wyvrnpm 2.12.2 → 2.12.3

package/README.md

@@ -4,7 +4,7 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.8.3** — Highlights since 2.4.0: non-ABI build-time `conf` block (CMake cache variables via recipe / team profile / `wyvrn.local.json` / CLI `--conf`), per-package `source` pin for multi-source defense, profile inheritance via `extends`, pattern-based `settingsOverrides` (`boost*: {...}`), `wyvrnpm cache list` / `cache prune` for selective source-build-cache cleanup, `install --dry-run` (JSON plan without side effects), `install --build=always` to force source-rebuild, `--token-env` for CI credentials, CloudFront/WAF-compatible HTTP provider (sends `User-Agent`, surfaces non-404 errors), publish preserves dependency ranges verbatim with lock snapshot moved to informational `publishedLock`, and a raft of security hardening (Zip Slip, MSVC arch allow-list). Full list in `claude/EVALUATION.md`.
+> **README version: 2.12.3** — Highlights since 2.8.3: profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
 
 ---
 
@@ -1820,7 +1820,7 @@ cmake --build build/wyvrn-default --config Release
 
 | File | Provides |
 |---|---|
-| `cpp.cmake` | C++ standard defaults (guarded — toolchain wins). |
+| `cpp.cmake` | Post-`project()` C++ language defaults. `CMAKE_CXX_STANDARD` is owned by the toolchain (set unconditionally from `profile.compiler.cppstd` before `project()` — a `-DCMAKE_CXX_STANDARD=…` on the cmake CLI cannot override it). |
 | `variables.cmake` | Platform detection (`WYVRN_PLATFORM_WIN`, …) and compiler flags. |
 | `options.cmake` | Feature toggles (`WYVRN_ENABLE_LOG`, …). |
 | `functions.cmake` | `SETUP_LIBRARY` / `SETUP_EXE` plus HAL source-collection helpers. |

package/cmake/cpp.cmake

@@ -1,9 +1,7 @@
-# Define the cpp information ( version, compilation type, thread type, exception handling )
-# Set a C++20 default only if the consumer (or wyvrnpm's toolchain) has not
-# already chosen a standard — the toolchain sets CMAKE_CXX_STANDARD from the
-# active build profile before project(), and that explicit choice must win.
-if(NOT DEFINED CMAKE_CXX_STANDARD)
-    set(CMAKE_CXX_STANDARD 20)
-    set(CMAKE_CXX_STANDARD_REQUIRED True)
-endif()
+# C++ language defaults that survive after project().
+#
+# CMAKE_CXX_STANDARD / _REQUIRED / _EXTENSIONS are owned by the toolchain
+# (wyvrn_toolchain.cmake sets them from the active profile's compiler.cppstd
+# before project()). Re-setting them here would clobber the profile-derived
+# value — so we deliberately don't.
 set(CMAKE_EXPERIMENTAL_CXX_MODULE_CMAKE_API OFF)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.12.2",
+  "version": "2.12.3",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/toolchain/template.cmake

@@ -39,11 +39,13 @@ set(WYVRN_PROFILE_RUNTIME          "{{PROFILE_RUNTIME}}")
 set(WYVRNPM_CMAKE_DIR "{{WYVRNPM_CMAKE_DIR}}")
 
 # ── C++ standard ──────────────────────────────────────────────────────────────
-if(NOT DEFINED CMAKE_CXX_STANDARD)
-    set(CMAKE_CXX_STANDARD {{PROFILE_CPPSTD}})
-    set(CMAKE_CXX_STANDARD_REQUIRED ON)
-    set(CMAKE_CXX_EXTENSIONS OFF)
-endif()
+# Profile-driven and unconditional. Anyone consuming this toolchain accepts
+# the active profile's `compiler.cppstd` as authoritative — a -DCMAKE_CXX_STANDARD
+# on the cmake command line cannot defeat it. Use a different profile (or
+# settings override on the dep) to change the standard.
+set(CMAKE_CXX_STANDARD {{PROFILE_CPPSTD}})
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
 
 # ── MSVC runtime library ──────────────────────────────────────────────────────
 # Only meaningful when the actual compiler is MSVC. CMake ignores this on other