wyvrnpm 2.12.3 → 2.13.11

package/README.md

@@ -4,7 +4,7 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.12.3** — Highlights since 2.8.3: profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
+> **README version: 2.13.0** — **New:** S1 artefact signing — Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`; `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`; `--require-signatures` on install, `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish; pure-Node `crypto` (no external tooling, identical on Windows / Linux / macOS). Closes S1 + S3. Highlights since 2.8.3: profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
 
 ---
 
@@ -335,6 +335,7 @@ wyvrnpm install --dry-run --format=json
 | `--dry-run` | `false` | Run the resolver + profile/options math, print the install plan, and exit. No download, no `wyvrn.lock`, no `wyvrn_internal/`, no toolchain. Combine with `--format=json` for CI ingestion (payload carries `command: "install-dry-run"`). |
 | `--conf` | — | Non-ABI build-time override. Repeatable. Format: `<namespace.leaf>=<value>` — e.g. `--conf cmake.cache.CHROMA_ENABLE_TEST=ON`. Layered: CLI > `wyvrn.local.json` > named-profile `conf` > recipe. Does **not** fold into `profileHash`. See [Build-time configuration (`conf`)](#build-time-configuration-conf). |
 | `--build-dir` | `build` | Project-relative subdir for the generated preset's `binaryDir` (`${sourceDir}/<root>/wyvrn-<profile>`). Use when the repo has a `BUILD` Bazel/Buck file at root that collides with `build/` on case-insensitive filesystems (gRPC, …). Persistent override: set `binaryDirRoot` in `wyvrn.local.json`. Validated — must be relative, no `..` segments. |
+| `--require-signatures` | `false` | Force S1 signature verification on every dep regardless of the registry's `mode.json`. Equivalent to `mode=require` for this run — useful for hardened CI. See [Signing & verification](#signing--verification-s1-2130). |
 
 Packages are extracted to `wyvrn_internal/{name}/`. A `wyvrn.lock` file is written alongside the manifest recording the exact resolved versions, profile, and per-package SHA256. On subsequent installs the lock file pins all previously resolved versions — only newly added dependencies are resolved fresh.
 
@@ -497,11 +498,15 @@ wyvrnpm publish --dry-run --format json | jq '.wouldOverwrite, .plan'
 | `--manifest` | `./wyvrn.json` | Path to the manifest file. |
 | `--force` / `-f` | `false` | Overwrite an existing published version (same version + profile hash). |
 | `--dry-run` | `false` | Run every step (profile, options, zip, SHA256, `v2Exists` check) and print the upload plan, but skip the provider write. An existing published version is reported as a warning (not an error) so the full plan still prints. Pair with `--format json` to gate CI on `wouldOverwrite`. |
+| `--no-sign` | `false` | Publish unsigned even when `defaultSigning` is configured. Logs a warning. Useful for local testing — never recommended in CI. See `## Signing & verification`. |
+| `--signing-key-env` | *(config)* | Override the env var holding the publisher private key for this run. Inherits `keyId` from `defaultSigning` / per-source `signing`. |
+| `--signing-key-file` | *(config)* | Override the file holding the publisher private key for this run. Inherits `keyId` from `defaultSigning` / per-source `signing`. |
 
 During publish the tool also:
 - reads `wyvrn.lock` to pin locked dependency versions into the uploaded manifest
 - captures the current git commit SHA and remote URL as metadata
 - computes a SHA256 of the zip and stores it in the upload metadata
+- when signing is configured, signs an Ed25519 attestation over `(name, version, profileHash, contentSha256, manifestSha256, publisherKeyId, publishedAt)` and uploads `wyvrn.att.json` + `wyvrn.sig` alongside the zip. See `## Signing & verification`.
 
 ---
 
@@ -871,6 +876,61 @@ wyvrnpm configure profile delete msvc_release
 | `--cppstd` | C++ standard (`14` \| `17` \| `20` \| `23`). |
 | `--runtime` | Runtime linkage (`static` \| `dynamic`). |
 
+#### `wyvrnpm configure signing` (S1, 2.13.0+)
+
+Manages the publisher signing context for `wyvrnpm publish`. Wyvrnpm never stores the private key — only the retrieval path (env-var name or file path).
+
+```bash
+# Persist the keyId + retrieval path. CI form:
+wyvrnpm configure signing set-default --key-id razer-2026 --key-env WYVRNPM_SIGNING_KEY
+
+# Local-dev form:
+wyvrnpm configure signing set-default --key-id razer-2026 --key-file ~/.wyvrnpm/keys/razer-2026.priv.pem
+
+wyvrnpm configure signing show
+wyvrnpm configure signing unset
+```
+
+See [Signing & verification](#signing--verification-s1-2130) for the full design.
+
+---
+
+### `wyvrnpm key` (S1, 2.13.0+)
+
+Generate / inspect publisher signing keys. Pure-Node Ed25519, no external tooling required.
+
+```bash
+# Generate a fresh keypair. Refuses to overwrite existing files.
+wyvrnpm key gen --out ./keys --id razer-2026
+# → ./keys/razer-2026.priv.pem (PKCS#8 PEM, mode 0600 on POSIX)
+# → ./keys/razer-2026.pub.pem  (SPKI PEM, paste into trust anchor)
+# → ./keys/razer-2026.pub.b64  (base64 SPKI DER, the literal value for keys.json)
+
+# Re-derive the public key from a private key file (read-only sanity check).
+wyvrnpm key show-pub --in ./keys/razer-2026.priv.pem
+```
+
+Pair with `wyvrnpm configure signing set-default` to persist the keyId + retrieval path locally, then add the printed `keys.json` block to the registry's `.trust/keys.json` to authorise the publisher.
+
+---
+
+### `wyvrnpm trust` (S1, 2.13.0+)
+
+Inspect or refresh the locally-cached per-registry trust anchor (`.trust/keys.json` + `.trust/mode.json`).
+
+```bash
+# Show what's cached locally (read-only — no fetch).
+wyvrnpm trust list --source corp-s3
+
+# Fetch fresh from the registry. Pure additions accepted silently;
+# removals or modifications of an existing keyId fail closed unless
+# --accept-breaking is passed (TOFU phase 1).
+wyvrnpm trust refresh --source corp-s3
+wyvrnpm trust refresh --source corp-s3 --accept-breaking
+```
+
+`--source` accepts a configured-source name or a literal URL.
+
 ---
 
 ## JSON output (`--format json`)
@@ -1016,6 +1076,107 @@ The `linkedPackages` field stores globally registered packages for `wyvrnpm link
 
 ---
 
+## Signing & verification (S1, 2.13.0+)
+
+wyvrnpm signs published artefacts with **Ed25519** detached signatures and verifies them at install time against a per-registry trust anchor. The signing layer is pure-Node (`crypto.sign` / `crypto.verify` from the built-in module) — no external tooling, no shell-outs, identical behaviour on Windows / Linux / macOS.
+
+> **Why this matters.** Without signing, `contentSha256` proves transit integrity *against itself* — a stolen S3 credential can republish a trojanised zip and update the SHA in `versions.json` to match. Signing pins the publisher's identity to a registry-side trust anchor (`.trust/keys.json`) that an attacker with bucket-write access cannot rewrite without also holding the publisher's private key.
+
+### Threat model
+
+| Protects against | Does *not* protect against |
+|---|---|
+| Stolen registry credentials (S3 / HTTP token) | A trusted signer publishing maliciously |
+| Mirror impersonation / MitM | Compromise of the publisher's signing key (use rotation) |
+| Consumer-upload masquerade (`--upload-built` attribution) | First-contact TOFU bootstrapping (phase 1; closed by phase 2 root-pinning) |
+| URL-swap attacks (a sig moved between profiles) | Malicious code that's correctly signed by an authorised publisher |
+
+### Quick start (publisher)
+
+```bash
+# 1. Generate an Ed25519 keypair
+wyvrnpm key gen --out ./keys --id razer-2026
+
+# 2. Persist the retrieval path. Wyvrnpm never stores the private key
+#    itself — only the env-var name (preferred for CI) or the file path.
+export WYVRNPM_SIGNING_KEY=$(cat ./keys/razer-2026.priv.pem)
+wyvrnpm configure signing set-default --key-id razer-2026 --key-env WYVRNPM_SIGNING_KEY
+
+# 3. Add the public half to the registry's trust anchor — exactly once,
+#    out-of-band. The block printed by `key gen` is the literal value to
+#    drop into {source}/v2/.trust/keys.json. Set mode to "warn" while
+#    rolling out signing across publishers; flip to "require" once every
+#    publisher is on board.
+
+# 4. Publish — signing happens automatically when defaultSigning is set.
+wyvrnpm publish --source corp-s3
+# → signs wyvrn.att.json + wyvrn.sig and uploads them alongside the zip
+```
+
+### Quick start (consumer)
+
+Consumers don't have to do anything when the registry is in `mode: warn` — installs proceed and signed artefacts log `signed by <keyId> (<identityHint>)`. To check what's cached locally:
+
+```bash
+wyvrnpm trust list  --source corp-s3
+wyvrnpm trust refresh --source corp-s3       # pull latest .trust/keys.json
+```
+
+To force strict verification regardless of registry mode (e.g., hardened CI):
+
+```bash
+wyvrnpm install --require-signatures
+```
+
+### Modes (`{source}/v2/.trust/mode.json`)
+
+| `mode` | missing sig | invalid sig |
+|---|---|---|
+| `off` (default — no `.trust/` dir) | accept silently | n/a |
+| `warn` (phase-1 default) | accept with one-line warning | **abort** (bad sig is stricter than missing) |
+| `require` (phase 2+) | abort | abort |
+
+### Trust-anchor rotation (TOFU)
+
+Phase 1 uses trust-on-first-use — the first `wyvrn install` against a registry caches `keys.json` locally at `%LOCALAPPDATA%\wyvrnpm\trust\<source-hash>\`. Subsequent fetches diff against the cache:
+
+- **Pure additions** → accepted silently (the common rotation event: bring on a new publisher).
+- **Removals or modifications** of an existing key → fail closed; install aborts and prompts for `wyvrnpm trust refresh --accept-breaking`.
+
+Phase 2 will allow pinning a root key in `installSources[].trustRootPub` so the registry's `keys.json` itself carries a root signature — closes the TOFU window.
+
+### What the attestation binds
+
+Each signed artefact gets a `wyvrn.att.json` body:
+
+```json
+{
+  "wyvrnAttestationVersion": 1,
+  "name":           "demo",
+  "version":        "1.0.0.0",
+  "profileHash":    "a1b2c3d4e5f60718",
+  "contentSha256":  "<sha256 of wyvrn.zip>",
+  "manifestSha256": "<sha256 of canonical wyvrn.json>",
+  "publishedAt":    "2026-04-29T12:34:56.789Z",
+  "publisherKeyId": "razer-2026",
+  "uploadedBy":     null
+}
+```
+
+Plus a sidecar `wyvrn.sig`:
+
+```json
+{ "alg": "ed25519", "keyId": "razer-2026", "sig": "<base64 64-byte signature>" }
+```
+
+The verifier checks the cryptographic signature, then asserts `(name, version, profileHash, contentSha256, manifestSha256)` match what the consumer downloaded. Dropping a valid attestation for `pkg-A` into `pkg-B`'s URL fails the bound-identity check; swapping the zip after publish fails the bound-`contentSha256` check; rewriting the manifest fails the bound-`manifestSha256` check.
+
+### Backward compatibility
+
+A registry without a `.trust/` directory behaves as `mode: off` — pre-S1 clients ignore the new files entirely, S1 clients install identically to today. Pre-S1 buckets need *zero* migration to keep working.
+
+---
+
 ## Publish Providers
 
 wyvrnpm uses a provider architecture to support different destination types. The correct provider is selected automatically based on the source URL format.

package/bin/wyvrnpm.js

@@ -16,6 +16,8 @@ const show         = require('../src/commands/show');
 const installSkill = require('../src/commands/install-skill');
 const cache        = require('../src/commands/cache');
 const bootstrap    = require('../src/commands/bootstrap');
+const keyCmd       = require('../src/commands/key');
+const trustCmd     = require('../src/commands/trust');
 const { link, unlink } = require('../src/commands/link');
 
 yargs
@@ -281,16 +283,34 @@ yargs
           choices: ['text', 'json'],
           default: 'text',
           description: 'Output format. "json" emits a single JSON object on stdout; log lines go to stderr.',
+        })
+        .option('require-signatures', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Force signature verification on every dep regardless of the ' +
+            'registry\'s mode.json. Equivalent to mode=require for this run. ' +
+            'Useful for hardened CI where unsigned artefacts must always block.',
+        })
+        .option('request-configs', {
+          type: 'string',
+          description:
+            'Comma-separated CMake configs to fetch from per-config-published deps ' +
+            '(e.g. "Release" or "Release,Debug"). Highest precedence; overrides ' +
+            'wyvrn.local.json:requestConfigs and the consumer\'s build.configs. ' +
+            'Ignored for deps published as a fat zip (today\'s default).',
         });
     },
     (argv) => install({
       ...argv,
-      uploadBuilt:  argv['upload-built'],
-      uploadSource: argv['upload-source'],
-      awsProfile:   argv['aws-profile'],
-      tokenEnv:     argv['token-env'],
-      dryRun:       argv['dry-run'],
-      buildDir:     argv['build-dir'],
+      uploadBuilt:        argv['upload-built'],
+      uploadSource:       argv['upload-source'],
+      awsProfile:         argv['aws-profile'],
+      tokenEnv:           argv['token-env'],
+      dryRun:             argv['dry-run'],
+      buildDir:           argv['build-dir'],
+      requireSignatures:  argv['require-signatures'],
+      requestConfigs:     argv['request-configs'],
     }),
   )
 
@@ -593,7 +613,19 @@ yargs
             'but skip the provider write. An existing published version is ' +
             'reported as a warning instead of failing. Pair with --format json ' +
             'to script bulk publish validation (plan + wouldOverwrite flag ' +
-            'land in stdout).',
+            'land in stdout). On --dry-run, the freshly-built artefacts ' +
+            '(wyvrn[-<Config>].zip, wyvrn.json, wyvrn.att.json, wyvrn.sig) ' +
+            'are also copied to a local inspection folder (default ' +
+            '`<srcDir>/<binaryDirRoot>/wyvrn-<profile>/dry-run-publish/`; ' +
+            'override with --dry-run-out).',
+        })
+        .option('dry-run-out', {
+          type: 'string',
+          description:
+            'Override the directory where --dry-run materialises the would-' +
+            'be-uploaded artefacts. Relative paths resolve against the project ' +
+            'root. Existing contents are wiped and replaced. No-op without ' +
+            '--dry-run.',
         })
         .option('option', {
           alias: 'o',
@@ -628,14 +660,38 @@ yargs
           default: 'text',
           description: 'Output format. "json" emits a single JSON object on stdout; log lines go to stderr.',
         })
+        // ── S1 signing ────────────────────────────────────────────────
+        .option('no-sign', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Publish unsigned even when defaultSigning is configured. Logs a ' +
+            'warning. Useful for local testing — never recommended in CI.',
+        })
+        .option('signing-key-env', {
+          type: 'string',
+          description:
+            'Override the env var holding the publisher private key (PKCS#8 PEM) ' +
+            'for this run. Inherits keyId from defaultSigning / per-source signing.',
+        })
+        .option('signing-key-file', {
+          type: 'string',
+          description:
+            'Override the file holding the publisher private key (PKCS#8 PEM) ' +
+            'for this run. Inherits keyId from defaultSigning / per-source signing.',
+        })
         ;
     },
     (argv) => publish({
       ...argv,
-      awsProfile: argv['aws-profile'],
-      tokenEnv:   argv['token-env'],
-      dryRun:     argv['dry-run'],
-      buildDir:   argv['build-dir'],
+      awsProfile:      argv['aws-profile'],
+      tokenEnv:        argv['token-env'],
+      dryRun:          argv['dry-run'],
+      dryRunOut:       argv['dry-run-out'],
+      buildDir:        argv['build-dir'],
+      noSign:          argv['no-sign'],
+      signingKeyEnv:   argv['signing-key-env'],
+      signingKeyFile:  argv['signing-key-file'],
     }),
   )
 
@@ -769,6 +825,106 @@ yargs
           () => {},
         )
 
+        // --- signing (S1) ---
+        .command(
+          'signing',
+          'Configure publisher signing context for `wyvrnpm publish`',
+          (y2) => {
+            y2
+              .command(
+                'set-default',
+                'Persist defaultSigning (alg + keyId + privateKey retrieval path)',
+                (y3) => {
+                  y3
+                    .option('key-id',   { type: 'string', demandOption: true,
+                                          description: 'Publisher keyId (must match an entry in the registry\'s .trust/keys.json)' })
+                    .option('key-env',  { type: 'string',
+                                          description: 'Env var name holding the PKCS#8 PEM private key' })
+                    .option('key-file', { type: 'string',
+                                          description: 'Filesystem path to a PKCS#8 PEM private key file' });
+                },
+                (argv) => configure.signingSetDefault(argv),
+              )
+              .command('show',  'Show the current defaultSigning entry',           () => {}, () => configure.signingShow())
+              .command('unset', 'Remove the defaultSigning entry from config.json', () => {}, () => configure.signingUnset())
+              .demandCommand(1)
+              .help();
+          },
+          () => {},
+        )
+
+        .demandCommand(1)
+        .help();
+    },
+    () => {},
+  )
+
+  // ── key (S1) ──────────────────────────────────────────────────────────────
+  .command(
+    'key',
+    'Generate / inspect publisher signing keys (Ed25519). Used for S1 artefact signing.',
+    (y) => {
+      y
+        .command(
+          'gen',
+          'Generate a fresh Ed25519 keypair (PKCS#8 PEM private + SPKI PEM public + base64 SPKI DER)',
+          (y2) => {
+            y2
+              .option('out',    { type: 'string', demandOption: true, description: 'Output directory' })
+              .option('id',     { type: 'string', default: 'wyvrnpm', description: 'Publisher keyId — also used as filename prefix' })
+              .option('format', { type: 'string', choices: ['text', 'json'], default: 'text' });
+          },
+          (argv) => keyCmd.gen(argv),
+        )
+        .command(
+          'show-pub',
+          'Re-derive the public key from a private key file (read-only)',
+          (y2) => {
+            y2
+              .option('in',     { type: 'string', demandOption: true, description: 'Path to PKCS#8 PEM private key' })
+              .option('format', { type: 'string', choices: ['text', 'json'], default: 'text' });
+          },
+          (argv) => keyCmd.showPub(argv),
+        )
+        .demandCommand(1)
+        .help();
+    },
+    () => {},
+  )
+
+  // ── trust (S1) ────────────────────────────────────────────────────────────
+  .command(
+    'trust',
+    'Inspect / refresh the per-registry trust anchor (.trust/keys.json + .trust/mode.json)',
+    (y) => {
+      y
+        .command(
+          'list',
+          'List the locally-cached trust anchor for a registry',
+          (y2) => {
+            y2
+              .option('source', { alias: 's', type: 'string', description: 'Source URL or configured-source name' })
+              .option('format', { type: 'string', choices: ['text', 'json'], default: 'text' });
+          },
+          (argv) => trustCmd.list(argv),
+        )
+        .command(
+          'refresh',
+          'Fetch + cache the registry trust anchor; refuse non-additive diffs unless --accept-breaking',
+          (y2) => {
+            y2
+              .option('source',           { alias: 's', type: 'string', description: 'Source URL or configured-source name' })
+              .option('aws-profile',      { type: 'string', description: 'AWS SSO profile (S3 only)' })
+              .option('accept-breaking',  { type: 'boolean', default: false,
+                                           description: 'Accept removal/modification of existing key entries' })
+              .option('format',           { type: 'string', choices: ['text', 'json'], default: 'text' });
+          },
+          (argv) => trustCmd.refresh({
+            ...argv,
+            awsProfile:      argv['aws-profile'],
+            acceptBreaking:  argv['accept-breaking'],
+          }),
+        )
         .demandCommand(1)
         .help();
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.12.3",
+  "version": "2.13.11",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/build/recipe.js

@@ -39,6 +39,12 @@ const DEFAULT_RECIPE = Object.freeze({
   installDir:    'install',                 // relative to binary dir; becomes CMAKE_INSTALL_PREFIX
   sourceSubdir:  '.',                       // where CMakeLists.txt lives relative to the clone root
   requiredTools: Object.freeze([]),
+  // When true, `wyvrnpm publish` slices the unified install tree into one
+  // zip per config (Release-only consumers download one slice, not the
+  // 4-config fat zip). Default false — small libraries don't benefit and
+  // pay 4× the per-publish round-trips. Big packages (gRPC, Boost) opt in.
+  // See claude/PLAN-PER-CONFIG-ARTEFACTS in plan history.
+  publishPerConfig: false,
 });
 
 const VALID_CMAKE_CONFIGS = new Set(['Debug', 'Release', 'RelWithDebInfo', 'MinSizeRel']);
@@ -157,15 +163,31 @@ function normalizeRecipe(rawBuild, effectiveOptions = null, manifestForConfColli
     }
   }
 
+  // `publishPerConfig` opts the package into per-config slicing at
+  // publish time. Strict boolean — undefined / null / missing all become
+  // the default (false); any other type is a hard error so a typo
+  // (e.g. `"true"` as a string) doesn't silently default to false and
+  // produce a fat zip the author didn't intend.
+  let publishPerConfig = DEFAULT_RECIPE.publishPerConfig;
+  if (b.publishPerConfig !== undefined && b.publishPerConfig !== null) {
+    if (typeof b.publishPerConfig !== 'boolean') {
+      throw new Error(
+        `build.publishPerConfig must be a boolean — got ${JSON.stringify(b.publishPerConfig)}`,
+      );
+    }
+    publishPerConfig = b.publishPerConfig;
+  }
+
   return {
     system,
     generators,
     configs,
     configure,
     buildArgs,
-    installDir:    b.installDir    ?? DEFAULT_RECIPE.installDir,
-    sourceSubdir:  b.sourceSubdir  ?? DEFAULT_RECIPE.sourceSubdir,
-    requiredTools: cleanArray(b.requiredTools),
+    installDir:       b.installDir    ?? DEFAULT_RECIPE.installDir,
+    sourceSubdir:     b.sourceSubdir  ?? DEFAULT_RECIPE.sourceSubdir,
+    requiredTools:    cleanArray(b.requiredTools),
+    publishPerConfig,
   };
 }
 

package/src/commands/configure.js

@@ -89,4 +89,64 @@ function removeSource(argv) {
   log.info(`Removed ${kind} source "${name}"`);
 }
 
-module.exports = { list, addSource, removeSource };
+/**
+ * wyvrnpm configure signing set-default --key-id <id>
+ *                                       [--key-env <VAR> | --key-file <path>]
+ *
+ * Persists the publisher signing context to `defaultSigning` in
+ * config.json. Wyvrnpm never stores the secret itself — only the
+ * retrieval path (env var name or file path), so a `cat config.json`
+ * never leaks key material.
+ */
+function signingSetDefault(argv) {
+  const keyId   = argv.keyId   ?? argv['key-id'];
+  const keyEnv  = argv.keyEnv  ?? argv['key-env'];
+  const keyFile = argv.keyFile ?? argv['key-file'];
+
+  if (!keyId) { log.error('--key-id is required'); process.exit(1); }
+  if (!!keyEnv === !!keyFile) {
+    log.error('Pass exactly one of --key-env or --key-file');
+    process.exit(1);
+  }
+
+  const config = readConfig();
+  config.defaultSigning = {
+    alg:        'ed25519',
+    keyId,
+    privateKey: keyEnv ? { env: keyEnv } : { file: keyFile },
+  };
+  writeConfig(config);
+  log.success(`set defaultSigning.keyId="${keyId}" (${keyEnv ? `env:${keyEnv}` : `file:${keyFile}`})`);
+}
+
+/** wyvrnpm configure signing show */
+function signingShow() {
+  const config = readConfig();
+  if (!config.defaultSigning) {
+    console.log('No defaultSigning configured. Set with `wyvrnpm configure signing set-default ...`');
+    return;
+  }
+  const s = config.defaultSigning;
+  console.log('defaultSigning:');
+  console.log(`  alg     : ${s.alg}`);
+  console.log(`  keyId   : ${s.keyId}`);
+  if (s.privateKey?.env)  console.log(`  privKey : env:${s.privateKey.env}`);
+  if (s.privateKey?.file) console.log(`  privKey : file:${s.privateKey.file}`);
+}
+
+/** wyvrnpm configure signing unset */
+function signingUnset() {
+  const config = readConfig();
+  if (!config.defaultSigning) {
+    log.info('defaultSigning was not set — nothing to do');
+    return;
+  }
+  delete config.defaultSigning;
+  writeConfig(config);
+  log.success('cleared defaultSigning');
+}
+
+module.exports = {
+  list, addSource, removeSource,
+  signingSetDefault, signingShow, signingUnset,
+};

package/src/commands/install.js

@@ -6,6 +6,7 @@ const path = require('path');
 const { normalizeDependencies }                             = require('../manifest');
 const { resolveDependencies }                               = require('../resolve');
 const { downloadDependencies }                              = require('../download');
+const { resolveSigningContext }                             = require('../signing/resolve-context');
 const { wyvrnFetch }                                        = require('../http-fetch');
 const { resolveEffectiveConf, cmakeCacheVariables, unflattenConf } = require('../conf');
 const { resolveBinaryDirRoot }                              = require('../binary-dir');
@@ -350,6 +351,47 @@ async function install(argv) {
 
   const razerDir = path.join(rootDir, 'wyvrn_internal');
 
+  // ── Resolve requestConfigs for per-config dep slicing ─────────────────────
+  // Precedence: CLI > wyvrn.local.json > consumer's recipe build.configs.
+  // When all three are absent, falls through to null which means "download
+  // every config the dep author published" (preserves pre-feature semantics
+  // for fat-zip deps; for sliced deps, equivalent to "no override, fetch all").
+  let requestConfigs = null;
+  const cliRaw = typeof argv.requestConfigs === 'string' ? argv.requestConfigs.trim() : null;
+  if (cliRaw) {
+    requestConfigs = cliRaw.split(',').map((s) => s.trim()).filter(Boolean);
+    if (requestConfigs.length === 0) {
+      log.error('--request-configs was empty after parsing');
+      process.exit(1);
+    }
+  } else if (effectiveConfResult.localRequestConfigs) {
+    requestConfigs = effectiveConfResult.localRequestConfigs.slice();
+  } else if (manifest && manifest.build && (Array.isArray(manifest.build.configs) || typeof manifest.build.configs === 'string')) {
+    // Read configs directly from the consumer's manifest. Avoid normalizeRecipe
+    // here because it can throw on `${options.X}` references that this caller
+    // hasn't resolved yet — request-configs only depends on the configs field.
+    const raw = manifest.build.configs;
+    requestConfigs = (typeof raw === 'string' ? [raw] : raw)
+      .filter((s) => typeof s === 'string' && s.trim())
+      .slice();
+    if (requestConfigs.length === 0) requestConfigs = null;
+  }
+  if (requestConfigs) {
+    log.info(`Request configs: ${requestConfigs.join(', ')}`);
+  }
+
+  // Per-dep override map (wyvrn.local.json: depRequestConfigs). When a
+  // dep is named in this map, its slice selection is the listed configs;
+  // otherwise it inherits the global `requestConfigs`. Use case: "fetch
+  // all four configs of fmt + zlib, but only MinSizeRel of grpc."
+  const depRequestConfigs = effectiveConfResult.localDepRequestConfigs ?? null;
+  if (depRequestConfigs && Object.keys(depRequestConfigs).length > 0) {
+    const summary = Object.entries(depRequestConfigs)
+      .map(([n, c]) => `${n}=[${c.join(',')}]`)
+      .join(' ');
+    log.info(`Per-dep request configs: ${summary}`);
+  }
+
   // Extract auth from the first install source (if any). Prefer
   // `tokenEnv` over a literal `token` stored in config — closes
   // EVALUATION.md S8 (no plaintext secret persisted, value is looked up
@@ -360,6 +402,12 @@ async function install(argv) {
     token:      ctx.auth.for(firstInstallSrc).token,
     buildMode,
     profileName,
+    // S1: forwarded straight through to download.js's verify tail.
+    requireSignatures: Boolean(argv.requireSignatures),
+    // Per-config slice selection. null = "no override, fetch all available".
+    requestConfigs,
+    // Per-dep override; null when the overlay omits it.
+    depRequestConfigs,
   };
 
   // ── Resolve upload destination up-front when --upload-built is set ──────
@@ -387,6 +435,33 @@ async function install(argv) {
     downloadOptions.uploadAuth   = resolved.uploadAuth;
     downloadOptions.uploadStats  = createUploadStats();
 
+    // S1: resolve signing context for the consumer-upload tail. Same
+    // precedence as `wyvrnpm publish` — per-source signing on the
+    // resolved upload entry, then defaultSigning, then CLI overrides.
+    // When null, the upload is unsigned and downstream consumers warn /
+    // abort per the destination registry's mode.json.
+    const uploadSourceEntry = (config.publishSources ?? [])
+      .find((s) => s.url === resolved.uploadSource || s.name === argv.uploadSource) ?? null;
+    let uploadSigningContext = null;
+    try {
+      const ctxOrSkip = resolveSigningContext(
+        {
+          noSign:         argv.noSign,
+          signingKeyEnv:  argv.signingKeyEnv,
+          signingKeyFile: argv.signingKeyFile,
+        },
+        config,
+        uploadSourceEntry,
+      );
+      // `skip: true` (--no-sign) is treated identically to "no context"
+      // here — the consumer just doesn't sign.
+      uploadSigningContext = (ctxOrSkip && !ctxOrSkip.skip) ? ctxOrSkip : null;
+    } catch (err) {
+      log.error(`upload-built signing config invalid: ${err.message}`);
+      process.exit(1);
+    }
+    downloadOptions.uploadSigningContext = uploadSigningContext;
+
     if (resolved.uploadSource !== (packageSources[0] ?? '')) {
       log.info(
         `upload-built: install source(s) and upload source differ —\n` +
@@ -569,7 +644,7 @@ async function install(argv) {
   // here so CI doesn't take "Done — N installed" at face value when one of
   // the deps actually failed.
   const SUCCESS_RESOLVED = new Set([
-    'v1', 'v2', 'v2-compat', 'v2-source-build', 'cached', 'link',
+    'v1', 'v2', 'v2-slice', 'v2-compat', 'v2-source-build', 'cached', 'link',
   ]);
   const failed = [];
   for (const [name, entry] of lockEntries ?? []) {