rakomi 0.2.0 → 0.3.1

package/dist/commands/whoami.js

@@ -1,12 +1,29 @@
 import { NotLoggedInError } from '../errors.js';
 import { resolveDpopKey } from '../install-key.js';
 import { fetchUserInfo } from '../userinfo-client.js';
+function describeTokenStatus(expiresAt, now) {
+    return now >= expiresAt ? 'expired (will auto-refresh on next use)' : 'valid';
+}
+function describeActiveTenant(deps, activeTenantId) {
+    if (!activeTenantId)
+        return 'none set (run `rakomi use <tenant-slug>`)';
+    if (deps.explicitTenant)
+        return `${activeTenantId} (--tenant override for this command only — not verified)`;
+    const active = deps.tenantConfig.readActive?.() ?? null;
+    if (active && active.tenantId === activeTenantId && active.verifiedViaSlug) {
+        return `${activeTenantId} (verified member of "${active.verifiedViaSlug}")`;
+    }
+    return `${activeTenantId} (remembered locally — membership not verified; re-run \`rakomi use <tenant-slug>\` to verify)`;
+}
 export async function runWhoami(deps) {
-    const session = deps.session.read();
-    if (!session)
+    const initialSession = deps.session.read();
+    if (!initialSession)
         throw new NotLoggedInError();
-    const dpop = resolveDpopKey(deps.keys, session);
-    const info = await fetchUserInfo(deps, { apiBaseUrl: session.api_base_url, accessToken: session.access_token, dpop });
+    const dpop = resolveDpopKey(deps.keys, initialSession);
+    const info = await fetchUserInfo(deps, { apiBaseUrl: initialSession.api_base_url, accessToken: initialSession.access_token, dpop });
+    const session = deps.session.read() ?? initialSession;
+    const now = (deps.now ?? Date.now)();
+    const tokenStatus = describeTokenStatus(session.expires_at, now);
     const activeTenantId = deps.explicitTenant ?? deps.tenantConfig.read() ?? undefined;
     if (deps.json) {
         deps.stdout.write(JSON.stringify({
@@ -16,6 +33,8 @@ export async function runWhoami(deps) {
             org_role: info.org_role,
             session_store: deps.session.describePath(),
             token_type: session.token_type,
+            expires_at: new Date(session.expires_at).toISOString(),
+            token_status: tokenStatus,
             home_tenant_id: session.home_tenant_id,
             active_tenant_id: activeTenantId,
         }) + '\n');
@@ -26,8 +45,9 @@ export async function runWhoami(deps) {
         lines.push(`Organization: ${info.org_id}${info.org_role ? ` (${info.org_role})` : ''}`);
     lines.push(`API: ${session.api_base_url}`);
     lines.push(`Home tenant: ${session.home_tenant_id ?? 'unknown (this session did not authenticate via the CIMD-default flow)'}`);
-    lines.push(`Active tenant: ${activeTenantId ?? 'none set (run `rakomi use <tenant-id>`)'}`);
+    lines.push(`Active tenant: ${describeActiveTenant(deps, activeTenantId)}`);
     lines.push(`Session stored in: ${deps.session.describePath()}`);
     lines.push(`Token type: ${session.token_type}`);
+    lines.push(`Token expires: ${new Date(session.expires_at).toISOString()} (${tokenStatus})`);
     deps.stdout.write(lines.join('\n') + '\n');
 }

package/dist/env.js

@@ -3,6 +3,7 @@ export const DEFAULT_API_BASE_URL = 'https://api.rakomi.com';
 export const DEFAULT_ACCOUNTS_BASE_URL = 'https://accounts.rakomi.com';
 export const DEFAULT_MCP_URL = 'https://mcp.rakomi.com/mcp';
 export const DEFAULT_CIMD_CLIENT_ID_URL = 'https://api.rakomi.com/.well-known/rakomi-cli/client-metadata.json';
+export const DEFAULT_PLATFORM_TENANT_ID = '01ef847e-4c40-4960-af05-11112c4764b2';
 export const CI_FEDERATION_SESSION_CLIENT_ID = 'oidc-federation';
 export function isCimdClientId(id) {
     let url;
@@ -36,7 +37,10 @@ export function isValidTenantId(id) {
 }
 export function platformTenantId(env) {
     const raw = env.RAKOMI_PLATFORM_TENANT_ID;
-    return raw && isValidTenantId(raw) ? raw : undefined;
+    if (raw)
+        return isValidTenantId(raw) ? raw : undefined;
+    const isUnoverriddenProdHost = apiBaseUrl(env) === DEFAULT_API_BASE_URL && accountsBaseUrl(env) === DEFAULT_ACCOUNTS_BASE_URL;
+    return isUnoverriddenProdHost ? DEFAULT_PLATFORM_TENANT_ID : undefined;
 }
 const CLIENT_ID_METADATA_DOCUMENT_SUPPORTED_FIELD = 'client_id_metadata_document_supported';
 export async function isCimdPlatformSupported(deps, apiUrl) {

package/dist/http.js

@@ -7,7 +7,40 @@ function isErrorEnvelope(v) {
 function isProblemDetails(v) {
     return typeof v === 'object' && v !== null && !('error' in v) && ('code' in v || 'detail' in v || 'title' in v);
 }
+function errorDetails(body) {
+    if (isErrorEnvelope(body) && typeof body.error === 'object') {
+        const d = body.error.details;
+        return d && typeof d === 'object' ? d : undefined;
+    }
+    if (isProblemDetails(body)) {
+        return body.details && typeof body.details === 'object' ? body.details : undefined;
+    }
+    return undefined;
+}
+export function upsellFromProblem(body, status) {
+    if (status !== 403)
+        return undefined;
+    const url = errorDetails(body)?.upgrade_url;
+    return typeof url === 'string' && url.length > 0 ? { upgradeUrl: url } : undefined;
+}
+export function requestIdFromError(body) {
+    if (isErrorEnvelope(body) && typeof body.error === 'object') {
+        const id = body.error.request_id;
+        return typeof id === 'string' && id.length > 0 ? id : undefined;
+    }
+    if (isProblemDetails(body)) {
+        return typeof body.request_id === 'string' && body.request_id.length > 0 ? body.request_id : undefined;
+    }
+    return undefined;
+}
 export function describeError(body, status) {
+    const base = describeErrorBase(body, status);
+    const upsell = upsellFromProblem(body, status);
+    const withUpsell = upsell ? `${base}\nUpgrade: ${upsell.upgradeUrl}\nRun \`rakomi upgrade\` to open this in your browser.` : base;
+    const id = requestIdFromError(body);
+    return id ? `${withUpsell}\nRequest ID: ${id}` : withUpsell;
+}
+function describeErrorBase(body, status) {
     if (isErrorEnvelope(body)) {
         if (typeof body.error === 'string')
             return body.error_description || body.error;
@@ -72,6 +105,8 @@ async function performOnce(deps, req, dpopNonce) {
                 parsed = JSON.parse(text);
             }
             catch {
+                if (res.status < 200 || res.status >= 300)
+                    return { status: res.status, body: {}, headers: res.headers };
                 throw new CliError('The Rakomi API returned a response the CLI could not understand.', EXIT.FAIL);
             }
         }
@@ -89,7 +124,7 @@ function isDpopNonceChallenge(result) {
     const nonce = result.headers.get('dpop-nonce');
     return nonce && nonce.length > 0 ? nonce : undefined;
 }
-export async function request(deps, req) {
+async function performWithNonceRetry(deps, req) {
     const first = await performOnce(deps, req);
     if (!req.dpop)
         return first;
@@ -102,3 +137,25 @@ export async function request(deps, req) {
     }
     return retry;
 }
+function isAuthenticatedRequest(req) {
+    if (req.dpop?.accessToken !== undefined)
+        return true;
+    return typeof req.headers?.authorization === 'string' && req.headers.authorization.length > 0;
+}
+function withRefreshedCredentials(req, credentials) {
+    if (req.dpop?.accessToken !== undefined) {
+        return { ...req, dpop: { ...req.dpop, accessToken: credentials.accessToken } };
+    }
+    return { ...req, headers: { ...req.headers, authorization: `Bearer ${credentials.accessToken}` } };
+}
+export async function request(deps, req) {
+    const first = await performWithNonceRetry(deps, req);
+    if (first.status !== 401)
+        return first;
+    if (!deps.onUnauthorized || !isAuthenticatedRequest(req))
+        return first;
+    const refreshed = await deps.onUnauthorized();
+    if (!refreshed)
+        return first;
+    return performWithNonceRetry(deps, withRefreshedCredentials(req, refreshed));
+}

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { delimiter, join } from 'node:path';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
@@ -9,7 +10,8 @@ import { runConnect } from './commands/connect.js';
 import { runLogin, runLoginCi } from './commands/login.js';
 import { runLogout } from './commands/logout.js';
 import { runMcpToolsCi } from './commands/mcp.js';
-import { runTenantsCreate, runTenantsList } from './commands/tenants.js';
+import { runTenantsClaim, runTenantsCreate, runTenantsList, runTenantsMemberships, runTenantsRelease } from './commands/tenants.js';
+import { runUpgrade } from './commands/upgrade.js';
 import { runUse } from './commands/use.js';
 import { runWhoami } from './commands/whoami.js';
 import { apiBaseUrl, DEFAULT_MCP_URL } from './env.js';
@@ -17,6 +19,7 @@ import { CliError, EXIT, UsageError } from './errors.js';
 import { startLoopbackListener } from './loopback-server.js';
 import { resolveStores } from './session.js';
 import { FileTenantConfigStore } from './tenant-config.js';
+import { refreshSession } from './token-refresh.js';
 import { helpText, usageLine } from './usage.js';
 const GLOBAL_OPTIONS = {
     json: { type: 'boolean' },
@@ -33,8 +36,11 @@ const GLOBAL_OPTIONS = {
     slug: { type: 'string' },
     'tenant-id': { type: 'string' },
     tenant: { type: 'string' },
+    'ttl-seconds': { type: 'string' },
+    label: { type: 'string' },
     'cimd-url': { type: 'string' },
     status: { type: 'boolean' },
+    name: { type: 'string' },
     help: { type: 'boolean', short: 'h' },
     version: { type: 'boolean', short: 'V' },
 };
@@ -55,6 +61,15 @@ export async function run(args, deps) {
         return EXIT.FAIL;
     }
 }
+function parseTtlSeconds(raw) {
+    if (typeof raw !== 'string')
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0) {
+        throw new UsageError(`--ttl-seconds must be a positive integer, got "${raw}"`);
+    }
+    return n;
+}
 async function dispatch(args, deps) {
     let values;
     let positionals;
@@ -78,6 +93,13 @@ async function dispatch(args, deps) {
     const dryRun = values['dry-run'] === true;
     const json = values.json === true;
     const httpDeps = { fetchImpl: deps.fetchImpl };
+    const onUnauthorized = async () => {
+        const current = deps.session.read();
+        if (!current)
+            return undefined;
+        return refreshSession({ fetchImpl: deps.fetchImpl }, current, deps.keys, deps.session, () => Date.now());
+    };
+    const authHttpDeps = { ...httpDeps, onUnauthorized };
     const [command, ...rest] = positionals;
     switch (command) {
         case 'login': {
@@ -115,7 +137,7 @@ async function dispatch(args, deps) {
             return EXIT.OK;
         case 'whoami':
             await runWhoami({
-                ...httpDeps,
+                ...authHttpDeps,
                 session: deps.session,
                 keys: deps.keys,
                 json,
@@ -127,16 +149,28 @@ async function dispatch(args, deps) {
         case 'use': {
             const tenantId = rest[0];
             if (!tenantId)
-                throw new UsageError('Usage: rakomi use <tenant-id>');
-            runUse({ tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
+                throw new UsageError('Usage: rakomi use <tenant-id-or-slug>');
+            await runUse({ ...authHttpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, stdout: deps.stdout }, { tenantId });
             return EXIT.OK;
         }
+        case 'upgrade':
+            await runUpgrade({
+                ...authHttpDeps,
+                session: deps.session,
+                keys: deps.keys,
+                tenantConfig: deps.tenantConfig,
+                explicitTenant: typeof values.tenant === 'string' ? values.tenant : undefined,
+                openBrowser: systemBrowserOpener(),
+                stdout: deps.stdout,
+            });
+            return EXIT.OK;
         case 'connect':
             await runConnect({
-                ...httpDeps,
+                ...authHttpDeps,
                 session: deps.session,
                 keys: deps.keys,
                 cwd: deps.cwd,
+                homeDir: homedir(),
                 apiBaseUrl: apiBaseUrl(deps.env),
                 mcpUrl: deps.env.RAKOMI_API_URL ? `${apiBaseUrl(deps.env)}/mcp` : DEFAULT_MCP_URL,
                 detectClaudeCode: deps.detectClaudeCode,
@@ -148,6 +182,7 @@ async function dispatch(args, deps) {
                 explicitClient: typeof values.client === 'string' ? values.client : undefined,
                 cimdUrl: typeof values['cimd-url'] === 'string' ? values['cimd-url'] : undefined,
                 status: values.status === true,
+                serverName: typeof values.name === 'string' ? values.name : undefined,
             });
             return EXIT.OK;
         case 'mcp': {
@@ -176,14 +211,39 @@ async function dispatch(args, deps) {
                 const name = tenantArgs[0];
                 if (!name)
                     throw new UsageError('Usage: rakomi tenants create <name> [--owner me|<email>] [--slug <slug>]');
-                await runTenantsCreate({ ...httpDeps, session: deps.session, keys: deps.keys, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
+                await runTenantsCreate({ ...authHttpDeps, session: deps.session, keys: deps.keys, json, dryRun, ci, stdout: deps.stdout }, { name, slug: typeof values.slug === 'string' ? values.slug : undefined, owner: typeof values.owner === 'string' ? values.owner : 'me' });
                 return EXIT.OK;
             }
             if (sub === 'list') {
-                await runTenantsList({ ...httpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+                await runTenantsList({ ...authHttpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+                return EXIT.OK;
+            }
+            if (sub === 'memberships') {
+                await runTenantsMemberships({ ...authHttpDeps, session: deps.session, keys: deps.keys, json, stdout: deps.stdout });
+                return EXIT.OK;
+            }
+            if (sub === 'claim') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants claim requires --ci (no interactive form exists yet).');
+                }
+                await runTenantsClaim({ ...authHttpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, {
+                    parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined,
+                    ttlSeconds: parseTtlSeconds(values['ttl-seconds']),
+                    label: typeof values.label === 'string' ? values.label : undefined,
+                });
+                return EXIT.OK;
+            }
+            if (sub === 'release') {
+                if (values.ci !== true) {
+                    throw new UsageError('rakomi tenants release requires --ci (no interactive form exists yet).');
+                }
+                const tenantId = tenantArgs[0];
+                if (!tenantId)
+                    throw new UsageError('Usage: rakomi tenants release --ci <tenant-id> [--tenant <parent-tenant-id>]');
+                await runTenantsRelease({ ...authHttpDeps, session: deps.session, keys: deps.keys, tenantConfig: deps.tenantConfig, json, stdout: deps.stdout }, { tenantId, parentTenantId: typeof values.tenant === 'string' ? values.tenant : undefined });
                 return EXIT.OK;
             }
-            throw new UsageError('Usage: rakomi tenants <create|list> ...');
+            throw new UsageError('Usage: rakomi tenants <create|list|claim|release> ...');
         }
         default:
             throw new UsageError(`Unknown command "${command ?? ''}".`);

package/dist/lease-client.js

@@ -0,0 +1,64 @@
+import { randomBytes } from 'node:crypto';
+import { CliError, EXIT } from './errors.js';
+import { describeError, errorCode, request } from './http.js';
+export const EPHEMERAL_TENANT_TTL_SECONDS_MIN = 600;
+export const EPHEMERAL_TENANT_TTL_SECONDS_MAX = 1_209_600;
+export const EPHEMERAL_LEASE_LABEL_MAX_LENGTH = 200;
+function generateIdempotencyKey() {
+    return randomBytes(16).toString('hex');
+}
+const CHILD_TENANT_LIMIT_REACHED_CODE = 'tenant/child_tenant_limit_reached';
+export async function claimEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'POST',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        body: {
+            ...(opts.ttlSeconds !== undefined ? { ttl_seconds: opts.ttlSeconds } : {}),
+            ...(opts.label ? { label: opts.label } : {}),
+        },
+        idempotencyKey: opts.idempotencyKey ?? generateIdempotencyKey(),
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(the given tenant is not the caller's own tenant, or the caller's own tenant is itself " +
+            'ephemeral — ephemeral tenants cannot nest).', EXIT.FAIL);
+    }
+    if (result.status === 409 && errorCode(result.body) === CHILD_TENANT_LIMIT_REACHED_CODE) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}.`, EXIT.FAIL);
+    }
+    if (result.status !== 201) {
+        throw new CliError(`Could not claim an ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function releaseEphemeralTenant(deps, opts) {
+    const result = await request(deps, {
+        method: 'DELETE',
+        url: `${opts.apiBaseUrl}/v1/tenants/${encodeURIComponent(opts.parentTenantId)}/ephemeral/claims/${encodeURIComponent(opts.tenantId)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login --ci` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            "(missing the `tenants:lease` scope — check this CI identity's trust policy).", EXIT.FAIL);
+    }
+    if (result.status === 404) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)} ` +
+            '(the given tenant id does not exist under the given parent, or is not an ephemeral tenant).', EXIT.FAIL);
+    }
+    if (result.status !== 204) {
+        throw new CliError(`Could not release the ephemeral tenant: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+}

package/dist/loopback-server.js

@@ -1,11 +1,90 @@
 import { createServer } from 'node:http';
 import { CliError, EXIT } from './errors.js';
-const SUCCESS_PAGE = `<!doctype html><html><head><title>rakomi login</title></head>
-<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;text-align:center">
-<h1>Signed in</h1><p>You can close this tab and return to your terminal.</p></body></html>`;
-const ERROR_PAGE = (message) => `<!doctype html><html><head><title>rakomi login</title></head>
-<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;text-align:center">
-<h1>Sign-in failed</h1><p>${escapeHtml(message)}</p><p>Return to your terminal and try again.</p></body></html>`;
+const PAGE_STYLE = `
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-family: "Inter", ui-sans-serif, system-ui, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+    background: linear-gradient(to bottom, #F3F4F7, #ECEEF2, #E4E6EB);
+    color: #2A2A2A;
+  }
+  .card {
+    max-width: 26rem;
+    width: calc(100% - 3rem);
+    margin: 1.5rem;
+    padding: 2.5rem 2rem;
+    border-radius: 1rem;
+    text-align: center;
+    background: rgba(255, 255, 255, 0.75);
+    border: 1px solid rgba(29, 85, 102, 0.14);
+    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.08), 0 8px 24px rgba(29, 85, 102, 0.08);
+  }
+  .wordmark {
+    font-size: 0.8125rem;
+    font-weight: 600;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: #1d5566;
+    margin: 0 0 1.5rem;
+  }
+  .icon {
+    width: 3rem;
+    height: 3rem;
+    margin: 0 auto 1.25rem;
+    border-radius: 999px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 1.5rem;
+    line-height: 1;
+  }
+  .icon.success { background: rgba(40, 114, 77, 0.14); color: #28724D; }
+  .icon.error { background: rgba(189, 46, 46, 0.14); color: #BD2E2E; }
+  h1 {
+    font-size: 1.25rem;
+    font-weight: 700;
+    line-height: 1.25;
+    margin: 0 0 0.5rem;
+    color: #2A2A2A;
+  }
+  p {
+    font-size: 0.9375rem;
+    line-height: 1.5;
+    color: #4A4A4A;
+    margin: 0 0 0.375rem;
+  }
+  p.hint { color: #616161; font-size: 0.875rem; }
+  @media (prefers-color-scheme: dark) {
+    body { background: linear-gradient(to bottom right, #23242c, #1e1f26, #191a20); color: #e6e7ec; }
+    .card { background: rgba(255, 255, 255, 0.07); border-color: rgba(255, 255, 255, 0.10); box-shadow: 0 1px 3px rgba(0, 0, 0, 0.3); }
+    .wordmark { color: #51b0cd; }
+    .icon.success { background: rgba(98, 200, 146, 0.16); color: #62C892; }
+    .icon.error { background: rgba(242, 159, 159, 0.16); color: #F29F9F; }
+    h1 { color: #e6e7ec; }
+    p { color: #a1a3ad; }
+    p.hint { color: #a1a3ad; }
+  }
+`;
+const SUCCESS_PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>rakomi login</title><style>${PAGE_STYLE}</style></head>
+<body><main class="card">
+<p class="wordmark">rakomi</p>
+<div class="icon success" aria-hidden="true">&#10003;</div>
+<h1>Signed in</h1>
+<p>You can close this tab and return to your terminal.</p>
+</main></body></html>`;
+const ERROR_PAGE = (message) => `<!doctype html><html><head><meta charset="utf-8"><title>rakomi login</title><style>${PAGE_STYLE}</style></head>
+<body><main class="card">
+<p class="wordmark">rakomi</p>
+<div class="icon error" aria-hidden="true">&#10005;</div>
+<h1>Sign-in failed</h1>
+<p>${escapeHtml(message)}</p>
+<p class="hint">Return to your terminal and try again.</p>
+</main></body></html>`;
 function escapeHtml(s) {
     return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }

package/dist/mcp-config.js

@@ -1,7 +1,12 @@
-import { readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-export const RAKOMI_SERVER_NAME = 'rakomi';
-const BACKUP_SUFFIX = '.rakomi-backup';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { RAKOMI_SERVER_NAME } from './client-registry.generated.js';
+import { CliError, EXIT } from './errors.js';
+export { RAKOMI_SERVER_NAME };
+export function backupSuffixFor(serverName) {
+    return `.${serverName}-backup`;
+}
+export const BACKUP_SUFFIX = backupSuffixFor(RAKOMI_SERVER_NAME);
 function readIfPresent(file) {
     try {
         return readFileSync(file, 'utf8');
@@ -12,13 +17,17 @@ function readIfPresent(file) {
         throw err;
     }
 }
-export function mcpConfigPath(projectDir) {
-    return join(projectDir, '.mcp.json');
+export function clientConfigPath(client, cwd, homeDir) {
+    if (!client.config) {
+        throw new CliError(`clientConfigPath: '${client.id}' is instructed-tier — it has no config file to write`, EXIT.FAIL);
+    }
+    const base = client.config.scope === 'user' ? homeDir : cwd;
+    return join(base, client.config.pathTemplate);
 }
-function backupPath(configPath) {
-    return `${configPath}${BACKUP_SUFFIX}`;
+function backupPath(configPath, serverName) {
+    return `${configPath}${backupSuffixFor(serverName)}`;
 }
-function readConfig(path) {
+function readJsonConfig(path) {
     const text = readIfPresent(path);
     if (text === null)
         return {};
@@ -32,43 +41,57 @@ function readConfig(path) {
         return {};
     }
 }
-export function mergeRakomiServerEntry(config, mcpUrl) {
-    const previousEntry = config.mcpServers?.[RAKOMI_SERVER_NAME];
-    const nextEntry = { type: 'http', url: mcpUrl };
-    const alreadyIdentical = previousEntry !== undefined &&
-        typeof previousEntry === 'object' &&
-        previousEntry.type === 'http' &&
-        previousEntry.url === mcpUrl;
+function shallowEqualStringRecord(a, b) {
+    const aKeys = Object.keys(a);
+    const bKeys = Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    return aKeys.every((k) => a[k] === b[k]);
+}
+export function mergeClientServerEntry(config, client, mcpUrl, serverName = RAKOMI_SERVER_NAME) {
+    if (!client.config || client.config.serialization !== 'json') {
+        throw new CliError(`mergeClientServerEntry: '${client.id}' is not a JSON-shaped written client`, EXIT.FAIL);
+    }
+    const { topLevelKey, remoteUrlField, extraFields } = client.config;
+    const bucket = config[topLevelKey] ?? {};
+    const previousEntry = bucket[serverName];
+    const nextEntry = { ...extraFields, [remoteUrlField]: mcpUrl };
+    const alreadyIdentical = previousEntry !== undefined && shallowEqualStringRecord(previousEntry, nextEntry);
     if (alreadyIdentical)
         return { config, changed: false, previousEntry };
     const merged = {
         ...config,
-        mcpServers: { ...(config.mcpServers ?? {}), [RAKOMI_SERVER_NAME]: nextEntry },
+        [topLevelKey]: { ...bucket, [serverName]: nextEntry },
     };
     return { config: merged, changed: true, previousEntry };
 }
-export function writeRakomiMcpServerEntry(projectDir, mcpUrl) {
-    const path = mcpConfigPath(projectDir);
-    const before = readConfig(path);
-    const { config: after, changed, previousEntry } = mergeRakomiServerEntry(before, mcpUrl);
+export function writeClientMcpConfigEntry(client, cwd, homeDir, mcpUrl, serverName = RAKOMI_SERVER_NAME) {
+    const path = clientConfigPath(client, cwd, homeDir);
+    const before = readJsonConfig(path);
+    const { config: after, changed, previousEntry } = mergeClientServerEntry(before, client, mcpUrl, serverName);
     if (!changed) {
-        return { wrote: false, backedUp: false, diff: `${RAKOMI_SERVER_NAME} already configured with ${mcpUrl} — no change.` };
+        return { wrote: false, backedUp: false, diff: `${serverName} already configured with ${mcpUrl} — no change.`, path };
     }
     let backedUp = false;
     const existing = readIfPresent(path);
     if (existing !== null) {
-        writeFileSync(backupPath(path), existing);
+        writeFileSync(backupPath(path, serverName), existing);
         backedUp = true;
     }
+    else {
+        mkdirSync(dirname(path), { recursive: true });
+    }
     writeFileSync(path, JSON.stringify(after, null, 2) + '\n');
+    const topLevelKey = client.config.topLevelKey;
+    const nowEntry = after[topLevelKey][serverName];
     const diff = previousEntry
-        ? `mcpServers.${RAKOMI_SERVER_NAME}: ${JSON.stringify(previousEntry)} -> ${JSON.stringify(after.mcpServers?.[RAKOMI_SERVER_NAME])}`
-        : `mcpServers.${RAKOMI_SERVER_NAME}: (added) ${JSON.stringify(after.mcpServers?.[RAKOMI_SERVER_NAME])}`;
-    return { wrote: true, backedUp, diff };
+        ? `${topLevelKey}.${serverName}: ${JSON.stringify(previousEntry)} -> ${JSON.stringify(nowEntry)}`
+        : `${topLevelKey}.${serverName}: (added) ${JSON.stringify(nowEntry)}`;
+    return { wrote: true, backedUp, diff, path };
 }
-export function undoMcpConfigWrite(projectDir) {
-    const path = mcpConfigPath(projectDir);
-    const backup = readIfPresent(backupPath(path));
+export function undoClientConfigWrite(client, cwd, homeDir, serverName = RAKOMI_SERVER_NAME) {
+    const path = clientConfigPath(client, cwd, homeDir);
+    const backup = readIfPresent(backupPath(path, serverName));
     if (backup === null)
         return false;
     writeFileSync(path, backup);

package/dist/server-name.js

@@ -0,0 +1,15 @@
+import { RAKOMI_SERVER_NAME } from './client-registry.generated.js';
+import { UsageError } from './errors.js';
+export const SERVER_NAME_PATTERN = /^[a-z][a-z0-9-]{0,39}$/;
+export const SERVER_NAME_MAX_LENGTH = 40;
+export function isValidServerName(value) {
+    return SERVER_NAME_PATTERN.test(value);
+}
+export function resolveServerName(raw) {
+    if (raw === undefined)
+        return RAKOMI_SERVER_NAME;
+    if (isValidServerName(raw))
+        return raw;
+    throw new UsageError(`Invalid --name "${raw}": use lowercase letters, digits and hyphens only, starting with a letter, ` +
+        `at most ${SERVER_NAME_MAX_LENGTH} characters (for example \`${RAKOMI_SERVER_NAME}-acme\`).`);
+}

package/dist/tenant-config.js

@@ -5,7 +5,9 @@ function isStoredTenantConfig(value) {
     if (typeof value !== 'object' || value === null)
         return false;
     const v = value;
-    return typeof v.active_tenant_id === 'string' && v.active_tenant_id.length > 0;
+    if (typeof v.active_tenant_id !== 'string' || v.active_tenant_id.length === 0)
+        return false;
+    return v.verified_via_slug === undefined || typeof v.verified_via_slug === 'string';
 }
 function tenantConfigFilePath(env) {
     return join(configDir(env), 'tenant.json');
@@ -18,18 +20,27 @@ export class FileTenantConfigStore {
         this.path = tenantConfigFilePath(env);
     }
     read() {
+        return this.readActive()?.tenantId ?? null;
+    }
+    readActive() {
         try {
             const raw = readFileSync(this.path, 'utf8');
             const parsed = JSON.parse(raw);
-            return isStoredTenantConfig(parsed) ? parsed.active_tenant_id : null;
+            if (!isStoredTenantConfig(parsed))
+                return null;
+            return parsed.verified_via_slug !== undefined && parsed.verified_via_slug.length > 0
+                ? { tenantId: parsed.active_tenant_id, verifiedViaSlug: parsed.verified_via_slug }
+                : { tenantId: parsed.active_tenant_id };
         }
         catch {
             return null;
         }
     }
-    write(tenantId) {
+    write(tenantId, verifiedViaSlug) {
         mkdirSync(this.dir, { recursive: true, mode: 0o700 });
-        const config = { active_tenant_id: tenantId };
+        const config = verifiedViaSlug !== undefined && verifiedViaSlug.length > 0
+            ? { active_tenant_id: tenantId, verified_via_slug: verifiedViaSlug }
+            : { active_tenant_id: tenantId };
         writeFileSync(this.path, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
         try {
             chmodSync(this.path, 0o600);