wyvrnpm 2.10.2 → 2.12.2

package/src/build/index.js

@@ -1,297 +1,299 @@
-'use strict';
-
-const fs   = require('fs');
-const path = require('path');
-const AdmZip = require('adm-zip');
-
-const { cloneAtSha }           = require('./clone');
-const { normalizeRecipe, hasBuildRecipe } = require('./recipe');
-const { configureBuildInstall } = require('./cmake');
-const { getBuildPaths, hasValidArtefact } = require('./cache');
-
-const { normalizeDependencies } = require('../manifest');
-const { resolveDependencies }   = require('../resolve');
-const { hashProfile, mergeProfile, sha256Of } = require('../profile');
-const { generateToolchain }     = require('../toolchain');
-const { normalizeOptionsDeclaration, resolveEffectiveOptions } = require('../options');
-const { readRecipeConf, cmakeCacheVariables } = require('../conf');
-const { wyvrnFetch }            = require('../http-fetch');
-const log                       = require('../logger');
-
-/**
- * Recursively walk a directory and add every file into an AdmZip at
- * paths relative to `base`. Matches the structure emitted by `publish` —
- * zip contents are the DIRECT SUBTREE of `base`, not `base` itself.
- */
-function addFolder(zip, dir, base) {
-  for (const entry of fs.readdirSync(dir)) {
-    const full = path.join(dir, entry);
-    const rel  = path.relative(base, full).replace(/\\/g, '/');
-    const stat = fs.statSync(full);
-    if (stat.isDirectory()) {
-      addFolder(zip, full, base);
-    } else {
-      const zipDir = path.dirname(rel);
-      zip.addLocalFile(full, zipDir === '.' ? '' : zipDir);
-    }
-  }
-}
-
-/**
- * Build a package from source and produce an artefact zip indistinguishable
- * from a pre-built download.
- *
- * ───────────────────────────────────────────────────────────────────────────
- * Flow (PLAN-BUILD-MISSING phase 3):
- *   1. Check the build cache for a ready artefact → copy and return.
- *   2. Shallow-clone `{gitRepo}` at `{gitSha}` into the cache.
- *   3. Read the cloned `wyvrn.json`; require a `build` section.
- *   4. Recursively resolve + download the package's OWN dependencies into a
- *      scratch `wyvrn_internal/` co-located with the source. Source-build
- *      propagates via `buildMode: "missing"`, so transitive source-only deps
- *      Just Work.
- *   5. Generate the CMake toolchain via `generateToolchain()` — the shared
- *      entry point documented in PLAN-CMAKE-TOOLCHAIN Phase F. Never hand-
- *      roll profile→flag translation here.
- *   6. Configure + build + install via `configureBuildInstall()`.
- *   7. Zip the install dir → `wyvrn.zip`, compute `contentSha256`.
- *   8. Copy the zip to `destZipPath` so `downloadDependencies` can extract
- *      it like any other v2 artefact.
- * ───────────────────────────────────────────────────────────────────────────
- *
- * @param {object} args
- * @param {string} args.name
- * @param {string} args.version
- * @param {import('../profile').WyvrnProfile} args.profile
- * @param {string} args.profileName
- * @param {string} args.profileHash
- * @param {Record<string, any>|null} [args.options]  Effective options for this build.
- *                                                    Used to expand `${options.*}` in the recipe.
- * @param {string} args.gitRepo
- * @param {string} args.gitSha
- * @param {string} args.destZipPath    Where the caller expects the artefact zip.
- * @param {string[]} args.packageSources  Used to resolve this package's own deps.
- * @param {string} args.platform       v1 fallback platform for transitive deps.
- * @param {number} args.timeoutMs
- * @param {string} [args.buildMode]    Propagated into transitive downloads. Default 'missing'.
- * @param {string[]} [args.configs]    Override recipe.configs (which defaults to
- *                                      all four CMake configurations).
- * @param {object} [args.authOptions]
- * @returns {Promise<{
- *   found:             true,
- *   contentSha256:     string,
- *   profileHash:       string,
- *   gitSha:            string,
- *   gitRepo:           string,
- *   source:            string,       // build-cache path (for logging)
- *   resolvedFrom:      'v2-source-build',
- *   artefactPath:      string,       // absolute path to the built zip in the cache
- *   clonedManifestPath: string,      // absolute path to the cloned wyvrn.json (for upload-built)
- * }>}
- * @throws {Error} when the cloned manifest lacks a `build` section, when
- *                 CMake is missing, or when the compile itself fails.
- */
-async function buildFromSource(args) {
-  const {
-    name, version,
-    profile, profileName, profileHash,
-    options = null,
-    gitRepo, gitSha,
-    destZipPath,
-    packageSources,
-    platform,
-    timeoutMs,
-    buildMode = 'missing',
-    configs,
-    authOptions = {},
-  } = args;
-
-  if (!gitRepo || !gitSha) {
-    throw new Error(
-      `Cannot source-build ${name}@${version}: the registry has no git metadata ` +
-      `(gitRepo/gitSha) for this version. Publisher must re-publish with git info.`,
-    );
-  }
-
-  const paths = getBuildPaths({ name, version, profileHash });
-
-  // ── 1. Cache hit? Short-circuit to copy and return ──────────────────────
-  if (hasValidArtefact({ name, version, profileHash })) {
-    log.info(`  source-build cache hit: ${paths.artefact}`);
-    fs.copyFileSync(paths.artefact, destZipPath);
-    const contentSha256 = sha256Of(paths.artefact);
-    return {
-      found:        true,
-      contentSha256,
-      profileHash,
-      gitSha,
-      gitRepo,
-      source:       paths.root,
-      resolvedFrom: 'v2-source-build',
-      artefactPath:       paths.artefact,
-      clonedManifestPath: path.join(paths.src, 'wyvrn.json'),
-    };
-  }
-
-  log.info(`  source-build starting: ${name}@${version} [${profileHash}]`);
-  log.info(`  cache dir: ${paths.root}`);
-
-  // ── 2. Clone source ─────────────────────────────────────────────────────
-  fs.mkdirSync(paths.root, { recursive: true });
-  await cloneAtSha({ gitRepo, gitSha, destDir: paths.src });
-
-  // ── 3. Read cloned manifest + recipe ────────────────────────────────────
-  const manifestPath = path.join(paths.src, 'wyvrn.json');
-  if (!fs.existsSync(manifestPath)) {
-    throw new Error(
-      `Cloned source does not contain wyvrn.json at ${manifestPath}. ` +
-      `${name}@${version} cannot be source-built.`,
-    );
-  }
-  const clonedManifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-  if (!hasBuildRecipe(clonedManifest)) {
-    throw new Error(
-      `${name}@${version} has no "build" section in its wyvrn.json at ${gitSha.slice(0, 12)}. ` +
-      `Source-build is opt-in — the publisher must add a build recipe.`,
-    );
-  }
-  // Pass effective options into the recipe so `${options.<name>}` tokens in
-  // `build.configure` / `build.buildArgs` expand to the concrete values that
-  // produced this build's profileHash. Pass the cloned manifest so PLAN-CONF.md
-  // §4.7 collision detection catches a publisher who declared the same KEY in
-  // both build.configure and conf.cmake.cache.
-  const recipe = normalizeRecipe(clonedManifest.build, options, clonedManifest);
-
-  // PLAN-CONF.md §4.8.2: source-build of a dep consumes ONLY the dep's own
-  // recipe conf — never the root project's merged conf. Translating the
-  // dep's cmake.cache namespace into -D args here keeps the dep's source-
-  // build CMake invocation aligned with its author's declared defaults
-  // while preserving cross-consumer reproducibility. The root's CLI
-  // --conf / wyvrn.local.json overlay is invisible at this seam.
-  const clonedConfFlat    = readRecipeConf(clonedManifest);
-  const clonedCacheVars   = cmakeCacheVariables(clonedConfFlat);
-  if (Object.keys(clonedCacheVars).length > 0) {
-    const confDerivedArgs = Object.entries(clonedCacheVars)
-      .map(([k, v]) => `-D${k}=${v}`);
-    recipe.configure = [...recipe.configure, ...confDerivedArgs];
-    log.info(
-      `  conf.cmake.cache → ${confDerivedArgs.length} source-build ` +
-      `configure arg(s) from the dep's own recipe`,
-    );
-  }
-
-  // ── 4. Recursively resolve + download this package's OWN deps ──────────
-  // Lazy-require: downloadDependencies is where we were called from, so
-  // pulling it in at module-load would be a circular import.
-  // eslint-disable-next-line global-require
-  const { downloadDependencies } = require('../download');
-
-  const rawPackageDeps = normalizeDependencies(
-    clonedManifest.dependencies ?? clonedManifest.Dependencies,
-  );
-  const depsForResolution = Object.fromEntries(
-    Object.entries(rawPackageDeps).map(([n, d]) => [n, d.version]),
-  );
-
-  log.info(`  resolving ${Object.keys(depsForResolution).length} transitive dep(s)`);
-  const transitiveManifests = new Map();
-  const resolvedDeps = await resolveDependencies(
-    depsForResolution, packageSources, platform, wyvrnFetch, new Map(),
-    transitiveManifests,
-  );
-
-  // Build an enriched deps map. Same logic as install.js: per-dep settings
-  // + recipe-declared options resolved against what the *cloned* source
-  // manifest asks for. No CLI overrides — transitive options come solely
-  // from the source package's `dependencies.<n>.options`.
-  const enrichedDeps = new Map();
-  for (const [depName, depVersion] of resolvedDeps) {
-    const depOverrides     = rawPackageDeps[depName]?.settings ?? {};
-    const effectiveProfile = mergeProfile(profile, depOverrides);
-
-    const transitiveManifest = transitiveManifests.get(depName);
-    const declaration = transitiveManifest?.options
-      ? normalizeOptionsDeclaration(transitiveManifest.options, `${depName}@${depVersion}`)
-      : null;
-    const effectiveOptions = resolveEffectiveOptions(
-      declaration,
-      rawPackageDeps[depName]?.options ?? {},
-      {},
-      `${depName}@${depVersion}`,
-    );
-
-    const depProfileHash = hashProfile(effectiveProfile, effectiveOptions);
-    enrichedDeps.set(depName, {
-      version:     depVersion,
-      profileHash: depProfileHash,
-      profile:     effectiveProfile,
-      options:     effectiveOptions,
-    });
-  }
-
-  if (enrichedDeps.size > 0) {
-    await downloadDependencies(
-      enrichedDeps, packageSources, platform, paths.internal,
-      wyvrnFetch, Math.max(30, Math.round(timeoutMs / 1000)),
-      { ...authOptions, buildMode },
-    );
-  } else {
-    fs.mkdirSync(paths.internal, { recursive: true });
-  }
-
-  // ── 5. Generate the CMake toolchain into wyvrn_internal/ ─────────────────
-  const { toolchain } = generateToolchain({
-    destDir:     paths.internal,
-    profile,
-    profileName,
-    profileHash,
-    packageNames: [...resolvedDeps.keys()].sort(),
-  });
-
-  // ── 6. Configure + build + install ──────────────────────────────────────
-  // Caller can override recipe.configs (e.g. for CI that only wants Release);
-  // otherwise the recipe's own default of all four CMake configurations is
-  // respected.
-  const effectiveConfigs = (configs && configs.length > 0) ? configs : recipe.configs;
-  log.info(`  building ${name}@${version} (configs: ${effectiveConfigs.join(', ')})`);
-  await configureBuildInstall({
-    recipe,
-    srcRoot:       paths.src,
-    buildPaths:    { build: paths.build, install: paths.install },
-    toolchainFile: toolchain,
-    configs:       effectiveConfigs,
-    profile,
-  });
-
-  // ── 7. Zip install dir → wyvrn.zip ──────────────────────────────────────
-  if (!fs.existsSync(paths.install) || fs.readdirSync(paths.install).length === 0) {
-    throw new Error(
-      `CMake install produced no files at ${paths.install}. ` +
-      `Check the package's install() rules in its CMakeLists.txt.`,
-    );
-  }
-  log.info(`  zipping install dir → ${paths.artefact}`);
-  const zip = new AdmZip();
-  addFolder(zip, paths.install, paths.install);
-  zip.writeZip(paths.artefact);
-
-  const contentSha256 = sha256Of(paths.artefact);
-  log.info(`  source-build SHA256: ${contentSha256.slice(0, 16)}...`);
-
-  // ── 8. Hand off to the caller's extraction flow ─────────────────────────
-  fs.copyFileSync(paths.artefact, destZipPath);
-
-  return {
-    found:        true,
-    contentSha256,
-    profileHash,
-    gitSha,
-    gitRepo,
-    source:       paths.root,
-    resolvedFrom: 'v2-source-build',
-    artefactPath:       paths.artefact,
-    clonedManifestPath: manifestPath,
-  };
-}
-
-module.exports = { buildFromSource };
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+const { StreamingZipWriter } = require('../zip-stream');
+const { cloneAtSha }           = require('./clone');
+const { normalizeRecipe, hasBuildRecipe } = require('./recipe');
+const { configureBuildInstall } = require('./cmake');
+const { getBuildPaths, hasValidArtefact } = require('./cache');
+
+const { normalizeDependencies } = require('../manifest');
+const { resolveDependencies }   = require('../resolve');
+const { hashProfile, mergeProfile, sha256Of } = require('../profile');
+const { generateToolchain }     = require('../toolchain');
+const { normalizeOptionsDeclaration, resolveEffectiveOptions } = require('../options');
+const { readRecipeConf, cmakeCacheVariables } = require('../conf');
+const { wyvrnFetch }            = require('../http-fetch');
+const log                       = require('../logger');
+
+/**
+ * Recursively walk a directory and add every file into a streaming zip
+ * writer at paths relative to `base`. Matches the structure emitted by
+ * `publish` — zip contents are the DIRECT SUBTREE of `base`, not
+ * `base` itself. The `zip` argument can be any object exposing
+ * `addLocalFile(fullPath, zipDir)` (see [src/zip-stream.js](../zip-stream.js)).
+ */
+function addFolder(zip, dir, base) {
+  for (const entry of fs.readdirSync(dir)) {
+    const full = path.join(dir, entry);
+    const rel  = path.relative(base, full).replace(/\\/g, '/');
+    const stat = fs.statSync(full);
+    if (stat.isDirectory()) {
+      addFolder(zip, full, base);
+    } else {
+      const zipDir = path.dirname(rel);
+      zip.addLocalFile(full, zipDir === '.' ? '' : zipDir);
+    }
+  }
+}
+
+/**
+ * Build a package from source and produce an artefact zip indistinguishable
+ * from a pre-built download.
+ *
+ * ───────────────────────────────────────────────────────────────────────────
+ * Flow (PLAN-BUILD-MISSING phase 3):
+ *   1. Check the build cache for a ready artefact → copy and return.
+ *   2. Shallow-clone `{gitRepo}` at `{gitSha}` into the cache.
+ *   3. Read the cloned `wyvrn.json`; require a `build` section.
+ *   4. Recursively resolve + download the package's OWN dependencies into a
+ *      scratch `wyvrn_internal/` co-located with the source. Source-build
+ *      propagates via `buildMode: "missing"`, so transitive source-only deps
+ *      Just Work.
+ *   5. Generate the CMake toolchain via `generateToolchain()` — the shared
+ *      entry point documented in PLAN-CMAKE-TOOLCHAIN Phase F. Never hand-
+ *      roll profile→flag translation here.
+ *   6. Configure + build + install via `configureBuildInstall()`.
+ *   7. Zip the install dir → `wyvrn.zip`, compute `contentSha256`.
+ *   8. Copy the zip to `destZipPath` so `downloadDependencies` can extract
+ *      it like any other v2 artefact.
+ * ───────────────────────────────────────────────────────────────────────────
+ *
+ * @param {object} args
+ * @param {string} args.name
+ * @param {string} args.version
+ * @param {import('../profile').WyvrnProfile} args.profile
+ * @param {string} args.profileName
+ * @param {string} args.profileHash
+ * @param {Record<string, any>|null} [args.options]  Effective options for this build.
+ *                                                    Used to expand `${options.*}` in the recipe.
+ * @param {string} args.gitRepo
+ * @param {string} args.gitSha
+ * @param {string} args.destZipPath    Where the caller expects the artefact zip.
+ * @param {string[]} args.packageSources  Used to resolve this package's own deps.
+ * @param {string} args.platform       v1 fallback platform for transitive deps.
+ * @param {number} args.timeoutMs
+ * @param {string} [args.buildMode]    Propagated into transitive downloads. Default 'missing'.
+ * @param {string[]} [args.configs]    Override recipe.configs (which defaults to
+ *                                      all four CMake configurations).
+ * @param {object} [args.authOptions]
+ * @returns {Promise<{
+ *   found:             true,
+ *   contentSha256:     string,
+ *   profileHash:       string,
+ *   gitSha:            string,
+ *   gitRepo:           string,
+ *   source:            string,       // build-cache path (for logging)
+ *   resolvedFrom:      'v2-source-build',
+ *   artefactPath:      string,       // absolute path to the built zip in the cache
+ *   clonedManifestPath: string,      // absolute path to the cloned wyvrn.json (for upload-built)
+ * }>}
+ * @throws {Error} when the cloned manifest lacks a `build` section, when
+ *                 CMake is missing, or when the compile itself fails.
+ */
+async function buildFromSource(args) {
+  const {
+    name, version,
+    profile, profileName, profileHash,
+    options = null,
+    gitRepo, gitSha,
+    destZipPath,
+    packageSources,
+    platform,
+    timeoutMs,
+    buildMode = 'missing',
+    configs,
+    authOptions = {},
+  } = args;
+
+  if (!gitRepo || !gitSha) {
+    throw new Error(
+      `Cannot source-build ${name}@${version}: the registry has no git metadata ` +
+      `(gitRepo/gitSha) for this version. Publisher must re-publish with git info.`,
+    );
+  }
+
+  const paths = getBuildPaths({ name, version, profileHash });
+
+  // ── 1. Cache hit? Short-circuit to copy and return ──────────────────────
+  if (hasValidArtefact({ name, version, profileHash })) {
+    log.info(`  source-build cache hit: ${paths.artefact}`);
+    fs.copyFileSync(paths.artefact, destZipPath);
+    const contentSha256 = sha256Of(paths.artefact);
+    return {
+      found:        true,
+      contentSha256,
+      profileHash,
+      gitSha,
+      gitRepo,
+      source:       paths.root,
+      resolvedFrom: 'v2-source-build',
+      artefactPath:       paths.artefact,
+      clonedManifestPath: path.join(paths.src, 'wyvrn.json'),
+    };
+  }
+
+  log.info(`  source-build starting: ${name}@${version} [${profileHash}]`);
+  log.info(`  cache dir: ${paths.root}`);
+
+  // ── 2. Clone source ─────────────────────────────────────────────────────
+  fs.mkdirSync(paths.root, { recursive: true });
+  await cloneAtSha({ gitRepo, gitSha, destDir: paths.src });
+
+  // ── 3. Read cloned manifest + recipe ────────────────────────────────────
+  const manifestPath = path.join(paths.src, 'wyvrn.json');
+  if (!fs.existsSync(manifestPath)) {
+    throw new Error(
+      `Cloned source does not contain wyvrn.json at ${manifestPath}. ` +
+      `${name}@${version} cannot be source-built.`,
+    );
+  }
+  const clonedManifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  if (!hasBuildRecipe(clonedManifest)) {
+    throw new Error(
+      `${name}@${version} has no "build" section in its wyvrn.json at ${gitSha.slice(0, 12)}. ` +
+      `Source-build is opt-in — the publisher must add a build recipe.`,
+    );
+  }
+  // Pass effective options into the recipe so `${options.<name>}` tokens in
+  // `build.configure` / `build.buildArgs` expand to the concrete values that
+  // produced this build's profileHash. Pass the cloned manifest so PLAN-CONF.md
+  // §4.7 collision detection catches a publisher who declared the same KEY in
+  // both build.configure and conf.cmake.cache.
+  const recipe = normalizeRecipe(clonedManifest.build, options, clonedManifest);
+
+  // PLAN-CONF.md §4.8.2: source-build of a dep consumes ONLY the dep's own
+  // recipe conf — never the root project's merged conf. Translating the
+  // dep's cmake.cache namespace into -D args here keeps the dep's source-
+  // build CMake invocation aligned with its author's declared defaults
+  // while preserving cross-consumer reproducibility. The root's CLI
+  // --conf / wyvrn.local.json overlay is invisible at this seam.
+  const clonedConfFlat    = readRecipeConf(clonedManifest);
+  const clonedCacheVars   = cmakeCacheVariables(clonedConfFlat);
+  if (Object.keys(clonedCacheVars).length > 0) {
+    const confDerivedArgs = Object.entries(clonedCacheVars)
+      .map(([k, v]) => `-D${k}=${v}`);
+    recipe.configure = [...recipe.configure, ...confDerivedArgs];
+    log.info(
+      `  conf.cmake.cache → ${confDerivedArgs.length} source-build ` +
+      `configure arg(s) from the dep's own recipe`,
+    );
+  }
+
+  // ── 4. Recursively resolve + download this package's OWN deps ──────────
+  // Lazy-require: downloadDependencies is where we were called from, so
+  // pulling it in at module-load would be a circular import.
+  // eslint-disable-next-line global-require
+  const { downloadDependencies } = require('../download');
+
+  const rawPackageDeps = normalizeDependencies(
+    clonedManifest.dependencies ?? clonedManifest.Dependencies,
+  );
+  const depsForResolution = Object.fromEntries(
+    Object.entries(rawPackageDeps).map(([n, d]) => [n, d.version]),
+  );
+
+  log.info(`  resolving ${Object.keys(depsForResolution).length} transitive dep(s)`);
+  const transitiveManifests = new Map();
+  const resolvedDeps = await resolveDependencies(
+    depsForResolution, packageSources, platform, wyvrnFetch, new Map(),
+    transitiveManifests,
+  );
+
+  // Build an enriched deps map. Same logic as install.js: per-dep settings
+  // + recipe-declared options resolved against what the *cloned* source
+  // manifest asks for. No CLI overrides — transitive options come solely
+  // from the source package's `dependencies.<n>.options`.
+  const enrichedDeps = new Map();
+  for (const [depName, depVersion] of resolvedDeps) {
+    const depOverrides     = rawPackageDeps[depName]?.settings ?? {};
+    const effectiveProfile = mergeProfile(profile, depOverrides);
+
+    const transitiveManifest = transitiveManifests.get(depName);
+    const declaration = transitiveManifest?.options
+      ? normalizeOptionsDeclaration(transitiveManifest.options, `${depName}@${depVersion}`)
+      : null;
+    const effectiveOptions = resolveEffectiveOptions(
+      declaration,
+      rawPackageDeps[depName]?.options ?? {},
+      {},
+      `${depName}@${depVersion}`,
+    );
+
+    const depProfileHash = hashProfile(effectiveProfile, effectiveOptions);
+    enrichedDeps.set(depName, {
+      version:     depVersion,
+      profileHash: depProfileHash,
+      profile:     effectiveProfile,
+      options:     effectiveOptions,
+    });
+  }
+
+  if (enrichedDeps.size > 0) {
+    await downloadDependencies(
+      enrichedDeps, packageSources, platform, paths.internal,
+      wyvrnFetch, Math.max(30, Math.round(timeoutMs / 1000)),
+      { ...authOptions, buildMode },
+    );
+  } else {
+    fs.mkdirSync(paths.internal, { recursive: true });
+  }
+
+  // ── 5. Generate the CMake toolchain into wyvrn_internal/ ─────────────────
+  const { toolchain } = generateToolchain({
+    destDir:     paths.internal,
+    profile,
+    profileName,
+    profileHash,
+    packageNames: [...resolvedDeps.keys()].sort(),
+  });
+
+  // ── 6. Configure + build + install ──────────────────────────────────────
+  // Caller can override recipe.configs (e.g. for CI that only wants Release);
+  // otherwise the recipe's own default of all four CMake configurations is
+  // respected.
+  const effectiveConfigs = (configs && configs.length > 0) ? configs : recipe.configs;
+  log.info(`  building ${name}@${version} (configs: ${effectiveConfigs.join(', ')})`);
+  await configureBuildInstall({
+    recipe,
+    srcRoot:       paths.src,
+    buildPaths:    { build: paths.build, install: paths.install },
+    toolchainFile: toolchain,
+    configs:       effectiveConfigs,
+    profile,
+  });
+
+  // ── 7. Zip install dir → wyvrn.zip ──────────────────────────────────────
+  if (!fs.existsSync(paths.install) || fs.readdirSync(paths.install).length === 0) {
+    throw new Error(
+      `CMake install produced no files at ${paths.install}. ` +
+      `Check the package's install() rules in its CMakeLists.txt.`,
+    );
+  }
+  log.info(`  zipping install dir → ${paths.artefact}`);
+  const zip = new StreamingZipWriter(paths.artefact);
+  addFolder(zip, paths.install, paths.install);
+  await zip.finalize();
+
+  const contentSha256 = sha256Of(paths.artefact);
+  log.info(`  source-build SHA256: ${contentSha256.slice(0, 16)}...`);
+
+  // ── 8. Hand off to the caller's extraction flow ─────────────────────────
+  fs.copyFileSync(paths.artefact, destZipPath);
+
+  return {
+    found:        true,
+    contentSha256,
+    profileHash,
+    gitSha,
+    gitRepo,
+    source:       paths.root,
+    resolvedFrom: 'v2-source-build',
+    artefactPath:       paths.artefact,
+    clonedManifestPath: manifestPath,
+  };
+}
+
+module.exports = { buildFromSource };