@norskvideo/ctl-sdk 0.1.58 → 0.1.59

package/docker-runner.d.ts

@@ -58,7 +58,11 @@ export declare function dockerRun(image: string, opts?: ProductRunOpts): Promise
 /** The container's address on its first network (the default bridge for a
  *  product container), or undefined when docker cannot say. */
 export declare function dockerAddress(containerId: string): Promise<string | undefined>;
-export declare function dockerRm(containerId: string): Promise<void>;
+/** `docker rm -f`, rejecting with DOCKER_RM_FAILED unless the container is
+ *  gone afterwards. Callers drop a registration once this resolves, so a
+ *  refused rm must not read as success: the container would keep running with
+ *  nothing tracking it. Bounded so a wedged dockerd cannot hang shutdown. */
+export declare function dockerRm(containerId: string, timeoutMs?: number): Promise<void>;
 /** Best-effort rename of a running container. The product is tracked by
  *  container id, never by name, so a rename failure (e.g. a stale container
  *  already holding the name) is non-fatal — the product still works, it just

package/docker-runner.js

@@ -95,8 +95,9 @@ export async function dockerRun(image, opts = {}) {
     const hostPort = await dockerPublishedPort(containerId);
     if (hostPort === undefined) {
         // Nothing to fall back to: the port is docker's to report, and a
-        // registration without one cannot be dialled or restarted.
-        await dockerRm(containerId);
+        // registration without one cannot be dialled or restarted. The rm is
+        // best-effort so its failure cannot replace this one.
+        await dockerRm(containerId).catch(() => undefined);
         throw new ProductError("DOCKER_RUN_FAILED", `docker did not report a published host port for ${CONTAINER_INTERNAL_PORT}/tcp`);
     }
     return { containerId, hostPort };
@@ -111,9 +112,24 @@ export async function dockerAddress(containerId) {
         return undefined;
     return stdout.split(/\s+/)[0];
 }
-export async function dockerRm(containerId) {
-    const proc = Bun.spawn(["docker", "rm", "-f", containerId], { stdout: "pipe", stderr: "pipe" });
-    await proc.exited;
+const DOCKER_RM_TIMEOUT_MS = 30_000;
+/** `docker rm -f`, rejecting with DOCKER_RM_FAILED unless the container is
+ *  gone afterwards. Callers drop a registration once this resolves, so a
+ *  refused rm must not read as success: the container would keep running with
+ *  nothing tracking it. Bounded so a wedged dockerd cannot hang shutdown. */
+export async function dockerRm(containerId, timeoutMs = DOCKER_RM_TIMEOUT_MS) {
+    const proc = Bun.spawn(["docker", "rm", "-f", containerId], { stdout: "pipe", stderr: "pipe", timeout: timeoutMs });
+    const exitCode = await proc.exited;
+    const stderr = (await new Response(proc.stderr).text()).trim();
+    if (exitCode === 0)
+        return;
+    // Current docker exits 0 for a missing container under -f; older ones do not.
+    if (/no such container/i.test(stderr))
+        return;
+    if (proc.signalCode !== null) {
+        throw new ProductError("DOCKER_RM_FAILED", `docker rm ${containerId} did not finish within ${timeoutMs}ms`);
+    }
+    throw new ProductError("DOCKER_RM_FAILED", `docker rm ${containerId} failed (exit ${exitCode}): ${stderr || "no stderr"}`);
 }
 /** Best-effort rename of a running container. The product is tracked by
  *  container id, never by name, so a rename failure (e.g. a stale container

package/manifest-fetch.d.ts

@@ -1,5 +1,9 @@
 import { type Manifest } from "./manifest-schema.js";
 import type { ProductRegistration, ProductSpec } from "./product-types.js";
+/** Cap on a one-shot request to a product. Without a signal Bun waits ~360 s
+ *  on a product that accepts and never answers, all while holding the
+ *  ProductService mutex. */
+export declare const PRODUCT_FETCH_TIMEOUT_MS = 30000;
 /**
  * Fast liveness probe for a registered product. A dev-mode product is
  * externally owned, so the only way to know it's actually up is to ask it.
@@ -16,7 +20,9 @@ export declare function specBaseUrl(spec: ProductSpec, port?: number, reachHost?
 /** specBaseUrl for a registration — the one call every dial site should make,
  *  so a recorded reachHost is never forgotten. */
 export declare function productBaseUrl(reg: Pick<ProductRegistration, "spec" | "port" | "reachHost">): string;
-export declare function fetchManifest(baseUrl: string): Promise<Manifest>;
+export declare function fetchManifest(baseUrl: string, opts?: {
+    timeoutMs?: number;
+}): Promise<Manifest>;
 /** Poll a product's manifest until it answers.
  *
  *  The timeout names `baseUrl`. That is the whole point of the message: the

package/manifest-fetch.js

@@ -3,7 +3,12 @@ import { ManifestSchema } from "./manifest-schema.js";
 import { ProductError } from "./product-error.js";
 const READINESS_TIMEOUT_MS = 60_000;
 const READINESS_INTERVAL_MS = 250;
+const READINESS_ATTEMPT_TIMEOUT_MS = 5_000;
 const LIVENESS_TIMEOUT_MS = 3_000;
+/** Cap on a one-shot request to a product. Without a signal Bun waits ~360 s
+ *  on a product that accepts and never answers, all while holding the
+ *  ProductService mutex. */
+export const PRODUCT_FETCH_TIMEOUT_MS = 30_000;
 /**
  * Fast liveness probe for a registered product. A dev-mode product is
  * externally owned, so the only way to know it's actually up is to ask it.
@@ -38,10 +43,12 @@ export function specBaseUrl(spec, port, reachHost) {
 export function productBaseUrl(reg) {
     return specBaseUrl(reg.spec, reg.port, reg.reachHost);
 }
-export async function fetchManifest(baseUrl) {
+export async function fetchManifest(baseUrl, opts = {}) {
     let response;
     try {
-        response = await fetch(`${baseUrl}/manifest.json`);
+        response = await fetch(`${baseUrl}/manifest.json`, {
+            signal: AbortSignal.timeout(opts.timeoutMs ?? PRODUCT_FETCH_TIMEOUT_MS),
+        });
     }
     catch (e) {
         throw new ProductError("MANIFEST_FETCH_FAILED", `manifest fetch failed: ${String(e)}`);
@@ -70,7 +77,9 @@ export async function waitForReady(baseUrl, opts = {}) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
         try {
-            const r = await fetch(`${baseUrl}/manifest.json`);
+            // One stalled attempt must not outlive the deadline.
+            const attemptMs = Math.max(1, Math.min(READINESS_ATTEMPT_TIMEOUT_MS, deadline - Date.now()));
+            const r = await fetch(`${baseUrl}/manifest.json`, { signal: AbortSignal.timeout(attemptMs) });
             if (r.ok)
                 return;
         }
@@ -101,7 +110,7 @@ export async function probeConfigScreen(baseUrl, configScreenUrl, headers = {})
     const url = `${baseUrl}${path}`;
     let response;
     try {
-        response = await fetch(url, { redirect: "follow", headers });
+        response = await fetch(url, { redirect: "follow", headers, signal: AbortSignal.timeout(PRODUCT_FETCH_TIMEOUT_MS) });
     }
     catch (e) {
         throw new ProductError("CONFIG_SCREEN_UNREACHABLE", `configScreenUrl '${path}' at ${baseUrl} unreachable: ${String(e)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-sdk",
-  "version": "0.1.58",
+  "version": "0.1.59",
   "type": "module",
   "exports": {
     ".": {

package/product-error.d.ts

@@ -1,10 +1,10 @@
 export declare class ProductError extends Error {
-    code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
+    code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "DOCKER_RM_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
      | "ROLE_CONFLICT"
     /** The host's custom role names could not be read to check for a clash. */
      | "ROLE_NAMES_UNREADABLE";
-    constructor(code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
+    constructor(code: "DEV_URL_INVALID" | "DEV_URL_NOT_LOCALHOST" | "PORT_EXHAUSTED" | "DOCKER_PULL_FAILED" | "DOCKER_RUN_FAILED" | "DOCKER_RM_FAILED" | "READINESS_TIMEOUT" | "MANIFEST_FETCH_FAILED" | "MANIFEST_INVALID" | "CONFIG_SCREEN_UNREACHABLE" | "CONFIG_SCREEN_DEV_SERVER" | "LICENSE_INVALID" | "NAME_CONFLICT" | "NOT_FOUND" | "NOT_RESTARTABLE" | "RUNNER_TOO_OLD" | "PRODUCT_TEMPLATE_FETCH_FAILED"
     /** Two products declare one bare role name with different `defaultFor`. */
      | "ROLE_CONFLICT"
     /** The host's custom role names could not be read to check for a clash. */

package/product-service.d.ts

@@ -245,6 +245,9 @@ export declare class ProductService {
     /** The address to record for a freshly started container: its own, when
      *  this daemon cannot dial the host loopback; otherwise nothing. */
     private reachHostFor;
+    /** Remove a container on a failure path. Best-effort: the caller is already
+     *  failing for its own reason, which a refused rm must not replace. */
+    private discard;
     private readonly onRolesDeclared?;
     private readonly onRemoved?;
     private readonly onChanged?;
@@ -292,15 +295,18 @@ export declare class ProductService {
      *  left alone. Clearing the id keeps the persisted store honest: a stale id
      *  left behind would make isRunning() point at a container `--rm` reaped.
      *  Best-effort per product — a failing `docker rm` is logged, never thrown,
-     *  so one stubborn container can't block a clean shutdown. */
+     *  so one stubborn container can't block a clean shutdown. Its id is kept:
+     *  the container may still be running, and the next boot's restoreAll
+     *  removes a recorded id before relaunching. */
     stopAll(): Promise<void>;
     private stopAllSerialised;
     /** Relaunch every container-kind product recorded in the store, refreshing
      *  its containerId (model B: called once at daemon boot to re-create the
      *  control planes stopped on the previous shutdown). Dev-kind products are
      *  externally owned — skipped. Best-effort per product: one that fails to
-     *  come up is logged and left with its containerId cleared, so isRunning()
-     *  reports it down rather than pointing at a container that never started. */
+     *  come up is logged, removed, and left with its containerId cleared, so
+     *  isRunning() reports it down rather than pointing at a container that
+     *  never started. */
     restoreAll(): Promise<void>;
     private restoreAllSerialised;
     /** Stop (if still present) and relaunch a single container-kind product,

package/product-service.js

@@ -4,7 +4,7 @@ import { validateDevUrl } from "./dev-url.js";
 import { dockerAddress, dockerPull, dockerRename, dockerRm, dockerRun, isDigestRef, productContainerName, } from "./docker-runner.js";
 import { resolveLicenseFile } from "./license-registration.js";
 import { checkProductEntitlement, notV2EnvelopeMessage, parseLicenseContents } from "./license-v2.js";
-import { fetchManifest, isDevUrlAlive, probeConfigScreen, productBaseUrl, specBaseUrl, waitForReady, } from "./manifest-fetch.js";
+import { fetchManifest, isDevUrlAlive, PRODUCT_FETCH_TIMEOUT_MS, probeConfigScreen, productBaseUrl, specBaseUrl, waitForReady, } from "./manifest-fetch.js";
 import { ProductError } from "./product-error.js";
 import { detectProductReach } from "./product-reach.js";
 import { checkRequiredCapabilities } from "./runner-capabilities.js";
@@ -16,7 +16,7 @@ async function fetchProductTemplateBytes(baseUrl, url, headers = {}) {
     const full = `${baseUrl.replace(/\/$/, "")}/${url.replace(/^\//, "")}`;
     let response;
     try {
-        response = await fetch(full, { headers });
+        response = await fetch(full, { headers, signal: AbortSignal.timeout(PRODUCT_FETCH_TIMEOUT_MS) });
     }
     catch (e) {
         throw new ProductError("PRODUCT_TEMPLATE_FETCH_FAILED", `fetch ${full} threw: ${String(e)}`);
@@ -102,6 +102,15 @@ export class ProductService {
             return undefined;
         return this.containerOps.address(containerId);
     }
+    /** Remove a container on a failure path. Best-effort: the caller is already
+     *  failing for its own reason, which a refused rm must not replace. */
+    async discard(containerId) {
+        if (!containerId)
+            return;
+        await this.containerOps.remove(containerId).catch((e) => {
+            logger.warn(`Container ${containerId} left running — ${e instanceof Error ? e.message : String(e)}`);
+        });
+    }
     onRolesDeclared;
     onRemoved;
     onChanged;
@@ -202,30 +211,25 @@ export class ProductService {
             await this.containerOps.waitForReady(baseUrl);
         }
         catch (e) {
-            if (containerId)
-                await this.containerOps.remove(containerId);
+            await this.discard(containerId);
             throw e;
         }
         const manifest = await fetchManifest(baseUrl).catch(async (e) => {
-            if (containerId)
-                await this.containerOps.remove(containerId);
+            await this.discard(containerId);
             throw e;
         });
         const refusal = this.refuseUnknownCapabilities(manifest);
         if (refusal) {
-            if (containerId)
-                await this.containerOps.remove(containerId);
+            await this.discard(containerId);
             throw refusal;
         }
         if (existing.some((p) => p.name === manifest.name)) {
-            if (containerId)
-                await this.containerOps.remove(containerId);
+            await this.discard(containerId);
             throw new ProductError("NAME_CONFLICT", `product '${manifest.name}' already registered`);
         }
         const roleConflict = this.refuseRoleConflicts(manifest, existing);
         if (roleConflict) {
-            if (containerId)
-                await this.containerOps.remove(containerId);
+            await this.discard(containerId);
             throw roleConflict;
         }
         const warnings = [];
@@ -241,8 +245,7 @@ export class ProductService {
             const resolved = resolveLicenseFile(opts.license.file, this.stageLicense);
             licenseFile = resolved.file;
             if (resolved.fatal) {
-                if (containerId)
-                    await this.containerOps.remove(containerId);
+                await this.discard(containerId);
                 throw new ProductError("LICENSE_INVALID", resolved.fatal);
             }
             if (resolved.warning)
@@ -267,20 +270,17 @@ export class ProductService {
             }
             const parsed = contents !== undefined ? parseLicenseContents(contents) : undefined;
             if (parsed?.kind === "invalid-v2") {
-                if (containerId)
-                    await this.containerOps.remove(containerId);
+                await this.discard(containerId);
                 throw new ProductError("LICENSE_INVALID", parsed.reason);
             }
             if (parsed?.kind === "legacy") {
-                if (containerId)
-                    await this.containerOps.remove(containerId);
+                await this.discard(containerId);
                 throw new ProductError("LICENSE_INVALID", notV2EnvelopeMessage("V1 licenses are no longer accepted at registration"));
             }
             if (parsed?.kind === "v2") {
                 const check = checkProductEntitlement(parsed, manifest.name, spec.kind === "container" ? spec.image : undefined);
                 if (!check.ok) {
-                    if (containerId)
-                        await this.containerOps.remove(containerId);
+                    await this.discard(containerId);
                     throw new ProductError("LICENSE_INVALID", check.reason);
                 }
                 warnings.push(...check.warnings);
@@ -307,7 +307,7 @@ export class ProductService {
                     await this.containerOps.waitForReady(baseUrl);
                 }
                 catch (e) {
-                    await this.containerOps.remove(containerId);
+                    await this.discard(containerId);
                     throw e;
                 }
             }
@@ -326,8 +326,7 @@ export class ProductService {
                 await probeConfigScreen(baseUrl, manifest.ui.configScreenUrl, this.probeHeadersFor?.(manifest.name) ?? {});
             }
             catch (e) {
-                if (containerId)
-                    await this.containerOps.remove(containerId);
+                await this.discard(containerId);
                 throw e;
             }
         }
@@ -451,7 +450,8 @@ export class ProductService {
                     await this.containerOps.remove(target.containerId);
                 }
                 catch {
-                    // Already gone (crashed / --rm reaped) — nothing to stop.
+                    // A gone container already resolves, so this is docker refusing; a
+                    // product left down is worse than a stray old container.
                 }
             }
             const { containerId, hostPort } = await this.containerOps.run(target.spec.image, this.runEnvFor(name, target.spec.env, target.manifest));
@@ -517,7 +517,9 @@ export class ProductService {
      *  left alone. Clearing the id keeps the persisted store honest: a stale id
      *  left behind would make isRunning() point at a container `--rm` reaped.
      *  Best-effort per product — a failing `docker rm` is logged, never thrown,
-     *  so one stubborn container can't block a clean shutdown. */
+     *  so one stubborn container can't block a clean shutdown. Its id is kept:
+     *  the container may still be running, and the next boot's restoreAll
+     *  removes a recorded id before relaunching. */
     async stopAll() {
         return this.mutations.run(() => this.stopAllSerialised());
     }
@@ -529,11 +531,11 @@ export class ProductService {
         await Promise.all(toStop.map(async (reg) => {
             try {
                 await this.containerOps.remove(reg.containerId);
+                stopped.add(reg.name);
             }
             catch (e) {
                 logger.warn(`Product '${reg.name}': failed to stop container — ${e instanceof Error ? e.message : String(e)}`);
             }
-            stopped.add(reg.name);
         }));
         await this.store.update((products) => products.map((p) => (stopped.has(p.name) ? withContainerId(p, undefined) : p)));
     }
@@ -541,8 +543,9 @@ export class ProductService {
      *  its containerId (model B: called once at daemon boot to re-create the
      *  control planes stopped on the previous shutdown). Dev-kind products are
      *  externally owned — skipped. Best-effort per product: one that fails to
-     *  come up is logged and left with its containerId cleared, so isRunning()
-     *  reports it down rather than pointing at a container that never started. */
+     *  come up is logged, removed, and left with its containerId cleared, so
+     *  isRunning() reports it down rather than pointing at a container that
+     *  never started. */
     async restoreAll() {
         return this.mutations.run(() => this.restoreAllSerialised());
     }
@@ -557,8 +560,17 @@ export class ProductService {
                 restored.set(reg.name, undefined);
                 return;
             }
+            // A daemon that died without stopAll leaves the recorded container
+            // running; relaunching beside it would orphan it.
+            if (reg.containerId) {
+                await this.containerOps.remove(reg.containerId).catch((e) => {
+                    logger.warn(`Product '${reg.name}': previous container not removed — ${e instanceof Error ? e.message : String(e)}`);
+                });
+            }
+            let started;
             try {
                 const { containerId, hostPort } = await this.containerOps.run(reg.spec.image, this.runEnvFor(reg.name, reg.spec.env, reg.manifest));
+                started = containerId;
                 const reachHost = await this.reachHostFor(containerId);
                 await this.containerOps.waitForReady(specBaseUrl(reg.spec, hostPort, reachHost));
                 await this.containerOps.rename(containerId, productContainerName(reg.name));
@@ -568,6 +580,8 @@ export class ProductService {
             catch (e) {
                 restored.set(reg.name, undefined);
                 logger.warn(`Product '${reg.name}': failed to restore — ${e instanceof Error ? e.message : String(e)}`);
+                // Its id is cleared below, so nothing else would ever reap it.
+                await this.discard(started);
             }
         }));
         await this.store.update((products) => products.map((p) => {
@@ -604,7 +618,8 @@ export class ProductService {
                 await this.containerOps.remove(target.containerId);
             }
             catch {
-                // Already gone (crashed / --rm reaped) — nothing to stop.
+                // A gone container already resolves, so this is docker refusing; a
+                // product left down is worse than a stray old container.
             }
         }
         const { containerId, hostPort } = await this.containerOps.run(target.spec.image, this.runEnvFor(name, target.spec.env, target.manifest));