@roarkanalytics/cli 0.28.0 → 0.31.1

package/man/roark-customer-flow-edge-case-create.1

@@ -30,6 +30,9 @@ Optional.
 \fB\-\-preceded\-by\-customer\-flow\-variant\-id\fR \fI<value>\fR
 Optional.
 .TP
+\fB\-\-additional\-expectations\fR \fI<value>\fR
+The expectations graded on this variant only, on top of the flow's own. Sent as the complete set: it replaces whatever the variant had, so omit it to leave the set alone and send [] to clear it. Improv flows only: a scripted variant's expectations come from the agent turns on its path and are rewritten on every graph edit. Optional.
+.TP
 \fB\-\-persona\-override\-id\fR \fI<value>\fR
 The persona this runs as. Omit to inherit the happy path's. Optional.
 .SH "GLOBAL OPTIONS"

package/man/roark-customer-flow-edge-case-update.1

@@ -37,7 +37,7 @@ Optional.
 The persona this runs as. Null on an edge case inherits the happy path's. Optional.
 .TP
 \fB\-\-additional\-expectations\fR \fI<value>\fR
-Replaces the expectations that apply to this variant on top of the flow's. Omit to leave them alone, send [] to clear. Improv flows only: a scripted variant's expectations come from the agent turns on its path and are rewritten on the next graph edit. Optional.
+The expectations graded on this variant only, on top of the flow's own. Sent as the complete set: it replaces whatever the variant had, so omit it to leave the set alone and send [] to clear it. Improv flows only: a scripted variant's expectations come from the agent turns on its path and are rewritten on every graph edit. Optional.
 .SH "GLOBAL OPTIONS"
 .TP
 \fB\-\-data\fR \fI<json>\fR

package/man/roark-customer-flow-happy-path-update.1

@@ -34,7 +34,7 @@ Optional.
 The persona this runs as. Null on an edge case inherits the happy path's. Optional.
 .TP
 \fB\-\-additional\-expectations\fR \fI<value>\fR
-Replaces the expectations that apply to this variant on top of the flow's. Omit to leave them alone, send [] to clear. Improv flows only: a scripted variant's expectations come from the agent turns on its path and are rewritten on the next graph edit. Optional.
+The expectations graded on this variant only, on top of the flow's own. Sent as the complete set: it replaces whatever the variant had, so omit it to leave the set alone and send [] to clear it. Improv flows only: a scripted variant's expectations come from the agent turns on its path and are rewritten on every graph edit. Optional.
 .SH "GLOBAL OPTIONS"
 .TP
 \fB\-\-data\fR \fI<json>\fR

package/man/roark-project-list.1

@@ -0,0 +1,89 @@
+.\" File generated from our OpenAPI spec by app-agent-codegen. Do not edit.
+.TH "ROARK\-PROJECT\-LIST" "1" "" "roark-project-list" "Roark Analytics API Manual"
+.SH "NAME"
+roark\-project\-list \- List projects available to this credential
+.SH "SYNOPSIS"
+.B roark project list
+[\fIoptions\fR]
+.SH "DESCRIPTION"
+Returns every project the calling credential may act on, with the permissions it holds in each. A project\-scoped API key returns the single project it is bound to. A user\-scoped credential returns the projects in its organization where the holder is an active member. Use the returned id in the X\-Roark\-Project\-Id header.
+.SH "API"
+GET /v1/projects
+.SH "GLOBAL OPTIONS"
+.TP
+\fB\-\-data\fR \fI<json>\fR
+Request body as JSON, or @file to read one (@\- for stdin).
+.TP
+\fB\-y\fR, \fB\-\-yes\fR
+Skip confirmation prompts.
+.TP
+\fB\-\-no\-input\fR
+Never prompt; fail instead.
+.TP
+\fB\-\-base\-url\fR \fI<url>\fR
+API base URL.
+.TP
+\fB\-\-token\fR \fI<token>\fR
+Bearer token. Prefer ROARK_API_BEARER_TOKEN or the stored credential.
+.TP
+\fB\-\-timeout\fR \fI<ms>\fR
+Request timeout in milliseconds.
+.TP
+\fB\-\-max\-retries\fR \fI<count>\fR
+Retries for retryable failures.
+.TP
+\fB\-\-format\fR \fI<format>\fR
+Output format: auto, json, jsonl, plain.
+.TP
+\fB\-\-json\fR
+Shorthand for \-\-format json.
+.TP
+\fB\-\-no\-color\fR
+Disable colour.
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Suppress non\-essential output.
+.TP
+\fB\-\-allow\-project\-base\-url\fR
+Send the stored credential to a base URL set by a project .roark.json. Refused by default.
+.SH "EXAMPLES"
+.PP
+.RS 4
+.nf
+roark project list
+.fi
+.RE
+.SH "ENVIRONMENT"
+.TP
+\fBROARK_API_BEARER_TOKEN\fR
+Bearer token used when \-\-token is not given.
+.TP
+\fBROARK_BASE_URL\fR
+API base URL.
+.TP
+\fBROARK_ALLOW_PROJECT_BASE_URL\fR
+Trusts a base URL set by a project .roark.json, like \-\-allow\-project\-base\-url.
+.TP
+\fBNO_COLOR\fR
+Disables colour when set to any value.
+.SH "EXIT STATUS"
+.TP
+\fB0\fR
+The command succeeded.
+.TP
+\fB1\fR
+The API rejected the request.
+.TP
+\fB2\fR
+The command line was wrong.
+.TP
+\fB3\fR
+No credential, or the credential was refused.
+.TP
+\fB4\fR
+The addressed resource does not exist.
+.TP
+\fB5\fR
+The request never completed: connection, timeout, or abort.
+.SH "SEE ALSO"
+.BR roark (1)

package/man/roark-whoami.1

@@ -0,0 +1,89 @@
+.\" File generated from our OpenAPI spec by app-agent-codegen. Do not edit.
+.TH "ROARK\-WHOAMI" "1" "" "roark-whoami" "Roark Analytics API Manual"
+.SH "NAME"
+roark\-whoami \- Describe the current credential
+.SH "SYNOPSIS"
+.B roark whoami
+[\fIoptions\fR]
+.SH "DESCRIPTION"
+Returns the scope of the credential making the request, the organization it acts in, its default project (if any) and the permissions it was granted. Works for both project\-scoped API keys and user\-scoped credentials from the CLI or an MCP connector.
+.SH "API"
+GET /v1/me
+.SH "GLOBAL OPTIONS"
+.TP
+\fB\-\-data\fR \fI<json>\fR
+Request body as JSON, or @file to read one (@\- for stdin).
+.TP
+\fB\-y\fR, \fB\-\-yes\fR
+Skip confirmation prompts.
+.TP
+\fB\-\-no\-input\fR
+Never prompt; fail instead.
+.TP
+\fB\-\-base\-url\fR \fI<url>\fR
+API base URL.
+.TP
+\fB\-\-token\fR \fI<token>\fR
+Bearer token. Prefer ROARK_API_BEARER_TOKEN or the stored credential.
+.TP
+\fB\-\-timeout\fR \fI<ms>\fR
+Request timeout in milliseconds.
+.TP
+\fB\-\-max\-retries\fR \fI<count>\fR
+Retries for retryable failures.
+.TP
+\fB\-\-format\fR \fI<format>\fR
+Output format: auto, json, jsonl, plain.
+.TP
+\fB\-\-json\fR
+Shorthand for \-\-format json.
+.TP
+\fB\-\-no\-color\fR
+Disable colour.
+.TP
+\fB\-q\fR, \fB\-\-quiet\fR
+Suppress non\-essential output.
+.TP
+\fB\-\-allow\-project\-base\-url\fR
+Send the stored credential to a base URL set by a project .roark.json. Refused by default.
+.SH "EXAMPLES"
+.PP
+.RS 4
+.nf
+roark whoami
+.fi
+.RE
+.SH "ENVIRONMENT"
+.TP
+\fBROARK_API_BEARER_TOKEN\fR
+Bearer token used when \-\-token is not given.
+.TP
+\fBROARK_BASE_URL\fR
+API base URL.
+.TP
+\fBROARK_ALLOW_PROJECT_BASE_URL\fR
+Trusts a base URL set by a project .roark.json, like \-\-allow\-project\-base\-url.
+.TP
+\fBNO_COLOR\fR
+Disables colour when set to any value.
+.SH "EXIT STATUS"
+.TP
+\fB0\fR
+The command succeeded.
+.TP
+\fB1\fR
+The API rejected the request.
+.TP
+\fB2\fR
+The command line was wrong.
+.TP
+\fB3\fR
+No credential, or the credential was refused.
+.TP
+\fB4\fR
+The addressed resource does not exist.
+.TP
+\fB5\fR
+The request never completed: connection, timeout, or abort.
+.SH "SEE ALSO"
+.BR roark (1)

package/man/roark.1

@@ -282,6 +282,9 @@ List a metric’s variants See roark\-metric\-variant\-list(1).
 \fBroark metric variant update\fR
 Update a metric variant See roark\-metric\-variant\-update(1).
 .TP
+\fBroark project list\fR
+List projects available to this credential See roark\-project\-list(1).
+.TP
 \fBroark simulation environment create\fR
 Create an environment See roark\-simulation\-environment\-create(1).
 .TP
@@ -377,6 +380,9 @@ Get webhook by ID See roark\-webhook\-get(1).
 .TP
 \fBroark webhook list\fR
 List webhooks See roark\-webhook\-list(1).
+.TP
+\fBroark whoami\fR
+Describe the current credential See roark\-whoami(1).
 .SH "CONFIGURATION"
 Settings are resolved highest precedence first: command line flag, environment variable, project .roark.json found by walking up from the working directory, then the user config file. The stored credential is written with mode 0600.
 .SH "ENVIRONMENT"

package/npm-shrinkwrap.json

@@ -1,15 +1,15 @@
 {
   "name": "@roarkanalytics/cli",
-  "version": "0.28.0",
+  "version": "0.31.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@roarkanalytics/cli",
-      "version": "0.28.0",
+      "version": "0.31.1",
       "license": "Apache-2.0",
       "dependencies": {
-        "@roarkanalytics/sdk": "^4.4.0",
+        "@roarkanalytics/sdk": "^4.15.0",
         "commander": "^14.0.3",
         "yaml": "^2.9.0"
       },
@@ -21,9 +21,9 @@
       }
     },
     "node_modules/@roarkanalytics/sdk": {
-      "version": "4.8.0",
-      "resolved": "https://registry.npmjs.org/@roarkanalytics/sdk/-/sdk-4.8.0.tgz",
-      "integrity": "sha512-j7awV7Fq8zJgZOYBoU+I7HOoBzQbWMsZFpmN601j1lt6j50vC1g3Lz7FKmrvP4X31EZBOvFDrGktnfRNQANIew==",
+      "version": "4.15.0",
+      "resolved": "https://registry.npmjs.org/@roarkanalytics/sdk/-/sdk-4.15.0.tgz",
+      "integrity": "sha512-H5bHFILsMVMUG7+6yi3gO4JrAvvoFPLn82zZp0tS1A6UugH/hzQgwuMFSkjbJCl29p9GcVjAFhLDaZa7845gmA==",
       "license": "Apache-2.0"
     },
     "node_modules/commander": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roarkanalytics/cli",
-  "version": "0.28.0",
+  "version": "0.31.1",
   "description": "The official command line interface for the Roark API",
   "author": "Roark <james@roark.ai>",
   "type": "commonjs",
@@ -29,7 +29,7 @@
     "fix": "eslint --fix . && prettier --write ."
   },
   "dependencies": {
-    "@roarkanalytics/sdk": "^4.4.0",
+    "@roarkanalytics/sdk": "^4.15.0",
     "commander": "^14.0.3",
     "yaml": "^2.9.0"
   },
@@ -109,6 +109,7 @@
     "./man/roark-metric-variant-get.1",
     "./man/roark-metric-variant-list.1",
     "./man/roark-metric-variant-update.1",
+    "./man/roark-project-list.1",
     "./man/roark-simulation-environment-create.1",
     "./man/roark-simulation-environment-delete.1",
     "./man/roark-simulation-environment-get.1",
@@ -140,6 +141,7 @@
     "./man/roark-webhook-create.1",
     "./man/roark-webhook-delete.1",
     "./man/roark-webhook-get.1",
-    "./man/roark-webhook-list.1"
+    "./man/roark-webhook-list.1",
+    "./man/roark-whoami.1"
   ]
 }

package/runtime/browser-login.d.ts

@@ -23,4 +23,18 @@ export interface BrowserLoginOptions {
     onAuthorizeUrl?: (url: string) => void;
     open?: (url: string) => void;
 }
-export declare const browserLogin: (options: BrowserLoginOptions) => Promise<string>;
+/** What the token exchange hands back. */
+export interface BrowserLoginResult {
+    /** The minted bearer token. */
+    token: string;
+    /**
+     * The project chosen on the consent screen, when the server reports one.
+     *
+     * A user-scoped credential stores no project of its own, so this is the only moment the choice
+     * is communicated: `auth login` writes it to the user config so the next command works without
+     * a `--project`. Absent when the server minted a project-scoped key, which needs no project
+     * setting at all.
+     */
+    project?: string;
+}
+export declare const browserLogin: (options: BrowserLoginOptions) => Promise<BrowserLoginResult>;

package/runtime/browser-login.js

@@ -127,6 +127,7 @@ const browserLogin = async (options) => {
     const token = body.data?.token;
     if (!token)
         throw new Error('token exchange returned no token');
-    return token;
+    const project = body.data?.defaultProjectId;
+    return { token, ...(typeof project === 'string' && project.length > 0 ? { project } : {}) };
 };
 exports.browserLogin = browserLogin;

package/runtime/commands/api.js

@@ -43,6 +43,10 @@ const registerApiCommand = (root, binaryName, clientFor, resolveOutput) => {
         .option('--data <json>', 'request body as JSON, or @file to read one (@- for stdin)')
         .option('--query <key=value>', 'query parameter; repeat for more than one', (value, previous) => [...(previous ?? []), value])
         .option('--base-url <url>', 'API base URL')
+        // `api` redeclares the connection options rather than inheriting the root ones, so this has to
+        // be listed here too. Without it the escape hatch is the one command a user credential cannot
+        // use: every project-scoped path 400s with no way to name a project.
+        .option('--project <id>', 'project to act on (or ROARK_PROJECT_ID, or `roark config set project`)')
         .option('--token <token>', 'bearer token')
         .option('--timeout <ms>', 'request timeout in milliseconds')
         .option('--max-retries <count>', 'retries for retryable failures')

package/runtime/commands/auth.js

@@ -24,6 +24,55 @@ const DEFAULT_BASE_URL = 'https://api.roark.ai';
 // a 401 while a valid one that merely lacks this endpoint's permission is a 403 — both prove the
 // token authenticates. `/v1/agent` is a stable GET that every project has.
 const AUTH_PROBE_PATH = '/v1/agent';
+// What the credential itself says it is. Added with user-scoped credentials and the only endpoint
+// that answers without naming a project, which is exactly what a liveness check needs. An older API
+// does not have it; callers fall back to AUTH_PROBE_PATH on a 404.
+const AUTH_DESCRIBE_PATH = '/v1/me';
+/**
+ * Asks the API whether the effective credential still works.
+ *
+ * `auth status` used to answer from the config file alone, so it said "Authenticated" for a
+ * credential the server had already revoked. That was always wrong and is now easy to hit: a
+ * user-scoped credential is revoked from the web UI, in a different place from the machine
+ * holding it, so the CLI is routinely the last to know.
+ */
+const describeCredential = async (clientFor) => {
+    let client;
+    try {
+        // Resolved the same way a real command would, so the base-url trust guard still applies and we
+        // are checking the credential that would actually be used.
+        client = clientFor({});
+    }
+    catch (error) {
+        return { kind: 'unknown', reason: error.message.split('\n')[0] ?? 'unknown error' };
+    }
+    const classify = (error) => {
+        const status = error.status;
+        if (status === 401)
+            return { kind: 'rejected' };
+        // 403 (authenticated, lacks a permission) and 400 (a user credential that named no project)
+        // both prove authentication succeeded.
+        if (status !== undefined && status < 500)
+            return { kind: 'live' };
+        return { kind: 'unknown', reason: error.message };
+    };
+    try {
+        const me = (await client.get(AUTH_DESCRIBE_PATH));
+        return { kind: 'live', scope: me.data?.tokenScope, email: me.data?.user?.email ?? null };
+    }
+    catch (error) {
+        if (error.status !== 404)
+            return classify(error);
+    }
+    // Older API without /v1/me: any authenticated endpoint still proves the token lives.
+    try {
+        await client.get(AUTH_PROBE_PATH, { query: { limit: '1' } });
+        return { kind: 'live' };
+    }
+    catch (error) {
+        return classify(error);
+    }
+};
 /**
  * Confirm the stored credential actually authenticates, so a mistyped or half-pasted token is caught
  * here instead of on the user's next real command. Best-effort: it never fails the login (the token
@@ -112,10 +161,21 @@ const readToken = async (binaryName) => {
     return token;
 };
 // Save the token and report where it went (masked). Shared by the browser and paste paths.
-const persistToken = (token) => {
-    const path = (0, config_1.writeUserConfig)({ ...(0, config_1.readUserConfig)(), bearerToken: token });
+//
+// `project` is written only when the browser flow reports one: a user credential stores no
+// project of its own, so without this the very next command would need a `--project`. The paste
+// path passes nothing, which leaves any existing setting alone rather than clearing it.
+const persistToken = (token, project) => {
+    const path = (0, config_1.writeUserConfig)({
+        ...(0, config_1.readUserConfig)(),
+        bearerToken: token,
+        ...(project === undefined ? {} : { project }),
+    });
     const color = (0, output_1.supportsColor)(process.stderr);
     (0, output_1.write)(`${(0, output_1.paint)('Saved', 'green', color)} ${(0, config_1.maskToken)(token)} to ${path}`, process.stderr);
+    if (project !== undefined) {
+        (0, output_1.write)(`${(0, output_1.paint)('Project', 'green', color)} ${project} (change it with \`config set project\`)`, process.stderr);
+    }
     return { color };
 };
 // A set environment variable outranks the stored token (see the precedence in config.ts), so without
@@ -151,9 +211,9 @@ const registerAuthCommands = (root, binaryName, clientFor) => {
             const color = (0, output_1.supportsColor)(process.stderr);
             const apiBaseUrl = (0, config_1.resolveConfig)({}).config.baseURL ?? DEFAULT_BASE_URL;
             (0, output_1.write)((0, output_1.paint)('Opening your browser to authorize this CLI…', 'dim', color), process.stderr);
-            let token;
+            let login;
             try {
-                token = await (0, browser_login_1.browserLogin)({
+                login = await (0, browser_login_1.browserLogin)({
                     apiBaseUrl,
                     platformOrigin: (0, browser_login_1.platformOriginFor)(apiBaseUrl),
                     clientName: `CLI on ${(0, node_os_1.hostname)()}`,
@@ -164,8 +224,8 @@ const registerAuthCommands = (root, binaryName, clientFor) => {
                 throw new errors_1.UsageError(`Browser login failed: ${error.message}\n` +
                     `Run \`${binaryName} auth login --paste\` to paste or pipe a token instead.`);
             }
-            const { color: savedColor } = persistToken(token);
-            warnEnvShadow(token, savedColor);
+            const { color: savedColor } = persistToken(login.token, login.project);
+            warnEnvShadow(login.token, savedColor);
             return;
         }
         const token = await readToken(binaryName);
@@ -184,24 +244,46 @@ const registerAuthCommands = (root, binaryName, clientFor) => {
     });
     auth
         .command('status')
-        .description('Show which credential would be used, and where it came from')
-        .action(() => {
+        .description('Show which credential would be used, where it came from, and whether it still works')
+        .action(async () => {
         const color = (0, output_1.supportsColor)(process.stderr);
         const fromEnv = process.env['ROARK_API_BEARER_TOKEN'];
         const stored = (0, config_1.readUserConfig)().bearerToken;
-        if (fromEnv) {
-            (0, output_1.write)(`${(0, output_1.paint)('Authenticated', 'green', color)} via ROARK_API_BEARER_TOKEN (${(0, config_1.maskToken)(fromEnv)})`, process.stderr);
-            if (stored) {
-                (0, output_1.write)((0, output_1.paint)(`A token is also stored in ${(0, config_1.userConfigPath)()}; the environment variable wins.`, 'dim', color), process.stderr);
-            }
+        const token = fromEnv ?? stored;
+        if (!token) {
+            (0, output_1.write)(`${(0, output_1.paint)('Not authenticated.', 'yellow', color)} Run \`${binaryName} auth login\`.`, process.stderr);
+            process.exitCode = 3;
             return;
         }
-        if (stored) {
-            (0, output_1.write)(`${(0, output_1.paint)('Authenticated', 'green', color)} via ${(0, config_1.userConfigPath)()} (${(0, config_1.maskToken)(stored)})`, process.stderr);
+        const source = fromEnv ? 'ROARK_API_BEARER_TOKEN' : (0, config_1.userConfigPath)();
+        // Ask the API rather than trusting the file. Without this the command reports a revoked
+        // credential as authenticated, which is the opposite of what someone runs it to find out.
+        const state = clientFor ? await describeCredential(clientFor) : { kind: 'unknown', reason: 'no client' };
+        if (state.kind === 'rejected') {
+            (0, output_1.write)(`${(0, output_1.paint)('Rejected', 'red', color)} by the API (401): the credential in ${source} (${(0, config_1.maskToken)(token)}) is wrong, expired, or revoked.`, process.stderr);
+            (0, output_1.write)((0, output_1.paint)(`Run \`${binaryName} auth login\` to replace it.`, 'dim', color), process.stderr);
+            process.exitCode = 3;
             return;
         }
-        (0, output_1.write)(`${(0, output_1.paint)('Not authenticated.', 'yellow', color)} Run \`${binaryName} auth login\`.`, process.stderr);
-        process.exitCode = 3;
+        if (state.kind === 'unknown') {
+            // Deliberately not "Authenticated": we do not know. Saying so is the whole point.
+            (0, output_1.write)(`${(0, output_1.paint)('Unverified', 'yellow', color)} credential in ${source} (${(0, config_1.maskToken)(token)}): could not reach the API (${state.reason}).`, process.stderr);
+        }
+        else {
+            const who = state.email ? ` as ${state.email}` : '';
+            (0, output_1.write)(`${(0, output_1.paint)('Authenticated', 'green', color)}${who} via ${source} (${(0, config_1.maskToken)(token)})`, process.stderr);
+            if (state.scope === 'USER') {
+                // A user credential reaches every project you belong to, so which one it acts on is part
+                // of the answer, not a detail.
+                const project = (0, config_1.loadConfig)().project;
+                (0, output_1.write)((0, output_1.paint)(project ?
+                    `Acting on project ${project}. Change it with \`${binaryName} config set project <id>\`.`
+                    : `No project selected: commands will fail until you set one with \`${binaryName} config set project <id>\`.`, 'dim', color), process.stderr);
+            }
+        }
+        if (fromEnv && stored) {
+            (0, output_1.write)((0, output_1.paint)(`A token is also stored in ${(0, config_1.userConfigPath)()}; the environment variable wins.`, 'dim', color), process.stderr);
+        }
     });
     root.addCommand(auth);
 };

package/runtime/commands/config.js

@@ -21,6 +21,7 @@ const output_1 = require("../output");
 /** Settable keys, as typed, mapped onto the config field they write. */
 const KEYS = {
     'base-url': 'baseURL',
+    project: 'project',
     timeout: 'timeout',
     'max-retries': 'maxRetries',
 };

package/runtime/config.d.ts

@@ -14,6 +14,18 @@
 export interface CliConfig {
     bearerToken?: string;
     baseURL?: string;
+    /**
+     * The project commands act on, sent as `X-Roark-Project-Id`.
+     *
+     * Only meaningful for a user credential (what `auth login` now stores): it can reach every
+     * project you belong to, so each request has to name one. A project API key already names its
+     * own project and ignores this.
+     *
+     * Unlike `baseURL`, this is safe to take from a project file. It selects which of your own
+     * projects you act on; it cannot send your credential anywhere new. See `unsafeBaseUrlRedirect`
+     * for the key where that distinction matters.
+     */
+    project?: string;
     timeout?: number;
     maxRetries?: number;
 }

package/runtime/config.js

@@ -62,6 +62,7 @@ const number = (value) => {
 const fromEnvironment = () => ({
     ...(process.env['ROARK_API_BEARER_TOKEN'] ? { bearerToken: process.env['ROARK_API_BEARER_TOKEN'] } : {}),
     ...(process.env['ROARK_BASE_URL'] ? { baseURL: process.env['ROARK_BASE_URL'] } : {}),
+    ...(process.env['ROARK_PROJECT_ID'] ? { project: process.env['ROARK_PROJECT_ID'] } : {}),
     ...(number(process.env['ROARK_TIMEOUT']) !== undefined ?
         { timeout: number(process.env['ROARK_TIMEOUT']) }
         : {}),

package/runtime/program.d.ts

@@ -19,6 +19,7 @@ export interface ProgramOptions {
 }
 interface GlobalOptions {
     baseUrl?: string;
+    project?: string;
     timeout?: string;
     maxRetries?: string;
     token?: string;

package/runtime/program.js

@@ -37,6 +37,7 @@ const isDestructive = (command) => DESTRUCTIVE_VERBS.has(command.commandPath.at(
 const addGlobalOptions = (command, extra) => {
     command
         .option('--base-url <url>', 'API base URL')
+        .option('--project <id>', 'project to act on (or ROARK_PROJECT_ID, or `roark config set project`)')
         .option('--token <token>', 'bearer token (prefer ROARK_API_BEARER_TOKEN or `auth login`)')
         .option('--timeout <ms>', 'request timeout in milliseconds')
         .option('--max-retries <count>', 'retries for retryable failures')
@@ -81,6 +82,7 @@ const clientFor = (options, requiresAuth = true) => {
     const overrides = {
         ...(options.token === undefined ? {} : { bearerToken: options.token }),
         ...(options.baseUrl === undefined ? {} : { baseURL: options.baseUrl }),
+        ...(options.project === undefined ? {} : { project: options.project }),
         ...(options.timeout === undefined ? {} : { timeout: Number(options.timeout) }),
         ...(options.maxRetries === undefined ? {} : { maxRetries: Number(options.maxRetries) }),
     };
@@ -94,6 +96,9 @@ const clientFor = (options, requiresAuth = true) => {
         // The SDK constructor rejects an absent token, so a public endpoint is given
         // an empty one rather than being made to demand a credential it never sends.
         bearerToken: config.bearerToken ?? '',
+        // Sent as `X-Roark-Project-Id`. Absent unless configured, because a project key names its own
+        // project and an empty header is a 400 rather than a no-op.
+        ...(config.project === undefined ? {} : { project: config.project }),
         ...(config.baseURL === undefined ? {} : { baseURL: config.baseURL }),
         ...(config.timeout === undefined ? {} : { timeout: config.timeout }),
         ...(config.maxRetries === undefined ? {} : { maxRetries: config.maxRetries }),

package/version.d.ts

@@ -1 +1 @@
-export declare const version = "0.28.0";
+export declare const version = "0.31.1";

package/version.js

@@ -10,4 +10,4 @@ exports.version = void 0;
 //
 // Do not edit: an edit here is overwritten, and the published number is whatever
 // package.json says.
-exports.version = '0.28.0'; // x-release-please-version
+exports.version = '0.31.1'; // x-release-please-version