rakomi 0.1.1 → 0.1.2

package/dist/ci-oidc-token.js

@@ -0,0 +1,51 @@
+import { CliError, EXIT } from './errors.js';
+import { request } from './http.js';
+export const NO_OIDC_SOURCE_MESSAGE = 'rakomi login --ci found no OIDC identity token. Set RAKOMI_OIDC_TOKEN, pass ' +
+    '--oidc-token-file <path>, or run on a CI platform this command recognizes automatically ' +
+    '(GitHub Actions with `permissions: id-token: write`, or GitLab CI with CI_JOB_JWT_V2).';
+export async function resolveCiOidcToken(deps, opts) {
+    if (opts.oidcTokenFile) {
+        let raw;
+        try {
+            raw = opts.readTextFile(opts.oidcTokenFile);
+        }
+        catch {
+            throw new CliError(`Could not read --oidc-token-file ${JSON.stringify(opts.oidcTokenFile)}.`, EXIT.FAIL);
+        }
+        const token = raw.trim();
+        if (token.length === 0) {
+            throw new CliError(`--oidc-token-file ${JSON.stringify(opts.oidcTokenFile)} was empty.`, EXIT.FAIL);
+        }
+        return token;
+    }
+    if (opts.env.RAKOMI_OIDC_TOKEN) {
+        return opts.env.RAKOMI_OIDC_TOKEN;
+    }
+    if (opts.env.ACTIONS_ID_TOKEN_REQUEST_URL && opts.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) {
+        return requestGitHubActionsIdToken(deps, opts.env.ACTIONS_ID_TOKEN_REQUEST_URL, opts.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN, opts.audience);
+    }
+    const gitlabToken = opts.env.CI_JOB_JWT_V2 || opts.env.CI_JOB_JWT;
+    if (gitlabToken) {
+        return gitlabToken;
+    }
+    throw new CliError(NO_OIDC_SOURCE_MESSAGE, EXIT.FAIL);
+}
+async function requestGitHubActionsIdToken(deps, requestUrl, requestToken, audience) {
+    let url;
+    try {
+        url = new URL(requestUrl);
+    }
+    catch {
+        throw new CliError('ACTIONS_ID_TOKEN_REQUEST_URL is not a valid URL.', EXIT.FAIL);
+    }
+    url.searchParams.set('audience', audience);
+    const result = await request(deps, {
+        method: 'GET',
+        url: url.toString(),
+        headers: { authorization: `Bearer ${requestToken}` },
+    });
+    if (result.status !== 200 || typeof result.body.value !== 'string' || result.body.value.length === 0) {
+        throw new CliError('Could not obtain a GitHub Actions OIDC token (check `permissions: id-token: write` on this job).', EXIT.FAIL);
+    }
+    return result.body.value;
+}

package/dist/commands/connect.js

@@ -2,6 +2,7 @@ import { AmbiguousClientError, clientDisplayName, resolveTargetClients } from '.
 import { pollCimdMaterialization, requestWriteElevation } from '../connect-client.js';
 import { DEFAULT_MCP_URL } from '../env.js';
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { mcpConfigPath, undoMcpConfigWrite, writeRakomiMcpServerEntry } from '../mcp-config.js';
 const CLAUDE_DESKTOP_INSTRUCTIONS = [
     'Claude Desktop connects to remote MCP servers through Connectors, configured from your Claude',
@@ -24,7 +25,7 @@ export async function runConnect(deps) {
     if (!session)
         throw new NotLoggedInError();
     if (deps.status) {
-        await reportStatus(deps, session.access_token);
+        await reportStatus(deps, session);
         return;
     }
     let targets;
@@ -41,24 +42,30 @@ export async function runConnect(deps) {
             deps.stdout.write(`${clientDisplayName(client)}:\n${CLAUDE_DESKTOP_INSTRUCTIONS}\n`);
             continue;
         }
-        await connectClaudeCode(deps, session.access_token);
+        await connectClaudeCode(deps, session);
     }
 }
-async function reportStatus(deps, accessToken) {
+async function reportStatus(deps, session) {
     if (!deps.cimdUrl) {
         throw new UsageError('`connect --status` needs `--cimd-url <url>` — the CIMD URL `connect` printed when it started waiting.');
     }
-    const row = await pollCimdMaterialization(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, cimdUrl: deps.cimdUrl });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const row = await pollCimdMaterialization(deps, {
+        apiBaseUrl: deps.apiBaseUrl,
+        accessToken: session.access_token,
+        cimdUrl: deps.cimdUrl,
+        dpop,
+    });
     if (!row) {
         deps.stdout.write('Not connected yet — finish sign-in in your MCP client, then run this command again.\n');
         return;
     }
     deps.stdout.write(`Connected — access: ${row.agent_access.level}${row.agent_access.owner_granted ? ' (owner-granted)' : ''}.\n`);
     if (deps.write && row.agent_access.level !== 'write') {
-        await requestWrite(deps, accessToken, row.id);
+        await requestWrite(deps, session, row.id);
     }
 }
-async function connectClaudeCode(deps, accessToken) {
+async function connectClaudeCode(deps, session) {
     if (deps.dryRun) {
         deps.stdout.write(`Would write ${mcpConfigPath(deps.cwd)} with mcpServers.rakomi -> ${deps.mcpUrl}. No file written (--dry-run).\n`);
         return;
@@ -78,7 +85,13 @@ async function connectClaudeCode(deps, accessToken) {
             'check the Agents page in the dashboard.\n');
         return;
     }
-    const row = await pollCimdMaterialization(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, cimdUrl: deps.cimdUrl });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const row = await pollCimdMaterialization(deps, {
+        apiBaseUrl: deps.apiBaseUrl,
+        accessToken: session.access_token,
+        cimdUrl: deps.cimdUrl,
+        dpop,
+    });
     if (!row) {
         deps.stdout.write(`\nNot connected yet. Ctrl+C is safe — resume any time with:\n` +
             `  rakomi connect --status --cimd-url ${deps.cimdUrl}\n`);
@@ -89,11 +102,12 @@ async function connectClaudeCode(deps, accessToken) {
         if (deps.ci) {
             throw new InteractiveRequiredError('`connect --write` cannot run under --ci — write-access needs a human owner decision.');
         }
-        await requestWrite(deps, accessToken, row.id);
+        await requestWrite(deps, session, row.id);
     }
 }
-async function requestWrite(deps, accessToken, oauthClientId) {
-    await requestWriteElevation(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, oauthClientId });
+async function requestWrite(deps, session, oauthClientId) {
+    const dpop = resolveDpopKey(deps.keys, session);
+    await requestWriteElevation(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken: session.access_token, oauthClientId, dpop });
     deps.stdout.write("Write-access request sent to your tenant's owner(s) — if that's you, you'll approve it yourself " +
         'from the dashboard Agents page. Destructive actions will still ask a human every time.\n');
 }

package/dist/commands/login.js

@@ -1,10 +1,19 @@
-import { accountsBaseUrl, apiBaseUrl, clientId as resolveClientId, isCimdClientId } from '../env.js';
+import { resolveCiOidcToken } from '../ci-oidc-token.js';
+import { accountsBaseUrl, apiBaseUrl, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, } from '../env.js';
 import { CliError, EXIT } from '../errors.js';
+import { bindInstallKey, getOrCreateInstallKey, signClientAssertion } from '../install-key.js';
 import { buildAuthorizeUrl, exchangeAuthorizationCode } from '../oauth-authcode.js';
 import { loginWithDeviceGrant } from '../oauth-device.js';
+import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
 import { generatePkcePair } from '../pkce.js';
 export const LOGIN_SCOPE = 'openid profile email clients:read elevation:request';
 const LOOPBACK_TIMEOUT_MS = 5 * 60_000;
+function cimdUnsupportedMessage(cid) {
+    return ('This Rakomi server does not have CIMD-based sign-in enabled, so the default client_id ' +
+        `(${cid}) cannot be used to sign in right now. Ask your tenant admin to register a client in ` +
+        'the dashboard, then run `rakomi login --client <your-client-id>` (or set RAKOMI_CLIENT_ID) ' +
+        'instead.');
+}
 export async function runLogin(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const cid = resolveClientId(deps.env);
@@ -13,21 +22,34 @@ export async function runLogin(deps) {
             "default CIMD client_id does not support it. Pass --client <your-client-id> (create one " +
             'in the dashboard) for headless/SSH sign-in, or omit --no-browser to sign in via loopback.', EXIT.FAIL);
     }
+    if (!deps.noBrowser && isCimdClientId(cid)) {
+        const supported = await isCimdPlatformSupported(deps, apiUrl);
+        if (supported === false) {
+            throw new CliError(cimdUnsupportedMessage(cid), EXIT.FAIL);
+        }
+    }
+    const installKey = isCimdClientId(cid) ? getOrCreateInstallKey(deps.keys, cid) : undefined;
     const token = deps.noBrowser
         ? await runDeviceGrantLogin(deps, apiUrl, cid)
-        : await runLoopbackLogin(deps, apiUrl, cid);
+        : await runLoopbackLogin(deps, apiUrl, cid, installKey);
     const session = {
         access_token: token.access_token,
         refresh_token: token.refresh_token,
-        token_type: 'Bearer',
+        token_type: token.token_type === 'DPoP' ? 'DPoP' : 'Bearer',
         expires_at: deps.now() + token.expires_in * 1000,
         api_base_url: apiUrl,
         client_id: cid,
     };
+    if (token.token_type !== 'Bearer' && token.token_type !== 'DPoP') {
+        deps.stdout.write(`(debug) unexpected token_type "${token.token_type}" from the server — treating this session as Bearer.\n`);
+    }
     deps.session.write(session);
     deps.stdout.write('Logged in to Rakomi.\n');
+    if (installKey) {
+        await bindInstallKey(deps, deps.keys, { apiBaseUrl: apiUrl, clientId: cid, accessToken: token.access_token, dpopBound: session.token_type === 'DPoP' }, installKey);
+    }
 }
-async function runLoopbackLogin(deps, apiUrl, cid) {
+async function runLoopbackLogin(deps, apiUrl, cid, installKey) {
     const listener = await deps.startLoopback();
     try {
         const pkce = generatePkcePair();
@@ -53,6 +75,10 @@ async function runLoopbackLogin(deps, apiUrl, cid) {
             redirectUri: listener.redirectUri,
             code: callback.code,
             codeVerifier: pkce.codeVerifier,
+            clientAssertion: installKey?.confirmedBound
+                ? signClientAssertion(installKey, { clientId: cid, audience: `${apiUrl}/oauth/token` })
+                : undefined,
+            dpopKey: installKey,
         });
     }
     finally {
@@ -68,3 +94,23 @@ async function runDeviceGrantLogin(deps, apiUrl, cid) {
         },
     }, { apiBaseUrl: apiUrl, clientId: cid, scope: LOGIN_SCOPE });
 }
+const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
+export async function runLoginCi(deps) {
+    const apiUrl = apiBaseUrl(deps.env);
+    const subjectToken = await resolveCiOidcToken(deps, {
+        env: deps.ciEnv,
+        oidcTokenFile: deps.oidcTokenFile,
+        readTextFile: deps.readTextFile,
+        audience: apiUrl,
+    });
+    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl });
+    const session = {
+        access_token: token.access_token,
+        token_type: token.token_type,
+        expires_at: deps.now() + token.expires_in * 1000,
+        api_base_url: apiUrl,
+        client_id: CI_FEDERATION_SESSION_CLIENT_ID,
+    };
+    deps.session.write(session);
+    deps.stdout.write('Logged in to Rakomi (CI workload identity).\n');
+}

package/dist/commands/tenants.js

@@ -1,4 +1,5 @@
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { createTenant, listTenants } from '../tenants-client.js';
 export async function runTenantsCreate(deps, args) {
     const session = deps.session.read();
@@ -23,6 +24,7 @@ export async function runTenantsCreate(deps, args) {
         name: args.name,
         slug: args.slug,
         ownerEmail: ownerIsSelf ? undefined : args.owner,
+        dpop: resolveDpopKey(deps.keys, session),
     });
     if (deps.json) {
         deps.stdout.write(JSON.stringify(result) + '\n');
@@ -41,7 +43,12 @@ export async function runTenantsList(deps) {
     const session = deps.session.read();
     if (!session)
         throw new NotLoggedInError();
-    const result = await listTenants(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, parent: 'me' });
+    const result = await listTenants(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parent: 'me',
+        dpop: resolveDpopKey(deps.keys, session),
+    });
     if (deps.json) {
         deps.stdout.write(JSON.stringify(result) + '\n');
         return;

package/dist/commands/whoami.js

@@ -1,12 +1,21 @@
 import { NotLoggedInError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { fetchUserInfo } from '../userinfo-client.js';
 export async function runWhoami(deps) {
     const session = deps.session.read();
     if (!session)
         throw new NotLoggedInError();
-    const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, dpop });
     if (deps.json) {
-        deps.stdout.write(JSON.stringify({ sub: info.sub, email: info.email, org_id: info.org_id, org_role: info.org_role, session_store: deps.session.describePath() }) + '\n');
+        deps.stdout.write(JSON.stringify({
+            sub: info.sub,
+            email: info.email,
+            org_id: info.org_id,
+            org_role: info.org_role,
+            session_store: deps.session.describePath(),
+            token_type: session.token_type,
+        }) + '\n');
         return;
     }
     const lines = [`Signed in as: ${info.email ?? info.sub}`];
@@ -14,5 +23,6 @@ export async function runWhoami(deps) {
         lines.push(`Organization: ${info.org_id}${info.org_role ? ` (${info.org_role})` : ''}`);
     lines.push(`API: ${session.api_base_url}`);
     lines.push(`Session stored in: ${deps.session.describePath()}`);
+    lines.push(`Token type: ${session.token_type}`);
     deps.stdout.write(lines.join('\n') + '\n');
 }

package/dist/connect-client.js

@@ -6,7 +6,8 @@ export async function pollCimdMaterialization(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: url.toString(),
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
@@ -20,8 +21,9 @@ export async function requestWriteElevation(deps, opts) {
     const result = await request(deps, {
         method: 'POST',
         url: `${opts.apiBaseUrl}/v1/oauth-clients/${encodeURIComponent(opts.oauthClientId)}/elevation-requests`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
         body: { scopes: ['mcp:tools:write'] },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/dist/dpop.js

@@ -0,0 +1,42 @@
+import { createHash, createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
+export function generateEphemeralDpopKey() {
+    const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    return { privateKeyPem, publicJwk };
+}
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+export function canonicalizeHtu(input) {
+    const url = new URL(input);
+    const protocol = url.protocol.toLowerCase();
+    const isDefaultPort = (protocol === 'https:' && url.port === '443') || (protocol === 'http:' && url.port === '80');
+    const host = (isDefaultPort ? url.hostname : url.host).toLowerCase();
+    const lowerHexPath = url.pathname.replace(/%([0-9A-Fa-f]{2})/g, (_m, h) => `%${h.toLowerCase()}`);
+    const collapsed = lowerHexPath.replace(/\/{2,}/g, '/');
+    const path = collapsed.length > 1 && collapsed.endsWith('/') ? collapsed.slice(0, -1) : collapsed;
+    return `${protocol}//${host}${path}`;
+}
+export function buildDpopProof(key, claims, opts) {
+    const privateKey = createPrivateKey(key.privateKeyPem);
+    const now = opts?.nowSec ?? Math.floor(Date.now() / 1000);
+    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: key.publicJwk };
+    const payload = {
+        jti: randomUUID(),
+        htm: claims.htm,
+        htu: claims.htu,
+        iat: now,
+    };
+    if (claims.accessToken !== undefined) {
+        payload.ath = createHash('sha256').update(claims.accessToken, 'utf8').digest('base64url');
+    }
+    if (claims.nonce !== undefined) {
+        payload.nonce = claims.nonce;
+    }
+    const h64 = base64url(Buffer.from(JSON.stringify(header)));
+    const p64 = base64url(Buffer.from(JSON.stringify(payload)));
+    const signingInput = `${h64}.${p64}`;
+    const signature = cryptoSign('sha256', Buffer.from(signingInput), { key: privateKey, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${base64url(signature)}`;
+}

package/dist/env.js

@@ -1,3 +1,4 @@
+import { request } from './http.js';
 export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
@@ -21,3 +22,18 @@ export function accountsBaseUrl(env) {
 export function clientId(env) {
     return env.RAKOMI_CLIENT_ID || DEFAULT_CIMD_CLIENT_ID_URL;
 }
+const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
+export async function isCimdPlatformSupported(deps, apiUrl) {
+    try {
+        const result = await request(deps, {
+            method: 'GET',
+            url: `${apiUrl}/.well-known/oauth-authorization-server`,
+        });
+        if (result.status !== 200)
+            return undefined;
+        return result.body[CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD] === true;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/http.js

@@ -1,3 +1,4 @@
+import { buildDpopProof, canonicalizeHtu } from './dpop.js';
 import { CliError, EXIT } from './errors.js';
 export const DEFAULT_TIMEOUT_MS = 15_000;
 function isErrorEnvelope(v) {
@@ -25,7 +26,7 @@ export function errorCode(body) {
         return body.code;
     return undefined;
 }
-export async function request(deps, req) {
+async function performOnce(deps, req, dpopNonce) {
     const controller = new AbortController();
     const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -42,6 +43,18 @@ export async function request(deps, req) {
         }
         if (req.idempotencyKey)
             headers['idempotency-key'] = req.idempotencyKey;
+        if (req.dpop) {
+            const proof = buildDpopProof(req.dpop.key, {
+                htm: req.method,
+                htu: canonicalizeHtu(req.url),
+                accessToken: req.dpop.accessToken,
+                nonce: dpopNonce,
+            });
+            headers['dpop'] = proof;
+            if (req.dpop.accessToken !== undefined) {
+                headers['authorization'] = `DPoP ${req.dpop.accessToken}`;
+            }
+        }
         let res;
         try {
             res = await deps.fetchImpl(req.url, { method: req.method, headers, body, signal: controller.signal });
@@ -68,3 +81,24 @@ export async function request(deps, req) {
         clearTimeout(timer);
     }
 }
+function isDpopNonceChallenge(result) {
+    if (result.status !== 401)
+        return undefined;
+    if (errorCode(result.body) !== 'auth/invalid_dpop_proof')
+        return undefined;
+    const nonce = result.headers.get('dpop-nonce');
+    return nonce && nonce.length > 0 ? nonce : undefined;
+}
+export async function request(deps, req) {
+    const first = await performOnce(deps, req);
+    if (!req.dpop)
+        return first;
+    const nonce = isDpopNonceChallenge(first);
+    if (nonce === undefined)
+        return first;
+    const retry = await performOnce(deps, req, nonce);
+    if (isDpopNonceChallenge(retry) !== undefined) {
+        throw new CliError('The Rakomi API kept demanding a fresh DPoP nonce; the request could not complete.', EXIT.FAIL);
+    }
+    return retry;
+}

package/dist/index.js

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 import { systemBrowserOpener } from './browser.js';
 import { runConnect } from './commands/connect.js';
-import { runLogin } from './commands/login.js';
+import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
 import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
 import { runWhoami } from './commands/whoami.js';
@@ -22,6 +22,7 @@ const GLOBAL_OPTIONS = {
     'dry-run': { type: 'boolean' },
     'no-browser': { type: 'boolean' },
     'no-keychain': { type: 'boolean' },
+    'oidc-token-file': { type: 'string' },
     client: { type: 'string' },
     undo: { type: 'boolean' },
     write: { type: 'boolean' },
@@ -74,11 +75,25 @@ async function dispatch(args, deps) {
     const httpDeps = { fetchImpl: deps.fetchImpl };
     const [command, ...rest] = positionals;
     switch (command) {
-        case 'login':
+        case 'login': {
+            if (values.ci === true) {
+                await runLoginCi({
+                    ...httpDeps,
+                    env: deps.env,
+                    ciEnv: deps.ciEnv ?? {},
+                    session: deps.session,
+                    oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
+                    readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
+                    stdout: deps.stdout,
+                    now: () => Date.now(),
+                });
+                return EXIT.OK;
+            }
             await runLogin({
                 ...httpDeps,
                 env: deps.env,
                 session: deps.session,
+                keys: deps.keys,
                 noBrowser: values['no-browser'] === true || ci,
                 openBrowser: systemBrowserOpener(),
                 startLoopback: startLoopbackListener,
@@ -87,16 +102,18 @@ async function dispatch(args, deps) {
                 now: () => Date.now(),
             });
             return EXIT.OK;
+        }
         case 'logout':
             runLogout({ session: deps.session, stdout: deps.stdout });
             return EXIT.OK;
         case 'whoami':
-            await runWhoami({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+            await runWhoami({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
             return EXIT.OK;
         case 'connect':
             await runConnect({
                 ...httpDeps,
                 session: deps.session,
+                keys: deps.keys,
                 cwd: deps.cwd,
                 apiBaseUrl: apiBaseUrl(deps.env),
                 mcpUrl: deps.env.RAKOMI_API_URL ? `${apiBaseUrl(deps.env)}/mcp` : DEFAULT_MCP_URL,
@@ -117,11 +134,11 @@ async function dispatch(args, deps) {
                 const name = tenantArgs[0];
                 if (!name)
                     throw new UsageError('Usage: rakomi tenants create <name> [--owner me|<email>] [--slug <slug>]');
-                await runTenantsCreate({ ...httpDeps, session: deps.session, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
+                await runTenantsCreate({ ...httpDeps, session: deps.session, keys: deps.keys, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
                 return EXIT.OK;
             }
             if (sub === 'list') {
-                await runTenantsList({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+                await runTenantsList({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
                 return EXIT.OK;
             }
             throw new UsageError('Usage: rakomi tenants <create|list> ...');
@@ -130,6 +147,11 @@ async function dispatch(args, deps) {
             throw new UsageError(`Unknown command "${command ?? ''}".`);
     }
 }
+export function printFallbackDisclosureOnce(resolved, stderr) {
+    if (resolved.fallbackDisclosure) {
+        stderr.write(resolved.fallbackDisclosure + '\n');
+    }
+}
 async function main() {
     const major = Number(process.versions.node.split('.')[0]);
     if (Number.isFinite(major) && major < 22) {
@@ -152,11 +174,16 @@ async function main() {
         NO_COLOR: process.env.NO_COLOR,
     };
     const noKeychainEnv = process.env.RAKOMI_NO_KEYCHAIN;
+    const ciEnv = {
+        ACTIONS_ID_TOKEN_REQUEST_URL: process.env.ACTIONS_ID_TOKEN_REQUEST_URL,
+        ACTIONS_ID_TOKEN_REQUEST_TOKEN: process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+        CI_JOB_JWT_V2: process.env.CI_JOB_JWT_V2,
+        CI_JOB_JWT: process.env.CI_JOB_JWT,
+        RAKOMI_OIDC_TOKEN: process.env.RAKOMI_OIDC_TOKEN,
+    };
     const noKeychainFlag = process.argv.slice(2).includes('--no-keychain');
     const resolved = resolveStores(env, { noKeychain: noKeychainFlag || Boolean(env.CI) || Boolean(noKeychainEnv) });
-    if (resolved.fallbackDisclosure) {
-        process.stderr.write(resolved.fallbackDisclosure + '\n');
-    }
+    printFallbackDisclosureOnce(resolved, { write: (text) => void process.stderr.write(text) });
     process.exitCode = await run(process.argv.slice(2), {
         stdout: { write: (text) => void process.stdout.write(text) },
         stderr: { write: (text) => void process.stderr.write(text) },
@@ -166,7 +193,9 @@ async function main() {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
         fetchImpl: fetch,
         session: resolved.session,
+        keys: resolved.keys,
         detectClaudeCode: () => detectClaudeCodeCli(),
+        ciEnv,
     });
 }
 function detectClaudeCodeCli() {

package/dist/install-key.js

@@ -0,0 +1,85 @@
+import { createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
+import { isCimdClientId } from './env.js';
+import { request } from './http.js';
+const INSTALL_KEY_NAME = 'install-key';
+const ASSERTION_LIFETIME_SEC = 60;
+function isStoredInstallKey(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const r = v;
+    return (typeof r.clientId === 'string' &&
+        typeof r.privateKeyPem === 'string' &&
+        typeof r.publicJwk === 'object' &&
+        r.publicJwk !== null &&
+        typeof r.confirmedBound === 'boolean');
+}
+function generateKeyPair(clientId) {
+    const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    return { clientId, privateKeyPem, publicJwk, confirmedBound: false };
+}
+export function getOrCreateInstallKey(keys, clientId) {
+    const raw = keys.get(INSTALL_KEY_NAME);
+    if (raw !== null) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
+                return parsed;
+        }
+        catch {
+        }
+    }
+    const fresh = generateKeyPair(clientId);
+    keys.set(INSTALL_KEY_NAME, JSON.stringify(fresh));
+    return fresh;
+}
+function base64url(buf) {
+    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+}
+export function signClientAssertion(key, opts) {
+    const privateKey = createPrivateKey(key.privateKeyPem);
+    const now = opts.nowSec ?? Math.floor(Date.now() / 1000);
+    const header = { alg: 'ES256', typ: 'JWT' };
+    const payload = {
+        iss: opts.clientId,
+        sub: opts.clientId,
+        aud: opts.audience,
+        jti: randomUUID(),
+        iat: now,
+        exp: now + ASSERTION_LIFETIME_SEC,
+    };
+    const h64 = base64url(Buffer.from(JSON.stringify(header)));
+    const p64 = base64url(Buffer.from(JSON.stringify(payload)));
+    const signingInput = `${h64}.${p64}`;
+    const signature = cryptoSign('sha256', Buffer.from(signingInput), { key: privateKey, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${base64url(signature)}`;
+}
+export async function bindInstallKey(deps, keys, opts, key) {
+    try {
+        const result = await request(deps, {
+            method: 'POST',
+            url: `${opts.apiBaseUrl}/v1/oauth-clients/install-key`,
+            headers: opts.dpopBound ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+            body: { client_id: opts.clientId, jwk: key.publicJwk },
+            dpop: opts.dpopBound ? { key, accessToken: opts.accessToken } : undefined,
+        });
+        if (result.status !== 200)
+            return { attempted: true, bound: false };
+        const bound = result.body.bound === true;
+        if (bound !== key.confirmedBound) {
+            keys.set(INSTALL_KEY_NAME, JSON.stringify({ ...key, confirmedBound: bound }));
+        }
+        return { attempted: true, bound };
+    }
+    catch {
+        return { attempted: false, bound: false };
+    }
+}
+export function resolveDpopKey(keys, session) {
+    if (session.token_type !== 'DPoP')
+        return undefined;
+    if (!isCimdClientId(session.client_id))
+        return undefined;
+    return getOrCreateInstallKey(keys, session.client_id);
+}

package/dist/oauth-authcode.js

@@ -21,7 +21,14 @@ export async function exchangeAuthorizationCode(deps, opts) {
             redirect_uri: opts.redirectUri,
             client_id: opts.clientId,
             code_verifier: opts.codeVerifier,
+            ...(opts.clientAssertion
+                ? {
+                    client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+                    client_assertion: opts.clientAssertion,
+                }
+                : {}),
         },
+        dpop: opts.dpopKey ? { key: opts.dpopKey } : undefined,
     });
     if (result.status !== 200) {
         throw new CliError(`Could not complete sign-in: ${describeError(result.body, result.status)}`, EXIT.FAIL);

package/dist/oidc-federation-login.js

@@ -0,0 +1,24 @@
+import { buildDpopProof, canonicalizeHtu, generateEphemeralDpopKey } from './dpop.js';
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export const OIDC_FEDERATION_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
+export async function exchangeOidcSubjectToken(deps, opts) {
+    const tokenUrl = `${opts.apiBaseUrl}/oauth/token`;
+    const dpopKey = generateEphemeralDpopKey();
+    const proof = buildDpopProof(dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
+    const result = await request(deps, {
+        method: 'POST',
+        url: tokenUrl,
+        headers: { dpop: proof },
+        form: {
+            grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            subject_token: opts.subjectToken,
+            subject_token_type: OIDC_FEDERATION_SUBJECT_TOKEN_TYPE,
+            resource: opts.resource,
+        },
+    });
+    if (result.status !== 200) {
+        throw new CliError(`Could not sign in from CI: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/session.js

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join } from 'node:path';
+import { CliError } from './errors.js';
 export function configDir(env) {
     if (env.RAKOMI_CONFIG_DIR)
         return env.RAKOMI_CONFIG_DIR;
@@ -49,12 +50,18 @@ export class FileSessionStore {
         return this.path;
     }
 }
+function assertValidKeyName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(name)) {
+        throw new TypeError(`invalid KeyStore name: ${JSON.stringify(name)} (expected 1-128 chars, alphanumeric/hyphen/underscore only, no path separators)`);
+    }
+}
 export class FileKeyStore {
     dir;
     constructor(dir) {
         this.dir = dir;
     }
     path(name) {
+        assertValidKeyName(name);
         return join(this.dir, `key-${name}.json`);
     }
     get(name) {
@@ -88,7 +95,7 @@ function isStoredSession(value) {
     const v = value;
     return (typeof v.access_token === 'string' &&
         v.access_token.length > 0 &&
-        v.token_type === 'Bearer' &&
+        (v.token_type === 'Bearer' || v.token_type === 'DPoP') &&
         typeof v.expires_at === 'number' &&
         typeof v.api_base_url === 'string' &&
         typeof v.client_id === 'string');
@@ -96,12 +103,41 @@ function isStoredSession(value) {
 export function isExpired(session, now) {
     return now >= session.expires_at;
 }
+export class ExecFileFailure extends Error {
+    command;
+    status;
+    stderrOutput;
+    constructor(command, status, stderrOutput) {
+        super(`${command} exited with status ${status ?? 'unknown'}${stderrOutput.length > 0 ? `: ${stderrOutput}` : ''}`);
+        this.command = command;
+        this.status = status;
+        this.stderrOutput = stderrOutput;
+        this.name = 'ExecFileFailure';
+    }
+}
 function realExecFileSync(file, args, options) {
-    return execFileSync(file, [...args], { encoding: 'utf8', input: options?.input, maxBuffer: 10 * 1024 * 1024 }).toString();
+    try {
+        return execFileSync(file, [...args], {
+            encoding: 'utf8',
+            input: options?.input,
+            maxBuffer: 10 * 1024 * 1024,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).toString();
+    }
+    catch (e) {
+        const err = e;
+        const rawStderr = err.stderr;
+        const stderrOutput = (typeof rawStderr === 'string' ? rawStderr : rawStderr?.toString('utf8')) ?? '';
+        throw new ExecFileFailure(file, err.status ?? null, stderrOutput.trim());
+    }
 }
 function commandExistsOnPath(binaryName, pathEnv, existsFn) {
     return pathEnv.split(delimiter).some((dir) => dir.length > 0 && existsFn(join(dir, binaryName)));
 }
+function keychainReadFailure(backendLabel, cause) {
+    const detail = cause instanceof ExecFileFailure && cause.stderrOutput.length > 0 ? cause.stderrOutput : cause instanceof Error ? cause.message : String(cause);
+    return new CliError(`Could not read your session from ${backendLabel}: ${detail}`);
+}
 export class MacKeychainBackend {
     execFileSyncFn;
     platform;
@@ -127,8 +163,10 @@ export class MacKeychainBackend {
             const value = out.trim();
             return value.length > 0 ? value : null;
         }
-        catch {
-            return null;
+        catch (e) {
+            if (e instanceof ExecFileFailure && e.status === 44)
+                return null;
+            throw keychainReadFailure('macOS Keychain', e);
         }
     }
     set(service, account, value) {
@@ -165,8 +203,10 @@ export class LinuxSecretToolBackend {
             const value = out.replace(/\n$/, '');
             return value.length > 0 ? value : null;
         }
-        catch {
-            return null;
+        catch (e) {
+            if (e instanceof ExecFileFailure && e.stderrOutput.length === 0)
+                return null;
+            throw keychainReadFailure('the Linux Secret Service', e);
         }
     }
     set(service, account, value) {
@@ -227,7 +267,13 @@ export class WindowsDpapiBackend {
         const valueB64 = Buffer.from(value, 'utf8').toString('base64');
         const script = `[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Convert]::FromBase64String('${valueB64}'), $null, 'CurrentUser'))`;
         const cipherB64 = this.execFileSyncFn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]).trim();
-        writeFileSync(this.filePath(service, account), cipherB64 + '\n', { mode: 0o600 });
+        const path = this.filePath(service, account);
+        writeFileSync(path, cipherB64 + '\n', { mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+        }
     }
     delete(service, account) {
         try {
@@ -286,12 +332,25 @@ export class KeychainKeyStore {
         this.backend = backend;
     }
     get(name) {
+        try {
+            assertValidKeyName(name);
+        }
+        catch {
+            return null;
+        }
         return this.backend.get(KEY_SERVICE, name);
     }
     set(name, value) {
+        assertValidKeyName(name);
         this.backend.set(KEY_SERVICE, name, value);
     }
     clear(name) {
+        try {
+            assertValidKeyName(name);
+        }
+        catch {
+            return;
+        }
         this.backend.delete(KEY_SERVICE, name);
     }
 }

package/dist/tenants-client.js

@@ -16,9 +16,10 @@ export async function createTenant(deps, opts) {
     const result = await request(deps, {
         method: 'POST',
         url: `${opts.apiBaseUrl}/v1/tenants`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
         body: { name: opts.name, ...(opts.slug ? { slug: opts.slug } : {}), ...(opts.ownerEmail ? { owner_email: opts.ownerEmail } : {}) },
         idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
@@ -46,7 +47,8 @@ export async function listTenants(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: url.toString(),
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/dist/usage.js

@@ -7,6 +7,8 @@ export function helpText() {
         '',
         'Commands:',
         '  login                    sign in (browser by default; --no-browser for a device code)',
+        '    --ci                   sign in from CI via the runner\'s own OIDC identity (no browser/device code)',
+        '    --oidc-token-file <p>  read the OIDC token from a file instead of the CI platform\'s own env',
         '  logout                   clear the local session',
         '  whoami                   show the signed-in account',
         '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',

package/dist/userinfo-client.js

@@ -4,7 +4,8 @@ export async function fetchUserInfo(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: `${opts.apiBaseUrl}/oauth/userinfo`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.1.1",
+      "bom-ref": "pkg:npm/rakomi@0.1.2",
       "name": "rakomi",
-      "version": "0.1.1",
-      "purl": "pkg:npm/rakomi@0.1.1",
+      "version": "0.1.2",
+      "purl": "pkg:npm/rakomi@0.1.2",
       "licenses": [
         {
           "license": {