rakomi 0.1.1 → 0.2.0

package/README.md

@@ -9,7 +9,15 @@ npx rakomi login
 ```
 
 Signs you in with your browser (loopback OAuth + PKCE). Add `--no-browser` on a headless/SSH
-session to get a short code to enter on another device instead.
+session to get a short code to enter on another device instead. If you don't already have a
+`accounts.rakomi.com` session or an invitation link, pass `--tenant-id <uuid>` (or set
+`RAKOMI_PLATFORM_TENANT_ID`) so sign-in knows which tenant to authenticate against — ask your
+Rakomi administrator for the right value.
+
+`rakomi whoami` shows the tenant you signed in against ("Home tenant") and the tenant your other
+commands should treat as active ("Active tenant"). `rakomi use <tenant-id>` remembers a tenant id
+locally for that; `--tenant <tenant-id>` overrides it for one command. Neither is a verified
+grant — the tenant `whoami` shows as your Home tenant is the only one the server has confirmed.
 
 ## Connect an AI agent
 
@@ -45,7 +53,8 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | --- | --- |
 | `login` | sign in (browser by default; `--no-browser` for a device code) |
 | `logout` | clear the local session |
-| `whoami` | show the signed-in account |
+| `whoami` | show the signed-in account, home tenant, and active tenant |
+| `use <tenant-id>` | remember a tenant id locally for `whoami`/future commands |
 | `connect` | connect Claude Code / Claude Desktop to your tenant (read access) |
 | `tenants create <name>` | create a tenant (`--owner me\|<email>`, `--slug <slug>`) |
 | `tenants list` | list tenants you provisioned |
@@ -59,6 +68,8 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `--dry-run` | print what would happen, make no writes or mutating calls |
 | `--no-browser` | use the device-code flow instead of opening a browser |
 | `--no-keychain` | store the session in a `0600` file instead of the OS keychain |
+| `--tenant-id <uuid>` | (`login`) the tenant to sign in against, if `RAKOMI_PLATFORM_TENANT_ID` isn't set for you |
+| `--tenant <tenant-id>` | override the active tenant for a single command (`whoami` today) |
 | `--client <name>` | `claude-code` or `claude-desktop` — required when more than one applies |
 | `--undo` | restore the `.mcp.json` `connect` last backed up |
 | `--cimd-url <url>` | (`connect`) the connecting client's own CIMD document URL — confirms/re-checks the connection |

package/dist/ci-oidc-token.js

@@ -0,0 +1,51 @@
+import { CliError, EXIT } from './errors.js';
+import { request } from './http.js';
+export const NO_OIDC_SOURCE_MESSAGE = 'rakomi login --ci found no OIDC identity token. Set RAKOMI_OIDC_TOKEN, pass ' +
+    '--oidc-token-file <path>, or run on a CI platform this command recognizes automatically ' +
+    '(GitHub Actions with `permissions: id-token: write`, or GitLab CI with CI_JOB_JWT_V2).';
+export async function resolveCiOidcToken(deps, opts) {
+    if (opts.oidcTokenFile) {
+        let raw;
+        try {
+            raw = opts.readTextFile(opts.oidcTokenFile);
+        }
+        catch {
+            throw new CliError(`Could not read --oidc-token-file ${JSON.stringify(opts.oidcTokenFile)}.`, EXIT.FAIL);
+        }
+        const token = raw.trim();
+        if (token.length === 0) {
+            throw new CliError(`--oidc-token-file ${JSON.stringify(opts.oidcTokenFile)} was empty.`, EXIT.FAIL);
+        }
+        return token;
+    }
+    if (opts.env.RAKOMI_OIDC_TOKEN) {
+        return opts.env.RAKOMI_OIDC_TOKEN;
+    }
+    if (opts.env.ACTIONS_ID_TOKEN_REQUEST_URL && opts.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) {
+        return requestGitHubActionsIdToken(deps, opts.env.ACTIONS_ID_TOKEN_REQUEST_URL, opts.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN, opts.audience);
+    }
+    const gitlabToken = opts.env.CI_JOB_JWT_V2 || opts.env.CI_JOB_JWT;
+    if (gitlabToken) {
+        return gitlabToken;
+    }
+    throw new CliError(NO_OIDC_SOURCE_MESSAGE, EXIT.FAIL);
+}
+async function requestGitHubActionsIdToken(deps, requestUrl, requestToken, audience) {
+    let url;
+    try {
+        url = new URL(requestUrl);
+    }
+    catch {
+        throw new CliError('ACTIONS_ID_TOKEN_REQUEST_URL is not a valid URL.', EXIT.FAIL);
+    }
+    url.searchParams.set('audience', audience);
+    const result = await request(deps, {
+        method: 'GET',
+        url: url.toString(),
+        headers: { authorization: `Bearer ${requestToken}` },
+    });
+    if (result.status !== 200 || typeof result.body.value !== 'string' || result.body.value.length === 0) {
+        throw new CliError('Could not obtain a GitHub Actions OIDC token (check `permissions: id-token: write` on this job).', EXIT.FAIL);
+    }
+    return result.body.value;
+}

package/dist/commands/connect.js

@@ -2,6 +2,7 @@ import { AmbiguousClientError, clientDisplayName, resolveTargetClients } from '.
 import { pollCimdMaterialization, requestWriteElevation } from '../connect-client.js';
 import { DEFAULT_MCP_URL } from '../env.js';
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { mcpConfigPath, undoMcpConfigWrite, writeRakomiMcpServerEntry } from '../mcp-config.js';
 const CLAUDE_DESKTOP_INSTRUCTIONS = [
     'Claude Desktop connects to remote MCP servers through Connectors, configured from your Claude',
@@ -24,7 +25,7 @@ export async function runConnect(deps) {
     if (!session)
         throw new NotLoggedInError();
     if (deps.status) {
-        await reportStatus(deps, session.access_token);
+        await reportStatus(deps, session);
         return;
     }
     let targets;
@@ -41,24 +42,30 @@ export async function runConnect(deps) {
             deps.stdout.write(`${clientDisplayName(client)}:\n${CLAUDE_DESKTOP_INSTRUCTIONS}\n`);
             continue;
         }
-        await connectClaudeCode(deps, session.access_token);
+        await connectClaudeCode(deps, session);
     }
 }
-async function reportStatus(deps, accessToken) {
+async function reportStatus(deps, session) {
     if (!deps.cimdUrl) {
         throw new UsageError('`connect --status` needs `--cimd-url <url>` — the CIMD URL `connect` printed when it started waiting.');
     }
-    const row = await pollCimdMaterialization(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, cimdUrl: deps.cimdUrl });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const row = await pollCimdMaterialization(deps, {
+        apiBaseUrl: deps.apiBaseUrl,
+        accessToken: session.access_token,
+        cimdUrl: deps.cimdUrl,
+        dpop,
+    });
     if (!row) {
         deps.stdout.write('Not connected yet — finish sign-in in your MCP client, then run this command again.\n');
         return;
     }
     deps.stdout.write(`Connected — access: ${row.agent_access.level}${row.agent_access.owner_granted ? ' (owner-granted)' : ''}.\n`);
     if (deps.write && row.agent_access.level !== 'write') {
-        await requestWrite(deps, accessToken, row.id);
+        await requestWrite(deps, session, row.id);
     }
 }
-async function connectClaudeCode(deps, accessToken) {
+async function connectClaudeCode(deps, session) {
     if (deps.dryRun) {
         deps.stdout.write(`Would write ${mcpConfigPath(deps.cwd)} with mcpServers.rakomi -> ${deps.mcpUrl}. No file written (--dry-run).\n`);
         return;
@@ -78,7 +85,13 @@ async function connectClaudeCode(deps, accessToken) {
             'check the Agents page in the dashboard.\n');
         return;
     }
-    const row = await pollCimdMaterialization(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, cimdUrl: deps.cimdUrl });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const row = await pollCimdMaterialization(deps, {
+        apiBaseUrl: deps.apiBaseUrl,
+        accessToken: session.access_token,
+        cimdUrl: deps.cimdUrl,
+        dpop,
+    });
     if (!row) {
         deps.stdout.write(`\nNot connected yet. Ctrl+C is safe — resume any time with:\n` +
             `  rakomi connect --status --cimd-url ${deps.cimdUrl}\n`);
@@ -89,11 +102,12 @@ async function connectClaudeCode(deps, accessToken) {
         if (deps.ci) {
             throw new InteractiveRequiredError('`connect --write` cannot run under --ci — write-access needs a human owner decision.');
         }
-        await requestWrite(deps, accessToken, row.id);
+        await requestWrite(deps, session, row.id);
     }
 }
-async function requestWrite(deps, accessToken, oauthClientId) {
-    await requestWriteElevation(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken, oauthClientId });
+async function requestWrite(deps, session, oauthClientId) {
+    const dpop = resolveDpopKey(deps.keys, session);
+    await requestWriteElevation(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken: session.access_token, oauthClientId, dpop });
     deps.stdout.write("Write-access request sent to your tenant's owner(s) — if that's you, you'll approve it yourself " +
         'from the dashboard Agents page. Destructive actions will still ask a human every time.\n');
 }

package/dist/commands/login.js

@@ -1,10 +1,39 @@
-import { accountsBaseUrl, apiBaseUrl, clientId as resolveClientId, isCimdClientId } from '../env.js';
+import { resolveCiOidcToken } from '../ci-oidc-token.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { accountsBaseUrl, apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, isValidTenantId, platformTenantId, } from '../env.js';
 import { CliError, EXIT } from '../errors.js';
+import { bindInstallKey, getOrCreateInstallKey, peekInstallKey, persistInstallKey, signClientAssertion, } from '../install-key.js';
 import { buildAuthorizeUrl, exchangeAuthorizationCode } from '../oauth-authcode.js';
 import { loginWithDeviceGrant } from '../oauth-device.js';
+import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
 import { generatePkcePair } from '../pkce.js';
 export const LOGIN_SCOPE = 'openid profile email clients:read elevation:request';
 const LOOPBACK_TIMEOUT_MS = 5 * 60_000;
+function cimdUnsupportedMessage(cid) {
+    return ('This Rakomi server does not have CIMD-based sign-in enabled, so the default client_id ' +
+        `(${cid}) cannot be used to sign in right now. Ask your tenant admin to register a client in ` +
+        'the dashboard, then run `rakomi login --client <your-client-id>` (or set RAKOMI_CLIENT_ID) ' +
+        'instead.');
+}
+function platformTenantMissingMessage() {
+    return ('rakomi login needs to know which tenant to authenticate your account against. Set ' +
+        'RAKOMI_PLATFORM_TENANT_ID to a real tenant UUID, or pass --tenant-id <uuid>. If neither is ' +
+        'set, this Rakomi environment likely does not have a platform tenant provisioned yet — ask ' +
+        'your operator.');
+}
+function explicitTenantIdMalformedMessage(value) {
+    return (`--tenant-id "${value}" is not a valid tenant id — expected a well-formed UUID (not the nil ` +
+        'or max UUID). Pass the real tenant id, or omit --tenant-id to fall back to RAKOMI_PLATFORM_TENANT_ID.');
+}
+function resolvePlatformTenantId(env, explicit) {
+    if (explicit !== undefined) {
+        if (!isValidTenantId(explicit)) {
+            throw new CliError(explicitTenantIdMalformedMessage(explicit), EXIT.FAIL);
+        }
+        return explicit;
+    }
+    return platformTenantId(env);
+}
 export async function runLogin(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const cid = resolveClientId(deps.env);
@@ -13,21 +42,42 @@ export async function runLogin(deps) {
             "default CIMD client_id does not support it. Pass --client <your-client-id> (create one " +
             'in the dashboard) for headless/SSH sign-in, or omit --no-browser to sign in via loopback.', EXIT.FAIL);
     }
+    if (!deps.noBrowser && isCimdClientId(cid)) {
+        const supported = await isCimdPlatformSupported(deps, apiUrl);
+        if (supported === false) {
+            throw new CliError(cimdUnsupportedMessage(cid), EXIT.FAIL);
+        }
+    }
+    const installKey = isCimdClientId(cid) ? getOrCreateInstallKey(deps.keys, cid) : undefined;
+    let tenantId;
+    if (!deps.noBrowser && isCimdClientId(cid)) {
+        tenantId = resolvePlatformTenantId(deps.env, deps.explicitTenantId);
+        if (!tenantId) {
+            throw new CliError(platformTenantMissingMessage(), EXIT.FAIL);
+        }
+    }
     const token = deps.noBrowser
         ? await runDeviceGrantLogin(deps, apiUrl, cid)
-        : await runLoopbackLogin(deps, apiUrl, cid);
+        : await runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId);
     const session = {
         access_token: token.access_token,
         refresh_token: token.refresh_token,
-        token_type: 'Bearer',
+        token_type: token.token_type === 'DPoP' ? 'DPoP' : 'Bearer',
         expires_at: deps.now() + token.expires_in * 1000,
         api_base_url: apiUrl,
         client_id: cid,
+        ...(tenantId ? { home_tenant_id: tenantId } : {}),
     };
+    if (token.token_type !== 'Bearer' && token.token_type !== 'DPoP') {
+        deps.stdout.write(`(debug) unexpected token_type "${token.token_type}" from the server — treating this session as Bearer.\n`);
+    }
     deps.session.write(session);
     deps.stdout.write('Logged in to Rakomi.\n');
+    if (installKey) {
+        await bindInstallKey(deps, deps.keys, { apiBaseUrl: apiUrl, clientId: cid, accessToken: token.access_token, dpopBound: session.token_type === 'DPoP' }, installKey);
+    }
 }
-async function runLoopbackLogin(deps, apiUrl, cid) {
+async function runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId) {
     const listener = await deps.startLoopback();
     try {
         const pkce = generatePkcePair();
@@ -37,6 +87,7 @@ async function runLoopbackLogin(deps, apiUrl, cid) {
             redirectUri: listener.redirectUri,
             pkce,
             scope: LOGIN_SCOPE,
+            tenantId,
         });
         deps.stdout.write(`Opening your browser to sign in:\n  ${authorizeUrl}\n`);
         await deps.openBrowser(authorizeUrl);
@@ -53,6 +104,10 @@ async function runLoopbackLogin(deps, apiUrl, cid) {
             redirectUri: listener.redirectUri,
             code: callback.code,
             codeVerifier: pkce.codeVerifier,
+            clientAssertion: installKey?.confirmedBound
+                ? signClientAssertion(installKey, { clientId: cid, audience: `${apiUrl}/oauth/token` })
+                : undefined,
+            dpopKey: installKey,
         });
     }
     finally {
@@ -68,3 +123,26 @@ async function runDeviceGrantLogin(deps, apiUrl, cid) {
         },
     }, { apiBaseUrl: apiUrl, clientId: cid, scope: LOGIN_SCOPE });
 }
+export async function runLoginCi(deps) {
+    const apiUrl = apiBaseUrl(deps.env);
+    const subjectToken = await resolveCiOidcToken(deps, {
+        env: deps.ciEnv,
+        oidcTokenFile: deps.oidcTokenFile,
+        readTextFile: deps.readTextFile,
+        audience: apiUrl,
+    });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl, dpopKey });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
+    const session = {
+        access_token: token.access_token,
+        token_type: token.token_type,
+        expires_at: deps.now() + token.expires_in * 1000,
+        api_base_url: apiUrl,
+        client_id: CI_FEDERATION_SESSION_CLIENT_ID,
+    };
+    deps.session.write(session);
+    deps.stdout.write('Logged in to Rakomi (CI workload identity).\n');
+}

package/dist/commands/mcp.js

@@ -0,0 +1,45 @@
+import { resolveCiOidcToken } from '../ci-oidc-token.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, DEFAULT_MCP_URL } from '../env.js';
+import { getOrCreateInstallKey, peekInstallKey, persistInstallKey } from '../install-key.js';
+import { listMcpToolsCi, MCP_RESOURCE } from '../mcp-tools-ci.js';
+import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
+function hintLine(t) {
+    const hints = [];
+    if (t.annotations?.readOnlyHint)
+        hints.push('read-only');
+    if (t.annotations?.idempotentHint)
+        hints.push('idempotent');
+    return hints.length > 0 ? ` (${hints.join(', ')})` : '';
+}
+export async function runMcpToolsCi(deps) {
+    const apiUrl = apiBaseUrl(deps.env);
+    const mcpUrl = deps.env.RAKOMI_API_URL ? `${apiUrl}/mcp` : DEFAULT_MCP_URL;
+    const subjectToken = await resolveCiOidcToken(deps, {
+        env: deps.ciEnv,
+        oidcTokenFile: deps.oidcTokenFile,
+        readTextFile: deps.readTextFile,
+        audience: MCP_RESOURCE,
+    });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, {
+        apiBaseUrl: apiUrl,
+        subjectToken,
+        resource: MCP_RESOURCE,
+        dpopKey,
+    });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
+    const resolvedKey = getOrCreateInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const tools = await listMcpToolsCi(deps, { mcpUrl, accessToken: token.access_token, dpopKey: resolvedKey });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ tools }) + '\n');
+        return;
+    }
+    if (tools.length === 0) {
+        deps.stdout.write('No MCP tools visible to this CI identity.\n');
+        return;
+    }
+    deps.stdout.write(tools.map((t) => `${t.name}${hintLine(t)} — ${t.description}`).join('\n') + '\n');
+}

package/dist/commands/tenants.js

@@ -1,4 +1,5 @@
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { createTenant, listTenants } from '../tenants-client.js';
 export async function runTenantsCreate(deps, args) {
     const session = deps.session.read();
@@ -23,6 +24,7 @@ export async function runTenantsCreate(deps, args) {
         name: args.name,
         slug: args.slug,
         ownerEmail: ownerIsSelf ? undefined : args.owner,
+        dpop: resolveDpopKey(deps.keys, session),
     });
     if (deps.json) {
         deps.stdout.write(JSON.stringify(result) + '\n');
@@ -41,7 +43,12 @@ export async function runTenantsList(deps) {
     const session = deps.session.read();
     if (!session)
         throw new NotLoggedInError();
-    const result = await listTenants(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, parent: 'me' });
+    const result = await listTenants(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parent: 'me',
+        dpop: resolveDpopKey(deps.keys, session),
+    });
     if (deps.json) {
         deps.stdout.write(JSON.stringify(result) + '\n');
         return;

package/dist/commands/use.js

@@ -0,0 +1,10 @@
+import { isValidTenantId } from '../env.js';
+import { UsageError } from '../errors.js';
+export function runUse(deps, args) {
+    if (!isValidTenantId(args.tenantId)) {
+        throw new UsageError(`"${args.tenantId}" is not a valid tenant id — expected a UUID (e.g. the value \`rakomi login\` ` +
+            'printed as "Home tenant", or the id shown in the dashboard).');
+    }
+    deps.tenantConfig.write(args.tenantId);
+    deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+}

package/dist/commands/whoami.js

@@ -1,18 +1,33 @@
 import { NotLoggedInError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
 import { fetchUserInfo } from '../userinfo-client.js';
 export async function runWhoami(deps) {
     const session = deps.session.read();
     if (!session)
         throw new NotLoggedInError();
-    const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token });
+    const dpop = resolveDpopKey(deps.keys, session);
+    const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, dpop });
+    const activeTenantId = deps.explicitTenant ?? deps.tenantConfig.read() ?? undefined;
     if (deps.json) {
-        deps.stdout.write(JSON.stringify({ sub: info.sub, email: info.email, org_id: info.org_id, org_role: info.org_role, session_store: deps.session.describePath() }) + '\n');
+        deps.stdout.write(JSON.stringify({
+            sub: info.sub,
+            email: info.email,
+            org_id: info.org_id,
+            org_role: info.org_role,
+            session_store: deps.session.describePath(),
+            token_type: session.token_type,
+            home_tenant_id: session.home_tenant_id,
+            active_tenant_id: activeTenantId,
+        }) + '\n');
         return;
     }
     const lines = [`Signed in as: ${info.email ?? info.sub}`];
     if (info.org_id)
         lines.push(`Organization: ${info.org_id}${info.org_role ? ` (${info.org_role})` : ''}`);
     lines.push(`API: ${session.api_base_url}`);
+    lines.push(`Home tenant: ${session.home_tenant_id ?? 'unknown (this session did not authenticate via the CIMD-default flow)'}`);
+    lines.push(`Active tenant: ${activeTenantId ?? 'none set (run `rakomi use <tenant-id>`)'}`);
     lines.push(`Session stored in: ${deps.session.describePath()}`);
+    lines.push(`Token type: ${session.token_type}`);
     deps.stdout.write(lines.join('\n') + '\n');
 }

package/dist/connect-client.js

@@ -6,7 +6,8 @@ export async function pollCimdMaterialization(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: url.toString(),
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
@@ -20,8 +21,9 @@ export async function requestWriteElevation(deps, opts) {
     const result = await request(deps, {
         method: 'POST',
         url: `${opts.apiBaseUrl}/v1/oauth-clients/${encodeURIComponent(opts.oauthClientId)}/elevation-requests`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
         body: { scopes: ['mcp:tools:write'] },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/dist/dpop.js

@@ -0,0 +1,42 @@
+import { createHash, createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
+export function generateEphemeralDpopKey() {
+    const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    return { privateKeyPem, publicJwk };
+}
+function base64url(buf) {
+    return buf.toString('base64url');
+}
+export function canonicalizeHtu(input) {
+    const url = new URL(input);
+    const protocol = url.protocol.toLowerCase();
+    const isDefaultPort = (protocol === 'https:' && url.port === '443') || (protocol === 'http:' && url.port === '80');
+    const host = (isDefaultPort ? url.hostname : url.host).toLowerCase();
+    const lowerHexPath = url.pathname.replace(/%([0-9A-Fa-f]{2})/g, (_m, h) => `%${h.toLowerCase()}`);
+    const collapsed = lowerHexPath.replace(/\/{2,}/g, '/');
+    const path = collapsed.length > 1 && collapsed.endsWith('/') ? collapsed.slice(0, -1) : collapsed;
+    return `${protocol}//${host}${path}`;
+}
+export function buildDpopProof(key, claims, opts) {
+    const privateKey = createPrivateKey(key.privateKeyPem);
+    const now = opts?.nowSec ?? Math.floor(Date.now() / 1000);
+    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: key.publicJwk };
+    const payload = {
+        jti: randomUUID(),
+        htm: claims.htm,
+        htu: claims.htu,
+        iat: now,
+    };
+    if (claims.accessToken !== undefined) {
+        payload.ath = createHash('sha256').update(claims.accessToken, 'utf8').digest('base64url');
+    }
+    if (claims.nonce !== undefined) {
+        payload.nonce = claims.nonce;
+    }
+    const h64 = base64url(Buffer.from(JSON.stringify(header)));
+    const p64 = base64url(Buffer.from(JSON.stringify(payload)));
+    const signingInput = `${h64}.${p64}`;
+    const signature = cryptoSign('sha256', Buffer.from(signingInput), { key: privateKey, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${base64url(signature)}`;
+}

package/dist/env.js

@@ -1,7 +1,9 @@
+import { request } from './http.js';
 export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
 export const DEFAULT_CIMD_CLIENT_ID_URL = 'https://api.rakomi.com/.well-known/rakomi-cli/client-metadata.json';
+export const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export function isCimdClientId(id) {
     let url;
     try {
@@ -21,3 +23,33 @@ export function accountsBaseUrl(env) {
 export function clientId(env) {
     return env.RAKOMI_CLIENT_ID || DEFAULT_CIMD_CLIENT_ID_URL;
 }
+const TENANT_ID_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NIL_TENANT_ID = '00000000-0000-0000-0000-000000000000';
+const MAX_TENANT_ID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';
+export function isValidTenantId(id) {
+    if (id.length !== 36)
+        return false;
+    if (!TENANT_ID_UUID_PATTERN.test(id))
+        return false;
+    const lower = id.toLowerCase();
+    return lower !== NIL_TENANT_ID && lower !== MAX_TENANT_ID;
+}
+export function platformTenantId(env) {
+    const raw = env.RAKOMI_PLATFORM_TENANT_ID;
+    return raw && isValidTenantId(raw) ? raw : undefined;
+}
+const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
+export async function isCimdPlatformSupported(deps, apiUrl) {
+    try {
+        const result = await request(deps, {
+            method: 'GET',
+            url: `${apiUrl}/.well-known/oauth-authorization-server`,
+        });
+        if (result.status !== 200)
+            return undefined;
+        return result.body[CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD] === true;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/http.js

@@ -1,3 +1,4 @@
+import { buildDpopProof, canonicalizeHtu } from './dpop.js';
 import { CliError, EXIT } from './errors.js';
 export const DEFAULT_TIMEOUT_MS = 15_000;
 function isErrorEnvelope(v) {
@@ -25,7 +26,7 @@ export function errorCode(body) {
         return body.code;
     return undefined;
 }
-export async function request(deps, req) {
+async function performOnce(deps, req, dpopNonce) {
     const controller = new AbortController();
     const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -42,6 +43,18 @@ export async function request(deps, req) {
         }
         if (req.idempotencyKey)
             headers['idempotency-key'] = req.idempotencyKey;
+        if (req.dpop) {
+            const proof = buildDpopProof(req.dpop.key, {
+                htm: req.method,
+                htu: canonicalizeHtu(req.url),
+                accessToken: req.dpop.accessToken,
+                nonce: dpopNonce,
+            });
+            headers['dpop'] = proof;
+            if (req.dpop.accessToken !== undefined) {
+                headers['authorization'] = `DPoP ${req.dpop.accessToken}`;
+            }
+        }
         let res;
         try {
             res = await deps.fetchImpl(req.url, { method: req.method, headers, body, signal: controller.signal });
@@ -68,3 +81,24 @@ export async function request(deps, req) {
         clearTimeout(timer);
     }
 }
+function isDpopNonceChallenge(result) {
+    if (result.status !== 401)
+        return undefined;
+    if (errorCode(result.body) !== 'auth/invalid_dpop_proof')
+        return undefined;
+    const nonce = result.headers.get('dpop-nonce');
+    return nonce && nonce.length > 0 ? nonce : undefined;
+}
+export async function request(deps, req) {
+    const first = await performOnce(deps, req);
+    if (!req.dpop)
+        return first;
+    const nonce = isDpopNonceChallenge(first);
+    if (nonce === undefined)
+        return first;
+    const retry = await performOnce(deps, req, nonce);
+    if (isDpopNonceChallenge(retry) !== undefined) {
+        throw new CliError('The Rakomi API kept demanding a fresh DPoP nonce; the request could not complete.', EXIT.FAIL);
+    }
+    return retry;
+}

package/dist/index.js

@@ -6,14 +6,17 @@ import { fileURLToPath } from 'node:url';
 import { parseArgs } from 'node:util';
 import { systemBrowserOpener } from './browser.js';
 import { runConnect } from './commands/connect.js';
-import { runLogin } from './commands/login.js';
+import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
+import { runMcpToolsCi } from './commands/mcp.js';
 import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runUse } from './commands/use.js';
 import { runWhoami } from './commands/whoami.js';
 import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
 import { CliError, EXIT, UsageError } from './errors.js';
 import { startLoopbackListener } from './loopback-server.js';
 import { resolveStores } from './session.js';
+import { FileTenantConfigStore } from './tenant-config.js';
 import { helpText, usageLine } from './usage.js';
 const GLOBAL_OPTIONS = {
     json: { type: 'boolean' },
@@ -22,11 +25,14 @@ const GLOBAL_OPTIONS = {
     'dry-run': { type: 'boolean' },
     'no-browser': { type: 'boolean' },
     'no-keychain': { type: 'boolean' },
+    'oidc-token-file': { type: 'string' },
     client: { type: 'string' },
     undo: { type: 'boolean' },
     write: { type: 'boolean' },
     owner: { type: 'string' },
     slug: { type: 'string' },
+    'tenant-id': { type: 'string' },
+    tenant: { type: 'string' },
     'cimd-url': { type: 'string' },
     status: { type: 'boolean' },
     help: { type: 'boolean', short: 'h' },
@@ -74,29 +80,62 @@ async function dispatch(args, deps) {
     const httpDeps = { fetchImpl: deps.fetchImpl };
     const [command, ...rest] = positionals;
     switch (command) {
-        case 'login':
+        case 'login': {
+            if (values.ci === true) {
+                await runLoginCi({
+                    ...httpDeps,
+                    env: deps.env,
+                    ciEnv: deps.ciEnv ?? {},
+                    session: deps.session,
+                    keys: deps.keys,
+                    oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
+                    readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
+                    stdout: deps.stdout,
+                    now: () => Date.now(),
+                });
+                return EXIT.OK;
+            }
             await runLogin({
                 ...httpDeps,
                 env: deps.env,
                 session: deps.session,
+                keys: deps.keys,
                 noBrowser: values['no-browser'] === true || ci,
                 openBrowser: systemBrowserOpener(),
                 startLoopback: startLoopbackListener,
                 sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
                 stdout: deps.stdout,
                 now: () => Date.now(),
+                explicitTenantId: typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined,
             });
             return EXIT.OK;
+        }
         case 'logout':
             runLogout({ session: deps.session, stdout: deps.stdout });
             return EXIT.OK;
         case 'whoami':
-            await runWhoami({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+            await runWhoami({
+                ...httpDeps,
+                session: deps.session,
+                keys: deps.keys,
+                json,
+                stdout: deps.stdout,
+                tenantConfig: deps.tenantConfig,
+                explicitTenant: typeof values.tenant === 'string' ? values.tenant : undefined,
+            });
+            return EXIT.OK;
+        case 'use': {
+            const tenantId = rest[0];
+            if (!tenantId)
+                throw new UsageError('Usage: rakomi use <tenant-id>');
+            runUse({ tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
             return EXIT.OK;
+        }
         case 'connect':
             await runConnect({
                 ...httpDeps,
                 session: deps.session,
+                keys: deps.keys,
                 cwd: deps.cwd,
                 apiBaseUrl: apiBaseUrl(deps.env),
                 mcpUrl: deps.env.RAKOMI_API_URL ? `${apiBaseUrl(deps.env)}/mcp` : DEFAULT_MCP_URL,
@@ -111,17 +150,37 @@ async function dispatch(args, deps) {
                 status: values.status === true,
             });
             return EXIT.OK;
+        case 'mcp': {
+            const [sub] = rest;
+            if (sub !== 'tools') {
+                throw new UsageError('Usage: rakomi mcp tools --ci');
+            }
+            if (values.ci !== true) {
+                throw new UsageError('rakomi mcp tools requires --ci (workload-identity federation; no interactive form exists yet).');
+            }
+            await runMcpToolsCi({
+                ...httpDeps,
+                env: deps.env,
+                ciEnv: deps.ciEnv ?? {},
+                keys: deps.keys,
+                oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
+                readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
+                json,
+                stdout: deps.stdout,
+            });
+            return EXIT.OK;
+        }
         case 'tenants': {
             const [sub, ...tenantArgs] = rest;
             if (sub === 'create') {
                 const name = tenantArgs[0];
                 if (!name)
                     throw new UsageError('Usage: rakomi tenants create <name> [--owner me|<email>] [--slug <slug>]');
-                await runTenantsCreate({ ...httpDeps, session: deps.session, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
+                await runTenantsCreate({ ...httpDeps, session: deps.session, keys: deps.keys, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
                 return EXIT.OK;
             }
             if (sub === 'list') {
-                await runTenantsList({ ...httpDeps, session: deps.session, json, stdout: deps.stdout });
+                await runTenantsList({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
                 return EXIT.OK;
             }
             throw new UsageError('Usage: rakomi tenants <create|list> ...');
@@ -130,6 +189,11 @@ async function dispatch(args, deps) {
             throw new UsageError(`Unknown command "${command ?? ''}".`);
     }
 }
+export function printFallbackDisclosureOnce(resolved, stderr) {
+    if (resolved.fallbackDisclosure) {
+        stderr.write(resolved.fallbackDisclosure + '\n');
+    }
+}
 async function main() {
     const major = Number(process.versions.node.split('.')[0]);
     if (Number.isFinite(major) && major < 22) {
@@ -148,15 +212,21 @@ async function main() {
         RAKOMI_ACCOUNTS_URL: process.env.RAKOMI_ACCOUNTS_URL,
         RAKOMI_CLIENT_ID: process.env.RAKOMI_CLIENT_ID,
         RAKOMI_CONFIG_DIR: process.env.RAKOMI_CONFIG_DIR,
+        RAKOMI_PLATFORM_TENANT_ID: process.env.RAKOMI_PLATFORM_TENANT_ID,
         CI: process.env.CI,
         NO_COLOR: process.env.NO_COLOR,
     };
     const noKeychainEnv = process.env.RAKOMI_NO_KEYCHAIN;
+    const ciEnv = {
+        ACTIONS_ID_TOKEN_REQUEST_URL: process.env.ACTIONS_ID_TOKEN_REQUEST_URL,
+        ACTIONS_ID_TOKEN_REQUEST_TOKEN: process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+        CI_JOB_JWT_V2: process.env.CI_JOB_JWT_V2,
+        CI_JOB_JWT: process.env.CI_JOB_JWT,
+        RAKOMI_OIDC_TOKEN: process.env.RAKOMI_OIDC_TOKEN,
+    };
     const noKeychainFlag = process.argv.slice(2).includes('--no-keychain');
     const resolved = resolveStores(env, { noKeychain: noKeychainFlag || Boolean(env.CI) || Boolean(noKeychainEnv) });
-    if (resolved.fallbackDisclosure) {
-        process.stderr.write(resolved.fallbackDisclosure + '\n');
-    }
+    printFallbackDisclosureOnce(resolved, { write: (text) => void process.stderr.write(text) });
     process.exitCode = await run(process.argv.slice(2), {
         stdout: { write: (text) => void process.stdout.write(text) },
         stderr: { write: (text) => void process.stderr.write(text) },
@@ -166,7 +236,10 @@ async function main() {
         isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
         fetchImpl: fetch,
         session: resolved.session,
+        keys: resolved.keys,
+        tenantConfig: new FileTenantConfigStore(env),
         detectClaudeCode: () => detectClaudeCodeCli(),
+        ciEnv,
     });
 }
 function detectClaudeCodeCli() {

package/dist/install-key.js

@@ -0,0 +1,94 @@
+import { createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
+import { CI_FEDERATION_SESSION_CLIENT_ID, isCimdClientId } from './env.js';
+import { request } from './http.js';
+const INSTALL_KEY_NAME = 'install-key';
+const ASSERTION_LIFETIME_SEC = 60;
+function isStoredInstallKey(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    const r = v;
+    return (typeof r.clientId === 'string' &&
+        typeof r.privateKeyPem === 'string' &&
+        typeof r.publicJwk === 'object' &&
+        r.publicJwk !== null &&
+        typeof r.confirmedBound === 'boolean');
+}
+function generateKeyPair(clientId) {
+    const { publicKey, privateKey } = generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    return { clientId, privateKeyPem, publicJwk, confirmedBound: false };
+}
+export function peekInstallKey(keys, clientId) {
+    const raw = keys.get(INSTALL_KEY_NAME);
+    if (raw === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
+            return parsed;
+    }
+    catch {
+    }
+    return undefined;
+}
+export function persistInstallKey(keys, key) {
+    keys.set(INSTALL_KEY_NAME, JSON.stringify(key));
+}
+export function getOrCreateInstallKey(keys, clientId) {
+    const existing = peekInstallKey(keys, clientId);
+    if (existing)
+        return existing;
+    const fresh = generateKeyPair(clientId);
+    persistInstallKey(keys, fresh);
+    return fresh;
+}
+function base64url(buf) {
+    return buf.toString('base64url');
+}
+export function signClientAssertion(key, opts) {
+    const privateKey = createPrivateKey(key.privateKeyPem);
+    const now = opts.nowSec ?? Math.floor(Date.now() / 1000);
+    const header = { alg: 'ES256', typ: 'JWT' };
+    const payload = {
+        iss: opts.clientId,
+        sub: opts.clientId,
+        aud: opts.audience,
+        jti: randomUUID(),
+        iat: now,
+        exp: now + ASSERTION_LIFETIME_SEC,
+    };
+    const h64 = base64url(Buffer.from(JSON.stringify(header)));
+    const p64 = base64url(Buffer.from(JSON.stringify(payload)));
+    const signingInput = `${h64}.${p64}`;
+    const signature = cryptoSign('sha256', Buffer.from(signingInput), { key: privateKey, dsaEncoding: 'ieee-p1363' });
+    return `${signingInput}.${base64url(signature)}`;
+}
+export async function bindInstallKey(deps, keys, opts, key) {
+    try {
+        const result = await request(deps, {
+            method: 'POST',
+            url: `${opts.apiBaseUrl}/v1/oauth-clients/install-key`,
+            headers: opts.dpopBound ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+            body: { client_id: opts.clientId, jwk: key.publicJwk },
+            dpop: opts.dpopBound ? { key, accessToken: opts.accessToken } : undefined,
+        });
+        if (result.status !== 200)
+            return { attempted: true, bound: false };
+        const bound = result.body.bound === true;
+        if (bound !== key.confirmedBound) {
+            keys.set(INSTALL_KEY_NAME, JSON.stringify({ ...key, confirmedBound: bound }));
+        }
+        return { attempted: true, bound };
+    }
+    catch {
+        return { attempted: false, bound: false };
+    }
+}
+export function resolveDpopKey(keys, session) {
+    if (session.token_type !== 'DPoP')
+        return undefined;
+    if (!isCimdClientId(session.client_id) && session.client_id !== CI_FEDERATION_SESSION_CLIENT_ID)
+        return undefined;
+    return getOrCreateInstallKey(keys, session.client_id);
+}

package/dist/mcp-tools-ci.js

@@ -0,0 +1,44 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export const MCP_RESOURCE = 'https://mcp.rakomi.com';
+const MCP_PROTOCOL_VERSION = '2026-07-28';
+const MCP_PROTOCOL_VERSION_HEADER = 'MCP-Protocol-Version';
+const MCP_METHOD_HEADER = 'Mcp-Method';
+const MCP_META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+const MCP_META_CLIENT_CAPABILITIES_KEY = 'io.modelcontextprotocol/clientCapabilities';
+function isJsonRpcError(body) {
+    return typeof body === 'object' && body !== null && 'error' in body;
+}
+export async function listMcpToolsCi(deps, opts) {
+    const message = {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/list',
+        params: {
+            _meta: {
+                [MCP_META_PROTOCOL_VERSION_KEY]: MCP_PROTOCOL_VERSION,
+                [MCP_META_CLIENT_CAPABILITIES_KEY]: {},
+            },
+        },
+    };
+    const result = await request(deps, {
+        method: 'POST',
+        url: opts.mcpUrl,
+        headers: {
+            [MCP_PROTOCOL_VERSION_HEADER]: MCP_PROTOCOL_VERSION,
+            [MCP_METHOD_HEADER]: 'tools/list',
+        },
+        body: message,
+        dpop: { key: opts.dpopKey, accessToken: opts.accessToken },
+    });
+    if (result.status === 401) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    if (isJsonRpcError(result.body)) {
+        throw new CliError(`Could not list MCP tools: ${result.body.error.message}`, EXIT.FAIL);
+    }
+    if (result.status !== 200 || typeof result.body !== 'object' || result.body === null || !('result' in result.body)) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body.result.tools;
+}

package/dist/oauth-authcode.js

@@ -9,6 +9,8 @@ export function buildAuthorizeUrl(opts) {
     url.searchParams.set('state', opts.pkce.state);
     url.searchParams.set('code_challenge', opts.pkce.codeChallenge);
     url.searchParams.set('code_challenge_method', opts.pkce.codeChallengeMethod);
+    if (opts.tenantId)
+        url.searchParams.set('tenant_id', opts.tenantId);
     return url.toString();
 }
 export async function exchangeAuthorizationCode(deps, opts) {
@@ -21,7 +23,14 @@ export async function exchangeAuthorizationCode(deps, opts) {
             redirect_uri: opts.redirectUri,
             client_id: opts.clientId,
             code_verifier: opts.codeVerifier,
+            ...(opts.clientAssertion
+                ? {
+                    client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+                    client_assertion: opts.clientAssertion,
+                }
+                : {}),
         },
+        dpop: opts.dpopKey ? { key: opts.dpopKey } : undefined,
     });
     if (result.status !== 200) {
         throw new CliError(`Could not complete sign-in: ${describeError(result.body, result.status)}`, EXIT.FAIL);

package/dist/oidc-federation-login.js

@@ -0,0 +1,23 @@
+import { buildDpopProof, canonicalizeHtu } from './dpop.js';
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export const OIDC_FEDERATION_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
+export async function exchangeOidcSubjectToken(deps, opts) {
+    const tokenUrl = `${opts.apiBaseUrl}/oauth/token`;
+    const proof = buildDpopProof(opts.dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
+    const result = await request(deps, {
+        method: 'POST',
+        url: tokenUrl,
+        headers: { dpop: proof },
+        form: {
+            grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
+            subject_token: opts.subjectToken,
+            subject_token_type: OIDC_FEDERATION_SUBJECT_TOKEN_TYPE,
+            resource: opts.resource,
+        },
+    });
+    if (result.status !== 200) {
+        throw new CliError(`Could not sign in from CI: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/pkce.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function generateCodeVerifier() {
     return base64url(randomBytes(32));

package/dist/session.js

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { delimiter, join } from 'node:path';
+import { CliError } from './errors.js';
 export function configDir(env) {
     if (env.RAKOMI_CONFIG_DIR)
         return env.RAKOMI_CONFIG_DIR;
@@ -49,12 +50,18 @@ export class FileSessionStore {
         return this.path;
     }
 }
+function assertValidKeyName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(name)) {
+        throw new TypeError(`invalid KeyStore name: ${JSON.stringify(name)} (expected 1-128 chars, alphanumeric/hyphen/underscore only, no path separators)`);
+    }
+}
 export class FileKeyStore {
     dir;
     constructor(dir) {
         this.dir = dir;
     }
     path(name) {
+        assertValidKeyName(name);
         return join(this.dir, `key-${name}.json`);
     }
     get(name) {
@@ -88,20 +95,50 @@ function isStoredSession(value) {
     const v = value;
     return (typeof v.access_token === 'string' &&
         v.access_token.length > 0 &&
-        v.token_type === 'Bearer' &&
+        (v.token_type === 'Bearer' || v.token_type === 'DPoP') &&
         typeof v.expires_at === 'number' &&
         typeof v.api_base_url === 'string' &&
-        typeof v.client_id === 'string');
+        typeof v.client_id === 'string' &&
+        (v.home_tenant_id === undefined || typeof v.home_tenant_id === 'string'));
 }
 export function isExpired(session, now) {
     return now >= session.expires_at;
 }
+export class ExecFileFailure extends Error {
+    command;
+    status;
+    stderrOutput;
+    constructor(command, status, stderrOutput) {
+        super(`${command} exited with status ${status ?? 'unknown'}${stderrOutput.length > 0 ? `: ${stderrOutput}` : ''}`);
+        this.command = command;
+        this.status = status;
+        this.stderrOutput = stderrOutput;
+        this.name = 'ExecFileFailure';
+    }
+}
 function realExecFileSync(file, args, options) {
-    return execFileSync(file, [...args], { encoding: 'utf8', input: options?.input, maxBuffer: 10 * 1024 * 1024 }).toString();
+    try {
+        return execFileSync(file, [...args], {
+            encoding: 'utf8',
+            input: options?.input,
+            maxBuffer: 10 * 1024 * 1024,
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).toString();
+    }
+    catch (e) {
+        const err = e;
+        const rawStderr = err.stderr;
+        const stderrOutput = (typeof rawStderr === 'string' ? rawStderr : rawStderr?.toString('utf8')) ?? '';
+        throw new ExecFileFailure(file, err.status ?? null, stderrOutput.trim());
+    }
 }
 function commandExistsOnPath(binaryName, pathEnv, existsFn) {
     return pathEnv.split(delimiter).some((dir) => dir.length > 0 && existsFn(join(dir, binaryName)));
 }
+function keychainReadFailure(backendLabel, cause) {
+    const detail = cause instanceof ExecFileFailure && cause.stderrOutput.length > 0 ? cause.stderrOutput : cause instanceof Error ? cause.message : String(cause);
+    return new CliError(`Could not read your session from ${backendLabel}: ${detail}`);
+}
 export class MacKeychainBackend {
     execFileSyncFn;
     platform;
@@ -127,8 +164,10 @@ export class MacKeychainBackend {
             const value = out.trim();
             return value.length > 0 ? value : null;
         }
-        catch {
-            return null;
+        catch (e) {
+            if (e instanceof ExecFileFailure && e.status === 44)
+                return null;
+            throw keychainReadFailure('macOS Keychain', e);
         }
     }
     set(service, account, value) {
@@ -165,8 +204,10 @@ export class LinuxSecretToolBackend {
             const value = out.replace(/\n$/, '');
             return value.length > 0 ? value : null;
         }
-        catch {
-            return null;
+        catch (e) {
+            if (e instanceof ExecFileFailure && e.stderrOutput.length === 0)
+                return null;
+            throw keychainReadFailure('the Linux Secret Service', e);
         }
     }
     set(service, account, value) {
@@ -227,7 +268,13 @@ export class WindowsDpapiBackend {
         const valueB64 = Buffer.from(value, 'utf8').toString('base64');
         const script = `[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect([Convert]::FromBase64String('${valueB64}'), $null, 'CurrentUser'))`;
         const cipherB64 = this.execFileSyncFn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]).trim();
-        writeFileSync(this.filePath(service, account), cipherB64 + '\n', { mode: 0o600 });
+        const path = this.filePath(service, account);
+        writeFileSync(path, cipherB64 + '\n', { mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+        }
     }
     delete(service, account) {
         try {
@@ -286,12 +333,25 @@ export class KeychainKeyStore {
         this.backend = backend;
     }
     get(name) {
+        try {
+            assertValidKeyName(name);
+        }
+        catch {
+            return null;
+        }
         return this.backend.get(KEY_SERVICE, name);
     }
     set(name, value) {
+        assertValidKeyName(name);
         this.backend.set(KEY_SERVICE, name, value);
     }
     clear(name) {
+        try {
+            assertValidKeyName(name);
+        }
+        catch {
+            return;
+        }
         this.backend.delete(KEY_SERVICE, name);
     }
 }

package/dist/tenant-config.js

@@ -0,0 +1,50 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { configDir } from './session.js';
+function isStoredTenantConfig(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return typeof v.active_tenant_id === 'string' && v.active_tenant_id.length > 0;
+}
+function tenantConfigFilePath(env) {
+    return join(configDir(env), 'tenant.json');
+}
+export class FileTenantConfigStore {
+    path;
+    dir;
+    constructor(env) {
+        this.dir = configDir(env);
+        this.path = tenantConfigFilePath(env);
+    }
+    read() {
+        try {
+            const raw = readFileSync(this.path, 'utf8');
+            const parsed = JSON.parse(raw);
+            return isStoredTenantConfig(parsed) ? parsed.active_tenant_id : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    write(tenantId) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        const config = { active_tenant_id: tenantId };
+        writeFileSync(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+        }
+    }
+    clear() {
+        try {
+            rmSync(this.path, { force: true });
+        }
+        catch {
+        }
+    }
+    describePath() {
+        return this.path;
+    }
+}

package/dist/tenants-client.js

@@ -16,9 +16,10 @@ export async function createTenant(deps, opts) {
     const result = await request(deps, {
         method: 'POST',
         url: `${opts.apiBaseUrl}/v1/tenants`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
         body: { name: opts.name, ...(opts.slug ? { slug: opts.slug } : {}), ...(opts.ownerEmail ? { owner_email: opts.ownerEmail } : {}) },
         idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
@@ -46,7 +47,8 @@ export async function listTenants(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: url.toString(),
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/dist/usage.js

@@ -7,8 +7,12 @@ export function helpText() {
         '',
         'Commands:',
         '  login                    sign in (browser by default; --no-browser for a device code)',
+        '    --ci                   sign in from CI via the runner\'s own OIDC identity (no browser/device code)',
+        '    --oidc-token-file <p>  read the OIDC token from a file instead of the CI platform\'s own env',
+        '    --tenant-id <uuid>     the tenant to authenticate against (or set RAKOMI_PLATFORM_TENANT_ID)',
         '  logout                   clear the local session',
-        '  whoami                   show the signed-in account',
+        '  whoami                   show the signed-in account, home tenant, and active tenant',
+        '  use <tenant-id>          remember a tenant id locally for whoami/future commands (a value, not a verified membership)',
         '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
         '    --write                also request write access for the connected client',
         '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
@@ -19,6 +23,7 @@ export function helpText() {
         '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
         '    --slug <slug>          optional; auto-derived + suffixed if omitted',
         '  tenants list             list tenants you provisioned',
+        '  mcp tools --ci           list MCP read tools your CI identity can invoke (no login needed first)',
         '',
         'Global options:',
         '  --json                   machine-readable output',
@@ -26,6 +31,7 @@ export function helpText() {
         '  --dry-run                print what would happen, make no writes or mutating calls',
         '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
         '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
+        '  --tenant <id>            override the active tenant for this invocation (whoami only today)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/dist/userinfo-client.js

@@ -4,7 +4,8 @@ export async function fetchUserInfo(deps, opts) {
     const result = await request(deps, {
         method: 'GET',
         url: `${opts.apiBaseUrl}/oauth/userinfo`,
-        headers: { authorization: `Bearer ${opts.accessToken}` },
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
     });
     if (result.status === 401) {
         throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.1.1",
+      "bom-ref": "pkg:npm/rakomi@0.2.0",
       "name": "rakomi",
-      "version": "0.1.1",
-      "purl": "pkg:npm/rakomi@0.1.1",
+      "version": "0.2.0",
+      "purl": "pkg:npm/rakomi@0.2.0",
       "licenses": [
         {
           "license": {