wyvrnpm 2.1.0 → 2.3.2

package/src/profile.js

@@ -163,25 +163,49 @@ function detectProfile() {
 }
 
 /**
- * Compute a stable 16-char SHA256 prefix that identifies a unique build profile.
- * Only non-null, non-wildcard fields contribute to the hash.
+ * Compute a stable 16-char SHA256 prefix identifying a unique build.
+ * Inputs:
+ *   - `profile`: the toolchain/ABI fields (os, arch, compiler, etc.).
+ *   - `options`: (optional) recipe-declared feature toggles resolved to
+ *     their effective values for this build.
+ *
+ * Backward-compat contract: when `options` is null / undefined / empty,
+ * the hash is byte-identical to what pre-F1 wyvrnpm produced. Packages
+ * without an `options` block keep their existing registry addresses.
+ * The caller therefore passes `null` (not `{}`) to mean "this recipe
+ * has no options declared" — consistent with what
+ * `resolveEffectiveOptions` returns in that case.
+ *
+ * See claude/PLAN-OPTIONS.md §3.2 for the full design.
  *
  * @param {WyvrnProfile} profile
+ * @param {Record<string, any>|null} [options]  effective options (after defaults + overrides)
  * @returns {string} 16-character lowercase hex string
  */
-function hashProfile(profile) {
+function hashProfile(profile, options = null) {
   const significant = Object.fromEntries(
     Object.entries(profile)
       .filter(([, v]) => v !== null && v !== undefined && v !== '*' && v !== '')
       .sort(([a], [b]) => a.localeCompare(b)),
   );
+
+  const payload = (options && Object.keys(options).length > 0)
+    ? { ...significant, options: sortOptionsForHashing(options) }
+    : significant;
+
   return crypto
     .createHash('sha256')
-    .update(JSON.stringify(significant))
+    .update(JSON.stringify(payload))
     .digest('hex')
     .slice(0, 16);
 }
 
+function sortOptionsForHashing(options) {
+  return Object.fromEntries(
+    Object.entries(options).sort(([a], [b]) => a.localeCompare(b)),
+  );
+}
+
 /**
  * Compute the SHA256 hash of a file or Buffer.
  *

package/src/providers/base.js

@@ -69,7 +69,20 @@ class BaseProvider {
 
   /**
    * Publish to the v2 path.
-   * Writes wyvrn.json + wyvrn.zip under profileHash, updates versions.json and latest.json.
+   * Writes wyvrn.json + wyvrn.zip under profileHash, updates versions.json and
+   * (when `updateLatest !== false`) latest.json.
+   *
+   * `updateLatest: false` is used by the `upload-built` flow (a consumer
+   * returning a source-built artefact — see PLAN-UPLOAD-BUILT.md). A consumer
+   * upload is NOT introducing a new package version, so `latest.json` must
+   * not be clobbered. For the same reason the `latest` pointer inside
+   * `versions.json` is also left alone. Defaults to `true` to preserve
+   * existing `publish` semantics.
+   *
+   * The optional `uploadedBy` field in `options` is written verbatim into
+   * the per-build `wyvrn.json` as provenance metadata. Absent by default
+   * (author publish); populated by the upload-built flow. Readers ignore
+   * the field — it is informational only.
    *
    * @param {{ manifest: string, zip: string }} files  - local file paths
    * @param {{
@@ -81,6 +94,8 @@ class BaseProvider {
    *   contentSha256: string,
    *   gitSha:        string|null,
    *   gitRepo:       string|null,
+   *   updateLatest?: boolean,       // default true; false for upload-built
+   *   uploadedBy?:   object,        // optional provenance block, written into wyvrn.json
    *   awsProfile?:   string,
    *   token?:        string,
    * }} options

package/src/providers/file.js

@@ -107,6 +107,7 @@ class FileProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies,
+      updateLatest = true, uploadedBy,
     } = options;
 
     const v2root    = this._v2Root(source, name);
@@ -130,6 +131,7 @@ class FileProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);
 
@@ -155,11 +157,14 @@ class FileProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     this._writeJson(versionsPath, versionsIdx);
 
-    // 5) v2 latest.json
-    this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    // 5) v2 latest.json — skipped for consumer uploads (upload-built) so a
+    //    historical-version rebuild cannot clobber the real "latest" pointer.
+    if (updateLatest) {
+      this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash }) {

package/src/providers/http.js

@@ -176,6 +176,7 @@ class HttpProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, token,
+      updateLatest = true, uploadedBy,
     } = options;
     const base   = source.replace(/\/$/, '');
     const v2root = `${base}/v2/${name}`;
@@ -199,6 +200,7 @@ class HttpProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       `${buildRoot}/wyvrn.json`,
@@ -232,7 +234,7 @@ class HttpProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)),
@@ -240,13 +242,15 @@ class HttpProvider extends BaseProvider {
       token,
     );
 
-    // 5) Update v2 latest.json
-    await this._putBuffer(
-      `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json',
-      token,
-    );
+    // 5) v2 latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json',
+        token,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, token }) {

package/src/providers/s3.js

@@ -178,6 +178,7 @@ class S3Provider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, awsProfile,
+      updateLatest = true, uploadedBy,
     } = options;
     const { PutObjectCommand, GetObjectCommand } = this._loadSdk();
     const client = this._makeClient(awsProfile);
@@ -204,6 +205,7 @@ class S3Provider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       client, bucket, `${buildRoot}/wyvrn.json`,
@@ -232,18 +234,20 @@ class S3Provider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       client, bucket, `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)), 'application/json', PutObjectCommand,
     );
 
-    // 5) latest.json
-    await this._putBuffer(
-      client, bucket, `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json', PutObjectCommand,
-    );
+    // 5) latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        client, bucket, `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json', PutObjectCommand,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, awsProfile }) {

package/src/resolve.js

@@ -4,6 +4,13 @@ const fs = require('fs');
 const path = require('path');
 
 const log = require('./logger');
+const {
+  parseRange,
+  matchesRange,
+  pickHighestInRange,
+  intersectRanges,
+  rangeToString,
+} = require('./version-range');
 
 /**
  * Checks if a version string represents a linked package.
@@ -65,6 +72,33 @@ function compareVersions(a, b) {
   return 0;
 }
 
+/**
+ * Fetch every published version of `name` across the configured sources
+ * via each source's `versions.json` (v2 layout). Returns the union of
+ * version keys sorted ascending. Used by the range resolver to pick the
+ * highest version satisfying `^/~/>=` style specs.
+ *
+ * @param {string}   name
+ * @param {string[]} packageSources
+ * @param {Function} httpClient
+ * @returns {Promise<string[]>}
+ */
+async function fetchPublishedVersions(name, packageSources, httpClient) {
+  const seen = new Set();
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    try {
+      const resp = await httpClient(`${base}/v2/${name}/versions.json`);
+      if (!resp.ok) continue;
+      const idx = await resp.json();
+      for (const v of Object.keys(idx?.versions ?? {})) seen.add(v);
+    } catch {
+      // Try next source
+    }
+  }
+  return [...seen].sort(compareVersions);
+}
+
 /**
  * Resolves the "latest" tag for a package by fetching latest.json from the registry.
  *
@@ -175,13 +209,21 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * Resolves the full, flattened dependency graph starting from rootDeps.
  * When the same package is required at multiple versions the highest version wins.
  *
+ * Side-effect parameter: when `manifestsOut` is provided (a Map instance),
+ * the resolver populates it with `{name → recipe manifest}` for every
+ * fetched dependency. Callers that need recipe-declared `options` (see
+ * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
+ * Passing `null` / omitting it keeps the legacy behaviour.
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
+ * @param {Map<string, string>} [lockedVersions]
+ * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map()) {
+async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -189,13 +231,45 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const manifestCache = new Map();
 
   /**
-   * Pending work queue: each entry is { name, version }.
+   * Per-package effective range. For a package that only ever appears with
+   * exact versions, this stores `{ kind: 'exact', version }` — which still
+   * intersects cleanly with later range requests. For packages with range
+   * specs, we intersect contributors so conflicting ranges fail fast.
+   * @type {Map<string, ReturnType<typeof parseRange>>}
+   */
+  const effectiveRange = new Map();
+
+  /**
+   * Who contributed which raw spec for which package — used only for the
+   * conflict error message so the user knows whose declaration to fix.
+   * @type {Map<string, Array<{ by: string, spec: string }>>}
+   */
+  const rangeContributors = new Map();
+
+  /**
+   * Cache the published-versions list per package — one HTTP round trip
+   * per name regardless of how often it appears in the graph.
+   * @type {Map<string, string[]>}
+   */
+  const publishedCache = new Map();
+  const fetchPublished = async (name) => {
+    if (publishedCache.has(name)) return publishedCache.get(name);
+    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    publishedCache.set(name, list);
+    return list;
+  };
+
+  /**
+   * Pending work queue: each entry is { name, version, by? }.
+   * `by` is the contributor label for conflict diagnostics.
    * We process iteratively to avoid deep recursion on large dependency trees.
    */
-  const queue = Object.entries(rootDeps).map(([name, version]) => ({ name, version }));
+  const queue = Object.entries(rootDeps).map(
+    ([name, version]) => ({ name, version, by: 'wyvrn.json' }),
+  );
 
   while (queue.length > 0) {
-    let { name, version } = queue.shift();
+    let { name, version, by } = queue.shift();
 
     // Lock file always wins — use pinned version regardless of what was requested.
     if (lockedVersions.has(name)) {
@@ -214,29 +288,108 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       }
     }
 
+    // Parse the version spec. Ranges (`^`, `~`, explicit comparators) resolve
+    // to an exact version via `fetchPublishedVersions` + highest-in-range;
+    // intersected against any previously-seen range for the same package.
+    let parsedSpec;
+    try {
+      parsedSpec = parseRange(version);
+    } catch (err) {
+      log.error(`Dependency "${name}": ${err.message}`);
+      continue;
+    }
+
+    if (parsedSpec.kind === 'linked') {
+      // Linked packages bypass range resolution entirely.
+      parsedSpec = { kind: 'exact', version };
+    }
+
+    // Intersect with any previously-seen range for this package.
+    //
+    // Backward-compat nuance: when both the previous and current spec are
+    // exact but differ, we preserve the legacy "pick higher with warning"
+    // behaviour rather than erroring. Intersection-strict conflict only
+    // applies when at least one side is an actual range — ranges are
+    // opt-in new territory where a declared range that cannot be satisfied
+    // IS a bug, not a soft conflict.
+    let effective = parsedSpec;
+    const prev = effectiveRange.get(name);
+    if (prev) {
+      const bothExact = prev.kind === 'exact' && parsedSpec.kind === 'exact';
+      if (bothExact) {
+        // Legacy behaviour: keep the HIGHER of the two exact versions.
+        // The warning is emitted in the "already resolved" branch below.
+        effective = compareVersions(parsedSpec.version, prev.version) > 0
+          ? parsedSpec
+          : prev;
+      } else {
+        const combined = intersectRanges(prev, parsedSpec);
+        if (!combined) {
+          const sources = rangeContributors.get(name) ?? [];
+          const lines = sources.map((c) => `    required by ${c.by}: ${c.spec}`);
+          lines.push(`    required by ${by}: ${version}`);
+          log.error(
+            `cannot satisfy conflicting version ranges for "${name}":\n` +
+            lines.join('\n') + '\n' +
+            `  no version satisfies all ranges`,
+          );
+          continue;
+        }
+        effective = combined;
+      }
+    }
+    effectiveRange.set(name, effective);
+    if (!rangeContributors.has(name)) rangeContributors.set(name, []);
+    rangeContributors.get(name).push({ by, spec: version });
+
+    // Resolve the (possibly intersected) spec down to an exact version.
+    let exactVersion;
+    if (effective.kind === 'exact') {
+      exactVersion = effective.version;
+    } else {
+      const published = await fetchPublished(name);
+      const picked = pickHighestInRange(published, effective);
+      if (!picked) {
+        log.error(
+          `no published version of "${name}" satisfies ${rangeToString(effective)}\n` +
+          (published.length > 0
+            ? `  published versions: ${published.join(', ')}`
+            : `  no versions published on the configured sources`),
+        );
+        continue;
+      }
+      exactVersion = picked;
+      if (!prev) log.info(`Resolved "${name}@${version}" → ${exactVersion}`);
+    }
+
     if (resolved.has(name)) {
       const existing = resolved.get(name);
-      if (existing === version) {
+      if (existing === exactVersion) {
         continue;
       }
       // Locked packages never lose to a conflict.
       if (lockedVersions.has(name)) {
         continue;
       }
-      // Conflict: keep the latest version.
-      const winner = compareVersions(version, existing) > 0 ? version : existing;
-      if (winner !== existing) {
+      // After range-intersection resolution, we prefer the
+      // intersected-range's highest over a naive version bump — the
+      // intersection already enforces "both contributors agree", so
+      // trust it.
+      if (exactVersion !== existing) {
         log.warn(
-          `Version conflict for "${name}": ${existing} vs ${version} — using ${winner}`,
+          `Version conflict for "${name}": ${existing} vs ${exactVersion} — using ${exactVersion}`,
         );
-        resolved.set(name, winner);
+        resolved.set(name, exactVersion);
         // Re-fetch the winning version's manifest to pull in its transitive deps.
-        queue.push({ name, version: winner });
+        queue.push({ name, version: exactVersion, by });
       }
       continue;
     }
 
-    resolved.set(name, version);
+    resolved.set(name, exactVersion);
+    // Shadow `version` with the resolved exact for the rest of this block
+    // — linked handling, manifest fetch, etc. all expect an exact string.
+    version = exactVersion;
 
     // Handle linked packages: read local manifest instead of fetching from remote
     let manifest;
@@ -263,6 +416,10 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       continue;
     }
 
+    if (manifestsOut instanceof Map) {
+      manifestsOut.set(name, manifest);
+    }
+
     // Support both formats:
     //   PascalCase array : { Dependencies: [ { Name, Version }, ... ] }
     //   string object    : { dependencies: { name: "version", ... } }
@@ -281,7 +438,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       }));
     }
     for (const dep of deps) {
-      if (dep.version) queue.push({ name: dep.name, version: dep.version });
+      if (dep.version) queue.push({ name: dep.name, version: dep.version, by: `${name}@${version}` });
     }
   }
 
@@ -292,6 +449,7 @@ module.exports = {
   compareVersions,
   resolveLatestVersion,
   resolveDependencies,
+  fetchPublishedVersions,
   isLinkedVersion,
   getLinkedPath,
 };

package/src/toolchain/presets.js

@@ -33,22 +33,64 @@ function isWyvrnGenerated(presets) {
 /**
  * Build the configure preset object for the active profile.
  *
+ * When the project has its own `build` recipe (i.e. it's a publishable
+ * library with `build.generator` / `build.configure` declared), those are
+ * propagated into the generated preset so `wyvrnpm build` locally honours
+ * the same knobs the source-build + publish paths use. Without this, a
+ * publisher's recipe is effectively advisory at install-time (F15 fix).
+ *
  * @param {object} args
  * @param {string} args.profileName
  * @param {string} args.profileHash
- * @param {string} args.toolchainRelPath   Relative from project root, CMake-style
- *                                         forward slashes.
+ * @param {string} args.toolchainRelPath       Relative from project root, CMake-style
+ *                                             forward slashes.
+ * @param {string|null} [args.generator]       Single generator name to pin on the
+ *                                             preset (e.g. "Ninja Multi-Config").
+ *                                             Null / undefined → let CMake pick.
+ * @param {Record<string,string>|null} [args.extraCacheVariables]
+ *                                             Merged into cacheVariables alongside
+ *                                             `CMAKE_TOOLCHAIN_FILE`. Usually
+ *                                             derived from the project's own
+ *                                             `build.configure` -D args.
  */
-function buildConfigurePreset({ profileName, profileHash, toolchainRelPath }) {
-  return {
+function buildConfigurePreset({
+  profileName,
+  profileHash,
+  toolchainRelPath,
+  generator = null,
+  extraCacheVariables = null,
+  installDir = null,
+}) {
+  const binaryDir = `\${sourceDir}/build/wyvrn-${profileName}`;
+  // Spread `extraCacheVariables` FIRST, then the wyvrn-owned entries. This
+  // means the recipe cannot redirect `CMAKE_TOOLCHAIN_FILE` — our dep
+  // injection is always the authoritative toolchain pointer. A malicious
+  // or sloppy recipe trying to override it is silently ignored, not
+  // quietly obeyed. Same protection applies to `CMAKE_INSTALL_PREFIX`:
+  // if a recipe declares `build.installDir`, we resolve it under the
+  // binary dir; any cacheVariables override is overwritten below.
+  const cacheVariables = {
+    ...(extraCacheVariables ?? {}),
+    CMAKE_TOOLCHAIN_FILE: `\${sourceDir}/${toolchainRelPath}`,
+  };
+  if (installDir) {
+    // `installDir` in wyvrn.json is defined as relative to the binary dir
+    // (same semantics as the source-build path, which passes
+    // -DCMAKE_INSTALL_PREFIX=<buildDir>/<installDir>). Without this, a
+    // `wyvrnpm build --install` falls back to CMake's system default —
+    // on Windows that's `C:/Program Files (x86)/<Project>`, which needs
+    // admin rights and almost always fails.
+    cacheVariables.CMAKE_INSTALL_PREFIX = `${binaryDir}/${installDir}`;
+  }
+  const preset = {
     name:         `wyvrn-${profileName}`,
     displayName:  `wyvrnpm (${profileName})`,
     description:  `Generated by wyvrnpm install — profile hash ${profileHash}`,
-    binaryDir:    `\${sourceDir}/build/wyvrn-${profileName}`,
-    cacheVariables: {
-      CMAKE_TOOLCHAIN_FILE: `\${sourceDir}/${toolchainRelPath}`,
-    },
+    binaryDir,
+    cacheVariables,
   };
+  if (generator) preset.generator = generator;
+  return preset;
 }
 
 /**
@@ -78,7 +120,14 @@ function buildBuildPresets(profileName) {
 /**
  * Build a fresh presets file from scratch (no prior content to merge).
  */
-function buildFreshPresetsFile({ profileName, profileHash, toolchainRelPath }) {
+function buildFreshPresetsFile({
+  profileName,
+  profileHash,
+  toolchainRelPath,
+  generator = null,
+  extraCacheVariables = null,
+  installDir = null,
+}) {
   return {
     version: SCHEMA_VERSION,
     vendor: {
@@ -88,8 +137,10 @@ function buildFreshPresetsFile({ profileName, profileHash, toolchainRelPath }) {
         generatedAt: new Date().toISOString(),
       },
     },
-    configurePresets: [buildConfigurePreset({ profileName, profileHash, toolchainRelPath })],
-    buildPresets:     buildBuildPresets(profileName),
+    configurePresets: [buildConfigurePreset({
+      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir,
+    })],
+    buildPresets: buildBuildPresets(profileName),
   };
 }
 
@@ -103,8 +154,17 @@ function buildFreshPresetsFile({ profileName, profileHash, toolchainRelPath }) {
  * @param {object} args  forwarded to the preset builders
  * @returns {object}
  */
-function mergeIntoExisting(existing, { profileName, profileHash, toolchainRelPath }) {
-  const newConfigure = buildConfigurePreset({ profileName, profileHash, toolchainRelPath });
+function mergeIntoExisting(existing, {
+  profileName,
+  profileHash,
+  toolchainRelPath,
+  generator = null,
+  extraCacheVariables = null,
+  installDir = null,
+}) {
+  const newConfigure = buildConfigurePreset({
+    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir,
+  });
   const newBuilds    = buildBuildPresets(profileName);
   const newConfigureNames = new Set([newConfigure.name]);
   const newBuildNames     = new Set(newBuilds.map((b) => b.name));
@@ -150,9 +210,21 @@ function mergeIntoExisting(existing, { profileName, profileHash, toolchainRelPat
  * @param {string} args.profileName
  * @param {string} args.profileHash
  * @param {string} args.toolchainRelPath  CMake-style forward slashes, relative to projectRoot.
+ * @param {string|null} [args.generator]  Propagated onto the configure preset's `generator` field.
+ * @param {Record<string,string>|null} [args.extraCacheVariables]
+ *                                        Merged into the configure preset's `cacheVariables`.
  * @returns {{ path: string|null, action: 'created'|'updated'|'skipped', isUser: boolean }}
  */
-function generateCMakePresets({ projectRoot, profileName, profileHash, toolchainRelPath }) {
+function generateCMakePresets({
+  projectRoot,
+  profileName,
+  profileHash,
+  toolchainRelPath,
+  generator = null,
+  extraCacheVariables = null,
+  installDir = null,
+}) {
+  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir };
   const candidates = [
     { filePath: path.join(projectRoot, 'CMakePresets.json'),     isUser: false },
     { filePath: path.join(projectRoot, 'CMakeUserPresets.json'), isUser: true  },
@@ -160,14 +232,14 @@ function generateCMakePresets({ projectRoot, profileName, profileHash, toolchain
 
   for (const { filePath, isUser } of candidates) {
     if (!fs.existsSync(filePath)) {
-      const content = buildFreshPresetsFile({ profileName, profileHash, toolchainRelPath });
+      const content = buildFreshPresetsFile(args);
       fs.writeFileSync(filePath, JSON.stringify(content, null, 2) + '\n', 'utf8');
       return { path: filePath, action: 'created', isUser };
     }
 
     const existing = safeReadJson(filePath);
     if (isWyvrnGenerated(existing)) {
-      const merged = mergeIntoExisting(existing, { profileName, profileHash, toolchainRelPath });
+      const merged = mergeIntoExisting(existing, args);
       fs.writeFileSync(filePath, JSON.stringify(merged, null, 2) + '\n', 'utf8');
       return { path: filePath, action: 'updated', isUser };
     }