rakomi 0.2.0 → 0.3.0

package/README.md

@@ -15,9 +15,11 @@ session to get a short code to enter on another device instead. If you don't alr
 Rakomi administrator for the right value.
 
 `rakomi whoami` shows the tenant you signed in against ("Home tenant") and the tenant your other
-commands should treat as active ("Active tenant"). `rakomi use <tenant-id>` remembers a tenant id
-locally for that; `--tenant <tenant-id>` overrides it for one command. Neither is a verified
-grant — the tenant `whoami` shows as your Home tenant is the only one the server has confirmed.
+commands should treat as active ("Active tenant"). `rakomi tenants memberships` lists every tenant
+your account is a verified member of, with your role in each. `rakomi use <slug>` looks one up from
+that list and remembers it — a slug you don't belong to fails with a plain "not found" rather than
+confirming the tenant exists; `rakomi use <tenant-id>` (a full id) remembers it directly without a
+lookup, and `--tenant <tenant-id>` overrides it for one command.
 
 ## Connect an AI agent
 
@@ -54,10 +56,11 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `login` | sign in (browser by default; `--no-browser` for a device code) |
 | `logout` | clear the local session |
 | `whoami` | show the signed-in account, home tenant, and active tenant |
-| `use <tenant-id>` | remember a tenant id locally for `whoami`/future commands |
+| `use <tenant-id-or-slug>` | remember a tenant locally for `whoami`/future commands; a slug is server-verified |
 | `connect` | connect Claude Code / Claude Desktop to your tenant (read access) |
 | `tenants create <name>` | create a tenant (`--owner me\|<email>`, `--slug <slug>`) |
 | `tenants list` | list tenants you provisioned |
+| `tenants memberships` | list tenants you're a verified member of |
 
 ## Global options
 

package/dist/commands/tenants.js

@@ -1,6 +1,7 @@
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
 import { resolveDpopKey } from '../install-key.js';
-import { createTenant, listTenants } from '../tenants-client.js';
+import { claimEphemeralTenant, EPHEMERAL_LEASE_LABEL_MAX_LENGTH, EPHEMERAL_TENANT_TTL_SECONDS_MAX, EPHEMERAL_TENANT_TTL_SECONDS_MIN, releaseEphemeralTenant, } from '../lease-client.js';
+import { createTenant, listTenantMemberships, listTenants } from '../tenants-client.js';
 export async function runTenantsCreate(deps, args) {
     const session = deps.session.read();
     if (!session)
@@ -59,3 +60,76 @@ export async function runTenantsList(deps) {
     }
     deps.stdout.write(result.data.map((t) => `${t.slug}\t${t.id}\t${t.status}`).join('\n') + '\n');
 }
+export async function runTenantsMemberships(deps) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const result = await listTenantMemberships(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    if (result.data.length === 0) {
+        deps.stdout.write('No tenant memberships found for your account.\n');
+        return;
+    }
+    deps.stdout.write(result.data.map((m) => `${m.slug}\t${m.id}\t${m.role}`).join('\n') + '\n');
+}
+function resolveParentTenantId(explicit, tenantConfig) {
+    return explicit ?? tenantConfig.read() ?? undefined;
+}
+const NO_PARENT_TENANT_MESSAGE = 'No tenant to operate on — pass --tenant <tenant-id>, or run `rakomi use <tenant-id>` first.';
+export async function runTenantsClaim(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    if (args.ttlSeconds !== undefined &&
+        (args.ttlSeconds < EPHEMERAL_TENANT_TTL_SECONDS_MIN || args.ttlSeconds > EPHEMERAL_TENANT_TTL_SECONDS_MAX)) {
+        throw new UsageError(`--ttl-seconds must be between ${EPHEMERAL_TENANT_TTL_SECONDS_MIN} and ${EPHEMERAL_TENANT_TTL_SECONDS_MAX}, got ${args.ttlSeconds}`);
+    }
+    const label = args.label?.trim();
+    if (args.label !== undefined && (label === '' || (label?.length ?? 0) > EPHEMERAL_LEASE_LABEL_MAX_LENGTH)) {
+        throw new UsageError(`--label must be 1-${EPHEMERAL_LEASE_LABEL_MAX_LENGTH} characters after trimming, got "${args.label}"`);
+    }
+    const result = await claimEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        ttlSeconds: args.ttlSeconds,
+        label,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    deps.stdout.write(`Claimed ephemeral tenant "${result.slug}" (${result.tenant_id}) — expires ${result.expires_at} (source: ${result.source})\n` +
+        `Lease id: ${result.lease_id} — pass this to \`rakomi tenants release --ci\` when you're done with it.\n`);
+}
+export async function runTenantsRelease(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    await releaseEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        tenantId: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ released: true, tenant_id: args.tenantId }) + '\n');
+        return;
+    }
+    deps.stdout.write(`Released ephemeral tenant ${args.tenantId} — deletion scheduled.\n`);
+}

package/dist/commands/use.js

@@ -1,10 +1,26 @@
 import { isValidTenantId } from '../env.js';
-import { UsageError } from '../errors.js';
-export function runUse(deps, args) {
-    if (!isValidTenantId(args.tenantId)) {
-        throw new UsageError(`"${args.tenantId}" is not a valid tenant id — expected a UUID (e.g. the value \`rakomi login\` ` +
-            'printed as "Home tenant", or the id shown in the dashboard).');
+import { NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
+import { getTenantMembershipBySlug } from '../tenants-client.js';
+export async function runUse(deps, args) {
+    if (isValidTenantId(args.tenantId)) {
+        deps.tenantConfig.write(args.tenantId);
+        deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+        return;
     }
-    deps.tenantConfig.write(args.tenantId);
-    deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const membership = await getTenantMembershipBySlug(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        slug: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (!membership) {
+        throw new UsageError(`No tenant membership found for "${args.tenantId}" — check the spelling, or ask a tenant ` +
+            'admin to invite you. (Run `rakomi tenants memberships` to see the tenants you already belong to.)');
+    }
+    deps.tenantConfig.write(membership.id);
+    deps.stdout.write(`Active tenant set to ${membership.slug} (${membership.id}) — role: ${membership.role}.\n`);
 }

package/dist/env.js

@@ -3,6 +3,7 @@ export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
 export const DEFAULT_CIMD_CLIENT_ID_URL = 'https://api.rakomi.com/.well-known/rakomi-cli/client-metadata.json';
+export const DEFAULT_PLATFORM_TENANT_ID = '01ef847e-4c40-4960-af05-11112c4764b2';
 export const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export function isCimdClientId(id) {
     let url;
@@ -36,7 +37,10 @@ export function isValidTenantId(id) {
 }
 export function platformTenantId(env) {
     const raw = env.RAKOMI_PLATFORM_TENANT_ID;
-    return raw && isValidTenantId(raw) ? raw : undefined;
+    if (raw)
+        return isValidTenantId(raw) ? raw : undefined;
+    const isUnoverriddenProdHost = apiBaseUrl(env) === DEFAULT_API_BASE_URL && accountsBaseUrl(env) === DEFAULT_ACCOUNTS_BASE_URL;
+    return isUnoverriddenProdHost ? DEFAULT_PLATFORM_TENANT_ID : undefined;
 }
 const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
 export async function isCimdPlatformSupported(deps, apiUrl) {

package/dist/index.js

@@ -9,7 +9,7 @@ import { runConnect } from './commands/connect.js';
 import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
 import { runMcpToolsCi } from './commands/mcp.js';
-import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runTenantsClaim, runTenantsCreate, runTenantsList, runTenantsMemberships, runTenantsRelease } from './commands/tenants.js';
 import { runUse } from './commands/use.js';
 import { runWhoami } from './commands/whoami.js';
 import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
@@ -33,6 +33,8 @@ const GLOBAL_OPTIONS = {
     slug: { type: 'string' },
     'tenant-id': { type: 'string' },
     tenant: { type: 'string' },
+    'ttl-seconds': { type: 'string' },
+    label: { type: 'string' },
     'cimd-url': { type: 'string' },
     status: { type: 'boolean' },
     help: { type: 'boolean', short: 'h' },
@@ -55,6 +57,15 @@ export async function run(args, deps) {
         return EXIT.FAIL;
     }
 }
+function parseTtlSeconds(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new UsageError(`--ttl-seconds must be a positive integer, got "${raw}"`);
+    }
+    return n;
+}
 async function dispatch(args, deps) {
     let values;
     let positionals;
@@ -127,8 +138,8 @@ async function dispatch(args, deps) {
         case 'use': {
             const tenantId = rest[0];
             if (!tenantId)
-                throw new UsageError('Usage: rakomi use <tenant-id>');
-            runUse({ tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
+                throw new UsageError('Usage: rakomi use <tenant-id-or-slug>');
+            await runUse({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
             return EXIT.OK;
         }
         case 'connect':
@@ -183,7 +194,32 @@ async function dispatch(args, deps) {
                 await runTenantsList({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
                 return EXIT.OK;
             }
-            throw new UsageError('Usage: rakomi tenants <create|list> ...');
+            if (sub === 'memberships') {
+                await runTenantsMemberships({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+                return EXIT.OK;
+            }
+            if (sub === 'claim') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants claim requires --ci (no interactive form exists yet).');
+                }
+                await runTenantsClaim({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, {
+                    parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined,
+                    ttlSeconds: parseTtlSeconds(values['ttl-seconds']),
+                    label: typeof values.label === 'string' ? values.label : undefined,
+                });
+                return EXIT.OK;
+            }
+            if (sub === 'release') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants release requires --ci (no interactive form exists yet).');
+                }
+                const tenantId = tenantArgs[0];
+                if (!tenantId)
+                    throw new UsageError('Usage: rakomi tenants release --ci <tenant-id> [--tenant <parent-tenant-id>]');
+                await runTenantsRelease({ ...httpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, { tenantId, parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined });
+                return EXIT.OK;
+            }
+            throw new UsageError('Usage: rakomi tenants <create|list|claim|release> ...');
         }
         default:
             throw new UsageError(`Unknown command "${command ?? ''}".`);

package/dist/lease-client.js

@@ -0,0 +1,64 @@
+import { randomBytes } from 'node:crypto';
+import { CliError, EXIT } from './errors.js';
+import { describeError, errorCode, request } from './http.js';
+export const EPHEMERAL_TENANT_TTL_SECONDS_MIN = 600;
+export const EPHEMERAL_TENANT_TTL_SECONDS_MAX = 1_209_600;
+export const EPHEMERAL_LEASE_LABEL_MAX_LENGTH = 200;
+function generateIdempotencyKey() {
+    return randomBytes(16).toString('hex');
+}
+const CHILD_TENANT_LIMIT_REACHED_CODE = 'tenant/child_tenant_limit_reached';
+export async function claimEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        body: {
+            ...(opts.ttlSeconds !== undefined ? { ttl_seconds: opts.ttlSeconds } : {}),
+            ...(opts.label ? { label: opts.label } : {}),
+        },
+        idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(the given tenant is not the caller's own tenant, or the caller's own tenant is itself " +
+            'ephemeral — ephemeral tenants cannot nest).', EXIT.FAIL);
+    }
+    if (result.status === 409 && errorCode(result.body) === CHILD_TENANT_LIMIT_REACHED_CODE) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}.`, EXIT.FAIL);
+    }
+    if (result.status !== 201) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function releaseEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'DELETE',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims/${encodeURIComponent(opts.tenantId)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            '(the given tenant id does not exist under the given parent, or is not an ephemeral tenant).', EXIT.FAIL);
+    }
+    if (result.status !== 204) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+}

package/dist/tenants-client.js

@@ -64,3 +64,46 @@ export async function listTenants(deps, opts) {
     }
     return result.body;
 }
+function describeCallerUnverified(action) {
+    return (`Could not ${action}: your account e-mail is not verified (or is disabled). Verify your e-mail ` +
+        'and sign in again.');
+}
+export async function listTenantMemberships(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('list your tenant memberships'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not list your tenant memberships: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function getTenantMembershipBySlug(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships/${encodeURIComponent(opts.slug)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 404) {
+        return null;
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('look up this tenant membership'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not look up tenant "${opts.slug}": ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/usage.js

@@ -12,7 +12,7 @@ export function helpText() {
         '    --tenant-id <uuid>     the tenant to authenticate against (or set RAKOMI_PLATFORM_TENANT_ID)',
         '  logout                   clear the local session',
         '  whoami                   show the signed-in account, home tenant, and active tenant',
-        '  use <tenant-id>          remember a tenant id locally for whoami/future commands (a value, not a verified membership)',
+        '  use <tenant-id-or-slug>  remember a tenant locally (whoami/future commands); a UUID is stored as-is, a slug is server-verified',
         '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
         '    --write                also request write access for the connected client',
         '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
@@ -23,6 +23,13 @@ export function helpText() {
         '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
         '    --slug <slug>          optional; auto-derived + suffixed if omitted',
         '  tenants list             list tenants you provisioned',
+        '  tenants memberships      list tenants your account is a verified member of',
+        '  tenants claim --ci       claim a temporary, self-expiring tenant under your own tenant',
+        '    --tenant <id>          your own tenant to claim under (or run `rakomi use <tenant-id>` first)',
+        '    --ttl-seconds <n>      how long the claim should live, in seconds (only for a freshly-created tenant)',
+        '    --label <text>         optional label, stored and echoed back, never interpreted',
+        '  tenants release --ci <tenant-id>  release a tenant claimed by `tenants claim`',
+        '    --tenant <id>          the tenant it was claimed under (or run `rakomi use <tenant-id>` first)',
         '  mcp tools --ci           list MCP read tools your CI identity can invoke (no login needed first)',
         '',
         'Global options:',
@@ -31,7 +38,7 @@ export function helpText() {
         '  --dry-run                print what would happen, make no writes or mutating calls',
         '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
         '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
-        '  --tenant <id>            override the active tenant for this invocation (whoami only today)',
+        '  --tenant <id>            the tenant for this invocation (whoami, tenants claim/release)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.2.0",
+      "bom-ref": "pkg:npm/rakomi@0.3.0",
       "name": "rakomi",
-      "version": "0.2.0",
-      "purl": "pkg:npm/rakomi@0.2.0",
+      "version": "0.3.0",
+      "purl": "pkg:npm/rakomi@0.3.0",
       "licenses": [
         {
           "license": {