wyvrnpm 2.16.0 → 2.16.1

package/README.md

@@ -4,7 +4,30 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.15.0** — **New:** `buildDependencies` block + `whenOption` gating — closes EVALUATION.md **F3** (`tool_requires` + `test_requires`). Recipes can now declare author-private deps (the asio / websocketpp / boost-internals case — header-only libs that compile into a `StaticLib` and aren't exposed by its public API; the protoc / flex / bison case — executables the build invokes at configure time) in a sibling block to `dependencies`. Buildable at the author's root and at source-build of a transitive, but **never walked transitively when a downstream consumer pulls the prebuilt binary** — they just get the lean runtime closure. `whenOption: "websocket"` (or `"api=legacy"`) gates a dep on a recipe-declared option value, evaluated at the seam where the package's effective options are known (root install + source-build). The combination also subsumes Conan's `test_requires`: declare `options.tests` and list gtest in `buildDependencies` with `whenOption: "tests"` — default `tests=false` skips it, `-o MyPkg:tests=true` opts in for that build, consumers of the prebuilt binary never see it either way. Mirrors Conan 2.0's `requires` / `tool_requires` split. Backward compat is automatic — old wyvrnpm clients ignore the unknown top-level field. `wyvrnpm show` surfaces both blocks per-profile so a publisher can verify what shipped. (Cross-compilation case — tool requires resolved under a *build* profile distinct from the *host* profile — stays open as F4, deferred pending a concrete cross-compilation user.) **New:** npm self-update notifier — when a newer `wyvrnpm` is on the npm registry, the next interactive run prints a one-line `[wyvrn] warn  wyvrnpm <old> → <new> available` banner on stderr. The fetch happens in a detached background process so the user's command never blocks on the network; the banner appears on the *following* invocation after the cache (`%LOCALAPPDATA%\wyvrnpm\update-check.json`) is populated. Auto-suppressed in CI (`$CI`), non-TTY runs, and `--format json` mode; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps) instead of pulling in `update-notifier` and its 10+ transitives. Closes the gap where users on stale CLIs silently missed bug fixes (the `2.8.4` CloudFront cache-split fix and the `2.12.2` install-failure exit code, in particular). **Resolver caches `@latest` lookups** within a single `wyvrnpm install` — when a package is referenced as `@latest` from multiple parents in the dep graph (or already resolved earlier via a range), the registry round-trip is reused instead of re-probing `latest.json` per encounter. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph; visible win on resolution wall-time when the registry sits behind CloudFront. Closes the parallel gap to `manifestCache` / `publishedCache` — all three S3-backed helpers in `resolve.js` now memoise per-name within one install. **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` then emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL instead of a single fat zip. Consumers fetch only the configs they need: `wyvrnpm install --request-configs Release` on a CI runner pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports (`IMPORTED_LOCATION_<CONFIG>`) so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` Release vs `lib/food.lib` Debug, via `CMAKE_DEBUG_POSTFIX`) classify correctly. `wyvrn.local.json` gains `requestConfigs` (global) + `depRequestConfigs` (per-dep override — "all four configs of fmt, but MinSizeRel of grpc"). Attestation v2 binds an `artefactSha256: { config → sha }` map; one signature covers every slice. `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (the existence check degrades to `wouldOverwrite: null` instead of crashing). Highlights since 2.8.3: S1 artefact signing — Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`; `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`; `--require-signatures` on install, `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish; pure-Node `crypto` (no external tooling, identical on Windows / Linux / macOS). Closes S1 + S3. Profile's `compiler.cppstd` is now authoritative for the toolchain — `CMAKE_CXX_STANDARD` is set unconditionally before `project()` and `cpp.cmake` no longer touches it post-`project()`, so a `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile; `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) and prints a per-dep failure summary instead of misreporting "Done — N installed"; streaming publish via `archiver` (handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs); `--build-dir <path>` + `wyvrn.local.json:binaryDirRoot` to sidestep `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …); `wyvrnpm version` to read / set / partially update the top-level `version` field from CI pipelines (`wyvrnpm version --build "$BUILD_ID"`); `wyvrnpm bootstrap <git-url>` to scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults; `wyvrnpm publish --dry-run` (npm-style preview of the upload plan, plus `wouldOverwrite` flag in `--format json`); `wyvrnpm build --config Debug,Release` / `--all-configs` to build multiple configurations from a single configure; resolver hardened against the CloudFront brotli-vs-identity cache split (resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist). Full list in `claude/EVALUATION.md`.
+> **README version: 2.15.0**
+>
+> **New in 2.15.0:**
+>
+> - **`buildDependencies` block + `whenOption` gating.** Recipes declare author-private deps (asio / websocketpp / boost-internals — header-only libs that compile into a `StaticLib`; protoc / flex / bison — tools invoked at configure time) in a sibling block to `dependencies`. Walked at the author's root and at source-build of a transitive, but **never walked transitively when a downstream consumer pulls the prebuilt binary** — they get the lean runtime closure. `whenOption: "websocket"` (or `"api=legacy"`) gates a dep on a recipe-declared option value. Subsumes Conan's `test_requires`: `options.tests` + gtest in `buildDependencies` with `whenOption: "tests"` → consumers of the prebuilt binary never see it. Closes EVALUATION.md **F3**; cross-compilation half stays open as F4.
+> - **npm self-update notifier.** When a newer `wyvrnpm` is on the npm registry, the next interactive run prints `[wyvrn] warn  wyvrnpm <old> → <new> available` on stderr. The fetch runs in a detached background process — the user's command never blocks on the network; the banner appears on the *following* invocation. Auto-suppressed in CI, non-TTY, and `--format json`; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps).
+> - **Resolver caches `@latest` lookups** within a single `wyvrnpm install`. When a package is referenced as `@latest` from multiple parents (or already resolved via a range), the registry round-trip is reused. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph behind CloudFront. Brings `latestCache` into line with the existing `manifestCache` / `publishedCache`.
+> - **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL. Consumers fetch only what they need — `wyvrnpm install --request-configs Release` pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports, so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` vs `lib/food.lib`) classify correctly. `wyvrn.local.json` gains `requestConfigs` + `depRequestConfigs`. Attestation v2 binds an `artefactSha256: { config → sha }` map under one signature.
+> - `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (`wouldOverwrite: null` instead of crashing).
+>
+> **Highlights since 2.8.3:**
+>
+> - **S1 artefact signing.** Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`. `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`. `--require-signatures` on install; `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish. Pure-Node `crypto` — no external tooling, identical on Windows / Linux / macOS. Closes **S1** + **S3**.
+> - **`compiler.cppstd` is authoritative.** `CMAKE_CXX_STANDARD` is set unconditionally before `project()`; `cpp.cmake` no longer touches it post-`project()`. A `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile.
+> - **Honest install exit codes.** `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) with a per-dep failure summary, instead of misreporting "Done — N installed".
+> - **Streaming publish via `archiver`.** Handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs.
+> - **`--build-dir <path>` + `wyvrn.local.json:binaryDirRoot`.** Sidesteps `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …).
+> - **`wyvrnpm version`** — read / set / partially update the top-level `version` field from CI (`wyvrnpm version --build "$BUILD_ID"`).
+> - **`wyvrnpm bootstrap <git-url>`** — scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults.
+> - **`wyvrnpm publish --dry-run`** — npm-style preview of the upload plan; `wouldOverwrite` flag in `--format json`.
+> - **`wyvrnpm build --config Debug,Release` / `--all-configs`** — build multiple configurations from a single configure.
+> - **CloudFront brotli-vs-identity cache split fix** — resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist.
+>
+> Full list in [claude/EVALUATION.md](claude/EVALUATION.md).
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.16.0",
+  "version": "2.16.1",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",