@norskvideo/ctl-dev-kit 0.2.68 → 0.2.70

package/conventions/check-drift.ts

@@ -412,6 +412,38 @@ export function productLogsProblems(repoRoot: string): string[] {
       ];
 }
 
+/** The Bun the dev-kit's build/ctl-shell.nix pins: the version its pin's URL
+ *  line names (`… .tar.gz"; # bun 1.4.2`). The shell runs it; the product's
+ *  image runs package.json's "packageManager", which must name the same. */
+export function pinnedBunVersion(ctlShell: string): string | undefined {
+  return /archive\/[0-9a-f]{40}\.tar\.gz"; # bun (\d+\.\d+\.\d+)/.exec(ctlShell)?.[1];
+}
+
+/** package.json's "packageManager" against the shell's Bun. They drifted once
+ *  already: the fleet's shells and images ran 1.3.13 by agreement alone, and a
+ *  move to 1.4.2 (1.3.13's HTTP/2 client segfaulted) had to touch every repo. */
+export function bunVersionProblems(repoRoot: string, ctlShellCanonical: string): string[] {
+  const want = pinnedBunVersion(ctlShellCanonical);
+  if (want === undefined) {
+    return ["@norskvideo/ctl-dev-kit build/ctl-shell.nix names no Bun version on its pin (`# bun X.Y.Z`)."];
+  }
+  const pkgPath = join(repoRoot, "package.json");
+  if (!existsSync(pkgPath)) return [];
+  let have: unknown;
+  try {
+    have = (JSON.parse(readFileSync(pkgPath, "utf8")) as { packageManager?: unknown }).packageManager;
+  } catch (e) {
+    return [`package.json is not parseable JSON (${e instanceof Error ? e.message : String(e)}).`];
+  }
+  return have === `bun@${want}`
+    ? []
+    : [
+        `package.json "packageManager" is ${JSON.stringify(have ?? null)}, not "bun@${want}": it is the Bun the ` +
+          "product's image runs, and must be the one the shell runs (@norskvideo/ctl-dev-kit build/ctl-shell.nix). " +
+          "Re-sync to set it.",
+      ];
+}
+
 // A file that must be a verbatim, byte-for-byte copy of its dev-kit canonical.
 function verbatimProblem(
   repoRoot: string,
@@ -862,6 +894,7 @@ export function checkDrift(repoRoot: string, canonical: CanonicalBytes, opts: Ch
 
   for (const p of demoProblems(repoRoot, canonical.demoShim)) push(p);
   for (const p of productLogsProblems(repoRoot)) push(p);
+  for (const p of bunVersionProblems(repoRoot, canonical.ctlShell)) push(p);
   for (const p of ctlPinProblems(repoRoot)) push(p);
 
   return { ok: problems.length === 0, problems };

package/conventions/sync-drift.ts

@@ -48,6 +48,7 @@ import {
   PRODUCT_SENTINEL,
   type ProductShape,
   PUBLISH_IMAGE_LINE,
+  pinnedBunVersion,
   RETIRED_BUMP_WORKFLOWS,
   RUNNER_LINE,
   resolveRepoName,
@@ -401,6 +402,29 @@ function syncDocsTheme(repoRoot: string, r: SyncReport): void {
   for (const rel of adrift) r.written.push(`${DOCS_SITE_DIR}/${rel}`);
 }
 
+// package.json "packageManager": the Bun the product's image runs, set to the
+// one the shell pins (build/ctl-shell.nix), so a Bun move reaches every
+// product through its sync. Only that field's value is rewritten, so the
+// file's own formatting stays. A package.json with no field is left for the
+// gate to flag.
+function syncPackageManager(repoRoot: string, ctlShell: string, r: SyncReport): void {
+  const want = pinnedBunVersion(ctlShell);
+  const path = join(repoRoot, "package.json");
+  if (want === undefined || !existsSync(path)) return;
+  const current = readFileSync(path, "utf8");
+  const field = /("packageManager"\s*:\s*")[^"]*(")/;
+  if (!field.test(current)) {
+    r.skipped.push("package.json (no packageManager to set)");
+    return;
+  }
+  writeIfChanged(
+    path,
+    current.replace(field, (_m, a: string, b: string) => `${a}bun@${want}${b}`),
+    "package.json",
+    r.written,
+  );
+}
+
 export function syncDrift(
   repoRoot: string,
   canonical: CanonicalBytes,
@@ -448,6 +472,7 @@ export function syncDrift(
 
   mkdirSync(dirname(join(repoRoot, CTL_SHELL_PATH)), { recursive: true });
   writeIfChanged(join(repoRoot, CTL_SHELL_PATH), canonical.ctlShell, CTL_SHELL_PATH, r.written);
+  syncPackageManager(repoRoot, canonical.ctlShell, r);
   syncFlake(repoRoot, flakeCanon, r);
   syncClaude(repoRoot, canonical.core, r);
   syncGitignore(repoRoot, canonical.gitignoreCore, r);

package/create-product/turnkey.ts

@@ -13,6 +13,8 @@
 // from the schema package, addComponent/stubbedLibrary with a THROWING
 // validate(), INVARIANTS + parity + byte-snapshot + studio-load wired into
 // test:unit, and an image smoke tier.
+
+import { pinnedBunVersion } from "../conventions/check-drift.ts";
 import {
   type GeneratedFile,
   PRODUCT_ZOD,
@@ -362,7 +364,8 @@ function rootPackageJson(ctx: ShapeContext): string {
         "@types/node": "^22.10.0",
         typescript: "^5.7.2",
       },
-      packageManager: "bun@1.3.13",
+      // The shell's Bun (build/ctl-shell.nix): the drift gate holds the two together.
+      packageManager: `bun@${pinnedBunVersion(ctx.canon.ctlShell)}`,
       overrides: {
         ws: "^8.20.1",
         "shell-quote": "^1.9.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.2.68",
+  "version": "0.2.70",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",
@@ -39,9 +39,9 @@
   "devDependencies": {
     "@norskvideo/ctl-oas-to-ts": "^0.1.0",
     "@norskvideo/norsk-sdk": "1.3.1-2026-10-10-c587f1cc",
-    "@norskvideo/norsk-studio": "1.30.0-2026-10-10-c2e37ae9",
-    "@norskvideo/norsk-studio-builder": "1.30.0-2026-10-10-c2e37ae9",
-    "@norskvideo/norsk-studio-built-ins": "1.30.0-2026-10-10-c2e37ae9",
+    "@norskvideo/norsk-studio": "1.30.0-2026-10-11-3deeff4c",
+    "@norskvideo/norsk-studio-builder": "1.30.0-2026-10-11-3deeff4c",
+    "@norskvideo/norsk-studio-built-ins": "1.30.0-2026-10-11-3deeff4c",
     "@playwright/test": "^1.59.0",
     "@types/bun": "latest",
     "@types/cors": "^2.8.17",