datagrok-tools 6.7.1 → 6.7.3

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> datagrok-tools@6.7.1 build /home/runner/work/public/public/tools
+> datagrok-tools@6.7.3 build /home/runner/work/public/public/tools
 > node build.js
 
 Successfully compiled 51 files with Babel.

package/CHANGELOG.md

@@ -1,12 +1,23 @@
 # Datagrok-tools changelog
 
-## 6.7.0 (WIP)
+## 6.7.3 (2026-09-17)
+
+* The function-metadata plugin emits decorator roles in camel case again (`fileHandler`, `app`, `viewer`, ...); since 6.7.1 it capitalised them, which broke JS code comparing `options.role` with `DG.FUNC_TYPES`.
+* `grok check` accepts `## v.next` as the top changelog heading, the section the repository keeps unreleased changes in.
+
+## 6.7.2 (2026-09-16)
+
+* `grok publish` marks a bundled package for servers older than 1.28.0, which detect one only by a `webpack.config.js` in the archive; the marker is generated at publish time and never written to the package folder.
+
+## 6.7.1 (2026-09-15)
 
 * `grok login <server>` — keypair authentication, the replacement for the developer key. Generates an EC P-256 key, registers only its public half (in the browser, or with a one-shot `--code` from Profile > Public keys...), and keeps the private half in `~/.grok/keys/<alias>.json`. Logging in signs a server-issued nonce, so nothing reusable crosses the wire; keys can carry an expiry (`--expires`) and are revoked one at a time. `grok publish`, `grok test`, `grok stresstest` and `grok s` use it automatically whenever one is configured for the server, and fall back to the developer key otherwise. For CI, `GROK_PRIVATE_KEY` holds the private JWK (raw or base64) instead of a config file. Needs a server from 1.28 on; see https://datagrok.ai/help/govern/access-control/keypair-authentication
 * `grok s token` — prints a session token for the configured server, so shell scripts stop curling `/users/login/dev` with a long-lived key.
 * `grok config add` — `--key` is now optional: a server reached with a keypair has no developer key to record.
 * Against a server older than 1.28 — which has no keypair endpoints and refuses their paths before routing — the CLI names the version needed instead of reporting a bare 401, and falls back to the developer key when one is still configured for that server.
 * `grok login` reports its progress step by step (spinner on a terminal, one line per step in a log), including while it waits for the browser approval.
+* `grok check` — warns when a package pins its own version of a platform-served library (`build-config/platform-deps.json`) instead of `catalog:`; the `common/*.js` shared-library map is read from the same manifest.
+* `grok s push/migrate` — a migrated entity is stamped in its `metaParams` with `migrated_from` (the source stand URL) and `migrated_on`, so on the target it is clear the entity came from another stand. Written wherever the entity already carries `metaParams` (as `sync_id` is) and stripped before the idempotency comparison, so a re-push of an unchanged entity still reads as identical.
 
 ## 6.6.0 (2026-09-13)
 

package/bin/commands/check.js

@@ -21,7 +21,7 @@ var utils = _interopRequireWildcard(require("../utils/utils"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _const = require("../utils/const");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-const warns = ['Latest package version', 'Datagrok API version should contain'];
+const warns = ['Latest package version', 'Datagrok API version should contain', 'is served by the platform'];
 const forbiddenNames = ['function', 'class', 'export'];
 /** Static imports of these libraries significantly increase the main bundle size. */
 const HEAVY_IMPORT_RULES = [
@@ -375,26 +375,29 @@ function checkFuncSignatures(packagePath, files) {
 
   return [warnings, errors];
 }
-const sharedLibExternals = {
-  'common/html2canvas.min.js': {
-    'exceljs': 'ExcelJS'
-  },
-  'common/exceljs.min.js': {
-    'html2canvas': 'html2canvas'
-  },
-  'common/ngl_viewer/ngl.js': {
-    'NGL': 'NGL'
-  },
-  'common/openchemlib-full.js': {
-    'openchemlib/full': 'OCL'
-  },
-  'common/codemirror/codemirror.js': {
-    'codemirror': 'CodeMirror'
-  },
-  'common/vue.js': {
-    'vue': 'Vue'
+
+/** Libraries the platform serves at runtime; versions live in build-config/platform-deps.json. */
+function platformDeps(packagePath) {
+  try {
+    return require(require.resolve('@datagrok/build-config/platform-deps.json', {
+      paths: [packagePath]
+    }));
+  } catch {
+    return {};
   }
-};
+}
+
+/** For each `common/*.js` source: the import specifiers a bundled package must externalize, with their globals. */
+function sharedLibExternals(packagePath) {
+  const result = {};
+  for (const [name, d] of Object.entries(platformDeps(packagePath))) {
+    if (d.source) result[d.source] = {
+      [name]: d.global,
+      ...d.imports
+    };
+  }
+  return result;
+}
 function checkPackageFile(packagePath, json, options) {
   const warnings = [];
   const isPublicPackage = _path.default.basename(_path.default.dirname(packagePath)) === 'packages' && _path.default.basename(_path.default.dirname(_path.default.dirname(packagePath))) === 'public';
@@ -416,6 +419,14 @@ function checkPackageFile(packagePath, json, options) {
   // if (dt && dt !== 'latest')
   //   warnings.push('File "package.json": "datagrok-tools" dependency must be "latest" version.');
 
+  const platform = platformDeps(packagePath);
+  for (const [name, spec] of Object.entries({
+    ...json.dependencies,
+    ...json.devDependencies
+  })) {
+    if (name in platform && !spec.startsWith('catalog:')) warnings.push(`File "package.json": "${name}" is served by the platform (${platform[name].version}, ` + `see build-config/platform-deps.json); "${spec}" overrides it. Use "catalog:" unless the override is intended.`);
+  }
+  const shared = sharedLibExternals(packagePath);
   if (Array.isArray(json.sources) && json.sources.length > 0) {
     for (const source of json.sources) {
       if (typeof source !== 'string') warnings.push(`File "package.json": Only file paths and URLs are allowed in sources. Modify the source ${source}`);
@@ -423,14 +434,15 @@ function checkPackageFile(packagePath, json, options) {
       if (source.startsWith('common/')) {
         if (options?.isWebpack && source.endsWith('.js')) {
           if (options?.externals) {
-            if (source in sharedLibExternals) {
-              const [lib, name] = Object.entries(sharedLibExternals[source])[0];
-              if (!(lib in options.externals && options.externals[lib] === name)) {
+            if (source in shared) {
+              const expected = Object.entries(shared[source]);
+              if (!expected.some(([lib, name]) => options.externals[lib] === name)) {
+                const [lib, name] = expected[0];
                 warnings.push(`Webpack config parsing: Consider adding source "${source}" to webpack externals:\n` + `'${lib}': '${name}'\n`);
               }
             } else warnings.push(`File "package.json": source "${source}" not in the list of shared libraries`);
           } else {
-            warnings.push('Webpack config parsing: External modules not found.\n' + `Consider adding source "${source}" to webpack externals` + (source in sharedLibExternals ? ':\n' + `'${Object.keys(sharedLibExternals[source])[0]}': '${Object.values(sharedLibExternals[source])[0]}'\n` : ''));
+            warnings.push('Webpack config parsing: External modules not found.\n' + `Consider adding source "${source}" to webpack externals` + (source in shared ? ':\n' + `'${Object.keys(shared[source])[0]}': '${Object.values(shared[source])[0]}'\n` : ''));
           }
         }
         continue;
@@ -475,9 +487,9 @@ function checkChangelog(packagePath, json) {
   let regex = /^##[^#].*$/gm;
   const h2 = clf.match(regex);
   if (!h2) return ['No versions found in CHANGELOG.md\n'];
-  regex = /^## \d+\.\d+\.\d+ \((\d{4}-\d{2}-\d{2}|WIP)\)$/;
+  regex = /^## (v\.next|\d+\.\d+\.\d+ \((\d{4}-\d{2}-\d{2}|WIP)\))$/;
   for (const h of h2) {
-    if (!regex.test(h)) warnings.push(`CHANGELOG: '${h}' does not match the h2 format, expected: ## <version> (<yyyy-mm-dd> | WIP)\n`);
+    if (!regex.test(h)) warnings.push(`CHANGELOG: '${h}' does not match the h2 format, expected: ## <version> (<yyyy-mm-dd> | WIP) or ## v.next\n`);
   }
   regex = /^## (\d+\.\d+\.\d+)/;
   const v1 = h2[0].match(regex)?.[1];

package/bin/commands/publish.js

@@ -4,6 +4,8 @@ var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefau
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.BUNDLE_MARKER_NAME = exports.BUNDLE_MARKER = void 0;
+exports.predatesBundleDetection = predatesBundleDetection;
 exports.processPackage = processPackage;
 exports.publish = publish;
 var _archiver = _interopRequireDefault(require("archiver"));
@@ -487,6 +489,21 @@ async function fallbackImage(img, host, devKey, registry, version, contentHash)
     requestedVersion: img.imageTag
   };
 }
+const BUNDLE_MARKER_NAME = exports.BUNDLE_MARKER_NAME = 'webpack.config.js';
+const BUNDLE_MARKER = exports.BUNDLE_MARKER = '// Generated by `grok publish` for servers before 1.28.0, which detect a ' + 'bundled\n// package by this file. The bundle itself is built by @datagrok/build-config.\nmodule.exports = {};\n';
+function predatesBundleDetection(version) {
+  const [major, minor, patch] = (version ?? '').split('.').map(Number);
+  if ([major, minor, patch].some(isNaN)) return true;
+  return major < 1 || major === 1 && minor < 28;
+}
+async function serverPredatesBundleDetection(host) {
+  try {
+    const resp = await (0, _nodeFetch.default)(`${host}/info/server`);
+    return predatesBundleDetection((await resp.json())?.Version);
+  } catch {
+    return true;
+  }
+}
 async function processPackage(debug, rebuild, host, devKey, packageName, dropDb, suffix, hostAlias, registry, rebuildDocker, skipDockerRebuild) {
   // Validate server connectivity and dev key
   let timestamps = {};
@@ -612,6 +629,13 @@ async function processPackage(debug, rebuild, host, devKey, packageName, dropDb,
     if (userInfo) dockerVersion = userInfo.login;
   }
   await processDockerImages(packageName, dockerVersion, registry, devKey, host, rebuildDocker ?? false, zip, localTimestamps, debug, skipDockerRebuild ?? false, generatedDockerDirs);
+  const bundledWithoutMarker = !rebuild && _fs.default.existsSync('dist/package.js') && !_fs.default.existsSync(BUNDLE_MARKER_NAME);
+  if (bundledWithoutMarker && (await serverPredatesBundleDetection(host))) {
+    zip.append(BUNDLE_MARKER, {
+      name: BUNDLE_MARKER_NAME
+    });
+    localTimestamps[BUNDLE_MARKER_NAME] = new Date().toUTCString();
+  }
   zip.append(JSON.stringify(localTimestamps), {
     name: 'timestamps.json'
   });

package/bin/utils/migrate/bundle.js

@@ -35,8 +35,12 @@ function normalize(type, json) {
   if (copy.package) copy.package = {
     id: copy.package.id
   };
-  // The stamp is written by the pusher, so it must not make an unchanged entity look different.
-  if (copy.metaParams) delete copy.metaParams.sync_id;
+  // The stamps are written by the pusher, so they must not make an unchanged entity look different.
+  if (copy.metaParams) {
+    delete copy.metaParams.sync_id;
+    delete copy.metaParams.migrated_from;
+    delete copy.metaParams.migrated_on;
+  }
   _registry.TYPES[type]?.strip?.(copy);
   return sortKeys(copy);
 }

package/bin/utils/migrate/bundle.ts

@@ -43,9 +43,12 @@ export function normalize(type: string, json: any): any {
     delete copy[k];
   if (copy.package)
     copy.package = {id: copy.package.id};
-  // The stamp is written by the pusher, so it must not make an unchanged entity look different.
-  if (copy.metaParams)
+  // The stamps are written by the pusher, so they must not make an unchanged entity look different.
+  if (copy.metaParams) {
     delete copy.metaParams.sync_id;
+    delete copy.metaParams.migrated_from;
+    delete copy.metaParams.migrated_on;
+  }
   TYPES[type]?.strip?.(copy);
   return sortKeys(copy);
 }

package/bin/utils/migrate/pusher.js

@@ -433,7 +433,14 @@ async function saveOne(dapi, bundle, op, rows, idmap, deferred, missing) {
   const spec = _registry.TYPES[op.type];
   const payload = (0, _bundle.stripPrivate)(JSON.parse(JSON.stringify(op.json)));
   const targetId = payload.id ?? op.id;
-  if (payload.metaParams && typeof payload.metaParams === 'object') payload.metaParams.sync_id = op.id;
+  if (payload.metaParams && typeof payload.metaParams === 'object') {
+    payload.metaParams.sync_id = op.id;
+    const from = bundle.manifest?.source?.url;
+    if (from) {
+      payload.metaParams.migrated_from = from;
+      payload.metaParams.migrated_on = new Date().toISOString();
+    }
+  }
 
   // The server encrypts and masks password-class parameters itself, so target-side
   // secrets go in as plain parameters and never touch the bundle.

package/bin/utils/migrate/pusher.ts

@@ -378,8 +378,14 @@ async function saveOne(dapi: NodeDapi, bundle: Bundle, op: Op, rows: Row[], idma
   const spec = TYPES[op.type];
   const payload = stripPrivate(JSON.parse(JSON.stringify(op.json)));
   const targetId = payload.id ?? op.id;
-  if (payload.metaParams && typeof payload.metaParams === 'object')
+  if (payload.metaParams && typeof payload.metaParams === 'object') {
     payload.metaParams.sync_id = op.id;
+    const from = bundle.manifest?.source?.url;
+    if (from) {
+      payload.metaParams.migrated_from = from;
+      payload.metaParams.migrated_on = new Date().toISOString();
+    }
+  }
 
   // The server encrypts and masks password-class parameters itself, so target-side
   // secrets go in as plain parameters and never touch the bundle.

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/datagrok-ai/public.git"
   },
-  "version": "6.7.1",
+  "version": "6.7.3",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {

package/plugins/func-gen-plugin.js

@@ -19,7 +19,7 @@ const {
 } = require('../bin/utils/func-generation');
 
 // Not imported from commands/migrate: that module loads ts-morph (~1.5 s) at require time.
-const toCamelCase = (s) => s.split('-').map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join('');
+const toCamelCase = (s) => s.replace(/[-_ ]+(\w)/g, (_, c) => c.toUpperCase()).replace(/^[A-Z]/, (c) => c.toLowerCase());
 
 let _api;
 const api = (...a) => (_api ??= require('../bin/commands/api').api)(...a);