@norskvideo/ctl-dev-kit 0.2.64 → 0.2.65

package/conventions/check-drift.ts

@@ -5,8 +5,10 @@
 //     tsconfig.base.json, the .gitignore core block, scripts/demo (only a
 //     product with tests/demo.spec.ts is asked for it), publish-docs-site.yml
 //     (only a repo with a docs site may carry it, and never a turnkey)
-//   - masked per-repo line: checks.yml, upgrade-latest.yml, publish-docs.yml
-//     and the other dispatching workflows (`product:` key)
+//   - masked per-repo line: checks.yml, bump.yml, publish-docs.yml and the
+//     other dispatching workflows (`product:` key)
+//   - retired: upgrade-latest.yml, sync-dev-kit.yml, sync-ctl-packages.yml,
+//     which bump.yml replaced; carrying one is drift
 //   - base + sanctioned extension block: dprint.json (repo-specific excludes)
 //   - must import the shared module: flake.nix (otherwise the product's own)
 //   - structural: root tsconfig.json (shape-dependent includes stay free),
@@ -262,14 +264,13 @@ export interface CanonicalBytes {
   /** build/ctl-shell.nix — the shared dev-shell module, gated verbatim at
    *  nix/ctl-shell.nix for every shape. */
   ctlShell: string;
-  upgradeLatest: string;
-  syncDevKit: string;
-  /** conventions/sync-ctl-packages.yml — the ctl-* pin freshness PR. No per-repo
-   *  line at all, so it is verbatim and sync-drift creates it where absent. */
-  syncCtlPackages: string;
-  /** conventions/bot-prs.yml -- merges the pin bots' green PRs and reports red
-   *  ones. Verbatim (it reads its dashboard key at run time), so sync-drift
-   *  creates it where absent, like sync-ctl-packages. */
+  /** conventions/bump.yml -- the one nightly bump (dev-kit, ctl-* and moq-*,
+   *  then the engine/Studio/norsk-ctl pins) and its one PR. Masked like
+   *  checks.yml; required, and sync-drift creates it where absent. */
+  bump: string;
+  /** conventions/bot-prs.yml -- merges the bump's green PR and reports a red
+   *  one. Verbatim (it reads its dashboard key at run time), so sync-drift
+   *  creates it where absent. */
   botPrs: string;
   publishDocs: string;
   /** conventions/build-docs.yml — the embedded docs variant (bundle -> image, no upload). */
@@ -305,10 +306,10 @@ export interface CanonicalBytes {
    *  Studio licence step removed (it reads shared/src/version.ts +
    *  product-template.ts). Optional for the same reason as flakeSdkApp. */
   checksSdkApp?: string;
-  /** conventions/upgrade-latest.sdk-app.yml — the upgrade-latest.yml variant for
-   *  an sdk-app: no Studio pair or manifest.seed.json, the norsk family bumped off
-   *  the SDK nightly. Optional for the same reason as flakeSdkApp. */
-  upgradeLatestSdkApp?: string;
+  /** conventions/bump.sdk-app.yml — the bump.yml variant for an sdk-app: its
+   *  pins step has no Studio pair or manifest.seed.json, and bumps the norsk
+   *  family off the SDK nightly. Optional for the same reason as flakeSdkApp. */
+  bumpSdkApp?: string;
 }
 
 // 05-demo s6: a product that has a demo (tests/demo.spec.ts) exposes it the
@@ -514,6 +515,16 @@ export function resolveRepoName(repoRoot: string, env: NodeJS.ProcessEnv = proce
 const PUBLIC_DOCS_REPO = /^norsk-ctl-product-/;
 const TURNKEY_REPO = /^norsk-ctl-turnkey-/;
 
+/** The one nightly bump (ci-fragility proposal B2). */
+export const BUMP_WORKFLOW = ".github/workflows/bump.yml";
+
+/** The three bump bots bump.yml replaced, removed from a product by sync-drift. */
+export const RETIRED_BUMP_WORKFLOWS = [
+  ".github/workflows/upgrade-latest.yml",
+  ".github/workflows/sync-dev-kit.yml",
+  ".github/workflows/sync-ctl-packages.yml",
+] as const;
+
 /** The docs site's publish workflow, where a repo carries one. */
 export const DOCS_SITE_WORKFLOW = ".github/workflows/publish-docs-site.yml";
 
@@ -657,7 +668,7 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
   // checks.yml is REQUIRED — it is the CI entry point that runs this very gate
   // (plus the shared quality jobs), so a repo without it never re-converges.
   // Only the `product:` dispatch key is per-repo; it is masked like
-  // upgrade-latest.yml's.
+  // bump.yml's.
   const checksPath = join(repoRoot, ".github", "workflows", "checks.yml");
   const checksRel = ".github/workflows/checks.yml";
   const checksCanon = shape === "sdk-app" ? canonical.checksSdkApp : canonical.checks;
@@ -702,52 +713,35 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
     }
   }
 
-  // upgrade-latest.yml is OPTIONAL — a product may ship without a nightly bump
-  // (e.g. until it has an integration tier). But when present it is the shared,
-  // single-sourced workflow and must not diverge. Shape-selected like checks.yml:
-  // an sdk-app has no Studio pair to bump, so it carries its own variant.
-  const workflowPath = join(repoRoot, ".github", "workflows", "upgrade-latest.yml");
-  if (existsSync(workflowPath)) {
-    const upgradeCanon = shape === "sdk-app" ? canonical.upgradeLatestSdkApp : canonical.upgradeLatest;
-    if (upgradeCanon === undefined) {
-      throw new Error(`checkDrift: shape "${shape}" requires canonical.upgradeLatestSdkApp`);
-    }
-    push(
-      workflowProblem(
-        ".github/workflows/upgrade-latest.yml",
-        shape === "sdk-app" ? "conventions/upgrade-latest.sdk-app.yml" : "conventions/upgrade-latest.yml",
-        readFileSync(workflowPath, "utf8"),
-        upgradeCanon,
-      ),
-    );
-  }
-
-  // sync-dev-kit.yml is OPTIONAL for the same reason as upgrade-latest.yml — a
-  // product may not carry it yet — but when present it is the shared,
-  // single-sourced workflow that keeps this repo's dev-kit pin fresh, and must
-  // not diverge. Only its `product:` dispatch key is per-repo.
-  const syncPath = join(repoRoot, ".github", "workflows", "sync-dev-kit.yml");
-  if (existsSync(syncPath)) {
-    push(
-      workflowProblem(
-        ".github/workflows/sync-dev-kit.yml",
-        "conventions/sync-dev-kit.yml",
-        readFileSync(syncPath, "utf8"),
-        canonical.syncDevKit,
-      ),
+  // bump.yml is REQUIRED: the one nightly bump (ci-fragility proposal B2), and
+  // sync-drift creates it. Shape-selected like checks.yml: an sdk-app has no
+  // Studio pair to bump, so it carries its own variant. Only its `product:`
+  // dispatch keys are per-repo.
+  const bumpPath = join(repoRoot, BUMP_WORKFLOW);
+  const bumpCanon = shape === "sdk-app" ? canonical.bumpSdkApp : canonical.bump;
+  const bumpRef = shape === "sdk-app" ? "conventions/bump.sdk-app.yml" : "conventions/bump.yml";
+  if (bumpCanon === undefined) {
+    throw new Error(`checkDrift: shape "${shape}" requires canonical.bumpSdkApp`);
+  } else if (!existsSync(bumpPath)) {
+    problems.push(
+      `${BUMP_WORKFLOW} not found (${bumpPath}). It is this repo's one nightly bump: \`bun run sync:drift\` creates it from @norskvideo/ctl-dev-kit ${bumpRef}, keeping this repo's dashboard key.`,
     );
+  } else {
+    push(workflowProblem(BUMP_WORKFLOW, bumpRef, readFileSync(bumpPath, "utf8"), bumpCanon));
   }
 
-  // sync-ctl-packages.yml is OPTIONAL until a repo has been synced once — it is
-  // NEW, and sync-drift creates it. Unlike its neighbours it carries no per-repo
-  // line (it dispatches to no dashboard), so the whole file is canonical.
-  const syncCtlPath = join(repoRoot, ".github", "workflows", "sync-ctl-packages.yml");
-  if (existsSync(syncCtlPath) && readFileSync(syncCtlPath, "utf8") !== canonical.syncCtlPackages) {
-    push(`.github/workflows/sync-ctl-packages.yml differs from conventions/sync-ctl-packages.yml. ${RESYNC}`);
+  // The three bots bump.yml replaced. One left beside it would run a second
+  // bump that conflicts with the first and is tested alone -- what B2 ended.
+  for (const rel of RETIRED_BUMP_WORKFLOWS) {
+    if (existsSync(join(repoRoot, rel))) {
+      problems.push(
+        `${rel} is retired: ${BUMP_WORKFLOW} does its job now, in the one nightly bump. Delete it (\`bun run sync:drift\` removes it once ${BUMP_WORKFLOW} exists).`,
+      );
+    }
   }
 
-  // bot-prs.yml: the same shape -- optional until a repo's first sync creates
-  // it, verbatim once present.
+  // bot-prs.yml: optional until a repo's first sync creates it, verbatim once
+  // present.
   const botPrsPath = join(repoRoot, ".github", "workflows", "bot-prs.yml");
   if (existsSync(botPrsPath) && readFileSync(botPrsPath, "utf8") !== canonical.botPrs) {
     push(`.github/workflows/bot-prs.yml differs from conventions/bot-prs.yml. ${RESYNC}`);
@@ -879,9 +873,7 @@ if (import.meta.main) {
     core: readFileSync(join(import.meta.dir, "CLAUDE.core.md"), "utf8"),
     flake: readFileSync(join(import.meta.dir, "..", "build", "flake.nix"), "utf8"),
     ctlShell: readFileSync(join(import.meta.dir, "..", "build", "ctl-shell.nix"), "utf8"),
-    upgradeLatest: readFileSync(join(import.meta.dir, "upgrade-latest.yml"), "utf8"),
-    syncDevKit: readFileSync(join(import.meta.dir, "sync-dev-kit.yml"), "utf8"),
-    syncCtlPackages: readFileSync(join(import.meta.dir, "sync-ctl-packages.yml"), "utf8"),
+    bump: readFileSync(join(import.meta.dir, "bump.yml"), "utf8"),
     botPrs: readFileSync(join(import.meta.dir, "bot-prs.yml"), "utf8"),
     publishDocs: readFileSync(join(import.meta.dir, "publish-docs.yml"), "utf8"),
     buildDocs: readFileSync(join(import.meta.dir, "build-docs.yml"), "utf8"),
@@ -899,7 +891,7 @@ if (import.meta.main) {
     demoShim: readFileSync(join(import.meta.dir, "demo.sh"), "utf8"),
     flakeSdkApp: readFileSync(join(import.meta.dir, "..", "build", "flake.sdk-app.nix"), "utf8"),
     checksSdkApp: readFileSync(join(import.meta.dir, "checks.sdk-app.yml"), "utf8"),
-    upgradeLatestSdkApp: readFileSync(join(import.meta.dir, "upgrade-latest.sdk-app.yml"), "utf8"),
+    bumpSdkApp: readFileSync(join(import.meta.dir, "bump.sdk-app.yml"), "utf8"),
   };
   const report = checkDrift(repoRoot, canonical, {
     repoName: resolveRepoName(repoRoot),

package/conventions/ctl-pin-agreement.ts

@@ -6,9 +6,8 @@
 // a different copy from the one the root was moved to, and nothing says so:
 // playout's tests/ pinned the dev-kit ^0.1.57 while the root moved to 0.2, its
 // guides ran a guide proxy that built the wrong Studio prefix, and first-light
-// failed every night from 2026-09-07. sync-dev-kit.yml and
-// sync-ctl-packages.yml now move every pin; this keeps a hand edit (or a new
-// nested package) from splitting them again.
+// failed every night from 2026-09-07. bump.yml now moves every pin; this keeps
+// a hand edit (or a new nested package) from splitting them again.
 import { lstatSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
 
@@ -61,7 +60,7 @@ export function ctlPinProblems(repoRoot: string): string[] {
     if (byRange.size < 2) continue;
     const where = [...byRange].flatMap(([range, files]) => files.map((f) => `${f} ${range}`)).join(", ");
     problems.push(
-      `${name} is pinned at ${byRange.size} different ranges (${where}). A nested package then runs a different copy from the root's; pin it at one range everywhere (sync-dev-kit / sync-ctl-packages move every pin).`,
+      `${name} is pinned at ${byRange.size} different ranges (${where}). A nested package then runs a different copy from the root's; pin it at one range everywhere (the nightly bump.yml moves every pin).`,
     );
   }
   return problems;

package/conventions/docs-site.md

@@ -132,7 +132,7 @@ reaches every product's manual at once.
   shared workflows — the clause is conditional on `website/astro.config.mjs`
   existing, so a repo without a site is not asked for one.
 - `bun run sync:drift` rewrites the copies from the installed dev-kit. The
-  nightly `sync-dev-kit.yml` runs it after bumping the pin, so a theme change
+  nightly `bump.yml` runs it after bumping the pin, so a theme change
   rolls out hands-free and only a change that genuinely breaks the site goes red.
 
 **Keeping the copies at exactly those paths is load-bearing**, not tidiness:
@@ -246,11 +246,11 @@ that branch (`--branch` is the ref that ran), never over production.
 Two steps, once a dev-kit carrying the workflow is published:
 
 ```
-bun update @norskvideo/ctl-dev-kit   # bump the pin (or let sync-dev-kit.yml do it)
+bun update @norskvideo/ctl-dev-kit   # bump the pin (or let bump.yml do it)
 bun run sync:drift                   # writes .github/workflows/publish-docs-site.yml
 ```
 
-Commit the result; `bun run check:drift` passes. The nightly `sync-dev-kit.yml`
+Commit the result; `bun run check:drift` passes. The nightly `bump.yml`
 does both hands-free, so a product with a site acquires the workflow on its
 next sync without anyone touching the repo. Then create the Pages project, set
 the two secrets and the variable, and the next push to `main` publishes.

package/conventions/integration-testing.md

@@ -265,7 +265,7 @@ converge: move the repo's bespoke steps into the hooks above, replace the
 workflow with the canonical (product and runner filled in), and prove it with
 `gh workflow run integration.yml --ref <branch>` before merging — the tier
 only fires on `main` and on dispatch, so a PR's checks never run it. Once the
-marker is in, `sync-dev-kit` keeps the copy current and `check:drift` names any
+marker is in, the nightly `bump.yml` keeps the copy current and `check:drift` names any
 hand edit.
 
 **Why the pipe is shaped the way it is.** The suite runs inside a shell

package/conventions/integration.yml

@@ -39,8 +39,9 @@
 # topology step below says so in NORSK_TEST_HOST/NORSK_TEST_NET); the GPU box
 # is '["ARM64","nvidia"]'.
 #
-# On a pull request the suite runs for a BOT branch only (upgrade-latest/*,
-# sync-dev-kit/*, chore/sync-ctl-packages): a bump reaches main only once this
+# On a pull request the suite runs for a BOT branch only (bump/nightly, and the
+# retired bots' upgrade-latest/*, sync-dev-kit/* and chore/sync-ctl-packages,
+# which the PR that brings bump.yml rides on): a bump reaches main only once this
 # tier has passed on it, and bot-prs merges on that (ci-workflows
 # docs/dashboard/ci-fragility.md, proposal B). A human PR does not pay for the
 # slow tier; it runs on main after the merge, as before. A PR's result is the
@@ -91,7 +92,7 @@ concurrency:
 
 jobs:
   integration:
-    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && (startsWith(github.head_ref, 'upgrade-latest/') || startsWith(github.head_ref, 'sync-dev-kit/') || github.head_ref == 'chore/sync-ctl-packages')) }}
+    if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && (github.head_ref == 'bump/nightly' || startsWith(github.head_ref, 'upgrade-latest/') || startsWith(github.head_ref, 'sync-dev-kit/') || github.head_ref == 'chore/sync-ctl-packages')) }}
     strategy:
       matrix:
         include:
@@ -313,7 +314,7 @@ jobs:
       # deep in the suite. No `|| true` on --version: a bad binary must fail here.
       #
       # WHICH binary: the version this commit pins, flake.nix ctlVersion -- the
-      # daemon the dev shell launches, moved by upgrade-latest's bump PR. It used
+      # daemon the dev shell launches, moved by bump.yml's nightly PR. It used
       # to be S3's moving `latest`, read at run time, so a result could change
       # with no product commit and a re-run was never a real repeat (funke went
       # red and green again on 2026-10-09 without a commit either time;
@@ -336,7 +337,7 @@ jobs:
             echo "norsk-ctl $CTL_CHANNEL channel -> $ver ($arch), in place of the repo pin"
           else
             ver="$( { sed -nE 's/^[[:space:]]*ctlVersion = "([^"]+)";.*/\1/p' flake.nix 2>/dev/null || true; } | head -1)"
-            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (upgrade-latest moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (the nightly bump.yml moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
             echo "norsk-ctl pinned by flake.nix ctlVersion -> $ver ($arch)"
           fi
           curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$S3/$ver/norsk-ctl-$ver-$arch" -o "$RUNNER_TEMP/norsk-ctl"

package/conventions/publish-docs.yml

@@ -205,14 +205,14 @@ jobs:
           done <<<"$left"
 
       # The norsk-ctl this commit pins (flake.nix ctlVersion, moved by
-      # upgrade-latest's bump PR), never S3's moving `latest`: a guide run is then
+      # bump.yml's nightly PR), never S3's moving `latest`: a guide run is then
       # a real repeat, and a red belongs to a commit (ci-fragility proposal A).
       - name: Download the pinned norsk-ctl binary (flake.nix ctlVersion)
         run: |
           set -euo pipefail
           S3="https://s3.eu-west-1.amazonaws.com/norsk.video/norsk-ctl"
           ver="$( { sed -nE 's/^[[:space:]]*ctlVersion = "([^"]+)";.*/\1/p' flake.nix 2>/dev/null || true; } | head -1)"
-          [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (upgrade-latest moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+          [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (the nightly bump.yml moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
           echo "norsk-ctl pinned by flake.nix ctlVersion -> $ver"
           curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$S3/$ver/norsk-ctl-$ver-linux-x64" -o "$RUNNER_TEMP/norsk-ctl"
           chmod +x "$RUNNER_TEMP/norsk-ctl"

package/conventions/smoke.yml

@@ -223,7 +223,7 @@ jobs:
       # deep in the suite. No `|| true` on --version: a bad binary must fail here.
       #
       # WHICH binary: the version this commit pins, flake.nix ctlVersion -- the
-      # daemon the dev shell launches, moved by upgrade-latest's bump PR. It used
+      # daemon the dev shell launches, moved by bump.yml's nightly PR. It used
       # to be S3's moving `latest`, read at run time, so a result could change
       # with no product commit and a re-run was never a real repeat (funke went
       # red and green again on 2026-10-09 without a commit either time;
@@ -246,7 +246,7 @@ jobs:
             echo "norsk-ctl $CTL_CHANNEL channel -> $ver ($arch), in place of the repo pin"
           else
             ver="$( { sed -nE 's/^[[:space:]]*ctlVersion = "([^"]+)";.*/\1/p' flake.nix 2>/dev/null || true; } | head -1)"
-            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (upgrade-latest moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
+            [ -n "$ver" ] || { echo "::error::flake.nix pins no ctlVersion. CI runs the norsk-ctl this commit pins (the nightly bump.yml moves it); add ctlVersion = \"<version>\"; to flake.nix."; exit 1; }
             echo "norsk-ctl pinned by flake.nix ctlVersion -> $ver ($arch)"
           fi
           curl -fsSL --retry 3 --retry-all-errors --retry-delay 2 "$S3/$ver/norsk-ctl-$ver-$arch" -o "$RUNNER_TEMP/norsk-ctl"

package/conventions/sync-drift.ts

@@ -7,8 +7,12 @@
 // It only touches copies whose convergent form is mechanical — there is no
 // judgement anywhere:
 //   - verbatim (biome.json, tsconfig.base.json)      -> overwrite with canonical
-//   - masked workflows (checks / upgrade / sync /    -> canonical, repo's product: key kept
+//   - masked workflows (checks / bump /              -> canonical, repo's product: key kept
 //     publish-docs)
+//   - bump.yml                                       -> CREATED where absent, under the key the
+//                                                       retired bump bots carried; then those
+//                                                       three (upgrade-latest / sync-dev-kit /
+//                                                       sync-ctl-packages) are DELETED
 //   - nix/ctl-shell.nix                              -> overwrite with canonical (created if absent)
 //   - flake.nix (legacy verbatim copy only)          -> the starter, repo's floating ctl pin kept
 //   - marker-block (CLAUDE core, dprint, .gitignore) -> replace the shared block, keep the rest
@@ -22,11 +26,12 @@
 // cannot mechanically converge (e.g. a workflow with no product key to preserve)
 // is left for check-drift to flag, and a convention that genuinely breaks the
 // product surfaces as a red lint/typecheck/test — not as a silent bad copy.
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { checkTheme, syncTheme } from "../docs-theme/sync.ts";
 import {
   BEGIN,
+  BUMP_WORKFLOW,
   type CanonicalBytes,
   CTL_HASH_LINE,
   CTL_SHELL_PATH,
@@ -43,6 +48,7 @@ import {
   PRODUCT_SENTINEL,
   type ProductShape,
   PUBLISH_IMAGE_LINE,
+  RETIRED_BUMP_WORKFLOWS,
   RUNNER_LINE,
   resolveRepoName,
   resolveShape,
@@ -69,7 +75,7 @@ function writeIfChanged(path: string, content: string, rel: string, written: str
   }
 }
 
-// checks.yml / upgrade-latest.yml / sync-dev-kit.yml: canonical byte-for-byte
+// checks.yml / publish-docs.yml: canonical byte-for-byte
 // except the one `product:` dispatch key, which the gate masks. Re-emit the
 // canonical with the repo's own key filled back in. A workflow with no key to
 // preserve (absent, or still the sentinel) is left for the gate to flag.
@@ -87,6 +93,48 @@ function syncWorkflow(repoRoot: string, rel: string, canonical: string, r: SyncR
   writeIfChanged(path, canonical.replace(PRODUCT_LINE, `$1${key}`), rel, r.written);
 }
 
+const productKey = (path: string): string | undefined => {
+  if (!existsSync(path)) return undefined;
+  const key = readFileSync(path, "utf8").match(/^\s*product:\s*(\S+)/m)?.[1];
+  return key && key !== PRODUCT_SENTINEL ? key : undefined;
+};
+
+// bump.yml, the one nightly bump (ci-fragility proposal B2), and the end of
+// the three bots it replaced. This is how it reaches a product: the old
+// sync-dev-kit.yml installs a dev-kit that has it and runs this writer, which
+// creates bump.yml under the dashboard key the old bots reported under and
+// deletes them -- sync-dev-kit.yml included, in the very PR it is opening. The
+// old bot-prs on main still triages that PR (its branch is sync-dev-kit/*),
+// and the new integration and build-image it brings still run on that branch,
+// so the transition lands like any other bump. Once landed, bump.yml owns the
+// night and the old three are gone.
+//
+// The key comes from bump.yml itself once it has one; before that from
+// upgrade-latest.yml (the nightly column's reporter), sync-dev-kit.yml, and
+// last checks.yml (required, always filled). With no key at all nothing is
+// created and nothing removed: deleting the old bots before their replacement
+// exists would leave the product with no nightly bump, silently. The gate then
+// names the missing bump.yml.
+function syncBump(repoRoot: string, canonical: string, r: SyncReport): void {
+  const wf = (rel: string) => join(repoRoot, rel);
+  const key =
+    productKey(wf(BUMP_WORKFLOW)) ??
+    productKey(wf(".github/workflows/upgrade-latest.yml")) ??
+    productKey(wf(".github/workflows/sync-dev-kit.yml")) ??
+    productKey(wf(".github/workflows/checks.yml"));
+  if (key === undefined) {
+    r.skipped.push(`${BUMP_WORKFLOW} (no product: key to give it; the retired bump workflows are left in place)`);
+    return;
+  }
+  mkdirSync(dirname(wf(BUMP_WORKFLOW)), { recursive: true });
+  writeIfChanged(wf(BUMP_WORKFLOW), canonical.replace(PRODUCT_LINE, `$1${key}`), BUMP_WORKFLOW, r.written);
+  for (const rel of RETIRED_BUMP_WORKFLOWS) {
+    if (!existsSync(wf(rel))) continue;
+    rmSync(wf(rel));
+    r.written.push(rel);
+  }
+}
+
 // publish-docs.yml: optional, and masked like checks.yml (only re-synced where
 // the repo already carries it). Every copy predating the mask was written
 // verbatim with the sentinel, so a copy with no key of its own takes the one
@@ -307,7 +355,7 @@ function syncWithDisplay(repoRoot: string, canonical: string, r: SyncReport): vo
 // carry one. It is CREATED only where the gate would accept it: a repo with a
 // site (there is something to publish), named, and not a turnkey (a turnkey has
 // no public site, ADR-0012). That is how a product that grows a site acquires
-// its publish: the next sync-dev-kit run installs it, green until the Pages
+// its publish: the next nightly bump installs it, green until the Pages
 // project exists. A name this writer cannot determine creates nothing, since
 // the gate could only refuse the result.
 const TURNKEY_REPO = /^norsk-ctl-turnkey-/;
@@ -338,7 +386,7 @@ function syncPublishDocsSite(repoRoot: string, canonical: string, repoName: stri
 // Only for a repo that HAS a site: sync never creates one (a site is a nested
 // standalone package with its own install, not a file this writer can conjure),
 // it only keeps an existing one's copies in step. That is what makes a theme
-// change roll out through sync-dev-kit.yml like any other convention.
+// change roll out through bump.yml like any other convention.
 function syncDocsTheme(repoRoot: string, r: SyncReport): void {
   if (!hasDocsSite(repoRoot)) {
     r.skipped.push(`${DOCS_SITE_DIR}/ docs theme (no docs site)`);
@@ -372,21 +420,12 @@ export function syncDrift(
   writeIfChanged(join(repoRoot, "tsconfig.base.json"), canonical.tsconfigBase, "tsconfig.base.json", r.written);
 
   syncWorkflow(repoRoot, ".github/workflows/checks.yml", checksCanon, r);
-  // upgrade-latest too: an sdk-app has no Studio pair, so it has its own variant
-  const upgradeCanon = shape === "sdk-app" ? canonical.upgradeLatestSdkApp : canonical.upgradeLatest;
-  if (upgradeCanon === undefined) throw new Error(`syncDrift: shape "${shape}" requires canonical.upgradeLatestSdkApp`);
-  syncWorkflow(repoRoot, ".github/workflows/upgrade-latest.yml", upgradeCanon, r);
-  syncWorkflow(repoRoot, ".github/workflows/sync-dev-kit.yml", canonical.syncDevKit, r);
-  // No per-repo line to preserve, so it is written whole -- and CREATED where
-  // absent, unlike syncWorkflow's copies. That is how a repo acquires the
-  // workflow at all: its next sync run installs it.
-  writeIfChanged(
-    join(repoRoot, ".github/workflows/sync-ctl-packages.yml"),
-    canonical.syncCtlPackages,
-    ".github/workflows/sync-ctl-packages.yml",
-    r.written,
-  );
-  // bot-prs.yml likewise: verbatim, and created where absent.
+  // bump.yml: an sdk-app has no Studio pair, so it has its own variant.
+  const bumpCanon = shape === "sdk-app" ? canonical.bumpSdkApp : canonical.bump;
+  if (bumpCanon === undefined) throw new Error(`syncDrift: shape "${shape}" requires canonical.bumpSdkApp`);
+  syncBump(repoRoot, bumpCanon, r);
+  // bot-prs.yml: no per-repo line to preserve, so it is written whole -- and
+  // CREATED where absent. That is how a repo acquires it: its next sync installs it.
   writeIfChanged(
     join(repoRoot, ".github/workflows/bot-prs.yml"),
     canonical.botPrs,
@@ -428,9 +467,7 @@ if (import.meta.main) {
     core: readFileSync(join(dir, "CLAUDE.core.md"), "utf8"),
     flake: readFileSync(join(dir, "..", "build", "flake.nix"), "utf8"),
     ctlShell: readFileSync(join(dir, "..", "build", "ctl-shell.nix"), "utf8"),
-    upgradeLatest: readFileSync(join(dir, "upgrade-latest.yml"), "utf8"),
-    syncDevKit: readFileSync(join(dir, "sync-dev-kit.yml"), "utf8"),
-    syncCtlPackages: readFileSync(join(dir, "sync-ctl-packages.yml"), "utf8"),
+    bump: readFileSync(join(dir, "bump.yml"), "utf8"),
     botPrs: readFileSync(join(dir, "bot-prs.yml"), "utf8"),
     publishDocs: readFileSync(join(dir, "publish-docs.yml"), "utf8"),
     buildDocs: readFileSync(join(dir, "build-docs.yml"), "utf8"),
@@ -448,7 +485,7 @@ if (import.meta.main) {
     demoShim: readFileSync(join(dir, "demo.sh"), "utf8"),
     flakeSdkApp: readFileSync(join(dir, "..", "build", "flake.sdk-app.nix"), "utf8"),
     checksSdkApp: readFileSync(join(dir, "checks.sdk-app.yml"), "utf8"),
-    upgradeLatestSdkApp: readFileSync(join(dir, "upgrade-latest.sdk-app.yml"), "utf8"),
+    bumpSdkApp: readFileSync(join(dir, "bump.sdk-app.yml"), "utf8"),
   };
   const report = syncDrift(repoRoot, canonical, resolveShape(repoRoot), { repoName: resolveRepoName(repoRoot) });
   if (report.written.length === 0) {

package/create-product/canon.ts

@@ -18,9 +18,7 @@ export interface Canon {
   /** build/ctl-shell.nix, emitted as nix/ctl-shell.nix — the flake imports it. */
   ctlShell: string;
   flakeLock: string;
-  upgradeLatest: string;
-  syncDevKit: string;
-  syncCtlPackages: string;
+  bump: string;
   botPrs: string;
   checks: string;
   biome: string;
@@ -45,9 +43,7 @@ export function loadCanon(): Canon {
     flake: readFileSync(join(buildDir, "flake.nix"), "utf8"),
     ctlShell: readFileSync(join(buildDir, "ctl-shell.nix"), "utf8"),
     flakeLock: readFileSync(join(buildDir, "flake.lock"), "utf8"),
-    upgradeLatest: readFileSync(join(conventionsDir, "upgrade-latest.yml"), "utf8"),
-    syncDevKit: readFileSync(join(conventionsDir, "sync-dev-kit.yml"), "utf8"),
-    syncCtlPackages: readFileSync(join(conventionsDir, "sync-ctl-packages.yml"), "utf8"),
+    bump: readFileSync(join(conventionsDir, "bump.yml"), "utf8"),
     botPrs: readFileSync(join(conventionsDir, "bot-prs.yml"), "utf8"),
     checks: readFileSync(join(conventionsDir, "checks.yml"), "utf8"),
     buildDocs: readFileSync(join(conventionsDir, "build-docs.yml"), "utf8"),

package/create-product/create-product.ts

@@ -220,9 +220,7 @@ function conventionFiles(ctx: ShapeContext, shape: ShapeModule): GeneratedFile[]
     },
     { path: ".gitignore", content: `${canon.gitignoreCore}\n${shape.gitignoreTail(ctx)}` },
     { path: ".github/workflows/checks.yml", content: fillProduct(canon.checks) },
-    { path: ".github/workflows/upgrade-latest.yml", content: fillProduct(canon.upgradeLatest) },
-    { path: ".github/workflows/sync-dev-kit.yml", content: fillProduct(canon.syncDevKit) },
-    { path: ".github/workflows/sync-ctl-packages.yml", content: canon.syncCtlPackages },
+    { path: ".github/workflows/bump.yml", content: fillProduct(canon.bump) },
     { path: ".github/workflows/bot-prs.yml", content: canon.botPrs },
     { path: ".github/workflows/build-image.yml", content: fillProduct(canon.buildImage) },
     { path: ".github/actions/ci-status-dispatch/action.yml", content: loadAsset("ci-status-dispatch.yml") },

package/create-product/turnkey.ts

@@ -228,7 +228,7 @@ machine-writable source of truth — RFC 0001 Workstream C) via
 \`shared/src/version.ts\`, which validates the seed through the SDK's
 \`parseManifestSeed\` at module load. \`version.test.ts\` fails if the seed and
 the \`norsk-sdk\`/\`norsk-studio*\` npm pins in \`shared/package.json\` drift
-apart — the shared \`upgrade-latest.yml\` bumps them all in lockstep nightly.
+apart — the shared \`bump.yml\` bumps them all in lockstep nightly.
 
 ## The stored-template trap
 
@@ -537,7 +537,7 @@ describe("npm pins stay coupled to the seed", () => {
   // the studio npm packages and the studio Docker image from different commits,
   // so the image rides the newest published Docker Hub tag on the same
   // major.minor.patch line as the npm nightly (exactly how the shared
-  // upgrade-latest.yml advances the pair).
+  // bump.yml advances the pair).
   it("studio image stays on the npm pin's major.minor.patch line", () => {
     expect(STUDIO_IMAGE_TAG.split("-")[0]).toBe(studioNpmPin.split("-")[0]);
   });

package/docs-theme/README.md

@@ -85,7 +85,7 @@ a class attribute on every page of the site.
 site: `hasDocsSite()` tests for `website/astro.config.mjs`, and
 `docsThemeProblems()` routes this directory's `checkTheme` into the same report as
 `biome.json` and the shared workflows. `conventions/sync-drift.ts` is the writer
-half, so `sync-dev-kit.yml` rolls a theme change out to every product like any
+half, so `bump.yml` rolls a theme change out to every product like any
 other convention, through a bot PR that `bot-prs.yml` merges once its tiers pass. The site directory is `website/` across the fleet
 (`DOCS_SITE_DIR`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.64",
+  "version": "0.2.65",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",