rakomi 0.1.2 → 0.3.0

package/README.md

@@ -9,7 +9,17 @@ npx rakomi login
 ```
 
 Signs you in with your browser (loopback OAuth + PKCE). Add `--no-browser` on a headless/SSH
-session to get a short code to enter on another device instead.
+session to get a short code to enter on another device instead. If you don't already have a
+`accounts.rakomi.com` session or an invitation link, pass `--tenant-id <uuid>` (or set
+`RAKOMI_PLATFORM_TENANT_ID`) so sign-in knows which tenant to authenticate against — ask your
+Rakomi administrator for the right value.
+
+`rakomi whoami` shows the tenant you signed in against ("Home tenant") and the tenant your other
+commands should treat as active ("Active tenant"). `rakomi tenants memberships` lists every tenant
+your account is a verified member of, with your role in each. `rakomi use <slug>` looks one up from
+that list and remembers it — a slug you don't belong to fails with a plain "not found" rather than
+confirming the tenant exists; `rakomi use <tenant-id>` (a full id) remembers it directly without a
+lookup, and `--tenant <tenant-id>` overrides it for one command.
 
 ## Connect an AI agent
 
@@ -45,10 +55,12 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | --- | --- |
 | `login` | sign in (browser by default; `--no-browser` for a device code) |
 | `logout` | clear the local session |
-| `whoami` | show the signed-in account |
+| `whoami` | show the signed-in account, home tenant, and active tenant |
+| `use <tenant-id-or-slug>` | remember a tenant locally for `whoami`/future commands; a slug is server-verified |
 | `connect` | connect Claude Code / Claude Desktop to your tenant (read access) |
 | `tenants create <name>` | create a tenant (`--owner me\|<email>`, `--slug <slug>`) |
 | `tenants list` | list tenants you provisioned |
+| `tenants memberships` | list tenants you're a verified member of |
 
 ## Global options
 
@@ -59,6 +71,8 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `--dry-run` | print what would happen, make no writes or mutating calls |
 | `--no-browser` | use the device-code flow instead of opening a browser |
 | `--no-keychain` | store the session in a `0600` file instead of the OS keychain |
+| `--tenant-id <uuid>` | (`login`) the tenant to sign in against, if `RAKOMI_PLATFORM_TENANT_ID` isn't set for you |
+| `--tenant <tenant-id>` | override the active tenant for a single command (`whoami` today) |
 | `--client <name>` | `claude-code` or `claude-desktop` — required when more than one applies |
 | `--undo` | restore the `.mcp.json` `connect` last backed up |
 | `--cimd-url <url>` | (`connect`) the connecting client's own CIMD document URL — confirms/re-checks the connection |

package/dist/commands/login.js

@@ -1,7 +1,8 @@
 import { resolveCiOidcToken } from '../ci-oidc-token.js';
-import { accountsBaseUrl, apiBaseUrl, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, } from '../env.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { accountsBaseUrl, apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, clientId as resolveClientId, isCimdClientId, isCimdPlatformSupported, isValidTenantId, platformTenantId, } from '../env.js';
 import { CliError, EXIT } from '../errors.js';
-import { bindInstallKey, getOrCreateInstallKey, signClientAssertion } from '../install-key.js';
+import { bindInstallKey, getOrCreateInstallKey, peekInstallKey, persistInstallKey, signClientAssertion, } from '../install-key.js';
 import { buildAuthorizeUrl, exchangeAuthorizationCode } from '../oauth-authcode.js';
 import { loginWithDeviceGrant } from '../oauth-device.js';
 import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
@@ -14,6 +15,25 @@ function cimdUnsupportedMessage(cid) {
         'the dashboard, then run `rakomi login --client <your-client-id>` (or set RAKOMI_CLIENT_ID) ' +
         'instead.');
 }
+function platformTenantMissingMessage() {
+    return ('rakomi login needs to know which tenant to authenticate your account against. Set ' +
+        'RAKOMI_PLATFORM_TENANT_ID to a real tenant UUID, or pass --tenant-id <uuid>. If neither is ' +
+        'set, this Rakomi environment likely does not have a platform tenant provisioned yet — ask ' +
+        'your operator.');
+}
+function explicitTenantIdMalformedMessage(value) {
+    return (`--tenant-id "${value}" is not a valid tenant id — expected a well-formed UUID (not the nil ` +
+        'or max UUID). Pass the real tenant id, or omit --tenant-id to fall back to RAKOMI_PLATFORM_TENANT_ID.');
+}
+function resolvePlatformTenantId(env, explicit) {
+    if (explicit !== undefined) {
+        if (!isValidTenantId(explicit)) {
+            throw new CliError(explicitTenantIdMalformedMessage(explicit), EXIT.FAIL);
+        }
+        return explicit;
+    }
+    return platformTenantId(env);
+}
 export async function runLogin(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const cid = resolveClientId(deps.env);
@@ -29,9 +49,16 @@ export async function runLogin(deps) {
         }
     }
     const installKey = isCimdClientId(cid) ? getOrCreateInstallKey(deps.keys, cid) : undefined;
+    let tenantId;
+    if (!deps.noBrowser && isCimdClientId(cid)) {
+        tenantId = resolvePlatformTenantId(deps.env, deps.explicitTenantId);
+        if (!tenantId) {
+            throw new CliError(platformTenantMissingMessage(), EXIT.FAIL);
+        }
+    }
     const token = deps.noBrowser
         ? await runDeviceGrantLogin(deps, apiUrl, cid)
-        : await runLoopbackLogin(deps, apiUrl, cid, installKey);
+        : await runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId);
     const session = {
         access_token: token.access_token,
         refresh_token: token.refresh_token,
@@ -39,6 +66,7 @@ export async function runLogin(deps) {
         expires_at: deps.now() + token.expires_in * 1000,
         api_base_url: apiUrl,
         client_id: cid,
+        ...(tenantId ? { home_tenant_id: tenantId } : {}),
     };
     if (token.token_type !== 'Bearer' && token.token_type !== 'DPoP') {
         deps.stdout.write(`(debug) unexpected token_type "${token.token_type}" from the server — treating this session as Bearer.\n`);
@@ -49,7 +77,7 @@ export async function runLogin(deps) {
         await bindInstallKey(deps, deps.keys, { apiBaseUrl: apiUrl, clientId: cid, accessToken: token.access_token, dpopBound: session.token_type === 'DPoP' }, installKey);
     }
 }
-async function runLoopbackLogin(deps, apiUrl, cid, installKey) {
+async function runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId) {
     const listener = await deps.startLoopback();
     try {
         const pkce = generatePkcePair();
@@ -59,6 +87,7 @@ async function runLoopbackLogin(deps, apiUrl, cid, installKey) {
             redirectUri: listener.redirectUri,
             pkce,
             scope: LOGIN_SCOPE,
+            tenantId,
         });
         deps.stdout.write(`Opening your browser to sign in:\n  ${authorizeUrl}\n`);
         await deps.openBrowser(authorizeUrl);
@@ -94,7 +123,6 @@ async function runDeviceGrantLogin(deps, apiUrl, cid) {
         },
     }, { apiBaseUrl: apiUrl, clientId: cid, scope: LOGIN_SCOPE });
 }
-const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export async function runLoginCi(deps) {
     const apiUrl = apiBaseUrl(deps.env);
     const subjectToken = await resolveCiOidcToken(deps, {
@@ -103,7 +131,11 @@ export async function runLoginCi(deps) {
         readTextFile: deps.readTextFile,
         audience: apiUrl,
     });
-    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, { apiBaseUrl: apiUrl, subjectToken, resource: apiUrl, dpopKey });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
     const session = {
         access_token: token.access_token,
         token_type: token.token_type,

package/dist/commands/mcp.js

@@ -0,0 +1,45 @@
+import { resolveCiOidcToken } from '../ci-oidc-token.js';
+import { generateEphemeralDpopKey } from '../dpop.js';
+import { apiBaseUrl, CI_FEDERATION_SESSION_CLIENT_ID, DEFAULT_MCP_URL } from '../env.js';
+import { getOrCreateInstallKey, peekInstallKey, persistInstallKey } from '../install-key.js';
+import { listMcpToolsCi, MCP_RESOURCE } from '../mcp-tools-ci.js';
+import { exchangeOidcSubjectToken } from '../oidc-federation-login.js';
+function hintLine(t) {
+    const hints = [];
+    if (t.annotations?.readOnlyHint)
+        hints.push('read-only');
+    if (t.annotations?.idempotentHint)
+        hints.push('idempotent');
+    return hints.length > 0 ? ` (${hints.join(', ')})` : '';
+}
+export async function runMcpToolsCi(deps) {
+    const apiUrl = apiBaseUrl(deps.env);
+    const mcpUrl = deps.env.RAKOMI_API_URL ? `${apiUrl}/mcp` : DEFAULT_MCP_URL;
+    const subjectToken = await resolveCiOidcToken(deps, {
+        env: deps.ciEnv,
+        oidcTokenFile: deps.oidcTokenFile,
+        readTextFile: deps.readTextFile,
+        audience: MCP_RESOURCE,
+    });
+    const existingKey = peekInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const dpopKey = existingKey ?? { clientId: CI_FEDERATION_SESSION_CLIENT_ID, ...generateEphemeralDpopKey(), confirmedBound: false };
+    const token = await exchangeOidcSubjectToken(deps, {
+        apiBaseUrl: apiUrl,
+        subjectToken,
+        resource: MCP_RESOURCE,
+        dpopKey,
+    });
+    if (!existingKey)
+        persistInstallKey(deps.keys, dpopKey);
+    const resolvedKey = getOrCreateInstallKey(deps.keys, CI_FEDERATION_SESSION_CLIENT_ID);
+    const tools = await listMcpToolsCi(deps, { mcpUrl, accessToken: token.access_token, dpopKey: resolvedKey });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ tools }) + '\n');
+        return;
+    }
+    if (tools.length === 0) {
+        deps.stdout.write('No MCP tools visible to this CI identity.\n');
+        return;
+    }
+    deps.stdout.write(tools.map((t) => `${t.name}${hintLine(t)} — ${t.description}`).join('\n') + '\n');
+}

package/dist/commands/tenants.js

@@ -1,6 +1,7 @@
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
 import { resolveDpopKey } from '../install-key.js';
-import { createTenant, listTenants } from '../tenants-client.js';
+import { claimEphemeralTenant, EPHEMERAL_LEASE_LABEL_MAX_LENGTH, EPHEMERAL_TENANT_TTL_SECONDS_MAX, EPHEMERAL_TENANT_TTL_SECONDS_MIN, releaseEphemeralTenant, } from '../lease-client.js';
+import { createTenant, listTenantMemberships, listTenants } from '../tenants-client.js';
 export async function runTenantsCreate(deps, args) {
     const session = deps.session.read();
     if (!session)
@@ -59,3 +60,76 @@ export async function runTenantsList(deps) {
     }
     deps.stdout.write(result.data.map((t) => `${t.slug}\t${t.id}\t${t.status}`).join('\n') + '\n');
 }
+export async function runTenantsMemberships(deps) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const result = await listTenantMemberships(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    if (result.data.length === 0) {
+        deps.stdout.write('No tenant memberships found for your account.\n');
+        return;
+    }
+    deps.stdout.write(result.data.map((m) => `${m.slug}\t${m.id}\t${m.role}`).join('\n') + '\n');
+}
+function resolveParentTenantId(explicit, tenantConfig) {
+    return explicit ?? tenantConfig.read() ?? undefined;
+}
+const NO_PARENT_TENANT_MESSAGE = 'No tenant to operate on — pass --tenant <tenant-id>, or run `rakomi use <tenant-id>` first.';
+export async function runTenantsClaim(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    if (args.ttlSeconds !== undefined &&
+        (args.ttlSeconds < EPHEMERAL_TENANT_TTL_SECONDS_MIN || args.ttlSeconds > EPHEMERAL_TENANT_TTL_SECONDS_MAX)) {
+        throw new UsageError(`--ttl-seconds must be between ${EPHEMERAL_TENANT_TTL_SECONDS_MIN} and ${EPHEMERAL_TENANT_TTL_SECONDS_MAX}, got ${args.ttlSeconds}`);
+    }
+    const label = args.label?.trim();
+    if (args.label !== undefined && (label === '' || (label?.length ?? 0) > EPHEMERAL_LEASE_LABEL_MAX_LENGTH)) {
+        throw new UsageError(`--label must be 1-${EPHEMERAL_LEASE_LABEL_MAX_LENGTH} characters after trimming, got "${args.label}"`);
+    }
+    const result = await claimEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        ttlSeconds: args.ttlSeconds,
+        label,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    deps.stdout.write(`Claimed ephemeral tenant "${result.slug}" (${result.tenant_id}) — expires ${result.expires_at} (source: ${result.source})\n` +
+        `Lease id: ${result.lease_id} — pass this to \`rakomi tenants release --ci\` when you're done with it.\n`);
+}
+export async function runTenantsRelease(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    await releaseEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        tenantId: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ released: true, tenant_id: args.tenantId }) + '\n');
+        return;
+    }
+    deps.stdout.write(`Released ephemeral tenant ${args.tenantId} — deletion scheduled.\n`);
+}

package/dist/commands/use.js

@@ -0,0 +1,26 @@
+import { isValidTenantId } from '../env.js';
+import { NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
+import { getTenantMembershipBySlug } from '../tenants-client.js';
+export async function runUse(deps, args) {
+    if (isValidTenantId(args.tenantId)) {
+        deps.tenantConfig.write(args.tenantId);
+        deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+        return;
+    }
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const membership = await getTenantMembershipBySlug(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        slug: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (!membership) {
+        throw new UsageError(`No tenant membership found for "${args.tenantId}" — check the spelling, or ask a tenant ` +
+            'admin to invite you. (Run `rakomi tenants memberships` to see the tenants you already belong to.)');
+    }
+    deps.tenantConfig.write(membership.id);
+    deps.stdout.write(`Active tenant set to ${membership.slug} (${membership.id}) — role: ${membership.role}.\n`);
+}

package/dist/commands/whoami.js

@@ -7,6 +7,7 @@ export async function runWhoami(deps) {
         throw new NotLoggedInError();
     const dpop = resolveDpopKey(deps.keys, session);
     const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, dpop });
+    const activeTenantId = deps.explicitTenant ?? deps.tenantConfig.read() ?? undefined;
     if (deps.json) {
         deps.stdout.write(JSON.stringify({
             sub: info.sub,
@@ -15,6 +16,8 @@ export async function runWhoami(deps) {
             org_role: info.org_role,
             session_store: deps.session.describePath(),
             token_type: session.token_type,
+            home_tenant_id: session.home_tenant_id,
+            active_tenant_id: activeTenantId,
         }) + '\n');
         return;
     }
@@ -22,6 +25,8 @@ export async function runWhoami(deps) {
     if (info.org_id)
         lines.push(`Organization: ${info.org_id}${info.org_role ? ` (${info.org_role})` : ''}`);
     lines.push(`API: ${session.api_base_url}`);
+    lines.push(`Home tenant: ${session.home_tenant_id ?? 'unknown (this session did not authenticate via the CIMD-default flow)'}`);
+    lines.push(`Active tenant: ${activeTenantId ?? 'none set (run `rakomi use <tenant-id>`)'}`);
     lines.push(`Session stored in: ${deps.session.describePath()}`);
     lines.push(`Token type: ${session.token_type}`);
     deps.stdout.write(lines.join('\n') + '\n');

package/dist/dpop.js

@@ -6,7 +6,7 @@ export function generateEphemeralDpopKey() {
     return { privateKeyPem, publicJwk };
 }
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function canonicalizeHtu(input) {
     const url = new URL(input);

package/dist/env.js

@@ -3,6 +3,8 @@ export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
 export const DEFAULT_CIMD_CLIENT_ID_URL = 'https://api.rakomi.com/.well-known/rakomi-cli/client-metadata.json';
+export const DEFAULT_PLATFORM_TENANT_ID = '01ef847e-4c40-4960-af05-11112c4764b2';
+export const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export function isCimdClientId(id) {
     let url;
     try {
@@ -22,6 +24,24 @@ export function accountsBaseUrl(env) {
 export function clientId(env) {
     return env.RAKOMI_CLIENT_ID || DEFAULT_CIMD_CLIENT_ID_URL;
 }
+const TENANT_ID_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NIL_TENANT_ID = '00000000-0000-0000-0000-000000000000';
+const MAX_TENANT_ID = 'ffffffff-ffff-ffff-ffff-ffffffffffff';
+export function isValidTenantId(id) {
+    if (id.length !== 36)
+        return false;
+    if (!TENANT_ID_UUID_PATTERN.test(id))
+        return false;
+    const lower = id.toLowerCase();
+    return lower !== NIL_TENANT_ID && lower !== MAX_TENANT_ID;
+}
+export function platformTenantId(env) {
+    const raw = env.RAKOMI_PLATFORM_TENANT_ID;
+    if (raw)
+        return isValidTenantId(raw) ? raw : undefined;
+    const isUnoverriddenProdHost = apiBaseUrl(env) === DEFAULT_API_BASE_URL && accountsBaseUrl(env) === DEFAULT_ACCOUNTS_BASE_URL;
+    return isUnoverriddenProdHost ? DEFAULT_PLATFORM_TENANT_ID : undefined;
+}
 const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
 export async function isCimdPlatformSupported(deps, apiUrl) {
     try {

package/dist/index.js

@@ -8,12 +8,15 @@ import { systemBrowserOpener } from './browser.js';
 import { runConnect } from './commands/connect.js';
 import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
-import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runMcpToolsCi } from './commands/mcp.js';
+import { runTenantsClaim, runTenantsCreate, runTenantsList, runTenantsMemberships, runTenantsRelease } from './commands/tenants.js';
+import { runUse } from './commands/use.js';
 import { runWhoami } from './commands/whoami.js';
 import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
 import { CliError, EXIT, UsageError } from './errors.js';
 import { startLoopbackListener } from './loopback-server.js';
 import { resolveStores } from './session.js';
+import { FileTenantConfigStore } from './tenant-config.js';
 import { helpText, usageLine } from './usage.js';
 const GLOBAL_OPTIONS = {
     json: { type: 'boolean' },
@@ -28,6 +31,10 @@ const GLOBAL_OPTIONS = {
     write: { type: 'boolean' },
     owner: { type: 'string' },
     slug: { type: 'string' },
+    'tenant-id': { type: 'string' },
+    tenant: { type: 'string' },
+    'ttl-seconds': { type: 'string' },
+    label: { type: 'string' },
     'cimd-url': { type: 'string' },
     status: { type: 'boolean' },
     help: { type: 'boolean', short: 'h' },
@@ -50,6 +57,15 @@ export async function run(args, deps) {
         return EXIT.FAIL;
     }
 }
+function parseTtlSeconds(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new UsageError(`--ttl-seconds must be a positive integer, got "${raw}"`);
+    }
+    return n;
+}
 async function dispatch(args, deps) {
     let values;
     let positionals;
@@ -82,6 +98,7 @@ async function dispatch(args, deps) {
                     env: deps.env,
                     ciEnv: deps.ciEnv ?? {},
                     session: deps.session,
+                    keys: deps.keys,
                     oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
                     readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
                     stdout: deps.stdout,
@@ -100,6 +117,7 @@ async function dispatch(args, deps) {
                 sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
                 stdout: deps.stdout,
                 now: () => Date.now(),
+                explicitTenantId: typeof values['tenant-id'] === 'string' ? values['tenant-id'] : undefined,
             });
             return EXIT.OK;
         }
@@ -107,8 +125,23 @@ async function dispatch(args, deps) {
             runLogout({ session: deps.session, stdout: deps.stdout });
             return EXIT.OK;
         case 'whoami':
-            await runWhoami({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+            await runWhoami({
+                ...httpDeps,
+                session: deps.session,
+                keys: deps.keys,
+                json,
+                stdout: deps.stdout,
+                tenantConfig: deps.tenantConfig,
+                explicitTenant: typeof values.tenant === 'string' ? values.tenant : undefined,
+            });
             return EXIT.OK;
+        case 'use': {
+            const tenantId = rest[0];
+            if (!tenantId)
+                throw new UsageError('Usage: rakomi use <tenant-id-or-slug>');
+            await runUse({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
+            return EXIT.OK;
+        }
         case 'connect':
             await runConnect({
                 ...httpDeps,
@@ -128,6 +161,26 @@ async function dispatch(args, deps) {
                 status: values.status === true,
             });
             return EXIT.OK;
+        case 'mcp': {
+            const [sub] = rest;
+            if (sub !== 'tools') {
+                throw new UsageError('Usage: rakomi mcp tools --ci');
+            }
+            if (values.ci !== true) {
+                throw new UsageError('rakomi mcp tools requires --ci (workload-identity federation; no interactive form exists yet).');
+            }
+            await runMcpToolsCi({
+                ...httpDeps,
+                env: deps.env,
+                ciEnv: deps.ciEnv ?? {},
+                keys: deps.keys,
+                oidcTokenFile: typeof values['oidc-token-file'] === 'string' ? values['oidc-token-file'] : undefined,
+                readTextFile: deps.readTextFile ?? ((p) => readFileSync(p, 'utf8')),
+                json,
+                stdout: deps.stdout,
+            });
+            return EXIT.OK;
+        }
         case 'tenants': {
             const [sub, ...tenantArgs] = rest;
             if (sub === 'create') {
@@ -141,7 +194,32 @@ async function dispatch(args, deps) {
                 await runTenantsList({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
                 return EXIT.OK;
             }
-            throw new UsageError('Usage: rakomi tenants <create|list> ...');
+            if (sub === 'memberships') {
+                await runTenantsMemberships({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+                return EXIT.OK;
+            }
+            if (sub === 'claim') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants claim requires --ci (no interactive form exists yet).');
+                }
+                await runTenantsClaim({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, {
+                    parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined,
+                    ttlSeconds: parseTtlSeconds(values['ttl-seconds']),
+                    label: typeof values.label === 'string' ? values.label : undefined,
+                });
+                return EXIT.OK;
+            }
+            if (sub === 'release') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants release requires --ci (no interactive form exists yet).');
+                }
+                const tenantId = tenantArgs[0];
+                if (!tenantId)
+                    throw new UsageError('Usage: rakomi tenants release --ci <tenant-id> [--tenant <parent-tenant-id>]');
+                await runTenantsRelease({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, { tenantId, parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined });
+                return EXIT.OK;
+            }
+            throw new UsageError('Usage: rakomi tenants <create|list|claim|release> ...');
         }
         default:
             throw new UsageError(`Unknown command "${command ?? ''}".`);
@@ -170,6 +248,7 @@ async function main() {
         RAKOMI_ACCOUNTS_URL: process.env.RAKOMI_ACCOUNTS_URL,
         RAKOMI_CLIENT_ID: process.env.RAKOMI_CLIENT_ID,
         RAKOMI_CONFIG_DIR: process.env.RAKOMI_CONFIG_DIR,
+        RAKOMI_PLATFORM_TENANT_ID: process.env.RAKOMI_PLATFORM_TENANT_ID,
         CI: process.env.CI,
         NO_COLOR: process.env.NO_COLOR,
     };
@@ -194,6 +273,7 @@ async function main() {
         fetchImpl: fetch,
         session: resolved.session,
         keys: resolved.keys,
+        tenantConfig: new FileTenantConfigStore(env),
         detectClaudeCode: () => detectClaudeCodeCli(),
         ciEnv,
     });

package/dist/install-key.js

@@ -1,5 +1,5 @@
 import { createPrivateKey, generateKeyPairSync, randomUUID, sign as cryptoSign } from 'node:crypto';
-import { isCimdClientId } from './env.js';
+import { CI_FEDERATION_SESSION_CLIENT_ID, isCimdClientId } from './env.js';
 import { request } from './http.js';
 const INSTALL_KEY_NAME = 'install-key';
 const ASSERTION_LIFETIME_SEC = 60;
@@ -19,23 +19,32 @@ function generateKeyPair(clientId) {
     const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
     return { clientId, privateKeyPem, publicJwk, confirmedBound: false };
 }
-export function getOrCreateInstallKey(keys, clientId) {
+export function peekInstallKey(keys, clientId) {
     const raw = keys.get(INSTALL_KEY_NAME);
-    if (raw !== null) {
-        try {
-            const parsed = JSON.parse(raw);
-            if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
-                return parsed;
-        }
-        catch {
-        }
+    if (raw === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (isStoredInstallKey(parsed) && parsed.clientId === clientId)
+            return parsed;
     }
+    catch {
+    }
+    return undefined;
+}
+export function persistInstallKey(keys, key) {
+    keys.set(INSTALL_KEY_NAME, JSON.stringify(key));
+}
+export function getOrCreateInstallKey(keys, clientId) {
+    const existing = peekInstallKey(keys, clientId);
+    if (existing)
+        return existing;
     const fresh = generateKeyPair(clientId);
-    keys.set(INSTALL_KEY_NAME, JSON.stringify(fresh));
+    persistInstallKey(keys, fresh);
     return fresh;
 }
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function signClientAssertion(key, opts) {
     const privateKey = createPrivateKey(key.privateKeyPem);
@@ -79,7 +88,7 @@ export async function bindInstallKey(deps, keys, opts, key) {
 export function resolveDpopKey(keys, session) {
     if (session.token_type !== 'DPoP')
         return undefined;
-    if (!isCimdClientId(session.client_id))
+    if (!isCimdClientId(session.client_id) && session.client_id !== CI_FEDERATION_SESSION_CLIENT_ID)
         return undefined;
     return getOrCreateInstallKey(keys, session.client_id);
 }

package/dist/lease-client.js

@@ -0,0 +1,64 @@
+import { randomBytes } from 'node:crypto';
+import { CliError, EXIT } from './errors.js';
+import { describeError, errorCode, request } from './http.js';
+export const EPHEMERAL_TENANT_TTL_SECONDS_MIN = 600;
+export const EPHEMERAL_TENANT_TTL_SECONDS_MAX = 1_209_600;
+export const EPHEMERAL_LEASE_LABEL_MAX_LENGTH = 200;
+function generateIdempotencyKey() {
+    return randomBytes(16).toString('hex');
+}
+const CHILD_TENANT_LIMIT_REACHED_CODE = 'tenant/child_tenant_limit_reached';
+export async function claimEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        body: {
+            ...(opts.ttlSeconds !== undefined ? { ttl_seconds: opts.ttlSeconds } : {}),
+            ...(opts.label ? { label: opts.label } : {}),
+        },
+        idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(the given tenant is not the caller's own tenant, or the caller's own tenant is itself " +
+            'ephemeral — ephemeral tenants cannot nest).', EXIT.FAIL);
+    }
+    if (result.status === 409 && errorCode(result.body) === CHILD_TENANT_LIMIT_REACHED_CODE) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}.`, EXIT.FAIL);
+    }
+    if (result.status !== 201) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function releaseEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'DELETE',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims/${encodeURIComponent(opts.tenantId)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            '(the given tenant id does not exist under the given parent, or is not an ephemeral tenant).', EXIT.FAIL);
+    }
+    if (result.status !== 204) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+}

package/dist/mcp-tools-ci.js

@@ -0,0 +1,44 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export const MCP_RESOURCE = 'https://mcp.rakomi.com';
+const MCP_PROTOCOL_VERSION = '2026-07-28';
+const MCP_PROTOCOL_VERSION_HEADER = 'MCP-Protocol-Version';
+const MCP_METHOD_HEADER = 'Mcp-Method';
+const MCP_META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+const MCP_META_CLIENT_CAPABILITIES_KEY = 'io.modelcontextprotocol/clientCapabilities';
+function isJsonRpcError(body) {
+    return typeof body === 'object' && body !== null && 'error' in body;
+}
+export async function listMcpToolsCi(deps, opts) {
+    const message = {
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/list',
+        params: {
+            _meta: {
+                [MCP_META_PROTOCOL_VERSION_KEY]: MCP_PROTOCOL_VERSION,
+                [MCP_META_CLIENT_CAPABILITIES_KEY]: {},
+            },
+        },
+    };
+    const result = await request(deps, {
+        method: 'POST',
+        url: opts.mcpUrl,
+        headers: {
+            [MCP_PROTOCOL_VERSION_HEADER]: MCP_PROTOCOL_VERSION,
+            [MCP_METHOD_HEADER]: 'tools/list',
+        },
+        body: message,
+        dpop: { key: opts.dpopKey, accessToken: opts.accessToken },
+    });
+    if (result.status === 401) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    if (isJsonRpcError(result.body)) {
+        throw new CliError(`Could not list MCP tools: ${result.body.error.message}`, EXIT.FAIL);
+    }
+    if (result.status !== 200 || typeof result.body !== 'object' || result.body === null || !('result' in result.body)) {
+        throw new CliError(`Could not list MCP tools: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body.result.tools;
+}

package/dist/oauth-authcode.js

@@ -9,6 +9,8 @@ export function buildAuthorizeUrl(opts) {
     url.searchParams.set('state', opts.pkce.state);
     url.searchParams.set('code_challenge', opts.pkce.codeChallenge);
     url.searchParams.set('code_challenge_method', opts.pkce.codeChallengeMethod);
+    if (opts.tenantId)
+        url.searchParams.set('tenant_id', opts.tenantId);
     return url.toString();
 }
 export async function exchangeAuthorizationCode(deps, opts) {

package/dist/oidc-federation-login.js

@@ -1,11 +1,10 @@
-import { buildDpopProof, canonicalizeHtu, generateEphemeralDpopKey } from './dpop.js';
+import { buildDpopProof, canonicalizeHtu } from './dpop.js';
 import { CliError, EXIT } from './errors.js';
 import { describeError, request } from './http.js';
 export const OIDC_FEDERATION_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:id_token';
 export async function exchangeOidcSubjectToken(deps, opts) {
     const tokenUrl = `${opts.apiBaseUrl}/oauth/token`;
-    const dpopKey = generateEphemeralDpopKey();
-    const proof = buildDpopProof(dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
+    const proof = buildDpopProof(opts.dpopKey, { htm: 'POST', htu: canonicalizeHtu(tokenUrl) });
     const result = await request(deps, {
         method: 'POST',
         url: tokenUrl,

package/dist/pkce.js

@@ -1,6 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 function base64url(buf) {
-    return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+    return buf.toString('base64url');
 }
 export function generateCodeVerifier() {
     return base64url(randomBytes(32));

package/dist/session.js

@@ -98,7 +98,8 @@ function isStoredSession(value) {
         (v.token_type === 'Bearer' || v.token_type === 'DPoP') &&
         typeof v.expires_at === 'number' &&
         typeof v.api_base_url === 'string' &&
-        typeof v.client_id === 'string');
+        typeof v.client_id === 'string' &&
+        (v.home_tenant_id === undefined || typeof v.home_tenant_id === 'string'));
 }
 export function isExpired(session, now) {
     return now >= session.expires_at;

package/dist/tenant-config.js

@@ -0,0 +1,50 @@
+import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { configDir } from './session.js';
+function isStoredTenantConfig(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const v = value;
+    return typeof v.active_tenant_id === 'string' && v.active_tenant_id.length > 0;
+}
+function tenantConfigFilePath(env) {
+    return join(configDir(env), 'tenant.json');
+}
+export class FileTenantConfigStore {
+    path;
+    dir;
+    constructor(env) {
+        this.dir = configDir(env);
+        this.path = tenantConfigFilePath(env);
+    }
+    read() {
+        try {
+            const raw = readFileSync(this.path, 'utf8');
+            const parsed = JSON.parse(raw);
+            return isStoredTenantConfig(parsed) ? parsed.active_tenant_id : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    write(tenantId) {
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+        const config = { active_tenant_id: tenantId };
+        writeFileSync(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+        }
+    }
+    clear() {
+        try {
+            rmSync(this.path, { force: true });
+        }
+        catch {
+        }
+    }
+    describePath() {
+        return this.path;
+    }
+}

package/dist/tenants-client.js

@@ -64,3 +64,46 @@ export async function listTenants(deps, opts) {
     }
     return result.body;
 }
+function describeCallerUnverified(action) {
+    return (`Could not ${action}: your account e-mail is not verified (or is disabled). Verify your e-mail ` +
+        'and sign in again.');
+}
+export async function listTenantMemberships(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('list your tenant memberships'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not list your tenant memberships: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function getTenantMembershipBySlug(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships/${encodeURIComponent(opts.slug)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 404) {
+        return null;
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('look up this tenant membership'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not look up tenant "${opts.slug}": ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/usage.js

@@ -9,8 +9,10 @@ export function helpText() {
         '  login                    sign in (browser by default; --no-browser for a device code)',
         '    --ci                   sign in from CI via the runner\'s own OIDC identity (no browser/device code)',
         '    --oidc-token-file <p>  read the OIDC token from a file instead of the CI platform\'s own env',
+        '    --tenant-id <uuid>     the tenant to authenticate against (or set RAKOMI_PLATFORM_TENANT_ID)',
         '  logout                   clear the local session',
-        '  whoami                   show the signed-in account',
+        '  whoami                   show the signed-in account, home tenant, and active tenant',
+        '  use <tenant-id-or-slug>  remember a tenant locally (whoami/future commands); a UUID is stored as-is, a slug is server-verified',
         '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
         '    --write                also request write access for the connected client',
         '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
@@ -21,6 +23,14 @@ export function helpText() {
         '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
         '    --slug <slug>          optional; auto-derived + suffixed if omitted',
         '  tenants list             list tenants you provisioned',
+        '  tenants memberships      list tenants your account is a verified member of',
+        '  tenants claim --ci       claim a temporary, self-expiring tenant under your own tenant',
+        '    --tenant <id>          your own tenant to claim under (or run `rakomi use <tenant-id>` first)',
+        '    --ttl-seconds <n>      how long the claim should live, in seconds (only for a freshly-created tenant)',
+        '    --label <text>         optional label, stored and echoed back, never interpreted',
+        '  tenants release --ci <tenant-id>  release a tenant claimed by `tenants claim`',
+        '    --tenant <id>          the tenant it was claimed under (or run `rakomi use <tenant-id>` first)',
+        '  mcp tools --ci           list MCP read tools your CI identity can invoke (no login needed first)',
         '',
         'Global options:',
         '  --json                   machine-readable output',
@@ -28,6 +38,7 @@ export function helpText() {
         '  --dry-run                print what would happen, make no writes or mutating calls',
         '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
         '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
+        '  --tenant <id>            the tenant for this invocation (whoami, tenants claim/release)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.1.2",
+      "bom-ref": "pkg:npm/rakomi@0.3.0",
       "name": "rakomi",
-      "version": "0.1.2",
-      "purl": "pkg:npm/rakomi@0.1.2",
+      "version": "0.3.0",
+      "purl": "pkg:npm/rakomi@0.3.0",
       "licenses": [
         {
           "license": {