wyvrnpm 2.12.2 → 2.13.11

package/src/providers/base.js

@@ -12,13 +12,24 @@
  *  v1 (legacy):  {source}/{platform}/{name}/{version}/wyvrn.{json,zip}
  *                {source}/{platform}/{name}/latest.json
  *
- *  v2:           {source}/v2/{name}/{version}/{profileHash}/wyvrn.{json,zip}
+ *  v2:           {source}/v2/{name}/{version}/{profileHash}/wyvrn.json
+ *                {source}/v2/{name}/{version}/{profileHash}/wyvrn.zip            (fat-zip publish, default)
+ *                {source}/v2/{name}/{version}/{profileHash}/wyvrn-<Config>.zip   (per-config slice publish — recipe build.publishPerConfig: true)
+ *                {source}/v2/{name}/{version}/{profileHash}/wyvrn.att.json       (S1)
+ *                {source}/v2/{name}/{version}/{profileHash}/wyvrn.sig            (S1)
  *                {source}/v2/{name}/{version}/source.json
  *                {source}/v2/{name}/versions.json
  *                {source}/v2/{name}/latest.json
+ *                {source}/v2/.trust/keys.json                                    (S1)
+ *                {source}/v2/.trust/mode.json                                    (S1)
  *
  * Publishing with v2 tooling writes both v2 AND v1 paths by default so that
  * v1 clients can still consume the packages.
+ *
+ * The signing files (`wyvrn.att.json` + `wyvrn.sig`) and the per-registry
+ * trust anchor (`.trust/`) are additive — pre-S1 clients ignore them and
+ * S1 clients treat their absence as `mode: off` (CLAUDE.md §8.S1 +
+ * claude/PLAN-SIGNING.md / echo-off-setlocal-velvet-lagoon plan).
  */
 class BaseProvider {
   /**
@@ -84,20 +95,47 @@ class BaseProvider {
    * (author publish); populated by the upload-built flow. Readers ignore
    * the field — it is informational only.
    *
-   * @param {{ manifest: string, zip: string }} files  - local file paths
+   * `files` may also carry `attPath` and `sigPath` — paths to the
+   * `wyvrn.att.json` (signed attestation body) and `wyvrn.sig` (detached
+   * signature envelope) produced by the publish flow's signing tail. Both
+   * optional; when present the provider MUST upload them in the order
+   * `zip(s) → manifest → att → sig → versions.json` so a partial-failure
+   * crash never leaves a sig-less entry visible in versions.json
+   * (claude/echo-off-setlocal-velvet-lagoon §3 + Risks §write-order).
+   *
+   * Per-config slicing (recipe `build.publishPerConfig: true`):
+   *   `options.artefactConfigs: { config → { sha256, sizeBytes } }` and
+   *   `files.artefactZips: { config → path }` together replace the single
+   *   `files.zip` upload. The provider uploads each slice as
+   *   `wyvrn-<Config>.zip` and emits a `configs` array (instead of
+   *   `contentSha256`) into the versions.json profile entry + latest.json.
+   *   `options.contentSha256` is null/absent in this branch — the
+   *   per-slice SHAs live in the published manifest's `artefactConfigs`
+   *   block (canonical source of truth) and in the v2 attestation's
+   *   `artefactSha256` field. Pre-feature publishes (no
+   *   `artefactConfigs`) take the byte-identical legacy path.
+   *
+   * @param {{
+   *   manifest:      string,
+   *   zip?:          string,
+   *   artefactZips?: Record<string, string>,
+   *   attPath?:      string,
+   *   sigPath?:      string,
+   * }} files
    * @param {{
-   *   source:        string,
-   *   name:          string,
-   *   version:       string,
-   *   profileHash:   string,
-   *   buildSettings: import('../profile').WyvrnProfile,  // stored in metadata for debugging
-   *   contentSha256: string,
-   *   gitSha:        string|null,
-   *   gitRepo:       string|null,
-   *   updateLatest?: boolean,       // default true; false for upload-built
-   *   uploadedBy?:   object,        // optional provenance block, written into wyvrn.json
-   *   awsProfile?:   string,
-   *   token?:        string,
+   *   source:           string,
+   *   name:             string,
+   *   version:          string,
+   *   profileHash:      string,
+   *   buildSettings:    import('../profile').WyvrnProfile,  // stored in metadata for debugging
+   *   contentSha256?:   string,                              // fat-zip publishes only
+   *   artefactConfigs?: Record<string, { sha256: string, sizeBytes: number }>,  // slice publishes only
+   *   gitSha:           string|null,
+   *   gitRepo:          string|null,
+   *   updateLatest?:    boolean,       // default true; false for upload-built
+   *   uploadedBy?:      object,        // optional provenance block, written into wyvrn.json
+   *   awsProfile?:      string,
+   *   token?:           string,
    * }} options
    * @returns {Promise<void>}
    */
@@ -105,6 +143,49 @@ class BaseProvider {
     throw new Error(`v2Publish() is not implemented in ${this.constructor.name}`);
   }
 
+  /**
+   * Fetch the signed attestation body (`wyvrn.att.json`) for a v2 build.
+   * Returns the raw bytes (as a Buffer) so the verifier sees exactly what
+   * the publisher signed — never a JSON.parse → JSON.stringify round trip,
+   * which would re-canonicalise and could change byte content.
+   *
+   * Returns null when the file does not exist (registry hasn't adopted S1,
+   * or this build was published with `--no-sign`).
+   *
+   * @param {{ source: string, name: string, version: string, profileHash: string, awsProfile?: string, token?: string }} _options
+   * @returns {Promise<Buffer|null>}
+   */
+  async v2GetAttestation(_options) {
+    return null;
+  }
+
+  /**
+   * Fetch the signature envelope (`wyvrn.sig`) for a v2 build. Same
+   * Buffer-not-parsed contract as `v2GetAttestation`.
+   *
+   * @param {{ source: string, name: string, version: string, profileHash: string, awsProfile?: string, token?: string }} _options
+   * @returns {Promise<Buffer|null>}
+   */
+  async v2GetSignature(_options) {
+    return null;
+  }
+
+  /**
+   * Fetch the per-registry trust anchor: `.trust/keys.json` and
+   * `.trust/mode.json`. Returns `{ keys, mode }` as parsed objects, or
+   * `null` when the registry has no `.trust/` directory at all (treated
+   * as mode `off` by the install flow — current behaviour).
+   *
+   * Either inner field may itself be null if only one of the two files
+   * exists (mid-rollout state). Callers default missing `mode` to `off`.
+   *
+   * @param {{ source: string, awsProfile?: string, token?: string }} _options
+   * @returns {Promise<{ keys: object|null, mode: object|null }|null>}
+   */
+  async v2GetTrustAnchor(_options) {
+    return null;
+  }
+
   /**
    * Fetch the wyvrn.json metadata object for a specific v2 build.
    * Returns null if the build does not exist.
@@ -130,7 +211,21 @@ class BaseProvider {
   /**
    * Download the prebuilt binary zip for a specific v2 build to destPath.
    *
-   * @param {{ source: string, name: string, version: string, profileHash: string, awsProfile?: string, token?: string }} options
+   * For per-config slice publishes, set `options.sliceConfig` to the
+   * canonical CMake config name (e.g. `"Release"`). The provider downloads
+   * `wyvrn-<sliceConfig>.zip` instead of the fat `wyvrn.zip`. When unset,
+   * downloads the fat `wyvrn.zip` (today's path, byte-identical for
+   * pre-feature publishes).
+   *
+   * @param {{
+   *   source:       string,
+   *   name:         string,
+   *   version:      string,
+   *   profileHash:  string,
+   *   sliceConfig?: string,
+   *   awsProfile?:  string,
+   *   token?:       string,
+   * }} options
    * @param {string} destPath  - absolute path to write the zip to
    * @param {number} timeoutMs
    * @returns {Promise<boolean>}  true on success

package/src/providers/file.js

@@ -91,35 +91,62 @@ class FileProvider extends BaseProvider {
   async v2Publish(files, options) {
     const {
       source, name, version, profileHash, buildSettings,
-      contentSha256, gitSha, gitRepo, publishedLock,
-      updateLatest = true, uploadedBy,
+      contentSha256, gitSha, gitRepo,
+      updateLatest = true,
+      artefactConfigs,
     } = options;
+    // `publishedLock` and `uploadedBy` are no longer consumed here —
+    // both are baked into `files.manifest` by the publisher (via
+    // src/v2-meta.js) before this call. They remain in the v2Publish
+    // contract on BaseProvider only for backward compatibility.
 
     const v2root    = this._v2Root(source, name);
     const buildDir  = path.join(v2root, version, profileHash);
     fs.mkdirSync(buildDir, { recursive: true });
 
-    // 1) zip
-    this._copy(files.zip, path.join(buildDir, 'wyvrn.zip'));
-
-    // 2) enriched wyvrn.json (buildSettings stored for debugging only)
-    //    Dependencies are published verbatim from wyvrn.json — ranges stay as
-    //    ranges so consumers can intersect them with their own. The author's
-    //    lockfile snapshot is preserved in `publishedLock` for audit.
-    const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
-    const v2Meta = {
-      ...rawManifest,
-      schemaVersion: 2,
-      profileHash,
-      buildSettings,
-      contentSha256,
-      gitSha:      gitSha  ?? null,
-      gitRepo:     gitRepo ?? null,
-      publishedAt: new Date().toISOString(),
-      ...(publishedLock && Object.keys(publishedLock).length > 0 ? { publishedLock } : {}),
-      ...(uploadedBy ? { uploadedBy } : {}),
-    };
-    this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);
+    // Slice publish iff artefactConfigs is supplied non-empty. List the
+    // configs in alphabetical order so versions.json round-trips
+    // deterministically across publishers.
+    const sliceConfigs =
+      (artefactConfigs && Object.keys(artefactConfigs).length > 0)
+        ? Object.keys(artefactConfigs).sort()
+        : null;
+
+    // 1) zip(s) — fat or per-config slices
+    if (sliceConfigs) {
+      if (!files.artefactZips || typeof files.artefactZips !== 'object') {
+        throw new Error('v2Publish: artefactConfigs supplied but files.artefactZips missing');
+      }
+      for (const config of sliceConfigs) {
+        const slicePath = files.artefactZips[config];
+        if (!slicePath) {
+          throw new Error(
+            `v2Publish: artefactConfigs declares "${config}" but files.artefactZips["${config}"] is missing`,
+          );
+        }
+        this._copy(slicePath, path.join(buildDir, `wyvrn-${config}.zip`));
+      }
+    } else {
+      if (!files.zip) {
+        throw new Error('v2Publish: files.zip required for fat-zip publish (or pass artefactConfigs + files.artefactZips for slice publish)');
+      }
+      this._copy(files.zip, path.join(buildDir, 'wyvrn.zip'));
+    }
+
+    // 2) wyvrn.json — uploaded VERBATIM from `files.manifest`. The
+    //    publisher (commands/publish.js, upload-built.js) builds the v2Meta
+    //    body via src/v2-meta.js so its signed manifestSha256 matches
+    //    exactly what consumers compute from v2GetMeta. Providers MUST
+    //    NOT mutate the manifest here — that would invalidate every
+    //    signature.
+    this._copy(files.manifest, path.join(buildDir, 'wyvrn.json'));
+
+    // 2.5) signing files (S1) — written between manifest and versions.json
+    //      so a partial-failure crash never leaves a sig-less entry visible
+    //      in versions.json. Both files optional; when absent the registry's
+    //      mode.json governs whether consumers warn or abort.
+    if (files.attPath) this._copy(files.attPath, path.join(buildDir, 'wyvrn.att.json'));
+    if (files.sigPath) this._copy(files.sigPath, path.join(buildDir, 'wyvrn.sig'));
 
     // 3) source.json
     if (gitSha || gitRepo) {
@@ -130,16 +157,23 @@ class FileProvider extends BaseProvider {
       });
     }
 
-    // 4) versions.json index
+    // 4) versions.json index. Per-profile entries hold either
+    //    `contentSha256` (fat zip) or `configs` (slice publish);
+    //    both fields can coexist for hybrid publishes but phase 1
+    //    emits one or the other.
     const versionsPath = path.join(v2root, 'versions.json');
     let versionsIdx = this._readJson(versionsPath) ?? { name, latest: version, versions: {} };
     if (!versionsIdx.versions) versionsIdx.versions = {};
     if (!versionsIdx.versions[version]) versionsIdx.versions[version] = { profiles: {} };
-    versionsIdx.versions[version].profiles[profileHash] = {
-      contentSha256,
+
+    const profileEntry = {
       publishedAt: new Date().toISOString(),
       buildSettings,
     };
+    if (sliceConfigs) profileEntry.configs       = sliceConfigs;
+    else              profileEntry.contentSha256 = contentSha256;
+    versionsIdx.versions[version].profiles[profileHash] = profileEntry;
+
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
@@ -149,7 +183,10 @@ class FileProvider extends BaseProvider {
     // 5) v2 latest.json — skipped for consumer uploads (upload-built) so a
     //    historical-version rebuild cannot clobber the real "latest" pointer.
     if (updateLatest) {
-      this._writeJson(path.join(v2root, 'latest.json'), { version, profileHash, contentSha256 });
+      const latestEntry = { version, profileHash };
+      if (sliceConfigs) latestEntry.configs       = sliceConfigs;
+      else              latestEntry.contentSha256 = contentSha256;
+      this._writeJson(path.join(v2root, 'latest.json'), latestEntry);
     }
   }
 
@@ -162,12 +199,36 @@ class FileProvider extends BaseProvider {
     return this._readJson(path.join(this._v2Root(source, name), 'versions.json'));
   }
 
-  async v2DownloadZip({ source, name, version, profileHash }, destPath) {
-    const src = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.zip');
+  async v2DownloadZip({ source, name, version, profileHash, sliceConfig }, destPath) {
+    const filename = sliceConfig ? `wyvrn-${sliceConfig}.zip` : 'wyvrn.zip';
+    const src = path.join(this._v2Root(source, name), version, profileHash, filename);
     if (!fs.existsSync(src)) return false;
     fs.copyFileSync(src, destPath);
     return true;
   }
+
+  // ── S1 signing surface ────────────────────────────────────────────────────
+
+  async v2GetAttestation({ source, name, version, profileHash }) {
+    const p = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.att.json');
+    if (!fs.existsSync(p)) return null;
+    return fs.readFileSync(p);   // raw bytes — verifier needs them unmodified
+  }
+
+  async v2GetSignature({ source, name, version, profileHash }) {
+    const p = path.join(this._v2Root(source, name), version, profileHash, 'wyvrn.sig');
+    if (!fs.existsSync(p)) return null;
+    return fs.readFileSync(p);
+  }
+
+  async v2GetTrustAnchor({ source }) {
+    const trustDir = path.join(this._resolvePath(source), 'v2', '.trust');
+    if (!fs.existsSync(trustDir)) return null;
+    return {
+      keys: this._readJson(path.join(trustDir, 'keys.json')),
+      mode: this._readJson(path.join(trustDir, 'mode.json')),
+    };
+  }
 }
 
 module.exports = FileProvider;

package/src/providers/http.js

@@ -123,6 +123,37 @@ class HttpProvider extends BaseProvider {
     });
   }
 
+  /**
+   * GET url → raw bytes (Buffer), or null on 404 / error. Used for the
+   * S1 attestation + signature fetches where the verifier must see the
+   * exact bytes the publisher signed (any JSON.parse → JSON.stringify
+   * round-trip would re-canonicalise and could change content).
+   */
+  _getBytes(url, token) {
+    return new Promise((resolve) => {
+      const parsed = new URL(url);
+      const headers = { 'User-Agent': USER_AGENT };
+      if (token) headers['Authorization'] = `Bearer ${token}`;
+      const req = this._lib(url).request(
+        { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'GET', headers },
+        (res) => {
+          if (res.statusCode === 404) { res.resume(); resolve(null); return; }
+          if (res.statusCode < 200 || res.statusCode >= 300) {
+            log.warn(`HTTP GET ${url} → ${res.statusCode}; treating as missing`);
+            res.resume();
+            resolve(null);
+            return;
+          }
+          const chunks = [];
+          res.on('data', (c) => chunks.push(c));
+          res.on('end', () => resolve(Buffer.concat(chunks)));
+        },
+      );
+      req.on('error', () => resolve(null));
+      req.end();
+    });
+  }
+
   /** GET url → stream download to destPath. Returns true on success. */
   async _download(url, destPath, token, timeoutMs) {
     const controller = new AbortController();
@@ -174,41 +205,57 @@ class HttpProvider extends BaseProvider {
   async v2Publish(files, options) {
     const {
       source, name, version, profileHash, buildSettings,
-      contentSha256, gitSha, gitRepo, publishedLock, token,
-      updateLatest = true, uploadedBy,
+      contentSha256, gitSha, gitRepo, token,
+      updateLatest = true,
+      artefactConfigs,
     } = options;
     const base   = source.replace(/\/$/, '');
     const v2root = `${base}/v2/${name}`;
     const buildRoot = `${v2root}/${version}/${profileHash}`;
 
-    // 1) Upload the binary zip
-    await this._put(`${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', token);
-
-    // 2) Upload enriched wyvrn.json (original manifest + v2 metadata).
-    //    buildSettings is stored for debugging purposes only — not for configuration.
-    //    Dependencies are published verbatim from wyvrn.json — ranges stay as
-    //    ranges so consumers can intersect them with their own. The author's
-    //    lockfile snapshot is preserved in `publishedLock` for audit.
-    const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
-    const v2Meta = {
-      ...rawManifest,
-      schemaVersion: 2,
-      profileHash,
-      buildSettings,     // copy of the profile used — for debugging
-      contentSha256,
-      gitSha:      gitSha  ?? null,
-      gitRepo:     gitRepo ?? null,
-      publishedAt: new Date().toISOString(),
-      ...(publishedLock && Object.keys(publishedLock).length > 0 ? { publishedLock } : {}),
-      ...(uploadedBy ? { uploadedBy } : {}),
-    };
-    await this._putBuffer(
+    const sliceConfigs =
+      (artefactConfigs && Object.keys(artefactConfigs).length > 0)
+        ? Object.keys(artefactConfigs).sort()
+        : null;
+
+    // 1) Upload the binary zip(s) — fat or per-config slices.
+    if (sliceConfigs) {
+      if (!files.artefactZips || typeof files.artefactZips !== 'object') {
+        throw new Error('v2Publish: artefactConfigs supplied but files.artefactZips missing');
+      }
+      for (const config of sliceConfigs) {
+        const slicePath = files.artefactZips[config];
+        if (!slicePath) {
+          throw new Error(
+            `v2Publish: artefactConfigs declares "${config}" but files.artefactZips["${config}"] is missing`,
+          );
+        }
+        await this._put(`${buildRoot}/wyvrn-${config}.zip`, slicePath, 'application/zip', token);
+      }
+    } else {
+      if (!files.zip) {
+        throw new Error('v2Publish: files.zip required for fat-zip publish');
+      }
+      await this._put(`${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', token);
+    }
+
+    // 2) Upload wyvrn.json VERBATIM from `files.manifest`. The publisher
+    //    (commands/publish.js, upload-built.js) builds the v2Meta body
+    //    via src/v2-meta.js so the signed manifestSha256 matches what
+    //    consumers compute from v2GetMeta. Providers MUST NOT mutate.
+    await this._put(
       `${buildRoot}/wyvrn.json`,
-      Buffer.from(JSON.stringify(v2Meta, null, 2)),
+      files.manifest,
       'application/json',
       token,
     );
 
+    // 2.5) signing files (S1) — written between manifest and versions.json
+    //      so a partial-failure crash never leaves a sig-less entry visible
+    //      in versions.json. Both files optional; mode.json governs.
+    if (files.attPath) await this._put(`${buildRoot}/wyvrn.att.json`, files.attPath, 'application/json', token);
+    if (files.sigPath) await this._put(`${buildRoot}/wyvrn.sig`,      files.sigPath, 'application/json', token);
+
     // 3) Upload source.json (git metadata for build-from-source)
     if (gitSha || gitRepo) {
       const srcMeta = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
@@ -220,17 +267,23 @@ class HttpProvider extends BaseProvider {
       );
     }
 
-    // 4) Read-modify-write versions.json index (non-atomic, best-effort)
+    // 4) Read-modify-write versions.json index (non-atomic, best-effort).
+    //    Per-profile entries hold either `contentSha256` (fat zip) or
+    //    `configs` (slice publish).
     let versionsIdx = await this._getJson(`${v2root}/versions.json`, token) ?? {
       name, latest: version, versions: {},
     };
     if (!versionsIdx.versions) versionsIdx.versions = {};
     if (!versionsIdx.versions[version]) versionsIdx.versions[version] = { profiles: {} };
-    versionsIdx.versions[version].profiles[profileHash] = {
-      contentSha256,
+
+    const profileEntry = {
       publishedAt: new Date().toISOString(),
       buildSettings,
     };
+    if (sliceConfigs) profileEntry.configs       = sliceConfigs;
+    else              profileEntry.contentSha256 = contentSha256;
+    versionsIdx.versions[version].profiles[profileHash] = profileEntry;
+
     if (gitSha || gitRepo) {
       versionsIdx.versions[version].source = { gitRepo: gitRepo ?? null, gitSha: gitSha ?? null };
     }
@@ -244,9 +297,12 @@ class HttpProvider extends BaseProvider {
 
     // 5) v2 latest.json — skipped for consumer uploads (see FileProvider note).
     if (updateLatest) {
+      const latestEntry = { version, profileHash };
+      if (sliceConfigs) latestEntry.configs       = sliceConfigs;
+      else              latestEntry.contentSha256 = contentSha256;
       await this._putBuffer(
         `${v2root}/latest.json`,
-        Buffer.from(JSON.stringify({ version, profileHash, contentSha256 })),
+        Buffer.from(JSON.stringify(latestEntry)),
         'application/json',
         token,
       );
@@ -263,11 +319,32 @@ class HttpProvider extends BaseProvider {
     return this._getJson(`${base}/v2/${name}/versions.json`, token);
   }
 
-  async v2DownloadZip({ source, name, version, profileHash, token }, destPath, timeoutMs) {
-    const base = source.replace(/\/$/, '');
-    const url  = `${base}/v2/${name}/${version}/${profileHash}/wyvrn.zip`;
+  async v2DownloadZip({ source, name, version, profileHash, sliceConfig, token }, destPath, timeoutMs) {
+    const base     = source.replace(/\/$/, '');
+    const filename = sliceConfig ? `wyvrn-${sliceConfig}.zip` : 'wyvrn.zip';
+    const url      = `${base}/v2/${name}/${version}/${profileHash}/${filename}`;
     return this._download(url, destPath, token, timeoutMs);
   }
+
+  // ── S1 signing surface ────────────────────────────────────────────────────
+
+  async v2GetAttestation({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getBytes(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.att.json`, token);
+  }
+
+  async v2GetSignature({ source, name, version, profileHash, token }) {
+    const base = source.replace(/\/$/, '');
+    return this._getBytes(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.sig`, token);
+  }
+
+  async v2GetTrustAnchor({ source, token }) {
+    const base = source.replace(/\/$/, '');
+    const keys = await this._getJson(`${base}/v2/.trust/keys.json`, token);
+    const mode = await this._getJson(`${base}/v2/.trust/mode.json`, token);
+    if (keys === null && mode === null) return null;     // no .trust dir at all → mode off
+    return { keys, mode };
+  }
 }
 
 module.exports = HttpProvider;