rakomi 0.0.1 → 0.1.0

package/dist/session.js

@@ -0,0 +1,320 @@
+import { execFileSync } from 'node:child_process';
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+export function configDir(env) {
+    if (env.RAKOMI_CONFIG_DIR)
+        return env.RAKOMI_CONFIG_DIR;
+    return join(homedir(), '.config', 'rakomi');
+}
+function sessionFilePath(env) {
+    return join(configDir(env), 'session.json');
+}
+export class FileSessionStore {
+    path;
+    dir;
+    constructor(env) {
+        this.dir = configDir(env);
+        this.path = sessionFilePath(env);
+    }
+    read() {
+        try {
+            const raw = readFileSync(this.path, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (!isStoredSession(parsed))
+                return null;
+            return parsed;
+        }
+        catch {
+            return null;
+        }
+    }
+    write(session) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        writeFileSync(this.path, JSON.stringify(session, null, 2) + '\n', { mode: 0o600 });
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+        }
+    }
+    clear() {
+        try {
+            rmSync(this.path, { force: true });
+        }
+        catch {
+        }
+    }
+    describePath() {
+        return this.path;
+    }
+}
+export class FileKeyStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    path(name) {
+        return join(this.dir, `key-${name}.json`);
+    }
+    get(name) {
+        try {
+            return readFileSync(this.path(name), 'utf8');
+        }
+        catch {
+            return null;
+        }
+    }
+    set(name, value) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        writeFileSync(this.path(name), value, { mode: 0o600 });
+        try {
+            chmodSync(this.path(name), 0o600);
+        }
+        catch {
+        }
+    }
+    clear(name) {
+        try {
+            rmSync(this.path(name), { force: true });
+        }
+        catch {
+        }
+    }
+}
+function isStoredSession(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return (typeof v.access_token === 'string' &&
+        v.access_token.length > 0 &&
+        v.token_type === 'Bearer' &&
+        typeof v.expires_at === 'number' &&
+        typeof v.api_base_url === 'string' &&
+        typeof v.client_id === 'string');
+}
+export function isExpired(session, now) {
+    return now >= session.expires_at;
+}
+function realExecFileSync(file, args, options) {
+    return execFileSync(file, [...args], { encoding: 'utf8', input: options?.input, maxBuffer: 10 * 1024 * 1024 }).toString();
+}
+function commandExistsOnPath(binaryName, pathEnv, existsFn) {
+    return pathEnv.split(delimiter).some((dir) => dir.length > 0 && existsFn(join(dir, binaryName)));
+}
+export class MacKeychainBackend {
+    execFileSyncFn;
+    platform;
+    name = 'macos-keychain';
+    constructor(execFileSyncFn = realExecFileSync, platform = process.platform) {
+        this.execFileSyncFn = execFileSyncFn;
+        this.platform = platform;
+    }
+    isAvailable() {
+        if (this.platform !== 'darwin')
+            return false;
+        try {
+            this.execFileSyncFn('security', ['list-keychains']);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    get(service, account) {
+        try {
+            const out = this.execFileSyncFn('security', ['find-generic-password', '-a', account, '-s', service, '-w']);
+            const value = out.trim();
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    set(service, account, value) {
+        this.execFileSyncFn('security', ['add-generic-password', '-a', account, '-s', service, '-w', value, '-U']);
+    }
+    delete(service, account) {
+        try {
+            this.execFileSyncFn('security', ['delete-generic-password', '-a', account, '-s', service]);
+        }
+        catch {
+        }
+    }
+}
+export class LinuxSecretToolBackend {
+    execFileSyncFn;
+    platform;
+    pathEnv;
+    existsFn;
+    name = 'linux-secret-service';
+    constructor(execFileSyncFn = realExecFileSync, platform = process.platform, pathEnv = process.env.PATH ?? '', existsFn = existsSync) {
+        this.execFileSyncFn = execFileSyncFn;
+        this.platform = platform;
+        this.pathEnv = pathEnv;
+        this.existsFn = existsFn;
+    }
+    isAvailable() {
+        if (this.platform !== 'linux')
+            return false;
+        return commandExistsOnPath('secret-tool', this.pathEnv, this.existsFn);
+    }
+    get(service, account) {
+        try {
+            const out = this.execFileSyncFn('secret-tool', ['lookup', 'service', service, 'account', account]);
+            const value = out.replace(/\n$/, '');
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    set(service, account, value) {
+        this.execFileSyncFn('secret-tool', ['store', '--label', `Rakomi CLI (${account})`, 'service', service, 'account', account], { input: value });
+    }
+    delete(service, account) {
+        try {
+            this.execFileSyncFn('secret-tool', ['clear', 'service', service, 'account', account]);
+        }
+        catch {
+        }
+    }
+}
+export class WindowsDpapiBackend {
+    dir;
+    execFileSyncFn;
+    platform;
+    pathEnv;
+    existsFn;
+    name = 'windows-dpapi';
+    constructor(dir, execFileSyncFn = realExecFileSync, platform = process.platform, pathEnv = process.env.PATH ?? '', existsFn = existsSync) {
+        this.dir = dir;
+        this.execFileSyncFn = execFileSyncFn;
+        this.platform = platform;
+        this.pathEnv = pathEnv;
+        this.existsFn = existsFn;
+    }
+    isAvailable() {
+        if (this.platform !== 'win32')
+            return false;
+        return commandExistsOnPath('powershell.exe', this.pathEnv, this.existsFn) || commandExistsOnPath('pwsh.exe', this.pathEnv, this.existsFn);
+    }
+    filePath(service, account) {
+        return join(this.dir, `${service}.${account}.dpapi`);
+    }
+    get(service, account) {
+        let cipherB64;
+        try {
+            cipherB64 = readFileSync(this.filePath(service, account), 'utf8').trim();
+        }
+        catch {
+            return null;
+        }
+        if (cipherB64.length === 0)
+            return null;
+        try {
+            const script = `[Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([Convert]::FromBase64String('${cipherB64}'), $null, 'CurrentUser'))`;
+            const out = this.execFileSyncFn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]);
+            const value = out.trim();
+            return value.length > 0 ? value : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    set(service, account, value) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        const valueB64 = Buffer.from(value, 'utf8').toString('base64');
+        const script = `[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Convert]::FromBase64String('${valueB64}'), $null, 'CurrentUser'))`;
+        const cipherB64 = this.execFileSyncFn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]).trim();
+        writeFileSync(this.filePath(service, account), cipherB64 + '\n', { mode: 0o600 });
+    }
+    delete(service, account) {
+        try {
+            rmSync(this.filePath(service, account), { force: true });
+        }
+        catch {
+        }
+    }
+}
+const SESSION_SERVICE = 'rakomi-cli';
+const SESSION_ACCOUNT = 'session';
+const KEY_SERVICE = 'rakomi-cli-keys';
+export class KeychainSessionStore {
+    backend;
+    legacyFile;
+    constructor(backend, legacyFile) {
+        this.backend = backend;
+        this.legacyFile = legacyFile;
+    }
+    read() {
+        const raw = this.backend.get(SESSION_SERVICE, SESSION_ACCOUNT);
+        if (raw !== null) {
+            try {
+                const parsed = JSON.parse(raw);
+                return isStoredSession(parsed) ? parsed : null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const legacy = this.legacyFile.read();
+        if (!legacy)
+            return null;
+        try {
+            this.backend.set(SESSION_SERVICE, SESSION_ACCOUNT, JSON.stringify(legacy));
+            this.legacyFile.clear();
+        }
+        catch {
+        }
+        return legacy;
+    }
+    write(session) {
+        this.backend.set(SESSION_SERVICE, SESSION_ACCOUNT, JSON.stringify(session));
+    }
+    clear() {
+        this.backend.delete(SESSION_SERVICE, SESSION_ACCOUNT);
+        this.legacyFile.clear();
+    }
+    describePath() {
+        return `${this.backend.name} (service "${SESSION_SERVICE}")`;
+    }
+}
+export class KeychainKeyStore {
+    backend;
+    constructor(backend) {
+        this.backend = backend;
+    }
+    get(name) {
+        return this.backend.get(KEY_SERVICE, name);
+    }
+    set(name, value) {
+        this.backend.set(KEY_SERVICE, name, value);
+    }
+    clear(name) {
+        this.backend.delete(KEY_SERVICE, name);
+    }
+}
+const FALLBACK_DISCLOSURE = 'rakomi: no OS keychain available (or --no-keychain set) — using a local session file instead ' +
+    '(~/.config/rakomi/session.json or $RAKOMI_CONFIG_DIR, readable only by your account). ' +
+    'Run without --no-keychain on a supported OS to store it in your platform keychain instead.';
+export function resolveStores(env, opts = {}) {
+    const dir = configDir(env);
+    const fileSession = new FileSessionStore(env);
+    const fileKeys = new FileKeyStore(dir);
+    if (opts.noKeychain) {
+        return { session: fileSession, keys: fileKeys, backend: 'file', fallbackDisclosure: FALLBACK_DISCLOSURE };
+    }
+    const candidates = opts.backends ?? [new MacKeychainBackend(), new LinuxSecretToolBackend(), new WindowsDpapiBackend(dir)];
+    for (const backend of candidates) {
+        if (backend.isAvailable()) {
+            return {
+                session: new KeychainSessionStore(backend, fileSession),
+                keys: new KeychainKeyStore(backend),
+                backend: backend.name,
+                fallbackDisclosure: null,
+            };
+        }
+    }
+    return { session: fileSession, keys: fileKeys, backend: 'file', fallbackDisclosure: FALLBACK_DISCLOSURE };
+}

package/dist/tenants-client.js

@@ -0,0 +1,64 @@
+import { randomBytes } from 'node:crypto';
+import { CliError, EXIT } from './errors.js';
+import { describeError, errorCode, request } from './http.js';
+const M2M_OR_OWNER_REQUIRED_CODE = 'tenant/owner_grant_requires_m2m_caller';
+const OWNER_EMAIL_NOT_ALLOWED_CODE = 'tenant/owner_email_not_allowed_for_self_owner';
+export function generateIdempotencyKey() {
+    return randomBytes(16).toString('hex');
+}
+function describeCallerRejected(action) {
+    return (`Could not ${action}: you are signed in, but you are not a verified owner of the tenant this ` +
+        'session belongs to (and this is not a partner client_credentials token either). Ask your ' +
+        'tenant\'s owner to run this, or integrate directly against `POST/GET /v1/tenants` with your ' +
+        'own partner client_credentials.');
+}
+export async function createTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/v1/tenants`,
+        headers: { authorization: `Bearer ${opts.accessToken}` },
+        body: { name: opts.name, ...(opts.slug ? { slug: opts.slug } : {}), ...(opts.ownerEmail ? { owner_email: opts.ownerEmail } : {}) },
+        idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 400 && errorCode(result.body) === OWNER_EMAIL_NOT_ALLOWED_CODE) {
+        throw new CliError('Could not create the tenant: --owner <email> (a third-party owner) requires a partner ' +
+            'client_credentials integration — use --owner me from an interactive session.', EXIT.FAIL);
+    }
+    if (result.status === 403) {
+        if (errorCode(result.body) === M2M_OR_OWNER_REQUIRED_CODE) {
+            throw new CliError(describeCallerRejected('create the tenant'), EXIT.FAIL);
+        }
+        throw new CliError(`Could not create the tenant: ${describeError(result.body, result.status)} ` +
+            '(missing the `tenants:create` scope, or the caller tenant already has a parent — depth-1 only).', EXIT.FAIL);
+    }
+    if (result.status !== 201) {
+        throw new CliError(`Could not create the tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function listTenants(deps, opts) {
+    const url = new URL('/v1/tenants', opts.apiBaseUrl);
+    if (opts.parent)
+        url.searchParams.set('parent', opts.parent);
+    const result = await request(deps, {
+        method: 'GET',
+        url: url.toString(),
+        headers: { authorization: `Bearer ${opts.accessToken}` },
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        if (errorCode(result.body) === M2M_OR_OWNER_REQUIRED_CODE) {
+            throw new CliError(describeCallerRejected('list tenants'), EXIT.FAIL);
+        }
+        throw new CliError(`Could not list tenants: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not list tenants: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/usage.js

@@ -0,0 +1,38 @@
+export function helpText() {
+    return [
+        'rakomi — the Rakomi CLI: sign in, connect an AI agent, and provision tenants',
+        '',
+        'Usage:',
+        '  rakomi <command> [options]',
+        '',
+        'Commands:',
+        '  login                    sign in (browser by default; --no-browser for a device code)',
+        '  logout                   clear the local session',
+        '  whoami                   show the signed-in account',
+        '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
+        '    --write                also request write access for the connected client',
+        '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
+        '    --undo                 restore the .mcp.json this command last backed up',
+        '    --cimd-url <url>       the connecting client\'s own CIMD document URL — confirms the connection',
+        '    --status               re-check status only (needs --cimd-url; never rewrites .mcp.json)',
+        '  tenants create <name>    create a tenant (parent-tenant only; depth-1 enforced server-side)',
+        '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
+        '    --slug <slug>          optional; auto-derived + suffixed if omitted',
+        '  tenants list             list tenants you provisioned',
+        '',
+        'Global options:',
+        '  --json                   machine-readable output',
+        '  --yes, --ci              never prompt; fail fast on any step needing a human',
+        '  --dry-run                print what would happen, make no writes or mutating calls',
+        '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
+        '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
+        '  -h, --help               show this help and exit',
+        '  -V, --version            print the version and exit',
+        '',
+        'Exit codes: 0 ok, 1 failure, 2 usage error, 3 not logged in, 4 needs a human (see --ci).',
+        '',
+    ].join('\n');
+}
+export function usageLine() {
+    return 'Usage: rakomi <command> [options] (see --help)';
+}

package/dist/userinfo-client.js

@@ -0,0 +1,16 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export async function fetchUserInfo(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/oauth/userinfo`,
+        headers: { authorization: `Bearer ${opts.accessToken}` },
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not fetch your account info: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/package.json

@@ -1,29 +1,45 @@
 {
   "name": "rakomi",
-  "version": "0.0.1",
-  "description": "Reserved package name for the Rakomi CLI by CRE8EVE. This is a placeholder — the official CLI is published under the @rakomi organization scope.",
+  "version": "0.1.0",
+  "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",
-    "cre8eve",
     "cli",
-    "reserved",
-    "placeholder"
+    "auth",
+    "authentication",
+    "mcp",
+    "oauth",
+    "ai-agent"
   ],
-  "homepage": "https://cre8eve.eu",
-  "license": "UNLICENSED",
-  "author": "CRE8EVE <hello@cre8eve.eu>",
-  "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rakomidev/rakomi-js.git"
+  },
+  "bugs": {
+    "url": "https://github.com/rakomidev/rakomi-js/issues"
+  },
+  "homepage": "https://github.com/rakomidev/rakomi-js#readme",
+  "license": "MIT",
+  "publishConfig": {
+    "provenance": true
+  },
+  "type": "module",
   "bin": {
-    "rakomi": "bin/rakomi.js"
+    "rakomi": "./dist/index.js"
   },
-  "files": [
-    "bin/rakomi.js",
-    "README.md"
-  ],
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
-  "publishConfig": {
-    "access": "public"
+  "author": "CRE8EVE Sp. z o.o.",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/ test/ --max-warnings=0",
+    "test": "vitest run"
   }
-}
+}

package/bin/rakomi.js

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-
-// Placeholder binary for the reserved `rakomi` package name.
-// The official Rakomi CLI is not published here yet.
-console.log(
-  [
-    'rakomi — name reserved by CRE8EVE.',
-    '',
-    'This is a placeholder. The official CLI is not yet available under this name.',
-    'See https://cre8eve.eu for updates.',
-  ].join('\n'),
-);