wyvrnpm 2.1.0 → 2.4.1

package/src/commands/clean.js

@@ -3,7 +3,11 @@
 const fs = require('fs');
 const path = require('path');
 
-const { clearBuildCache, getBuildCacheRoot } = require('../build/cache');
+const {
+  clearBuildCache,
+  getBuildCacheRoot,
+  clearUploadSidecars,
+} = require('../build/cache');
 const log = require('../logger');
 
 /**
@@ -11,10 +15,17 @@ const log = require('../logger');
  * With `--build-cache`, also clears the machine-wide source-build cache
  * under `%LOCALAPPDATA%\wyvrnpm\bc\` (shared across projects).
  *
+ * `--uploaded-built` wipes just the consumer's local RECORD of what they
+ * have uploaded via `wyvrnpm install --build=missing --upload-built` (the
+ * `.uploaded-to.json` sidecars under the build cache). It does NOT touch
+ * the registry, the artefact zips, or the source clones. Privacy / local
+ * audit cleanup only.
+ *
  * @param {object}  argv
- * @param {string}  argv.root        Project root directory.
- * @param {string}  argv.manifest    Path to the manifest file (used to locate wyvrn.lock).
- * @param {boolean} [argv.buildCache] When true, also nukes the source-build cache.
+ * @param {string}  argv.root             Project root directory.
+ * @param {string}  argv.manifest         Path to the manifest file (used to locate wyvrn.lock).
+ * @param {boolean} [argv.buildCache]     When true, also nukes the source-build cache.
+ * @param {boolean} [argv.uploadedBuilt]  When true, wipes upload sidecars only.
  * @returns {Promise<void>}
  */
 async function clean(argv) {
@@ -22,20 +33,27 @@ async function clean(argv) {
   const razerDir = path.join(rootDir, 'wyvrn_internal');
   const lockPath = path.join(path.dirname(path.resolve(argv.manifest)), 'wyvrn.lock');
 
+  // --uploaded-built is a targeted cleanup mode. When passed on its own,
+  // skip the default wyvrn_internal/ + wyvrn.lock scrub so a user can
+  // "forget uploads" without also wiping their project-local install.
+  const targetedOnly = argv.uploadedBuilt && !argv.buildCache;
+
   let removedAnything = false;
 
-  if (fs.existsSync(razerDir)) {
-    fs.rmSync(razerDir, { recursive: true, force: true });
-    log.info(`Removed ${razerDir}`);
-    removedAnything = true;
-  } else {
-    log.info(`Nothing to clean at ${razerDir}`);
-  }
+  if (!targetedOnly) {
+    if (fs.existsSync(razerDir)) {
+      fs.rmSync(razerDir, { recursive: true, force: true });
+      log.info(`Removed ${razerDir}`);
+      removedAnything = true;
+    } else {
+      log.info(`Nothing to clean at ${razerDir}`);
+    }
 
-  if (fs.existsSync(lockPath)) {
-    fs.unlinkSync(lockPath);
-    log.info(`Removed ${lockPath}`);
-    removedAnything = true;
+    if (fs.existsSync(lockPath)) {
+      fs.unlinkSync(lockPath);
+      log.info(`Removed ${lockPath}`);
+      removedAnything = true;
+    }
   }
 
   if (argv.buildCache) {
@@ -46,6 +64,12 @@ async function clean(argv) {
     } else {
       log.info(`No source-build cache at ${getBuildCacheRoot()}`);
     }
+  } else if (argv.uploadedBuilt) {
+    // clearBuildCache() would have nuked the sidecars as a side-effect, so
+    // only bother with the sidecar sweep when the cache itself is surviving.
+    const removed = clearUploadSidecars();
+    log.info(`Removed ${removed} upload record${removed === 1 ? '' : 's'} from the build cache`);
+    if (removed > 0) removedAnything = true;
   }
 
   if (!removedAnything) {

package/src/commands/install-skill.js

@@ -0,0 +1,107 @@
+'use strict';
+
+const fs   = require('fs');
+const os   = require('os');
+const path = require('path');
+const AdmZip = require('adm-zip');
+
+const log = require('../logger');
+
+// ---------------------------------------------------------------------------
+// `wyvrnpm install-skill --claude`
+//
+// Copies the bundled wyvrnpm Agent Skill (claude/skills/wyvrnpm.skill) into
+// the user's Claude Code skills directory so Claude picks it up automatically.
+//
+// Works for both install shapes:
+//   - `npm i -g wyvrnpm` → skill zip ships under <pkg>/claude/skills/
+//   - `git clone` of this repo → same path, just not from node_modules
+//
+// Destination, per target:
+//   --claude  → %USERPROFILE%\.claude\skills\wyvrnpm\  (Windows)
+//               ~/.claude/skills/wyvrnpm/               (macOS / Linux)
+// ---------------------------------------------------------------------------
+
+const SKILL_NAME = 'wyvrnpm';
+
+function bundledSkillPath() {
+  // __dirname = <pkg>/src/commands; the .skill zip lives at
+  // <pkg>/claude/skills/wyvrnpm.skill.
+  return path.resolve(__dirname, '..', '..', 'claude', 'skills', `${SKILL_NAME}.skill`);
+}
+
+function claudeSkillsDir() {
+  const home = os.homedir();
+  if (!home) throw new Error('cannot resolve user home directory');
+  return path.join(home, '.claude', 'skills');
+}
+
+function rmrf(target) {
+  if (!fs.existsSync(target)) return;
+  fs.rmSync(target, { recursive: true, force: true });
+}
+
+function installForClaude({ force, dryRun }) {
+  const zipPath = bundledSkillPath();
+  if (!fs.existsSync(zipPath)) {
+    log.error(`bundled skill not found at ${zipPath}`);
+    log.error('this is a packaging bug — please file an issue');
+    process.exit(1);
+  }
+
+  const skillsDir = claudeSkillsDir();
+  const destDir   = path.join(skillsDir, SKILL_NAME);
+  const destZip   = path.join(skillsDir, `${SKILL_NAME}.skill`);
+
+  log.info(`Source      : ${zipPath}`);
+  log.info(`Destination : ${destDir}`);
+
+  if (fs.existsSync(destDir) && !force) {
+    log.warn(`${destDir} already exists`);
+    log.warn('re-run with --force to overwrite');
+    process.exit(1);
+  }
+
+  if (dryRun) {
+    log.info('(--dry-run) would remove existing skill dir and zip, then extract fresh copy');
+    return;
+  }
+
+  fs.mkdirSync(skillsDir, { recursive: true });
+  rmrf(destDir);
+  rmrf(destZip);
+
+  const zip = new AdmZip(zipPath);
+  zip.extractAllTo(skillsDir, /* overwrite */ true);
+  fs.copyFileSync(zipPath, destZip);
+
+  if (!fs.existsSync(path.join(destDir, 'SKILL.md'))) {
+    log.error(`extraction produced no SKILL.md under ${destDir}`);
+    log.error('the bundled .skill zip may be malformed');
+    process.exit(1);
+  }
+
+  log.success(`Installed ${SKILL_NAME} skill to ${destDir}`);
+  log.info('Claude Code will pick it up on next session start.');
+}
+
+async function installSkill(argv) {
+  const targets = [];
+  if (argv.claude) targets.push('claude');
+
+  if (targets.length === 0) {
+    log.error('no target specified — pass --claude');
+    log.error('(more targets may be added in future releases)');
+    process.exit(1);
+  }
+
+  for (const target of targets) {
+    if (target === 'claude') {
+      installForClaude({ force: !!argv.force, dryRun: !!argv['dry-run'] });
+    }
+  }
+}
+
+module.exports = installSkill;
+module.exports.bundledSkillPath = bundledSkillPath;
+module.exports.claudeSkillsDir  = claudeSkillsDir;

package/src/commands/install.js

@@ -9,6 +9,17 @@ const { downloadDependencies }                              = require('../downlo
 const { readConfig }                                        = require('../config');
 const { loadProfile, hashProfile, formatProfile, mergeProfile } = require('../profile');
 const { generateToolchain, generateCMakePresets }           = require('../toolchain');
+const { normalizeRecipe, hasBuildRecipe }                   = require('../build/recipe');
+const {
+  normalizeOptionsDeclaration,
+  resolveEffectiveOptions,
+  parseCliOptions,
+}                                                            = require('../options');
+const {
+  resolveUploadDestination,
+  createUploadStats,
+  formatUploadSummary,
+}                                                            = require('../upload-built');
 const log                                                    = require('../logger');
 
 /**
@@ -26,6 +37,23 @@ async function install(argv) {
   const manifestPath = path.resolve(argv.manifest);
   const rootDir      = path.resolve(argv.root);
   const buildMode    = argv.build ?? 'never';
+  const uploadBuilt  = argv.uploadBuilt === true;
+  const jsonOut      = argv.format === 'json';
+
+  // Under --format=json, stdout is reserved for the final JSON payload.
+  // All info/success lines route to stderr via the logger.
+  if (jsonOut) log.setJsonMode(true);
+
+  // --upload-built implies a build step happened. `--build=never` +
+  // `--upload-built` is a usage error — fail fast rather than silently
+  // accept something that cannot upload anything.
+  if (uploadBuilt && buildMode === 'never') {
+    log.error(
+      '--upload-built requires --build=missing (or --build=always).\n' +
+      '  Nothing will be built, so there is nothing to upload.',
+    );
+    process.exit(1);
+  }
 
   if (buildMode === 'always') {
     log.error(
@@ -95,22 +123,44 @@ async function install(argv) {
     `Installing dependencies for "${manifest.name}" (platform: ${argv.platform})`,
   );
 
+  // Manifests collected during resolution — reused below to read each dep's
+  // recipe-declared `options` block without a second HTTP round trip.
+  const depManifests = new Map();
+
   const resolvedDeps = await resolveDependencies(
     depsForResolution,
     packageSources,
     argv.platform,
     fetch,
     lockedVersions,
+    depManifests,
   );
 
+  // CLI `-o <pkg>:<name>=<value>` overrides, parsed into { pkg → {name: value} }.
+  const cliOptionsByPkg = parseCliOptions(argv.option);
+
   // ── Build per-dependency enriched map ─────────────────────────────────────
-  // Each dep gets a profileHash based on base profile + any settings overrides
-  // declared in wyvrn.json under that dependency's "settings" key.
+  // Each dep gets:
+  //   - an effective profile (base + per-dep settings overrides)
+  //   - effective options (recipe defaults + consumer overrides + CLI overrides)
+  //   - profileHash computed from both (options only hashed in when declared)
   const enrichedDeps = new Map();
   for (const [name, version] of resolvedDeps) {
-    const depOverrides    = normalizedDeps[name]?.settings ?? {};
+    const depOverrides     = normalizedDeps[name]?.settings ?? {};
     const effectiveProfile = mergeProfile(baseProfile, depOverrides);
-    const profileHash      = hashProfile(effectiveProfile);
+
+    const depManifest    = depManifests.get(name);
+    const declaration    = depManifest?.options
+      ? normalizeOptionsDeclaration(depManifest.options, `${name}@${version}`)
+      : null;
+    const effectiveOptions = resolveEffectiveOptions(
+      declaration,
+      normalizedDeps[name]?.options ?? {},
+      cliOptionsByPkg[name]         ?? {},
+      `${name}@${version}`,
+    );
+
+    const profileHash = hashProfile(effectiveProfile, effectiveOptions);
 
     if (Object.keys(depOverrides).length > 0) {
       log.info(
@@ -118,8 +168,16 @@ async function install(argv) {
         ` (${JSON.stringify(depOverrides)})`,
       );
     }
+    if (effectiveOptions) {
+      log.info(`${name}: options → ${JSON.stringify(effectiveOptions)}`);
+    }
 
-    enrichedDeps.set(name, { version, profileHash, profile: effectiveProfile });
+    enrichedDeps.set(name, {
+      version,
+      profileHash,
+      profile: effectiveProfile,
+      options: effectiveOptions,
+    });
   }
 
   const razerDir = path.join(rootDir, 'wyvrn_internal');
@@ -133,6 +191,40 @@ async function install(argv) {
     profileName,
   };
 
+  // ── Resolve upload destination up-front when --upload-built is set ──────
+  // Failing here (no publish source configured) avoids spending minutes on
+  // a source-build whose output we can't deliver.
+  if (uploadBuilt) {
+    const resolved = resolveUploadDestination(
+      {
+        uploadSource: argv.uploadSource,
+        awsProfile:   argv.awsProfile ?? firstInstallSrc?.profile,
+        token:        argv.token      ?? firstInstallSrc?.token,
+      },
+      config,
+    );
+    if (!resolved) {
+      log.error(
+        '--upload-built was passed but no upload destination could be resolved.\n' +
+        '  Pass --upload-source <url-or-name> or configure a publish source:\n' +
+        '    wyvrnpm configure add-source --kind publish --name ... --url ...',
+      );
+      process.exit(1);
+    }
+    downloadOptions.uploadBuilt  = true;
+    downloadOptions.uploadSource = resolved.uploadSource;
+    downloadOptions.uploadAuth   = resolved.uploadAuth;
+    downloadOptions.uploadStats  = createUploadStats();
+
+    if (resolved.uploadSource !== (packageSources[0] ?? '')) {
+      log.info(
+        `upload-built: install source(s) and upload source differ —\n` +
+        `  install: ${packageSources.join(', ') || '(none)'}\n` +
+        `  upload : ${resolved.uploadSource}`,
+      );
+    }
+  }
+
   const lockEntries = await downloadDependencies(
     enrichedDeps,
     packageSources,
@@ -177,11 +269,71 @@ async function install(argv) {
   const toolchainRelPath = path
     .relative(rootDir, toolchain)
     .replace(/\\/g, '/');
+
+  // Derive generator + cacheVariables from the project's own `build` recipe
+  // so `wyvrnpm build` locally honours the same knobs the source-build /
+  // publish paths use. Without this, `build.configure` is advisory metadata
+  // and CMake falls back to its default generator (VS on Windows) — which
+  // breaks publishers whose recipe disables example/test subprojects (F15).
+  let presetGenerator = null;
+  let presetCacheVariables = null;
+  let presetInstallDir = null;
+  if (hasBuildRecipe(manifest)) {
+    try {
+      // Resolve the project's own options to expand ${options.*} in its
+      // configure args. When the project declares no options, this is null
+      // and the recipe's configure / buildArgs must not contain templates
+      // (normalizeRecipe enforces that).
+      const projectDeclaration = manifest.options
+        ? normalizeOptionsDeclaration(manifest.options, manifest.name)
+        : null;
+      const projectCliOverrides = cliOptionsByPkg[manifest.name] ?? {};
+      const projectEffectiveOptions = resolveEffectiveOptions(
+        projectDeclaration, {}, projectCliOverrides, manifest.name,
+      );
+      const recipe = normalizeRecipe(manifest.build, projectEffectiveOptions);
+
+      if (recipe.generators.length > 0) {
+        // First entry in the generator fallback chain. Users whose system
+        // lacks the first pick can override via CMakeUserPresets.json
+        // (which CMake merges in automatically).
+        [presetGenerator] = recipe.generators;
+      }
+
+      // Fold -DKEY=VALUE from recipe.configure into cacheVariables. Other
+      // configure args (anything not matching `-DKEY=VALUE`) can't be
+      // expressed in a CMake preset and are silently skipped here — the
+      // source-build path still sees them verbatim.
+      const cacheVars = {};
+      for (const arg of recipe.configure) {
+        const match = arg.match(/^-D([^=]+)=(.*)$/);
+        if (match) cacheVars[match[1]] = match[2];
+      }
+      if (Object.keys(cacheVars).length > 0) presetCacheVariables = cacheVars;
+
+      // Propagate `build.installDir` so that `wyvrnpm build --install` lands
+      // under the project's build tree instead of CMake's system default
+      // (C:/Program Files on Windows, /usr/local on Unix). Same semantics as
+      // the source-build path which passes -DCMAKE_INSTALL_PREFIX explicitly.
+      presetInstallDir = recipe.installDir;
+    } catch (err) {
+      log.warn(
+        `could not derive CMake preset config from the project's build recipe: ${err.message}\n` +
+        `  the preset will be emitted without a generator or recipe cacheVariables. ` +
+        `Fix the recipe or override via CMakeUserPresets.json.`,
+      );
+    }
+  }
+
   const presetResult = generateCMakePresets({
     projectRoot:  rootDir,
     profileName,
     profileHash:  hashProfile(baseProfile),
     toolchainRelPath,
+    generator:           presetGenerator,
+    extraCacheVariables: presetCacheVariables,
+    installDir:          presetInstallDir,
+    profileArch:         baseProfile.arch ?? null,
   });
   if (presetResult.action === 'skipped') {
     log.warn(
@@ -198,6 +350,51 @@ async function install(argv) {
 
   const count = resolvedDeps.size;
   log.success(`Done — ${count} package${count !== 1 ? 's' : ''} installed.`);
+
+  // ── upload-built summary ────────────────────────────────────────────────
+  const uploadSummary = formatUploadSummary(downloadOptions.uploadStats);
+  if (uploadSummary) log.info(uploadSummary);
+
+  // ── JSON payload (--format=json) ────────────────────────────────────────
+  // All log.info/success above have gone to stderr thanks to setJsonMode.
+  // stdout gets exactly one JSON object, no trailing text.
+  if (jsonOut) {
+    const packages = [...resolvedDeps.keys()].sort().map((name) => {
+      const entry       = lockEntries?.get(name) ?? {};
+      const consumerSpec = normalizedDeps[name]?.version ?? null;
+      const resolvedVer  = entry.version ?? resolvedDeps.get(name);
+      const versionRange = (consumerSpec && consumerSpec !== resolvedVer) ? consumerSpec : null;
+      return {
+        name,
+        version:       resolvedVer,
+        versionRange,
+        profileHash:   entry.profileHash   ?? null,
+        options:       entry.options       ?? null,
+        contentSha256: entry.contentSha256 ?? null,
+        gitSha:        entry.gitSha        ?? null,
+        resolvedFrom:  entry.resolvedFrom  ?? null,
+      };
+    });
+
+    const stats = downloadOptions.uploadStats;
+    const uploadSummaryJson = stats ? {
+      uploaded: stats.uploaded.length,
+      skipped:  stats.skipped.length,
+      failed:   stats.failed.length,
+    } : null;
+
+    const payload = {
+      command:        'install',
+      wyvrnpmVersion: require('../../package.json').version,
+      profile:        baseProfile,
+      profileName,
+      profileHash:    hashProfile(baseProfile),
+      packages,
+      lockFile:       lockPath,
+      uploadSummary:  uploadSummaryJson,
+    };
+    process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+  }
 }
 
 module.exports = install;