rakomi 0.2.0 → 0.3.1

package/README.md

@@ -2,6 +2,16 @@
 
 The [Rakomi](https://rakomi.com) CLI. EU-native authentication as a service.
 
+## Ask your agent
+
+Add the Rakomi MCP server to your coding agent, then ask it directly:
+
+```sh
+claude mcp add --transport http rakomi https://mcp.rakomi.com/mcp
+```
+
+"List the AI agents connected to my Rakomi tenant."
+
 ## Getting started
 
 ```sh
@@ -15,9 +25,12 @@ session to get a short code to enter on another device instead. If you don't alr
 Rakomi administrator for the right value.
 
 `rakomi whoami` shows the tenant you signed in against ("Home tenant") and the tenant your other
-commands should treat as active ("Active tenant"). `rakomi use <tenant-id>` remembers a tenant id
-locally for that; `--tenant <tenant-id>` overrides it for one command. Neither is a verified
-grant — the tenant `whoami` shows as your Home tenant is the only one the server has confirmed.
+commands should treat as active ("Active tenant") — including whether that active selection was
+confirmed by the server or only remembered locally. `rakomi tenants memberships` lists every tenant
+your account is a verified member of, with your role in each. `rakomi use <slug>` looks one up from
+that list and remembers it — a slug you don't belong to fails with a plain "not found" rather than
+confirming the tenant exists; `rakomi use <tenant-id>` (a full id) remembers it directly without a
+lookup, and `--tenant <tenant-id>` overrides it for one command.
 
 ## Connect an AI agent
 
@@ -25,10 +38,12 @@ grant — the tenant `whoami` shows as your Home tenant is the only one the serv
 npx rakomi connect
 ```
 
-Detects Claude Code and writes the `.mcp.json` entry for you, or prints Claude Desktop's
-Custom-Connectors instructions when run with `--client claude-desktop`. Read access works
-immediately once the client finishes its own sign-in; write access is a separate step your
-tenant owner approves — see the [Connect an AI Agent guide](https://docs.rakomi.dev/guides/connect-an-ai-agent).
+Detects Claude Code and writes its config entry for you. Pass `--client <name>` for any other known
+client — a config file is written in that client's own shape for one that supports it, or its own
+connection steps are printed for a UI-only client (Claude Desktop, ChatGPT, JetBrains). Run
+`rakomi --help` for the current client list. Read access works immediately once the client finishes
+its own sign-in; write access is a separate step your tenant owner approves — see the
+[Connect an AI Agent guide](https://docs.rakomi.dev/guides/connect-an-ai-agent).
 
 Pass `--cimd-url <url>` (find it in your MCP client's own connection diagnostics) and `rakomi`
 confirms the connection for you instead of leaving you to check the dashboard; add `--write` to
@@ -54,10 +69,11 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `login` | sign in (browser by default; `--no-browser` for a device code) |
 | `logout` | clear the local session |
 | `whoami` | show the signed-in account, home tenant, and active tenant |
-| `use <tenant-id>` | remember a tenant id locally for `whoami`/future commands |
-| `connect` | connect Claude Code / Claude Desktop to your tenant (read access) |
+| `use <tenant-id-or-slug>` | remember a tenant locally for `whoami`/future commands; a slug is server-verified |
+| `connect` | connect an MCP client (Claude Code, Claude Desktop, and others — see `--help`) to your tenant (read access) |
 | `tenants create <name>` | create a tenant (`--owner me\|<email>`, `--slug <slug>`) |
 | `tenants list` | list tenants you provisioned |
+| `tenants memberships` | list tenants you're a verified member of |
 
 ## Global options
 
@@ -70,10 +86,11 @@ token), sends a real invitation e-mail, and is refused under `--ci` — see
 | `--no-keychain` | store the session in a `0600` file instead of the OS keychain |
 | `--tenant-id <uuid>` | (`login`) the tenant to sign in against, if `RAKOMI_PLATFORM_TENANT_ID` isn't set for you |
 | `--tenant <tenant-id>` | override the active tenant for a single command (`whoami` today) |
-| `--client <name>` | `claude-code` or `claude-desktop` — required when more than one applies |
-| `--undo` | restore the `.mcp.json` `connect` last backed up |
+| `--client <name>` | one of the known MCP clients (`connect --help` prints the current list) — required when more than one applies |
+| `--name <server-name>` | (`connect`) the config key to write the entry under (default `rakomi`) — one name per workspace on a machine; a client keeps one login per server name |
+| `--undo` | restore the config file `connect` last backed up (for the same `--name`) |
 | `--cimd-url <url>` | (`connect`) the connecting client's own CIMD document URL — confirms/re-checks the connection |
-| `--status` | (`connect`) re-check status only — needs `--cimd-url`, never rewrites `.mcp.json` |
+| `--status` | (`connect`) re-check status only — needs `--cimd-url`, never rewrites the config file |
 | `-h`, `--help` | show help |
 | `-V`, `--version` | print the version |
 

package/SECURITY.md

@@ -9,8 +9,8 @@ While these packages remain pre-1.0 (`0.x`), they carry **no stability or suppor
 (SemVer 2.0.0 §4); the latest `0.x` line receives security updates on a best-effort basis.
 
 From version **1.0** onward, Rakomi maintains the current (N) and previous (N-1) MAJOR in parallel, with N-1 receiving
-security-only fixes. The CRA support period for each MAJOR is determined in accordance with
-**CRA Art. 13(8)** — at least five years, or the product's expected use time where shorter. The authoritative, machine-readable support windows are published at
+security-only fixes. For each MAJOR version of the Rakomi SDKs, CRE8EVE commits to a CRA support period of
+**at least five years (60 months)**, meeting the support-period requirement of **CRA Art. 13(8)**. The authoritative, machine-readable support windows are published at
 [`https://api.rakomi.com/.well-known/sdk-support.json`](https://api.rakomi.com/.well-known/sdk-support.json)
 and rendered for humans on the [SDK Support & Lifecycle page](https://rakomi.com/sdk-support). This
 document points at that single source rather than re-typing dated rows.

package/dist/billing-client.js

@@ -0,0 +1,19 @@
+import { CliError, EXIT } from './errors.js';
+import { describeError, request } from './http.js';
+export async function getBillingPlan(deps, opts) {
+    const url = new URL('/v1/billing/plan', opts.apiBaseUrl);
+    url.searchParams.set('tenant_id', opts.tenantId);
+    const result = await request(deps, {
+        method: 'GET',
+        url: url.toString(),
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not fetch your billing plan: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/client-registry.generated.js

@@ -0,0 +1,156 @@
+export const RAKOMI_SERVER_NAME = "rakomi";
+export const CLIENT_REGISTRY = [
+    {
+        id: "claude-code",
+        displayName: "Claude Code",
+        tier: "written",
+        status: "verified",
+        finishInstruction: "1. Run `claude` in this directory and approve the \"{{SERVER_NAME}}\" project server when prompted.\n2. Then run `claude mcp login {{SERVER_NAME}}` to finish sign-in in your browser (or use `/mcp` inside that session).",
+        config: {
+            scope: "project",
+            pathTemplate: ".mcp.json",
+            serialization: "json",
+            topLevelKey: "mcpServers",
+            remoteUrlField: "url",
+            extraFields: { "type": "http" },
+        },
+        evidenceUrl: "https://code.claude.com/docs/en/mcp",
+    },
+    {
+        id: "vscode",
+        displayName: "VS Code",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Open the Command Palette and run \"MCP: List Servers\", or the Extensions view — VS Code starts the OAuth flow automatically the first time it connects.",
+        config: {
+            scope: "project",
+            pathTemplate: ".vscode/mcp.json",
+            serialization: "json",
+            topLevelKey: "servers",
+            remoteUrlField: "url",
+            extraFields: { "type": "http" },
+        },
+        evidenceUrl: "https://code.visualstudio.com/docs/agents/reference/mcp-configuration",
+    },
+    {
+        id: "cursor",
+        displayName: "Cursor",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Open Cursor's MCP settings and connect — for a server that supports OAuth, Cursor completes the flow for you (or accepts static client credentials in mcp.json instead of dynamic client registration).",
+        config: {
+            scope: "project",
+            pathTemplate: ".cursor/mcp.json",
+            serialization: "json",
+            topLevelKey: "mcpServers",
+            remoteUrlField: "url",
+            extraFields: {},
+        },
+        evidenceUrl: "https://cursor.com/docs/mcp",
+    },
+    {
+        id: "antigravity",
+        displayName: "Google Antigravity",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Open the MCP Store or your MCP settings in Antigravity — it handles OAuth automatically for servers that support dynamic client registration (DCR).",
+        config: {
+            scope: "project",
+            pathTemplate: ".agents/mcp_config.json",
+            serialization: "json",
+            topLevelKey: "mcpServers",
+            remoteUrlField: "serverUrl",
+            extraFields: {},
+        },
+        evidenceUrl: "https://antigravity.google/docs/ide/mcp/",
+    },
+    {
+        id: "gemini-cli",
+        displayName: "Gemini CLI",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Run `gemini mcp list`, or just start a session — the Gemini CLI supports OAuth 2.0 for remote MCP servers and negotiates it automatically.",
+        config: {
+            scope: "project",
+            pathTemplate: ".gemini/settings.json",
+            serialization: "json",
+            topLevelKey: "mcpServers",
+            remoteUrlField: "httpUrl",
+            extraFields: {},
+        },
+        evidenceUrl: "https://google-gemini.github.io/gemini-cli/docs/tools/mcp-server.html",
+    },
+    {
+        id: "zed",
+        displayName: "Zed",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Open Settings -> AI -> MCP Servers in Zed — when a remote server has no Authorization header configured, Zed prompts you to authenticate with the standard MCP OAuth flow.",
+        config: {
+            scope: "project",
+            pathTemplate: ".zed/settings.json",
+            serialization: "json",
+            topLevelKey: "context_servers",
+            remoteUrlField: "url",
+            extraFields: {},
+        },
+        evidenceUrl: "https://zed.dev/docs/ai/mcp",
+    },
+    {
+        id: "codex-cli",
+        displayName: "OpenAI Codex CLI",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Run `codex mcp login {{SERVER_NAME}}` to finish sign-in in your browser.",
+        config: {
+            scope: "user",
+            pathTemplate: ".codex/config.toml",
+            serialization: "toml",
+            topLevelKey: "mcp_servers",
+            remoteUrlField: "url",
+            extraFields: {},
+        },
+        evidenceUrl: "https://learn.chatgpt.com/docs/extend/mcp?surface=cli",
+    },
+    {
+        id: "devin-desktop",
+        displayName: "Devin Desktop",
+        tier: "written",
+        status: "documented-shape-only",
+        finishInstruction: "Open Devin Desktop — it supports OAuth for each transport type and prompts you to connect the first time.",
+        config: {
+            scope: "user",
+            pathTemplate: ".codeium/windsurf/mcp_config.json",
+            serialization: "json",
+            topLevelKey: "mcpServers",
+            remoteUrlField: "serverUrl",
+            extraFields: {},
+        },
+        evidenceUrl: "https://docs.devin.ai/desktop/cascade/mcp",
+    },
+    {
+        id: "claude-desktop",
+        displayName: "Claude Desktop",
+        tier: "instructed",
+        status: "verified",
+        finishInstruction: "Claude Desktop connects to remote MCP servers through Connectors, configured from your Claude account rather than a local file — there is nothing for `rakomi connect` to write.\n\n1. Open Settings -> Connectors in Claude Desktop and add a custom connector.\n2. Enter Rakomi's MCP server URL: {{MCP_URL}}\n3. Click Connect. Claude Desktop opens your browser at accounts.rakomi.com — sign in and\n   approve the read-only consent screen.",
+        evidenceUrl: "https://support.claude.com/en/articles/11175166-about-custom-connectors-remote-mcp",
+    },
+    {
+        id: "chatgpt",
+        displayName: "ChatGPT",
+        tier: "instructed",
+        status: "documented-shape-only",
+        finishInstruction: "In ChatGPT, go to Workspace Settings -> Permissions & Roles -> Developer mode, then add {{MCP_URL}} as a remote server. ChatGPT starts an OAuth flow to your workspace's identity provider once it's added.",
+        evidenceUrl: "https://developers.openai.com/api/docs/mcp",
+    },
+    {
+        id: "jetbrains",
+        displayName: "JetBrains AI Assistant",
+        tier: "instructed",
+        status: "documented-shape-only",
+        finishInstruction: "In your JetBrains IDE, go to Settings -> Tools -> AI Assistant -> Model Context Protocol (MCP), click Add, and paste: {\"mcpServers\":{\"{{SERVER_NAME}}\":{\"url\":\"{{MCP_URL}}\"}}}\nJetBrains' own documentation does not state whether it drives OAuth for you — be ready to complete sign-in in whatever browser tab it opens.",
+        evidenceUrl: "https://www.jetbrains.com/help/ai-assistant/mcp.html",
+    },
+];
+export const KNOWN_CLIENTS = CLIENT_REGISTRY.map((c) => c.id);

package/dist/clients.js

@@ -1,9 +1,17 @@
-export const KNOWN_CLIENTS = ['claude-code', 'claude-desktop'];
+import { CLIENT_REGISTRY, KNOWN_CLIENTS } from './client-registry.generated.js';
+import { CliError, EXIT } from './errors.js';
+export { CLIENT_REGISTRY, KNOWN_CLIENTS };
 export function isKnownClient(value) {
     return KNOWN_CLIENTS.includes(value);
 }
+export function clientRegistryEntry(id) {
+    const entry = CLIENT_REGISTRY.find((c) => c.id === id);
+    if (!entry)
+        throw new CliError(`clientRegistryEntry: unknown client '${id}' — this should be unreachable, isKnownClient() gates every caller`, EXIT.FAIL);
+    return entry;
+}
 export function clientDisplayName(client) {
-    return client === 'claude-code' ? 'Claude Code' : 'Claude Desktop';
+    return clientRegistryEntry(client).displayName;
 }
 export function resolveTargetClients(opts) {
     if (opts.explicitClient) {

package/dist/commands/connect.js

@@ -1,24 +1,29 @@
-import { AmbiguousClientError, clientDisplayName, resolveTargetClients } from '../clients.js';
+import { AmbiguousClientError, clientRegistryEntry, resolveTargetClients } from '../clients.js';
 import { pollCimdMaterialization, requestWriteElevation } from '../connect-client.js';
-import { DEFAULT_MCP_URL } from '../env.js';
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
 import { resolveDpopKey } from '../install-key.js';
-import { mcpConfigPath, undoMcpConfigWrite, writeRakomiMcpServerEntry } from '../mcp-config.js';
-const CLAUDE_DESKTOP_INSTRUCTIONS = [
-    'Claude Desktop connects to remote MCP servers through Connectors, configured from your Claude',
-    'account rather than a local file — there is nothing for `rakomi connect` to write.',
-    '',
-    '1. Open Settings -> Connectors in Claude Desktop and add a custom connector.',
-    `2. Enter Rakomi's MCP server URL: ${DEFAULT_MCP_URL}`,
-    '3. Click Connect. Claude Desktop opens your browser at accounts.rakomi.com — sign in and',
-    '   approve the read-only consent screen.',
-].join('\n');
+import { backupSuffixFor, clientConfigPath, RAKOMI_SERVER_NAME, undoClientConfigWrite, writeClientMcpConfigEntry, } from '../mcp-config.js';
+import { resolveServerName } from '../server-name.js';
+import { undoClientTomlConfigWrite, writeClientTomlConfigEntry } from '../toml-config.js';
+function renderInstruction(instruction, mcpUrl, serverName) {
+    return instruction.replaceAll('{{MCP_URL}}', mcpUrl).replaceAll('{{SERVER_NAME}}', serverName);
+}
+function resolveSingleTargetClient(deps) {
+    let targets;
+    try {
+        targets = resolveTargetClients({ explicitClient: deps.explicitClient, claudeCodeDetected: deps.detectClaudeCode() });
+    }
+    catch (e) {
+        if (e instanceof AmbiguousClientError)
+            throw new UsageError(e.message);
+        throw e;
+    }
+    return clientRegistryEntry(targets[0]);
+}
 export async function runConnect(deps) {
+    const serverName = resolveServerName(deps.serverName);
     if (deps.undo) {
-        const restored = undoMcpConfigWrite(deps.cwd);
-        deps.stdout.write(restored
-            ? `Restored ${mcpConfigPath(deps.cwd)} from the backup \`rakomi connect\` made.\n`
-            : `No \`rakomi connect\` backup found at ${mcpConfigPath(deps.cwd)}.rakomi-backup — nothing to undo.\n`);
+        runUndo(deps, serverName);
         return;
     }
     const session = deps.session.read();
@@ -37,13 +42,33 @@ export async function runConnect(deps) {
             throw new UsageError(e.message);
         throw e;
     }
-    for (const client of targets) {
-        if (client === 'claude-desktop') {
-            deps.stdout.write(`${clientDisplayName(client)}:\n${CLAUDE_DESKTOP_INSTRUCTIONS}\n`);
+    for (const clientId of targets) {
+        const client = clientRegistryEntry(clientId);
+        if (client.tier === 'instructed') {
+            deps.stdout.write(`${client.displayName}:\n${renderInstruction(client.finishInstruction, deps.mcpUrl, serverName)}\n`);
             continue;
         }
-        await connectClaudeCode(deps, session);
+        if (clientId === 'claude-code') {
+            await connectClaudeCode(deps, session, client, serverName);
+        }
+        else {
+            connectGenericWrittenClient(deps, client, serverName);
+        }
+    }
+}
+function runUndo(deps, serverName) {
+    const client = resolveSingleTargetClient(deps);
+    if (!client.config) {
+        deps.stdout.write(`${client.displayName} writes no config file — nothing to undo.\n`);
+        return;
     }
+    const path = clientConfigPath(client, deps.cwd, deps.homeDir);
+    const restored = client.config.serialization === 'toml'
+        ? undoClientTomlConfigWrite(client, deps.cwd, deps.homeDir, serverName)
+        : undoClientConfigWrite(client, deps.cwd, deps.homeDir, serverName);
+    deps.stdout.write(restored
+        ? `Restored ${path} from the backup \`rakomi connect\` made.\n`
+        : `No \`rakomi connect\` backup found at ${path}${backupSuffixFor(serverName)} — nothing to undo.\n`);
 }
 async function reportStatus(deps, session) {
     if (!deps.cimdUrl) {
@@ -65,20 +90,35 @@ async function reportStatus(deps, session) {
         await requestWrite(deps, session, row.id);
     }
 }
-async function connectClaudeCode(deps, session) {
-    if (deps.dryRun) {
-        deps.stdout.write(`Would write ${mcpConfigPath(deps.cwd)} with mcpServers.rakomi -> ${deps.mcpUrl}. No file written (--dry-run).\n`);
-        return;
-    }
-    const result = writeRakomiMcpServerEntry(deps.cwd, deps.mcpUrl);
+function writeSummary(deps, result) {
     if (result.wrote) {
-        deps.stdout.write(`Wrote ${mcpConfigPath(deps.cwd)}${result.backedUp ? ' (previous file backed up)' : ''}.\n${result.diff}\n`);
+        deps.stdout.write(`Wrote ${result.path}${result.backedUp ? ' (previous file backed up)' : ''}.\n${result.diff}\n`);
     }
     else {
         deps.stdout.write(`${result.diff}\n`);
     }
-    deps.stdout.write('Now open Claude Code and run `claude mcp login rakomi` to finish sign-in in your browser.\n' +
+}
+function secondWorkspaceHint(client, explicitClient) {
+    const example = `${RAKOMI_SERVER_NAME}-<workspace>`;
+    const clientFlag = explicitClient ? ` --client ${explicitClient}` : '';
+    const where = client.config?.scope === 'user' ? '' : ' in that project';
+    const login = client.id === 'claude-code' ? `, then \`claude mcp login ${example}\`` : ', then sign in under that name';
+    return (`\nTip: another project on this machine bound to a different workspace? Sign-ins are kept per server ` +
+        `name, so give it its own: run \`rakomi connect${clientFlag} --name ${example}\`${where}${login}.\n`);
+}
+async function connectClaudeCode(deps, session, client, serverName) {
+    const path = clientConfigPath(client, deps.cwd, deps.homeDir);
+    if (deps.dryRun) {
+        deps.stdout.write(`Would write ${path} with ${client.config.topLevelKey}.${serverName} -> ${deps.mcpUrl}. No file written (--dry-run).\n`);
+        return;
+    }
+    const result = writeClientMcpConfigEntry(client, deps.cwd, deps.homeDir, deps.mcpUrl, serverName);
+    writeSummary(deps, result);
+    deps.stdout.write(`${renderInstruction(client.finishInstruction, deps.mcpUrl, serverName)}\n` +
         'Once approved, Claude Code has READ access to your tenant immediately.\n');
+    if (result.wrote && serverName === RAKOMI_SERVER_NAME) {
+        deps.stdout.write(secondWorkspaceHint(client, deps.explicitClient));
+    }
     if (!deps.cimdUrl) {
         deps.stdout.write('\nOnce connected, Rakomi can confirm it and (with --write) request write access for you — pass ' +
             '`--cimd-url <url>` (find it in your MCP client\'s own connection diagnostics) to use it, or ' +
@@ -93,8 +133,9 @@ async function connectClaudeCode(deps, session) {
         dpop,
     });
     if (!row) {
+        const nameFlag = serverName === RAKOMI_SERVER_NAME ? '' : ` --name ${serverName}`;
         deps.stdout.write(`\nNot connected yet. Ctrl+C is safe — resume any time with:\n` +
-            `  rakomi connect --status --cimd-url ${deps.cimdUrl}\n`);
+            `  rakomi connect --status${nameFlag} --cimd-url ${deps.cimdUrl}\n`);
         return;
     }
     deps.stdout.write(`\nConnected — access: ${row.agent_access.level}.\n`);
@@ -105,6 +146,21 @@ async function connectClaudeCode(deps, session) {
         await requestWrite(deps, session, row.id);
     }
 }
+function connectGenericWrittenClient(deps, client, serverName) {
+    const path = clientConfigPath(client, deps.cwd, deps.homeDir);
+    if (deps.dryRun) {
+        deps.stdout.write(`Would write ${path} with ${client.config.topLevelKey}.${serverName} -> ${deps.mcpUrl}. No file written (--dry-run).\n`);
+        return;
+    }
+    const result = client.config.serialization === 'toml'
+        ? writeClientTomlConfigEntry(client, deps.cwd, deps.homeDir, deps.mcpUrl, serverName)
+        : writeClientMcpConfigEntry(client, deps.cwd, deps.homeDir, deps.mcpUrl, serverName);
+    writeSummary(deps, result);
+    deps.stdout.write(`${renderInstruction(client.finishInstruction, deps.mcpUrl, serverName)}\n`);
+    if (result.wrote && serverName === RAKOMI_SERVER_NAME) {
+        deps.stdout.write(secondWorkspaceHint(client, deps.explicitClient));
+    }
+}
 async function requestWrite(deps, session, oauthClientId) {
     const dpop = resolveDpopKey(deps.keys, session);
     await requestWriteElevation(deps, { apiBaseUrl: deps.apiBaseUrl, accessToken: session.access_token, oauthClientId, dpop });

package/dist/commands/login.js

@@ -89,6 +89,7 @@ async function runLoopbackLogin(deps, apiUrl, cid, installKey, tenantId) {
             scope: LOGIN_SCOPE,
             tenantId,
         });
+        deps.stdout.write('Signing you in to your Rakomi developer account (separate from your tenants\' end-user accounts)…\n');
         deps.stdout.write(`Opening your browser to sign in:\n  ${authorizeUrl}\n`);
         await deps.openBrowser(authorizeUrl);
         const callback = await listener.waitForCallback(LOOPBACK_TIMEOUT_MS);

package/dist/commands/tenants.js

@@ -1,6 +1,7 @@
 import { InteractiveRequiredError, NotLoggedInError, UsageError } from '../errors.js';
 import { resolveDpopKey } from '../install-key.js';
-import { createTenant, listTenants } from '../tenants-client.js';
+import { claimEphemeralTenant, EPHEMERAL_LEASE_LABEL_MAX_LENGTH, EPHEMERAL_TENANT_TTL_SECONDS_MAX, EPHEMERAL_TENANT_TTL_SECONDS_MIN, releaseEphemeralTenant, } from '../lease-client.js';
+import { createTenant, listTenantMemberships, listTenants } from '../tenants-client.js';
 export async function runTenantsCreate(deps, args) {
     const session = deps.session.read();
     if (!session)
@@ -59,3 +60,76 @@ export async function runTenantsList(deps) {
     }
     deps.stdout.write(result.data.map((t) => `${t.slug}\t${t.id}\t${t.status}`).join('\n') + '\n');
 }
+export async function runTenantsMemberships(deps) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const result = await listTenantMemberships(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    if (result.data.length === 0) {
+        deps.stdout.write('No tenant memberships found for your account.\n');
+        return;
+    }
+    deps.stdout.write(result.data.map((m) => `${m.slug}\t${m.id}\t${m.role}`).join('\n') + '\n');
+}
+function resolveParentTenantId(explicit, tenantConfig) {
+    return explicit ?? tenantConfig.read() ?? undefined;
+}
+const NO_PARENT_TENANT_MESSAGE = 'No tenant to operate on — pass --tenant <tenant-id>, or run `rakomi use <tenant-id>` first.';
+export async function runTenantsClaim(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    if (args.ttlSeconds !== undefined &&
+        (args.ttlSeconds < EPHEMERAL_TENANT_TTL_SECONDS_MIN || args.ttlSeconds > EPHEMERAL_TENANT_TTL_SECONDS_MAX)) {
+        throw new UsageError(`--ttl-seconds must be between ${EPHEMERAL_TENANT_TTL_SECONDS_MIN} and ${EPHEMERAL_TENANT_TTL_SECONDS_MAX}, got ${args.ttlSeconds}`);
+    }
+    const label = args.label?.trim();
+    if (args.label !== undefined && (label === '' || (label?.length ?? 0) > EPHEMERAL_LEASE_LABEL_MAX_LENGTH)) {
+        throw new UsageError(`--label must be 1-${EPHEMERAL_LEASE_LABEL_MAX_LENGTH} characters after trimming, got "${args.label}"`);
+    }
+    const result = await claimEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        ttlSeconds: args.ttlSeconds,
+        label,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify(result) + '\n');
+        return;
+    }
+    deps.stdout.write(`Claimed ephemeral tenant "${result.slug}" (${result.tenant_id}) — expires ${result.expires_at} (source: ${result.source})\n` +
+        `Lease id: ${result.lease_id} — pass this to \`rakomi tenants release --ci\` when you're done with it.\n`);
+}
+export async function runTenantsRelease(deps, args) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError('Not logged in. Run `rakomi login --ci` first.');
+    const parentTenantId = resolveParentTenantId(args.parentTenantId, deps.tenantConfig);
+    if (!parentTenantId)
+        throw new UsageError(NO_PARENT_TENANT_MESSAGE);
+    await releaseEphemeralTenant(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        parentTenantId,
+        tenantId: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (deps.json) {
+        deps.stdout.write(JSON.stringify({ released: true, tenant_id: args.tenantId }) + '\n');
+        return;
+    }
+    deps.stdout.write(`Released ephemeral tenant ${args.tenantId} — deletion scheduled.\n`);
+}

package/dist/commands/upgrade.js

@@ -0,0 +1,21 @@
+import { getBillingPlan } from '../billing-client.js';
+import { NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
+export async function runUpgrade(deps) {
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const tenantId = deps.explicitTenant ?? deps.tenantConfig.read() ?? undefined;
+    if (!tenantId) {
+        throw new UsageError('No active tenant set. Run `rakomi use <tenant-slug>` first, or pass --tenant <id>.');
+    }
+    const dpop = resolveDpopKey(deps.keys, session);
+    const plan = await getBillingPlan(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        tenantId,
+        dpop,
+    });
+    deps.stdout.write(`Current plan: ${plan.effective_plan}\nOpening ${plan.upgrade_url} in your browser...\n`);
+    await deps.openBrowser(plan.upgrade_url);
+}

package/dist/commands/use.js

@@ -1,10 +1,26 @@
 import { isValidTenantId } from '../env.js';
-import { UsageError } from '../errors.js';
-export function runUse(deps, args) {
-    if (!isValidTenantId(args.tenantId)) {
-        throw new UsageError(`"${args.tenantId}" is not a valid tenant id — expected a UUID (e.g. the value \`rakomi login\` ` +
-            'printed as "Home tenant", or the id shown in the dashboard).');
+import { NotLoggedInError, UsageError } from '../errors.js';
+import { resolveDpopKey } from '../install-key.js';
+import { getTenantMembershipBySlug } from '../tenants-client.js';
+export async function runUse(deps, args) {
+    if (isValidTenantId(args.tenantId)) {
+        deps.tenantConfig.write(args.tenantId);
+        deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+        return;
     }
-    deps.tenantConfig.write(args.tenantId);
-    deps.stdout.write(`Active tenant set to ${args.tenantId}.\n`);
+    const session = deps.session.read();
+    if (!session)
+        throw new NotLoggedInError();
+    const membership = await getTenantMembershipBySlug(deps, {
+        apiBaseUrl: session.api_base_url,
+        accessToken: session.access_token,
+        slug: args.tenantId,
+        dpop: resolveDpopKey(deps.keys, session),
+    });
+    if (!membership) {
+        throw new UsageError(`No tenant membership found for "${args.tenantId}" — check the spelling, or ask a tenant ` +
+            'admin to invite you. (Run `rakomi tenants memberships` to see the tenants you already belong to.)');
+    }
+    deps.tenantConfig.write(membership.id, membership.slug);
+    deps.stdout.write(`Active tenant set to ${membership.slug} (${membership.id}) — role: ${membership.role}.\n`);
 }