@norskvideo/ctl-dev-kit 0.2.27 → 0.2.29

package/conventions/upgrade-latest.yml

@@ -1,5 +1,8 @@
 # Keep the product fresh against the Norsk "nightly" channel (RFC 0001 —
-# product version freshness). Version discovery anchors on manifest.seed.json
+# product version freshness). The {engine, studio image} pair comes from the
+# nightly entry of norsk-studio's channel manifest -- the pair studio TESTED
+# together -- never from the two channels separately. Version discovery of the
+# product's current pins anchors on manifest.seed.json
 # (the machine-writable source of truth for the launched {media, studio} image
 # pair — every product repo has one). Any npm pins on the same version string
 # (media build libraries, the @norskvideo/norsk-studio* family in whichever
@@ -119,22 +122,41 @@ jobs:
           # product, even when nothing changed — pure dashboard noise.
           parts=()
 
+          # ONE TESTED PAIR, NOT TWO CHANNELS. The engine and the studio image are
+          # taken together from the nightly entry of norsk-studio's channel
+          # manifest: the pair studio's publish built and tested against each
+          # other (scripts/write-channel-manifest.sh in norsk-studio). Resolving
+          # them apart -- the engine off norsk-sdk's nightly dist-tag, the image
+          # off Docker Hub's nightly tag -- produced pairs nobody had tested
+          # whenever one channel moved without the other. On 2026-10-04 studio's
+          # nightly had been held by its test gate since 09-28 while the engine
+          # walked on to 10-02, a breaking SDK change landed in between, and
+          # commentary's audio mix produced nothing on the old-studio /
+          # new-engine pair it was pinned to (norsk task 112).
+          #
+          # Consequence, deliberately: when studio's nightly stalls, the engine
+          # stalls with it (or steps BACK to the pair), rather than running ahead
+          # untested. Unblocking studio's nightly is how products move forward.
+          #
+          # Everything is resolved and checked BEFORE anything is rewritten, so a
+          # refusal never leaves the engine moved and studio not.
+          manifest_url="https://s3.eu-west-1.amazonaws.com/norsk.video/channel-manifest.json"
+          pair="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$manifest_url" | jq -c '.channels.nightly // empty')"
+          [ -n "$pair" ] || { echo "::error::no nightly pair in $manifest_url"; exit 1; }
+          tag_re='^[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+$'
+          new_media="$(jq -r '(.norsk // "") | split(":") | .[1] // ""' <<<"$pair")"
+          new_studio_img="$(jq -r '(.studio // "") | split(":") | .[1] // ""' <<<"$pair")"
+          printf '%s' "$new_media" | grep -qE "$tag_re" || { echo "::error::the manifest's nightly norsk image is not a dated nightly tag: $pair"; exit 1; }
+          printf '%s' "$new_studio_img" | grep -qE "$tag_re" || { echo "::error::the manifest's nightly studio image is not a dated nightly tag: $pair"; exit 1; }
+          echo "nightly pair: norsk $new_media + studio $new_studio_img"
+
           # MEDIA: the npm packages and the launched image are built from the SAME
-          # commit (their hash suffixes match), so one version string drives the
-          # whole family. norsk-sdk is the family reference; read its nightly
-          # dist-tag off the registry (curl+jq — the runner has no npm) and rewrite
-          # every occurrence (overrides, sub-package deps, manifest image ref,
-          # version-pin test) EXCEPT the lockfile, which bun install regenerates.
+          # commit (their hash suffixes match), so the pair's engine version drives
+          # the whole family: overrides, sub-package deps, the manifest image ref,
+          # the version-pin test -- every occurrence EXCEPT the lockfile, which bun
+          # install regenerates.
           old_media="$(jq -r '.latest.media | split(":")[1]' manifest.seed.json)"
-          new_media="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-sdk" | jq -r '."dist-tags".nightly')"
-          [ -n "$new_media" ] && [ "$new_media" != "null" ] || { echo "could not resolve norsk-sdk nightly"; exit 1; }
-          echo "media: $old_media -> $new_media"
-          if [ "$old_media" != "$new_media" ]; then
-            git grep -lF "$old_media" -- . ':!bun.lock' | xargs -r sed -i "s|$old_media|$new_media|g"
-            changed=1
-            parts+=("media \`$new_media\`")
-          fi
-          # The rewrite above is a LITERAL replace of the value found in
+          # The rewrite below is a LITERAL replace of the value found in
           # manifest.seed.json, so it only ever touches pins that already equal the
           # seed. A pin that has drifted off it -- a hand edit, a merge, a
           # half-finished run -- is invisible to this bump and to every later one,
@@ -148,9 +170,10 @@ jobs:
           # Not auto-rewritten: a pin held back on purpose is someone's decision,
           # and silently moving it would be the same class of surprise in the
           # other direction. Fail, name them, and let a human fix the pin or the
-          # intent.
+          # intent. (Checked against the SEED, the family's current value: after
+          # the rewrite every seed-equal pin reads the pair's engine.)
           stranded="$(git grep -hoE '"@norskvideo/norsk-(api|sdk|auto-manager|manager-sdk)"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
-            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u | grep -vxF "$new_media" || true)"
+            | sed -E 's/.*"([^"]+)"$/\1/' | sort -u | grep -vxF "$old_media" | grep -vxF "$new_media" || true)"
           if [ -n "$stranded" ]; then
             echo "::error::npm norsk pins are stranded off the nightly channel: $(printf '%s' "$stranded" | tr '\n' ' ')"
             echo "The media family (api, sdk, auto-manager, manager-sdk) and the launched image are built from the same"
@@ -159,76 +182,85 @@ jobs:
             exit 1
           fi
 
-          # STUDIO: unlike media, Norsk builds the studio npm packages and the
-          # studio Docker image from DIFFERENT commits — their hash suffixes never
-          # match — so one version string can't serve both: pinning the launched
-          # image to the npm nightly yields a tag that was never pushed (integration
-          # then dies on "manifest unknown"). Resolve the two apart: build libraries
-          # from npm, the launched image from Docker Hub's newest published tag ON
-          # THE SAME version line (so it's pullable AND matches the libs'
-          # major.minor.patch). Rewrite the image ref FIRST, then the bare library
-          # version — so even when the two happen to coincide, the image ref is
-          # already moved and the bare-version rewrite only touches the npm pins
-          # (no dependence on which files hold each — some products have no
-          # version-pin test).
+          # STUDIO: the studio npm packages and the studio image are built from
+          # DIFFERENT commits -- their hash suffixes never match -- so the image
+          # comes from the pair and the build libraries from npm's nightly. The
+          # libraries must belong to the same pair: their norsk-sdk dependency has
+          # to name the pair's engine, and their version line the image's. A
+          # mismatch means the channels are inconsistent (studio published npm
+          # without updating the manifest, or the reverse); refuse rather than pin
+          # a combination nobody tested. (Studio's publish installs the SDK it
+          # builds against as a DEV dependency -- `npm install --save-dev
+          # @norskvideo/norsk-sdk@<channel>` -- so that is where the pairing lives.)
           #
           # The old npm pin is discovered from the repo's REAL studio deps: any
           # exact nightly on a @norskvideo/norsk-studio* package in a tracked
-          # package.json (deps, devDeps, or overrides — wherever it lives). A
-          # repo with none skips the lib rewrite; nothing forces phantom
-          # `overrides` entries just to give this script an anchor. Distinct
-          # pins disagreeing across files abort rather than half-rewrite.
+          # package.json (deps, devDeps, or overrides -- wherever it lives). A
+          # repo with none skips the lib entirely. Distinct pins disagreeing
+          # across files abort rather than half-rewrite.
           old_studio_lib="$(git grep -hoE '"@norskvideo/norsk-studio[^"]*"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+"' -- '*package.json' \
             | sed -E 's/.*"([^"]+)"$/\1/' | sort -u || true)"
           if [ "$(printf '%s' "$old_studio_lib" | grep -c .)" -gt 1 ]; then
             echo "studio npm pins disagree across package.json files:"; echo "$old_studio_lib"; exit 1
           fi
-          new_studio_lib="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-studio" | jq -r '."dist-tags".nightly')"
-          [ -n "$new_studio_lib" ] && [ "$new_studio_lib" != "null" ] || { echo "could not resolve norsk-studio npm nightly"; exit 1; }
-          studio_line="${new_studio_lib%%-*}"   # e.g. 1.28.0 — keep the image on this line
           old_studio_img="$(jq -r '.latest.studio | split(":")[1]' manifest.seed.json)"
-          # FOLLOW THE NIGHTLY CHANNEL — do not pick the newest tag NAME on the
-          # line. Newest-name selects on publish recency, so any build landing a
-          # <line>-<date>-<sha> tag wins, including one off a feature branch. Not
-          # hypothetical: a norsk-studio `reasoning` build took both the nightly
-          # tag and the newest-name slot on 2026-08-25, this job pinned it at
-          # 04:29, and every signed probe workflow was refused at launch that
-          # morning because the fix on main was not in it. norsk-studio now
-          # refuses to publish `nightly` from anything but main, so the channel is
-          # the trustworthy signal — and this follows it rather than guessing.
-          #
-          # Resolve nightly's digest, then name the version-specific tag carrying
-          # the same digest. The moving tag is not pinnable itself: it moves under
-          # you, and a launch has to record the exact image it ran.
-          hub="https://hub.docker.com/v2/repositories/norskvideo/norsk-studio"
-          nightly_digest="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$hub/tags/nightly" | jq -r '.digest // empty')"
-          [ -n "$nightly_digest" ] || { echo "could not resolve the norsk-studio nightly tag's digest"; exit 1; }
-          new_studio_img="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$hub/tags?page_size=100&ordering=last_updated" \
-            | jq -r --arg d "$nightly_digest" '.results[] | select(.digest == $d) | .name' \
-            | grep -E "^${studio_line}-[0-9]{4}-[0-9]{2}-[0-9]{2}-[0-9a-f]+$" | head -1 || true)"
-          [ -n "$new_studio_img" ] || {
-            echo "norsk-studio nightly ($nightly_digest) has no version-specific tag on the $studio_line line."
-            echo "Either the npm and docker version lines have diverged, or nightly has moved to a"
-            echo "different line than the npm nightly ($new_studio_lib). Not guessing — fix the channel."
-            exit 1
-          }
-          echo "studio lib:   ${old_studio_lib:-<no npm pins>} -> $new_studio_lib"
+          new_studio_lib=""
+          if [ -n "$old_studio_lib" ]; then
+            studio_doc="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/@norskvideo%2Fnorsk-studio")"
+            new_studio_lib="$(jq -r '."dist-tags".nightly // empty' <<<"$studio_doc")"
+            [ -n "$new_studio_lib" ] || { echo "could not resolve norsk-studio npm nightly"; exit 1; }
+            lib_sdk="$(jq -r --arg v "$new_studio_lib" \
+              '.versions[$v] | ((.devDependencies // {}) + (.peerDependencies // {}) + (.dependencies // {}))["@norskvideo/norsk-sdk"] // empty' <<<"$studio_doc")"
+            lib_sdk="${lib_sdk#^}"; lib_sdk="${lib_sdk#~}"
+            if [ "$lib_sdk" != "$new_media" ]; then
+              echo "::error::norsk-studio npm nightly $new_studio_lib was built against norsk-sdk ${lib_sdk:-<none declared>}, not the tested pair's engine $new_media."
+              echo "The npm channel and the channel manifest disagree; not pinning a combination nobody tested."
+              exit 1
+            fi
+            if [ "${new_studio_lib%%-*}" != "${new_studio_img%%-*}" ]; then
+              echo "::error::norsk-studio npm nightly $new_studio_lib is on a different version line from the pair's image $new_studio_img."
+              exit 1
+            fi
+          fi
+
+          echo "media:        $old_media -> $new_media"
+          echo "studio lib:   ${old_studio_lib:-<no npm pins>} -> ${new_studio_lib:-<unchanged>}"
           echo "studio image: $old_studio_img -> $new_studio_img"
+          if [ "$old_media" != "$new_media" ]; then
+            git grep -lF "$old_media" -- . ':!bun.lock' | xargs -r sed -i "s|$old_media|$new_media|g"
+            changed=1
+            parts+=("media \`$new_media\`")
+          fi
+          # Rewrite the image ref FIRST, then the bare library version -- so even
+          # when the two coincide, the image ref has already moved and the
+          # bare-version rewrite only touches the npm pins.
           if [ "$old_studio_img" != "$new_studio_img" ]; then
             git grep -lF "norskvideo/norsk-studio:$old_studio_img" -- . ':!bun.lock' \
               | xargs -r sed -i "s|norskvideo/norsk-studio:$old_studio_img|norskvideo/norsk-studio:$new_studio_img|g"
+            # And the tag on its own: a product can carry it unprefixed (onair2026's
+            # committed template input has `"studioTag": "<tag>"`), which the
+            # prefixed rewrite never reached -- the engine moved, studio did not,
+            # and the repo's own pin test went red (2026-10-04). Safe because the
+            # image tag and the npm library version are different strings; if
+            # they ever coincide, the bare rewrite would also hit the lib pins, so
+            # it is skipped and the lib rewrite below owns that string.
+            if [ "$old_studio_img" != "$old_studio_lib" ]; then
+              # `|| true`: after the prefixed rewrite most repos have no bare
+              # occurrence left, and git grep exits 1 on no match (pipefail).
+              { git grep -lF "$old_studio_img" -- . ':!bun.lock' || true; } | xargs -r sed -i "s|$old_studio_img|$new_studio_img|g"
+            fi
             changed=1
           fi
-          if [ -n "$old_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
+          if [ -n "$new_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
             git grep -lF "$old_studio_lib" -- . ':!bun.lock' | xargs -r sed -i "s|$old_studio_lib|$new_studio_lib|g"
             changed=1
           fi
-          # One studio entry, not two — the launched image tag is the runtime-
+          # One studio entry, not two -- the launched image tag is the runtime-
           # relevant one; only fall back to the lib tag if the image held but the
-          # library advanced (npm nightly moved with no new image on the line yet).
+          # library advanced.
           if [ "$old_studio_img" != "$new_studio_img" ]; then
             parts+=("studio \`$new_studio_img\`")
-          elif [ -n "$old_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
+          elif [ -n "$new_studio_lib" ] && [ "$old_studio_lib" != "$new_studio_lib" ]; then
             parts+=("studio-lib \`$new_studio_lib\`")
           fi
 
@@ -299,6 +331,8 @@ jobs:
         if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'success'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Through env, never pasted into the script (see the PR step below).
+          SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
           # This bump is about to land, which makes any upgrade-latest/* PR an earlier
@@ -321,7 +355,7 @@ jobs:
           git add -A
           git commit -m "chore: bump Norsk nightly + ctl pins to latest channel
 
-          ${{ steps.bump.outputs.summary }}
+          ${SUMMARY}
 
           Coupled Norsk pins (npm overrides + manifest.seed.json image tags +
           version-pin guard test) moved together via a global version-string
@@ -351,6 +385,11 @@ jobs:
         if: steps.bump.outputs.changed == '1' && steps.gate.outcome == 'failure'
         env:
           API_TOKEN: ${{ secrets.CI_DISPATCH_TOKEN }}
+          # Through env, never pasted into the script: the summary wraps each
+          # version in backticks, and inside a double-quoted shell string those
+          # ran as commands ("1.3.1-...: command not found"), dropping every
+          # version from the commit message and PR body.
+          SUMMARY: ${{ steps.bump.outputs.summary }}
         run: |
           set -euo pipefail
           branch="upgrade-latest/nightly"
@@ -360,7 +399,7 @@ jobs:
           git add -A
           git commit -m "chore: bump Norsk nightly + ctl pins to latest channel (needs reconciliation)
 
-          ${{ steps.bump.outputs.summary }}"
+          ${SUMMARY}"
           git push -f origin "$branch"
           title="Bump Norsk nightly + ctl pins to latest channel"
           body="$(printf '%s\n' \
@@ -368,7 +407,7 @@ jobs:
             "pins came with it -- but the product gate is **red**, so this bump needs a" \
             "human before it reaches main." \
             "" \
-            "    ${{ steps.bump.outputs.summary }}" \
+            "    ${SUMMARY}" \
             "" \
             "A red gate here usually means the new Norsk nightly is bad, or genuinely" \
             "changed something the product depends on. Run it to see which:" \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.27",
+  "version": "0.2.29",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",