@norskvideo/ctl-sdk 0.1.49 → 0.1.51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-sdk",
-  "version": "0.1.49",
+  "version": "0.1.51",
   "type": "module",
   "exports": {
     ".": {

package/product-error.d.ts

@@ -1,8 +1,12 @@
 export declare class ProductError extends Error {
     code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
-     | "ROLE_CONFLICT";
+     | "ROLE_CONFLICT"
+    /** The host's custom role names could not be read to check for a clash. */
+     | "ROLE_NAMES_UNREADABLE";
     constructor(code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
-     | "ROLE_CONFLICT", message: string);
+     | "ROLE_CONFLICT"
+    /** The host's custom role names could not be read to check for a clash. */
+     | "ROLE_NAMES_UNREADABLE", message: string);
 }

package/product-service.d.ts

@@ -1,3 +1,4 @@
+import { type Result } from "@norskvideo/ctl-foundation";
 import { type ProductPlacement } from "./docker-runner.js";
 import { type LicenseStager } from "./license-registration.js";
 import type { Manifest, ProductRoleDeclaration } from "./manifest-schema.js";
@@ -159,9 +160,20 @@ export interface ProductServiceOptions {
     onRolesDeclared?: (productName: string, roles: readonly ProductRoleDeclaration[], acceptance: {
         pending: readonly RoleDefault[];
     }) => void;
+    /**
+     * Role names a product may not declare, because the host already uses them
+     * for something else: its custom roles (ADR-0014). Names are one name space
+     * on a host, so a product role spelt like a custom role would be ambiguous in
+     * every assignment naming it. Omitted means none. An error is a host that
+     * cannot say which names it uses, and refuses any product declaring roles.
+     */
+    reservedRoleNames?: () => Result<ReadonlySet<string>, string>;
     /** Told once a registration is removed, so the host can drop whatever it
      *  holds against the product (role assignments on `product/<name>`). */
     onRemoved?: (productName: string) => void;
+    /** Told after every add, remove and reload that succeeds: the host keeps a
+     *  view of its products elsewhere (norsk-ctl's discovery entries). */
+    onChanged?: () => void;
     /**
      * What the daemon asserts when it dials a REGISTERED product's own routes —
      * the config-screen probe and the product-template fetches (RFC 0003 D7's
@@ -219,6 +231,8 @@ export declare class ProductService {
     private reachHostFor;
     private readonly onRolesDeclared?;
     private readonly onRemoved?;
+    private readonly onChanged?;
+    private readonly reservedRoleNames?;
     /**
      * Product roles travel bare, so a name means one thing on a host. Two
      * products may share one — a common vocabulary is the point — but not with
@@ -238,6 +252,7 @@ export declare class ProductService {
      *  tracked containerId means running. Dev-mode: externally owned, so probe
      *  the dev URL — registered no longer implies running. */
     isRunning(reg: ProductRegistration): Promise<boolean>;
+    private changed;
     add(spec: ProductSpec, opts?: AddProductOpts): Promise<AddProductResult>;
     private addSerialised;
     remove(name: string): Promise<void>;

package/product-service.js

@@ -74,7 +74,9 @@ export class ProductService {
         this.knownCapabilities = opts.knownCapabilities ?? [];
         this.identityEnvFor = opts.identityEnvFor;
         this.onRolesDeclared = opts.onRolesDeclared;
+        this.reservedRoleNames = opts.reservedRoleNames;
         this.onRemoved = opts.onRemoved;
+        this.onChanged = opts.onChanged;
         this.forgetIdentity = opts.forgetIdentity;
         this.probeHeadersFor = opts.probeHeadersFor;
     }
@@ -98,6 +100,8 @@ export class ProductService {
     }
     onRolesDeclared;
     onRemoved;
+    onChanged;
+    reservedRoleNames;
     /**
      * Product roles travel bare, so a name means one thing on a host. Two
      * products may share one — a common vocabulary is the point — but not with
@@ -106,7 +110,19 @@ export class ProductService {
      * know which two products to talk to.
      */
     refuseRoleConflicts(manifest, others) {
-        for (const role of manifest.access?.roles ?? []) {
+        const declared = manifest.access?.roles ?? [];
+        const read = declared.length === 0 ? undefined : this.reservedRoleNames?.();
+        // Fail closed: a clash nobody could see would make one name mean two roles.
+        if (read?.status === "error") {
+            return new ProductError("ROLE_NAMES_UNREADABLE", `'${manifest.name}' declares product roles, and this host's custom roles cannot be read to check they ` +
+                `do not clash: ${read.error}`);
+        }
+        const reserved = read?.status === "ok" ? read.value : new Set();
+        for (const role of declared) {
+            if (reserved.has(role.name)) {
+                return new ProductError("ROLE_CONFLICT", `product role '${role.name}' is already a custom role on this host; role names are one name space, ` +
+                    "so rename the custom role (or remove it) before registering this product");
+            }
             for (const other of others) {
                 if (other.name === manifest.name)
                     continue;
@@ -151,8 +167,12 @@ export class ProductService {
             return reg.containerId !== undefined;
         return this.isDevUrlAlive(productBaseUrl(reg));
     }
+    changed(result) {
+        this.onChanged?.();
+        return result;
+    }
     async add(spec, opts = {}) {
-        return this.mutations.run(() => this.addSerialised(spec, opts));
+        return this.changed(await this.mutations.run(() => this.addSerialised(spec, opts)));
     }
     async addSerialised(spec, opts) {
         const existing = this.store.read();
@@ -359,7 +379,7 @@ export class ProductService {
         return { registration, warnings };
     }
     async remove(name) {
-        return this.mutations.run(() => this.removeSerialised(name));
+        return this.changed(await this.mutations.run(() => this.removeSerialised(name)));
     }
     async removeSerialised(name) {
         const existing = this.store.read();
@@ -386,7 +406,7 @@ export class ProductService {
      *  stood in for. Like restart, the new container id is persisted before the
      *  readiness wait so a timed-out reload leaves a tracked container. */
     async reload(name) {
-        return this.mutations.run(() => this.reloadSerialised(name));
+        return this.changed(await this.mutations.run(() => this.reloadSerialised(name)));
     }
     async reloadSerialised(name) {
         const target = this.store.read().find((p) => p.name === name);