@norskvideo/ctl-sdk 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-sdk",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "type": "module",
   "exports": {
     ".": {

package/product-error.d.ts

@@ -1,8 +1,12 @@
 export declare class ProductError extends Error {
     code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
-     | "ROLE_CONFLICT";
+     | "ROLE_CONFLICT"
+    /** The host's custom role names could not be read to check for a clash. */
+     | "ROLE_NAMES_UNREADABLE";
     constructor(code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
-     | "ROLE_CONFLICT", message: string);
+     | "ROLE_CONFLICT"
+    /** The host's custom role names could not be read to check for a clash. */
+     | "ROLE_NAMES_UNREADABLE", message: string);
 }

package/product-reach.d.ts

@@ -5,5 +5,7 @@ export type ProductReach = "host" | "container-address";
 export declare function parseContainerIdFromCgroup(text: string): string | null;
 export declare function detectProductReach(opts: {
     cgroup?: () => string;
+    /** Whether /.dockerenv exists; injectable so a test does not read the host it runs on. */
+    dockerenv?: () => boolean;
     env?: Record<string, string | undefined>;
 }): ProductReach;

package/product-reach.js

@@ -5,11 +5,21 @@
 // host, not to the daemon, and every registration times out at readiness. The
 // container's own bridge address on the internal port is what such a daemon
 // can dial, so a containerised daemon uses that and remembers it on the
-// registration (`reachHost`). Detection reads the daemon's own cgroup, the
-// same tell the test harness uses; NORSK_CTL_PRODUCT_REACH overrides it.
-import { readFileSync } from "node:fs";
+// registration (`reachHost`). Detection reads the daemon's own cgroup, then
+// /.dockerenv; NORSK_CTL_PRODUCT_REACH overrides both.
+//
+// The cgroup alone is not enough. Under a cgroup NAMESPACE (docker's default on
+// cgroup v2) a container sees `0::/` and no id, so it reads as a bare host from
+// inside a container. That sent funke's image-mode demo check on an arm DooD
+// runner to 127.0.0.1:<host port> on 2026-10-04, which never answers. The test
+// harness fixed the same false negative in its own resolveContainerId; this is
+// the daemon's copy of that fix. /.dockerenv is written by the docker daemon
+// into every container it creates, and answers the question asked here: is
+// THIS process containerised.
+import { existsSync, readFileSync } from "node:fs";
 const CGROUP_PATH = "/proc/self/cgroup";
 const REACH_ENV = "NORSK_CTL_PRODUCT_REACH";
+const DOCKERENV_PATH = "/.dockerenv";
 /** The 64-hex docker container id from a /proc/self/cgroup dump, or null on a
  *  bare host. Present in both cgroup v1 (`/docker/<id>`) and v2
  *  (`docker-<id>.scope`) layouts. */
@@ -23,10 +33,13 @@ export function detectProductReach(opts) {
     if (forced === "host" || forced === "container-address")
         return forced;
     const read = opts.cgroup ?? (() => readFileSync(CGROUP_PATH, "utf-8"));
+    const dockerenv = opts.dockerenv ?? (() => existsSync(DOCKERENV_PATH));
     try {
-        return parseContainerIdFromCgroup(read()) ? "container-address" : "host";
+        if (parseContainerIdFromCgroup(read()))
+            return "container-address";
     }
     catch {
-        return "host";
+        // No /proc: fall through to the marker file.
     }
+    return dockerenv() ? "container-address" : "host";
 }

package/product-service.d.ts

@@ -1,3 +1,4 @@
+import { type Result } from "@norskvideo/ctl-foundation";
 import { type ProductPlacement } from "./docker-runner.js";
 import { type LicenseStager } from "./license-registration.js";
 import type { Manifest, ProductRoleDeclaration } from "./manifest-schema.js";
@@ -159,6 +160,14 @@ export interface ProductServiceOptions {
     onRolesDeclared?: (productName: string, roles: readonly ProductRoleDeclaration[], acceptance: {
         pending: readonly RoleDefault[];
     }) => void;
+    /**
+     * Role names a product may not declare, because the host already uses them
+     * for something else: its custom roles (ADR-0014). Names are one name space
+     * on a host, so a product role spelt like a custom role would be ambiguous in
+     * every assignment naming it. Omitted means none. An error is a host that
+     * cannot say which names it uses, and refuses any product declaring roles.
+     */
+    reservedRoleNames?: () => Result<ReadonlySet<string>, string>;
     /** Told once a registration is removed, so the host can drop whatever it
      *  holds against the product (role assignments on `product/<name>`). */
     onRemoved?: (productName: string) => void;
@@ -219,6 +228,7 @@ export declare class ProductService {
     private reachHostFor;
     private readonly onRolesDeclared?;
     private readonly onRemoved?;
+    private readonly reservedRoleNames?;
     /**
      * Product roles travel bare, so a name means one thing on a host. Two
      * products may share one — a common vocabulary is the point — but not with

package/product-service.js

@@ -74,6 +74,7 @@ export class ProductService {
         this.knownCapabilities = opts.knownCapabilities ?? [];
         this.identityEnvFor = opts.identityEnvFor;
         this.onRolesDeclared = opts.onRolesDeclared;
+        this.reservedRoleNames = opts.reservedRoleNames;
         this.onRemoved = opts.onRemoved;
         this.forgetIdentity = opts.forgetIdentity;
         this.probeHeadersFor = opts.probeHeadersFor;
@@ -98,6 +99,7 @@ export class ProductService {
     }
     onRolesDeclared;
     onRemoved;
+    reservedRoleNames;
     /**
      * Product roles travel bare, so a name means one thing on a host. Two
      * products may share one — a common vocabulary is the point — but not with
@@ -106,7 +108,19 @@ export class ProductService {
      * know which two products to talk to.
      */
     refuseRoleConflicts(manifest, others) {
-        for (const role of manifest.access?.roles ?? []) {
+        const declared = manifest.access?.roles ?? [];
+        const read = declared.length === 0 ? undefined : this.reservedRoleNames?.();
+        // Fail closed: a clash nobody could see would make one name mean two roles.
+        if (read?.status === "error") {
+            return new ProductError("ROLE_NAMES_UNREADABLE", `'${manifest.name}' declares product roles, and this host's custom roles cannot be read to check they ` +
+                `do not clash: ${read.error}`);
+        }
+        const reserved = read?.status === "ok" ? read.value : new Set();
+        for (const role of declared) {
+            if (reserved.has(role.name)) {
+                return new ProductError("ROLE_CONFLICT", `product role '${role.name}' is already a custom role on this host; role names are one name space, ` +
+                    "so rename the custom role (or remove it) before registering this product");
+            }
             for (const other of others) {
                 if (other.name === manifest.name)
                     continue;