datagrok-tools 6.6.0 → 6.7.1

package/bin/commands/help.js

@@ -13,14 +13,17 @@ Datagrok's package management tool
 Commands:
     add         Add an object template
     api         Create wrapper functions
-    build       Build a package or multiple packages
-    check       Check package content (function signatures, etgc.)
+    setup       Get a public/ checkout ready to build (pnpm, install, npm-era clean-up)
+    build       Build a package and its dependencies (Turborepo), or just this package
+    tsc         Run the workspace TypeScript compiler
+    check       Check package content (function signatures, etc.)
     claude      Launch Claude Code in a Datagrok dev container
     config      Create and manage config files
     create      Create a package
     docker-gen  Generate Celery Docker artifacts from Python functions
     init        Modify a package template
     link        Link \`datagrok-api\` and libraries for local development
+    login       Log in to a server with a keypair (replaces the developer key)
     publish     Upload a package
     report      Manage user error reports (fetch, resolve, create ticket)
     run         Build, publish, and open in browser
@@ -138,6 +141,29 @@ Options:
                   file exists, plain \`grok api\` keeps it up to date; delete it to
                   opt out again
 `;
+const HELP_LOGIN = `
+Usage: grok login <server>
+
+Log in to a Datagrok server with a keypair. Generates an EC P-256 key, registers
+its public half on your account, and stores the private half in
+~/.grok/keys/<alias>.json. Nothing reusable is ever copied out of the UI, and the
+key can be given an expiry and revoked on its own.
+
+grok login https://dev.datagrok.ai      Approve the key in the browser
+grok login dev --code AB12CD34          Use a code from your profile page
+                                        (Profile > Public keys...), no browser
+
+Options:
+[--code] [--name] [--expires] [--alias]
+
+--code      One-shot enrollment code from your profile page. Skips the browser
+--name      Key name shown in your profile (default: user@host)
+--expires   Days from now, or an ISO date (2027-01-31). Default: never
+--alias     Config alias to write (default: the server's first host label)
+
+For CI, set GROK_PRIVATE_KEY to the private key JWK (raw or base64) instead of a
+config file. Read more: https://datagrok.ai/help/govern/access-control/keypair-authentication
+`;
 const HELP_CONFIG = `
 Usage: grok config
 
@@ -150,6 +176,7 @@ Options:
 --server    Use to add a server to the config (\`grok config add --alias alias --server url --key key\`)
 --alias     Use in conjunction with the \`server\` option to set the server name
 --key       Use in conjunction with the \`server\` option to set the developer key
+            (deprecated - prefer \`grok login\`, which needs no key here)
 --default   Use in conjunction with the \`server\` option to set the added server as default
 --registry  Docker registry URL (default: registry.{server hostname})
 `;
@@ -184,7 +211,8 @@ Options:
 --all                  Publish all available packages (run in packages directory)
 --refresh              Publish all available already loaded packages (run in packages directory)
 --link                 Link the package to local packages
---build                Builds the package
+--build                Builds the package (the default; kept for compatibility)
+--skip-build           Upload the existing dist/ without rebuilding
 --release              Publish package as release version
 --rebuild-docker       Force rebuild Docker images locally before pushing to registry
 --skip-docker-rebuild  Skip auto-rebuild when Dockerfile folder has changed
@@ -283,6 +311,9 @@ https://datagrok.ai/help/develop/how-to/test-packages#local-testing
 const HELP_LINK = `
 Usage: grok link
 
+In a pnpm workspace checkout (public/) this is a no-op: \`pnpm install\` at the repository root
+links every in-repo dependency (workspace:^). The options below apply to standalone checkouts only.
+
 Links \`datagrok-api\`, all necessary libraries and packages for local development.
 Uses \`npm link\` unless the --path option specified. 
 By default, it links packages from the parent directory of the repository's root.
@@ -316,27 +347,61 @@ Example:
   ⟶
   meta: { role: 'viewer,ml' }
 `;
+const HELP_SETUP = `
+Usage: grok setup [--check] [--global]
+
+Gets a public/ checkout (or a fresh worktree) ready to build, and keeps it that way after a pull:
+  1. Node 20+ (22 recommended); pnpm through corepack, at the version the workspace pins
+  2. removes per-package node_modules left by the npm era and stray package-lock.json files
+  3. pnpm install at the workspace root
+  4. reports a global grok older than the workspace one
+
+--check     Report only, change nothing
+--global    Also update the global datagrok-tools to the workspace version
+
+Examples:
+  grok setup            After cloning, after a pull that changed dependencies, in a new worktree
+  grok setup --check    What would change
+`;
+const HELP_TSC = `
+Usage: grok tsc [tsc arguments]
+
+Runs the workspace TypeScript compiler (the version @datagrok/build-config pins) with the given arguments,
+so a package never needs its own tsc. After an emitting run in a library, the css/wasm/json assets its
+sources import are mirrored into dist/.
+
+Examples:
+  grok tsc --noEmit -p tsconfig.json     Type-check (what the \`typecheck\` script runs)
+  grok tsc -p tsconfig.build.json        A library with a custom build config
+`;
 const HELP_BUILD = `
 Usage: grok build
 
-Build a package in the current directory, or recursively build multiple packages.
+Inside the public/ workspace: build the package in the current directory and everything it depends
+on, in dependency order, through Turborepo (cached: unchanged packages take milliseconds). Never prompts.
+Inside a Turborepo task, in a standalone package, or with --local: build just this package — an rspack
+bundle (src/package.ts -> dist/package.js, function metadata generated, \`grok check --soft\`) for a
+plugin, a TypeScript emit into dist/ for a library.
 
 Options:
-[-r | --recursive] [-s | --silent] [--filter] [--no-incremental] [--parallel N] [-v | --verbose]
-
---recursive       Build all packages in the current directory
---silent          Skip confirmation prompt (for recursive builds)
---filter          Filter packages by package.json fields (e.g. --filter "category:Cheminformatics")
---no-incremental  Run a full build instead of the default incremental build
---parallel N      Max parallel builds (default: 4)
---verbose         Print detailed output
+[--all] [--affected] [--typecheck] [--filter <turbo filter>] [--parallel N] [--force] [--local] [--skip-check] [-v | --verbose]
+
+--all             Build the whole workspace
+--affected        Build everything the diff against origin/master affects, dependents included
+--typecheck       Also run the type-check task
+--filter          Extra Turborepo filter (e.g. --filter "@datagrok/chem...")
+--parallel N      Max parallel builds (default: 3)
+--force           Ignore the build cache
+--local           Build only this package, without Turborepo
+--skip-check      Local build: skip \`grok check\`
+--verbose         Show full build output instead of errors only
 
 Examples:
-  grok build                                          Build the current package
-  grok build -r                                       Build all packages in the current directory
-  grok build -r -s                                    Build all packages without confirmation
-  grok build -r --filter "category:Cheminformatics"   Build only matching packages
-  grok build -r --parallel 8                          Build with 8 parallel jobs
+  grok build                    This package and its dependencies
+  grok build --all              Everything
+  grok build --affected         What my change touches (CI does the same)
+  grok build --typecheck        Bundle and type-check
+  grok build --local            Just this package (what the package's build script runs)
 `;
 
 // const HELP_MIGRATE = `
@@ -410,13 +475,16 @@ const help = exports.help = {
   'docker-gen': HELP_DOCKER_GEN,
   init: HELP_INIT,
   link: HELP_LINK,
+  login: HELP_LOGIN,
   publish: HELP_PUBLISH,
   report: HELP_REPORT,
   run: HELP_RUN,
   test: HELP_TEST,
+  tsc: HELP_TSC,
   testall: HELP_TESTALL,
   migrate: HELP_MIGRATE,
   server: _server.HELP_SERVER,
   s: _server.HELP_SERVER,
+  setup: HELP_SETUP,
   help: HELP
 };

package/bin/commands/link.js

@@ -30,11 +30,21 @@ while (_path.default.dirname(dirStep) !== dirStep) {
   }
   dirStep = _path.default.dirname(dirStep);
 }
+function isPnpmWorkspace(dir) {
+  for (let d = _path.default.resolve(dir);; d = _path.default.dirname(d)) {
+    if (_fs.default.existsSync(_path.default.join(d, 'pnpm-workspace.yaml'))) return true;
+    if (_path.default.dirname(d) === d) return false;
+  }
+}
 let verbose = false;
 let pathMode = false;
 let devMode = false;
 let unlink = false;
 async function link(args) {
+  if (isPnpmWorkspace(curDir)) {
+    console.log('This checkout is a pnpm workspace: in-repo dependencies are linked by `pnpm install` ' + '(workspace:^), and `grok link` is not needed. Run `pnpm install` at the repository root.');
+    return true;
+  }
   verbose = args.verbose ?? false;
   devMode = args.dev ?? false;
   pathMode = args.path ?? false;

package/bin/commands/login.js

@@ -0,0 +1,213 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.login = login;
+var _crypto = _interopRequireDefault(require("crypto"));
+var _http = _interopRequireDefault(require("http"));
+var _os = _interopRequireDefault(require("os"));
+var _child_process = require("child_process");
+var color = _interopRequireWildcard(require("../utils/color-utils"));
+var kp = _interopRequireWildcard(require("../utils/keypair"));
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * `grok login <server>` - generates a keypair, registers its public half on the
+ * server, and stores the private half locally. Replaces the developer key: no
+ * reusable secret is copied out of the UI, and the key can be given an expiry
+ * and revoked on its own.
+ */
+async function login(args) {
+  if (args['_'].length > 2) return false;
+  const target = (args['_'][1] ?? '').toString();
+  const name = args.name ?? `${_os.default.userInfo().username}-${_os.default.hostname()}`;
+  const expires = parseExpiry(args.expires);
+  if (args.expires && !expires) {
+    color.error('--expires takes a number of days or an ISO date (2027-01-31)');
+    return false;
+  }
+  let url;
+  let alias;
+  let keyFile;
+  let registered;
+  const config = kp.readConfig();
+  const {
+    publicKey,
+    privateKey
+  } = kp.generateKeyPair();
+  try {
+    ({
+      url,
+      alias
+    } = resolveTarget(target, config, args.alias));
+    url = await color.step(`Finding the Datagrok API at ${url}`, () => resolveApiRoot(url));
+    registered = args.code ? await color.step(`Registering "${name}" with the enrollment code`, () => kp.enrollWithCode(url, args.code, publicKey, name, expires)) : await enrollInBrowser(url, publicKey, name, expires);
+    if (registered.login == null) throw new Error(registered.comment ?? registered.message ?? 'The server did not accept the key');
+    keyFile = await color.step('Storing the private key', async () => {
+      const file = kp.savePrivateKey(alias, privateKey);
+      config.servers ??= {};
+      config.servers[alias] = {
+        ...(config.servers[alias] ?? {}),
+        url,
+        key: config.servers[alias]?.key ?? '',
+        keyFile: file,
+        login: registered.login
+      };
+      config.default ??= alias;
+      kp.writeConfig(config);
+      return file;
+    });
+
+    // Proves the round trip before the user walks away, rather than at the next
+    // `grok publish`: a key that registered but cannot sign is worse than none.
+    await color.step('Signing in with the new key', () => kp.keyLogin(url, privateKey));
+  } catch (error) {
+    color.error(error.message ?? String(error));
+    return false;
+  }
+  color.success(`Logged in to ${url} as ${registered.login}`);
+  console.log(`  key         ${name} (${kp.fingerprint(publicKey)})`);
+  console.log(`  private key ${keyFile}`);
+  console.log(`  alias       ${alias} - use it as \`grok publish ${alias}\`, \`grok test --host ${alias}\``);
+  if (expires) console.log(`  expires     ${expires}`);
+  return true;
+}
+function resolveTarget(target, config, aliasArg) {
+  if (target === '') {
+    const alias = aliasArg ?? config.default;
+    if (!alias || !config.servers?.[alias]) throw new Error('Which server? Pass a URL or a configured alias: grok login https://dev.datagrok.ai/api');
+    return {
+      url: config.servers[alias].url,
+      alias
+    };
+  }
+  const configured = config.servers?.[target];
+  if (configured) return {
+    url: configured.url,
+    alias: aliasArg ?? target
+  };
+  let parsed;
+  try {
+    parsed = new URL(target);
+  } catch {
+    throw new Error(`"${target}" is neither a URL nor a server in your config`);
+  }
+  return {
+    url: parsed.href.replace(/\/$/, ''),
+    alias: aliasArg ?? defaultAlias(parsed)
+  };
+}
+
+/**
+ * The API base for [url]. A stand behind nginx serves it at `<origin>/api`, a bare Datlas at
+ * the origin itself, and there is no telling which from the URL alone - so ask, rather than
+ * guess and fail at the first call.
+ *
+ * A 200 is not the answer: nginx serves the single-page app for anything it does not route,
+ * so the origin of a real stand answers `/info/server` with the app's HTML. Only a JSON body
+ * that names the server counts.
+ */
+async function resolveApiRoot(url) {
+  const candidates = /\/api$/.test(url) ? [url] : [`${url}/api`, url];
+  for (const candidate of candidates) {
+    try {
+      const response = await fetch(`${candidate}/info/server`);
+      if (!response.ok) continue;
+      const info = JSON.parse(await response.text());
+      if (info?.webRoot != null || info?.Version != null) return candidate;
+    } catch {/* not JSON, or unreachable: try the next shape */}
+  }
+  throw new Error(`${url} does not answer as a Datagrok API (tried ${candidates.join(' and ')})`);
+}
+function defaultAlias(url) {
+  const host = url.hostname;
+  if (host === 'localhost' || host === '127.0.0.1' || host === '::1') return 'local';
+  return host.split('.')[0];
+}
+
+/** Days from now, or an ISO date, as the ISO instant the server stores. */
+function parseExpiry(value) {
+  if (value == null || value === '') return undefined;
+  const days = Number(value);
+  if (!isNaN(days) && days > 0) return new Date(Date.now() + days * 86400000).toISOString();
+  const date = new Date(String(value));
+  return isNaN(date.getTime()) ? undefined : date.toISOString();
+}
+
+/**
+ * Opens the server's enrollment page in a browser and waits for it to call back
+ * on a loopback listener. The user authenticates however that stand does -
+ * password, SSO, SAML - because the approval happens in the platform UI.
+ */
+async function enrollInBrowser(url, publicKey, name, expires) {
+  const origin = new URL(url).origin;
+  // The page asks for this before it registers anything. It exists only in this terminal, so a
+  // link someone else sent has nothing for the user to type — which is the difference between
+  // approving one's own `grok login` and handing an attacker a key to one's account.
+  const verify = _crypto.default.randomBytes(4).toString('hex').toUpperCase().slice(0, 6);
+  let started;
+  const listening = new Promise(resolve => started = resolve);
+  const approved = new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      server.close();
+      reject(new Error('Timed out waiting for the browser. Use `grok login <server> --code <code>` ' + 'with a code from your profile page instead.'));
+    }, 5 * 60 * 1000);
+    const server = _http.default.createServer((req, res) => {
+      const params = new URL(req.url ?? '/', 'http://127.0.0.1').searchParams;
+      const status = params.get('status');
+      res.writeHead(200, {
+        'content-type': 'text/html; charset=utf-8'
+      });
+      res.end(status === 'ok' ? '<h3>Key registered. You can close this tab and return to the terminal.</h3>' : `<h3>Key registration was cancelled.</h3><p>${escapeHtml(params.get('message') ?? '')}</p>`);
+      clearTimeout(timeout);
+      server.close();
+      if (status === 'ok') resolve({
+        login: params.get('login'),
+        fingerprint: params.get('fingerprint')
+      });else reject(new Error(params.get('message') ?? 'Key registration was cancelled in the browser'));
+    });
+    server.listen(0, '127.0.0.1', () => {
+      const port = server.address().port;
+      const enrollUrl = `${origin}/enroll-key?` + new URLSearchParams({
+        pk: JSON.stringify(publicKey),
+        name,
+        ...(expires ? {
+          expires
+        } : {}),
+        verify,
+        cb: `http://127.0.0.1:${port}`
+      }).toString();
+      console.log(`\n  Verification code: ${verify}`);
+      console.log(`  Type it on the page that opens. If the browser does not open, visit:`);
+      console.log(`    ${enrollUrl}\n`);
+      openBrowser(enrollUrl);
+      started();
+    });
+  });
+
+  // The prints above land before the spinner starts, so the code stays readable on screen.
+  await listening;
+  return await color.step(`Waiting for approval in the browser at ${origin}`, () => approved);
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"]/g, c => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;'
+  })[c]);
+}
+function openBrowser(url) {
+  try {
+    // cmd splits an unquoted argument at `&`, and the enrollment URL is all query parameters;
+    // rundll32 takes the whole thing and hands it to the default browser.
+    const [command, args] = process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+    (0, _child_process.spawn)(command, args, {
+      detached: true,
+      stdio: 'ignore'
+    }).unref();
+  } catch {
+    // The URL is printed above; a headless box just uses that.
+  }
+}

package/bin/commands/publish.js

@@ -21,6 +21,7 @@ var _check = require("./check");
 var _pythonCeleryGen = require("../utils/python-celery-gen");
 var _queueWorkerGen = require("../utils/queue-worker-gen");
 var _devKey = require("../utils/dev-key");
+var keypair = _interopRequireWildcard(require("../utils/keypair"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 // @ts-ignore
 
@@ -242,18 +243,21 @@ function listRecursive(basePath, rel) {
   return results;
 }
 async function getUserLogin(host, devKey) {
-  let loginResp;
+  let token;
   try {
-    loginResp = await (0, _devKey.devKeyFetch)(`${host}/users/login/dev`, `${host}/users/login/dev/${devKey}`, devKey, {
-      method: 'POST'
-    });
+    token = await (0, _devKey.keypairToken)(host, devKey);
+    if (token == null) {
+      const loginResp = await (0, _devKey.devKeyFetch)(`${host}/users/login/dev`, `${host}/users/login/dev/${devKey}`, devKey, {
+        method: 'POST'
+      });
+      if (loginResp.status !== 200) return null;
+      token = (await loginResp.json()).token;
+    }
   } catch (e) {
     color.warn(`Cannot reach server ${host}: ${e.message || e}`);
     return null;
   }
-  if (loginResp.status !== 200) return null;
-  const loginData = await loginResp.json();
-  const token = loginData.token;
+  if (token == null) return null;
   try {
     const userResp = await (0, _nodeFetch.default)(`${host}/users/current`, {
       headers: {
@@ -489,7 +493,7 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
   const url = `${host}/packages/dev/${packageName}`;
   const legacyUrl = `${host}/packages/dev/${devKey}/${packageName}`;
   try {
-    const checkResp = await (0, _devKey.devKeyFetch)(`${url}/timestamps`, `${legacyUrl}/timestamps`, devKey);
+    const checkResp = await (0, _devKey.devKeyFetch)(`${url}/timestamps`, `${legacyUrl}/timestamps`, devKey, {}, host);
     const checkData = await checkResp.json();
     if (checkData['#type'] === 'ApiError') {
       color.error(checkData.message);
@@ -522,7 +526,10 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
     includeEmpty: false,
     follow: true
   });
-  const isWebpack = _fs.default.existsSync('webpack.config.js');
+
+  // A bundled package ships dist/package.js: built by webpack (legacy) or by `grok build`
+  // (rspack via @datagrok/build-config, which needs no config file at all).
+  const isWebpack = _fs.default.existsSync('webpack.config.js') || _fs.default.existsSync('rspack.config.js') || _fs.default.existsSync('dist/package.js') || _fs.default.existsSync(_path.default.join(curDir, 'src', 'package.ts'));
   if (!rebuild && isWebpack) {
     if (_fs.default.existsSync('dist/package.js')) {
       const distFiles = await (0, _ignoreWalk.default)({
@@ -546,12 +553,6 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
   const json = JSON.parse(_fs.default.readFileSync(packageFilePath, {
     encoding: 'utf-8'
   }));
-  if (isWebpack) {
-    const webpackConfigPath = _path.default.join(curDir, 'webpack.config.js');
-    const content = _fs.default.readFileSync(webpackConfigPath, {
-      encoding: 'utf-8'
-    });
-  }
   const funcFiles = jsTsFiles.filter(f => packageFiles.includes(f));
   color.log(`Checks finished in ${Date.now() - checkStart} ms`);
   const reg = new RegExp(/\${(\w*)}/g);
@@ -624,7 +625,7 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
     const body = await (0, _devKey.devKeyFetch)(url + query, legacyUrl + query, devKey, {
       method: 'POST',
       body: zipBuffer
-    });
+    }, host);
     const log = JSON.parse(await body.text());
     if (log != undefined) {
       if (log['#type'] === 'ApiError') {
@@ -688,12 +689,14 @@ async function publish(args) {
 }
 async function publishPackage(args) {
   const nArgs = args['_'].length;
-  if (!args.link) {
-    if (args.build || args.rebuild) {
-      color.log('Building');
-      await utils.runScript('npm install', curDir, false);
-      await utils.runScript('npm run build', curDir, false);
-    }
+
+  // A bundled package is built locally before upload unless --skip-build. Inside the pnpm
+  // workspace the install already happened at the root; standalone packages install first.
+  if (!args.link && !args['skip-build'] && !args.rebuild && _fs.default.existsSync(_path.default.join(curDir, 'src'))) {
+    color.log('Building');
+    const workspace = utils.isPnpmWorkspace(curDir);
+    if (!workspace && !_fs.default.existsSync(_path.default.join(curDir, 'node_modules'))) await utils.runScript('npm install', curDir, false);
+    await utils.runScript(workspace ? 'pnpm run build' : 'npm run build', curDir, false);
   }
   if (args.debug && args.release) {
     color.error('Incompatible options: --debug and --release');
@@ -728,7 +731,7 @@ async function publishPackage(args) {
 
   // Update the developer key
   if (args.key) key = args.key;
-  if (key === '') return color.warn('Please provide the key with `--key` option or add it by running `grok config`');
+  if (!key && !keypair.keypairFor(url)) return color.warn(`No credentials for ${url}. Run \`grok login ${host}\`, ` + 'or pass a developer key with `--key` (deprecated).');
 
   // Get the package name
   if (!_fs.default.existsSync(packDir)) return color.error('`package.json` doesn\'t exist');

package/bin/commands/server.js

@@ -27,7 +27,7 @@ const ENTITY_TYPES = {
   reports: 'UserReport'
 };
 const ENTITIES = ['users', 'groups', 'functions', 'connections', 'queries', 'scripts', 'packages', 'reports', 'files', 'tables'];
-const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle'];
+const COMMANDS = ['shares', 'domains', 'raw', 'batch', 'describe', 'healthcheck', 'sync', 'pull', 'push', 'migrate', 'diff', 'bundle', 'token'];
 const VERBS = ['list', 'count', 'get', 'delete'];
 async function server(argv) {
   const args = argv['_'].slice(1);
@@ -61,6 +61,12 @@ async function server(argv) {
     if (['pull', 'push', 'migrate', 'diff', 'bundle'].includes(entity)) return await (0, _serverMigrate.handleMigrate)(dapi, entity, [verb, ...rest].filter(Boolean), argv, output);
     if (entity === 'domains') return await (0, _serverDomains.handleDomains)(dapi, verb, rest, argv, output);
     if (entity === 'batch') return await handleBatch(dapi, argv, verb, rest, output);
+    // Shell scripts that used to curl /users/login/dev get a token the same way
+    // every other command does, whatever credential the config holds.
+    if (entity === 'token') {
+      console.log(client.token);
+      return true;
+    }
     if (entity === 'raw') return await handleRaw(dapi, verb, rest, argv, output);
     if (entity === 'describe') return await handleDescribe(dapi, verb ?? rest[0], output);
     if (entity === 'healthcheck') return await handleHealthcheck(dapi, argv, output);