rakomi 0.1.2 → 0.2.0

package/README.md

@@ -9,7 +9,15 @@ npx rakomi login
 ```
 
 Signs you in with your browser (loopback OAuth + PKCE). Add `--no-browser` on a headless/SSH
-session to get a short code to enter on another device instead.
+session to get a short code to enter on another device instead. If you don't already have a
+`accounts.rakomi.com` session or an invitation link, pass `--tenant-id <uuid>` (or set
+`RAKOMI_PLATFORM_TENANT_ID`) so sign-in knows which tenant to authenticate against — ask your
+Rakomi administrator for the right value.
+
+`rakomi whoami` shows the tenant you signed in against ("Home tenant") and the tenant your other
+commands should treat as active ("Active tenant"). `rakomi use <tenant-id>` remembers a tenant id
+locally for that; `--tenant <tenant-id>` overrides it for one command. Neither is a verified
+grant — the tenant `whoami` shows as your Home tenant is the only one the server has confirmed.
 
 ## Connect an AI agent
 
@@ -45,7 +53,8 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | --- | --- |
 | `login` | sign in (browser by default; `--no-browser` for a device code) |
 | `logout` | clear the local session |
-| `whoami` | show the signed-in account |
+| `whoami` | show the signed-in account, home tenant, and active tenant |
+| `use <tenant-id>` | remember a tenant id locally for `whoami`/future commands |
 | `connect` | connect Claude Code / Claude Desktop to your tenant (read access) |
 | `tenants create <name>` | create a tenant (`--owner me\|<email>`, `--slug <slug>`) |
 | `tenants list` | list tenants you provisioned |
@@ -59,6 +68,8 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `--dry-run` | print what would happen, make no writes or mutating calls |
 | `--no-browser` | use the device-code flow instead of opening a browser |
 | `--no-keychain` | store the session in a `0600` file instead of the OS keychain |
+| `--tenant-id <uuid>` | (`login`) the tenant to sign in against, if `RAKOMI_PLATFORM_TENANT_ID` isn't set for you |
+| `--tenant <tenant-id>` | override the active tenant for a single command (`whoami` today) |
 | `--client <name>` | `claude-code` or `claude-desktop` — required when more than one applies |
 | `--undo` | restore the `.mcp.json` `connect` last backed up |
 | `--cimd-url <url>` | (`connect`) the connecting client's own CIMD document URL — confirms/re-checks the connection |

package/dist/commands/login.js

@@ -1,7 +1,8 @@
 import { resolveCiOidcToken } from '../ci-oidc-token.js';
-import { accountsBaseUrl, apiBaseUrl, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, } from '../env.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { accountsBaseUrl, apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, isValidTenantId, platformTenantId, } from '../env.js';
 import { CliError, EXIT } from '../errors.js';
-import { bindInstallKey, getOrCreateInstallKey, signClientAssertion } from '../install-key.js';
+import { bindInstallKey, getOrCreateInstallKey, peekInstallKey, persistInstallKey, signClientAssertion, } from '../install-key.js';
 import { buildAuthorizeUrl, exchangeAuthorizationCode } from '../oauth-authcode.js';
 import { loginWithDeviceGrant } from '../oauth-device.js';
 import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
@@ -14,6 +15,25 @@ function cimdUnsupportedMessage(cid) {
         'the dashboard, then run `rakomi login --client <your-client-id>` (or set RAKOMI_CLIENT_ID) ' +
         'instead.');
 }
+function platformTenantMissingMessage() {
+    return ('rakomi login needs to know which tenant to authenticate your account against. Set ' +
+        'RAKOMI_PLATFORM_TENANT_ID to a real tenant UUID, or pass --tenant-id <uuid>. If neither is ' +
+        'set, this Rakomi environment likely does not have a platform tenant provisioned yet — ask ' +
+        'your operator.');
+}
+function explicitTenantIdMalformedMessage(value) {
+    return (`--tenant-id "${value}" is not a valid tenant id — expected a well-formed UUID (not the nil ` +
+        'or max UUID). Pass the real tenant id, or omit --tenant-id to fall back to RAKOMI_PLATFORM_TENANT_ID.');
+}
+function resolvePlatformTenantId(env, explicit) {
+    if (explicit !== undefined) {
+        if (!isValidTenantId(explicit)) {
+            throw new CliError(explicitTenantIdMalformedMessage(explicit), EXIT.FAIL);
+        }
+        return explicit;
+    }
+    return platformTenantId(env);
+}
 export async function runLogin(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const cid = resolveClientId(deps.env);
@@ -29,9 +49,16 @@ export async function runLogin(deps) {
         }
     }
     const installKey = isCimdClientId(cid) ? getOrCreateInstallKey(deps.keys, cid) : undefined;
+    let tenantId;
+    if (!deps.noBrowser && isCimdClientId(cid)) {
+        tenantId = resolvePlatformTenantId(deps.env, deps.explicitTenantId);
+        if (!tenantId) {
+            throw new CliError(platformTenantMissingMessage(), EXIT.FAIL);
+        }
+    }
     const token = deps.noBrowser
         ? await runDeviceGrantLogin(deps, apiUrl, cid)
-        : await runLoopbackLogin(deps, apiUrl, cid, installKey);
+        : await runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId);
     const session = {
         access_token: token.access_token,
         refresh_token: token.refresh_token,
@@ -39,6 +66,7 @@ export async function runLogin(deps) {
         expires_at: deps.now() + token.expires_in * 1000,
         api_base_url: apiUrl,
         client_id: cid,
+        ...(tenantId ? { home_tenant_id: tenantId } : {}),
     };
     if (token.token_type !== 'Bearer' && token.token_type !== 'DPoP') {
         deps.stdout.write(`(debug) unexpected token_type "${token.token_type}" from the server — treating this session as Bearer.\n`);
@@ -49,7 +77,7 @@ export async function runLogin(deps) {
         await bindInstallKey(deps, deps.keys, { apiBaseUrl: apiUrl, clientId: cid, accessToken: token.access_token, dpopBound: session.token_type === 'DPoP' }, installKey);
     }
 }
-async function runLoopbackLogin(deps, apiUrl, cid, installKey) {
+async function runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId) {
     const listener = await deps.startLoopback();
     try {
         const pkce = generatePkcePair();
@@ -59,6 +87,7 @@ async function runLoopbackLogin(deps, apiUrl, cid, installKey) {
             redirectUri: listener.redirectUri,
             pkce,
             scope: LOGIN_SCOPE,
+            tenantId,
         });
         deps.stdout.write(`Opening your browser to sign in:\n  ${authorizeUrl}\n`);
         await deps.openBrowser(authorizeUrl);
@@ -94,7 +123,6 @@ async function runDeviceGrantLogin(deps, apiUrl, cid) {
         },
     }, { apiBaseUrl: apiUrl, clientId: cid, scope: LOGIN_SCOPE });
 }
-const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export async function runLoginCi(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const subjectToken = await resolveCiOidcToken(deps, {
@@ -103,7 +131,11 @@ export async function runLoginCi(deps) {
         readTextFile: deps.readTextFile,
         audience: apiUrl,
     });
-    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl, dpopKey });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
     const session = {
         access_token: token.access_token,
         token_type: token.token_type,

package/dist/commands/mcp.js

@@ -0,0 +1,45 @@
+import { resolveCiOidcToken } from '../ci-oidc-token.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, DEFAULT_MCP_URL } from '../env.js';
+import { getOrCreateInstallKey, peekInstallKey, persistInstallKey } from '../install-key.js';
+import { listMcpToolsCi, MCP_RESOURCE } from '../mcp-tools-ci.js';
+import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
+function hintLine(t) {
+    const hints = [];
+    if (t.annotations?.readOnlyHint)
+        hints.push('read-only');
+    if (t.annotations?.idempotentHint)
+        hints.push('idempotent');
+    return hints.length > 0 ? ` (${hints.join(', ')})` : '';
+}
+export async function runMcpToolsCi(deps) {
+    const apiUrl = apiBaseUrl(deps.env);
+    const mcpUrl = deps.env.RAKOMI_API_URL ? `${apiUrl}/mcp` : DEFAULT_MCP_URL;
+    const subjectToken = await resolveCiOidcToken(deps, {
+        env: deps.ciEnv,
+        oidcTokenFile: deps.oidcTokenFile,
+        readTextFile: deps.readTextFile,
+        audience: MCP_RESOURCE,
+    });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, {
+        apiBaseUrl: apiUrl,
+        subjectToken,
+        resource: MCP_RESOURCE,
+        dpopKey,
+    });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
+    const resolvedKey = getOrCreateInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const tools = await listMcpToolsCi(deps, { mcpUrl, accessToken: token.access_token, dpopKey: resolvedKey });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ tools }) + '\n');
+        return;
+    }
+    if (tools.length === 0) {
+        deps.stdout.write('No MCP tools visible to this CI identity.\n');
+        return;
+    }
+    deps.stdout.write(tools.map((t) => `${t.name}${hintLine(t)} — ${t.description}`).join('\n') + '\n');
+}

package/dist/commands/use.js

@@ -0,0 +1,10 @@
+import { isValidTenantId } from '../env.js';
+import { UsageError } from '../errors.js';
+export function runUse(deps, args) {
+    if (!isValidTenantId(args.tenantId)) {
+        throw new UsageError(`"${args.tenantId}" is not a valid tenant id — expected a UUID (e.g. the value \`rakomi login\` ` +
+            'printed as "Home tenant", or the id shown in the dashboard).');
+    }
+    deps.tenantConfig.write(args.tenantId);
+    deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+}

package/dist/commands/whoami.js

@@ -7,6 +7,7 @@ export async function runWhoami(deps) {
         throw new NotLoggedInError();
     const dpop = resolveDpopKey(deps.keys, session);
     const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, dpop });
+    const activeTenantId = deps.explicitTenant ?? deps.tenantConfig.read() ?? undefined;
     if (deps.json) {
         deps.stdout.write(JSON.stringify({
             sub: info.sub,
@@ -15,6 +16,8 @@ export async function runWhoami(deps) {
             org_role: info.org_role,
             session_store: deps.session.describePath(),
             token_type: session.token_type,
+            home_tenant_id: session.home_tenant_id,
+            active_tenant_id: activeTenantId,
         }) + '\n');
         return;
     }
@@ -22,6 +25,8 @@ export async function runWhoami(deps) {
     if (info.org_id)
         lines.push(`Organization: ${info.org_id}${info.org_role ? ` (${info.org_role})` : ''}`);
     lines.push(`API: ${session.api_base_url}`);
+    lines.push(`Home tenant: ${session.home_tenant_id ?? 'unknown (this session did not authenticate via the CIMD-default flow)'}`);
+    lines.push(`Active tenant: ${activeTenantId ?? 'none set (run `rakomi use <tenant-id>`)'}`);
     lines.push(`Session stored in: ${deps.session.describePath()}`);
     lines.push(`Token type: ${session.token_type}`);
     deps.stdout.write(lines.join('\n') + '\n');

package/dist/dpop.js

@@ -6,7 +6,7 @@ export function generateEphemeralDpopKey() {
     return { privateKeyPem, publicJwk };
 }
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function canonicalizeHtu(input) {
     const url = new URL(input);

package/dist/env.js

@@ -3,6 +3,7 @@ export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
 export const DEFAULT_CIMD_CLIENT_ID_URL = 'https://api.rakomi.com/.well-known/rakomi-cli/client-metadata.json';
+export const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export function isCimdClientId(id) {
     let url;
     try {
@@ -22,6 +23,21 @@ export function accountsBaseUrl(env) {
 export function clientId(env) {
     return env.RAKOMI_CLIENT_ID || DEFAULT_CIMD_CLIENT_ID_URL;
 }
+const TENANT_ID_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NIL_TENANT_ID = '00000000-0000-0000-0000-000000000000';
+const MAX_TENANT_ID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';
+export function isValidTenantId(id) {
+    if (id.length !== 36)
+        return false;
+    if (!TENANT_ID_UUID_PATTERN.test(id))
+        return false;
+    const lower = id.toLowerCase();
+    return lower !== NIL_TENANT_ID && lower !== MAX_TENANT_ID;
+}
+export function platformTenantId(env) {
+    const raw = env.RAKOMI_PLATFORM_TENANT_ID;
+    return raw && isValidTenantId(raw) ? raw : undefined;
+}
 const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
 export async function isCimdPlatformSupported(deps, apiUrl) {
     try {

package/dist/index.js

@@ -8,12 +8,15 @@ import { systemBrowserOpener } from './browser.js';
 import { runConnect } from './commands/connect.js';
 import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
+import { runMcpToolsCi } from './commands/mcp.js';
 import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runUse } from './commands/use.js';
 import { runWhoami } from './commands/whoami.js';
 import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
 import { CliError, EXIT, UsageError } from './errors.js';
 import { startLoopbackListener } from './loopback-server.js';
 import { resolveStores } from './session.js';
+import { FileTenantConfigStore } from './tenant-config.js';
 import { helpText, usageLine } from './usage.js';
 const GLOBAL_OPTIONS = {
     json: { type: 'boolean' },
@@ -28,6 +31,8 @@ const GLOBAL_OPTIONS = {
     write: { type: 'boolean' },
     owner: { type: 'string' },
     slug: { type: 'string' },
+    'tenant-id': { type: 'string' },
+    tenant: { type: 'string' },
     'cimd-url': { type: 'string' },
     status: { type: 'boolean' },
     help: { type: 'boolean', short: 'h' },
@@ -82,6 +87,7 @@ async function dispatch(args, deps) {
                     env: deps.env,
                     ciEnv: deps.ciEnv ?? {},
                     session: deps.session,
+                    keys: deps.keys,
                     oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
                     readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
                     stdout: deps.stdout,
@@ -100,6 +106,7 @@ async function dispatch(args, deps) {
                 sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
                 stdout: deps.stdout,
                 now: () => Date.now(),
+                explicitTenantId: typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined,
             });
             return EXIT.OK;
         }
@@ -107,8 +114,23 @@ async function dispatch(args, deps) {
             runLogout({ session: deps.session, stdout: deps.stdout });
             return EXIT.OK;
         case 'whoami':
-            await runWhoami({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+            await runWhoami({
+                ...httpDeps,
+                session: deps.session,
+                keys: deps.keys,
+                json,
+                stdout: deps.stdout,
+                tenantConfig: deps.tenantConfig,
+                explicitTenant: typeof values.tenant === 'string' ? values.tenant : undefined,
+            });
+            return EXIT.OK;
+        case 'use': {
+            const tenantId = rest[0];
+            if (!tenantId)
+                throw new UsageError('Usage: rakomi use <tenant-id>');
+            runUse({ tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
             return EXIT.OK;
+        }
         case 'connect':
             await runConnect({
                 ...httpDeps,
@@ -128,6 +150,26 @@ async function dispatch(args, deps) {
                 status: values.status === true,
             });
             return EXIT.OK;
+        case 'mcp': {
+            const [sub] = rest;
+            if (sub !== 'tools') {
+                throw new UsageError('Usage: rakomi mcp tools --ci');
+            }
+            if (values.ci !== true) {
+                throw new UsageError('rakomi mcp tools requires --ci (workload-identity federation; no interactive form exists yet).');
+            }
+            await runMcpToolsCi({
+                ...httpDeps,
+                env: deps.env,
+                ciEnv: deps.ciEnv ?? {},
+                keys: deps.keys,
+                oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
+                readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
+                json,
+                stdout: deps.stdout,
+            });
+            return EXIT.OK;
+        }
         case 'tenants': {
             const [sub, ...tenantArgs] = rest;
             if (sub === 'create') {
@@ -170,6 +212,7 @@ async function main() {
         RAKOMI_ACCOUNTS_URL: process.env.RAKOMI_ACCOUNTS_URL,
         RAKOMI_CLIENT_ID: process.env.RAKOMI_CLIENT_ID,
         RAKOMI_CONFIG_DIR: process.env.RAKOMI_CONFIG_DIR,
+        RAKOMI_PLATFORM_TENANT_ID: process.env.RAKOMI_PLATFORM_TENANT_ID,
         CI: process.env.CI,
         NO_COLOR: process.env.NO_COLOR,
     };
@@ -194,6 +237,7 @@ async function main() {
         fetchImpl: fetch,
         session: resolved.session,
         keys: resolved.keys,
+        tenantConfig: new FileTenantConfigStore(env),
         detectClaudeCode: () => detectClaudeCodeCli(),
         ciEnv,
     });

package/dist/install-key.js

@@ -1,5 +1,5 @@
 import { createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
-import { isCimdClientId } from './env.js';
+import { CI_FEDERATION_SESSION_CLIENT_ID, isCimdClientId } from './env.js';
 import { request } from './http.js';
 const INSTALL_KEY_NAME = 'install-key';
 const ASSERTION_LIFETIME_SEC = 60;
@@ -19,23 +19,32 @@ function generateKeyPair(clientId) {
     const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
     return { clientId, privateKeyPem, publicJwk, confirmedBound: false };
 }
-export function getOrCreateInstallKey(keys, clientId) {
+export function peekInstallKey(keys, clientId) {
     const raw = keys.get(INSTALL_KEY_NAME);
-    if (raw !== null) {
-        try {
-            const parsed = JSON.parse(raw);
-            if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
-                return parsed;
-        }
-        catch {
-        }
+    if (raw === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
+            return parsed;
     }
+    catch {
+    }
+    return undefined;
+}
+export function persistInstallKey(keys, key) {
+    keys.set(INSTALL_KEY_NAME, JSON.stringify(key));
+}
+export function getOrCreateInstallKey(keys, clientId) {
+    const existing = peekInstallKey(keys, clientId);
+    if (existing)
+        return existing;
     const fresh = generateKeyPair(clientId);
-    keys.set(INSTALL_KEY_NAME, JSON.stringify(fresh));
+    persistInstallKey(keys, fresh);
     return fresh;
 }
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function signClientAssertion(key, opts) {
     const privateKey = createPrivateKey(key.privateKeyPem);
@@ -79,7 +88,7 @@ export async function bindInstallKey(deps, keys, opts, key) {
 export function resolveDpopKey(keys, session) {
     if (session.token_type !== 'DPoP')
         return undefined;
-    if (!isCimdClientId(session.client_id))
+    if (!isCimdClientId(session.client_id) && session.client_id !== CI_FEDERATION_SESSION_CLIENT_ID)
         return undefined;
     return getOrCreateInstallKey(keys, session.client_id);
 }

package/dist/mcp-tools-ci.js

@@ -0,0 +1,44 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export const MCP_RESOURCE = 'https://mcp.rakomi.com';
+const MCP_PROTOCOL_VERSION = '2026-07-28';
+const MCP_PROTOCOL_VERSION_HEADER = 'MCP-Protocol-Version';
+const MCP_METHOD_HEADER = 'Mcp-Method';
+const MCP_META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+const MCP_META_CLIENT_CAPABILITIES_KEY = 'io.modelcontextprotocol/clientCapabilities';
+function isJsonRpcError(body) {
+    return typeof body === 'object' && body !== null && 'error' in body;
+}
+export async function listMcpToolsCi(deps, opts) {
+    const message = {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/list',
+        params: {
+            _meta: {
+                [MCP_META_PROTOCOL_VERSION_KEY]: MCP_PROTOCOL_VERSION,
+                [MCP_META_CLIENT_CAPABILITIES_KEY]: {},
+            },
+        },
+    };
+    const result = await request(deps, {
+        method: 'POST',
+        url: opts.mcpUrl,
+        headers: {
+            [MCP_PROTOCOL_VERSION_HEADER]: MCP_PROTOCOL_VERSION,
+            [MCP_METHOD_HEADER]: 'tools/list',
+        },
+        body: message,
+        dpop: { key: opts.dpopKey, accessToken: opts.accessToken },
+    });
+    if (result.status === 401) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    if (isJsonRpcError(result.body)) {
+        throw new CliError(`Could not list MCP tools: ${result.body.error.message}`, EXIT.FAIL);
+    }
+    if (result.status !== 200 || typeof result.body !== 'object' || result.body === null || !('result' in result.body)) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body.result.tools;
+}

package/dist/oauth-authcode.js

@@ -9,6 +9,8 @@ export function buildAuthorizeUrl(opts) {
     url.searchParams.set('state', opts.pkce.state);
     url.searchParams.set('code_challenge', opts.pkce.codeChallenge);
     url.searchParams.set('code_challenge_method', opts.pkce.codeChallengeMethod);
+    if (opts.tenantId)
+        url.searchParams.set('tenant_id', opts.tenantId);
     return url.toString();
 }
 export async function exchangeAuthorizationCode(deps, opts) {

package/dist/oidc-federation-login.js

@@ -1,11 +1,10 @@
-import { buildDpopProof, canonicalizeHtu, generateEphemeralDpopKey } from './dpop.js';
+import { buildDpopProof, canonicalizeHtu } from './dpop.js';
 import { CliError, EXIT } from './errors.js';
 import { describeError, request } from './http.js';
 export const OIDC_FEDERATION_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
 export async function exchangeOidcSubjectToken(deps, opts) {
     const tokenUrl = `${opts.apiBaseUrl}/oauth/token`;
-    const dpopKey = generateEphemeralDpopKey();
-    const proof = buildDpopProof(dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
+    const proof = buildDpopProof(opts.dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
     const result = await request(deps, {
         method: 'POST',
         url: tokenUrl,

package/dist/pkce.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function generateCodeVerifier() {
     return base64url(randomBytes(32));

package/dist/session.js

@@ -98,7 +98,8 @@ function isStoredSession(value) {
         (v.token_type === 'Bearer' || v.token_type === 'DPoP') &&
         typeof v.expires_at === 'number' &&
         typeof v.api_base_url === 'string' &&
-        typeof v.client_id === 'string');
+        typeof v.client_id === 'string' &&
+        (v.home_tenant_id === undefined || typeof v.home_tenant_id === 'string'));
 }
 export function isExpired(session, now) {
     return now >= session.expires_at;

package/dist/tenant-config.js

@@ -0,0 +1,50 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { configDir } from './session.js';
+function isStoredTenantConfig(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return typeof v.active_tenant_id === 'string' && v.active_tenant_id.length > 0;
+}
+function tenantConfigFilePath(env) {
+    return join(configDir(env), 'tenant.json');
+}
+export class FileTenantConfigStore {
+    path;
+    dir;
+    constructor(env) {
+        this.dir = configDir(env);
+        this.path = tenantConfigFilePath(env);
+    }
+    read() {
+        try {
+            const raw = readFileSync(this.path, 'utf8');
+            const parsed = JSON.parse(raw);
+            return isStoredTenantConfig(parsed) ? parsed.active_tenant_id : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    write(tenantId) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        const config = { active_tenant_id: tenantId };
+        writeFileSync(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+        }
+    }
+    clear() {
+        try {
+            rmSync(this.path, { force: true });
+        }
+        catch {
+        }
+    }
+    describePath() {
+        return this.path;
+    }
+}

package/dist/usage.js

@@ -9,8 +9,10 @@ export function helpText() {
         '  login                    sign in (browser by default; --no-browser for a device code)',
         '    --ci                   sign in from CI via the runner\'s own OIDC identity (no browser/device code)',
         '    --oidc-token-file <p>  read the OIDC token from a file instead of the CI platform\'s own env',
+        '    --tenant-id <uuid>     the tenant to authenticate against (or set RAKOMI_PLATFORM_TENANT_ID)',
         '  logout                   clear the local session',
-        '  whoami                   show the signed-in account',
+        '  whoami                   show the signed-in account, home tenant, and active tenant',
+        '  use <tenant-id>          remember a tenant id locally for whoami/future commands (a value, not a verified membership)',
         '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
         '    --write                also request write access for the connected client',
         '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
@@ -21,6 +23,7 @@ export function helpText() {
         '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
         '    --slug <slug>          optional; auto-derived + suffixed if omitted',
         '  tenants list             list tenants you provisioned',
+        '  mcp tools --ci           list MCP read tools your CI identity can invoke (no login needed first)',
         '',
         'Global options:',
         '  --json                   machine-readable output',
@@ -28,6 +31,7 @@ export function helpText() {
         '  --dry-run                print what would happen, make no writes or mutating calls',
         '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
         '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
+        '  --tenant <id>            override the active tenant for this invocation (whoami only today)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.1.2",
+      "bom-ref": "pkg:npm/rakomi@0.2.0",
       "name": "rakomi",
-      "version": "0.1.2",
-      "purl": "pkg:npm/rakomi@0.1.2",
+      "version": "0.2.0",
+      "purl": "pkg:npm/rakomi@0.2.0",
       "licenses": [
         {
           "license": {