@norskvideo/ctl-dev-kit 0.2.44 → 0.2.46

package/conventions/check-drift.ts

@@ -18,11 +18,13 @@
 // dev-kit forces a re-sync. Canonical bytes ship alongside this script
 // (conventions/* + build/*), resolved package-relative so they work both
 // workspace-symlinked and installed from the published tarball.
+
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { parseManifestSeed } from "@norskvideo/ctl-sdk/manifest-seed";
 import { checkTheme } from "../docs-theme/sync.ts";
+import { ctlPinProblems } from "./ctl-pin-agreement.ts";
 
 export interface DriftReport {
   ok: boolean;
@@ -803,6 +805,7 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
 
   for (const p of demoProblems(repoRoot, canonical.demoShim)) push(p);
   for (const p of productLogsProblems(repoRoot)) push(p);
+  for (const p of ctlPinProblems(repoRoot)) push(p);
 
   return { ok: problems.length === 0, problems };
 }

package/conventions/ctl-pin-agreement.ts

@@ -0,0 +1,68 @@
+// Every package.json in a product repo pins each @norskvideo/ctl-* package at
+// the SAME range.
+//
+// A repo is a workspace of packages, and a nested one (tests/, shared/) can pin
+// a ctl package of its own. When the two ranges differ, the nested package runs
+// a different copy from the one the root was moved to, and nothing says so:
+// playout's tests/ pinned the dev-kit ^0.1.57 while the root moved to 0.2, its
+// guides ran a guide proxy that built the wrong Studio prefix, and first-light
+// failed every night from 2026-09-07. sync-dev-kit.yml and
+// sync-ctl-packages.yml now move every pin; this keeps a hand edit (or a new
+// nested package) from splitting them again.
+import { lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const SCOPE = "@norskvideo/ctl-";
+/** Directories that hold installed or generated packages, not this repo's own. */
+const SKIP = new Set(["node_modules", ".git", "dist", "build", "test-temp", "generated", ".nix"]);
+
+function manifests(root: string, dir = root, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    if (SKIP.has(name)) continue;
+    const path = join(dir, name);
+    // lstat: never follow a symlink. A repo's own packages are real
+    // directories, and a link (a nix `result`, a workspace link) can lead
+    // anywhere, including out of the repo entirely.
+    let st: ReturnType<typeof lstatSync>;
+    try {
+      st = lstatSync(path);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) manifests(root, path, out);
+    else if (name === "package.json") out.push(path);
+  }
+  return out;
+}
+
+export function ctlPinProblems(repoRoot: string): string[] {
+  const problems: string[] = [];
+  /** package -> range -> the files pinning it at that range */
+  const pins = new Map<string, Map<string, string[]>>();
+  for (const path of manifests(repoRoot).sort()) {
+    const rel = relative(repoRoot, path);
+    let parsed: Record<string, Record<string, string> | undefined>;
+    try {
+      parsed = JSON.parse(readFileSync(path, "utf8"));
+    } catch (e) {
+      problems.push(`${rel} is not parseable JSON (${e instanceof Error ? e.message : String(e)}).`);
+      continue;
+    }
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      for (const [name, range] of Object.entries(parsed[field] ?? {})) {
+        if (!name.startsWith(SCOPE) || typeof range !== "string" || range.startsWith("workspace:")) continue;
+        const byRange = pins.get(name) ?? new Map<string, string[]>();
+        byRange.set(range, [...(byRange.get(range) ?? []), rel]);
+        pins.set(name, byRange);
+      }
+    }
+  }
+  for (const [name, byRange] of pins) {
+    if (byRange.size < 2) continue;
+    const where = [...byRange].flatMap(([range, files]) => files.map((f) => `${f} ${range}`)).join(", ");
+    problems.push(
+      `${name} is pinned at ${byRange.size} different ranges (${where}). A nested package then runs a different copy from the root's; pin it at one range everywhere (sync-dev-kit / sync-ctl-packages move every pin).`,
+    );
+  }
+  return problems;
+}

package/conventions/sync-dev-kit.yml

@@ -117,24 +117,32 @@ jobs:
           new="$(curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$reg/$enc" | jq -r '."dist-tags".latest')"
           [ -n "$new" ] && [ "$new" != "null" ] || { echo "could not resolve $pkg latest"; exit 1; }
 
-          # The current pin, whatever its range operator. A repo with no dev-kit
-          # dep has nothing to sync.
-          old="$(grep -oE "\"$pkg\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" package.json | head -1 | sed -E 's/.*"([^"]*)"$/\1/')"
-          if [ -z "$old" ]; then
-            echo "$pkg is not pinned in package.json -- nothing to sync."
-            echo "changed=0" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          old_bare="${old#^}"; old_bare="${old_bare#~}"
-          echo "dev-kit: $old -> ^$new"
-          if [ "$old_bare" = "$new" ]; then
-            echo "already on the newest dev-kit ($new)."
+          # Every tracked package.json, not just the root. A nested workspace can
+          # pin the dev-kit too, and a root-only rewrite left it behind: playout's
+          # tests/ sat on 0.1.x after the root moved to 0.2, ran a guide proxy
+          # that built the wrong Studio prefix, and first-light failed every
+          # night from 2026-09-07. Same walk as sync-ctl-packages.yml.
+          mapfile -t manifests < <(git ls-files '*package.json' ':!:**/node_modules/**')
+          moved=""
+          for m in "${manifests[@]}"; do
+            old="$(grep -oE "\"$pkg\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" "$m" | head -1 | sed -E 's/.*"([^"]*)"$/\1/' || true)"
+            # Absent here, or a workspace protocol spec that names no version.
+            case "$old" in "" | workspace:*) continue ;; esac
+            old_bare="${old#^}"; old_bare="${old_bare#~}"
+            [ "$old_bare" != "$new" ] || continue
+            # Surgical single-line rewrite so the file keeps its formatting
+            # (a jq reserialize would reflow it and trip the formatter).
+            sed -i -E "s|(\"$pkg\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1^$new\2|" "$m"
+            echo "dev-kit: $m $old -> ^$new"
+            moved="$moved $old_bare"
+          done
+          if [ -z "$moved" ]; then
+            echo "every dev-kit pin is already on the newest dev-kit ($new)."
             echo "changed=0" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          # Surgical single-line rewrite so package.json keeps its formatting
-          # (a jq reserialize would reflow the whole file and trip the formatter).
-          sed -i -E "s|(\"$pkg\"[[:space:]]*:[[:space:]]*\")[^\"]*(\")|\1^$new\2|" package.json
+          # `old` names the lowest pin moved, for the commit message and PR title.
+          old_bare="$(printf '%s\n' $moved | sort -V | head -1)"
           echo "changed=1" >> "$GITHUB_OUTPUT"
           echo "old=$old_bare" >> "$GITHUB_OUTPUT"
           echo "new=$new" >> "$GITHUB_OUTPUT"
@@ -148,7 +156,14 @@ jobs:
         run: |
           nix develop .#build --command bash -c '
             set -euo pipefail
-            bun install
+            # Per install root, as sync-ctl-packages.yml does: a manifest outside
+            # the root workspace owns its own lockfile. Then move the locked
+            # dev-kit to the newest in range everywhere: bun install keeps a
+            # locked version that still satisfies its range, so a nested
+            # workspace could otherwise stay on an old dev-kit under a new pin.
+            for lock in $(git ls-files "*bun.lock"); do
+              (cd "$(dirname "$lock")" && bun install && bun update @norskvideo/ctl-dev-kit)
+            done
           '
 
       - name: Re-sync the copies from canonical and run the product gate

package/docs/path-existence.ts

@@ -13,6 +13,7 @@
 // walk and nothing is ignored.
 import { readdirSync, readFileSync, realpathSync } from "node:fs";
 import { basename, dirname, join, posix } from "node:path";
+import { BEGIN_MARKER, END_MARKER } from "./splice-generated.ts";
 
 export interface PathFinding {
   file: string;
@@ -39,6 +40,9 @@ export const PATH_ALLOW = "<!-- path-allow -->";
 // conventions, not claims about this repo's tree.
 const CORE_BEGIN = "<!-- BEGIN ctl-shared-conventions v1 -->";
 const CORE_END = "<!-- END ctl-shared-conventions v1 -->";
+// A spliced generated block (splice-generated.ts) is a tool's output, gated
+// against that tool; its paths name the tool's world (an export bundle's
+// `template/workflow.yml`), not this repo's tree.
 
 // The five prefixes the review names (its `@norskvideo/` widened to every
 // scoped npm name), plus the classes they imply: any absolute path (container
@@ -207,6 +211,7 @@ export function checkPathExistence(
     const lines = readFileSync(join(repoRoot, file), "utf8").split("\n");
     let inFence = false;
     let inCore = false;
+    let inGenerated = false;
     lines.forEach((line, index) => {
       if (/^\s*(```|~~~)/.test(line)) {
         inFence = !inFence;
@@ -214,7 +219,9 @@ export function checkPathExistence(
       }
       if (line.includes(CORE_BEGIN)) inCore = true;
       if (line.includes(CORE_END)) inCore = false;
-      if (inFence || inCore || line.includes(PATH_ALLOW)) return;
+      if (line.startsWith(BEGIN_MARKER)) inGenerated = true;
+      if (line.trim() === END_MARKER) inGenerated = false;
+      if (inFence || inCore || inGenerated || line.includes(PATH_ALLOW)) return;
       for (const token of extractPathTokens(line)) {
         if (isSkipped(token, skipPrefixes)) continue;
         if (!token.includes("/")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",