wyvrnpm 2.12.2 → 2.13.11

package/src/commands/trust.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const { getProvider }  = require('../providers');
+const { readConfig }   = require('../config');
+const { resolveSourceAuth } = require('../auth');
+const trust            = require('../signing/trust');
+const log              = require('../logger');
+
+/**
+ * Resolve a `--source` argument (URL or configured-source name) against
+ * `installSources` first then `publishSources`. Trust anchors live with
+ * the registry, not the consumer's view of it; both side's source lists
+ * point at the same buckets, so accepting either is the right UX.
+ */
+function resolveTrustSource(argv) {
+  const config = readConfig();
+  const all = [...(config.installSources ?? []), ...(config.publishSources ?? [])];
+  let arg = argv.source;
+  if (!arg && all.length === 1) arg = all[0].name;
+  if (!arg) {
+    log.error(
+      'specify a source: `wyvrnpm trust <cmd> --source <name|url>` ' +
+      '(or configure exactly one installSources entry)',
+    );
+    process.exit(1);
+  }
+  const named = all.find((s) => s.name === arg);
+  if (named) return { source: named.url, sourceEntry: named, awsProfile: argv.awsProfile ?? named.profile };
+  return { source: arg, sourceEntry: null, awsProfile: argv.awsProfile };
+}
+
+/**
+ * `wyvrnpm trust list [--source <name|url>] [--format json]`
+ *
+ * Prints the locally-cached trust anchor for a registry. Read-only —
+ * does NOT fetch. Pair with `trust refresh` when stale.
+ */
+async function list(argv) {
+  const { source } = resolveTrustSource(argv);
+  const keys = trust.readCachedKeys(source);
+  const mode = trust.readCachedMode(source);
+  const ageMs = trust.getCacheAgeMs(source);
+
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'trust list',
+      wyvrnpmVersion: require('../../package.json').version,
+      source,
+      keys, mode,
+      cacheAgeMs:     Number.isFinite(ageMs) ? ageMs : null,
+      fresh:          trust.isCacheFresh(source),
+    }, null, 2) + '\n');
+    return;
+  }
+
+  if (!keys && !mode) {
+    log.warn(`no cached trust anchor for ${source}. Run \`wyvrnpm trust refresh --source ${argv.source ?? source}\` to fetch.`);
+    return;
+  }
+
+  console.log(`Trust anchor for ${source}`);
+  console.log(`  cached    : ${Number.isFinite(ageMs) ? `${Math.round(ageMs / 1000)}s ago` : 'unknown'}`);
+  console.log(`  mode      : ${mode?.mode ?? '(none — defaults to off)'}`);
+  console.log(`  keys      : ${keys?.keys?.length ?? 0}`);
+  for (const k of keys?.keys ?? []) {
+    const status = k.retiredAt ? `retired ${k.retiredAt}` : 'active';
+    console.log(`    - ${k.id} [${k.alg}] ${status} ${k.identityHint ? `(${k.identityHint})` : ''}`);
+  }
+}
+
+/**
+ * `wyvrnpm trust refresh [--source <name|url>] [--format json]`
+ *
+ * Fetch `.trust/keys.json` and `.trust/mode.json` from the registry.
+ * TOFU diff classification:
+ *   - `first-fetch` / `unchanged` / `additive` → cache + accept silently
+ *     (additive logs the new keyIds).
+ *   - `breaking`                               → DO NOT cache; print diff
+ *     and exit 1. The user must re-run with `--accept-breaking` to pin
+ *     the new state. (Phase 2 will require a root-key signature instead.)
+ */
+async function refresh(argv) {
+  const { source, sourceEntry, awsProfile } = resolveTrustSource(argv);
+  const { token } = resolveSourceAuth({}, sourceEntry);
+
+  let provider;
+  try { provider = getProvider(source); }
+  catch (err) { log.error(`no provider for ${source}: ${err.message}`); process.exit(1); }
+
+  const fetched = await provider.v2GetTrustAnchor({ source, awsProfile, token });
+  if (!fetched) {
+    log.warn(`no .trust/ directory found at ${source} — registry has not adopted S1 (mode=off)`);
+    if (argv.format === 'json') {
+      process.stdout.write(JSON.stringify({ command: 'trust refresh', source, found: false }, null, 2) + '\n');
+    }
+    return;
+  }
+
+  const cached = trust.readCachedKeys(source);
+  const diff   = fetched.keys ? trust.diffKeys(cached, fetched.keys) : { kind: 'unchanged' };
+
+  if (diff.kind === 'breaking' && !argv.acceptBreaking) {
+    log.error(
+      `trust anchor at ${source} changed in a non-additive way:\n` +
+      `  removed: ${diff.removedIds.join(', ') || '(none)'}\n` +
+      `  modified: ${diff.modifiedIds.join(', ') || '(none)'}\n` +
+      `  added: ${diff.addedIds.join(', ') || '(none)'}\n` +
+      'Re-run with --accept-breaking to overwrite the cache. Phase 2 will require a root-key signature instead.',
+    );
+    process.exit(1);
+  }
+
+  trust.writeCache(source, { keys: fetched.keys ?? undefined, mode: fetched.mode ?? undefined });
+
+  if (argv.format === 'json') {
+    process.stdout.write(JSON.stringify({
+      command:        'trust refresh',
+      wyvrnpmVersion: require('../../package.json').version,
+      source,
+      diff,
+      keys:           fetched.keys,
+      mode:           fetched.mode,
+    }, null, 2) + '\n');
+    return;
+  }
+
+  log.success(`refreshed trust anchor for ${source} (${diff.kind})`);
+  if (diff.kind === 'additive') {
+    log.info(`  added keys : ${diff.addedIds.join(', ')}`);
+  } else if (diff.kind === 'breaking') {
+    log.warn(`  breaking diff accepted: -${diff.removedIds.length} ~${diff.modifiedIds.length} +${diff.addedIds.length}`);
+  }
+  log.info(`  mode       : ${fetched.mode?.mode ?? '(none — defaults to off)'}`);
+}
+
+module.exports = { list, refresh, resolveTrustSource };

package/src/conf/index.js

@@ -21,14 +21,29 @@ const { validateFlatConfKeys } = require('./namespaces');
 
 const LOCAL_OVERLAY_FILENAME = 'wyvrn.local.json';
 
-// Per plan §4.5 "Strict top-level allow-list". Two top-level keys
-// today:
-//   - `conf`           — non-ABI build-time knobs (PLAN-CONF.md).
-//   - `binaryDirRoot`  — dev-local override of the preset's build
-//                        subdir (sibling channel to --build-dir on
-//                        install/build). See src/binary-dir.js.
+// Per plan §4.5 "Strict top-level allow-list". Top-level keys today:
+//   - `conf`              — non-ABI build-time knobs (PLAN-CONF.md).
+//   - `binaryDirRoot`     — dev-local override of the preset's build
+//                           subdir (sibling channel to --build-dir on
+//                           install/build). See src/binary-dir.js.
+//   - `requestConfigs`    — global per-config artefact selection;
+//                           dev-local / runner-local default. Array of
+//                           CMake config names; intersected with the
+//                           author's `artefactConfigs` at install time.
+//   - `depRequestConfigs` — per-dep override of `requestConfigs`. Map
+//                           of `{ <depName>: [<config>, ...] }`. When a
+//                           dep is named here, the listed configs apply
+//                           to it ONLY; everything else inherits the
+//                           global `requestConfigs`. Use case: "fetch
+//                           all four configs of fmt + zlib, but only
+//                           MinSizeRel of the multi-GB grpc."
 // Adding dependencies/options/etc. is plan-2 territory.
-const LOCAL_OVERLAY_ALLOWED_TOP_KEYS = new Set(['conf', 'binaryDirRoot']);
+const LOCAL_OVERLAY_ALLOWED_TOP_KEYS = new Set([
+  'conf',
+  'binaryDirRoot',
+  'requestConfigs',
+  'depRequestConfigs',
+]);
 
 // ---------------------------------------------------------------------------
 // Value normalisation
@@ -203,11 +218,24 @@ function parseCliConf(rawArgs) {
  * phase 1 is `conf`; anything else is a hard error (not a warning).
  *
  * @param {string} rootDir
- * @returns {{ flat: Record<string,string>, path: string|null, binaryDirRoot: string|null }}
+ * @returns {{
+ *   flat:               Record<string,string>,
+ *   path:               string|null,
+ *   binaryDirRoot:      string|null,
+ *   requestConfigs:     string[]|null,
+ *   depRequestConfigs:  Record<string, string[]>|null,
+ * }}
  */
 function readLocalOverlay(rootDir) {
   const p = path.join(rootDir, LOCAL_OVERLAY_FILENAME);
-  if (!fs.existsSync(p)) return { flat: {}, path: null, binaryDirRoot: null };
+  if (!fs.existsSync(p)) {
+    return {
+      flat: {}, path: null,
+      binaryDirRoot:     null,
+      requestConfigs:    null,
+      depRequestConfigs: null,
+    };
+  }
 
   let raw;
   try {
@@ -243,7 +271,84 @@ function readLocalOverlay(rootDir) {
     ? raw.binaryDirRoot
     : null;
 
-  return { flat, path: p, binaryDirRoot };
+  // `requestConfigs` shape-validates here; intersection with the
+  // author's `artefactConfigs` happens in download.js. Custom CMake
+  // configs (e.g. "Profile") are intentionally permitted — the
+  // intersection will reject unknown names with a clear diagnostic
+  // listing what the author actually published.
+  let requestConfigs = null;
+  if (Object.prototype.hasOwnProperty.call(raw, 'requestConfigs')) {
+    const v = raw.requestConfigs;
+    if (!Array.isArray(v)) {
+      throw new Error(
+        `${LOCAL_OVERLAY_FILENAME}: requestConfigs must be an array of CMake config names — ` +
+        `got ${JSON.stringify(v)}`,
+      );
+    }
+    if (v.length === 0) {
+      throw new Error(
+        `${LOCAL_OVERLAY_FILENAME}: requestConfigs must not be empty — ` +
+        `omit the key to inherit the recipe's build.configs`,
+      );
+    }
+    for (const entry of v) {
+      if (typeof entry !== 'string' || entry.trim() !== entry || entry.length === 0) {
+        throw new Error(
+          `${LOCAL_OVERLAY_FILENAME}: requestConfigs entries must be non-empty trimmed strings — ` +
+          `got ${JSON.stringify(entry)}`,
+        );
+      }
+    }
+    requestConfigs = v.slice();
+  }
+
+  // `depRequestConfigs` shape-validates here. Each entry is the same
+  // array-of-config-names contract as `requestConfigs`; the dep-name
+  // key is intentionally NOT validated against any registered package
+  // list — names are resolved at install time and a typo just means
+  // "no override applies" (with the global `requestConfigs` taking over).
+  let depRequestConfigs = null;
+  if (Object.prototype.hasOwnProperty.call(raw, 'depRequestConfigs')) {
+    const map = raw.depRequestConfigs;
+    if (map === null || typeof map !== 'object' || Array.isArray(map)) {
+      throw new Error(
+        `${LOCAL_OVERLAY_FILENAME}: depRequestConfigs must be an object keyed by dep name — ` +
+        `got ${JSON.stringify(map)}`,
+      );
+    }
+    const out = {};
+    for (const [depName, val] of Object.entries(map)) {
+      if (typeof depName !== 'string' || depName.trim() !== depName || depName.length === 0) {
+        throw new Error(
+          `${LOCAL_OVERLAY_FILENAME}: depRequestConfigs key ${JSON.stringify(depName)} must be a non-empty trimmed string`,
+        );
+      }
+      if (!Array.isArray(val)) {
+        throw new Error(
+          `${LOCAL_OVERLAY_FILENAME}: depRequestConfigs[${JSON.stringify(depName)}] must be an array of CMake config names — ` +
+          `got ${JSON.stringify(val)}`,
+        );
+      }
+      if (val.length === 0) {
+        throw new Error(
+          `${LOCAL_OVERLAY_FILENAME}: depRequestConfigs[${JSON.stringify(depName)}] must not be empty — ` +
+          `omit the entry to inherit the global requestConfigs`,
+        );
+      }
+      for (const entry of val) {
+        if (typeof entry !== 'string' || entry.trim() !== entry || entry.length === 0) {
+          throw new Error(
+            `${LOCAL_OVERLAY_FILENAME}: depRequestConfigs[${JSON.stringify(depName)}] entries must be non-empty trimmed strings — ` +
+            `got ${JSON.stringify(entry)}`,
+          );
+        }
+      }
+      out[depName] = val.slice();
+    }
+    depRequestConfigs = out;
+  }
+
+  return { flat, path: p, binaryDirRoot, requestConfigs, depRequestConfigs };
 }
 
 // ---------------------------------------------------------------------------
@@ -356,7 +461,13 @@ function resolveEffectiveConf({ manifest, rootDir, cliConf, profile }) {
   const recipeFlat  = readRecipeConf(manifest);
   const profileFlat = readProfileConf(profile);
   const overlay = readLocalOverlay(rootDir);
-  const { flat: localFlat, path: localOverlayPath, binaryDirRoot: localBinaryDirRoot } = overlay;
+  const {
+    flat: localFlat,
+    path: localOverlayPath,
+    binaryDirRoot:     localBinaryDirRoot,
+    requestConfigs:    localRequestConfigs,
+    depRequestConfigs: localDepRequestConfigs,
+  } = overlay;
   const cli = parseCliConf(cliConf);
   const flat = mergeConfLayers(recipeFlat, localFlat, cli, profileFlat);
   return {
@@ -370,6 +481,15 @@ function resolveEffectiveConf({ manifest, rootDir, cliConf, profile }) {
     // re-reading the overlay file. Validated downstream — this just
     // forwards the raw value the user wrote.
     localBinaryDirRoot,
+    // Forwarded for the per-config slice resolver in install.js. Null
+    // when the overlay omits it; the resolver falls through to recipe
+    // build.configs in that case.
+    localRequestConfigs,
+    // Per-dep override of the slice resolver. Map of `{ depName: [...] }`.
+    // When a dep is named here, those configs apply to it specifically;
+    // otherwise the global `localRequestConfigs` (or its fallback chain)
+    // takes over.
+    localDepRequestConfigs,
   };
 }
 

package/src/config.js

@@ -26,12 +26,21 @@ function getConfigPath() {
 /**
  * Read and parse config.json.
  * Returns a default empty config if the file doesn't exist yet.
- * @returns {{ installSources: SourceEntry[], publishSources: SourceEntry[], linkedPackages: Object<string, string>, defaultProfile: string }}
+ * @returns {{
+ *   installSources: SourceEntry[],
+ *   publishSources: SourceEntry[],
+ *   linkedPackages: Object<string, string>,
+ *   defaultProfile: string,
+ *   defaultSigning: SigningConfig|null,
+ * }}
  */
 function readConfig() {
   const configPath = getConfigPath();
   if (!fs.existsSync(configPath)) {
-    return { installSources: [], publishSources: [], linkedPackages: {}, defaultProfile: 'default' };
+    return {
+      installSources: [], publishSources: [], linkedPackages: {},
+      defaultProfile: 'default', defaultSigning: null,
+    };
   }
   try {
     const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
@@ -41,10 +50,19 @@ function readConfig() {
       linkedPackages: raw.linkedPackages  ?? {},
       // Migrate: if old config had an inline `profile` object, drop it; use file-based profiles.
       defaultProfile: raw.defaultProfile  ?? 'default',
+      // S1: optional signing config, never auto-populated. Each
+      // installSources / publishSources entry MAY also carry `signing`
+      // (publish-side) and `trustRootPub` (install-side, phase 2)
+      // overrides; consumers consult the per-source value first and
+      // fall back to defaultSigning.
+      defaultSigning: raw.defaultSigning  ?? null,
     };
   } catch {
     log.warn('could not parse config.json — using defaults');
-    return { installSources: [], publishSources: [], linkedPackages: {}, defaultProfile: 'default' };
+    return {
+      installSources: [], publishSources: [], linkedPackages: {},
+      defaultProfile: 'default', defaultSigning: null,
+    };
   }
 }
 
@@ -61,5 +79,18 @@ function writeConfig(config) {
 module.exports = { getConfigDir, getConfigPath, readConfig, writeConfig };
 
 /**
- * @typedef {{ name: string, url: string, profile?: string, token?: string }} SourceEntry
+ * @typedef {{ name: string, url: string, profile?: string, token?: string, signing?: SigningConfig, trustRootPub?: string }} SourceEntry
+ *
+ * @typedef {{
+ *   alg:        'ed25519',
+ *   keyId:      string,
+ *   privateKey: { env: string } | { file: string },
+ * }} SigningConfig
+ *
+ * `signing` on a publishSources entry overrides `defaultSigning` for that
+ * specific destination; useful when one team-shared registry uses a
+ * different keyId from another. `trustRootPub` on an installSources entry
+ * (phase 2) carries an SPKI-PEM root key pinned by the consumer; the
+ * registry's keys.json will then need to be signed by that root for the
+ * install to accept rotations.
  */