datagrok-tools 6.6.0 → 6.7.1

package/.turbo/turbo-build.log

@@ -0,0 +1,5 @@
+
+> datagrok-tools@6.7.1 build /home/runner/work/public/public/tools
+> node build.js
+
+Successfully compiled 51 files with Babel.

package/CHANGELOG.md

@@ -1,6 +1,14 @@
 # Datagrok-tools changelog
 
-## 6.6.0 (WIP)
+## 6.7.0 (WIP)
+
+* `grok login <server>` — keypair authentication, the replacement for the developer key. Generates an EC P-256 key, registers only its public half (in the browser, or with a one-shot `--code` from Profile > Public keys...), and keeps the private half in `~/.grok/keys/<alias>.json`. Logging in signs a server-issued nonce, so nothing reusable crosses the wire; keys can carry an expiry (`--expires`) and are revoked one at a time. `grok publish`, `grok test`, `grok stresstest` and `grok s` use it automatically whenever one is configured for the server, and fall back to the developer key otherwise. For CI, `GROK_PRIVATE_KEY` holds the private JWK (raw or base64) instead of a config file. Needs a server from 1.28 on; see https://datagrok.ai/help/govern/access-control/keypair-authentication
+* `grok s token` — prints a session token for the configured server, so shell scripts stop curling `/users/login/dev` with a long-lived key.
+* `grok config add` — `--key` is now optional: a server reached with a keypair has no developer key to record.
+* Against a server older than 1.28 — which has no keypair endpoints and refuses their paths before routing — the CLI names the version needed instead of reporting a bare 401, and falls back to the developer key when one is still configured for that server.
+* `grok login` reports its progress step by step (spinner on a terminal, one line per step in a log), including while it waits for the browser approval.
+
+## 6.6.0 (2026-09-13)
 
 * The developer key is sent in the `Authorization` header (`Dev <key>`) instead of the URL path. `POST /users/login/dev/<key>` and `POST /packages/dev/<key>/<package>` put a long-lived credential into every nginx access log, proxy log and shell history along the way; the key-less routes (`/users/login/dev`, `/packages/dev/<package>`) take it as a header. Servers that predate the header form answer 404/401 and the old URL is used instead, so publishing to an older server still works - but a server from 1.28 on rejects the URL form and asks for datagrok-tools 6.6.0 or later.
 
@@ -14,6 +22,8 @@
 
 ## 6.5.8 (2026-09-10)
 
+* `grok setup [--check] [--global]`: gets a public/ checkout ready (Node check, pnpm via corepack at the pinned version, removal of npm-era per-package node_modules and lockfiles, `pnpm install`, global grok version check). `grok tsc ...` runs the workspace TypeScript compiler; `grok build` inside a package or a Turborepo task builds just that package (bundle + metadata + check, or a library emit). `grok --version`.
+* Workspace toolchain: `public/` is a pnpm workspace with a Turborepo task graph and the shared `@datagrok/build-config` package (rspack + swc bundling, TypeScript 7 type-checking). `grok build` is now a front for Turborepo: the package in cwd and its dependencies in order, cached, never prompting; `--all`, `--affected`, `--typecheck`, `--filter`. `grok link` is a no-op inside a workspace (`pnpm install` links everything). `grok check` accepts `workspace:` and `catalog:` for the `datagrok-api` range. `grok publish` recognises packages built by `grok build --skip-check` (no `webpack.config.js`). `grok create` emits the new package shape (runtime deps only, `extends` tsconfig, four scripts); outside a workspace it pins published ranges and adds `@datagrok/build-config` as a devDependency. Command modules load lazily: `grok` starts in ~0.6 s instead of ~6 s. The webpack `FuncGeneratorPlugin` is also used by rspack builds; `@babel/generator` is a declared dependency now.
 * `grok s` — correctness pass from the CLI audit: every server failure now exits 1 with one line on stderr (a 200 carrying an `ApiError` — missing entity, duplicate login or group name, unknown function — used to print as data with exit 0); `--limit`/`--offset` are honoured for users, groups, connections and functions (their public routes ignore paging, so `list` and the new `count` verb go through the internal routers); `files list` works (the public files route only downloads; listing goes through the connection's file route) and prints `path, kind, size`; `tables list|get|delete` no longer throw, and `tables download|get|delete` accept the bare table name, the full `Project:Table` name or the id; `describe <entity|type>` works (registry record plus the fields of a live sample; it called a nonexistent endpoint before); positional `functions run 'F(1, 2)'` maps the values onto the function's inputs instead of silently sending `{"0": 1}` (which ran the function with nulls); `raw` takes API-relative paths (a leading `/api` is accepted), sends a body from `--json <file>` or `--data '<json>'`, and fails on non-2xx — so it, and `healthcheck`, now work against a bare-Datlas `--host` too; `shares list` accepts a name and shows the grants inherited through project links; `groups` name resolution prefers an exact match (`admin` no longer collides with `Administrators`) and `--user` works on `list-members`/`list-memberships`; `connections delete` of an unknown id fails instead of reporting success; a bad `--host` URL or alias reports the reason without the help dump. `users delete` refuses with a pointer at `users block`: the platform has no user deletion, and removing the entity record leaves the login unusable. `functions delete` covers scripts and queries.
 
 * GROK-20298: `grok s domains` — entity-mapped domain schemas and their rows from the CLI, addressed as `<schema>` or `<schema>.<table>`: `list`, `get` (manifest, a table's columns, or one row), `query` (`--filter`, `--columns`, `--sort`, `--expand`, `--limit`, `--offset`), `count`, `aggregate` (`--measures 'count,sum(x) as t' --group-by a`), `insert` / `update` (from `--json` or inline `col=value`, `--version` for optimistic concurrency), `delete` (one row, `--filter` bulk, or a whole user schema with `--force`), `upload` (csv, d42, json; `--upsert`, `--no-all-or-nothing`), `download` (csv to stdout or `-O out.csv|out.d42`), `transaction`, `audit`, `capabilities`, `grants` / `grant` / `revoke` (groups by name), `create`, and `apply` (`--dry-run`, `--confirm-destructive`, `--if-version`). Validation errors print per row; a destructive plan awaiting confirmation is printed with the error.

package/CLAUDE.md

@@ -141,12 +141,11 @@ Tests use Puppeteer for headless browser automation:
 
 ### `grok build` Command
 
-Builds packages with `npm install` + `npm run build`. Supports:
-- Single package: `grok build` (from package directory)
-- Recursive: `grok build --recursive` (discovers and builds all packages in subdirectories)
-- `--filter "name:Chem"` - Filter packages by package.json fields (supports regex, `&&` for multiple conditions)
-- `--parallel N` - Max parallel build jobs (default 4)
-- `--no-incremental` - Force full rebuild (default uses `--env incremental`)
+A front for Turborepo inside the `public/` pnpm workspace (`pnpm exec turbo run build ...`), never prompting:
+- `grok build` (from a package directory): the package and everything it depends on, in dependency order, cached
+- `grok build --all`: the whole workspace; `grok build --affected`: everything the diff against `origin/master` touches
+- `--typecheck` adds the type-check task; `--filter <turbo filter>`; `--parallel N` (default 3); `--force` ignores the cache
+- Outside a workspace it explains that `pnpm run build` / `npm run build` in the package is the way
 
 ### `grok claude` Command
 

package/GROK_S.md

@@ -52,13 +52,21 @@ servers:
     key: admin
   dev:
     url: https://dev.datagrok.ai/api
-    key: <developer-key>
+    keyFile: /home/me/.grok/keys/dev.json
+    login: me
 ```
 
-- `grok config add --alias <name> --server <url> --key <key>` writes a new entry.
+- `grok login <server>` is the way to add a server: it registers a keypair and writes the
+  entry for you. The private key stays in `~/.grok/keys/<alias>.json`.
+  See [keypair authentication](../help/govern/access-control/keypair-authentication.md).
+- `grok config add --alias <name> --server <url> [--key <developer-key>]` writes an entry by
+  hand. The developer key is deprecated; omit it when the server is reached with a keypair.
 - Add `--default` to make it the active server.
+- In CI, `GROK_PRIVATE_KEY` (the private JWK, raw or base64) overrides the config file.
 - Every `grok s ...` command accepts `--host <alias-or-url>` to override the default. The URL
   is the API base (`https://host/api`, or `http://host:8082` for a bare Datlas).
+- `grok s token` prints a session token for the target server — what a shell script needs
+  when it has to call the API with `curl` itself.
 
 ## Entity operations
 

package/LICENSE.md

@@ -0,0 +1,16 @@
+Copyright 2020 Datagrok, INC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES
+OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -26,7 +26,9 @@ npm install datagrok-tools -g
 
    A new folder `<package-name>` will be created automatically as well as its contents.
 3. Run `npm install` in your package directory to get the required dependencies (the command is called
-   automatically after package creation, if it ran successfully, skip this step).
+   automatically after package creation, if it ran successfully, skip this step). Inside the
+   [public repository](https://github.com/datagrok-ai/public) the packages form one pnpm workspace: run
+   `pnpm install` once at the repository root instead, and build with `grok build`.
 4. Start working on the functionality of your package. Use `grok add` to create function templates.
 5. Once you have completed the work on your package, upload it by running:
 
@@ -92,8 +94,8 @@ For more information on configuring connections, refer to the [Connections](http
   ```
 
   Options:
-  - `--build` or `--rebuild`: boolean flags that indicate whether a local webpack bundle should be used or it should
-    be generated on the server side
+  - the package is built locally before upload (`npm run build`, or `pnpm run build` inside the workspace);
+    `--skip-build` uploads the existing `dist/` as is, `--rebuild` asks the server to build instead
   - `--debug` or `--release`: boolean flags that determine whether to publish a debug version of the package visible
     only to the developer or a release version accessible by all eligible users and user groups
   - `--key`: a string containing a developer key that is not listed in the config file, e.g., the key for a new server

package/bin/commands/build.js

@@ -8,74 +8,136 @@ exports.applyFilter = applyFilter;
 exports.build = build;
 exports.confirm = confirm;
 exports.discoverPackages = discoverPackages;
+exports.findWorkspaceRoot = findWorkspaceRoot;
 exports.getNestedValue = getNestedValue;
 var _fs = _interopRequireDefault(require("fs"));
 var _path = _interopRequireDefault(require("path"));
-var _util = require("util");
-var _child_process = require("child_process");
 var readline = _interopRequireWildcard(require("readline"));
-var utils = _interopRequireWildcard(require("../utils/utils"));
+var _child_process = require("child_process");
 var color = _interopRequireWildcard(require("../utils/color-utils"));
+var _toolchain = require("../utils/toolchain");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-const execAsync = (0, _util.promisify)(_child_process.exec);
+/** Walks up from `dir` to the pnpm workspace root (the directory holding pnpm-workspace.yaml). */
+function findWorkspaceRoot(dir) {
+  let d = _path.default.resolve(dir);
+  for (;;) {
+    if (_fs.default.existsSync(_path.default.join(d, 'pnpm-workspace.yaml'))) return d;
+    const parent = _path.default.dirname(d);
+    if (parent === d) return null;
+    d = parent;
+  }
+}
+
+/**
+ * `grok build` in a workspace drives Turborepo: the package in cwd and everything it depends on,
+ * in dependency order, cached (`--all`, `--affected`, `--typecheck`, `--filter`). Inside a Turborepo
+ * task (TURBO_HASH is set), in a standalone package, or with `--local`, it builds just the package in
+ * cwd: an rspack bundle plus `grok check` for a plugin (src/package.ts or rspack.config.js), a
+ * TypeScript emit into dist/ for a library.
+ */
 async function build(args) {
-  if (args.verbose) color.setVerbose(true);
-  const buildCmd = args['no-incremental'] ? 'npm run build' : 'npm run build -- --env incremental';
-  if (args.recursive) return await buildRecursive(process.cwd(), args, buildCmd);else return await buildSingle(process.cwd(), buildCmd);
+  const cwd = process.cwd();
+  const root = findWorkspaceRoot(cwd);
+  if (args.local || process.env.TURBO_HASH || !root) return buildLocal(cwd, args);
+  return buildWithTurbo(cwd, root, args);
 }
-async function buildSingle(dir, buildCmd) {
-  if (!utils.isPackageDir(dir)) {
-    color.error('Not a package directory (no package.json found)');
-    return false;
-  }
-  const packageJson = JSON.parse(_fs.default.readFileSync(_path.default.join(dir, 'package.json'), 'utf-8'));
-  const name = packageJson.friendlyName || packageJson.name;
-  console.log(`Building ${name}...`);
-  try {
-    await utils.runScript('npm install', dir, color.isVerbose());
-    await utils.runScript(buildCmd, dir, color.isVerbose());
-    color.success(`Successfully built ${name}`);
-    return true;
-  } catch (error) {
-    color.error(`Failed to build ${name}`);
-    if (error.message) color.error(error.message);
-    return false;
+async function buildWithTurbo(cwd, root, args) {
+  const filters = [];
+  if (args.affected) filters.push('--filter=...[origin/master]');else if (!(args.all || args.recursive)) {
+    const pkgPath = _path.default.join(cwd, 'package.json');
+    if (!_fs.default.existsSync(pkgPath)) {
+      color.error('Not a package directory (no package.json). Use --all or --affected from anywhere in the workspace.');
+      return false;
+    }
+    filters.push(`--filter=${JSON.parse(_fs.default.readFileSync(pkgPath, 'utf8')).name}...`);
   }
+  if (args.filter) filters.push(`--filter=${args.filter}`);
+  const tasks = ['build'];
+  if (args.typecheck) tasks.push('typecheck');
+  const cmd = ['exec', 'turbo', 'run', ...tasks, ...filters, `--concurrency=${args.parallel ?? 3}`, '--continue'];
+  if (!args.verbose) cmd.push('--output-logs=errors-only');
+  if (args.force) cmd.push('--force');
+  const r = (0, _child_process.spawnSync)('pnpm', cmd, {
+    stdio: 'inherit',
+    cwd: root,
+    shell: true,
+    env: {
+      ...process.env,
+      TURBO_TELEMETRY_DISABLED: '1'
+    }
+  });
+  return r.status === 0;
 }
-async function buildRecursive(baseDir, args, buildCmd) {
-  const packages = discoverPackages(baseDir);
-  if (packages.length === 0) {
-    color.warn('No packages found in the current directory');
+async function buildLocal(dir, args) {
+  if (!_fs.default.existsSync(_path.default.join(dir, 'package.json'))) {
+    color.error('Not a package directory (no package.json).');
     return false;
   }
-  const filtered = args.filter ? applyFilter(packages, args.filter) : packages;
-  if (filtered.length === 0) {
-    color.warn('No packages match the filter');
-    return false;
-  }
-  console.log(`Found ${filtered.length} package(s): ${filtered.map(p => p.friendlyName).join(', ')}`);
-  if (!args.silent && !args.s) {
-    const confirmed = await confirm(`\nBuild ${filtered.length} package(s)?`);
-    if (!confirmed) {
-      console.log('Aborted.');
+  const isPlugin = _fs.default.existsSync(_path.default.join(dir, 'rspack.config.js')) || ['ts', 'js'].some(e => _fs.default.existsSync(_path.default.join(dir, 'src', `package.${e}`)));
+  return isPlugin ? bundle(dir, args) : emitLibrary(dir);
+}
+async function bundle(dir, args) {
+  const {
+    bundler,
+    rspack
+  } = (0, _toolchain.toolchain)(dir).buildConfig;
+  // --key=value arguments reach a config exported as a function, e.g. `grok build --only=browser`
+  const env = {};
+  for (const [k, v] of Object.entries(args)) if (!['_', 'local', 'verbose', 'skip-check', 'typecheck', 'all', 'affected', 'filter', 'parallel', 'force'].includes(k)) env[k] = v;
+  const cfgPath = _path.default.join(dir, 'rspack.config.js');
+  let config = _fs.default.existsSync(cfgPath) ? require(cfgPath) : bundler({
+    dir
+  });
+  if (typeof config === 'function') config = config(env);
+  if (config && typeof config.then === 'function') config = await config;
+  if (!args['skip-check'] && _fs.default.existsSync(_path.default.join(dir, 'src', 'package.ts'))) {
+    const {
+      check
+    } = require('./check');
+    if (check({
+      _: ['check'],
+      soft: true,
+      'no-exit': true
+    }) === false) {
+      color.error('grok check failed');
       return false;
     }
   }
-  const maxParallel = args.parallel || 4;
-  const results = await buildParallel(filtered, buildCmd, maxParallel);
-  return results.every(r => r.success);
+  const t0 = Date.now();
+  const ok = await new Promise((resolve, reject) => {
+    rspack(config, (err, stats) => {
+      if (err) return reject(err);
+      const text = stats.toString({
+        colors: process.stdout.isTTY,
+        preset: 'errors-warnings'
+      });
+      if (text.trim()) console.log(text);
+      resolve(!stats.hasErrors());
+    });
+  });
+  const dist = _path.default.join(dir, 'dist', 'package.js');
+  const size = _fs.default.existsSync(dist) ? `${(_fs.default.statSync(dist).size / 1024).toFixed(0)} KB` : '';
+  console.log(`${ok ? 'bundled' : 'FAILED'} ${_path.default.basename(dir)} in ${((Date.now() - t0) / 1000).toFixed(1)}s ${size}`);
+  return ok;
 }
+
+/** A library: `tsc -p tsconfig.json` into dist/, then the css/wasm/json assets its sources import. */
+function emitLibrary(dir) {
+  (0, _toolchain.ensureLibraryExports)(dir);
+  const r = (0, _child_process.spawnSync)(process.execPath, [(0, _toolchain.toolchain)(dir).tsc, '-p', 'tsconfig.json'], {
+    stdio: 'inherit',
+    cwd: dir
+  });
+  if (r.status !== 0) return false;
+  (0, _toolchain.copyLibraryAssets)(dir);
+  return true;
+}
+/** Packages directly under `baseDir` (used by `grok testall`). */
 function discoverPackages(baseDir) {
-  const entries = _fs.default.readdirSync(baseDir);
   const packages = [];
-  for (const entry of entries) {
+  for (const entry of _fs.default.readdirSync(baseDir)) {
     if (entry.startsWith('.') || entry === 'node_modules') continue;
     const dir = _path.default.join(baseDir, entry);
-    try {
-      if (!_fs.default.statSync(dir).isDirectory()) continue;
-    } catch (_) {
-      continue;
-    }
     const packageJsonPath = _path.default.join(dir, 'package.json');
     if (!_fs.default.existsSync(packageJsonPath)) continue;
     try {
@@ -87,114 +149,36 @@ function discoverPackages(baseDir) {
         version: packageJson.version || '0.0.0',
         packageJson
       });
-    } catch (_) {
-      continue;
-    }
+    } catch (_) {/* not a package */}
   }
   return packages.sort((a, b) => a.friendlyName.localeCompare(b.friendlyName));
 }
+
+/** `field:regex && field:regex` filter over package.json fields. */
 function applyFilter(packages, filterStr) {
-  const conditions = filterStr.split('&&').map(s => s.trim());
-  const parsedConditions = conditions.map(cond => {
+  const conditions = filterStr.split('&&').map(s => s.trim()).map(cond => {
     const colonIdx = cond.indexOf(':');
-    if (colonIdx === -1) return {
+    return colonIdx === -1 ? {
       field: cond,
       pattern: new RegExp('.')
+    } : {
+      field: cond.substring(0, colonIdx).trim(),
+      pattern: new RegExp(cond.substring(colonIdx + 1).trim())
     };
-    const field = cond.substring(0, colonIdx).trim();
-    const pattern = new RegExp(cond.substring(colonIdx + 1).trim());
-    return {
-      field,
-      pattern
-    };
-  });
-  return packages.filter(pkg => {
-    for (const cond of parsedConditions) {
-      const value = getNestedValue(pkg.packageJson, cond.field);
-      if (value === undefined || !cond.pattern.test(String(value))) return false;
-    }
-    return true;
   });
+  return packages.filter(pkg => conditions.every(cond => {
+    const value = getNestedValue(pkg.packageJson, cond.field);
+    return value !== undefined && cond.pattern.test(String(value));
+  }));
 }
 function getNestedValue(obj, path) {
-  const parts = path.split('.');
   let current = obj;
-  for (const part of parts) {
+  for (const part of path.split('.')) {
     if (current == null || typeof current !== 'object') return undefined;
     current = current[part];
   }
   return current;
 }
-async function buildParallel(packages, buildCmd, maxParallel) {
-  const results = [];
-  const headers = ['Plugin', 'Version', 'Build time', 'Bundle size'];
-  const widths = [Math.max(headers[0].length, ...packages.map(p => p.friendlyName.length)), Math.max(headers[1].length, ...packages.map(p => p.version.length)), Math.max(headers[2].length, 10), Math.max(headers[3].length, 40)];
-  const pad = (s, w) => s + ' '.repeat(Math.max(0, w - s.length));
-  console.log(`\nBuilding with ${maxParallel} parallel job(s)...`);
-  console.log(headers.map((h, i) => pad(h, widths[i])).join(' | '));
-  console.log(widths.map(w => '-'.repeat(w)).join('-+-'));
-  const buildOne = async pkg => {
-    const start = Date.now();
-    let success = true;
-    let buildTime = '';
-    let bundleSize = '';
-    try {
-      await execAsync('npm install', {
-        cwd: pkg.dir,
-        maxBuffer: 10 * 1024 * 1024
-      });
-      await execAsync(buildCmd, {
-        cwd: pkg.dir,
-        maxBuffer: 10 * 1024 * 1024
-      });
-      const elapsed = (Date.now() - start) / 1000;
-      buildTime = `${elapsed.toFixed(1)}s`;
-      bundleSize = getBundleSize(pkg.dir);
-    } catch (error) {
-      success = false;
-      buildTime = 'Error';
-      const raw = (error.stderr || error.stdout || error.message || 'Unknown error').trim();
-      bundleSize = raw.replace(/\r?\n/g, ' ').replace(/\s+/g, ' ').substring(0, 40);
-    }
-    const result = {
-      name: pkg.friendlyName,
-      version: pkg.version,
-      buildTime,
-      bundleSize,
-      success
-    };
-    results.push(result);
-    const cells = [result.name, result.version, result.buildTime, result.bundleSize];
-    const line = cells.map((cell, j) => pad(cell, widths[j])).join(' | ');
-    if (success) color.info(line);else color.error(line);
-    return result;
-  };
-  let idx = 0;
-  const next = async () => {
-    while (idx < packages.length) {
-      const pkg = packages[idx++];
-      await buildOne(pkg);
-    }
-  };
-  const workers = Array.from({
-    length: Math.min(maxParallel, packages.length)
-  }, () => next());
-  await Promise.all(workers);
-  const succeeded = results.filter(r => r.success).length;
-  const failed = results.length - succeeded;
-  console.log('');
-  if (failed === 0) color.success(`All ${results.length} package(s) built successfully`);else color.warn(`${succeeded} succeeded, ${failed} failed`);
-  return results;
-}
-function getBundleSize(dir) {
-  const bundlePath = _path.default.join(dir, 'dist', 'package.js');
-  try {
-    const stats = _fs.default.statSync(bundlePath);
-    return `${(stats.size / 1024).toFixed(1)} KB`;
-  } catch (_) {
-    return 'N/A';
-  }
-}
 function confirm(message) {
   const rl = readline.createInterface({
     input: process.stdin,

package/bin/commands/check.js

@@ -19,7 +19,6 @@ var _path = _interopRequireDefault(require("path"));
 var _ignoreWalk = _interopRequireDefault(require("ignore-walk"));
 var utils = _interopRequireWildcard(require("../utils/utils"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
-var testUtils = _interopRequireWildcard(require("../utils/test-utils"));
 var _const = require("../utils/const");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 const warns = ['Latest package version', 'Datagrok API version should contain'];
@@ -57,7 +56,7 @@ function check(args) {
       color.error('File `package.json` not found. Run the command from the package directory');
       return false;
     }
-    return runChecks(curDir, args.soft ?? false, false);
+    return runChecks(curDir, args.soft ?? false, args['no-exit'] ?? false);
   }
 }
 function runChecks(packagePath, soft = false, noExit = false) {
@@ -113,7 +112,7 @@ function runChecks(packagePath, soft = false, noExit = false) {
     console.log(`Checking package ${_path.default.basename(packagePath)}...`);
     showError(errors);
     if (soft || json.version.startsWith('0') || errors.every(w => warns.some(ww => w.includes(ww)))) return true;
-    if (noExit) return false;else testUtils.exitWithCode(1);
+    if (noExit) return false;else process.exit(1);
   }
   color.log(`Checking package ${_path.default.basename(packagePath)}...\t\t\t\u2713 OK`);
   return true;
@@ -410,7 +409,7 @@ function checkPackageFile(packagePath, json, options) {
   if (json.version.includes('beta') && isPublicPackage) warnings.push('File "package.json": public package cannot be beta version.');
   const api = json.dependencies?.['datagrok-api'];
   if (api) {
-    if (api === '../../js-api') {} else if (api === 'latest') warnings.push('File "package.json": you should specify Datagrok API version constraint (for example ^1.16.0, >=1.16.0).');else if (options?.isReleaseCandidateVersion === false && !/^(\^|>|<|~).+/.test(api)) warnings.push('File "package.json": Datagrok API version should starts with > | >= | ~ | ^ | < | <=');
+    if (api === '../../js-api') {} else if (api === 'latest') warnings.push('File "package.json": you should specify Datagrok API version constraint (for example ^1.16.0, >=1.16.0).');else if (options?.isReleaseCandidateVersion === false && !/^(\^|>|<|~|workspace:|catalog:).+/.test(api)) warnings.push('File "package.json": Datagrok API version should starts with > | >= | ~ | ^ | < | <=');
   }
 
   // const dt = json.devDependencies?.['datagrok-tools'] ?? json.dependencies?.['datagrok-tools'];

package/bin/commands/config.js

@@ -84,7 +84,9 @@ function config(args) {
   const nOptions = Object.keys(args).length - 1;
   const askRegistry = args.registry != null;
   const interactiveMode = args['_'].length === 1 && (nOptions < 1 || nOptions === 1 && (args.reset || askRegistry) || nOptions === 2 && args.reset && askRegistry);
-  const hasAddServerCommand = args['_'].length === 2 && args['_'][1] === 'add' && args.server && args.key && args.k && args.alias && nOptions >= 4 && nOptions <= 6;
+  // `--key` is optional: a server reached with a keypair (`grok login`) has no
+  // developer key to record. minimist mirrors -k into both `key` and `k`.
+  const hasAddServerCommand = args['_'].length === 2 && args['_'][1] === 'add' && args.server && args.alias && nOptions >= 2 && nOptions <= 6;
   if (!interactiveMode && !hasAddServerCommand) return false;
   if (!_fs.default.existsSync(grokDir)) _fs.default.mkdirSync(grokDir);
   if (!_fs.default.existsSync(confPath) || args.reset) _fs.default.writeFileSync(confPath, _jsYaml.default.dump(confTemplate));
@@ -100,7 +102,7 @@ function config(args) {
     }
     const server = {
       url: args.server,
-      key: args.key
+      key: args.key ?? ''
     };
     if (args.registry != null) {
       const registry = typeof args.registry === 'string' ? args.registry : defaultRegistry(args.server);

package/bin/commands/create.js

@@ -21,6 +21,12 @@ const curFolder = _path.default.basename(curDir);
 const grokDir = _path.default.join(_os.default.homedir(), '.grok');
 const confPath = _path.default.join(grokDir, 'config.yaml');
 const templateDir = _path.default.join(_path.default.dirname(_path.default.dirname(__dirname)), 'package-template');
+function isPnpmWorkspace(dir) {
+  for (let d = _path.default.resolve(dir);; d = _path.default.dirname(d)) {
+    if (_fs.default.existsSync(_path.default.join(d, 'pnpm-workspace.yaml'))) return true;
+    if (_path.default.dirname(d) === d) return false;
+  }
+}
 const confTemplateDir = _path.default.join(_path.default.dirname(_path.default.dirname(__dirname)), 'config-template.yaml');
 const confTemplate = _jsYaml.default.load(_fs.default.readFileSync(confTemplateDir, {
   encoding: 'utf-8'
@@ -37,7 +43,7 @@ function createDirectoryContents(name, friendlyName, config, templateDir, packag
         _fs.default.writeFileSync(copyFilePath, _fs.default.readFileSync(origFilePath, 'base64'), 'base64');
         return false;
       }
-      let contents = _fs.default.readFileSync(file === 'webpack.config.js' && ts ? _path.default.join(templateDir, 'ts.webpack.config.js') : origFilePath, 'utf8');
+      let contents = _fs.default.readFileSync(origFilePath, 'utf8');
       contents = contents.replace(/#{PACKAGE_FRIENDLY_NAME}/g, friendlyName);
       contents = contents.replace(/#{PACKAGE_NAME}/g, name);
       contents = contents.replace(/#{PACKAGE_DETECTORS_NAME}/g, utils.kebabToCamelCase(name));
@@ -49,20 +55,40 @@ function createDirectoryContents(name, friendlyName, config, templateDir, packag
       contents = contents.replace(/#{GROK_HOST_ALIAS}/g, config.default);
       contents = contents.replace(/#{GROK_HOST}/g, /localhost|127\.0\.0\.1/.test(config['servers'][config.default]['url']) ? 'http://localhost:63343/login.html' : new URL(config['servers'][config.default]['url']).origin);
       if (file === 'package.json') {
-        // Generate scripts for non-default servers from `config.yaml`
+        // The toolchain (bundler, TypeScript, eslint) comes from the workspace root; a package
+        // declares only what it imports. Deploy with `grok publish <alias>`, no per-server scripts.
         const _package = JSON.parse(contents);
         _package['scripts'] = _package['scripts'] ?? {};
-        for (const server in config.servers) {
-          if (server === config.default) continue;
-          _package['scripts'][`debug-${name.toLowerCase()}-${server}`] = `webpack && grok publish ${server}`;
-          _package['scripts'][`release-${name.toLowerCase()}-${server}`] = `webpack && grok publish ${server} --release`;
-        }
-        if (ts) {
-          _package.devDependencies = _package.devDependencies ?? {};
+        _package.devDependencies = _package.devDependencies ?? {};
+        // Outside the public/ pnpm workspace the template's workspace:/catalog: specifiers mean
+        // nothing to npm: pin published ranges and bring the toolchain in as a devDependency.
+        if (!isPnpmWorkspace(packageDir)) {
+          const published = {
+            'datagrok-api': `^${require('datagrok-api/package.json').version}`,
+            '@datagrok-libraries/test': '^1.4.0',
+            'rxjs': '^6.5.5',
+            'cash-dom': '^8.1.5',
+            'dayjs': '^1.11.13',
+            'wu': '^2.1.0',
+            'typescript': '^7.0.2'
+          };
+          for (const sect of ['dependencies', 'devDependencies']) {
+            for (const [dep, spec] of Object.entries(_package[sect] ?? {})) {
+              if (spec === 'workspace:^' || spec === 'catalog:') _package[sect][dep] = published[dep] ?? 'latest';
+            }
+          }
           Object.assign(_package.devDependencies, {
-            'ts-loader': 'latest',
-            'typescript': 'latest'
+            '@datagrok/build-config': '^0.1.0',
+            'eslint': '^8.57.1',
+            '@typescript-eslint/parser': '^8.39.0',
+            '@typescript-eslint/eslint-plugin': '^8.39.0',
+            'eslint-config-google': '^0.14.0',
+            'typescript': '^5.9.3'
           });
+          _fs.default.writeFileSync(_path.default.join(packageDir, '.eslintrc.json'), JSON.stringify({
+            root: true,
+            extends: './node_modules/@datagrok/build-config/eslintrc.json'
+          }, null, 2) + '\n');
         }
         if (eslint) {
           Object.assign(_package.devDependencies, {