wyvrnpm 2.15.0 → 2.16.1

package/README.md

@@ -4,7 +4,30 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.15.0** — **New:** `buildDependencies` block + `whenOption` gating — closes EVALUATION.md **F3** (`tool_requires` + `test_requires`). Recipes can now declare author-private deps (the asio / websocketpp / boost-internals case — header-only libs that compile into a `StaticLib` and aren't exposed by its public API; the protoc / flex / bison case — executables the build invokes at configure time) in a sibling block to `dependencies`. Buildable at the author's root and at source-build of a transitive, but **never walked transitively when a downstream consumer pulls the prebuilt binary** — they just get the lean runtime closure. `whenOption: "websocket"` (or `"api=legacy"`) gates a dep on a recipe-declared option value, evaluated at the seam where the package's effective options are known (root install + source-build). The combination also subsumes Conan's `test_requires`: declare `options.tests` and list gtest in `buildDependencies` with `whenOption: "tests"` — default `tests=false` skips it, `-o MyPkg:tests=true` opts in for that build, consumers of the prebuilt binary never see it either way. Mirrors Conan 2.0's `requires` / `tool_requires` split. Backward compat is automatic — old wyvrnpm clients ignore the unknown top-level field. `wyvrnpm show` surfaces both blocks per-profile so a publisher can verify what shipped. (Cross-compilation case — tool requires resolved under a *build* profile distinct from the *host* profile — stays open as F4, deferred pending a concrete cross-compilation user.) **New:** npm self-update notifier — when a newer `wyvrnpm` is on the npm registry, the next interactive run prints a one-line `[wyvrn] warn  wyvrnpm <old> → <new> available` banner on stderr. The fetch happens in a detached background process so the user's command never blocks on the network; the banner appears on the *following* invocation after the cache (`%LOCALAPPDATA%\wyvrnpm\update-check.json`) is populated. Auto-suppressed in CI (`$CI`), non-TTY runs, and `--format json` mode; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps) instead of pulling in `update-notifier` and its 10+ transitives. Closes the gap where users on stale CLIs silently missed bug fixes (the `2.8.4` CloudFront cache-split fix and the `2.12.2` install-failure exit code, in particular). **Resolver caches `@latest` lookups** within a single `wyvrnpm install` — when a package is referenced as `@latest` from multiple parents in the dep graph (or already resolved earlier via a range), the registry round-trip is reused instead of re-probing `latest.json` per encounter. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph; visible win on resolution wall-time when the registry sits behind CloudFront. Closes the parallel gap to `manifestCache` / `publishedCache` — all three S3-backed helpers in `resolve.js` now memoise per-name within one install. **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` then emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL instead of a single fat zip. Consumers fetch only the configs they need: `wyvrnpm install --request-configs Release` on a CI runner pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports (`IMPORTED_LOCATION_<CONFIG>`) so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` Release vs `lib/food.lib` Debug, via `CMAKE_DEBUG_POSTFIX`) classify correctly. `wyvrn.local.json` gains `requestConfigs` (global) + `depRequestConfigs` (per-dep override — "all four configs of fmt, but MinSizeRel of grpc"). Attestation v2 binds an `artefactSha256: { config → sha }` map; one signature covers every slice. `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (the existence check degrades to `wouldOverwrite: null` instead of crashing). Highlights since 2.8.3: S1 artefact signing — Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`; `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`; `--require-signatures` on install, `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish; pure-Node `crypto` (no external tooling, identical on Windows / Linux / macOS). Closes S1 + S3. Profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
+> **README version: 2.15.0**
+>
+> **New in 2.15.0:**
+>
+> - **`buildDependencies` block + `whenOption` gating.** Recipes declare author-private deps (asio / websocketpp / boost-internals — header-only libs that compile into a `StaticLib`; protoc / flex / bison — tools invoked at configure time) in a sibling block to `dependencies`. Walked at the author's root and at source-build of a transitive, but **never walked transitively when a downstream consumer pulls the prebuilt binary** — they get the lean runtime closure. `whenOption: "websocket"` (or `"api=legacy"`) gates a dep on a recipe-declared option value. Subsumes Conan's `test_requires`: `options.tests` + gtest in `buildDependencies` with `whenOption: "tests"` → consumers of the prebuilt binary never see it. Closes EVALUATION.md **F3**; cross-compilation half stays open as F4.
+> - **npm self-update notifier.** When a newer `wyvrnpm` is on the npm registry, the next interactive run prints `[wyvrn] warn  wyvrnpm <old> → <new> available` on stderr. The fetch runs in a detached background process — the user's command never blocks on the network; the banner appears on the *following* invocation. Auto-suppressed in CI, non-TTY, and `--format json`; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps).
+> - **Resolver caches `@latest` lookups** within a single `wyvrnpm install`. When a package is referenced as `@latest` from multiple parents (or already resolved via a range), the registry round-trip is reused. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph behind CloudFront. Brings `latestCache` into line with the existing `manifestCache` / `publishedCache`.
+> - **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL. Consumers fetch only what they need — `wyvrnpm install --request-configs Release` pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports, so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` vs `lib/food.lib`) classify correctly. `wyvrn.local.json` gains `requestConfigs` + `depRequestConfigs`. Attestation v2 binds an `artefactSha256: { config → sha }` map under one signature.
+> - `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (`wouldOverwrite: null` instead of crashing).
+>
+> **Highlights since 2.8.3:**
+>
+> - **S1 artefact signing.** Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`. `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`. `--require-signatures` on install; `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish. Pure-Node `crypto` — no external tooling, identical on Windows / Linux / macOS. Closes **S1** + **S3**.
+> - **`compiler.cppstd` is authoritative.** `CMAKE_CXX_STANDARD` is set unconditionally before `project()`; `cpp.cmake` no longer touches it post-`project()`. A `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile.
+> - **Honest install exit codes.** `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) with a per-dep failure summary, instead of misreporting "Done — N installed".
+> - **Streaming publish via `archiver`.** Handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs.
+> - **`--build-dir <path>` + `wyvrn.local.json:binaryDirRoot`.** Sidesteps `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …).
+> - **`wyvrnpm version`** — read / set / partially update the top-level `version` field from CI (`wyvrnpm version --build "$BUILD_ID"`).
+> - **`wyvrnpm bootstrap <git-url>`** — scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults.
+> - **`wyvrnpm publish --dry-run`** — npm-style preview of the upload plan; `wouldOverwrite` flag in `--format json`.
+> - **`wyvrnpm build --config Debug,Release` / `--all-configs`** — build multiple configurations from a single configure.
+> - **CloudFront brotli-vs-identity cache split fix** — resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist.
+>
+> Full list in [claude/EVALUATION.md](claude/EVALUATION.md).
 
 ---
 

package/bin/wyvrnpm.js

@@ -506,9 +506,34 @@ yargs
   // ── clean ─────────────────────────────────────────────────────────────────
   .command(
     'clean',
-    'Remove downloaded packages and lock file. --build-cache also wipes the machine-wide source-build cache.',
+    'Remove downloaded packages and lock file. --build-dir adds the active profile\'s CMake build dir; --all wipes the entire wyvrnpm workspace footprint.',
     (y) => {
       y
+        .option('profile', {
+          alias: 'p',
+          type: 'string',
+          description: 'Active profile name — determines which wyvrn-<profile>/ build dir --build-dir targets',
+        })
+        .option('build-dir', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Also remove the active profile\'s CMake build directory ' +
+            '(<binaryDirRoot>/wyvrn-<profile>/). Pairs well with CI cleanup. ' +
+            'binaryDirRoot resolves from wyvrn.local.json; non-default roots ' +
+            'set only via the install-time --build-dir <path> flag will not ' +
+            'be found here.',
+        })
+        .option('all', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Wipe every wyvrnpm-managed file in the workspace: wyvrn_internal/, ' +
+            'wyvrn.lock, every <binaryDirRoot>/wyvrn-*/ build dir, and wyvrn-* ' +
+            'entries from CMakePresets.json / CMakeUserPresets.json. Does NOT ' +
+            'touch the machine-wide build cache — combine with --build-cache ' +
+            'for that.',
+        })
         .option('build-cache', {
           type: 'boolean',
           default: false,
@@ -521,12 +546,19 @@ yargs
             'Wipe only the local record of artefacts uploaded via --upload-built ' +
             '(the .uploaded-to.json sidecars in the build cache). Does not touch ' +
             'the registry, the artefact zips, or wyvrn_internal/.',
+        })
+        .option('dry-run', {
+          type: 'boolean',
+          default: false,
+          description: 'Print what would be removed without modifying anything.',
         });
     },
     (argv) => clean({
       ...argv,
+      buildDir:       argv['build-dir'],
       buildCache:     argv['build-cache'],
       uploadedBuilt:  argv['uploaded-built'],
+      dryRun:         argv['dry-run'],
     }),
   )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.15.0",
+  "version": "2.16.1",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/commands/clean.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const fs = require('fs');
+const fs   = require('fs');
 const path = require('path');
 
 const {
@@ -8,72 +8,230 @@ const {
   getBuildCacheRoot,
   clearUploadSidecars,
 } = require('../build/cache');
+const { readConfig }                = require('../config');
+const { readLocalOverlay }          = require('../conf');
+const { resolveBinaryDirRoot }      = require('../binary-dir');
+const { stripWyvrnPresets, safeReadJson } = require('../toolchain/presets');
 const log = require('../logger');
 
+/**
+ * Resolve the active profile name using the same precedence install/build
+ * use, but without pulling the full buildContext (which would require a
+ * manifest, parse --conf, etc. — overkill for a cleanup command).
+ *
+ * Precedence: --profile > config.defaultProfile > "default".
+ */
+function resolveProfileName(argv) {
+  if (typeof argv.profile === 'string' && argv.profile.length > 0) {
+    return argv.profile;
+  }
+  const config = readConfig();
+  if (typeof config.defaultProfile === 'string' && config.defaultProfile.length > 0) {
+    return config.defaultProfile;
+  }
+  return 'default';
+}
+
+/**
+ * Resolve binaryDirRoot the same way install/build do — overlay-only on
+ * clean (no `--build-dir <path>` setter; clean's `--build-dir` is a
+ * boolean selector). If the user installed against a non-default root
+ * via the install-time CLI flag, they need the overlay set for cleanup
+ * to find the same tree.
+ */
+function resolveBinaryRoot(rootDir) {
+  const overlay = readLocalOverlay(rootDir);
+  return resolveBinaryDirRoot({
+    localOverlayBinaryDirRoot: overlay.binaryDirRoot,
+  });
+}
+
+/**
+ * List every `wyvrn-*` subdirectory directly under `<rootDir>/<binaryRoot>/`.
+ * Returns absolute paths. Empty list if the parent dir doesn't exist.
+ */
+function listWyvrnBuildDirs(rootDir, binaryRoot) {
+  const parent = path.join(rootDir, binaryRoot);
+  if (!fs.existsSync(parent)) return [];
+  let entries;
+  try {
+    entries = fs.readdirSync(parent, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((e) => e.isDirectory() && e.name.startsWith('wyvrn-'))
+    .map((e) => path.join(parent, e.name));
+}
+
+/**
+ * Remove a path (file or dir). Honours dry-run by logging instead. Returns
+ * true if the path existed and we either removed it or would have.
+ */
+function removePath(p, { dryRun, label }) {
+  if (!fs.existsSync(p)) return false;
+  if (dryRun) {
+    log.info(`Would remove ${label ?? p}`);
+  } else {
+    fs.rmSync(p, { recursive: true, force: true });
+    log.info(`Removed ${label ?? p}`);
+  }
+  return true;
+}
+
+/**
+ * Strip wyvrn-generated entries from `CMakePresets.json` /
+ * `CMakeUserPresets.json`. User-owned files (no wyvrnpm vendor marker)
+ * are left untouched. Files whose only meaningful content was wyvrnpm's
+ * are deleted; files with surviving foreign content are rewritten.
+ *
+ * Returns the number of files touched (incl. dry-run "would touch").
+ */
+function stripPresetsFromWorkspace(rootDir, { dryRun }) {
+  const candidates = [
+    path.join(rootDir, 'CMakePresets.json'),
+    path.join(rootDir, 'CMakeUserPresets.json'),
+  ];
+  let touched = 0;
+  for (const filePath of candidates) {
+    if (!fs.existsSync(filePath)) continue;
+    const existing = safeReadJson(filePath);
+    if (!existing) continue;
+    // Only act on files we generated. A user-owned file (no wyvrnpm
+    // vendor marker AND no wyvrn-* presets) is left alone — defence in
+    // depth so we never strip presets from a hand-authored file even
+    // if a stray `wyvrn-x` name slipped in.
+    const hasOurVendor = !!(existing.vendor && existing.vendor['wyvrnpm/generated']);
+    const hasOurPresets =
+      (existing.configurePresets ?? []).some((p) => p && typeof p.name === 'string' && p.name.startsWith('wyvrn-')) ||
+      (existing.buildPresets     ?? []).some((p) => p && typeof p.name === 'string' && p.name.startsWith('wyvrn-'));
+    if (!hasOurVendor && !hasOurPresets) continue;
+
+    const { result, removed } = stripWyvrnPresets(existing);
+    if (removed.length === 0 && hasOurVendor && !result) continue;
+
+    if (result === null) {
+      if (dryRun) {
+        log.info(`Would remove ${filePath} (only wyvrnpm content remained)`);
+      } else {
+        fs.unlinkSync(filePath);
+        log.info(`Removed ${filePath} (only wyvrnpm content remained)`);
+      }
+    } else {
+      if (dryRun) {
+        log.info(`Would strip ${removed.length} wyvrn-* preset(s) from ${filePath}`);
+      } else {
+        fs.writeFileSync(filePath, JSON.stringify(result, null, 2) + '\n', 'utf8');
+        log.info(`Stripped ${removed.length} wyvrn-* preset(s) from ${filePath}`);
+      }
+    }
+    touched += 1;
+  }
+  return touched;
+}
+
 /**
  * Removes the project's `wyvrn_internal/` package cache and `wyvrn.lock` file.
- * With `--build-cache`, also clears the machine-wide source-build cache
- * under `%LOCALAPPDATA%\wyvrnpm\bc\` (shared across projects).
  *
- * `--uploaded-built` wipes just the consumer's local RECORD of what they
- * have uploaded via `wyvrnpm install --build=missing --upload-built` (the
- * `.uploaded-to.json` sidecars under the build cache). It does NOT touch
- * the registry, the artefact zips, or the source clones. Privacy / local
- * audit cleanup only.
+ * Flag matrix:
+ *   - (default)        wyvrn_internal/ + wyvrn.lock
+ *   - --build-dir      also the active profile's wyvrn-<profile> build dir
+ *   - --all            default set + every wyvrn-prefixed build dir + wyvrn-prefixed preset entries
+ *   - --build-cache    also the machine-wide source-build cache
+ *   - --uploaded-built wipe just the upload sidecars (targeted-only when used
+ *                      alone — does not also do the default scrub)
+ *   - --dry-run        print what would be removed; write nothing
  *
  * @param {object}  argv
  * @param {string}  argv.root             Project root directory.
  * @param {string}  argv.manifest         Path to the manifest file (used to locate wyvrn.lock).
+ * @param {string}  [argv.profile]        Active profile name (overrides config.defaultProfile).
+ * @param {boolean} [argv.buildDir]       When true, also wipes <binaryDirRoot>/wyvrn-<profile>/.
+ * @param {boolean} [argv.all]            When true, scorched-earth workspace cleanup.
  * @param {boolean} [argv.buildCache]     When true, also nukes the source-build cache.
  * @param {boolean} [argv.uploadedBuilt]  When true, wipes upload sidecars only.
+ * @param {boolean} [argv.dryRun]         When true, log intentions but write nothing.
  * @returns {Promise<void>}
  */
 async function clean(argv) {
   const rootDir  = path.resolve(argv.root);
   const razerDir = path.join(rootDir, 'wyvrn_internal');
   const lockPath = path.join(path.dirname(path.resolve(argv.manifest)), 'wyvrn.lock');
+  const dryRun   = !!argv.dryRun;
 
   // --uploaded-built is a targeted cleanup mode. When passed on its own,
   // skip the default wyvrn_internal/ + wyvrn.lock scrub so a user can
   // "forget uploads" without also wiping their project-local install.
-  const targetedOnly = argv.uploadedBuilt && !argv.buildCache;
+  // --all forces the default scrub regardless (scorched-earth wins).
+  const targetedOnly = argv.uploadedBuilt && !argv.buildCache && !argv.buildDir && !argv.all;
 
   let removedAnything = false;
 
   if (!targetedOnly) {
-    if (fs.existsSync(razerDir)) {
-      fs.rmSync(razerDir, { recursive: true, force: true });
-      log.info(`Removed ${razerDir}`);
-      removedAnything = true;
+    if (removePath(razerDir, { dryRun, label: razerDir })) removedAnything = true;
+    else log.info(`Nothing to clean at ${razerDir}`);
+
+    if (removePath(lockPath, { dryRun, label: lockPath })) removedAnything = true;
+  }
+
+  // --build-dir / --all: wipe CMake build trees.
+  if (argv.buildDir || argv.all) {
+    const binaryRoot = resolveBinaryRoot(rootDir);
+
+    if (argv.all) {
+      // Every wyvrn-* subdir under binaryDirRoot — covers all profiles
+      // any past install/build wrote to.
+      const dirs = listWyvrnBuildDirs(rootDir, binaryRoot);
+      if (dirs.length === 0) {
+        log.info(`No wyvrn-* build directories under ${path.join(rootDir, binaryRoot)}`);
+      }
+      for (const d of dirs) {
+        if (removePath(d, { dryRun, label: d })) removedAnything = true;
+      }
     } else {
-      log.info(`Nothing to clean at ${razerDir}`);
+      // Active profile only — symmetric with `wyvrnpm build --clean`.
+      const profileName = resolveProfileName(argv);
+      const buildDir    = path.join(rootDir, binaryRoot, `wyvrn-${profileName}`);
+      if (removePath(buildDir, { dryRun, label: buildDir })) removedAnything = true;
+      else log.info(`Nothing to clean at ${buildDir}`);
     }
+  }
 
-    if (fs.existsSync(lockPath)) {
-      fs.unlinkSync(lockPath);
-      log.info(`Removed ${lockPath}`);
-      removedAnything = true;
-    }
+  // --all: also strip wyvrn-* entries from CMakePresets.json / CMakeUserPresets.json.
+  if (argv.all) {
+    const touched = stripPresetsFromWorkspace(rootDir, { dryRun });
+    if (touched > 0) removedAnything = true;
   }
 
   if (argv.buildCache) {
-    const removed = clearBuildCache();
-    if (removed) {
-      log.info(`Removed source-build cache ${removed}`);
+    if (dryRun) {
+      log.info(`Would remove source-build cache ${getBuildCacheRoot()}`);
       removedAnything = true;
     } else {
-      log.info(`No source-build cache at ${getBuildCacheRoot()}`);
+      const removed = clearBuildCache();
+      if (removed) {
+        log.info(`Removed source-build cache ${removed}`);
+        removedAnything = true;
+      } else {
+        log.info(`No source-build cache at ${getBuildCacheRoot()}`);
+      }
     }
   } else if (argv.uploadedBuilt) {
     // clearBuildCache() would have nuked the sidecars as a side-effect, so
     // only bother with the sidecar sweep when the cache itself is surviving.
-    const removed = clearUploadSidecars();
-    log.info(`Removed ${removed} upload record${removed === 1 ? '' : 's'} from the build cache`);
-    if (removed > 0) removedAnything = true;
+    if (dryRun) {
+      log.info('Would remove upload sidecars from the build cache');
+    } else {
+      const removed = clearUploadSidecars();
+      log.info(`Removed ${removed} upload record${removed === 1 ? '' : 's'} from the build cache`);
+      if (removed > 0) removedAnything = true;
+    }
   }
 
   if (!removedAnything) {
     log.info('Nothing to clean.');
+  } else if (dryRun) {
+    log.info('Dry run — no files were modified.');
   }
 }
 

package/src/toolchain/presets.js

@@ -343,8 +343,86 @@ function generateCMakePresets({
   return { path: null, action: 'skipped', isUser: false };
 }
 
+/**
+ * Strip every wyvrnpm-generated entry from a parsed presets object.
+ * Mirror of `mergeIntoExisting` — used by `wyvrnpm clean --all` to
+ * leave no trace of our injections in the consumer's CMakePresets.json.
+ *
+ * Both `configurePresets` and `buildPresets` are filtered for names
+ * matching `/^wyvrn-/`. The wyvrnpm `vendor` entry is always removed.
+ *
+ * Returns:
+ *   - `result: null`  → the file is now empty of meaningful content
+ *                       (no presets of either kind, no other vendor
+ *                       entries, no other top-level keys beyond the
+ *                       schema `version`). Caller should delete the
+ *                       file rather than write a husk.
+ *   - `result: object` → the trimmed object the caller should write
+ *                        back. Foreign vendor blocks, user-named
+ *                        presets, and any other top-level keys are
+ *                        preserved.
+ *   - `removed: string[]` → names of every preset (configure + build)
+ *                           that was stripped. Useful for dry-run
+ *                           reporting.
+ *
+ * @param {object|null} existing
+ * @returns {{ result: object|null, removed: string[] }}
+ */
+function stripWyvrnPresets(existing) {
+  if (!existing || typeof existing !== 'object') {
+    return { result: null, removed: [] };
+  }
+
+  const isWyvrnName = (n) => typeof n === 'string' && n.startsWith('wyvrn-');
+
+  const removed = [];
+  const configurePresets = (existing.configurePresets ?? []).filter((p) => {
+    if (p && isWyvrnName(p.name)) { removed.push(p.name); return false; }
+    return true;
+  });
+  const buildPresets = (existing.buildPresets ?? []).filter((p) => {
+    if (p && (isWyvrnName(p.name) || isWyvrnName(p.configurePreset))) {
+      removed.push(p.name);
+      return false;
+    }
+    return true;
+  });
+
+  // Drop our vendor marker; preserve any foreign vendor entries.
+  let vendor = existing.vendor;
+  if (vendor && typeof vendor === 'object') {
+    const { [VENDOR_KEY]: _ours, ...rest } = vendor;
+    vendor = Object.keys(rest).length > 0 ? rest : undefined;
+  }
+
+  // Decide if anything meaningful survives. The schema `version` field
+  // is metadata, not content — a file with only `{ version: 3 }` is a
+  // husk we should delete.
+  const hasSurvivingPresets = configurePresets.length > 0 || buildPresets.length > 0;
+  const hasForeignVendor = vendor !== undefined;
+  const otherTopLevelKeys = Object.keys(existing).filter(
+    (k) => k !== 'version' && k !== 'vendor' && k !== 'configurePresets' && k !== 'buildPresets',
+  );
+
+  if (!hasSurvivingPresets && !hasForeignVendor && otherTopLevelKeys.length === 0) {
+    return { result: null, removed };
+  }
+
+  const result = { ...existing };
+  if (configurePresets.length > 0) result.configurePresets = configurePresets;
+  else delete result.configurePresets;
+  if (buildPresets.length > 0) result.buildPresets = buildPresets;
+  else delete result.buildPresets;
+  if (vendor !== undefined) result.vendor = vendor;
+  else delete result.vendor;
+
+  return { result, removed };
+}
+
 module.exports = {
   generateCMakePresets,
+  stripWyvrnPresets,
+  safeReadJson,
   // Exported for tests
   isWyvrnGenerated,
   buildConfigurePreset,