datagrok-tools 6.5.10 → 6.7.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Datagrok-tools changelog
 
+## 6.7.0 (WIP)
+
+* `grok login <server>` — keypair authentication, the replacement for the developer key. Generates an EC P-256 key, registers only its public half (in the browser, or with a one-shot `--code` from Profile > Public keys...), and keeps the private half in `~/.grok/keys/<alias>.json`. Logging in signs a server-issued nonce, so nothing reusable crosses the wire; keys can carry an expiry (`--expires`) and are revoked one at a time. `grok publish`, `grok test`, `grok stresstest` and `grok s` use it automatically whenever one is configured for the server, and fall back to the developer key otherwise. For CI, `GROK_PRIVATE_KEY` holds the private JWK (raw or base64) instead of a config file. Needs a server from 1.28 on; see https://datagrok.ai/help/govern/access-control/keypair-authentication
+* `grok s token` — prints a session token for the configured server, so shell scripts stop curling `/users/login/dev` with a long-lived key.
+* `grok config add` — `--key` is now optional: a server reached with a keypair has no developer key to record.
+* Against a server older than 1.28 — which has no keypair endpoints and refuses their paths before routing — the CLI names the version needed instead of reporting a bare 401, and falls back to the developer key when one is still configured for that server.
+* `grok login` reports its progress step by step (spinner on a terminal, one line per step in a log), including while it waits for the browser approval.
+
+## 6.6.0 (2026-09-13)
+
+* The developer key is sent in the `Authorization` header (`Dev <key>`) instead of the URL path. `POST /users/login/dev/<key>` and `POST /packages/dev/<key>/<package>` put a long-lived credential into every nginx access log, proxy log and shell history along the way; the key-less routes (`/users/login/dev`, `/packages/dev/<package>`) take it as a header. Servers that predate the header form answer 404/401 and the old URL is used instead, so publishing to an older server still works - but a server from 1.28 on rejects the URL form and asks for datagrok-tools 6.6.0 or later.
+
 ## 6.5.10 (2026-09-11)
 
 * `grok s pull` — a bundle file name is capped at 200 bytes plus a digest of the full name, so it stays unique and stable across pulls. A nested view under a long space spells a longer name than a path component may hold (255 bytes on ext4 and NTFS): one TWIG snapshot reached 268 and the write failed with `ENAMETOOLONG`, taking down the whole part rather than the entity — a `--by-namespace` part that only touched the space as a dependency died with it.

package/CLAUDE.md

@@ -94,7 +94,9 @@ The `publish` command executes these steps:
 3. Process environment variables in `/connections/*.json` files (replace `${VAR}`)
 4. **Process Docker images** (see below)
 5. Create ZIP archive with archiver-promise (includes `image.json` metadata per container)
-6. Upload to server: `POST ${host}/packages/dev/${devKey}/${packageName}`
+6. Upload to server: `POST ${host}/packages/dev/${packageName}` with `Authorization: Dev ${devKey}`
+   (older servers only know `POST ${host}/packages/dev/${devKey}/${packageName}`; `devKeyFetch` in
+   `bin/utils/dev-key.ts` falls back to it on 404/401)
 
 **Key flags:**
 - `--debug` (default) - Package visible only to developer

package/GROK_S.md

@@ -52,13 +52,21 @@ servers:
     key: admin
   dev:
     url: https://dev.datagrok.ai/api
-    key: <developer-key>
+    keyFile: /home/me/.grok/keys/dev.json
+    login: me
 ```
 
-- `grok config add --alias <name> --server <url> --key <key>` writes a new entry.
+- `grok login <server>` is the way to add a server: it registers a keypair and writes the
+  entry for you. The private key stays in `~/.grok/keys/<alias>.json`.
+  See [keypair authentication](../help/govern/access-control/keypair-authentication.md).
+- `grok config add --alias <name> --server <url> [--key <developer-key>]` writes an entry by
+  hand. The developer key is deprecated; omit it when the server is reached with a keypair.
 - Add `--default` to make it the active server.
+- In CI, `GROK_PRIVATE_KEY` (the private JWK, raw or base64) overrides the config file.
 - Every `grok s ...` command accepts `--host <alias-or-url>` to override the default. The URL
   is the API base (`https://host/api`, or `http://host:8082` for a bare Datlas).
+- `grok s token` prints a session token for the target server — what a shell script needs
+  when it has to call the API with `curl` itself.
 
 ## Entity operations
 

package/README.md

@@ -100,6 +100,11 @@ For more information on configuring connections, refer to the [Connections](http
   - `--suffix`: a string containing package version hash
 
   Running `grok publish` is the same as running `grok publish defaultHost --build --debug`.
+- `report` works with user error reports on a Datagrok instance (the instance is a server alias from
+  `config.yaml`): `grok report fetch <instance> <number>` downloads the report zip, `grok report read
+  <zip|json|instance number>` prints one normalized JSON object (flags `--extract-screenshot`,
+  `--extract-d42`, `--extract-client-log`), `grok report resolve <instance> <number>` marks it resolved.
+  `ticket`, `comment`, `label`, `attach` talk to JIRA with `JIRA_TOKEN`. See `grok report --help`.
 - `check` checks package content (function signatures, import statements of external modules,
   etc.). The check is also run during package publication.
 - `init` modifies a package template by adding config files for linters, IDE, and so on

package/bin/_deprecated/upload.js

@@ -72,7 +72,8 @@ async function processPackage() {
   let timestamps = {};
   if (debug) {
     try {
-      timestamps = await (await fetch(`${host}/packages/dev/${devKey}/${packageName}/timestamps`)).json();
+      timestamps = await (await fetch(`${host}/packages/dev/${packageName}/timestamps`,
+        {headers: {Authorization: `Dev ${devKey}`}})).json();
       if (timestamps['#type'] === 'ApiError') {
         console.log(timestamps.message);
         return 1;
@@ -134,8 +135,9 @@ async function processPackage() {
 
   //upload
   const uploadPromise = new Promise((resolve, reject) => {
-    fetch(`${host}/packages/dev/${devKey}/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
+    fetch(`${host}/packages/dev/${packageName}?debug=${debug.toString()}&rebuild=${rebuild.toString()}`, {
       method: 'POST',
+      headers: {Authorization: `Dev ${devKey}`},
       body: zip,
     }).then((body) => body.json()).then((j) => resolve(j)).catch((err) => {
       reject(err);

package/bin/commands/config.js

@@ -84,7 +84,9 @@ function config(args) {
   const nOptions = Object.keys(args).length - 1;
   const askRegistry = args.registry != null;
   const interactiveMode = args['_'].length === 1 && (nOptions < 1 || nOptions === 1 && (args.reset || askRegistry) || nOptions === 2 && args.reset && askRegistry);
-  const hasAddServerCommand = args['_'].length === 2 && args['_'][1] === 'add' && args.server && args.key && args.k && args.alias && nOptions >= 4 && nOptions <= 6;
+  // `--key` is optional: a server reached with a keypair (`grok login`) has no
+  // developer key to record. minimist mirrors -k into both `key` and `k`.
+  const hasAddServerCommand = args['_'].length === 2 && args['_'][1] === 'add' && args.server && args.alias && nOptions >= 2 && nOptions <= 6;
   if (!interactiveMode && !hasAddServerCommand) return false;
   if (!_fs.default.existsSync(grokDir)) _fs.default.mkdirSync(grokDir);
   if (!_fs.default.existsSync(confPath) || args.reset) _fs.default.writeFileSync(confPath, _jsYaml.default.dump(confTemplate));
@@ -100,7 +102,7 @@ function config(args) {
     }
     const server = {
       url: args.server,
-      key: args.key
+      key: args.key ?? ''
     };
     if (args.registry != null) {
       const registry = typeof args.registry === 'string' ? args.registry : defaultRegistry(args.server);

package/bin/commands/help.js

@@ -21,6 +21,7 @@ Commands:
     docker-gen  Generate Celery Docker artifacts from Python functions
     init        Modify a package template
     link        Link \`datagrok-api\` and libraries for local development
+    login       Log in to a server with a keypair (replaces the developer key)
     publish     Upload a package
     report      Manage user error reports (fetch, resolve, create ticket)
     run         Build, publish, and open in browser
@@ -138,6 +139,29 @@ Options:
                   file exists, plain \`grok api\` keeps it up to date; delete it to
                   opt out again
 `;
+const HELP_LOGIN = `
+Usage: grok login <server>
+
+Log in to a Datagrok server with a keypair. Generates an EC P-256 key, registers
+its public half on your account, and stores the private half in
+~/.grok/keys/<alias>.json. Nothing reusable is ever copied out of the UI, and the
+key can be given an expiry and revoked on its own.
+
+grok login https://dev.datagrok.ai      Approve the key in the browser
+grok login dev --code AB12CD34          Use a code from your profile page
+                                        (Profile > Public keys...), no browser
+
+Options:
+[--code] [--name] [--expires] [--alias]
+
+--code      One-shot enrollment code from your profile page. Skips the browser
+--name      Key name shown in your profile (default: user@host)
+--expires   Days from now, or an ISO date (2027-01-31). Default: never
+--alias     Config alias to write (default: the server's first host label)
+
+For CI, set GROK_PRIVATE_KEY to the private key JWK (raw or base64) instead of a
+config file. Read more: https://datagrok.ai/help/govern/access-control/keypair-authentication
+`;
 const HELP_CONFIG = `
 Usage: grok config
 
@@ -150,6 +174,7 @@ Options:
 --server    Use to add a server to the config (\`grok config add --alias alias --server url --key key\`)
 --alias     Use in conjunction with the \`server\` option to set the server name
 --key       Use in conjunction with the \`server\` option to set the developer key
+            (deprecated - prefer \`grok login\`, which needs no key here)
 --default   Use in conjunction with the \`server\` option to set the added server as default
 --registry  Docker registry URL (default: registry.{server hostname})
 `;
@@ -371,10 +396,17 @@ Usage: grok report <subcommand> [args]
 Manage Datagrok user error reports
 
 Subcommands:
-    fetch    Download a report zip from a managed instance
+    fetch    Download a report zip from a managed instance (writes <stem>_meta.json next to it)
     read     Normalize a report (zip or json) into one JSON object on stdout
-    resolve  Mark a report as resolved
-    ticket   Create a JIRA ticket for a report via the Datlas API
+    resolve  Mark a report as resolved (needs the _meta.json written by fetch)
+    ticket   Create a JIRA ticket for a report directly in JIRA (no dedup; the key is NOT
+             written back to the report — prefer POST /reports/{id}/jira for that)
+    comment  Add a comment to a JIRA ticket (--body <text> | --body-file <path>)
+    label    Add labels to a JIRA ticket
+    attach   Attach a file to a JIRA ticket
+
+JIRA subcommands need JIRA_TOKEN (plus JIRA_USER for a user API token); ticket also needs
+--project or $JIRA_PROJECT.
 
 Read flags:
     --extract-screenshot <path>  Write the screenshot binary to <path>
@@ -403,6 +435,7 @@ const help = exports.help = {
   'docker-gen': HELP_DOCKER_GEN,
   init: HELP_INIT,
   link: HELP_LINK,
+  login: HELP_LOGIN,
   publish: HELP_PUBLISH,
   report: HELP_REPORT,
   run: HELP_RUN,

package/bin/commands/login.js

@@ -0,0 +1,213 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.login = login;
+var _crypto = _interopRequireDefault(require("crypto"));
+var _http = _interopRequireDefault(require("http"));
+var _os = _interopRequireDefault(require("os"));
+var _child_process = require("child_process");
+var color = _interopRequireWildcard(require("../utils/color-utils"));
+var kp = _interopRequireWildcard(require("../utils/keypair"));
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * `grok login <server>` - generates a keypair, registers its public half on the
+ * server, and stores the private half locally. Replaces the developer key: no
+ * reusable secret is copied out of the UI, and the key can be given an expiry
+ * and revoked on its own.
+ */
+async function login(args) {
+  if (args['_'].length > 2) return false;
+  const target = (args['_'][1] ?? '').toString();
+  const name = args.name ?? `${_os.default.userInfo().username}-${_os.default.hostname()}`;
+  const expires = parseExpiry(args.expires);
+  if (args.expires && !expires) {
+    color.error('--expires takes a number of days or an ISO date (2027-01-31)');
+    return false;
+  }
+  let url;
+  let alias;
+  let keyFile;
+  let registered;
+  const config = kp.readConfig();
+  const {
+    publicKey,
+    privateKey
+  } = kp.generateKeyPair();
+  try {
+    ({
+      url,
+      alias
+    } = resolveTarget(target, config, args.alias));
+    url = await color.step(`Finding the Datagrok API at ${url}`, () => resolveApiRoot(url));
+    registered = args.code ? await color.step(`Registering "${name}" with the enrollment code`, () => kp.enrollWithCode(url, args.code, publicKey, name, expires)) : await enrollInBrowser(url, publicKey, name, expires);
+    if (registered.login == null) throw new Error(registered.comment ?? registered.message ?? 'The server did not accept the key');
+    keyFile = await color.step('Storing the private key', async () => {
+      const file = kp.savePrivateKey(alias, privateKey);
+      config.servers ??= {};
+      config.servers[alias] = {
+        ...(config.servers[alias] ?? {}),
+        url,
+        key: config.servers[alias]?.key ?? '',
+        keyFile: file,
+        login: registered.login
+      };
+      config.default ??= alias;
+      kp.writeConfig(config);
+      return file;
+    });
+
+    // Proves the round trip before the user walks away, rather than at the next
+    // `grok publish`: a key that registered but cannot sign is worse than none.
+    await color.step('Signing in with the new key', () => kp.keyLogin(url, privateKey));
+  } catch (error) {
+    color.error(error.message ?? String(error));
+    return false;
+  }
+  color.success(`Logged in to ${url} as ${registered.login}`);
+  console.log(`  key         ${name} (${kp.fingerprint(publicKey)})`);
+  console.log(`  private key ${keyFile}`);
+  console.log(`  alias       ${alias} - use it as \`grok publish ${alias}\`, \`grok test --host ${alias}\``);
+  if (expires) console.log(`  expires     ${expires}`);
+  return true;
+}
+function resolveTarget(target, config, aliasArg) {
+  if (target === '') {
+    const alias = aliasArg ?? config.default;
+    if (!alias || !config.servers?.[alias]) throw new Error('Which server? Pass a URL or a configured alias: grok login https://dev.datagrok.ai/api');
+    return {
+      url: config.servers[alias].url,
+      alias
+    };
+  }
+  const configured = config.servers?.[target];
+  if (configured) return {
+    url: configured.url,
+    alias: aliasArg ?? target
+  };
+  let parsed;
+  try {
+    parsed = new URL(target);
+  } catch {
+    throw new Error(`"${target}" is neither a URL nor a server in your config`);
+  }
+  return {
+    url: parsed.href.replace(/\/$/, ''),
+    alias: aliasArg ?? defaultAlias(parsed)
+  };
+}
+
+/**
+ * The API base for [url]. A stand behind nginx serves it at `<origin>/api`, a bare Datlas at
+ * the origin itself, and there is no telling which from the URL alone - so ask, rather than
+ * guess and fail at the first call.
+ *
+ * A 200 is not the answer: nginx serves the single-page app for anything it does not route,
+ * so the origin of a real stand answers `/info/server` with the app's HTML. Only a JSON body
+ * that names the server counts.
+ */
+async function resolveApiRoot(url) {
+  const candidates = /\/api$/.test(url) ? [url] : [`${url}/api`, url];
+  for (const candidate of candidates) {
+    try {
+      const response = await fetch(`${candidate}/info/server`);
+      if (!response.ok) continue;
+      const info = JSON.parse(await response.text());
+      if (info?.webRoot != null || info?.Version != null) return candidate;
+    } catch {/* not JSON, or unreachable: try the next shape */}
+  }
+  throw new Error(`${url} does not answer as a Datagrok API (tried ${candidates.join(' and ')})`);
+}
+function defaultAlias(url) {
+  const host = url.hostname;
+  if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return 'local';
+  return host.split('.')[0];
+}
+
+/** Days from now, or an ISO date, as the ISO instant the server stores. */
+function parseExpiry(value) {
+  if (value == null || value === '') return undefined;
+  const days = Number(value);
+  if (!isNaN(days) && days > 0) return new Date(Date.now() + days * 86400000).toISOString();
+  const date = new Date(String(value));
+  return isNaN(date.getTime()) ? undefined : date.toISOString();
+}
+
+/**
+ * Opens the server's enrollment page in a browser and waits for it to call back
+ * on a loopback listener. The user authenticates however that stand does -
+ * password, SSO, SAML - because the approval happens in the platform UI.
+ */
+async function enrollInBrowser(url, publicKey, name, expires) {
+  const origin = new URL(url).origin;
+  // The page asks for this before it registers anything. It exists only in this terminal, so a
+  // link someone else sent has nothing for the user to type — which is the difference between
+  // approving one's own `grok login` and handing an attacker a key to one's account.
+  const verify = _crypto.default.randomBytes(4).toString('hex').toUpperCase().slice(0, 6);
+  let started;
+  const listening = new Promise(resolve => started = resolve);
+  const approved = new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error('Timed out waiting for the browser. Use `grok login <server> --code <code>` ' + 'with a code from your profile page instead.'));
+    }, 5 * 60 * 1000);
+    const server = _http.default.createServer((req, res) => {
+      const params = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams;
+      const status = params.get('status');
+      res.writeHead(200, {
+        'content-type': 'text/html; charset=utf-8'
+      });
+      res.end(status === 'ok' ? '<h3>Key registered. You can close this tab and return to the terminal.</h3>' : `<h3>Key registration was cancelled.</h3><p>${escapeHtml(params.get('message') ?? '')}</p>`);
+      clearTimeout(timeout);
+      server.close();
+      if (status === 'ok') resolve({
+        login: params.get('login'),
+        fingerprint: params.get('fingerprint')
+      });else reject(new Error(params.get('message') ?? 'Key registration was cancelled in the browser'));
+    });
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      const enrollUrl = `${origin}/enroll-key?` + new URLSearchParams({
+        pk: JSON.stringify(publicKey),
+        name,
+        ...(expires ? {
+          expires
+        } : {}),
+        verify,
+        cb: `http://127.0.0.1:${port}`
+      }).toString();
+      console.log(`\n  Verification code: ${verify}`);
+      console.log(`  Type it on the page that opens. If the browser does not open, visit:`);
+      console.log(`    ${enrollUrl}\n`);
+      openBrowser(enrollUrl);
+      started();
+    });
+  });
+
+  // The prints above land before the spinner starts, so the code stays readable on screen.
+  await listening;
+  return await color.step(`Waiting for approval in the browser at ${origin}`, () => approved);
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"]/g, c => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;'
+  })[c]);
+}
+function openBrowser(url) {
+  try {
+    // cmd splits an unquoted argument at `&`, and the enrollment URL is all query parameters;
+    // rundll32 takes the whole thing and hands it to the default browser.
+    const [command, args] = process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+    (0, _child_process.spawn)(command, args, {
+      detached: true,
+      stdio: 'ignore'
+    }).unref();
+  } catch {
+    // The URL is printed above; a headless box just uses that.
+  }
+}

package/bin/commands/publish.js

@@ -20,6 +20,8 @@ var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _check = require("./check");
 var _pythonCeleryGen = require("../utils/python-celery-gen");
 var _queueWorkerGen = require("../utils/queue-worker-gen");
+var _devKey = require("../utils/dev-key");
+var keypair = _interopRequireWildcard(require("../utils/keypair"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 // @ts-ignore
 
@@ -241,18 +243,21 @@ function listRecursive(basePath, rel) {
   return results;
 }
 async function getUserLogin(host, devKey) {
-  let loginResp;
+  let token;
   try {
-    loginResp = await (0, _nodeFetch.default)(`${host}/users/login/dev/${devKey}`, {
-      method: 'POST'
-    });
+    token = await (0, _devKey.keypairToken)(host, devKey);
+    if (token == null) {
+      const loginResp = await (0, _devKey.devKeyFetch)(`${host}/users/login/dev`, `${host}/users/login/dev/${devKey}`, devKey, {
+        method: 'POST'
+      });
+      if (loginResp.status !== 200) return null;
+      token = (await loginResp.json()).token;
+    }
   } catch (e) {
     color.warn(`Cannot reach server ${host}: ${e.message || e}`);
     return null;
   }
-  if (loginResp.status !== 200) return null;
-  const loginData = await loginResp.json();
-  const token = loginData.token;
+  if (token == null) return null;
   try {
     const userResp = await (0, _nodeFetch.default)(`${host}/users/current`, {
       headers: {
@@ -485,9 +490,10 @@ async function fallbackImage(img, host, devKey, registry, version, contentHash)
 async function processPackage(debug, rebuild, host, devKey, packageName, dropDb, suffix, hostAlias, registry, rebuildDocker, skipDockerRebuild) {
   // Validate server connectivity and dev key
   let timestamps = {};
-  let url = `${host}/packages/dev/${devKey}/${packageName}`;
+  const url = `${host}/packages/dev/${packageName}`;
+  const legacyUrl = `${host}/packages/dev/${devKey}/${packageName}`;
   try {
-    const checkResp = await (0, _nodeFetch.default)(url + '/timestamps');
+    const checkResp = await (0, _devKey.devKeyFetch)(`${url}/timestamps`, `${legacyUrl}/timestamps`, devKey, {}, host);
     const checkData = await checkResp.json();
     if (checkData['#type'] === 'ApiError') {
       color.error(checkData.message);
@@ -614,15 +620,15 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
   });
 
   // Upload
-  url += `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
-  if (suffix) url += `&suffix=${suffix.toString()}`;
+  let query = `?debug=${debug.toString()}&rebuild=${rebuild.toString()}&dropDb=${(dropDb ?? false).toString()}`;
+  if (suffix) query += `&suffix=${suffix.toString()}`;
   await zip.finalize();
   const zipBuffer = Buffer.concat(chunks);
   try {
-    const body = await (0, _nodeFetch.default)(url, {
+    const body = await (0, _devKey.devKeyFetch)(url + query, legacyUrl + query, devKey, {
       method: 'POST',
       body: zipBuffer
-    });
+    }, host);
     const log = JSON.parse(await body.text());
     if (log != undefined) {
       if (log['#type'] === 'ApiError') {
@@ -726,7 +732,7 @@ async function publishPackage(args) {
 
   // Update the developer key
   if (args.key) key = args.key;
-  if (key === '') return color.warn('Please provide the key with `--key` option or add it by running `grok config`');
+  if (!key && !keypair.keypairFor(url)) return color.warn(`No credentials for ${url}. Run \`grok login ${host}\`, ` + 'or pass a developer key with `--key` (deprecated).');
 
   // Get the package name
   if (!_fs.default.existsSync(packDir)) return color.error('`package.json` doesn\'t exist');

package/bin/commands/server.js

@@ -27,7 +27,7 @@ const ENTITY_TYPES = {
   reports: 'UserReport'
 };
 const ENTITIES = ['users', 'groups', 'functions', 'connections', 'queries', 'scripts', 'packages', 'reports', 'files', 'tables'];
-const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle'];
+const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle', 'token'];
 const VERBS = ['list', 'count', 'get', 'delete'];
 async function server(argv) {
   const args = argv['_'].slice(1);
@@ -61,6 +61,12 @@ async function server(argv) {
     if (['pull', 'push', 'migrate', 'diff', 'bundle'].includes(entity)) return await (0, _serverMigrate.handleMigrate)(dapi, entity, [verb, ...rest].filter(Boolean), argv, output);
     if (entity === 'domains') return await (0, _serverDomains.handleDomains)(dapi, verb, rest, argv, output);
     if (entity === 'batch') return await handleBatch(dapi, argv, verb, rest, output);
+    // Shell scripts that used to curl /users/login/dev get a token the same way
+    // every other command does, whatever credential the config holds.
+    if (entity === 'token') {
+      console.log(client.token);
+      return true;
+    }
     if (entity === 'raw') return await handleRaw(dapi, verb, rest, argv, output);
     if (entity === 'describe') return await handleDescribe(dapi, verb ?? rest[0], output);
     if (entity === 'healthcheck') return await handleHealthcheck(dapi, argv, output);

package/bin/commands/stress-tests.js

@@ -49,7 +49,9 @@ async function run(config, args) {
   processArgs.push('./node-test-loader/register.mjs');
   processArgs.push('src/package-test-node.ts');
   processArgs.push(`--apiUrl=${config.url}`);
-  processArgs.push(`--devKey=${config.key}`);
+  // A session token rather than the credential: it is short-lived, and with a keypair
+  // there is no reusable secret to put on a command line at all.
+  processArgs.push(`--token=${await testUtils.getToken(config.url, config.key)}`);
   // Explicit even though it's the runner default: the stress baseline must only run
   // stressTest-marked tests regardless of how the runner's default evolves.
   processArgs.push('--mode=stress');

package/bin/grok.js

@@ -23,6 +23,7 @@ const commands = {
   'docker-gen': require('./commands/docker-gen').dockerGen,
   init: require('./commands/init').init,
   link: require('./commands/link').link,
+  login: require('./commands/login').login,
   publish: require('./commands/publish').publish,
   report: require('./commands/report').report,
   run: require('./commands/run').run,

package/bin/utils/color-utils.js

@@ -5,7 +5,9 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.isVerbose = exports.info = exports.fail = exports.error = void 0;
 exports.log = log;
-exports.warn = exports.success = exports.setVerbose = void 0;
+exports.setVerbose = void 0;
+exports.step = step;
+exports.warn = exports.success = void 0;
 const error = s => console.log('\x1b[31m%s\x1b[0m', s);
 exports.error = error;
 const info = s => console.log('\x1b[32m%s\x1b[0m', s);
@@ -42,4 +44,31 @@ function log(s, type = 'plain') {
       console.log(s);
       break;
   }
+}
+
+/**
+ * One step of a multi-step command: prints its label, ticks a spinner while [action] runs, and
+ * replaces the line with the outcome. A spinner needs a terminal to erase lines, so a CI log
+ * (or a redirected stdout) gets one plain line per step instead.
+ */
+async function step(label, action) {
+  const tty = process.stdout.isTTY === true;
+  const frames = ['-', '\\', '|', '/'];
+  let frame = 0;
+  const draw = () => process.stdout.write(`\r  ${frames[frame++ % frames.length]} ${label}   `);
+  if (!tty) console.log(`  ${label}...`);
+  const timer = tty ? setInterval(draw, 120) : null;
+  if (tty) draw();
+  const finish = (mark, color, text) => {
+    if (timer) clearInterval(timer);
+    if (tty) process.stdout.write(`\r\x1b[2K  \x1b[${color}m${mark}\x1b[0m ${text}\n`);else if (mark !== '+') console.log(`  ${mark} ${text}`);
+  };
+  try {
+    const result = await action();
+    finish('+', '32', label);
+    return result;
+  } catch (e) {
+    finish('x', '31', label);
+    throw e;
+  }
 }

package/bin/utils/dev-key.js

@@ -0,0 +1,71 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.devKeyFetch = devKeyFetch;
+exports.devKeyHeaders = devKeyHeaders;
+exports.keypairToken = keypairToken;
+var keypair = _interopRequireWildcard(require("./keypair"));
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+const fetch = require('node-fetch');
+
+/** `Authorization` header carrying the developer key. */
+function devKeyHeaders(key, headers = {}) {
+  return {
+    ...headers,
+    'Authorization': `Dev ${key}`
+  };
+}
+
+/** One login per API root per process: every publish step reuses the token. */
+const tokenCache = new Map();
+
+/**
+ * Bearer token obtained by signing a nonce with the server's registered keypair,
+ * or `null` when no keypair is configured for [apiRoot] and the caller should
+ * fall back to the developer key.
+ */
+async function keypairToken(apiRoot, devKey) {
+  const privateKey = keypair.keypairFor(apiRoot, devKey);
+  if (!privateKey) return null;
+  if (!tokenCache.has(apiRoot)) tokenCache.set(apiRoot, keypair.keyLogin(apiRoot, privateKey));
+  try {
+    return await tokenCache.get(apiRoot);
+  } catch (e) {
+    // A server without the keypair endpoints is a reason to use the developer key that is
+    // still configured, not to stop: one config usually names stands of both vintages.
+    if (e?.name !== 'ServerTooOldError' || !devKey) throw e;
+    tokenCache.delete(apiRoot);
+    return null;
+  }
+}
+
+/**
+ * Calls [url] as the configured user. With a keypair (`grok login`) that is a
+ * session token; otherwise the developer key rides in the `Authorization`
+ * header, falling back to [legacyUrl] - which carries the key as a path segment -
+ * for servers that predate the header form. Those answer 404 (no such route) or
+ * 401 (the route-less path is not on their anonymous allow-list); a server that
+ * knows the header form answers neither.
+ *
+ * [apiRoot] enables the keypair path; without it this stays dev-key only.
+ */
+async function devKeyFetch(url, legacyUrl, key, init = {}, apiRoot) {
+  if (apiRoot != null) {
+    const token = await keypairToken(apiRoot, key);
+    if (token) return await fetch(url, {
+      ...init,
+      headers: {
+        ...init.headers,
+        'Authorization': token
+      }
+    });
+  }
+  const response = await fetch(url, {
+    ...init,
+    headers: devKeyHeaders(key, init.headers)
+  });
+  if (response.status !== 404 && response.status !== 401) return response;
+  return await fetch(legacyUrl, init);
+}

package/bin/utils/keypair.js

@@ -0,0 +1,292 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.ServerTooOldError = exports.MIN_SERVER_VERSION = void 0;
+exports.enrollWithCode = enrollWithCode;
+exports.fingerprint = fingerprint;
+exports.generateKeyPair = generateKeyPair;
+exports.getServerCredentials = getServerCredentials;
+exports.hasKeypair = hasKeypair;
+exports.keyFilePath = keyFilePath;
+exports.keyFromEnv = keyFromEnv;
+exports.keyLogin = keyLogin;
+exports.keypairFor = keypairFor;
+exports.publicPart = publicPart;
+exports.readConfig = readConfig;
+exports.savePrivateKey = savePrivateKey;
+exports.signNonce = signNonce;
+exports.writeConfig = writeConfig;
+var _crypto = _interopRequireDefault(require("crypto"));
+var _fs = _interopRequireDefault(require("fs"));
+var _os = _interopRequireDefault(require("os"));
+var _path = _interopRequireDefault(require("path"));
+var _jsYaml = _interopRequireDefault(require("js-yaml"));
+const grokDir = _path.default.join(_os.default.homedir(), '.grok');
+const confPath = _path.default.join(grokDir, 'config.yaml');
+const keysDir = _path.default.join(grokDir, 'keys');
+
+/** Prefix the server wraps a nonce in before checking the signature. */
+const SIGNATURE_PREFIX = 'datagrok-login:';
+/** Generates the keypair `grok login` registers: EC P-256, the JOSE ES256 curve. */
+function generateKeyPair() {
+  const {
+    publicKey,
+    privateKey
+  } = _crypto.default.generateKeyPairSync('ec', {
+    namedCurve: 'prime256v1'
+  });
+  return {
+    publicKey: publicKey.export({
+      format: 'jwk'
+    }),
+    privateKey: privateKey.export({
+      format: 'jwk'
+    })
+  };
+}
+
+/** The public half of a private JWK — what gets registered on the server. */
+function publicPart(privateKey) {
+  const {
+    d,
+    p,
+    q,
+    dp,
+    dq,
+    qi,
+    ...pub
+  } = privateKey;
+  return pub;
+}
+
+/**
+ * RFC 7638 JWK thumbprint, base64url without padding. The server computes the
+ * same value from the stored key, so this is what identifies a key at login.
+ */
+function fingerprint(jwk) {
+  const members = {
+    EC: ['crv', 'kty', 'x', 'y'],
+    RSA: ['e', 'kty', 'n']
+  };
+  const order = members[jwk.kty];
+  if (!order) throw new Error(`Unsupported key type "${jwk.kty}" - expected EC or RSA`);
+  const canonical = '{' + order.map(m => `${JSON.stringify(m)}:${JSON.stringify(jwk[m])}`).join(',') + '}';
+  return _crypto.default.createHash('sha256').update(canonical).digest('base64url');
+}
+
+/**
+ * Signs the login nonce. [audience] is the API root this client dialed: it is part of what is
+ * signed, so a server cannot relay the signature to a second stand where the same key is
+ * enrolled. ECDSA signatures go out in the raw r||s form (JOSE's, not DER's), which is what
+ * the server's verifier expects.
+ */
+function signNonce(privateKey, audience, nonce) {
+  const key = _crypto.default.createPrivateKey({
+    key: privateKey,
+    format: 'jwk'
+  });
+  const options = {
+    key
+  };
+  if (privateKey.kty === 'EC') options.dsaEncoding = 'ieee-p1363';
+  return _crypto.default.sign('sha256', Buffer.from(`${SIGNATURE_PREFIX}${audience}:${nonce}`), options).toString('base64url');
+}
+
+/** Exchanges a keypair for a session token: ask for a nonce, sign it, log in. */
+async function keyLogin(url, privateKey) {
+  const fp = fingerprint(publicPart(privateKey));
+  const challenge = await postJson(`${url}/users/login/key/challenge`, {
+    fingerprint: fp
+  });
+  const response = await postJson(`${url}/users/login/key`, {
+    fingerprint: fp,
+    audience: url,
+    nonce: challenge.nonce,
+    signature: signNonce(privateKey, url, challenge.nonce)
+  });
+  if (response.isSuccess !== true) throw new Error(response.comment ?? 'Key login failed');
+  return response.token;
+}
+
+/** Registers [publicKey] with a one-shot enrollment code from the user profile. */
+async function enrollWithCode(url, code, publicKey, name, expires) {
+  return await postJson(`${url}/users/keys/enroll`, {
+    code,
+    name,
+    expires,
+    publicKey: JSON.stringify(publicKey)
+  });
+}
+
+/** The first Datagrok that has the keypair endpoints. */
+const MIN_SERVER_VERSION = exports.MIN_SERVER_VERSION = '1.28';
+
+/**
+ * Thrown when the server has no keypair endpoints at all. Callers that still hold a developer
+ * key catch it and fall back; `grok login` reports it, since there is nothing to fall back to.
+ */
+class ServerTooOldError extends Error {
+  constructor(server) {
+    super(`${server} does not support keypair authentication — it needs Datagrok ` + `${MIN_SERVER_VERSION} or later. Use a developer key for this server ` + '(grok config add --alias <alias> --server <url> --key <key>), or ask its operator to upgrade.');
+    this.server = server;
+    this.name = 'ServerTooOldError';
+  }
+}
+exports.ServerTooOldError = ServerTooOldError;
+async function postJson(url, body) {
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json'
+    },
+    body: JSON.stringify(body)
+  });
+  // These routes are anonymous on every server that has them. A server that does not answers
+  // 404 (no such route) or 401 (unknown paths are refused before routing) — either way, the
+  // keypair endpoints are simply not there.
+  if (response.status === 404 || response.status === 401) throw new ServerTooOldError(new URL(url).origin);
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`Unexpected response from ${url} (status ${response.status}): ${text.slice(0, 200)}`);
+  }
+}
+function keyFilePath(alias) {
+  return _path.default.join(keysDir, `${alias}.json`);
+}
+
+/** Writes the private key readable only by its owner, the way ssh-keygen does. */
+function savePrivateKey(alias, privateKey) {
+  _fs.default.mkdirSync(keysDir, {
+    recursive: true,
+    mode: 0o700
+  });
+  const file = keyFilePath(alias);
+  _fs.default.writeFileSync(file, JSON.stringify(privateKey, null, 2), {
+    mode: 0o600
+  });
+  // mkdirSync/writeFileSync ignore `mode` when the path already exists.
+  try {
+    _fs.default.chmodSync(keysDir, 0o700);
+    _fs.default.chmodSync(file, 0o600);
+  } catch {/* Windows has no POSIX modes; ACLs already keep it in the profile. */}
+  return file;
+}
+function readConfig() {
+  if (!_fs.default.existsSync(confPath)) return {
+    servers: {},
+    default: ''
+  };
+  return _jsYaml.default.load(_fs.default.readFileSync(confPath, {
+    encoding: 'utf-8'
+  })) ?? {
+    servers: {},
+    default: ''
+  };
+}
+function writeConfig(config) {
+  _fs.default.mkdirSync(grokDir, {
+    recursive: true
+  });
+  _fs.default.writeFileSync(confPath, _jsYaml.default.dump(config));
+}
+
+/**
+ * The key at [file], or `undefined` when there is none. A config can name a key file the
+ * deployment has not filled in yet — CI writes the entry and the secret separately — and that
+ * has to mean "fall back to the developer key". A file that exists but cannot be read or parsed
+ * is a different thing, and says so.
+ */
+function tryLoadKeyFile(file) {
+  const expanded = file.startsWith('~') ? _path.default.join(_os.default.homedir(), file.slice(1)) : file;
+  let text;
+  try {
+    text = _fs.default.readFileSync(expanded, {
+      encoding: 'utf-8'
+    });
+  } catch (error) {
+    if (error?.code === 'ENOENT') return undefined;
+    throw new Error(`cannot read the private key at ${expanded}: ${error?.message ?? error}`);
+  }
+  try {
+    return parseKey(text);
+  } catch (error) {
+    throw new Error(`${expanded} is not a private key in JWK form: ${error?.message ?? error}`);
+  }
+}
+
+/**
+ * The credentials for one server: its config entry, with `GROK_PRIVATE_KEY`
+ * taking precedence so a CI job can hold the key in a secret rather than on
+ * disk. [hostKey] is an alias, a URL, or empty for the default server.
+ */
+function getServerCredentials(hostKey) {
+  const config = readConfig();
+  let host = (hostKey === '' || hostKey == null ? config.default : hostKey).trim();
+  let entry;
+  let alias;
+  let url;
+  try {
+    url = new URL(host).href;
+    if (url.endsWith('/')) url = url.slice(0, -1);
+    // Several aliases can name the same server. Prefer one that has a keypair: a
+    // dev-key-only entry matching first would silently downgrade the login.
+    const matches = Object.keys(config.servers ?? {}).filter(name => config.servers[name].url === url);
+    alias = matches.find(name => config.servers[name].keyFile || _fs.default.existsSync(keyFilePath(name))) ?? matches[0];
+    entry = alias == null ? undefined : config.servers[alias];
+  } catch (error) {
+    entry = config.servers?.[host];
+    if (entry == null) throw new Error(`Unknown server alias. Please add it to ${confPath}`);
+    alias = host;
+    url = entry.url;
+  }
+  const cred = {
+    url: url,
+    alias,
+    key: entry?.key,
+    login: entry?.login
+  };
+  if (process.env.GROK_PRIVATE_KEY) {
+    cred.privateKey = parseKey(process.env.GROK_PRIVATE_KEY);
+    cred.privateKeySource = 'GROK_PRIVATE_KEY';
+  } else if (entry?.keyFile && (cred.privateKey = tryLoadKeyFile(entry.keyFile)) != null) cred.privateKeySource = entry.keyFile;else if (alias && (cred.privateKey = tryLoadKeyFile(keyFilePath(alias))) != null) cred.privateKeySource = keyFilePath(alias);
+  if (process.env.GROK_LOGIN) cred.login = process.env.GROK_LOGIN;
+  return cred;
+}
+
+/** A JWK, raw or base64-encoded — CI secret stores mangle multi-line values. */
+function parseKey(value) {
+  const text = value.trim().startsWith('{') ? value : Buffer.from(value.trim(), 'base64').toString('utf-8');
+  return JSON.parse(text);
+}
+function hasKeypair(cred) {
+  return cred.privateKey != null;
+}
+
+/** A private JWK held in an environment variable, raw or base64-encoded. */
+function keyFromEnv(name) {
+  const value = process.env[name];
+  return value ? parseKey(value) : undefined;
+}
+
+/**
+ * The private key to use for [url], or `undefined` to fall back to the developer
+ * key. An explicitly supplied [devKey] that differs from the one configured for
+ * this server means the caller wants *that* identity - a second CI user, say -
+ * so the configured keypair must not silently take over.
+ */
+function keypairFor(url, devKey) {
+  let cred;
+  try {
+    cred = getServerCredentials(url);
+  } catch {
+    return undefined;
+  }
+  if (cred.privateKey == null) return undefined;
+  if (devKey && devKey !== cred.key) return undefined;
+  return cred.privateKey;
+}

package/bin/utils/node-dapi.js

@@ -11,6 +11,7 @@ exports.mapPositionalParams = mapPositionalParams;
 exports.parseDomainAddress = parseDomainAddress;
 exports.throwIfApiError = throwIfApiError;
 var _crypto = require("crypto");
+var _keypair = require("./keypair");
 /// Docs: [Grok Dapi](/docs/plans/grok-dapi/)
 
 function ensureBodyId(body) {
@@ -62,13 +63,34 @@ async function fetchOrRetry(url, opts, retriable, timeoutMs = setting('TIMEOUT',
 class NodeApiClient {
   /** Set by `createClient` when the run asked for an admin session, so a re-login restores it. */
   adminMode = false;
-  constructor(baseUrl, token, devKey) {
+  constructor(baseUrl, token, devKey, privateKey) {
     this.baseUrl = baseUrl;
     this.token = token;
     this.devKey = devKey;
+    this.privateKey = privateKey;
   }
-  static async login(baseUrl, devKey) {
-    const res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
+
+  /** [privateKey] from a caller that resolved it by alias; otherwise it is looked up by URL. */
+  static async login(baseUrl, devKey, privateKey) {
+    privateKey ??= (0, _keypair.keypairFor)(baseUrl, devKey);
+    if (privateKey) {
+      try {
+        return new NodeApiClient(baseUrl, await (0, _keypair.keyLogin)(baseUrl, privateKey), devKey, privateKey);
+      } catch (e) {
+        // A server without the keypair endpoints is a reason to use the developer key that is
+        // still configured, not to stop: the same config often names stands of both vintages.
+        if (e?.name !== 'ServerTooOldError' || !devKey) throw e;
+      }
+    }
+    // Servers before 1.28 only knew the key-in-URL form, where it leaked into every
+    // access log on the way; they answer 404 or 401 to the key-less route.
+    let res = await fetch(`${baseUrl}/users/login/dev`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Dev ${devKey}`
+      }
+    });
+    if (res.status === 404 || res.status === 401) res = await fetch(`${baseUrl}/users/login/dev/${devKey}`, {
       method: 'POST'
     });
     const json = (res.headers.get('content-type') ?? '').includes('application/json') ? await res.json() : null;
@@ -79,12 +101,12 @@ class NodeApiClient {
 
   /**
    * A stand serving several isolates can reject a session one of them does not know, and an
-   * hour-long walk has no way to ask the operator to log in again. The developer key is good
-   * for a new session, so one is taken rather than losing the run.
+   * hour-long walk has no way to ask the operator to log in again. The keypair (or the
+   * developer key) is good for a new session, so one is taken rather than losing the run.
    */
   async reauthenticate() {
-    if (!this.devKey) return false;
-    const fresh = await NodeApiClient.login(this.baseUrl, this.devKey).catch(() => null);
+    if (!this.devKey && !this.privateKey) return false;
+    const fresh = await NodeApiClient.login(this.baseUrl, this.devKey, this.privateKey).catch(() => null);
     if (!fresh) return false;
     this.token = fresh.token;
     if (this.adminMode) this.token = (await fresh.post('/users/sessions/current/admin'))?.token ?? this.token;

package/bin/utils/playwright-runner.js

@@ -12,6 +12,7 @@ var _path = _interopRequireDefault(require("path"));
 var _papaparse = _interopRequireDefault(require("papaparse"));
 var color = _interopRequireWildcard(require("./color-utils"));
 var testUtils = _interopRequireWildcard(require("./test-utils"));
+var keypair = _interopRequireWildcard(require("./keypair"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 function hasPlaywrightTests(pkgDir) {
   const pkgJsonPath = _path.default.join(pkgDir, 'package.json');
@@ -159,12 +160,17 @@ async function runPlaywrightTests(pkgDir, testDir, args, hostKey) {
   } catch {
     webUrl = url.replace(/\/api\/?$/, '');
   }
+
+  // The second user the multi-user specs need. Its keypair wins over its developer key,
+  // the same way the first user's does; both are explicit, so neither picks up the
+  // configured identity by accident.
   let token2 = '';
-  if (process.env.DATAGROK_DEV_KEY_2 && process.env.DATAGROK_DEV_KEY_2.length > 0) {
+  const privateKey2 = keypair.keyFromEnv('DATAGROK_PRIVATE_KEY_2');
+  if (privateKey2 || process.env.DATAGROK_DEV_KEY_2) {
     try {
-      token2 = await testUtils.getToken(url, process.env.DATAGROK_DEV_KEY_2);
+      token2 = privateKey2 ? await keypair.keyLogin(url, privateKey2) : await testUtils.getToken(url, process.env.DATAGROK_DEV_KEY_2);
     } catch (e) {
-      color.warn(`Playwright: DATAGROK_DEV_KEY_2 set but failed to exchange for token: ${e.message || e}`);
+      color.warn(`Playwright: second-user credentials set but failed to exchange for token: ${e.message || e}`);
     }
   }
   const configPath = _path.default.join(testDir, 'playwright.config.ts');

package/bin/utils/server-client.js

@@ -5,7 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.createClient = createClient;
 var _nodeDapi = require("./node-dapi");
-var _testUtils = require("./test-utils");
+var _keypair = require("./keypair");
 /**
  * `--admin` asks the server for an admin session, which lifts the permission filter for this run:
  * without it a stand-wide pull sees only what the key's own account can, and content in other
@@ -14,14 +14,13 @@ var _testUtils = require("./test-utils");
  * the command or reach another session.
  */
 async function createClient(hostArg, admin = false) {
-  const {
-    url,
-    key
-  } = (0, _testUtils.getDevKey)(hostArg ?? '');
-  const client = await _nodeDapi.NodeApiClient.login(url, key);
+  // Resolved from the alias the caller named, not from its URL: two aliases can point at the
+  // same server, and only this side knows which one was asked for.
+  const cred = (0, _keypair.getServerCredentials)(hostArg ?? '');
+  const client = await _nodeDapi.NodeApiClient.login(cred.url, cred.key ?? '', cred.privateKey);
   if (!admin) return client;
   const token = (await client.post('/users/sessions/current/admin'))?.token;
-  if (!token) throw new Error(`${url} refused an admin session — the account behind this key cannot start one`);
+  if (!token) throw new Error(`${cred.url} refused an admin session — the account behind this key cannot start one`);
   client.token = token;
   client.adminMode = true;
   return client;

package/bin/utils/test-utils.js

@@ -35,6 +35,8 @@ var utils = _utils;
 var _puppeteer = _interopRequireDefault(require("puppeteer"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _papaparse = _interopRequireDefault(require("papaparse"));
+var _devKey = require("./dev-key");
+var keypair = _interopRequireWildcard(require("./keypair"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const fetch = require('node-fetch');
 const grokDir = _path.default.join(_os.default.homedir(), '.grok');
@@ -54,10 +56,25 @@ async function getToken(url, key) {
   // auth failure (valid JSON with isSuccess=false) is returned immediately, no retry.
   const maxAttempts = 15;
   const delayMs = 3000;
+  // Keypair login is the supported path; the developer key remains as a fallback
+  // for stands and CI secrets that have not been migrated yet — including when a key is
+  // configured but that stand does not know it, which must not take the run down while a
+  // working dev key is right there.
+  let privateKey = keypair.keypairFor(url, key);
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     try {
-      const response = await fetch(`${url}/users/login/dev/${key}`, {
+      if (privateKey) {
+        try {
+          return await keypair.keyLogin(url, privateKey);
+        } catch (error) {
+          const refused = error?.name === 'ServerTooOldError' || error?.message?.startsWith('Key login failed');
+          if (!key || !refused) throw error;
+          color.warn(`${url}: ${error.message} Falling back to the developer key.`);
+          privateKey = undefined;
+        }
+      }
+      const response = await (0, _devKey.devKeyFetch)(`${url}/users/login/dev`, `${url}/users/login/dev/${key}`, key, {
         method: 'POST'
       });
       const text = await response.text();
@@ -79,12 +96,14 @@ async function getToken(url, key) {
       throw new Error('Unable to login to server. Check your dev key');
     } catch (error) {
       if (error?.message === 'Unable to login to server. Check your dev key') throw error;
+      // A rejected signature is a credential problem, not a readiness one.
+      if (error?.message?.startsWith('Key login failed')) throw error;
       lastError = error;
       if (utils.isConnectivityError(error)) color.warn(`Playwright: server not reachable yet (attempt ${attempt}/${maxAttempts}): ${url}`);
       if (attempt < maxAttempts) await new Promise(r => setTimeout(r, delayMs));
     }
   }
-  throw lastError ?? new Error(`Unable to exchange dev key for token at ${url}`);
+  throw lastError ?? new Error(`Unable to obtain a token from ${url}`);
 }
 async function isPackageOnServer(hostKey, packageName) {
   try {

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/datagrok-ai/public.git"
   },
-  "version": "6.5.10",
+  "version": "6.7.0",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {
@@ -36,7 +36,7 @@
     "update:ivp-parser": "esbuild plugins/ivp-parser.entry.mjs --bundle --format=cjs --platform=node --alias:diff-grok=../libraries/compute-utils/node_modules/diff-grok --outfile=plugins/ivp-parser.bundle.cjs",
     "debug-source-map": "node build.js --source-maps",
     "test": "vitest run --project unit",
-    "test:server": "vitest run --project unit bin/__tests__/node-dapi bin/__tests__/server bin/__tests__/migrate",
+    "test:server": "vitest run --project unit bin/__tests__/node-dapi bin/__tests__/server bin/__tests__/migrate bin/__tests__/keypair",
     "test:watch": "vitest --project unit",
     "test:integration": "vitest run --project integration",
     "test:all": "vitest run"