@norskvideo/ctl-dev-kit 0.1.73 → 0.1.75

package/conventions/smoke.yml

@@ -172,6 +172,24 @@ jobs:
       # runner the first pull overruns the per-test timeout. Pre-pull them (tags
       # from manifest.seed.json), plus whatever the repo lists in the optional
       # scripts/smoke/prepull-extra.sh hook (a driver image, a sidecar).
+      # Before anything is built or launched: does this licence actually name
+      # this product? `product add` refuses one it does not, and that refusal
+      # reaches the log as a 60-second readiness timeout indistinguishable from
+      # a product that failed to start. Turnkeys make this routine — each ships
+      # under a licence naming its own product, so a newly created one whose
+      # licence was never minted should say so in seconds, by name.
+      #
+      # The product name is the repo's own PRODUCT_NAME, not the short board key
+      # above (`funke` vs `funke-pegasus`): the licence names the product.
+      - name: Check the licence entitles this product
+        run: |
+          set -euo pipefail
+          product="$(sed -nE 's/.*PRODUCT_NAME[[:space:]]*=[[:space:]]*"([^"]+)".*/\1/p' shared/src/version.ts | head -1)"
+          [ -n "$product" ] || { echo "::error::could not read PRODUCT_NAME from shared/src/version.ts"; exit 1; }
+          nix develop .#build --command bun \
+            node_modules/@norskvideo/ctl-dev-kit/licence/check-entitlement.ts \
+            "$RUNNER_TEMP/norsk-license.json" "$product"
+
       - name: Pre-pull the media + studio images
         run: |
           set -euo pipefail

package/conventions/sync-ctl-packages.yml

@@ -104,7 +104,14 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            bun install
+            # Per INSTALL ROOT, not per repo. The rewrite above walks every
+            # tracked package.json, and a manifest outside the root workspace
+            # list (funke proxy/ui) owns its own lockfile that a root-only
+            # install never regenerates -- leaving a bumped pin its own
+            # --frozen-lockfile then rejects.
+            for lock in $(git ls-files "*bun.lock"); do
+              (cd "$(dirname "$lock")" && bun install)
+            done
             bun run check:drift
             bun run lint
             bun run typecheck

package/conventions/upgrade-latest.yml

@@ -191,7 +191,16 @@ jobs:
 
       - name: Refresh the lockfile against the new pins
         if: steps.bump.outputs.changed == '1'
-        run: nix develop .#build --command bash -c 'set -euo pipefail; bun install'
+        # Per INSTALL ROOT: the rewrites above walk every tracked package.json,
+        # and a manifest outside the root workspace list owns a lockfile a
+        # root-only install never regenerates. See lockfile-reinstall.test.ts.
+        run: |
+          nix develop .#build --command bash -c '
+            set -euo pipefail
+            for lock in $(git ls-files "*bun.lock"); do
+              (cd "$(dirname "$lock")" && bun install)
+            done
+          '
 
       - name: Commit the bump to main
         if: steps.bump.outputs.changed == '1'

package/licence/check-entitlement.ts

@@ -0,0 +1,78 @@
+// Does this licence entitle this product? Asked before anything is built or
+// launched, because the failure it prevents is otherwise invisible.
+//
+// A V2 licence names the products it covers, and `product add` refuses one it
+// does not name. Discovered late, that surfaces as
+// `product did not become ready within 60000ms` — the same 60 seconds of
+// silence as a product that could not start, or one on an address the daemon
+// could not dial. Reuters' smoke tier sat behind exactly that ambiguity.
+//
+// Turnkeys make this routine rather than rare: each ships to one customer under
+// a licence naming their product, so every new turnkey needs its own, and the
+// moment one is missing should be a sentence rather than a timeout.
+import { readFileSync } from "node:fs";
+
+interface LicensedProduct {
+  product?: unknown;
+}
+
+/** The product names a licence covers, or null when the shape is unreadable —
+ *  deliberately distinct from "covers nothing", which is a real answer. */
+export function licensedProducts(licenceJson: string): string[] | null {
+  let payload: string;
+  try {
+    const outer = JSON.parse(licenceJson) as { payload?: unknown };
+    if (typeof outer.payload !== "string") return null;
+    payload = Buffer.from(outer.payload, "base64").toString("utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const inner = JSON.parse(payload) as { products?: unknown };
+    if (!Array.isArray(inner.products)) return null;
+    return inner.products.map((p) => (p as LicensedProduct)?.product).filter((p): p is string => typeof p === "string");
+  } catch {
+    return null;
+  }
+}
+
+/** The message to fail with, or null to proceed. Null covers two very different
+ *  cases on purpose: the licence entitles the product, or the licence is in a
+ *  shape this cannot read. Refusing on the second would assert something never
+ *  determined, and would break the fleet on the first licence format change. */
+export function entitlementProblem(licenceJson: string, product: string): string | null {
+  if (licenceJson.trim() === "") {
+    return `licence is empty — the NORSK_LICENSE_V2 secret is unset or unreadable, so ${product} cannot be launched`;
+  }
+  const products = licensedProducts(licenceJson);
+  if (products === null) return null;
+  if (products.includes(product)) return null;
+  const covers = products.length ? products.join(", ") : "nothing";
+  return `licence does not entitle ${product} (covers: ${covers})`;
+}
+
+if (import.meta.main) {
+  const [file, product] = process.argv.slice(2);
+  if (!file || !product) {
+    console.error("usage: check-entitlement.ts <licence.json> <product-name>");
+    process.exit(2);
+  }
+  let contents: string;
+  try {
+    contents = readFileSync(file, "utf8");
+  } catch (e) {
+    console.error(`licence-check: cannot read ${file}: ${String(e)}`);
+    process.exit(2);
+  }
+  const problem = entitlementProblem(contents, product);
+  if (problem) {
+    console.error(`licence-check: ${problem}`);
+    process.exit(1);
+  }
+  const products = licensedProducts(contents);
+  console.log(
+    products === null
+      ? `licence-check: licence shape not recognised; entitlement for ${product} not asserted`
+      : `licence-check: ${product} is entitled (licence covers: ${products.join(", ")})`,
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",
@@ -13,6 +13,7 @@
     "./doc-guide/prose-bundle": "./doc-guide/prose-bundle.js",
     "./docs/path-existence": "./docs/path-existence.ts",
     "./docs/splice-generated": "./docs/splice-generated.ts",
+    "./licence/check-entitlement": "./licence/check-entitlement.ts",
     "./licence/check-product-name": "./licence/check-product-name.ts",
     "./licence/check-template": "./licence/check-template.ts",
     "./package.json": "./package.json",