wyvrnpm 2.13.11 → 2.14.1

package/README.md

@@ -4,7 +4,7 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.13.0** — **New:** S1 artefact signing — Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`; `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`; `--require-signatures` on install, `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish; pure-Node `crypto` (no external tooling, identical on Windows / Linux / macOS). Closes S1 + S3. Highlights since 2.8.3: profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
+> **README version: 2.14.0** — **New:** npm self-update notifier — when a newer `wyvrnpm` is on the npm registry, the next interactive run prints a one-line `[wyvrn] warn  wyvrnpm <old> → <new> available` banner on stderr. The fetch happens in a detached background process so the user's command never blocks on the network; the banner appears on the *following* invocation after the cache (`%LOCALAPPDATA%\wyvrnpm\update-check.json`) is populated. Auto-suppressed in CI (`$CI`), non-TTY runs, and `--format json` mode; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps) instead of pulling in `update-notifier` and its 10+ transitives. Closes the gap where users on stale CLIs silently missed bug fixes (the `2.8.4` CloudFront cache-split fix and the `2.12.2` install-failure exit code, in particular). **Resolver caches `@latest` lookups** within a single `wyvrnpm install` — when a package is referenced as `@latest` from multiple parents in the dep graph (or already resolved earlier via a range), the registry round-trip is reused instead of re-probing `latest.json` per encounter. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph; visible win on resolution wall-time when the registry sits behind CloudFront. Closes the parallel gap to `manifestCache` / `publishedCache` — all three S3-backed helpers in `resolve.js` now memoise per-name within one install. **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` then emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL instead of a single fat zip. Consumers fetch only the configs they need: `wyvrnpm install --request-configs Release` on a CI runner pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports (`IMPORTED_LOCATION_<CONFIG>`) so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` Release vs `lib/food.lib` Debug, via `CMAKE_DEBUG_POSTFIX`) classify correctly. `wyvrn.local.json` gains `requestConfigs` (global) + `depRequestConfigs` (per-dep override — "all four configs of fmt, but MinSizeRel of grpc"). Attestation v2 binds an `artefactSha256: { config → sha }` map; one signature covers every slice. `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (the existence check degrades to `wouldOverwrite: null` instead of crashing). Highlights since 2.8.3: S1 artefact signing — Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`; `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`; `--require-signatures` on install, `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish; pure-Node `crypto` (no external tooling, identical on Windows / Linux / macOS). Closes S1 + S3. Profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
 
 ---
 
@@ -22,6 +22,16 @@ For S3 publishing, also install the AWS SDK:
 npm install -g @aws-sdk/client-s3 @aws-sdk/credential-providers
 ```
 
+### Update notifier
+
+When a newer `wyvrnpm` is published to npm, the next interactive run prints a single-line banner on stderr:
+
+```
+[wyvrn] warn  wyvrnpm 2.13.12 → 2.14.0 available. Run `npm i -g wyvrnpm` to update.
+```
+
+The check is non-blocking — the registry round-trip happens in a detached background process, so your command never waits on the network. The banner appears on the *following* invocation. Auto-suppressed in CI (`$CI` set), non-TTY runs (redirected stdout, pipelines), and `--format json` mode. Opt out manually via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`.
+
 ---
 
 ## Quick Start

package/bin/wyvrnpm.js

@@ -1,7 +1,11 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 'use strict';
 
+// npm self-update notifier — synchronous, non-blocking, suppressed in CI /
+// non-TTY / JSON mode. Runs before yargs so it gets first crack at argv.
+require('../src/update-check').maybeNotify();
+
 const yargs     = require('yargs');
 const init         = require('../src/commands/init');
 const add          = require('../src/commands/add');

package/cmake/functions.cmake

@@ -192,28 +192,34 @@ function(SETUP_LIBRARY target type)
 
 endfunction()
 
-# ── SETUP_EXE(target [EXCLUDE pat...] [extra_sources...]) ─────────────────────
+# ── SETUP_EXE(target [CONSOLE] [EXCLUDE pat...] [extra_sources...]) ───────────
 # Creates an executable target from all sources in CMAKE_CURRENT_SOURCE_DIR,
 # with platform-specific HAL sources included automatically.
-# On Windows and Xbox the WIN32 subsystem flag is set automatically.
+# On Windows and Xbox the WIN32 subsystem flag is set automatically; pass
+# CONSOLE to opt out and produce a console-subsystem binary instead.
 #
 # Arguments:
 #   target         CMake target name
+#   CONSOLE        (optional flag) Skip the WIN32 subsystem flag on Windows/Xbox
+#                  so the binary is built as a console application. Equivalent
+#                  to passing /SUBSYSTEM:CONSOLE under MSVC by hand. No-op
+#                  outside Windows/Xbox.
 #   EXCLUDE        (optional) One or more regex patterns; matched files are
 #                  excluded from the auto-collected source list
 #   extra_sources  (optional) Additional source files to append (positional,
 #                  or via the SOURCES keyword)
 #
 # Example:
-#   SETUP_EXE(ChromaApp)
+#   SETUP_EXE(ChromaApp)                                    # GUI subsystem on Windows
+#   SETUP_EXE(ChromaTool CONSOLE)                           # console subsystem on Windows
 #   SETUP_EXE(ChromaTool ${TOOL_GENERATED_SOURCES})
 #   SETUP_EXE(ChromaTool EXCLUDE ".*test_stub.*" SOURCES ${EXTRA})
 function(SETUP_EXE target)
-    cmake_parse_arguments(_SETUP "" "" "EXCLUDE;SOURCES" ${ARGN})
+    cmake_parse_arguments(_SETUP "CONSOLE" "" "EXCLUDE;SOURCES" ${ARGN})
     _wyvrn_collect_sources(_sources ${_SETUP_EXCLUDE})
     list(APPEND _sources ${_SETUP_SOURCES} ${_SETUP_UNPARSED_ARGUMENTS})
 
-    if(WYVRN_PLATFORM_WINDOWS OR WYVRN_PLATFORM_XBOX)
+    if((WYVRN_PLATFORM_WINDOWS OR WYVRN_PLATFORM_XBOX) AND NOT _SETUP_CONSOLE)
         add_executable(${target} WIN32 ${_sources})
     else()
         add_executable(${target} ${_sources})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.13.11",
+  "version": "2.14.1",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/config.js

@@ -23,6 +23,11 @@ function getConfigPath() {
   return path.join(getConfigDir(), 'config.json');
 }
 
+/** Full path to update-check.json (npm self-update notifier cache). */
+function getUpdateCheckPath() {
+  return path.join(getConfigDir(), 'update-check.json');
+}
+
 /**
  * Read and parse config.json.
  * Returns a default empty config if the file doesn't exist yet.
@@ -76,7 +81,7 @@ function writeConfig(config) {
   fs.writeFileSync(getConfigPath(), JSON.stringify(config, null, 2) + '\n', 'utf8');
 }
 
-module.exports = { getConfigDir, getConfigPath, readConfig, writeConfig };
+module.exports = { getConfigDir, getConfigPath, getUpdateCheckPath, readConfig, writeConfig };
 
 /**
  * @typedef {{ name: string, url: string, profile?: string, token?: string, signing?: SigningConfig, trustRootPub?: string }} SourceEntry

package/src/resolve.js

@@ -298,6 +298,19 @@ async function resolveDependencies(
     return list;
   };
 
+  /**
+   * Cache `@latest` resolution per package — one round trip per name
+   * regardless of how often it appears in the graph as `"latest"`.
+   * @type {Map<string, string>}
+   */
+  const latestCache = new Map();
+  const fetchLatest = async (name) => {
+    if (latestCache.has(name)) return latestCache.get(name);
+    const v = await resolveLatestVersion(name, sourcesFor(name), platform, httpClient);
+    latestCache.set(name, v);
+    return v;
+  };
+
   /**
    * Pending work queue: each entry is { name, version, by? }.
    * `by` is the contributor label for conflict diagnostics.
@@ -319,8 +332,9 @@ async function resolveDependencies(
     // Skip this for linked packages which have "linked:" prefix.
     if (version === 'latest') {
       try {
-        version = await resolveLatestVersion(name, sourcesFor(name), platform, httpClient);
-        log.info(`Resolved "${name}@latest" → ${version}`);
+        const cached = latestCache.has(name);
+        version = await fetchLatest(name);
+        if (!cached) log.info(`Resolved "${name}@latest" → ${version}`);
       } catch (err) {
         log.warn(err.message);
         continue;

package/src/update-check/fetcher.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+
+'use strict';
+
+// Detached background fetcher for the npm self-update notifier.
+//
+// Spawned by src/update-check/index.js when the update-check.json cache is
+// stale or missing. Runs independently of the parent CLI process — the parent
+// returns from `maybeNotify()` immediately; this script's exit timing is
+// irrelevant to the user. Banner prints on the *next* invocation, after the
+// cache file has been populated.
+//
+// Hard rules:
+//   - swallow every error; never exit non-zero (parent ignores us anyway, but
+//     a non-zero exit could surface in `ps` / job-control noise)
+//   - 10 s timeout — slow networks must not leave a zombie node process
+//   - atomic write (tmp + rename) so a half-written file never trips the
+//     parent's JSON.parse
+//
+// Test hooks (undocumented, internal-only):
+//   WYVRNPM_UPDATE_CHECK_URL   — override the registry URL
+//   WYVRNPM_UPDATE_CHECK_PATH  — override the cache file path
+
+const fs   = require('fs');
+const path = require('path');
+
+const { getUpdateCheckPath } = require('../config');
+const { wyvrnFetch }         = require('../http-fetch');
+
+const DEFAULT_URL = 'https://registry.npmjs.org/wyvrnpm/latest';
+const TIMEOUT_MS  = 10_000;
+
+async function main() {
+  const url       = process.env.WYVRNPM_UPDATE_CHECK_URL || DEFAULT_URL;
+  const cachePath = process.env.WYVRNPM_UPDATE_CHECK_PATH || getUpdateCheckPath();
+
+  const installed = require('../../package.json').version;
+
+  const ac      = new AbortController();
+  const timeout = setTimeout(() => ac.abort(), TIMEOUT_MS);
+  let body;
+  try {
+    const res = await wyvrnFetch(url, { signal: ac.signal });
+    if (!res.ok) return;
+    body = await res.json();
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  const latestVersion = body && typeof body.version === 'string' ? body.version : null;
+  if (!latestVersion) return;
+
+  const payload = {
+    lastCheckedAt:    Date.now(),
+    latestVersion,
+    installedAtCheck: installed,
+  };
+
+  fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+  const tmp = `${cachePath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(payload, null, 2) + '\n', 'utf8');
+  fs.renameSync(tmp, cachePath);
+}
+
+// Swallow everything — a background fetch failure must never surface.
+main().catch(() => {}).finally(() => process.exit(0));

package/src/update-check/index.js

@@ -0,0 +1,145 @@
+'use strict';
+
+// Lightweight npm self-update notifier for the wyvrnpm CLI.
+//
+// `maybeNotify()` is called once at the top of bin/wyvrnpm.js, before yargs
+// parses argv. It runs synchronously and returns immediately — never blocks
+// the user's command on a network call. Two paths:
+//
+//   - cache fresh + newer version on npm → print one-line warning banner
+//   - cache stale or missing            → spawn detached child to refresh,
+//                                          banner appears on the *next*
+//                                          invocation
+//
+// Suppression covers CI, non-TTY, --format=json, and explicit opt-out.
+// Background failures (no network, npm rate-limit, corrupt cache) are
+// silent — see fetcher.js. Hand-rolled to avoid the 10+ transitive deps
+// the npm `update-notifier` package brings.
+//
+// Cache schema (under %LOCALAPPDATA%\wyvrnpm\update-check.json):
+//   { lastCheckedAt: <ms>, latestVersion: "<x.y.z>", installedAtCheck: "<x.y.z>" }
+//
+// `installedAtCheck` invalidates the cache when the user has manually
+// upgraded since the last check — without it, a stale cache could keep
+// nagging about a version the user already has.
+
+const fs          = require('fs');
+const path        = require('path');
+const childProc   = require('child_process');
+
+const log                       = require('../logger');
+const { getUpdateCheckPath }    = require('../config');
+const { compareVersions }       = require('../version-range');
+
+const TTL_MS         = 24 * 60 * 60 * 1000;
+const FETCHER_SCRIPT = path.join(__dirname, 'fetcher.js');
+const PKG_VERSION    = require('../../package.json').version;
+
+/**
+ * Decide whether to run the update check at all. Returns false in any
+ * non-interactive context — CI, redirected stdout, JSON output mode, or
+ * when the user has explicitly opted out.
+ */
+function shouldRunUpdateCheck(env = process.env, argv = process.argv, stdout = process.stdout) {
+  if (env.WYVRNPM_NO_UPDATE_CHECK) return false;
+  if (env.CI)                      return false;
+  if (!stdout || !stdout.isTTY)    return false;
+
+  if (argv.includes('--no-update-check')) return false;
+
+  // `--format json` (space-separated) and `--format=json` (equals) — any
+  // subcommand running in JSON mode would only inject stderr noise into
+  // CI scripts that capture stdout.
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--format=json')                          return false;
+    if (a === '--format' && argv[i + 1] === 'json')     return false;
+  }
+
+  // Don't recurse — the detached fetcher must not re-trigger maybeNotify.
+  if (argv[1] && argv[1].endsWith(path.join('update-check', 'fetcher.js'))) {
+    return false;
+  }
+
+  return true;
+}
+
+function readCache(cachePath) {
+  try {
+    const raw    = fs.readFileSync(cachePath, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.lastCheckedAt    !== 'number') return null;
+    if (typeof parsed.latestVersion    !== 'string') return null;
+    if (typeof parsed.installedAtCheck !== 'string') return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+function spawnFetcher() {
+  try {
+    const child = childProc.spawn(
+      process.execPath,
+      [FETCHER_SCRIPT],
+      { detached: true, stdio: 'ignore', windowsHide: true },
+    );
+    child.unref();
+  } catch {
+    // Spawn failures (sandbox, exec policy) — silent. Worst case the user
+    // never sees the banner; the CLI itself keeps working.
+  }
+}
+
+/**
+ * Print the banner via log.warn — single line on stderr, [wyvrn] prefix
+ * applied by the logger. Stays out of stdout so `VER=$(wyvrnpm version)`
+ * stays clean.
+ */
+function emitBanner(installed, latest) {
+  log.warn(`wyvrnpm ${installed} → ${latest} available. Run \`npm i -g wyvrnpm\` to update.`);
+}
+
+/**
+ * Main entry. Sync work (gate + cache read + banner) returns synchronously;
+ * background fetch runs in a detached child. Total foreground cost: one
+ * fs.readFileSync of a tiny JSON file in the happy path.
+ */
+function maybeNotify(opts = {}) {
+  const env       = opts.env       || process.env;
+  const argv      = opts.argv      || process.argv;
+  const stdout    = opts.stdout    || process.stdout;
+  const cachePath = opts.cachePath || getUpdateCheckPath();
+  const installed = opts.installedVersion || PKG_VERSION;
+  const now       = opts.now       || Date.now();
+  const spawn     = opts.spawn     || spawnFetcher;
+  const banner    = opts.banner    || emitBanner;
+
+  if (!shouldRunUpdateCheck(env, argv, stdout)) return;
+
+  const cache = readCache(cachePath);
+
+  // Cache invalid if installedAtCheck disagrees with the live version
+  // (user upgraded since the last check) — treat as stale.
+  if (!cache || cache.installedAtCheck !== installed) {
+    spawn();
+    return;
+  }
+
+  if (now - cache.lastCheckedAt >= TTL_MS) {
+    spawn();
+    // Fall through — we may still have a useful latestVersion from the
+    // last fetch even though it's "stale" by TTL. Print the banner if
+    // applicable; the background fetch will refresh for next time.
+  }
+
+  if (compareVersions(cache.latestVersion, installed) > 0) {
+    banner(installed, cache.latestVersion);
+  }
+}
+
+module.exports = {
+  maybeNotify,
+  shouldRunUpdateCheck,
+  readCache,
+};