wyvrnpm 2.1.0 → 2.4.1

package/cmake/macros.cmake

@@ -25,6 +25,44 @@ macro(WYVRN_CONFIGURE_VERSION_HEADER)
     )
 endmacro()
 
+# Apply WYVRN_ARCH_SUFFIX to a target's OUTPUT_NAME so the produced artefact
+# carries an unambiguous arch marker. Opt-in — call it from your CMakeLists
+# only if you want the suffixing:
+#
+#   WYVRN_APPLY_ARCH_SUFFIX(String)                       # String64.lib / String32.lib
+#   WYVRN_APPLY_ARCH_SUFFIX(String BASE_NAME my-string)   # my-string64.lib / my-string32.lib
+#
+# BASE_NAME defaults to the target name. The target linkage name (what
+# consumers pass to target_link_libraries) is untouched — only the on-disk
+# output file changes. Safe to call for any target type; does nothing if
+# WYVRN_ARCH_SUFFIX is empty (unknown / unmapped arch).
+function(WYVRN_APPLY_ARCH_SUFFIX _wyvrn_target)
+    set(options)
+    set(oneValueArgs BASE_NAME)
+    set(multiValueArgs)
+    cmake_parse_arguments(_WYVRN_ARG "${options}" "${oneValueArgs}" "${multiValueArgs}" ${ARGN})
+
+    if(NOT TARGET ${_wyvrn_target})
+        message(FATAL_ERROR "WYVRN_APPLY_ARCH_SUFFIX: '${_wyvrn_target}' is not a target")
+    endif()
+
+    if("${WYVRN_ARCH_SUFFIX}" STREQUAL "")
+        # Unknown arch — leave the output name alone rather than stamping a
+        # misleading value. The caller can still set OUTPUT_NAME manually.
+        return()
+    endif()
+
+    if(_WYVRN_ARG_BASE_NAME)
+        set(_wyvrn_base "${_WYVRN_ARG_BASE_NAME}")
+    else()
+        set(_wyvrn_base "${_wyvrn_target}")
+    endif()
+
+    set_target_properties(${_wyvrn_target} PROPERTIES
+        OUTPUT_NAME "${_wyvrn_base}${WYVRN_ARCH_SUFFIX}"
+    )
+endfunction()
+
 function(WYVRN_INSTALL_PACKAGE_EXPORT)
     set(options)
     set(oneValueArgs
@@ -84,10 +122,23 @@ function(WYVRN_INSTALL_PACKAGE_EXPORT)
         INSTALL_DESTINATION "${WYVRN_EXPORT_INSTALL_CMAKEDIR}"
     )
 
+    # INTERFACE libraries (header-only) have no compiled binary, so the arch
+    # stamped by `write_basic_package_version_file()` by default makes CMake
+    # reject the package when the consumer's CMAKE_SIZEOF_VOID_P differs —
+    # even though the headers themselves are arch-portable. Pass
+    # ARCH_INDEPENDENT so a HeaderOnlyLib published from x86_64 is consumable
+    # from x86 (and vice versa). Binary kinds keep the arch check.
+    set(_wyvrn_version_args)
+    get_target_property(_wyvrn_target_type ${WYVRN_EXPORT_TARGET} TYPE)
+    if(_wyvrn_target_type STREQUAL "INTERFACE_LIBRARY")
+        list(APPEND _wyvrn_version_args ARCH_INDEPENDENT)
+    endif()
+
     write_basic_package_version_file(
         "${WYVRN_EXPORT_VERSION_OUTPUT}"
         VERSION "${WYVRN_EXPORT_PACKAGE_VERSION}"
         COMPATIBILITY SameMajorVersion
+        ${_wyvrn_version_args}
     )
 
     install(FILES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.1.0",
+  "version": "2.4.1",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",
@@ -20,6 +20,7 @@
     "bin/",
     "src/",
     "cmake/",
+    "claude/skills/wyvrnpm.skill",
     "README.md"
   ],
   "scripts": {

package/src/build/cache.js

@@ -51,6 +51,7 @@ const LAYOUT = Object.freeze({
   buildDir:      'build',
   installSubdir: 'install', // relative to buildDir — can be overridden by recipe.installDir
   artefactZip:   'wyvrn.zip',
+  uploadSidecar: '.uploaded-to.json',
 });
 
 /**
@@ -91,11 +92,57 @@ function hasValidArtefact(args) {
   return fs.existsSync(artefact);
 }
 
+/**
+ * Find every `.uploaded-to.json` sidecar under the build cache. Each file
+ * records the destinations that a cached artefact has been pushed to via
+ * `wyvrnpm install --build=missing --upload-built`.
+ *
+ * Used by `wyvrnpm clean --uploaded-built` and for audit tooling.
+ *
+ * @returns {Array<{ cacheDir: string, sidecarPath: string, uploads: Array<object> }>}
+ */
+function listUploadSidecars() {
+  const root = getBuildCacheRoot();
+  if (!fs.existsSync(root)) return [];
+  const out = [];
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const cacheDir    = path.join(root, entry.name);
+    const sidecarPath = path.join(cacheDir, LAYOUT.uploadSidecar);
+    if (!fs.existsSync(sidecarPath)) continue;
+    let uploads = [];
+    try {
+      const raw = JSON.parse(fs.readFileSync(sidecarPath, 'utf8'));
+      if (Array.isArray(raw?.uploads)) uploads = raw.uploads;
+    } catch { /* corrupt — surface as empty uploads */ }
+    out.push({ cacheDir, sidecarPath, uploads });
+  }
+  return out;
+}
+
+/**
+ * Remove every `.uploaded-to.json` sidecar under the build cache. Used by
+ * `wyvrnpm clean --uploaded-built`. Leaves all other cache content intact
+ * (the artefact zips, source clones, and build dirs stay put).
+ *
+ * @returns {number}  count of sidecar files removed
+ */
+function clearUploadSidecars() {
+  const entries = listUploadSidecars();
+  let removed = 0;
+  for (const { sidecarPath } of entries) {
+    try { fs.unlinkSync(sidecarPath); removed++; } catch { /* ignore */ }
+  }
+  return removed;
+}
+
 module.exports = {
   getBuildCacheRoot,
   getPackageBuildDir,
   getBuildPaths,
   clearBuildCache,
   hasValidArtefact,
+  listUploadSidecars,
+  clearUploadSidecars,
   LAYOUT,
 };

package/src/build/index.js

@@ -13,6 +13,7 @@ const { normalizeDependencies } = require('../manifest');
 const { resolveDependencies }   = require('../resolve');
 const { hashProfile, mergeProfile, sha256Of } = require('../profile');
 const { generateToolchain }     = require('../toolchain');
+const { normalizeOptionsDeclaration, resolveEffectiveOptions } = require('../options');
 const log                       = require('../logger');
 
 /**
@@ -62,6 +63,8 @@ function addFolder(zip, dir, base) {
  * @param {import('../profile').WyvrnProfile} args.profile
  * @param {string} args.profileName
  * @param {string} args.profileHash
+ * @param {Record<string, any>|null} [args.options]  Effective options for this build.
+ *                                                    Used to expand `${options.*}` in the recipe.
  * @param {string} args.gitRepo
  * @param {string} args.gitSha
  * @param {string} args.destZipPath    Where the caller expects the artefact zip.
@@ -73,13 +76,15 @@ function addFolder(zip, dir, base) {
  *                                      all four CMake configurations).
  * @param {object} [args.authOptions]
  * @returns {Promise<{
- *   found:          true,
- *   contentSha256:  string,
- *   profileHash:    string,
- *   gitSha:         string,
- *   gitRepo:        string,
- *   source:         string,       // build-cache path (for logging)
- *   resolvedFrom:   'v2-source-build',
+ *   found:             true,
+ *   contentSha256:     string,
+ *   profileHash:       string,
+ *   gitSha:            string,
+ *   gitRepo:           string,
+ *   source:            string,       // build-cache path (for logging)
+ *   resolvedFrom:      'v2-source-build',
+ *   artefactPath:      string,       // absolute path to the built zip in the cache
+ *   clonedManifestPath: string,      // absolute path to the cloned wyvrn.json (for upload-built)
  * }>}
  * @throws {Error} when the cloned manifest lacks a `build` section, when
  *                 CMake is missing, or when the compile itself fails.
@@ -88,6 +93,7 @@ async function buildFromSource(args) {
   const {
     name, version,
     profile, profileName, profileHash,
+    options = null,
     gitRepo, gitSha,
     destZipPath,
     packageSources,
@@ -120,6 +126,8 @@ async function buildFromSource(args) {
       gitRepo,
       source:       paths.root,
       resolvedFrom: 'v2-source-build',
+      artefactPath:       paths.artefact,
+      clonedManifestPath: path.join(paths.src, 'wyvrn.json'),
     };
   }
 
@@ -145,7 +153,10 @@ async function buildFromSource(args) {
       `Source-build is opt-in — the publisher must add a build recipe.`,
     );
   }
-  const recipe = normalizeRecipe(clonedManifest.build);
+  // Pass effective options into the recipe so `${options.<name>}` tokens in
+  // `build.configure` / `build.buildArgs` expand to the concrete values that
+  // produced this build's profileHash.
+  const recipe = normalizeRecipe(clonedManifest.build, options);
 
   // ── 4. Recursively resolve + download this package's OWN deps ──────────
   // Lazy-require: downloadDependencies is where we were called from, so
@@ -161,20 +172,38 @@ async function buildFromSource(args) {
   );
 
   log.info(`  resolving ${Object.keys(depsForResolution).length} transitive dep(s)`);
+  const transitiveManifests = new Map();
   const resolvedDeps = await resolveDependencies(
     depsForResolution, packageSources, platform, fetch, new Map(),
+    transitiveManifests,
   );
 
-  // Build an enriched deps map (profileHash per dep based on overrides).
+  // Build an enriched deps map. Same logic as install.js: per-dep settings
+  // + recipe-declared options resolved against what the *cloned* source
+  // manifest asks for. No CLI overrides — transitive options come solely
+  // from the source package's `dependencies.<n>.options`.
   const enrichedDeps = new Map();
   for (const [depName, depVersion] of resolvedDeps) {
-    const depOverrides    = rawPackageDeps[depName]?.settings ?? {};
+    const depOverrides     = rawPackageDeps[depName]?.settings ?? {};
     const effectiveProfile = mergeProfile(profile, depOverrides);
-    const depProfileHash   = hashProfile(effectiveProfile);
+
+    const transitiveManifest = transitiveManifests.get(depName);
+    const declaration = transitiveManifest?.options
+      ? normalizeOptionsDeclaration(transitiveManifest.options, `${depName}@${depVersion}`)
+      : null;
+    const effectiveOptions = resolveEffectiveOptions(
+      declaration,
+      rawPackageDeps[depName]?.options ?? {},
+      {},
+      `${depName}@${depVersion}`,
+    );
+
+    const depProfileHash = hashProfile(effectiveProfile, effectiveOptions);
     enrichedDeps.set(depName, {
       version:     depVersion,
       profileHash: depProfileHash,
       profile:     effectiveProfile,
+      options:     effectiveOptions,
     });
   }
 
@@ -238,6 +267,8 @@ async function buildFromSource(args) {
     gitRepo,
     source:       paths.root,
     resolvedFrom: 'v2-source-build',
+    artefactPath:       paths.artefact,
+    clonedManifestPath: manifestPath,
   };
 }
 

package/src/build/recipe.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { substituteTemplateAll } = require('../options');
+
 /**
  * The `build` section of a source-repo `wyvrn.json` tells wyvrnpm how to
  * build the package from source when `--build=missing` fires. Only
@@ -50,13 +52,23 @@ const SUPPORTED_SYSTEMS = new Set(['cmake']);
  * array of strings (fallback chain — tried in order; first available wins).
  * Both forms produce a `generators: string[]` field in the normalised recipe.
  *
+ * When `effectiveOptions` is supplied, `${options.<name>}` tokens inside
+ * `configure` and `buildArgs` are expanded using those values — bool → ON/OFF,
+ * strings verbatim. An unknown option in a template is a hard error (fail
+ * fast so the bad arg never reaches cmake). See src/options.js
+ * `substituteTemplate`. When `effectiveOptions` is null (recipe declares
+ * no options), any `${options.*}` token in the recipe also fails fast —
+ * recipes don't get to reference undeclared options.
+ *
  * @param {object|null|undefined} rawBuild
+ * @param {Record<string, any>|null} [effectiveOptions]
  * @returns {{ system: string, generators: string[], configure: string[],
  *            buildArgs: string[], installDir: string, sourceSubdir: string,
  *            requiredTools: string[] }}
- * @throws {Error} when `system` is set but not supported
+ * @throws {Error} when `system` is set but not supported, or when a
+ *                 `${options.<name>}` template references an undeclared option
  */
-function normalizeRecipe(rawBuild) {
+function normalizeRecipe(rawBuild, effectiveOptions = null) {
   const b = rawBuild ?? {};
   const system = b.system ?? DEFAULT_RECIPE.system;
   if (!SUPPORTED_SYSTEMS.has(system)) {
@@ -98,12 +110,26 @@ function normalizeRecipe(rawBuild) {
   configs = configs.filter((c) => VALID_CMAKE_CONFIGS.has(c));
   if (configs.length === 0) configs = DEFAULT_RECIPE.configs.slice();
 
+  // Expand ${options.<name>} tokens in args the recipe passes to cmake.
+  // Only `configure` and `buildArgs` are user-authored arg lists; the
+  // other fields are literals.
+  const configure = substituteTemplateAll(
+    cleanArray(b.configure),
+    effectiveOptions,
+    'build.configure',
+  );
+  const buildArgs = substituteTemplateAll(
+    cleanArray(b.buildArgs),
+    effectiveOptions,
+    'build.buildArgs',
+  );
+
   return {
     system,
     generators,
     configs,
-    configure:     cleanArray(b.configure),
-    buildArgs:     cleanArray(b.buildArgs),
+    configure,
+    buildArgs,
     installDir:    b.installDir    ?? DEFAULT_RECIPE.installDir,
     sourceSubdir:  b.sourceSubdir  ?? DEFAULT_RECIPE.sourceSubdir,
     requiredTools: cleanArray(b.requiredTools),

package/src/commands/add.js

@@ -0,0 +1,140 @@
+'use strict';
+
+const path = require('path');
+
+const { readManifest, writeManifest } = require('../manifest');
+const { resolveLatestVersion }        = require('../resolve');
+const { readConfig }                  = require('../config');
+const log                             = require('../logger');
+
+/**
+ * Parse a `<name>[@<version>]` positional into its parts.
+ *
+ * `@` inside the version (e.g. tags like `latest`) is allowed — only the
+ * first `@` is treated as the separator.
+ *
+ * @param {string} spec
+ * @returns {{ name: string, version: string | null }}
+ */
+function parseSpec(spec) {
+  const at = spec.indexOf('@');
+  if (at === -1)  return { name: spec, version: null };
+  if (at === 0)   throw new Error(`invalid package spec "${spec}" — missing name before "@"`);
+  const name    = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!version) throw new Error(`invalid package spec "${spec}" — missing version after "@"`);
+  return { name, version };
+}
+
+/**
+ * Add one or more dependencies to wyvrn.json.
+ *
+ *   wyvrnpm add <name>              → resolves latest, writes "^<latest>"
+ *   wyvrnpm add <name>@<version>    → writes "<version>" verbatim (exact or range)
+ *
+ * Existing entries are replaced. If the prior entry was an object
+ * (`{ version, settings, options }`), its settings/options are preserved —
+ * only `version` is updated.
+ *
+ * Does not run install. The user must `wyvrnpm install` afterwards.
+ *
+ * @param {object} argv
+ */
+async function add(argv) {
+  const manifestPath = path.resolve(argv.manifest);
+  const specs = (argv.packages ?? []).map(parseSpec);
+
+  if (specs.length === 0) {
+    log.error('no packages given. Usage: wyvrnpm add <name>[@<version>] [...]');
+    process.exit(1);
+  }
+
+  // Install sources — only needed when at least one spec omits @version and
+  // we have to hit `latest.json`.
+  let packageSources;
+  if (argv.source && argv.source.length > 0) {
+    packageSources = argv.source;
+  } else {
+    const config   = readConfig();
+    packageSources = config.installSources.map((s) => s.url);
+  }
+
+  const needsResolve = specs.some((s) => s.version === null);
+  if (needsResolve && packageSources.length === 0) {
+    log.error(
+      'no install sources configured — cannot look up latest versions.\n' +
+      '  Pass --source <url>, pin versions explicitly (`name@1.2.3.4`), or run:\n' +
+      '    wyvrnpm configure add-source --kind install --name ... --url ...',
+    );
+    process.exit(1);
+  }
+
+  const manifest = readManifest(manifestPath);
+
+  // Preserve whichever dependencies key the manifest already uses. If neither
+  // exists, create lowercase `dependencies` (the v2 convention).
+  const depsKey =
+    Object.prototype.hasOwnProperty.call(manifest, 'dependencies') ? 'dependencies' :
+    Object.prototype.hasOwnProperty.call(manifest, 'Dependencies') ? 'Dependencies' :
+    'dependencies';
+
+  let deps = manifest[depsKey];
+  // Legacy array form → object. Editing by name is the whole point of `add`,
+  // and round-tripping as an array would silently drop per-dep settings.
+  if (Array.isArray(deps)) {
+    const obj = {};
+    for (const d of deps) {
+      const n = d.Name ?? d.name;
+      const v = d.Version ?? d.version;
+      if (n && v) obj[n] = v;
+    }
+    deps = obj;
+  } else if (!deps || typeof deps !== 'object') {
+    deps = {};
+  }
+
+  for (const spec of specs) {
+    let versionToWrite;
+    if (spec.version) {
+      versionToWrite = spec.version;
+      log.info(`${spec.name}: writing "${versionToWrite}" (as given)`);
+    } else {
+      const latest = await resolveLatestVersion(spec.name, packageSources, argv.platform, fetch);
+      versionToWrite = `^${latest}`;
+      log.info(`${spec.name}: latest is ${latest} → writing "${versionToWrite}"`);
+    }
+
+    const prior = deps[spec.name];
+    if (prior !== undefined) {
+      const priorVer =
+        typeof prior === 'string' ? prior :
+        (prior && typeof prior === 'object') ? (prior.version ?? prior.Version ?? '(unknown)') :
+        '(unknown)';
+      log.info(`  replacing existing entry: "${priorVer}"`);
+    }
+
+    // If the prior entry was an object with settings/options, keep those —
+    // only bump the version field. Otherwise write the short-form string.
+    if (prior && typeof prior === 'object' && !Array.isArray(prior)) {
+      const updated = { ...prior };
+      if ('Version' in updated && !('version' in updated)) {
+        updated.Version = versionToWrite;
+      } else {
+        updated.version = versionToWrite;
+      }
+      deps[spec.name] = updated;
+    } else {
+      deps[spec.name] = versionToWrite;
+    }
+  }
+
+  manifest[depsKey] = deps;
+  writeManifest(manifestPath, manifest);
+
+  const n = specs.length;
+  log.success(`Updated ${manifestPath} — ${n} package${n !== 1 ? 's' : ''}.`);
+  log.info('Run `wyvrnpm install` to download.');
+}
+
+module.exports = add;
+module.exports.parseSpec = parseSpec;

package/src/commands/build.js

@@ -4,9 +4,14 @@ const fs   = require('fs');
 const path = require('path');
 const { spawn } = require('child_process');
 
-const { readConfig } = require('../config');
-const install        = require('./install');
-const log            = require('../logger');
+const { readConfig }   = require('../config');
+const { loadProfile }  = require('../profile');
+const { readManifest } = require('../manifest');
+const { normalizeRecipe, hasBuildRecipe } = require('../build/recipe');
+const { loadMsvcEnv }  = require('../build/msvc-env');
+const { archToVsPlatform, isVisualStudioGenerator } = require('../toolchain');
+const install          = require('./install');
+const log              = require('../logger');
 
 // ---------------------------------------------------------------------------
 // Pure helpers (unit-testable — no process spawning, no filesystem writes)
@@ -66,11 +71,29 @@ function resolveBinaryDir({ rootDir, presetName }) {
 
 /**
  * Args passed to `cmake` for the configure step.
- * @param {{ presetName: string }} args
+ *
+ * `generator`, when set, appends `-G <name>` after `--preset`. CMake 3.21+
+ * lets CLI args override a preset's declared fields, so this swaps the
+ * generator at configure time without touching CMakePresets.json. Note:
+ * CMake bakes the chosen generator into the cache, so switching generators
+ * for an existing build directory requires `--clean` (otherwise CMake
+ * errors with "CMAKE_GENERATOR has changed").
+ *
+ * `vsPlatform`, when set, appends `-A <platform>`. Only meaningful for
+ * Visual Studio generators — they default to x64 when unspecified, which
+ * silently produces a 64-bit build even for a 32-bit profile. The caller
+ * is responsible for deriving this from the profile arch only when the
+ * effective generator is VS (see `isVisualStudioGenerator` +
+ * `archToVsPlatform`).
+ *
+ * @param {{ presetName: string, generator?: string|null, vsPlatform?: string|null }} args
  * @returns {string[]}
  */
-function buildConfigureArgs({ presetName }) {
-  return ['--preset', presetName];
+function buildConfigureArgs({ presetName, generator = null, vsPlatform = null }) {
+  const args = ['--preset', presetName];
+  if (generator)  args.push('-G', generator);
+  if (vsPlatform) args.push('-A', vsPlatform);
+  return args;
 }
 
 /**
@@ -117,12 +140,18 @@ function buildInstallArgs({ binaryDir, config, prefix }) {
  * Run `cmake` with the given args. Inherits stdio for real-time output.
  * Rejects if the process exits non-zero or fails to spawn.
  *
+ * When `env` is provided, it replaces the ambient environment (used to
+ * activate MSVC via vcvarsall for non-VS generators on Windows).
+ *
  * @param {string[]} args
+ * @param {NodeJS.ProcessEnv|null} [env]
  * @returns {Promise<void>}
  */
-function runCmake(args) {
+function runCmake(args, env = null) {
   return new Promise((resolve, reject) => {
-    const proc = spawn('cmake', args, { stdio: 'inherit' });
+    const opts = { stdio: 'inherit' };
+    if (env) opts.env = env;
+    const proc = spawn('cmake', args, opts);
     proc.on('error', (err) => {
       reject(new Error(
         `Failed to spawn cmake: ${err.message}\n` +
@@ -192,10 +221,65 @@ async function build(argv) {
     fs.rmSync(binaryDir, { recursive: true, force: true });
   }
 
+  // ── MSVC env activation (Windows + non-VS generator) ───────────────────
+  // When the preset's generator is Ninja / Ninja Multi-Config / Make / etc.
+  // and the active profile is MSVC, we need `vcvarsall.bat` to have been
+  // sourced — otherwise cmake's compiler detection fails with "CXX compiler
+  // identification is unknown". VS generators sidestep this because MSBuild
+  // finds MSVC via its own toolset resolution.
+  //
+  // Same mechanism the source-build path already uses (src/build/msvc-env.js).
+  let cmakeEnv = null;
+  let effectiveGenerator = argv.generator ?? null;
+  let effectiveProfile   = null;
+  try {
+    const { profile: activeProfile } = loadProfile(profileName);
+    effectiveProfile = activeProfile;
+    // Which generator will the preset actually use? Read it from the
+    // project's own recipe if one exists. If not, default to null and let
+    // cmake/CMakePresets decide — in which case MSVC env activation is
+    // skipped (because VS is usually the default on Windows).
+    const manifest = readManifest(manifestPath);
+    let presetGenerator = null;
+    if (hasBuildRecipe(manifest)) {
+      try {
+        const recipe = normalizeRecipe(manifest.build, null);
+        if (recipe.generators.length > 0) [presetGenerator] = recipe.generators;
+      } catch { /* templates need options → skip env activation */ }
+    }
+    // CLI --generator wins — that is the generator CMake will actually use,
+    // so it is the one that determines whether vcvarsall must be activated.
+    if (!effectiveGenerator) effectiveGenerator = presetGenerator;
+    cmakeEnv = await loadMsvcEnv({
+      profile:          activeProfile,
+      skipForGenerator: effectiveGenerator,
+    });
+  } catch (err) {
+    log.warn(`Could not resolve MSVC env activation: ${err.message}`);
+  }
+
   // ── Configure ─────────────────────────────────────────────────────────────
-  const configureArgs = buildConfigureArgs({ presetName });
+  // Auto-emit `-A <platform>` for Visual Studio generators, mapped from the
+  // active profile's arch. VS otherwise defaults to x64 regardless of the
+  // profile, which breaks x86 builds: CMake produces 64-bit artefacts but
+  // find_package() rejects the 32-bit installed dependencies with "version
+  // not compatible" (actually a CMAKE_SIZEOF_VOID_P mismatch, not a
+  // version-number check).
+  let vsPlatform = null;
+  if (isVisualStudioGenerator(effectiveGenerator) && effectiveProfile) {
+    vsPlatform = archToVsPlatform(effectiveProfile.arch);
+    if (vsPlatform) {
+      log.info(`Visual Studio generator + arch=${effectiveProfile.arch} → passing -A ${vsPlatform}`);
+    }
+  }
+
+  const configureArgs = buildConfigureArgs({
+    presetName,
+    generator:  argv.generator,
+    vsPlatform,
+  });
   log.info(`cmake ${configureArgs.join(' ')}`);
-  await runCmake(configureArgs);
+  await runCmake(configureArgs, cmakeEnv);
 
   // ── Build ─────────────────────────────────────────────────────────────────
   const buildArgs = buildBuildArgs({
@@ -206,7 +290,7 @@ async function build(argv) {
     passthru: argv['--'] ?? [],
   });
   log.info(`cmake ${buildArgs.join(' ')}`);
-  await runCmake(buildArgs);
+  await runCmake(buildArgs, cmakeEnv);
 
   // ── Install (optional) ────────────────────────────────────────────────────
   // `--install` runs `cmake --install <binaryDir>` after the build. Prefix
@@ -219,7 +303,7 @@ async function build(argv) {
       prefix: argv.installPrefix,
     });
     log.info(`cmake ${installArgs.join(' ')}`);
-    await runCmake(installArgs);
+    await runCmake(installArgs, cmakeEnv);
   }
 
   const suffix = argv.install