wyvrnpm 2.1.0 → 2.4.1

package/src/profile.js

@@ -163,25 +163,49 @@ function detectProfile() {
 }
 
 /**
- * Compute a stable 16-char SHA256 prefix that identifies a unique build profile.
- * Only non-null, non-wildcard fields contribute to the hash.
+ * Compute a stable 16-char SHA256 prefix identifying a unique build.
+ * Inputs:
+ *   - `profile`: the toolchain/ABI fields (os, arch, compiler, etc.).
+ *   - `options`: (optional) recipe-declared feature toggles resolved to
+ *     their effective values for this build.
+ *
+ * Backward-compat contract: when `options` is null / undefined / empty,
+ * the hash is byte-identical to what pre-F1 wyvrnpm produced. Packages
+ * without an `options` block keep their existing registry addresses.
+ * The caller therefore passes `null` (not `{}`) to mean "this recipe
+ * has no options declared" — consistent with what
+ * `resolveEffectiveOptions` returns in that case.
+ *
+ * See claude/PLAN-OPTIONS.md §3.2 for the full design.
  *
  * @param {WyvrnProfile} profile
+ * @param {Record<string, any>|null} [options]  effective options (after defaults + overrides)
  * @returns {string} 16-character lowercase hex string
  */
-function hashProfile(profile) {
+function hashProfile(profile, options = null) {
   const significant = Object.fromEntries(
     Object.entries(profile)
       .filter(([, v]) => v !== null && v !== undefined && v !== '*' && v !== '')
       .sort(([a], [b]) => a.localeCompare(b)),
   );
+
+  const payload = (options && Object.keys(options).length > 0)
+    ? { ...significant, options: sortOptionsForHashing(options) }
+    : significant;
+
   return crypto
     .createHash('sha256')
-    .update(JSON.stringify(significant))
+    .update(JSON.stringify(payload))
     .digest('hex')
     .slice(0, 16);
 }
 
+function sortOptionsForHashing(options) {
+  return Object.fromEntries(
+    Object.entries(options).sort(([a], [b]) => a.localeCompare(b)),
+  );
+}
+
 /**
  * Compute the SHA256 hash of a file or Buffer.
  *

package/src/providers/base.js

@@ -69,7 +69,20 @@ class BaseProvider {
 
   /**
    * Publish to the v2 path.
-   * Writes wyvrn.json + wyvrn.zip under profileHash, updates versions.json and latest.json.
+   * Writes wyvrn.json + wyvrn.zip under profileHash, updates versions.json and
+   * (when `updateLatest !== false`) latest.json.
+   *
+   * `updateLatest: false` is used by the `upload-built` flow (a consumer
+   * returning a source-built artefact — see PLAN-UPLOAD-BUILT.md). A consumer
+   * upload is NOT introducing a new package version, so `latest.json` must
+   * not be clobbered. For the same reason the `latest` pointer inside
+   * `versions.json` is also left alone. Defaults to `true` to preserve
+   * existing `publish` semantics.
+   *
+   * The optional `uploadedBy` field in `options` is written verbatim into
+   * the per-build `wyvrn.json` as provenance metadata. Absent by default
+   * (author publish); populated by the upload-built flow. Readers ignore
+   * the field — it is informational only.
    *
    * @param {{ manifest: string, zip: string }} files  - local file paths
    * @param {{
@@ -81,6 +94,8 @@ class BaseProvider {
    *   contentSha256: string,
    *   gitSha:        string|null,
    *   gitRepo:       string|null,
+   *   updateLatest?: boolean,       // default true; false for upload-built
+   *   uploadedBy?:   object,        // optional provenance block, written into wyvrn.json
    *   awsProfile?:   string,
    *   token?:        string,
    * }} options

package/src/providers/file.js

@@ -107,6 +107,7 @@ class FileProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies,
+      updateLatest = true, uploadedBy,
     } = options;
 
     const v2root    = this._v2Root(source, name);
@@ -130,6 +131,7 @@ class FileProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);
 
@@ -155,11 +157,14 @@ class FileProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     this._writeJson(versionsPath, versionsIdx);
 
-    // 5) v2 latest.json
-    this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    // 5) v2 latest.json — skipped for consumer uploads (upload-built) so a
+    //    historical-version rebuild cannot clobber the real "latest" pointer.
+    if (updateLatest) {
+      this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash }) {

package/src/providers/http.js

@@ -176,6 +176,7 @@ class HttpProvider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, token,
+      updateLatest = true, uploadedBy,
     } = options;
     const base   = source.replace(/\/$/, '');
     const v2root = `${base}/v2/${name}`;
@@ -199,6 +200,7 @@ class HttpProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       `${buildRoot}/wyvrn.json`,
@@ -232,7 +234,7 @@ class HttpProvider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)),
@@ -240,13 +242,15 @@ class HttpProvider extends BaseProvider {
       token,
     );
 
-    // 5) Update v2 latest.json
-    await this._putBuffer(
-      `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json',
-      token,
-    );
+    // 5) v2 latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json',
+        token,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, token }) {

package/src/providers/s3.js

@@ -178,6 +178,7 @@ class S3Provider extends BaseProvider {
     const {
       source, name, version, profileHash, buildSettings,
       contentSha256, gitSha, gitRepo, lockedDependencies, awsProfile,
+      updateLatest = true, uploadedBy,
     } = options;
     const { PutObjectCommand, GetObjectCommand } = this._loadSdk();
     const client = this._makeClient(awsProfile);
@@ -204,6 +205,7 @@ class S3Provider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(
       client, bucket, `${buildRoot}/wyvrn.json`,
@@ -232,18 +234,20 @@ class S3Provider extends BaseProvider {
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
-    versionsIdx.latest = version;
+    if (updateLatest) versionsIdx.latest = version;
     await this._putBuffer(
       client, bucket, `${v2root}/versions.json`,
       Buffer.from(JSON.stringify(versionsIdx, null, 2)), 'application/json', PutObjectCommand,
     );
 
-    // 5) latest.json
-    await this._putBuffer(
-      client, bucket, `${v2root}/latest.json`,
-      Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
-      'application/json', PutObjectCommand,
-    );
+    // 5) latest.json — skipped for consumer uploads (see FileProvider note).
+    if (updateLatest) {
+      await this._putBuffer(
+        client, bucket, `${v2root}/latest.json`,
+        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        'application/json', PutObjectCommand,
+      );
+    }
   }
 
   async v2GetMeta({ source, name, version, profileHash, awsProfile }) {

package/src/resolve.js

@@ -4,6 +4,13 @@ const fs = require('fs');
 const path = require('path');
 
 const log = require('./logger');
+const {
+  parseRange,
+  matchesRange,
+  pickHighestInRange,
+  intersectRanges,
+  rangeToString,
+} = require('./version-range');
 
 /**
  * Checks if a version string represents a linked package.
@@ -65,6 +72,33 @@ function compareVersions(a, b) {
   return 0;
 }
 
+/**
+ * Fetch every published version of `name` across the configured sources
+ * via each source's `versions.json` (v2 layout). Returns the union of
+ * version keys sorted ascending. Used by the range resolver to pick the
+ * highest version satisfying `^/~/>=` style specs.
+ *
+ * @param {string}   name
+ * @param {string[]} packageSources
+ * @param {Function} httpClient
+ * @returns {Promise<string[]>}
+ */
+async function fetchPublishedVersions(name, packageSources, httpClient) {
+  const seen = new Set();
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    try {
+      const resp = await httpClient(`${base}/v2/${name}/versions.json`);
+      if (!resp.ok) continue;
+      const idx = await resp.json();
+      for (const v of Object.keys(idx?.versions ?? {})) seen.add(v);
+    } catch {
+      // Try next source
+    }
+  }
+  return [...seen].sort(compareVersions);
+}
+
 /**
  * Resolves the "latest" tag for a package by fetching latest.json from the registry.
  *
@@ -175,13 +209,21 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * Resolves the full, flattened dependency graph starting from rootDeps.
  * When the same package is required at multiple versions the highest version wins.
  *
+ * Side-effect parameter: when `manifestsOut` is provided (a Map instance),
+ * the resolver populates it with `{name → recipe manifest}` for every
+ * fetched dependency. Callers that need recipe-declared `options` (see
+ * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
+ * Passing `null` / omitting it keeps the legacy behaviour.
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
+ * @param {Map<string, string>} [lockedVersions]
+ * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map()) {
+async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -189,13 +231,45 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const manifestCache = new Map();
 
   /**
-   * Pending work queue: each entry is { name, version }.
+   * Per-package effective range. For a package that only ever appears with
+   * exact versions, this stores `{ kind: 'exact', version }` — which still
+   * intersects cleanly with later range requests. For packages with range
+   * specs, we intersect contributors so conflicting ranges fail fast.
+   * @type {Map<string, ReturnType<typeof parseRange>>}
+   */
+  const effectiveRange = new Map();
+
+  /**
+   * Who contributed which raw spec for which package — used only for the
+   * conflict error message so the user knows whose declaration to fix.
+   * @type {Map<string, Array<{ by: string, spec: string }>>}
+   */
+  const rangeContributors = new Map();
+
+  /**
+   * Cache the published-versions list per package — one HTTP round trip
+   * per name regardless of how often it appears in the graph.
+   * @type {Map<string, string[]>}
+   */
+  const publishedCache = new Map();
+  const fetchPublished = async (name) => {
+    if (publishedCache.has(name)) return publishedCache.get(name);
+    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    publishedCache.set(name, list);
+    return list;
+  };
+
+  /**
+   * Pending work queue: each entry is { name, version, by? }.
+   * `by` is the contributor label for conflict diagnostics.
    * We process iteratively to avoid deep recursion on large dependency trees.
    */
-  const queue = Object.entries(rootDeps).map(([name, version]) => ({ name, version }));
+  const queue = Object.entries(rootDeps).map(
+    ([name, version]) => ({ name, version, by: 'wyvrn.json' }),
+  );
 
   while (queue.length > 0) {
-    let { name, version } = queue.shift();
+    let { name, version, by } = queue.shift();
 
     // Lock file always wins — use pinned version regardless of what was requested.
     if (lockedVersions.has(name)) {
@@ -214,29 +288,108 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       }
     }
 
+    // Parse the version spec. Ranges (`^`, `~`, explicit comparators) resolve
+    // to an exact version via `fetchPublishedVersions` + highest-in-range;
+    // intersected against any previously-seen range for the same package.
+    let parsedSpec;
+    try {
+      parsedSpec = parseRange(version);
+    } catch (err) {
+      log.error(`Dependency "${name}": ${err.message}`);
+      continue;
+    }
+
+    if (parsedSpec.kind === 'linked') {
+      // Linked packages bypass range resolution entirely.
+      parsedSpec = { kind: 'exact', version };
+    }
+
+    // Intersect with any previously-seen range for this package.
+    //
+    // Backward-compat nuance: when both the previous and current spec are
+    // exact but differ, we preserve the legacy "pick higher with warning"
+    // behaviour rather than erroring. Intersection-strict conflict only
+    // applies when at least one side is an actual range — ranges are
+    // opt-in new territory where a declared range that cannot be satisfied
+    // IS a bug, not a soft conflict.
+    let effective = parsedSpec;
+    const prev = effectiveRange.get(name);
+    if (prev) {
+      const bothExact = prev.kind === 'exact' && parsedSpec.kind === 'exact';
+      if (bothExact) {
+        // Legacy behaviour: keep the HIGHER of the two exact versions.
+        // The warning is emitted in the "already resolved" branch below.
+        effective = compareVersions(parsedSpec.version, prev.version) > 0
+          ? parsedSpec
+          : prev;
+      } else {
+        const combined = intersectRanges(prev, parsedSpec);
+        if (!combined) {
+          const sources = rangeContributors.get(name) ?? [];
+          const lines = sources.map((c) => `    required by ${c.by}: ${c.spec}`);
+          lines.push(`    required by ${by}: ${version}`);
+          log.error(
+            `cannot satisfy conflicting version ranges for "${name}":\n` +
+            lines.join('\n') + '\n' +
+            `  no version satisfies all ranges`,
+          );
+          continue;
+        }
+        effective = combined;
+      }
+    }
+    effectiveRange.set(name, effective);
+    if (!rangeContributors.has(name)) rangeContributors.set(name, []);
+    rangeContributors.get(name).push({ by, spec: version });
+
+    // Resolve the (possibly intersected) spec down to an exact version.
+    let exactVersion;
+    if (effective.kind === 'exact') {
+      exactVersion = effective.version;
+    } else {
+      const published = await fetchPublished(name);
+      const picked = pickHighestInRange(published, effective);
+      if (!picked) {
+        log.error(
+          `no published version of "${name}" satisfies ${rangeToString(effective)}\n` +
+          (published.length > 0
+            ? `  published versions: ${published.join(', ')}`
+            : `  no versions published on the configured sources`),
+        );
+        continue;
+      }
+      exactVersion = picked;
+      if (!prev) log.info(`Resolved "${name}@${version}" → ${exactVersion}`);
+    }
+
     if (resolved.has(name)) {
       const existing = resolved.get(name);
-      if (existing === version) {
+      if (existing === exactVersion) {
         continue;
       }
       // Locked packages never lose to a conflict.
       if (lockedVersions.has(name)) {
         continue;
       }
-      // Conflict: keep the latest version.
-      const winner = compareVersions(version, existing) > 0 ? version : existing;
-      if (winner !== existing) {
+      // After range-intersection resolution, we prefer the
+      // intersected-range's highest over a naive version bump — the
+      // intersection already enforces "both contributors agree", so
+      // trust it.
+      if (exactVersion !== existing) {
         log.warn(
-          `Version conflict for "${name}": ${existing} vs ${version} — using ${winner}`,
+          `Version conflict for "${name}": ${existing} vs ${exactVersion} — using ${exactVersion}`,
         );
-        resolved.set(name, winner);
+        resolved.set(name, exactVersion);
         // Re-fetch the winning version's manifest to pull in its transitive deps.
-        queue.push({ name, version: winner });
+        queue.push({ name, version: exactVersion, by });
       }
       continue;
     }
 
-    resolved.set(name, version);
+    resolved.set(name, exactVersion);
+    // Shadow `version` with the resolved exact for the rest of this block
+    // — linked handling, manifest fetch, etc. all expect an exact string.
+    version = exactVersion;
 
     // Handle linked packages: read local manifest instead of fetching from remote
     let manifest;
@@ -263,6 +416,10 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       continue;
     }
 
+    if (manifestsOut instanceof Map) {
+      manifestsOut.set(name, manifest);
+    }
+
     // Support both formats:
     //   PascalCase array : { Dependencies: [ { Name, Version }, ... ] }
     //   string object    : { dependencies: { name: "version", ... } }
@@ -281,7 +438,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       }));
     }
     for (const dep of deps) {
-      if (dep.version) queue.push({ name: dep.name, version: dep.version });
+      if (dep.version) queue.push({ name: dep.name, version: dep.version, by: `${name}@${version}` });
     }
   }
 
@@ -292,6 +449,7 @@ module.exports = {
   compareVersions,
   resolveLatestVersion,
   resolveDependencies,
+  fetchPublishedVersions,
   isLinkedVersion,
   getLinkedPath,
 };

package/src/toolchain/index.js

@@ -17,6 +17,73 @@ function getBundledCmakeDir() {
   return dir.replace(/\\/g, '/');
 }
 
+// Arch bit-width mapping. Kept exhaustive against `ARCH_MAP` in profile.js
+// so any arch a profile can hold has a deterministic "32"/"64" suffix.
+// Unknown arch strings fall back to an empty suffix — the consumer's
+// CMakeLists should then use another discriminator (e.g. profile hash).
+const ARCH_BIT_SUFFIX = {
+  x86_64:  '64',
+  x86:     '32',
+  armv8:   '64',
+  armv7:   '32',
+  ppc64le: '64',
+  s390x:   '64',
+  mips:    '32',
+  mipsel:  '32',
+};
+
+/**
+ * Map a profile `arch` value to the canonical "64" / "32" suffix that
+ * `WYVRN_ARCH_SUFFIX` exposes to consumer CMakeLists. Empty string for
+ * unknown arches — callers can pattern-match on that to fall back.
+ *
+ * @param {string|null|undefined} arch
+ * @returns {string}
+ */
+function archToBitSuffix(arch) {
+  if (!arch) return '';
+  return ARCH_BIT_SUFFIX[arch] ?? '';
+}
+
+// Visual Studio generator `-A <platform>` mapping. VS defaults to x64
+// when `-A` is unspecified — which silently wins against a 32-bit profile
+// and causes consumer-side `find_package()` to reject 32-bit artefacts
+// with "The version found is not compatible" (a CMake pointer-size check,
+// not a version-number check). Auto-emitting `-A` keeps VS + x86 honest.
+const ARCH_VS_PLATFORM = {
+  x86_64: 'x64',
+  x86:    'Win32',
+  armv8:  'ARM64',
+  armv7:  'ARM',
+};
+
+/**
+ * Map a profile arch to the Visual Studio generator's `-A <platform>` value.
+ * Returns null for arches that don't map to a known VS platform — callers
+ * should skip `-A` in that case and let the user pass one explicitly.
+ *
+ * @param {string|null|undefined} arch
+ * @returns {string|null}
+ */
+function archToVsPlatform(arch) {
+  if (!arch) return null;
+  return ARCH_VS_PLATFORM[arch] ?? null;
+}
+
+/**
+ * True when the generator name identifies a Visual Studio generator (e.g.
+ * "Visual Studio 17 2022"). VS generators require `-A <platform>` /
+ * `architecture` in the preset; everyone else (Ninja, Make, Xcode, …)
+ * ignores it.
+ *
+ * @param {string|null|undefined} name
+ * @returns {boolean}
+ */
+function isVisualStudioGenerator(name) {
+  if (!name) return false;
+  return /^Visual Studio \d/.test(name);
+}
+
 /**
  * Substitute `{{KEY}}` placeholders in a template string.
  *
@@ -54,6 +121,7 @@ function buildPlaceholders({ profile, profileName, profileHash, packageNames })
     PROFILE_HASH:             profileHash,
     PROFILE_OS:               profile.os ?? '',
     PROFILE_ARCH:             profile.arch ?? '',
+    PROFILE_ARCH_SUFFIX:      archToBitSuffix(profile.arch),
     PROFILE_COMPILER:         profile.compiler ?? '',
     PROFILE_COMPILER_VERSION: profile['compiler.version'] ?? '',
     PROFILE_CPPSTD:           profile['compiler.cppstd'] ?? '20',
@@ -135,7 +203,10 @@ module.exports = {
   generateToolchain,
   generateCMakePresets,
   getBundledCmakeDir,
+  archToVsPlatform,
+  isVisualStudioGenerator,
   // Exported for tests
+  archToBitSuffix,
   buildPlaceholders,
   renderTemplate,
 };