wyvrnpm 2.12.2 → 2.13.11

package/src/commands/publish.js

@@ -14,16 +14,78 @@ const {
 }                                                          = require('../conf');
 const { resolveBinaryDirRoot }                             = require('../binary-dir');
 const { hashProfile, sha256Of, getGitSha, getGitRepo, isShaOnRemote } = require('../profile');
+const { sha256OfCanonical }                                = require('../signing/canonical');
+const {
+  signAttestation,
+  serializeSigEnvelope,
+}                                                          = require('../signing');
+const { resolveSigningContext }                            = require('../signing/resolve-context');
 const { defaultCompatBlock }                               = require('../compat');
 const { buildContext }                                     = require('../context');
+const { buildV2Meta }                                      = require('../v2-meta');
 const {
   normalizeOptionsDeclaration,
   resolveEffectiveOptions,
 }                                                          = require('../options');
 const { loadIgnorePatterns, isIgnored }                    = require('../ignore');
 const { hasBuildRecipe, normalizeRecipe }                  = require('../build/recipe');
+const {
+  planSlice,
+  auditSlicePlan,
+  sha256AndSize,
+}                                                          = require('../publish/slice');
 const log                                                  = require('../logger');
 
+/**
+ * Materialise the freshly-built dry-run artefacts (manifest, slice or
+ * fat zip(s), optional att+sig) into a local inspection directory.
+ * Does NOT touch any provider — pure local copy. The same files the
+ * provider would have uploaded land here under their canonical
+ * registry filenames so the user can `unzip`, sha256, or diff them
+ * before committing to a real publish.
+ *
+ * Existing contents of `outDir` are wiped first — dry-run-publish is
+ * a fresh-rendering operation; stale leftovers from a previous run
+ * would just confuse inspection.
+ *
+ * @param {object} args
+ * @param {string} args.outDir
+ * @param {string} args.manifestPath           tmp wyvrn.json
+ * @param {string|null} [args.zipPath]         tmp fat-zip path (fat-zip publishes)
+ * @param {Record<string,string>|null} [args.artefactZips]  config → tmp slice path
+ * @param {string|null} [args.attPath]
+ * @param {string|null} [args.sigPath]
+ * @returns {{ outDir: string, files: Array<{ name: string, sizeBytes: number }> }}
+ */
+function writeDryRunArtefacts({ outDir, manifestPath, zipPath, artefactZips, attPath, sigPath }) {
+  // Wipe + recreate. Recursive rm on an absent dir is a no-op.
+  fs.rmSync(outDir, { recursive: true, force: true });
+  fs.mkdirSync(outDir, { recursive: true });
+
+  const files = [];
+  function copyTo(srcPath, name) {
+    const dest = path.join(outDir, name);
+    fs.copyFileSync(srcPath, dest);
+    files.push({ name, sizeBytes: fs.statSync(dest).size });
+  }
+
+  // Order mirrors the registry write order (zips → manifest → att → sig)
+  // so the inspection folder reads top-to-bottom in the same shape the
+  // provider would write.
+  if (artefactZips && Object.keys(artefactZips).length > 0) {
+    for (const cfg of Object.keys(artefactZips).sort()) {
+      copyTo(artefactZips[cfg], `wyvrn-${cfg}.zip`);
+    }
+  } else if (zipPath) {
+    copyTo(zipPath, 'wyvrn.zip');
+  }
+  copyTo(manifestPath, 'wyvrn.json');
+  if (attPath) copyTo(attPath, 'wyvrn.att.json');
+  if (sigPath) copyTo(sigPath, 'wyvrn.sig');
+
+  return { outDir, files };
+}
+
 /**
  * Human-friendly byte formatter for the dry-run summary.
  *
@@ -44,29 +106,49 @@ function formatBytes(n) {
  * providers (§4.5 of CLAUDE.md), so dry-run can surface the exact shape
  * of the upload without actually performing it.
  *
+ * `sliceConfigs` triggers the per-config branch: instead of a single
+ * `wyvrn.zip`, the plan lists one `wyvrn-<Config>.zip` per declared
+ * config (alphabetical). Pass `null` for fat-zip publishes (today's
+ * default).
+ *
  * @param {{
- *   source:       string,
- *   name:         string,
- *   version:      string,
- *   profileHash:  string,
- *   gitSha?:      string | null,
- *   gitRepo?:     string | null,
+ *   source:        string,
+ *   name:          string,
+ *   version:       string,
+ *   profileHash:   string,
+ *   gitSha?:       string | null,
+ *   gitRepo?:      string | null,
  *   updateLatest?: boolean,
+ *   signed?:       boolean,
+ *   sliceConfigs?: string[] | null,
  * }} opts
- * @returns {Array<{ path: string, kind: 'wyvrn.zip'|'wyvrn.json'|'source.json'|'versions.json'|'latest.json' }>}
+ * @returns {Array<{ path: string, kind: string }>}
  */
 function planPublishUrls({
   source, name, version, profileHash,
-  gitSha = null, gitRepo = null, updateLatest = true,
+  gitSha = null, gitRepo = null, updateLatest = true, signed = false,
+  sliceConfigs = null,
 }) {
   const base = source.replace(/\/$/, '');
   const v2root    = `${base}/v2/${name}`;
   const buildRoot = `${v2root}/${version}/${profileHash}`;
 
-  const plan = [
-    { path: `${buildRoot}/wyvrn.zip`,   kind: 'wyvrn.zip' },
-    { path: `${buildRoot}/wyvrn.json`,  kind: 'wyvrn.json' },
-  ];
+  const plan = [];
+  if (Array.isArray(sliceConfigs) && sliceConfigs.length > 0) {
+    for (const cfg of sliceConfigs.slice().sort()) {
+      plan.push({ path: `${buildRoot}/wyvrn-${cfg}.zip`, kind: `wyvrn-${cfg}.zip` });
+    }
+  } else {
+    plan.push({ path: `${buildRoot}/wyvrn.zip`, kind: 'wyvrn.zip' });
+  }
+  plan.push({ path: `${buildRoot}/wyvrn.json`, kind: 'wyvrn.json' });
+  if (signed) {
+    // Write order matters: att+sig land between the manifest and
+    // versions.json so a partial-failure crash never leaves a sig-less
+    // entry visible to consumers (S1 plan §3 + Risks §write-order).
+    plan.push({ path: `${buildRoot}/wyvrn.att.json`, kind: 'wyvrn.att.json' });
+    plan.push({ path: `${buildRoot}/wyvrn.sig`,      kind: 'wyvrn.sig' });
+  }
   if (gitSha || gitRepo) {
     plan.push({ path: `${v2root}/${version}/source.json`, kind: 'source.json' });
   }
@@ -77,6 +159,9 @@ function planPublishUrls({
   return plan;
 }
 
+// resolveSigningContext lives in src/signing/resolve-context.js so the
+// install.js `--upload-built` path uses identical precedence rules.
+
 /**
  * Walk `dir` recursively and add every file to `zip`, skipping anything that
  * matches `.wyvrnignore` patterns OR whose zip-relative path is already in
@@ -179,7 +264,7 @@ function resolveSource(argv, ctx) {
   // buildContext.
   const { token } = ctx.auth.for(sourceEntry);
 
-  return { source, awsProfile, token };
+  return { source, awsProfile, token, sourceEntry };
 }
 
 // ---------------------------------------------------------------------------
@@ -199,7 +284,7 @@ async function publish(argv) {
     process.exit(1);
   }
 
-  const { source, awsProfile, token } = resolveSource(argv, ctx);
+  const { source, awsProfile, token, sourceEntry } = resolveSource(argv, ctx);
   const { path: publishPath, force } = argv;
   const dryRun  = Boolean(argv.dryRun);
   const jsonOut = ctx.flags.format === 'json';
@@ -283,8 +368,33 @@ async function publish(argv) {
   // Dry-run softens the overwrite-without-force error to a warning so the
   // full plan still prints — CI callers should parse `--format json` and
   // gate on `wouldOverwrite` rather than on the exit code.
-  const v2AlreadyExists = await provider.v2Exists({ source, name, version, profileHash, awsProfile, token });
-  if (v2AlreadyExists) {
+  //
+  // The existence check is the only outbound network hit in publish()
+  // before the dry-run early-return. Under --dry-run we tolerate
+  // network/credential failures: the user's intent is "show me what
+  // WOULD happen, locally" — they shouldn't need a live AWS SSO token
+  // to inspect the slice plan + materialise artefacts. Degrade to
+  // wouldOverwrite=null and continue. Real publishes still propagate.
+  let v2AlreadyExists = false;
+  try {
+    v2AlreadyExists = await provider.v2Exists({ source, name, version, profileHash, awsProfile, token });
+  } catch (err) {
+    if (dryRun) {
+      log.warn(
+        `could not check existence of ${name}@${version} [${profileHash}] on ${source}: ` +
+        `${err.message}. ` +
+        `Continuing dry-run; "wouldOverwrite" reported as unknown.`,
+      );
+      v2AlreadyExists = null;   // sentinel — surfaces in JSON payload
+    } else {
+      log.error(
+        `existence check failed for ${name}@${version} [${profileHash}] on ${source}: ` +
+        `${err.message}`,
+      );
+      process.exit(1);
+    }
+  }
+  if (v2AlreadyExists === true) {
     if (force) {
       log.warn(`${name}@${version} [${profileHash}] already exists — overwriting (--force)`);
     } else if (dryRun) {
@@ -350,6 +460,13 @@ async function publish(argv) {
 
   // ── Build zip ─────────────────────────────────────────────────────────────
   const tmpZipPath = path.join(os.tmpdir(), `wyvrnpm-${name}-${version}-${Date.now()}.zip`);
+  // Declared at function scope so the cleanup `finally` can `unlink` them
+  // regardless of which step in the try block populated them.
+  let attestationFilePath = null;
+  let signatureFilePath   = null;
+  // Per-config slicing fans out to N tmp zips; tracked here so the
+  // cleanup `finally` unlinks every one even on partial failures.
+  const sliceTmpPaths = [];
 
   // ── Inject default `compatibility` block if the source manifest lacks one ──
   // Written to a temp file so the source wyvrn.json is never modified.
@@ -388,7 +505,10 @@ async function publish(argv) {
       ? { publishedConf: unflattenConf(publishedConf) }
       : {}),
   };
-  fs.writeFileSync(tmpManifestPath, JSON.stringify(manifestForPublish, null, 2), 'utf8');
+  // The full v2Meta is built BEFORE provider write so the publisher's
+  // attestation can sign over the exact bytes the provider will upload.
+  // Providers no longer mutate the manifest; they read tmpManifestPath
+  // verbatim. See src/v2-meta.js for the canonical shape.
   if (!manifest.compatibility) {
     log.info('Injecting default `compatibility` block (all fields `exact`) — override by adding one to wyvrn.json');
   } else {
@@ -424,9 +544,10 @@ async function publish(argv) {
   // on path collisions (e.g. `include/`).
   let installOverlayDir = null;
   let installOverlayPaths = new Set();
+  let recipe = null;
   if (hasBuildRecipe(manifest)) {
     try {
-      const recipe = normalizeRecipe(manifest.build, effectiveOptions, manifest);
+      recipe = normalizeRecipe(manifest.build, effectiveOptions, manifest);
       const candidate = path.join(
         srcDir, publishBinaryDirRoot, `wyvrn-${activeProfileName}`, recipe.installDir,
       );
@@ -445,11 +566,27 @@ async function publish(argv) {
       }
     } catch (err) {
       log.warn(`could not locate install tree: ${err.message} — publishing source tree only`);
+      recipe = null;
     }
   }
 
+  // Per-config slice publish (recipe `build.publishPerConfig: true`)
+  // requires an install tree to slice — fail fast if the recipe opted
+  // in but the install tree is missing.
+  const usePerConfig = recipe?.publishPerConfig === true;
+  if (usePerConfig && !installOverlayDir) {
+    log.error(
+      'build.publishPerConfig is true but no install tree found. ' +
+      'Per-config slicing has nothing to slice — run `wyvrnpm build --all-configs --install` ' +
+      'and retry, or set publishPerConfig: false to publish the source tree alone.',
+    );
+    process.exit(1);
+  }
+  if (usePerConfig) {
+    log.info(`Per-config slicing: enabled — configs ${recipe.configs.join(', ')}`);
+  }
+
   try {
-    log.info(`Zipping ${srcDir} ...`);
     // StreamingZipWriter — replaces adm-zip on the write path. archiver
     // streams each file in via fs.createReadStream rather than the
     // sync-readFileSync adm-zip used, so multi-GB artefacts (gRPC's
@@ -458,43 +595,222 @@ async function publish(argv) {
     // auto-promotes to ZIP64 when total size or entry count crosses
     // the 4 GB / 65535 thresholds; node-stream-zip on the consumer
     // side reads ZIP64 transparently.
-    const zip = new StreamingZipWriter(tmpZipPath);
-    if (installOverlayDir) {
-      // Collect install-tree paths first so the source-tree walker can skip
-      // anything the install tree will add canonically.
-      const peek = collectInstallTreeFiles(installOverlayDir);
-      installOverlayPaths = new Set(peek.map((f) => f.relPath));
+    let contentSha256   = null;       // fat-zip mode
+    let zipBytes        = 0;
+    let artefactConfigs = null;       // slice mode: { config → { sha256, sizeBytes } }
+    let artefactZips    = null;       // slice mode: { config → tmpPath } (passed to v2Publish)
+
+    if (usePerConfig) {
+      // ── Per-config slice publish ────────────────────────────────────────
+      log.info(`Slicing install tree per config (${recipe.configs.join(', ')}) ...`);
+      const installPlan = planSlice(installOverlayDir);
+      try {
+        auditSlicePlan(installPlan, recipe.configs);
+      } catch (err) {
+        log.error(err.message);
+        process.exit(1);
+      }
+
+      // installOverlayPaths covers EVERY install-tree file (shared +
+      // per-config[*]) so the source-tree walker skips them all — install
+      // tree wins on collisions for any config slice.
+      installOverlayPaths = new Set([
+        ...installPlan.sharedFiles.map((f) => f.relPath),
+        ...Object.values(installPlan.perConfigFiles).flat().map((f) => f.relPath),
+      ]);
+
+      artefactZips    = {};
+      artefactConfigs = {};
+
+      for (const config of recipe.configs.slice().sort()) {
+        const slicePath = path.join(
+          os.tmpdir(),
+          `wyvrnpm-slice-${name}-${version}-${config}-${Date.now()}.zip`,
+        );
+        sliceTmpPaths.push(slicePath);
+
+        log.info(`  Building slice ${config} ...`);
+        const sliceZip = new StreamingZipWriter(slicePath);
+        // Source tree (filtered by .wyvrnignore, install-tree paths skipped).
+        addFolderFiltered(sliceZip, srcDir, srcDir, ignorePatterns, installOverlayPaths);
+        // Install-tree shared files — same in every slice so the
+        // multi-config-merge invariant holds when consumers extract two
+        // slices into one wyvrn_internal/<name>/.
+        for (const { fullPath, relPath } of installPlan.sharedFiles) {
+          const zipDir = path.dirname(relPath).replace(/\\/g, '/');
+          sliceZip.addLocalFile(fullPath, zipDir === '.' ? '' : zipDir);
+        }
+        // Install-tree per-config[<config>] files — exclusive to this slice.
+        for (const { fullPath, relPath } of installPlan.perConfigFiles[config]) {
+          const zipDir = path.dirname(relPath).replace(/\\/g, '/');
+          sliceZip.addLocalFile(fullPath, zipDir === '.' ? '' : zipDir);
+        }
+        await sliceZip.finalize();
+
+        const { sha256, sizeBytes } = await sha256AndSize(slicePath);
+        artefactZips[config]    = slicePath;
+        artefactConfigs[config] = { sha256, sizeBytes };
+        zipBytes += sizeBytes;
+        log.info(`    ${formatBytes(sizeBytes).padStart(10)}  sha=${sha256.slice(0, 16)}...`);
+      }
+      log.info(`Total slice bytes: ${formatBytes(zipBytes)}  (${Object.keys(artefactConfigs).length} slice(s))`);
+    } else {
+      // ── Fat-zip publish (today's default) ───────────────────────────────
+      log.info(`Zipping ${srcDir} ...`);
+      const zip = new StreamingZipWriter(tmpZipPath);
+      if (installOverlayDir) {
+        // Collect install-tree paths first so the source-tree walker can skip
+        // anything the install tree will add canonically.
+        const peek = collectInstallTreeFiles(installOverlayDir);
+        installOverlayPaths = new Set(peek.map((f) => f.relPath));
+      }
+      addFolderFiltered(zip, srcDir, srcDir, ignorePatterns, installOverlayPaths);
+      if (installOverlayDir) {
+        log.info(`Overlaying install tree: ${installOverlayDir}`);
+        const added = addInstallTree(zip, installOverlayDir);
+        log.info(`  Added ${added.size} file(s) from install tree`);
+      }
+      await zip.finalize();
+
+      contentSha256 = sha256Of(tmpZipPath);
+      zipBytes      = fs.statSync(tmpZipPath).size;
+      log.info(`Content SHA256 : ${contentSha256}`);
+      log.info(`Zip size       : ${formatBytes(zipBytes)} (${zipBytes} bytes)`);
     }
-    addFolderFiltered(zip, srcDir, srcDir, ignorePatterns, installOverlayPaths);
-    if (installOverlayDir) {
-      log.info(`Overlaying install tree: ${installOverlayDir}`);
-      const added = addInstallTree(zip, installOverlayDir);
-      log.info(`  Added ${added.size} file(s) from install tree`);
+
+    // ── Build v2Meta + write tmpManifestPath ─────────────────────────────
+    // Single source of truth (src/v2-meta.js) so the publisher's signed
+    // manifestSha256 matches what consumers compute from v2GetMeta.
+    // Providers MUST NOT mutate the manifest after this point.
+    //
+    // Slice publishes carry `artefactConfigs` (per-config { sha256, sizeBytes });
+    // fat-zip publishes carry `contentSha256`. Mutually exclusive.
+    const publishedAt = new Date().toISOString();
+    const v2Meta = buildV2Meta(manifestForPublish, {
+      profileHash,
+      buildSettings: effectiveOptions
+        ? { ...buildProfile, options: effectiveOptions }
+        : buildProfile,
+      ...(usePerConfig ? { artefactConfigs } : { contentSha256 }),
+      gitSha,
+      gitRepo,
+      publishedAt,
+      publishedLock,
+    });
+    fs.writeFileSync(tmpManifestPath, JSON.stringify(v2Meta, null, 2), 'utf8');
+    const manifestBytes  = fs.statSync(tmpManifestPath).size;
+    const manifestSha256 = sha256OfCanonical(v2Meta);
+
+    let signingCtx;
+    try {
+      signingCtx = resolveSigningContext(argv, ctx.config, sourceEntry);
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
     }
-    await zip.finalize();
 
-    const contentSha256 = sha256Of(tmpZipPath);
-    const zipBytes      = fs.statSync(tmpZipPath).size;
-    const manifestBytes = fs.statSync(tmpManifestPath).size;
-    log.info(`Content SHA256 : ${contentSha256}`);
-    log.info(`Zip size       : ${formatBytes(zipBytes)} (${zipBytes} bytes)`);
+    let signed = false;
+    let signerKeyId = null;
+    if (signingCtx === null) {
+      log.warn(
+        'publishing unsigned — no signing config found. Configure ' +
+        'defaultSigning in config.json to enable S1 attestations.',
+      );
+    } else if (signingCtx.skip) {
+      log.warn(`publishing unsigned — ${signingCtx.reason}`);
+    } else {
+      try {
+        const att = {
+          name, version, profileHash,
+          ...(usePerConfig
+            ? {
+                artefactSha256: Object.fromEntries(
+                  Object.entries(artefactConfigs).map(([cfg, v]) => [cfg, v.sha256]),
+                ),
+              }
+            : { contentSha256 }),
+          manifestSha256,
+          publishedAt: new Date().toISOString(),
+          publisherKeyId: signingCtx.keyId,
+          uploadedBy: null,
+        };
+        const result = signAttestation(att, signingCtx);
+        attestationFilePath = path.join(
+          os.tmpdir(),
+          `wyvrnpm-att-${name}-${version}-${Date.now()}.json`,
+        );
+        signatureFilePath = path.join(
+          os.tmpdir(),
+          `wyvrnpm-sig-${name}-${version}-${Date.now()}.json`,
+        );
+        fs.writeFileSync(attestationFilePath, result.attBytes);
+        fs.writeFileSync(signatureFilePath,   serializeSigEnvelope(result.sigEnvelope));
+        signed = true;
+        signerKeyId = signingCtx.keyId;
+        log.info(`Signed by      : ${signingCtx.keyId} (ed25519)`);
+      } catch (err) {
+        log.error(`signing failed: ${err.message}`);
+        process.exit(1);
+      }
+    }
 
     // ── Dry run: print the plan, skip the actual upload ──────────────────
     // Mirrors `npm publish --dry-run` — every step above (profile, options,
-    // zip, hash, v2Exists) runs; only the provider write is skipped.
+    // zip, hash, v2Exists, sign) runs; only the provider write is skipped.
     if (dryRun) {
       const plan = planPublishUrls({
-        source, name, version, profileHash, gitSha, gitRepo, updateLatest: true,
+        source, name, version, profileHash, gitSha, gitRepo, updateLatest: true, signed,
+        sliceConfigs: usePerConfig ? Object.keys(artefactConfigs) : null,
       });
 
+      // ── Materialise artefacts to a local inspection folder ─────────────
+      // CLI override (`--dry-run-out`) wins; otherwise default to a
+      // sibling of the install tree so it lives under the existing
+      // gitignored build dir and is wiped by `wyvrnpm clean`.
+      const dryRunOutDir = (() => {
+        if (typeof argv.dryRunOut === 'string' && argv.dryRunOut.length > 0) {
+          return path.isAbsolute(argv.dryRunOut)
+            ? argv.dryRunOut
+            : path.join(srcDir, argv.dryRunOut);
+        }
+        return path.join(srcDir, publishBinaryDirRoot, `wyvrn-${activeProfileName}`, 'dry-run-publish');
+      })();
+      let dryRunWritten = null;
+      try {
+        dryRunWritten = writeDryRunArtefacts({
+          outDir:        dryRunOutDir,
+          manifestPath:  tmpManifestPath,
+          zipPath:       usePerConfig ? null : tmpZipPath,
+          artefactZips:  usePerConfig ? artefactZips : null,
+          attPath:       attestationFilePath,
+          sigPath:       signatureFilePath,
+        });
+      } catch (err) {
+        log.error(`could not materialise dry-run artefacts to ${dryRunOutDir}: ${err.message}`);
+        process.exit(1);
+      }
+
       if (!jsonOut) {
         console.log();
         console.log(`Would publish ${name}@${version} [${profileHash}] to ${source}`);
-        console.log(`  contentSha256 : ${contentSha256}`);
-        console.log(`  zip size      : ${formatBytes(zipBytes)}`);
+        if (usePerConfig) {
+          console.log(`  per-config slices:`);
+          for (const cfg of Object.keys(artefactConfigs).sort()) {
+            const { sha256, sizeBytes } = artefactConfigs[cfg];
+            console.log(`    ${cfg.padEnd(15)} ${formatBytes(sizeBytes).padStart(10)}  sha=${sha256.slice(0, 16)}...`);
+          }
+          console.log(`  total bytes   : ${formatBytes(zipBytes)}`);
+        } else {
+          console.log(`  contentSha256 : ${contentSha256}`);
+          console.log(`  zip size      : ${formatBytes(zipBytes)}`);
+        }
+        console.log(`  manifestSha256: ${manifestSha256}`);
         console.log(`  manifest size : ${formatBytes(manifestBytes)}`);
-        if (v2AlreadyExists) {
+        console.log(`  signing       : ${signed ? `signed (${signerKeyId}, ed25519)` : 'unsigned'}`);
+        if (v2AlreadyExists === true) {
           console.log(`  overwrite     : YES — ${force ? '--force set, would proceed' : 'NOT SET, real publish would refuse'}`);
+        } else if (v2AlreadyExists === null) {
+          console.log(`  overwrite     : UNKNOWN — existence check skipped (no credentials)`);
         }
         console.log();
         console.log('Registry writes:');
@@ -502,6 +818,11 @@ async function publish(argv) {
           console.log(`  → ${p}    (${kind})`);
         }
         console.log();
+        console.log(`Artefacts written for inspection: ${dryRunWritten.outDir}`);
+        for (const { name: f, sizeBytes } of dryRunWritten.files) {
+          console.log(`  ${f.padEnd(28)} ${formatBytes(sizeBytes).padStart(10)}`);
+        }
+        console.log();
         log.success('Dry run OK — nothing uploaded.');
       } else {
         const payload = {
@@ -512,17 +833,27 @@ async function publish(argv) {
           version,
           profileHash,
           source,
-          contentSha256,
+          contentSha256:   usePerConfig ? null : contentSha256,
+          artefactConfigs: usePerConfig ? artefactConfigs : null,
+          manifestSha256,
           zipBytes,
           manifestBytes,
           options:         effectiveOptions ?? null,
           gitSha:          gitSha  ?? null,
           gitRepo:         gitRepo ?? null,
-          wouldOverwrite:  Boolean(v2AlreadyExists),
+          // null when the existence check failed (e.g. expired SSO token
+          // under --dry-run); CI scripts must distinguish "would overwrite"
+          // from "couldn't tell" to avoid false-greens.
+          wouldOverwrite:  v2AlreadyExists === null ? null : Boolean(v2AlreadyExists),
           forceSet:        Boolean(force),
           publishedLock,
           publishedConf:   Object.keys(publishedConf).length > 0 ? unflattenConf(publishedConf) : null,
+          signing:         signed
+            ? { signed: true, keyId: signerKeyId, alg: 'ed25519' }
+            : { signed: false, keyId: null,        alg: null },
           plan,
+          dryRunOut:   dryRunWritten.outDir,
+          dryRunFiles: dryRunWritten.files,
         };
         process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
       }
@@ -532,7 +863,15 @@ async function publish(argv) {
     // ── v2 publish ────────────────────────────────────────────────────────
     log.info('Publishing (v2) ...');
     await provider.v2Publish(
-      { manifest: tmpManifestPath, zip: tmpZipPath },
+      {
+        manifest: tmpManifestPath,
+        // Slice publishes pass artefactZips; fat-zip publishes pass `zip`.
+        ...(usePerConfig ? { artefactZips } : { zip: tmpZipPath }),
+        // S1 — both undefined when publishing unsigned; provider skips
+        // the writes entirely so the v2 layout is byte-identical to today.
+        ...(attestationFilePath ? { attPath: attestationFilePath } : {}),
+        ...(signatureFilePath   ? { sigPath: signatureFilePath   } : {}),
+      },
       {
         source,
         name,
@@ -542,7 +881,7 @@ async function publish(argv) {
         buildSettings: effectiveOptions
           ? { ...buildProfile, options: effectiveOptions }
           : buildProfile,
-        contentSha256,
+        ...(usePerConfig ? { artefactConfigs } : { contentSha256 }),
         gitSha,
         gitRepo,
         publishedLock,
@@ -551,7 +890,10 @@ async function publish(argv) {
       },
     );
 
-    log.success(`Successfully published ${name}@${version} [${profileHash}] to ${source}`);
+    log.success(
+      `Successfully published ${name}@${version} [${profileHash}] to ${source}` +
+      (signed ? ` (signed by ${signerKeyId})` : ''),
+    );
 
     if (jsonOut) {
       const payload = {
@@ -561,17 +903,27 @@ async function publish(argv) {
         version,
         profileHash,
         source,
-        contentSha256,
+        contentSha256:   usePerConfig ? null : contentSha256,
+        artefactConfigs: usePerConfig ? artefactConfigs : null,
+        manifestSha256,
         options:        effectiveOptions ?? null,
         gitSha:         gitSha  ?? null,
         gitRepo:        gitRepo ?? null,
         publishedAt:    new Date().toISOString(),
+        signing:        signed
+          ? { signed: true, keyId: signerKeyId, alg: 'ed25519' }
+          : { signed: false, keyId: null,        alg: null },
       };
       process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
     }
   } finally {
-    if (fs.existsSync(tmpZipPath))      fs.unlinkSync(tmpZipPath);
-    if (fs.existsSync(tmpManifestPath)) fs.unlinkSync(tmpManifestPath);
+    if (fs.existsSync(tmpZipPath))                                fs.unlinkSync(tmpZipPath);
+    if (fs.existsSync(tmpManifestPath))                           fs.unlinkSync(tmpManifestPath);
+    if (attestationFilePath && fs.existsSync(attestationFilePath)) fs.unlinkSync(attestationFilePath);
+    if (signatureFilePath   && fs.existsSync(signatureFilePath))   fs.unlinkSync(signatureFilePath);
+    for (const slicePath of sliceTmpPaths) {
+      if (fs.existsSync(slicePath)) fs.unlinkSync(slicePath);
+    }
   }
 }
 
@@ -581,4 +933,5 @@ module.exports.addFolderFiltered       = addFolderFiltered;
 module.exports.addInstallTree          = addInstallTree;
 module.exports.collectInstallTreeFiles = collectInstallTreeFiles;
 module.exports.planPublishUrls         = planPublishUrls;
+module.exports.writeDryRunArtefacts    = writeDryRunArtefacts;
 module.exports.formatBytes             = formatBytes;

package/src/commands/show.js

@@ -130,10 +130,26 @@ async function show(argv) {
         }
 
         let meta = null;
+        let signing = { signed: false, keyId: null, alg: null };
         if (deepFetch) {
           meta = await provider.v2GetMeta({
             source, name, version: v, profileHash: hash, awsProfile, token,
           });
+          // S1: surface signer identity per profile when an attestation
+          // exists. We don't fully VERIFY here (`wyvrnpm show` is a
+          // read-only registry query, not a download path) — just parse
+          // the envelope so the user knows whose signature shipped.
+          // Verification still runs on `wyvrnpm install` per mode.json.
+          try {
+            const sigBytes = await provider.v2GetSignature({
+              source, name, version: v, profileHash: hash, awsProfile, token,
+            });
+            if (sigBytes) {
+              const env = JSON.parse(sigBytes.toString('utf8'));
+              signing = { signed: true, keyId: env.keyId ?? null, alg: env.alg ?? null };
+            }
+          } catch { /* malformed sig is non-fatal here — install will catch */ }
+
           if (!jsonOut) {
             if (meta?.uploadedBy) {
               console.log(`      origin  : consumer upload (${meta.uploadedBy.kind})`);
@@ -159,6 +175,12 @@ async function show(argv) {
             if (meta?.publishedConf && Object.keys(meta.publishedConf).length > 0) {
               console.log(`      conf    : ${JSON.stringify(meta.publishedConf)}`);
             }
+            // S1 — surface signer (informational; install still verifies).
+            if (signing.signed) {
+              console.log(`      signed  : ${signing.keyId} [${signing.alg}]`);
+            } else if (deepFetch) {
+              console.log(`      signed  : (unsigned)`);
+            }
           }
         }
 
@@ -172,6 +194,7 @@ async function show(argv) {
           compatibility:   meta?.compatibility ?? null,
           declaredOptions: meta?.options       ?? null,
           publishedConf:   meta?.publishedConf ?? null,
+          signing,
         });
       }