@roarkanalytics/cli 0.36.0 → 0.37.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.37.1](https://github.com/roarkhq/cli-roark-analytics/compare/v0.37.0...v0.37.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **deps:** raise the @roarkanalytics/sdk floor to the release the credential commands need ([#93](https://github.com/roarkhq/cli-roark-analytics/issues/93)) ([179a331](https://github.com/roarkhq/cli-roark-analytics/commit/179a3319003fda28947bb06593c6e10b1e5af02c))
+
+## [0.37.0](https://github.com/roarkhq/cli-roark-analytics/compare/v0.36.0...v0.37.0) (2026-10-05)
+
+
+### Features
+
+* **cli:** cli update ([#91](https://github.com/roarkhq/cli-roark-analytics/issues/91)) ([430457c](https://github.com/roarkhq/cli-roark-analytics/commit/430457c6a130db45a1125c2f864187f1f5495b3b))
+
 ## [0.36.0](https://github.com/roarkhq/cli-roark-analytics/compare/v0.35.0...v0.36.0) (2026-10-03)
 
 

package/README.md

@@ -177,6 +177,14 @@ roark completion fish | source
 | `roark config apply [dir]` | Reconcile the project to a config directory (or bundle). Previews and confirms first. |
 | `roark config diff [dir]`  | Preview the changes a config directory (or bundle) would make. No writes.             |
 
+### credential
+
+| Command                                   | Description                             |
+| ----------------------------------------- | --------------------------------------- |
+| `roark credential create --name <value>`  | Create a personal credential            |
+| `roark credential list`                   | List your personal credentials          |
+| `roark credential revoke <credential-id>` | Revoke one of your personal credentials |
+
 ### customer-flow
 
 | Command                                                                                                                                               | Description                            |

package/commands.js

@@ -30,6 +30,7 @@ exports.GROUPS = {
     'call tool-invocation': 'Manage call tool invocations',
     'call transcript': 'Read call transcript',
     config: 'Read configs',
+    credential: 'Manage credentials',
     'customer-flow': 'Manage customer flows',
     'customer-flow edge-case': 'Manage customer flow edge cases',
     'customer-flow graph': 'Manage customer flow graph',
@@ -1895,6 +1896,120 @@ exports.COMMANDS = [
         acceptsBody: true,
         requiresAuth: true,
     },
+    {
+        commandPath: ['credential', 'create'],
+        clientProperty: 'me',
+        methodName: 'createAPIKey',
+        httpMethod: 'post',
+        httpPath: '/v1/me/api-keys',
+        summary: 'Create a personal credential',
+        description: 'Mints a credential that acts as you, for a CLI or an automation. The key value is returned exactly once, in the `key` field: capture it now, it is unreadable afterwards. Requires a personal credential (a project API key is refused) and admin on the project the credential defaults to. The new credential can never exceed the one that created it: not in scope, not in permissions, and not in lifetime. Omit a field to copy it from the calling credential.',
+        positionals: [],
+        flags: [
+            {
+                name: 'name',
+                path: ['name'],
+                location: 'body',
+                required: true,
+                description: 'A label you will recognise later. It is the only thing that tells two credentials apart in the list you revoke from.',
+                valueKind: 'string',
+                repeatable: false,
+            },
+            {
+                name: 'project-id',
+                path: ['projectId'],
+                location: 'body',
+                required: false,
+                description: "Project the credential assumes when a request sends no X-Roark-Project-Id header. Defaults to the calling credential's own default project. You must be an admin of whichever project is used.",
+                valueKind: 'string',
+                repeatable: false,
+            },
+            {
+                name: 'scopes',
+                path: ['scopes'],
+                location: 'body',
+                required: false,
+                description: "Coarse tier. Defaults to the calling credential's own tier, and can never exceed it: a READ credential cannot mint a WRITE one.",
+                valueKind: 'array',
+                enumValues: ['READ', 'WRITE'],
+                repeatable: true,
+            },
+            {
+                name: 'permissions',
+                path: ['permissions'],
+                location: 'body',
+                required: false,
+                description: "Granular 'resource:action' permissions. Defaults to the calling credential's own set, and can never exceed it. A ceiling, not an entitlement: the holder still only reaches what their project membership allows.",
+                valueKind: 'array',
+                repeatable: true,
+            },
+            {
+                name: 'expires-at',
+                path: ['expiresAt'],
+                location: 'body',
+                required: false,
+                description: "ISO 8601 expiry. Defaults to the calling credential's own expiry (no expiry, for a `roark auth login` credential) and may not outlive it, so a short-lived connector credential cannot mint a permanent one.",
+                valueKind: 'string',
+                repeatable: false,
+            },
+        ],
+        hasParams: true,
+        paramsAllOptional: false,
+        bodyOpaque: false,
+        bodyVariants: [],
+        acceptsBody: true,
+        requiresAuth: true,
+    },
+    {
+        commandPath: ['credential', 'list'],
+        clientProperty: 'me',
+        methodName: 'listAPIKeys',
+        httpMethod: 'get',
+        httpPath: '/v1/me/api-keys',
+        summary: 'List your personal credentials',
+        description: 'Returns the credentials that act as you: the ones created in the dashboard, from `roark auth login`, and MCP connectors. Requires a personal credential; a project API key is refused. Defaults to ACTIVE, pass ?status=REVOKED to see revoked ones. The key value itself is never returned.',
+        positionals: [],
+        flags: [
+            {
+                name: 'status',
+                path: ['status'],
+                location: 'query',
+                required: false,
+                description: 'Filter by status. Defaults to ACTIVE.',
+                valueKind: 'string',
+                enumValues: ['ACTIVE', 'REVOKED'],
+                repeatable: false,
+            },
+        ],
+        hasParams: true,
+        paramsAllOptional: true,
+        bodyOpaque: false,
+        bodyVariants: [],
+        acceptsBody: false,
+        requiresAuth: true,
+    },
+    {
+        commandPath: ['credential', 'revoke'],
+        clientProperty: 'me',
+        methodName: 'revokeAPIKey',
+        httpMethod: 'delete',
+        httpPath: '/v1/me/api-keys/{id}',
+        summary: 'Revoke one of your personal credentials',
+        description: 'Revokes a credential that acts as you. It stops working immediately. A credential may revoke itself, which is what `roark auth logout` does. Repeating the call is safe; an unknown id, or one belonging to someone else, answers 404.',
+        positionals: [
+            {
+                name: 'credential-id',
+                paramKey: 'id',
+            },
+        ],
+        flags: [],
+        hasParams: false,
+        paramsAllOptional: true,
+        bodyOpaque: false,
+        bodyVariants: [],
+        acceptsBody: false,
+        requiresAuth: true,
+    },
     {
         commandPath: ['customer-flow', 'create'],
         clientProperty: 'customerFlow',