wyvrnpm 2.0.4 → 2.3.2

package/src/providers/file.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const BaseProvider = require('./base');
+const log = require('../logger');
 
 /**
  * File system provider — handles local directories and SMB/UNC shares.
@@ -56,12 +57,12 @@ class FileProvider extends BaseProvider {
   }
 
   _copy(src, dest) {
-    console.log(`[wyvrn]   → ${dest}`);
+    log.info(`  → ${dest}`);
     fs.copyFileSync(src, dest);
   }
 
   _writeJson(filePath, data) {
-    console.log(`[wyvrn]   → ${filePath}`);
+    log.info(`  → ${filePath}`);
     fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf8');
   }
 
@@ -87,7 +88,7 @@ class FileProvider extends BaseProvider {
     this._copy(files.zip,      path.join(destDir, 'wyvrn.zip'));
 
     const latestPath = path.join(packageDir, 'latest.json');
-    console.log(`[wyvrn]   → ${latestPath}`);
+    log.info(`  → ${latestPath}`);
     fs.writeFileSync(latestPath, JSON.stringify({ version }), 'utf8');
   }
 
@@ -106,6 +107,7 @@ class FileProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies,
+      updateLatest = true, uploadedBy,
     } = options;
 
     const v2root    = this._v2Root(source, name);
@@ -129,6 +131,7 @@ class FileProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);
 
@@ -154,11 +157,14 @@ class FileProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     this._writeJson(versionsPath, versionsIdx);
 
-    // 5) v2 latest.json
-    this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    // 5) v2 latest.json — skipped for consumer uploads (upload-built) so a
+    //    historical-version rebuild cannot clobber the real "latest" pointer.
+    if (updateLatest) {
+      this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash }) {

package/src/providers/http.js

@@ -6,6 +6,7 @@ const https = require('https');
 const { pipeline } = require('stream/promises');
 const { Readable } = require('stream');
 const BaseProvider = require('./base');
+const log = require('../logger');
 
 function pinDependencies(rawDeps, lockedDeps) {
   if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
@@ -45,7 +46,7 @@ class HttpProvider extends BaseProvider {
       const parsed = new URL(url);
       const headers = { 'Content-Type': contentType, 'Content-Length': body.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
-      console.log(`[wyvrn]   → PUT ${url}`);
+      log.info(`  → PUT ${url}`);
       const req = this._lib(url).request(
         { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
         (res) => {
@@ -66,7 +67,7 @@ class HttpProvider extends BaseProvider {
       const parsed = new URL(url);
       const headers = { 'Content-Type': contentType, 'Content-Length': buffer.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
-      console.log(`[wyvrn]   → PUT ${url}`);
+      log.info(`  → PUT ${url}`);
       const req = this._lib(url).request(
         { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'PUT', headers },
         (res) => {
@@ -175,6 +176,7 @@ class HttpProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, token,
+      updateLatest = true, uploadedBy,
     } = options;
     const base   = source.replace(/\/$/, '');
     const v2root = `${base}/v2/${name}`;
@@ -198,6 +200,7 @@ class HttpProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       `${buildRoot}/wyvrn.json`,
@@ -231,7 +234,7 @@ class HttpProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)),
@@ -239,13 +242,15 @@ class HttpProvider extends BaseProvider {
       token,
     );
 
-    // 5) Update v2 latest.json
-    await this._putBuffer(
-      `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json',
-      token,
-    );
+    // 5) v2 latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json',
+        token,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, token }) {

package/src/providers/s3.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const BaseProvider = require('./base');
+const log = require('../logger');
 
 const RE_S3_URI           = /^s3:\/\//;
 const RE_S3_VIRTUAL_HOSTED = /^https?:\/\/([^.]+)\.s3[.-][^/]*\.amazonaws\.com/;
@@ -79,7 +80,7 @@ class S3Provider extends BaseProvider {
   }
 
   async _putFile(client, bucket, key, filePath, contentType, PutObjectCommand) {
-    console.log(`[wyvrn]   → s3://${bucket}/${key}`);
+    log.info(`  → s3://${bucket}/${key}`);
     await client.send(new PutObjectCommand({
       Bucket: bucket, Key: key,
       Body: fs.readFileSync(filePath),
@@ -88,7 +89,7 @@ class S3Provider extends BaseProvider {
   }
 
   async _putBuffer(client, bucket, key, content, contentType, PutObjectCommand) {
-    console.log(`[wyvrn]   → s3://${bucket}/${key}`);
+    log.info(`  → s3://${bucket}/${key}`);
     await client.send(new PutObjectCommand({
       Bucket: bucket, Key: key,
       Body: content,
@@ -177,6 +178,7 @@ class S3Provider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, awsProfile,
+      updateLatest = true, uploadedBy,
     } = options;
     const { PutObjectCommand, GetObjectCommand } = this._loadSdk();
     const client = this._makeClient(awsProfile);
@@ -203,6 +205,7 @@ class S3Provider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       client, bucket, `${buildRoot}/wyvrn.json`,
@@ -231,18 +234,20 @@ class S3Provider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       client, bucket, `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)), 'application/json', PutObjectCommand,
     );
 
-    // 5) latest.json
-    await this._putBuffer(
-      client, bucket, `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json', PutObjectCommand,
-    );
+    // 5) latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        client, bucket, `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json', PutObjectCommand,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, awsProfile }) {

package/src/resolve.js

@@ -3,6 +3,15 @@
 const fs = require('fs');
 const path = require('path');
 
+const log = require('./logger');
+const {
+  parseRange,
+  matchesRange,
+  pickHighestInRange,
+  intersectRanges,
+  rangeToString,
+} = require('./version-range');
+
 /**
  * Checks if a version string represents a linked package.
  * @param {string} version
@@ -63,6 +72,33 @@ function compareVersions(a, b) {
   return 0;
 }
 
+/**
+ * Fetch every published version of `name` across the configured sources
+ * via each source's `versions.json` (v2 layout). Returns the union of
+ * version keys sorted ascending. Used by the range resolver to pick the
+ * highest version satisfying `^/~/>=` style specs.
+ *
+ * @param {string}   name
+ * @param {string[]} packageSources
+ * @param {Function} httpClient
+ * @returns {Promise<string[]>}
+ */
+async function fetchPublishedVersions(name, packageSources, httpClient) {
+  const seen = new Set();
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    try {
+      const resp = await httpClient(`${base}/v2/${name}/versions.json`);
+      if (!resp.ok) continue;
+      const idx = await resp.json();
+      for (const v of Object.keys(idx?.versions ?? {})) seen.add(v);
+    } catch {
+      // Try next source
+    }
+  }
+  return [...seen].sort(compareVersions);
+}
+
 /**
  * Resolves the "latest" tag for a package by fetching latest.json from the registry.
  *
@@ -164,7 +200,7 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
     }
   }
 
-  console.warn(`[wyvrn] Warning: could not fetch manifest for ${name}@${version} from any source`);
+  log.warn(`could not fetch manifest for ${name}@${version} from any source`);
   cache.set(cacheKey, null);
   return null;
 }
@@ -173,13 +209,21 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * Resolves the full, flattened dependency graph starting from rootDeps.
  * When the same package is required at multiple versions the highest version wins.
  *
+ * Side-effect parameter: when `manifestsOut` is provided (a Map instance),
+ * the resolver populates it with `{name → recipe manifest}` for every
+ * fetched dependency. Callers that need recipe-declared `options` (see
+ * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
+ * Passing `null` / omitting it keeps the legacy behaviour.
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
+ * @param {Map<string, string>} [lockedVersions]
+ * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map()) {
+async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -187,13 +231,45 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const manifestCache = new Map();
 
   /**
-   * Pending work queue: each entry is { name, version }.
+   * Per-package effective range. For a package that only ever appears with
+   * exact versions, this stores `{ kind: 'exact', version }` — which still
+   * intersects cleanly with later range requests. For packages with range
+   * specs, we intersect contributors so conflicting ranges fail fast.
+   * @type {Map<string, ReturnType<typeof parseRange>>}
+   */
+  const effectiveRange = new Map();
+
+  /**
+   * Who contributed which raw spec for which package — used only for the
+   * conflict error message so the user knows whose declaration to fix.
+   * @type {Map<string, Array<{ by: string, spec: string }>>}
+   */
+  const rangeContributors = new Map();
+
+  /**
+   * Cache the published-versions list per package — one HTTP round trip
+   * per name regardless of how often it appears in the graph.
+   * @type {Map<string, string[]>}
+   */
+  const publishedCache = new Map();
+  const fetchPublished = async (name) => {
+    if (publishedCache.has(name)) return publishedCache.get(name);
+    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    publishedCache.set(name, list);
+    return list;
+  };
+
+  /**
+   * Pending work queue: each entry is { name, version, by? }.
+   * `by` is the contributor label for conflict diagnostics.
    * We process iteratively to avoid deep recursion on large dependency trees.
    */
-  const queue = Object.entries(rootDeps).map(([name, version]) => ({ name, version }));
+  const queue = Object.entries(rootDeps).map(
+    ([name, version]) => ({ name, version, by: 'wyvrn.json' }),
+  );
 
   while (queue.length > 0) {
-    let { name, version } = queue.shift();
+    let { name, version, by } = queue.shift();
 
     // Lock file always wins — use pinned version regardless of what was requested.
     if (lockedVersions.has(name)) {
@@ -205,36 +281,115 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
     if (version === 'latest') {
       try {
         version = await resolveLatestVersion(name, packageSources, platform, httpClient);
-        console.log(`[wyvrn] Resolved "${name}@latest" → ${version}`);
+        log.info(`Resolved "${name}@latest" → ${version}`);
       } catch (err) {
-        console.warn(`[wyvrn] Warning: ${err.message}`);
+        log.warn(err.message);
         continue;
       }
     }
 
+    // Parse the version spec. Ranges (`^`, `~`, explicit comparators) resolve
+    // to an exact version via `fetchPublishedVersions` + highest-in-range;
+    // intersected against any previously-seen range for the same package.
+    let parsedSpec;
+    try {
+      parsedSpec = parseRange(version);
+    } catch (err) {
+      log.error(`Dependency "${name}": ${err.message}`);
+      continue;
+    }
+
+    if (parsedSpec.kind === 'linked') {
+      // Linked packages bypass range resolution entirely.
+      parsedSpec = { kind: 'exact', version };
+    }
+
+    // Intersect with any previously-seen range for this package.
+    //
+    // Backward-compat nuance: when both the previous and current spec are
+    // exact but differ, we preserve the legacy "pick higher with warning"
+    // behaviour rather than erroring. Intersection-strict conflict only
+    // applies when at least one side is an actual range — ranges are
+    // opt-in new territory where a declared range that cannot be satisfied
+    // IS a bug, not a soft conflict.
+    let effective = parsedSpec;
+    const prev = effectiveRange.get(name);
+    if (prev) {
+      const bothExact = prev.kind === 'exact' && parsedSpec.kind === 'exact';
+      if (bothExact) {
+        // Legacy behaviour: keep the HIGHER of the two exact versions.
+        // The warning is emitted in the "already resolved" branch below.
+        effective = compareVersions(parsedSpec.version, prev.version) > 0
+          ? parsedSpec
+          : prev;
+      } else {
+        const combined = intersectRanges(prev, parsedSpec);
+        if (!combined) {
+          const sources = rangeContributors.get(name) ?? [];
+          const lines = sources.map((c) => `    required by ${c.by}: ${c.spec}`);
+          lines.push(`    required by ${by}: ${version}`);
+          log.error(
+            `cannot satisfy conflicting version ranges for "${name}":\n` +
+            lines.join('\n') + '\n' +
+            `  no version satisfies all ranges`,
+          );
+          continue;
+        }
+        effective = combined;
+      }
+    }
+    effectiveRange.set(name, effective);
+    if (!rangeContributors.has(name)) rangeContributors.set(name, []);
+    rangeContributors.get(name).push({ by, spec: version });
+
+    // Resolve the (possibly intersected) spec down to an exact version.
+    let exactVersion;
+    if (effective.kind === 'exact') {
+      exactVersion = effective.version;
+    } else {
+      const published = await fetchPublished(name);
+      const picked = pickHighestInRange(published, effective);
+      if (!picked) {
+        log.error(
+          `no published version of "${name}" satisfies ${rangeToString(effective)}\n` +
+          (published.length > 0
+            ? `  published versions: ${published.join(', ')}`
+            : `  no versions published on the configured sources`),
+        );
+        continue;
+      }
+      exactVersion = picked;
+      if (!prev) log.info(`Resolved "${name}@${version}" → ${exactVersion}`);
+    }
+
     if (resolved.has(name)) {
       const existing = resolved.get(name);
-      if (existing === version) {
+      if (existing === exactVersion) {
         continue;
       }
       // Locked packages never lose to a conflict.
       if (lockedVersions.has(name)) {
         continue;
       }
-      // Conflict: keep the latest version.
-      const winner = compareVersions(version, existing) > 0 ? version : existing;
-      if (winner !== existing) {
-        console.warn(
-          `[wyvrn] Version conflict for "${name}": ${existing} vs ${version} — using ${winner}`,
+      // After range-intersection resolution, we prefer the
+      // intersected-range's highest over a naive version bump — the
+      // intersection already enforces "both contributors agree", so
+      // trust it.
+      if (exactVersion !== existing) {
+        log.warn(
+          `Version conflict for "${name}": ${existing} vs ${exactVersion} — using ${exactVersion}`,
         );
-        resolved.set(name, winner);
+        resolved.set(name, exactVersion);
         // Re-fetch the winning version's manifest to pull in its transitive deps.
-        queue.push({ name, version: winner });
+        queue.push({ name, version: exactVersion, by });
       }
       continue;
     }
 
-    resolved.set(name, version);
+    resolved.set(name, exactVersion);
+    // Shadow `version` with the resolved exact for the rest of this block
+    // — linked handling, manifest fetch, etc. all expect an exact string.
+    version = exactVersion;
 
     // Handle linked packages: read local manifest instead of fetching from remote
     let manifest;
@@ -242,9 +397,9 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       const localPath = getLinkedPath(version);
       manifest = readLocalManifest(localPath);
       if (manifest) {
-        console.log(`[wyvrn] Linked: ${name} → ${localPath}`);
+        log.info(`Linked: ${name} → ${localPath}`);
       } else {
-        console.log(`[wyvrn] Linked: ${name} → ${localPath} (no manifest found)`);
+        log.info(`Linked: ${name} → ${localPath} (no manifest found)`);
       }
     } else {
       manifest = await fetchPackageManifest(
@@ -261,6 +416,10 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       continue;
     }
 
+    if (manifestsOut instanceof Map) {
+      manifestsOut.set(name, manifest);
+    }
+
     // Support both formats:
     //   PascalCase array : { Dependencies: [ { Name, Version }, ... ] }
     //   string object    : { dependencies: { name: "version", ... } }
@@ -279,7 +438,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       }));
     }
     for (const dep of deps) {
-      if (dep.version) queue.push({ name: dep.name, version: dep.version });
+      if (dep.version) queue.push({ name: dep.name, version: dep.version, by: `${name}@${version}` });
     }
   }
 
@@ -290,6 +449,7 @@ module.exports = {
   compareVersions,
   resolveLatestVersion,
   resolveDependencies,
+  fetchPublishedVersions,
   isLinkedVersion,
   getLinkedPath,
 };

package/src/toolchain/deps.js

@@ -0,0 +1,164 @@
+'use strict';
+
+/**
+ * Generate the contents of `wyvrn_deps.cmake`.
+ *
+ * This file is loaded via `CMAKE_PROJECT_INCLUDE` — it runs after the
+ * consumer's first `project()` call, which is when CMake variables like
+ * `CMAKE_CXX_COMPILER_ID`, `CMAKE_SIZEOF_VOID_P`, `CMAKE_SYSTEM_NAME`, and
+ * `WIN32` / `APPLE` / `UNIX` become valid. The bundled utility scripts
+ * (`variables.cmake` etc.) rely on those, so they cannot be included from
+ * the toolchain body.
+ *
+ * @param {object}   args
+ * @param {string[]} args.packageNames       Resolved dep names in topological order.
+ * @param {string}   args.profileHash        16-char profile hash (for logging).
+ * @returns {string} CMake file content.
+ */
+function generateDepsCmake({ packageNames, profileHash }) {
+  const findPackageCalls = packageNames
+    .map((name) => `    find_package(${name} CONFIG QUIET)`)
+    .join('\n');
+
+  const resolvedList = packageNames.map((n) => `    ${n}`).join('\n');
+
+  return `# Generated by wyvrnpm — do not edit.
+# Loaded after project() via CMAKE_PROJECT_INCLUDE.
+# Profile hash: ${profileHash}
+
+if(WYVRN_DEPS_INCLUDED)
+    return()
+endif()
+set(WYVRN_DEPS_INCLUDED TRUE)
+
+# List of every package resolved by \`wyvrnpm install\`, in topological order.
+set(WYVRN_RESOLVED_PACKAGES
+${resolvedList || '    # (none)'}
+)
+
+# ── Bundled wyvrnpm CMake utilities ───────────────────────────────────────────
+# Included in the order the utility scripts expect.
+include("\${WYVRNPM_CMAKE_DIR}/variables.cmake")
+include("\${WYVRNPM_CMAKE_DIR}/options.cmake")
+include("\${WYVRNPM_CMAKE_DIR}/cpp.cmake")
+include("\${WYVRNPM_CMAKE_DIR}/functions.cmake")
+include("\${WYVRNPM_CMAKE_DIR}/macros.cmake")
+
+# ── Sanity checks (warn only — do not override the consumer's environment) ───
+if(DEFINED CMAKE_CXX_COMPILER_ID AND DEFINED WYVRN_PROFILE_COMPILER)
+    set(_wyvrn_expected_compiler_id "")
+    if(WYVRN_PROFILE_COMPILER STREQUAL "msvc")
+        set(_wyvrn_expected_compiler_id "MSVC")
+    elseif(WYVRN_PROFILE_COMPILER STREQUAL "gcc")
+        set(_wyvrn_expected_compiler_id "GNU")
+    elseif(WYVRN_PROFILE_COMPILER STREQUAL "clang")
+        set(_wyvrn_expected_compiler_id "Clang")
+    elseif(WYVRN_PROFILE_COMPILER STREQUAL "apple-clang")
+        set(_wyvrn_expected_compiler_id "AppleClang")
+    endif()
+    if(_wyvrn_expected_compiler_id AND NOT CMAKE_CXX_COMPILER_ID STREQUAL _wyvrn_expected_compiler_id)
+        message(WARNING
+            "wyvrnpm profile expects compiler '\${WYVRN_PROFILE_COMPILER}' "
+            "(CMake id '\${_wyvrn_expected_compiler_id}') but the active compiler "
+            "is '\${CMAKE_CXX_COMPILER_ID}'. Installed binaries may be ABI-incompatible."
+        )
+    endif()
+endif()
+
+if(DEFINED CMAKE_SIZEOF_VOID_P AND DEFINED WYVRN_PROFILE_ARCH)
+    if(WYVRN_PROFILE_ARCH STREQUAL "x86_64" OR WYVRN_PROFILE_ARCH STREQUAL "armv8")
+        if(NOT CMAKE_SIZEOF_VOID_P EQUAL 8)
+            message(WARNING
+                "wyvrnpm profile expects 64-bit arch '\${WYVRN_PROFILE_ARCH}' "
+                "but CMake is configuring a 32-bit build (CMAKE_SIZEOF_VOID_P=\${CMAKE_SIZEOF_VOID_P})."
+            )
+        endif()
+    elseif(WYVRN_PROFILE_ARCH STREQUAL "x86")
+        if(NOT CMAKE_SIZEOF_VOID_P EQUAL 4)
+            message(WARNING
+                "wyvrnpm profile expects 32-bit arch 'x86' "
+                "but CMake is configuring a 64-bit build (CMAKE_SIZEOF_VOID_P=\${CMAKE_SIZEOF_VOID_P})."
+            )
+        endif()
+    endif()
+endif()
+
+# ── wyvrnpm_find_dependencies() ───────────────────────────────────────────────
+# One-shot helper: resolves every package that wyvrnpm installed.
+# Packages that don't ship a CMake config are silently skipped (CONFIG QUIET).
+function(wyvrnpm_find_dependencies)
+${findPackageCalls || '    # (no dependencies)'}
+
+    # Post-find aliasing: ensure every resolved package has a wyvrn::<name>
+    # target, creating an INTERFACE alias when the package exports only
+    # <name>::<name>. Skipped when wyvrn::<name> already exists.
+    foreach(_wyvrn_pkg IN LISTS WYVRN_RESOLVED_PACKAGES)
+        if(TARGET wyvrn::\${_wyvrn_pkg})
+            # Already provided by the package's own CMake config.
+        elseif(TARGET \${_wyvrn_pkg}::\${_wyvrn_pkg})
+            add_library(wyvrn::\${_wyvrn_pkg} INTERFACE IMPORTED)
+            set_target_properties(wyvrn::\${_wyvrn_pkg} PROPERTIES
+                INTERFACE_LINK_LIBRARIES \${_wyvrn_pkg}::\${_wyvrn_pkg}
+            )
+        endif()
+    endforeach()
+endfunction()
+
+# ── wyvrnpm_enable_runtime_dll_copy(target) ───────────────────────────────────
+# Adds a POST_BUILD command that copies every runtime DLL the target depends on
+# (transitively, via \$<TARGET_RUNTIME_DLLS:...>) next to the target's own
+# binary — so consumers can run the executable straight from the build dir
+# without \`PATH\` tinkering. No-op on non-Windows platforms and on non-
+# executable targets.
+#
+# Respects the per-target opt-out property WYVRN_COPY_RUNTIME_DLLS OFF.
+# Requires CMake ≥ 3.21 (for TARGET_RUNTIME_DLLS).
+function(wyvrnpm_enable_runtime_dll_copy target)
+    if(NOT WIN32)
+        return()
+    endif()
+    if(NOT TARGET \${target})
+        message(WARNING "wyvrnpm_enable_runtime_dll_copy: target '\${target}' does not exist")
+        return()
+    endif()
+    get_target_property(_wyvrn_type \${target} TYPE)
+    if(NOT _wyvrn_type STREQUAL "EXECUTABLE")
+        return()
+    endif()
+    get_target_property(_wyvrn_optout \${target} WYVRN_COPY_RUNTIME_DLLS)
+    if(_wyvrn_optout STREQUAL "OFF" OR _wyvrn_optout STREQUAL "FALSE")
+        return()
+    endif()
+    add_custom_command(TARGET \${target} POST_BUILD
+        COMMAND \${CMAKE_COMMAND} -E copy_if_different
+                "\$<TARGET_RUNTIME_DLLS:\${target}>"
+                "\$<TARGET_FILE_DIR:\${target}>"
+        COMMAND_EXPAND_LISTS
+        VERBATIM
+    )
+endfunction()
+
+# ── wyvrnpm_finalize_targets() ────────────────────────────────────────────────
+# Discovers all executable targets in the calling directory (top-level only,
+# not recursive) and wires each one up for runtime-DLL copy. Call this at the
+# end of the consumer's top-level CMakeLists.txt, AFTER all add_executable()
+# calls, so every target is visible.
+#
+# Scope: uses the BUILDSYSTEM_TARGETS directory property of the calling
+# directory. For multi-subdirectory projects where executables are added from
+# subdirectories, consumers should either:
+#   (a) call wyvrnpm_enable_runtime_dll_copy(<tgt>) explicitly for each exe, or
+#   (b) call wyvrnpm_finalize_targets() from each subdirectory.
+function(wyvrnpm_finalize_targets)
+    get_property(_wyvrn_targets DIRECTORY PROPERTY BUILDSYSTEM_TARGETS)
+    foreach(_wyvrn_t IN LISTS _wyvrn_targets)
+        get_target_property(_wyvrn_type \${_wyvrn_t} TYPE)
+        if(_wyvrn_type STREQUAL "EXECUTABLE")
+            wyvrnpm_enable_runtime_dll_copy(\${_wyvrn_t})
+        endif()
+    endforeach()
+endfunction()
+`;
+}
+
+module.exports = { generateDepsCmake };