rakomi 0.2.0 → 0.3.1

package/dist/tenants-client.js

@@ -64,3 +64,46 @@ export async function listTenants(deps, opts) {
     }
     return result.body;
 }
+function describeCallerUnverified(action) {
+    return (`Could not ${action}: your account e-mail is not verified (or is disabled). Verify your e-mail ` +
+        'and sign in again.');
+}
+export async function listTenantMemberships(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('list your tenant memberships'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not list your tenant memberships: ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}
+export async function getTenantMembershipBySlug(deps, opts) {
+    const result = await request(deps, {
+        method: 'GET',
+        url: `${opts.apiBaseUrl}/v1/tenants/memberships/${encodeURIComponent(opts.slug)}`,
+        headers: opts.dpop ? undefined : { authorization: `Bearer ${opts.accessToken}` },
+        dpop: opts.dpop ? { key: opts.dpop, accessToken: opts.accessToken } : undefined,
+    });
+    if (result.status === 401) {
+        throw new CliError('Your session has expired. Run `rakomi login` again.', EXIT.NOT_LOGGED_IN);
+    }
+    if (result.status === 404) {
+        return null;
+    }
+    if (result.status === 403) {
+        throw new CliError(describeCallerUnverified('look up this tenant membership'), EXIT.FAIL);
+    }
+    if (result.status !== 200) {
+        throw new CliError(`Could not look up tenant "${opts.slug}": ${describeError(result.body, result.status)}`, EXIT.FAIL);
+    }
+    return result.body;
+}

package/dist/token-refresh.js

@@ -0,0 +1,56 @@
+import { CliError, EXIT } from './errors.js';
+import { request, requestIdFromError } from './http.js';
+import { resolveDpopKey } from './install-key.js';
+export async function refreshSession(deps, session, keys, sessionStore, now) {
+    if (!session.refresh_token)
+        return undefined;
+    const dpopKey = resolveDpopKey(keys, session);
+    let result;
+    try {
+        result = await request({ fetchImpl: deps.fetchImpl, timeoutMs: deps.timeoutMs }, {
+            method: 'POST',
+            url: `${session.api_base_url}/oauth/token`,
+            form: {
+                grant_type: 'refresh_token',
+                refresh_token: session.refresh_token,
+                client_id: session.client_id,
+            },
+            dpop: dpopKey ? { key: dpopKey } : undefined,
+        });
+    }
+    catch (err) {
+        const cause = err instanceof CliError ? err.message : 'The Rakomi API could not be reached.';
+        throw new CliError(`Could not refresh your session: ${cause} You are still logged in — try again in a moment.`, EXIT.FAIL);
+    }
+    if (isTransientStatus(result.status)) {
+        const retryAfter = retryAfterSeconds(result.headers.get('retry-after'));
+        const wait = retryAfter !== undefined ? `in ${retryAfter}s` : 'in a moment';
+        const id = requestIdFromError(result.body);
+        throw new CliError(`Could not refresh your session: the Rakomi API is temporarily unavailable (HTTP ${result.status}). ` +
+            `You are still logged in — try again ${wait}.${id ? `\nRequest ID: ${id}` : ''}`, EXIT.FAIL);
+    }
+    if (result.status !== 200)
+        return undefined;
+    const token = result.body;
+    if (typeof token.access_token !== 'string' || token.access_token.length === 0)
+        return undefined;
+    if (typeof token.expires_in !== 'number' || !Number.isFinite(token.expires_in))
+        return undefined;
+    const updated = {
+        ...session,
+        access_token: token.access_token,
+        refresh_token: token.refresh_token ?? session.refresh_token,
+        token_type: token.token_type === 'DPoP' ? 'DPoP' : 'Bearer',
+        expires_at: now() + token.expires_in * 1000,
+    };
+    sessionStore.write(updated);
+    return { accessToken: updated.access_token };
+}
+function isTransientStatus(status) {
+    return status >= 500 || status === 429 || status === 408;
+}
+function retryAfterSeconds(header) {
+    if (header === null || !/^\d+$/.test(header.trim()))
+        return undefined;
+    return Number(header.trim());
+}

package/dist/toml-config.js

@@ -0,0 +1,96 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { CliError, EXIT } from './errors.js';
+import { backupSuffixFor, clientConfigPath, RAKOMI_SERVER_NAME } from './mcp-config.js';
+function readIfPresent(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+function backupPath(configPath, serverName) {
+    return `${configPath}${backupSuffixFor(serverName)}`;
+}
+function tomlBasicString(value) {
+    return JSON.stringify(value);
+}
+function renderTomlBlockLines(header, fields) {
+    const lines = [`[${header}]`];
+    for (const [key, value] of Object.entries(fields)) {
+        lines.push(`${key} = ${tomlBasicString(value)}`);
+    }
+    return lines;
+}
+export function mergeTomlServerTable(text, client, mcpUrl, serverName = RAKOMI_SERVER_NAME) {
+    if (!client.config || client.config.serialization !== 'toml') {
+        throw new CliError(`mergeTomlServerTable: '${client.id}' is not a TOML-shaped written client`, EXIT.FAIL);
+    }
+    const header = `${client.config.topLevelKey}.${serverName}`;
+    const fields = { ...client.config.extraFields, [client.config.remoteUrlField]: mcpUrl };
+    const newBlockLines = renderTomlBlockLines(header, fields);
+    const newBlockText = newBlockLines.join('\n');
+    const lines = text.length > 0 ? text.split('\n') : [];
+    const headerLine = `[${header}]`;
+    let start = -1;
+    for (let i = 0; i < lines.length; i++) {
+        if (lines[i]?.trim() === headerLine) {
+            start = i;
+            break;
+        }
+    }
+    if (start === -1) {
+        const needsSeparator = lines.length > 0 && lines[lines.length - 1] !== '';
+        const prefix = needsSeparator ? [...lines, ''] : lines;
+        const nextLines = [...prefix, ...newBlockLines, ''];
+        return { text: nextLines.join('\n'), changed: true, previousBlock: undefined };
+    }
+    let end = lines.length;
+    for (let i = start + 1; i < lines.length; i++) {
+        if (/^\[/.test(lines[i] ?? '')) {
+            end = i;
+            break;
+        }
+    }
+    let blockEnd = end;
+    while (blockEnd > start + 1 && lines[blockEnd - 1] === '')
+        blockEnd--;
+    const previousBlock = lines.slice(start, blockEnd).join('\n');
+    if (previousBlock === newBlockText) {
+        return { text, changed: false, previousBlock };
+    }
+    const nextLines = [...lines.slice(0, start), ...newBlockLines, ...lines.slice(end)];
+    return { text: nextLines.join('\n'), changed: true, previousBlock };
+}
+export function writeClientTomlConfigEntry(client, cwd, homeDir, mcpUrl, serverName = RAKOMI_SERVER_NAME) {
+    const path = clientConfigPath(client, cwd, homeDir);
+    const existing = readIfPresent(path);
+    const before = existing ?? '';
+    const { text: after, changed, previousBlock } = mergeTomlServerTable(before, client, mcpUrl, serverName);
+    if (!changed) {
+        return { wrote: false, backedUp: false, diff: `${serverName} already configured with ${mcpUrl} — no change.`, path };
+    }
+    let backedUp = false;
+    if (existing !== null) {
+        writeFileSync(backupPath(path, serverName), existing);
+        backedUp = true;
+    }
+    else {
+        mkdirSync(dirname(path), { recursive: true });
+    }
+    writeFileSync(path, after.endsWith('\n') ? after : `${after}\n`);
+    const header = `${client.config.topLevelKey}.${serverName}`;
+    const diff = previousBlock !== undefined ? `[${header}]: updated` : `[${header}]: (added)`;
+    return { wrote: true, backedUp, diff, path };
+}
+export function undoClientTomlConfigWrite(client, cwd, homeDir, serverName = RAKOMI_SERVER_NAME) {
+    const path = clientConfigPath(client, cwd, homeDir);
+    const backup = readIfPresent(backupPath(path, serverName));
+    if (backup === null)
+        return false;
+    writeFileSync(path, backup);
+    return true;
+}

package/dist/usage.js

@@ -1,4 +1,6 @@
+import { KNOWN_CLIENTS } from './clients.js';
 export function helpText() {
+    const clientList = KNOWN_CLIENTS.join(' | ');
     return [
         'rakomi — the Rakomi CLI: sign in, connect an AI agent, and provision tenants',
         '',
@@ -12,17 +14,26 @@ export function helpText() {
         '    --tenant-id <uuid>     the tenant to authenticate against (or set RAKOMI_PLATFORM_TENANT_ID)',
         '  logout                   clear the local session',
         '  whoami                   show the signed-in account, home tenant, and active tenant',
-        '  use <tenant-id>          remember a tenant id locally for whoami/future commands (a value, not a verified membership)',
-        '  connect                  connect Claude Code / Claude Desktop to your tenant (read access)',
+        '  use <tenant-id-or-slug>  remember a tenant locally (whoami/future commands); a UUID is stored as-is, a slug is server-verified',
+        '  upgrade                  open your current tenant\'s upgrade page in the browser',
+        '  connect                  connect an MCP client to your tenant (read access)',
         '    --write                also request write access for the connected client',
-        '    --client <name>        claude-code | claude-desktop (required if more than one applies)',
-        '    --undo                 restore the .mcp.json this command last backed up',
+        `    --client <name>        ${clientList} (required if more than one applies)`,
+        '    --name <server-name>   the config key to write the entry under (default: rakomi) — one name per workspace on a machine',
+        '    --undo                 restore the config file this command last backed up (for the same --name)',
         '    --cimd-url <url>       the connecting client\'s own CIMD document URL — confirms the connection',
-        '    --status               re-check status only (needs --cimd-url; never rewrites .mcp.json)',
+        '    --status               re-check status only (needs --cimd-url; never rewrites the config file)',
         '  tenants create <name>    create a tenant (parent-tenant only; depth-1 enforced server-side)',
         '    --owner <me|email>     who becomes the new tenant\'s owner (default: me)',
         '    --slug <slug>          optional; auto-derived + suffixed if omitted',
         '  tenants list             list tenants you provisioned',
+        '  tenants memberships      list tenants your account is a verified member of',
+        '  tenants claim --ci       claim a temporary, self-expiring tenant under your own tenant',
+        '    --tenant <id>          your own tenant to claim under (or run `rakomi use <tenant-id>` first)',
+        '    --ttl-seconds <n>      how long the claim should live, in seconds (only for a freshly-created tenant)',
+        '    --label <text>         optional label, stored and echoed back, never interpreted',
+        '  tenants release --ci <tenant-id>  release a tenant claimed by `tenants claim`',
+        '    --tenant <id>          the tenant it was claimed under (or run `rakomi use <tenant-id>` first)',
         '  mcp tools --ci           list MCP read tools your CI identity can invoke (no login needed first)',
         '',
         'Global options:',
@@ -31,7 +42,7 @@ export function helpText() {
         '  --dry-run                print what would happen, make no writes or mutating calls',
         '  --no-browser             use the RFC 8628 device-code flow instead of opening a browser',
         '  --no-keychain            store the session in a 0600 file instead of the OS keychain',
-        '  --tenant <id>            override the active tenant for this invocation (whoami only today)',
+        '  --tenant <id>            the tenant for this invocation (whoami, upgrade, tenants claim/release)',
         '  -h, --help               show this help and exit',
         '  -V, --version            print the version and exit',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rakomi",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "The Rakomi CLI — sign in, connect an AI agent (Claude Code, Claude Desktop) to your tenant, and provision tenants. EU-native auth-as-a-service.",
   "keywords": [
     "rakomi",
@@ -42,6 +42,6 @@
     "build": "tsc",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src/ test/ --max-warnings=0",
-    "test": "vitest run"
+    "test": "node ../../scripts/assert-not-story-agent-worktree.mjs test && node ../../scripts/ci/vitest-fork-crash-retry.mjs --results ./test-results.json -- vitest run"
   }
 }

package/sbom.cdx.json

@@ -26,10 +26,10 @@
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/rakomi@0.2.0",
+      "bom-ref": "pkg:npm/rakomi@0.3.1",
       "name": "rakomi",
-      "version": "0.2.0",
-      "purl": "pkg:npm/rakomi@0.2.0",
+      "version": "0.3.1",
+      "purl": "pkg:npm/rakomi@0.3.1",
       "licenses": [
         {
           "license": {