rakomi 0.0.1 → 0.1.0

package/dist/index.js

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { delimiter, join } from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { systemBrowserOpener } from './browser.js';
+import { runConnect } from './commands/connect.js';
+import { runLogin } from './commands/login.js';
+import { runLogout } from './commands/logout.js';
+import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runWhoami } from './commands/whoami.js';
+import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
+import { CliError, EXIT, UsageError } from './errors.js';
+import { startLoopbackListener } from './loopback-server.js';
+import { resolveStores } from './session.js';
+import { helpText, usageLine } from './usage.js';
+const GLOBAL_OPTIONS = {
+    json: { type: 'boolean' },
+    yes: { type: 'boolean' },
+    ci: { type: 'boolean' },
+    'dry-run': { type: 'boolean' },
+    'no-browser': { type: 'boolean' },
+    'no-keychain': { type: 'boolean' },
+    client: { type: 'string' },
+    undo: { type: 'boolean' },
+    write: { type: 'boolean' },
+    owner: { type: 'string' },
+    slug: { type: 'string' },
+    'cimd-url': { type: 'string' },
+    status: { type: 'boolean' },
+    help: { type: 'boolean', short: 'h' },
+    version: { type: 'boolean', short: 'V' },
+};
+export async function run(args, deps) {
+    try {
+        return await dispatch(args, deps);
+    }
+    catch (e) {
+        if (e instanceof UsageError) {
+            deps.stderr.write(`${e.message}\n${usageLine()}\n`);
+            return e.exitCode;
+        }
+        if (e instanceof CliError) {
+            deps.stderr.write(`${e.message}\n`);
+            return e.exitCode;
+        }
+        deps.stderr.write('An unexpected error occurred.\n');
+        return EXIT.FAIL;
+    }
+}
+async function dispatch(args, deps) {
+    let values;
+    let positionals;
+    try {
+        const parsed = parseArgs({ args: [...args], allowPositionals: true, options: GLOBAL_OPTIONS });
+        values = parsed.values;
+        positionals = parsed.positionals;
+    }
+    catch {
+        throw new UsageError('Unknown or malformed argument.');
+    }
+    if (values.help === true || args.length === 0) {
+        deps.stdout.write(helpText());
+        return EXIT.OK;
+    }
+    if (values.version === true) {
+        deps.stdout.write(`${deps.version}\n`);
+        return EXIT.OK;
+    }
+    const ci = values.ci === true || values.yes === true || Boolean(deps.env.CI);
+    const dryRun = values['dry-run'] === true;
+    const json = values.json === true;
+    const httpDeps = { fetchImpl: deps.fetchImpl };
+    const [command, ...rest] = positionals;
+    switch (command) {
+        case 'login':
+            await runLogin({
+                ...httpDeps,
+                env: deps.env,
+                session: deps.session,
+                noBrowser: values['no-browser'] === true || ci,
+                openBrowser: systemBrowserOpener(),
+                startLoopback: startLoopbackListener,
+                sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+                stdout: deps.stdout,
+                now: () => Date.now(),
+            });
+            return EXIT.OK;
+        case 'logout':
+            runLogout({ session: deps.session, stdout: deps.stdout });
+            return EXIT.OK;
+        case 'whoami':
+            await runWhoami({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+            return EXIT.OK;
+        case 'connect':
+            await runConnect({
+                ...httpDeps,
+                session: deps.session,
+                cwd: deps.cwd,
+                apiBaseUrl: apiBaseUrl(deps.env),
+                mcpUrl: deps.env.RAKOMI_API_URL ? `${apiBaseUrl(deps.env)}/mcp` : DEFAULT_MCP_URL,
+                detectClaudeCode: deps.detectClaudeCode,
+                stdout: deps.stdout,
+                write: values.write === true,
+                dryRun,
+                ci,
+                undo: values.undo === true,
+                explicitClient: typeof values.client === 'string' ? values.client : undefined,
+                cimdUrl: typeof values['cimd-url'] === 'string' ? values['cimd-url'] : undefined,
+                status: values.status === true,
+            });
+            return EXIT.OK;
+        case 'tenants': {
+            const [sub, ...tenantArgs] = rest;
+            if (sub === 'create') {
+                const name = tenantArgs[0];
+                if (!name)
+                    throw new UsageError('Usage: rakomi tenants create <name> [--owner me|<email>] [--slug <slug>]');
+                await runTenantsCreate({ ...httpDeps, session: deps.session, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
+                return EXIT.OK;
+            }
+            if (sub === 'list') {
+                await runTenantsList({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+                return EXIT.OK;
+            }
+            throw new UsageError('Usage: rakomi tenants <create|list> ...');
+        }
+        default:
+            throw new UsageError(`Unknown command "${command ?? ''}".`);
+    }
+}
+async function main() {
+    const major = Number(process.versions.node.split('.')[0]);
+    if (Number.isFinite(major) && major < 22) {
+        process.stderr.write('rakomi needs Node.js 22 or newer.\n');
+        process.exitCode = EXIT.FAIL;
+        return;
+    }
+    let version = '0.0.0';
+    try {
+        version = String(JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version);
+    }
+    catch {
+    }
+    const env = {
+        RAKOMI_API_URL: process.env.RAKOMI_API_URL,
+        RAKOMI_ACCOUNTS_URL: process.env.RAKOMI_ACCOUNTS_URL,
+        RAKOMI_CLIENT_ID: process.env.RAKOMI_CLIENT_ID,
+        RAKOMI_CONFIG_DIR: process.env.RAKOMI_CONFIG_DIR,
+        CI: process.env.CI,
+        NO_COLOR: process.env.NO_COLOR,
+    };
+    const noKeychainEnv = process.env.RAKOMI_NO_KEYCHAIN;
+    const noKeychainFlag = process.argv.slice(2).includes('--no-keychain');
+    const resolved = resolveStores(env, { noKeychain: noKeychainFlag || Boolean(env.CI) || Boolean(noKeychainEnv) });
+    if (resolved.fallbackDisclosure) {
+        process.stderr.write(resolved.fallbackDisclosure + '\n');
+    }
+    process.exitCode = await run(process.argv.slice(2), {
+        stdout: { write: (text) => void process.stdout.write(text) },
+        stderr: { write: (text) => void process.stderr.write(text) },
+        env,
+        cwd: process.cwd(),
+        version,
+        isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+        fetchImpl: fetch,
+        session: resolved.session,
+        detectClaudeCode: () => detectClaudeCodeCli(),
+    });
+}
+function detectClaudeCodeCli() {
+    const pathEnv = process.env.PATH ?? '';
+    const binaryName = process.platform === 'win32' ? 'claude.cmd' : 'claude';
+    return pathEnv.split(delimiter).some((dir) => dir.length > 0 && existsSync(join(dir, binaryName)));
+}
+function isCliEntry() {
+    const argv1 = process.argv[1];
+    if (!argv1)
+        return false;
+    const real = (p) => {
+        try {
+            return realpathSync(p);
+        }
+        catch {
+            return p;
+        }
+    };
+    try {
+        return real(argv1) === real(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return false;
+    }
+}
+if (isCliEntry()) {
+    void main();
+}

package/dist/loopback-server.js

@@ -0,0 +1,63 @@
+import { createServer } from 'node:http';
+import { CliError, EXIT } from './errors.js';
+const SUCCESS_PAGE = `<!doctype html><html><head><title>rakomi login</title></head>
+<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;text-align:center">
+<h1>Signed in</h1><p>You can close this tab and return to your terminal.</p></body></html>`;
+const ERROR_PAGE = (message) => `<!doctype html><html><head><title>rakomi login</title></head>
+<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;text-align:center">
+<h1>Sign-in failed</h1><p>${escapeHtml(message)}</p><p>Return to your terminal and try again.</p></body></html>`;
+function escapeHtml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+}
+export async function startLoopbackListener() {
+    let resolveCallback;
+    let rejectCallback;
+    let settled = false;
+    const server = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== '/callback') {
+            res.writeHead(404).end();
+            return;
+        }
+        const code = url.searchParams.get('code') ?? undefined;
+        const state = url.searchParams.get('state') ?? undefined;
+        const error = url.searchParams.get('error') ?? undefined;
+        const errorDescription = url.searchParams.get('error_description') ?? undefined;
+        res.writeHead(error ? 400 : 200, { 'content-type': 'text/html; charset=utf-8' });
+        res.end(error ? ERROR_PAGE(errorDescription ?? error) : SUCCESS_PAGE);
+        if (!settled) {
+            settled = true;
+            resolveCallback?.({ code, state, error, errorDescription });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const address = server.address();
+    if (address === null || typeof address === 'string') {
+        server.close();
+        throw new CliError('Could not start the local sign-in listener.', EXIT.FAIL);
+    }
+    const redirectUri = `http://127.0.0.1:${address.port}/callback`;
+    return {
+        redirectUri,
+        waitForCallback(timeoutMs) {
+            return new Promise((resolve, reject) => {
+                resolveCallback = resolve;
+                rejectCallback = reject;
+                const timer = setTimeout(() => {
+                    if (!settled) {
+                        settled = true;
+                        reject(new CliError('Timed out waiting for the browser sign-in to complete.', EXIT.FAIL));
+                    }
+                }, timeoutMs);
+                timer.unref?.();
+            });
+        },
+        close() {
+            rejectCallback?.(new CliError('The local sign-in listener was closed before a callback arrived.', EXIT.FAIL));
+            server.close();
+        },
+    };
+}

package/dist/mcp-config.js

@@ -0,0 +1,76 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export const RAKOMI_SERVER_NAME = 'rakomi';
+const BACKUP_SUFFIX = '.rakomi-backup';
+function readIfPresent(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export function mcpConfigPath(projectDir) {
+    return join(projectDir, '.mcp.json');
+}
+function backupPath(configPath) {
+    return `${configPath}${BACKUP_SUFFIX}`;
+}
+function readConfig(path) {
+    const text = readIfPresent(path);
+    if (text === null)
+        return {};
+    try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed))
+            return parsed;
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+export function mergeRakomiServerEntry(config, mcpUrl) {
+    const previousEntry = config.mcpServers?.[RAKOMI_SERVER_NAME];
+    const nextEntry = { type: 'http', url: mcpUrl };
+    const alreadyIdentical = previousEntry !== undefined &&
+        typeof previousEntry === 'object' &&
+        previousEntry.type === 'http' &&
+        previousEntry.url === mcpUrl;
+    if (alreadyIdentical)
+        return { config, changed: false, previousEntry };
+    const merged = {
+        ...config,
+        mcpServers: { ...(config.mcpServers ?? {}), [RAKOMI_SERVER_NAME]: nextEntry },
+    };
+    return { config: merged, changed: true, previousEntry };
+}
+export function writeRakomiMcpServerEntry(projectDir, mcpUrl) {
+    const path = mcpConfigPath(projectDir);
+    const before = readConfig(path);
+    const { config: after, changed, previousEntry } = mergeRakomiServerEntry(before, mcpUrl);
+    if (!changed) {
+        return { wrote: false, backedUp: false, diff: `${RAKOMI_SERVER_NAME} already configured with ${mcpUrl} — no change.` };
+    }
+    let backedUp = false;
+    const existing = readIfPresent(path);
+    if (existing !== null) {
+        writeFileSync(backupPath(path), existing);
+        backedUp = true;
+    }
+    writeFileSync(path, JSON.stringify(after, null, 2) + '\n');
+    const diff = previousEntry
+        ? `mcpServers.${RAKOMI_SERVER_NAME}: ${JSON.stringify(previousEntry)} -> ${JSON.stringify(after.mcpServers?.[RAKOMI_SERVER_NAME])}`
+        : `mcpServers.${RAKOMI_SERVER_NAME}: (added) ${JSON.stringify(after.mcpServers?.[RAKOMI_SERVER_NAME])}`;
+    return { wrote: true, backedUp, diff };
+}
+export function undoMcpConfigWrite(projectDir) {
+    const path = mcpConfigPath(projectDir);
+    const backup = readIfPresent(backupPath(path));
+    if (backup === null)
+        return false;
+    writeFileSync(path, backup);
+    return true;
+}

package/dist/oauth-authcode.js

@@ -0,0 +1,30 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export function buildAuthorizeUrl(opts) {
+    const url = new URL('/authorize', opts.accountsBaseUrl);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', opts.clientId);
+    url.searchParams.set('redirect_uri', opts.redirectUri);
+    url.searchParams.set('scope', opts.scope);
+    url.searchParams.set('state', opts.pkce.state);
+    url.searchParams.set('code_challenge', opts.pkce.codeChallenge);
+    url.searchParams.set('code_challenge_method', opts.pkce.codeChallengeMethod);
+    return url.toString();
+}
+export async function exchangeAuthorizationCode(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/oauth/token`,
+        form: {
+            grant_type: 'authorization_code',
+            code: opts.code,
+            redirect_uri: opts.redirectUri,
+            client_id: opts.clientId,
+            code_verifier: opts.codeVerifier,
+        },
+    });
+    if (result.status !== 200) {
+        throw new CliError(`Could not complete sign-in: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/oauth-device.js

@@ -0,0 +1,57 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export async function requestDeviceCode(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/oauth/device/code`,
+        form: { client_id: opts.clientId, ...(opts.scope ? { scope: opts.scope } : {}) },
+    });
+    if (result.status !== 200) {
+        throw new CliError(`Could not start device sign-in: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function pollDeviceToken(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/oauth/token`,
+        form: {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: opts.deviceCode,
+            client_id: opts.clientId,
+        },
+    });
+    if (result.status === 200)
+        return { kind: 'success', token: result.body };
+    const error = result.body.error;
+    if (error === 'authorization_pending')
+        return { kind: 'pending' };
+    if (error === 'slow_down')
+        return { kind: 'slow_down' };
+    if (error === 'access_denied')
+        return { kind: 'denied' };
+    if (error === 'expired_token')
+        return { kind: 'expired' };
+    throw new CliError(`Device sign-in failed: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+}
+export async function loginWithDeviceGrant(deps, opts) {
+    const issued = await requestDeviceCode(deps, opts);
+    deps.onWaiting?.(issued);
+    let intervalMs = issued.interval * 1000;
+    const deadline = Date.now() + issued.expires_in * 1000;
+    for (;;) {
+        if (Date.now() >= deadline) {
+            throw new CliError('The device sign-in code expired before it was approved.', EXIT.FAIL);
+        }
+        await deps.sleep(intervalMs);
+        const outcome = await pollDeviceToken(deps, { apiBaseUrl: opts.apiBaseUrl, clientId: opts.clientId, deviceCode: issued.device_code });
+        if (outcome.kind === 'success')
+            return outcome.token;
+        if (outcome.kind === 'denied')
+            throw new CliError('Sign-in was denied.', EXIT.FAIL);
+        if (outcome.kind === 'expired')
+            throw new CliError('The device sign-in code expired before it was approved.', EXIT.FAIL);
+        if (outcome.kind === 'slow_down')
+            intervalMs += 5000;
+    }
+}

package/dist/pkce.js

@@ -0,0 +1,22 @@
+import { createHash, randomBytes } from 'node:crypto';
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+export function generateCodeVerifier() {
+    return base64url(randomBytes(32));
+}
+export function codeChallengeS256(codeVerifier) {
+    return base64url(createHash('sha256').update(codeVerifier, 'ascii').digest());
+}
+export function generateState() {
+    return base64url(randomBytes(16));
+}
+export function generatePkcePair() {
+    const codeVerifier = generateCodeVerifier();
+    return {
+        codeVerifier,
+        codeChallenge: codeChallengeS256(codeVerifier),
+        codeChallengeMethod: 'S256',
+        state: generateState(),
+    };
+}