@norskvideo/ctl-dev-kit 0.2.11 → 0.2.13

package/conventions/sync-ctl-packages.yml

@@ -10,6 +10,13 @@
 # versions -- `--frozen-lockfile` is what holds them back, and nothing ever
 # regenerated the lockfile.
 #
+# Rewriting the pins is not enough on its own: a family member can be a
+# transitive dep with no pin to rewrite, and the gate step re-resolves those
+# explicitly. Note the residual gap -- a staleness that is PURELY transitive
+# moves nothing in a package.json, so `changed` stays 0 and this workflow does
+# nothing that morning. It is picked up the next time any pin moves, which for
+# this family is most days.
+#
 # Unlike sync-dev-kit this NEVER pushes to main. Its gate is drift + lint +
 # typecheck + unit, and a bump to the test harness changes the code that drives
 # smoke and integration -- neither of which that gate runs, because both need
@@ -162,6 +169,29 @@ jobs:
             for lock in $(git ls-files "*bun.lock"); do
               (cd "$(dirname "$lock")" && bun install)
             done
+            # A ctl-* package also arrives TRANSITIVELY, and those never move on
+            # their own. probe pins no ctl-foundation at all: it comes through
+            # ctl-sdk and ctl-product-template-schema, both of which ask for
+            # ^0.1.0 -- and `bun install` keeps whatever the lockfile already
+            # resolved for a range it still satisfies. So probe sat on
+            # ctl-foundation 0.1.14 from 2026-09-02 while 0.1.19 was current,
+            # and this gate went red on an Export-named-parseProductRoleName-
+            # not-found from @norskvideo+ctl-foundation@0.1.14 -- which reads as
+            # the bumped harness breaking the product, when it is a four-week-
+            # stale transitive dep that no pin rewrite can reach. (No apostrophe
+            # anywhere in this step: the whole body is one bash -c string in
+            # single quotes, and conventions/workflow-quoting.test.ts fails on
+            # one.)
+            #
+            # Same family as the rewrite above, and deliberately named again
+            # rather than shared: the two steps are separate shells.
+            for pkg in ctl-test-harness ctl-sdk ctl-foundation ctl-product-template-schema; do
+              for lock in $(git ls-files "*bun.lock"); do
+                # Not every install root has every member, directly or
+                # otherwise; bun says so and this moves on.
+                (cd "$(dirname "$lock")" && bun update "@norskvideo/$pkg") || true
+              done
+            done
             bun run check:drift
             bun run lint
             bun run typecheck

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.11",
+  "version": "0.2.13",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",