope may be closed without a tracking ID.
+
+## Report Tracking
+
+*(ISO/IEC 29147:2018 §6.6)*
+
+Each report receives a unique tracking identifier upon acknowledgment. For reports submitted via GitHub Private Vulnerability Reporting, the GHSA identifier (e.g., GHSA-xxxx-xxxx-xxxx) serves as the tracking ID. For email reports, we will direct you to also submit via GitHub PVR for formal tracking.
+
+## Status Updates
+
+*(ISO/IEC 29147:2018 §6.4)*
+
+We provide status updates at least every **7 business days** for Critical/High severity issues, and upon resolution for Medium/Low severity issues.
+
+## CVE Assignment
+
+Confirmed vulnerabilities with sufficient impact will receive CVE identifiers via GitHub's CNA (CVE Numbering Authority) program.
+
+## Reporter Data Privacy
+
+*(GDPR Art. 6(1)(f) + Art. 13/14)*
+
+Reporter personal data (name, email) is processed under GDPR Art. 6(1)(f) legitimate interest for vulnerability coordination. This data is:
+- Retained for the duration of the vulnerability lifecycle plus 2 years
+- Not shared with third parties except as required for CVE assignment or regulatory reporting (e.g., ENISA, national CSIRT)
+- Accessible to the reporter upon request (GDPR Art. 15)
+- Deletable upon request after vulnerability closure (GDPR Art. 17, where not overridden by regulatory retention obligations)
+
+To exercise your GDPR rights, contact security@rakomi.com.
+
+## PGP Key Fingerprint
+
+The PGP public key for encrypted communication is available at:
+`https://rakomi.com/rakomi-security-pgp-key.asc`
+
+Verify the key fingerprint through an independent channel (e.g., LinkedIn, Twitter/X, or a direct phone call) before sending sensitive information.

package/dist/env.js

@@ -7,8 +7,6 @@ export const ENV_KEYS = ['RAKOMI_REGION', 'RAKOMI_TENANT_ID', 'RAKOMI_API_KEY'];
 export const DEFAULT_REGION = 'eu-central';
 /** Keys whose value is a credential and must never be echoed to stdout / logs / summaries. */
 export const SECRET_KEYS = new Set(['RAKOMI_API_KEY']);
-// Matches every ASCII control character (0x00-0x1F and 0x7F), including CR and LF.
-// eslint-disable-next-line no-control-regex -- deliberately strips ALL control chars from values
 const CONTROL_CHARS = /[\u0000-\u001F\u007F]/g;
 /**
  * Serialise a single `KEY=value` line in canonical dotenv form:

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // SPDX-License-Identifier: MIT
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from 'node:fs';
 import { appendFile, readFile } from 'node:fs/promises';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import process from 'node:process';
@@ -30,7 +30,6 @@ export async function run(args, deps) {
             deps.stderr.write(`${e.message}\n`);
             return e.exitCode;
         }
-        // Unknown error — never leak a stack trace, path, or version.
         deps.stderr.write('An unexpected error occurred.\n');
         return EXIT.FAIL;
     }
@@ -48,6 +47,7 @@ async function dispatch(args, deps) {
                 'tenant-id': { type: 'string' },
                 'template-source': { type: 'string' },
                 yes: { type: 'boolean' },
+                connect: { type: 'boolean' },
                 help: { type: 'boolean', short: 'h' },
                 version: { type: 'boolean', short: 'V' },
             },
@@ -58,12 +58,10 @@ async function dispatch(args, deps) {
     catch {
         throw new UsageError('Unknown or malformed argument.');
     }
-    // --help / -h / bare invocation → usage to stdout, exit 0.
     if (values.help === true || args.length === 0) {
         deps.stdout.write(helpText());
         return EXIT.OK;
     }
-    // --version / -V → version to stdout, exit 0.
     if (values.version === true) {
         deps.stdout.write(`${deps.version}\n`);
         return EXIT.OK;
@@ -72,7 +70,6 @@ async function dispatch(args, deps) {
     if (!slug) {
         throw new UsageError(`Missing --template. Valid templates: ${slugList()}.`);
     }
-    // Allow-list membership check — the slug is never sanitised or used in a path/URL before this.
     const template = findTemplate(slug);
     if (!template) {
         throw new UsageError(`Unknown template "${slug}". Valid templates: ${slugList()}.`);
@@ -80,7 +77,6 @@ async function dispatch(args, deps) {
     const rawTarget = positionals[0] ?? template.slug;
     const targetDir = resolveTarget(rawTarget, deps.cwd);
     await assertTargetWritable(targetDir);
-    // Resolve env values by precedence: flag > env var > prompt > default.
     const flags = {};
     if (typeof values.region === 'string')
         flags.RAKOMI_REGION = values.region;
@@ -88,19 +84,28 @@ async function dispatch(args, deps) {
         flags.RAKOMI_TENANT_ID = values['tenant-id'];
     const interactive = deps.isTTY && values.yes !== true && !deps.env.CI;
     const envValues = await collectEnv({ flags, env: deps.env, interactive, ask: deps.ask });
-    // Fetch + extract the template (safe, atomic) then write the local .env.
     const source = deps.source ?? makeDefaultSource(values, deps.env);
     const archive = await source.fetchArchive(template);
     await materializeArchive(archive, targetDir);
-    // Git-ignore `.env` BEFORE writing the secret, so a failure between the two steps never leaves an
-    // un-ignored secret on disk. The two calls touch independent files (.gitignore vs .env), so the
-    // order is otherwise free.
     await ensureEnvIgnored(targetDir);
     await writeEnvFile(targetDir, envValues);
     const pm = detectPackageManager(deps.env.npm_config_user_agent);
     deps.stdout.write(postInstallMessage(template.slug, rawTarget, pm));
+    if (values.connect === true) {
+        deps.stdout.write(connectInstructions());
+    }
     return EXIT.OK;
 }
+/** `--connect` next-step copy: how to connect an AI agent once the scaffolded app is set up. */
+export function connectInstructions() {
+    return [
+        '',
+        'Connect an AI agent (Claude Code, Claude Desktop) to this tenant:',
+        '  npx rakomi login',
+        '  npx rakomi connect',
+        '',
+    ].join('\n');
+}
 function makeDefaultSource(values, env) {
     const base = (typeof values['template-source'] === 'string' ? values['template-source'] : undefined) ??
         env.CREATE_RAKOMI_TEMPLATE_BASE;
@@ -119,8 +124,13 @@ function resolveTarget(raw, cwd) {
 async function ensureEnvIgnored(targetDir) {
     const gitignore = join(targetDir, '.gitignore');
     let content = '';
-    if (existsSync(gitignore))
+    try {
         content = await readFile(gitignore, 'utf8');
+    }
+    catch (err) {
+        if (err.code !== 'ENOENT')
+            throw err;
+    }
     const alreadyIgnored = content.split(/\r?\n/).some((line) => line.trim() === '.env');
     if (alreadyIgnored)
         return;
@@ -139,15 +149,10 @@ async function main() {
         version = String(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version);
     }
     catch {
-        // Fall back to a placeholder version rather than crash.
     }
     process.exitCode = await run(process.argv.slice(2), {
         stdout: { write: (text) => void process.stdout.write(text) },
         stderr: { write: (text) => void process.stderr.write(text) },
-        // A standalone published CLI reads the real environment at its entry point; there is no
-        // app config.ts to route through (that pattern is for the server). The whole env object is
-        // handed to the injectable `run`, which is what the test suite exercises.
-        // eslint-disable-next-line no-restricted-syntax -- CLI entry must read process.env directly
         env: process.env,
         cwd: process.cwd(),
         version,
@@ -155,6 +160,23 @@ async function main() {
         ask: createTtyAsk(),
     });
 }
-if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+/**
+ * Whether this module is the process entry point. npm/npx invoke the bin through a symlink in
+ * `node_modules/.bin`, and `pathToFileURL` does not resolve symlinks — comparing against the raw
+ * `argv[1]` is false under npx, so the CLI exits 0 having done nothing. Resolve the real path
+ * first; fall back to the raw path when it cannot be resolved.
+ */
+function isProcessEntry(argv1) {
+    if (!argv1)
+        return false;
+    let real = argv1;
+    try {
+        real = realpathSync(argv1);
+    }
+    catch {
+    }
+    return import.meta.url === pathToFileURL(real).href || import.meta.url === pathToFileURL(argv1).href;
+}
+if (isProcessEntry(process.argv[1])) {
     void main();
 }

package/dist/prompt.js

@@ -31,7 +31,6 @@ export async function collectEnv(deps) {
             out[field.key] = answer !== '' ? answer : (field.defaultValue ?? '');
             continue;
         }
-        // Non-interactive: use the default if any, otherwise leave the key for the user to fill.
         if (field.defaultValue !== undefined)
             out[field.key] = field.defaultValue;
     }

package/dist/source.js

@@ -5,7 +5,6 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { createGunzip } from 'node:zlib';
 import { CliError, EXIT, UsageError } from './errors.js';
 import { archiveUrl, DEFAULT_TEMPLATE_BASE } from './templates.js';
-// --- Safety caps (constants, not configurable — a hardened scaffolder, not a general extractor) ---
 /** Max compressed bytes downloaded before aborting the stream. */
 export const COMPRESSED_CAP = 50 * 1024 * 1024;
 /** Max total decompressed bytes — aborts mid-inflate to defeat a decompression bomb. */
@@ -74,7 +73,6 @@ export class GithubCodeloadSource {
                 }
                 if (e instanceof CliError)
                     throw e;
-                // An unexpected network error (reset, DNS) — retryable, user-safe message.
                 lastError = new FetchError('Network error while downloading the template.', true);
                 if (attempt < this.maxRetries) {
                     await delay(this.backoffMs * (attempt + 1));
@@ -92,7 +90,6 @@ export class GithubCodeloadSource {
             response = await this.fetchImpl(url, { redirect: 'error', signal: controller.signal });
         }
         catch {
-            // Aborted (timeout) or a transport error — both retryable.
             throw new FetchError('Timed out or failed while downloading the template.', true);
         }
         finally {
@@ -210,23 +207,20 @@ export function parseTar(buf) {
     while (offset + 512 <= buf.length) {
         const block = buf.subarray(offset, offset + 512);
         if (block.every((b) => b === 0))
-            break; // end-of-archive marker
+            break;
         const name = readCString(block, 0, 100);
         const size = parseOctal(block, 124, 12);
         const typeflag = String.fromCharCode(block[156] ?? 0);
         const prefix = readCString(block, 345, 155);
         offset += 512;
         const dataBlocks = Math.ceil(size / 512);
-        // GNU/pax metadata entries — skip their payload, materialise nothing.
         if (typeflag === 'x' || typeflag === 'g' || typeflag === 'L' || typeflag === 'K') {
             offset += dataBlocks * 512;
             continue;
         }
-        // Reject symlink / hardlink (CWE-59) — independent of the traversal check below.
         if (typeflag === '1' || typeflag === '2') {
             throw new CliError('The template archive contains a link entry; refusing for safety.', EXIT.FAIL);
         }
-        // Reject character/block device and FIFO entries.
         if (typeflag === '3' || typeflag === '4' || typeflag === '6') {
             throw new CliError('The template archive contains a special-file entry; refusing for safety.', EXIT.FAIL);
         }
@@ -241,7 +235,6 @@ export function parseTar(buf) {
             entries.push({ type: 'dir', path: fullName });
         }
         else {
-            // '0' or NUL typeflag → regular file.
             entries.push({ type: 'file', path: fullName, data: Buffer.from(buf.subarray(offset, offset + size)) });
         }
         offset += dataBlocks * 512;
@@ -267,7 +260,6 @@ export async function materializeArchive(gzipBytes, targetDir) {
     if (entries.length === 0) {
         throw new CliError('The template archive is empty; refusing.', EXIT.FAIL);
     }
-    // The codeload tarball wraps everything in a single leading `<repo>-<sha>/` dir.
     const wrapper = normalizeEntryPath(entries[0].path).split('/')[0] ?? '';
     const target = resolve(targetDir);
     const parent = dirname(target);
@@ -276,14 +268,12 @@ export async function materializeArchive(gzipBytes, targetDir) {
     try {
         for (const entry of entries) {
             const norm = normalizeEntryPath(entry.path);
-            // Every entry must live under the detected wrapper dir; anything else is an escape attempt
-            // (absolute path, sibling-of-wrapper, escape-after-strip-1).
             if (norm !== wrapper && !norm.startsWith(`${wrapper}/`)) {
                 throw new CliError('A template archive entry escapes the template root; refusing.', EXIT.FAIL);
             }
             const stripped = norm === wrapper ? '' : norm.slice(wrapper.length + 1);
             if (stripped === '')
-                continue; // the wrapper dir itself
+                continue;
             const dest = resolve(tmpDir, stripped);
             const rel = relative(tmpDir, dest);
             if (rel === '' || rel.startsWith('..') || isAbsolute(rel)) {
@@ -305,7 +295,6 @@ export async function materializeArchive(gzipBytes, targetDir) {
     }
 }
 async function moveIntoPlace(tmpDir, target) {
-    // The clobber check guarantees `target` is empty or absent before we get here.
     if (existsSync(target)) {
         await rmdir(target);
     }

package/dist/templates.generated.js

@@ -1,8 +1,4 @@
 // SPDX-License-Identifier: MIT
-//
-// GENERATED FILE — do not edit by hand. Regenerate with `node scripts/gen-templates.mjs`
-// (runs automatically on build/typecheck). The data mirrors the shared quickstart manifest;
-// the parity test asserts they stay in sync.
 /** The full set of templates, in manifest order. */
 export const TEMPLATES = [
     { slug: "nextjs", label: "Next.js quickstart", publicRepo: "rakomidev/rakomi-nextjs-quickstart" },

package/dist/templates.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
 import { TEMPLATES } from './templates.generated.js';
 /** The public portal host where each quickstart's walkthrough lives (post-install URL). */
-export const PORTAL_HOST = 'examples.rakomi.com';
+export const PORTAL_HOST = 'examples.rakomi.dev';
 /**
  * The default base for fetching template archives. Overridable at runtime via
  * `--template-source` / `CREATE_RAKOMI_TEMPLATE_BASE` (mirror, offline, or emergency
@@ -39,6 +39,9 @@ export function portalUrl(slug) {
  * Pinned to the `main` branch ref (a future enhancement could pin a tagged ref per template).
  */
 export function archiveUrl(template, base = DEFAULT_TEMPLATE_BASE) {
-    const trimmed = base.replace(/\/+$/, '');
+    let end = base.length;
+    while (end > 0 && base.charCodeAt(end - 1) === 47)
+        end -= 1;
+    const trimmed = base.slice(0, end);
     return `${trimmed}/${template.publicRepo}/tar.gz/refs/heads/main`;
 }

package/dist/usage.js

@@ -38,6 +38,7 @@ export function helpText() {
         '  --tenant-id <value>      your tenant id',
         '  --template-source <url>  override the archive base (mirror / offline)',
         '  --yes                    accept defaults, never prompt (non-interactive)',
+        '  --connect                print next steps for connecting an AI agent (the rakomi CLI)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-rakomi-app",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Scaffold a Rakomi quickstart app. EU-native auth-as-a-service. npx create-rakomi-app --template <slug>",
   "keywords": [
     "rakomi",
@@ -35,16 +35,13 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md",
+    "sbom.cdx.json"
   ],
-  "devDependencies": {
-    "@types/node": "22.19.13",
-    "typescript": "5.9.3",
-    "vitest": "4.0.18"
-  },
   "scripts": {
-    "build": "node scripts/gen-templates.mjs && tsc",
-    "typecheck": "node scripts/gen-templates.mjs && tsc --noEmit",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
     "lint": "eslint src/ test/ --max-warnings=0",
     "test": "vitest run"
   }

package/sbom.cdx.json

@@ -0,0 +1,43 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.6",
+  "version": 1,
+  "metadata": {
+    "supplier": {
+      "name": "CRE8EVE Sp. z o.o.",
+      "url": [
+        "https://rakomi.com"
+      ]
+    },
+    "authors": [
+      {
+        "name": "CRE8EVE Sp. z o.o."
+      }
+    ],
+    "tools": {
+      "components": [
+        {
+          "type": "application",
+          "group": "rakomi",
+          "name": "generate-sbom",
+          "version": "sha256:ffabbf3f1638"
+        }
+      ]
+    },
+    "component": {
+      "type": "library",
+      "bom-ref": "pkg:npm/create-rakomi-app@0.1.2",
+      "name": "create-rakomi-app",
+      "version": "0.1.2",
+      "purl": "pkg:npm/create-rakomi-app@0.1.2",
+      "licenses": [
+        {
+          "license": {
+            "name": "NOASSERTION"
+          }
+        }
+      ]
+    }
+  },
+  "components": []
+}