wyvrnpm 2.21.3 → 2.22.0

package/README.md

@@ -4,44 +4,22 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.20.2**
+> **README version: 2.22.0**
 >
-> **New in 2.16.0 – 2.20.2:**
+> **New in 2.16.0 – 2.22.0:**
 >
-> - **Visual Studio architecture pinning (2.20.0).** A recipe-less Windows/MSVC consumer (one that only lists `dependencies`, no `build` recipe) used to get a generator-less `wyvrn-<profile>` preset, so `cmake --preset` fell through to CMake's implicit Visual Studio default — which targets the **host** arch (x64) when no `-A` is supplied. An `x86` / `armv8` profile therefore silently produced 64-bit binaries. `wyvrnpm install` now detects the default VS generator and bakes both `generator` and `architecture` into the emitted preset, and `wyvrnpm build` derives `-A` (`x86→Win32`, `x86_64→x64`, `armv8→ARM64`, `armv7→ARM`) for VS generators. Builds now match the profile's bitness without a recipe. (Already-published non-host-arch artefacts built via the old source-build path may still hold wrong-bitness binaries — those are rebuilt + republished out of band.)
-> - **`wyvrnpm build` resolves the generator from the emitted preset, not the recipe (2.20.2).** The configure step now reads the generator that `cmake --preset` will *actually* use — precedence: CLI `--generator` > the `generator` baked into `CMakePresets.json` > the detected default for a generator-less preset. This drives both the `-A` pin and the vcvarsall-skip decision, so they stay consistent with reality. Fixes a class of failures where a Ninja Multi-Config preset got `-A x64` ("does not support platform specification") and skipped vcvarsall ("CMAKE_CXX_COMPILER not set") because the old code re-derived the generator from the recipe — which can legitimately diverge from the preset (an install-time `--generator`, or a recipe edited after the last install).
-> - **CMake-path fallback (2.20.1).** `install` / `build` / source-build no longer fail outright on a machine where CMake isn't on `PATH` — `resolveCmakeExe()` falls back to the Windows default `C:\Program Files\CMake\bin\cmake.exe` before surfacing the usual "is CMake installed?" error.
-> - **Machine-wide binary package cache (2.19.0).** Every successful v2 exact-match download is also cached under `%LOCALAPPDATA%\wyvrnpm\pkg\` (14-day TTL) so re-installs across projects skip the network. `wyvrnpm cache list` / `cache prune` gain a `--type src|pkg|all` selector covering both this and the source-build cache, and `wyvrnpm clean --pkg-cache` wipes it.
-> - **`wyvrnpm test` (2.18.0).** A `ctest --preset wyvrn-<profile>-<config>` wrapper that auto-builds when stale, supports `-R` / `-L` filters and `--all-configs`, and emits a `--format json` summary for CI.
-> - **Output directory restructure (2.17.0).** Compiled artefacts now land inside the CMake binary dir (`<binaryDir>/lib`, `<binaryDir>/bin`) instead of `${CMAKE_SOURCE_DIR}/output/`, so `wyvrnpm clean --all` actually catches them. Scripts that hard-coded `output/bin64/…` must switch paths — `clean --all` sweeps the legacy `output/` tree as a migration aid.
-> - **`wyvrnpm clean` flags (2.16.0).** `--build-dir` (also wipe the active profile's CMake build tree), `--all` (scorched-earth: build dirs + `wyvrn-*` presets + legacy `output/`), and `--dry-run` (preview, write nothing).
+> - **`build --configure-only` (2.22.0)** — configure only (`cmake --preset` → `.sln` / `build.ninja`), skip compile; still auto-installs + applies the MSVC env / VS `-A` pin.
+> - **VS architecture pinning (2.20.0)** — recipe-less Windows/MSVC consumers bake `generator` + `architecture` into the preset and derive `-A` from arch, so `x86` / `armv8` profiles stop silently building x64.
+> - **Generator from preset, not recipe (2.20.2)** — configure reads the generator `cmake --preset` will actually use (CLI `--generator` > baked preset > detected default), keeping the `-A` pin + vcvarsall-skip consistent.
+> - **CMake-path fallback (2.20.1)** — falls back to `C:\Program Files\CMake\bin\cmake.exe` when CMake isn't on `PATH`.
+> - **Machine-wide pkg cache (2.19.0)** — v2 downloads cached under `%LOCALAPPDATA%\wyvrnpm\pkg\` (14-day TTL); `cache list` / `prune --type src|pkg|all`, `clean --pkg-cache`.
+> - **`wyvrnpm test` (2.18.0)** — `ctest --preset` wrapper: auto-build, `-R` / `-L` filters, `--all-configs`, `--format json`.
+> - **Output dir restructure (2.17.0)** — artefacts land in `<binaryDir>/lib|bin` instead of `output/`; `clean --all` catches them.
+> - **`clean` flags (2.16.0)** — `--build-dir`, `--all`, `--dry-run`.
 >
-> **Planned (not yet shipped):**
+> **Planned:** resolver → provider unification — route metadata lookups through provider methods so S3 SigV4 / auth live in one place ([plan](.claude-wyvrn-local/plans/2026-04-24-resolver-http-unify.md)).
 >
-> - **Resolver → provider unification.** Today the dependency resolver (`resolve.js` / `download.js`) talks to registries through a bare `fetch` client that hard-codes the v2/v1 URL layouts, separate from the provider classes that handle publish + download. The plan is to route all metadata lookups through provider methods (`v2GetVersionsIndex` / `v2GetMeta` / `v2GetLatest` / `v1*`) so S3 SigV4, auth resolution, and provider-specific quirks live in one place. Design captured in [.claude-wyvrn-local/plans/2026-04-24-resolver-http-unify.md](.claude-wyvrn-local/plans/2026-04-24-resolver-http-unify.md). The 2.8.4 `Accept-Encoding: identity` hotfix covers the immediate CloudFront cache-split symptom in the meantime.
->
-> **New in 2.15.0:**
->
-> - **`buildDependencies` block + `whenOption` gating.** Recipes declare author-private deps (asio / websocketpp / boost-internals — header-only libs that compile into a `StaticLib`; protoc / flex / bison — tools invoked at configure time) in a sibling block to `dependencies`. Walked at the author's root and at source-build of a transitive, but **never walked transitively when a downstream consumer pulls the prebuilt binary** — they get the lean runtime closure. `whenOption: "websocket"` (or `"api=legacy"`) gates a dep on a recipe-declared option value. Subsumes Conan's `test_requires`: `options.tests` + gtest in `buildDependencies` with `whenOption: "tests"` → consumers of the prebuilt binary never see it. Closes EVALUATION.md **F3**; cross-compilation half stays open as F4.
-> - **npm self-update notifier.** When a newer `wyvrnpm` is on the npm registry, the next interactive run prints `[wyvrn] warn  wyvrnpm <old> → <new> available` on stderr. The fetch runs in a detached background process — the user's command never blocks on the network; the banner appears on the *following* invocation. Auto-suppressed in CI, non-TTY, and `--format json`; opt out via `WYVRNPM_NO_UPDATE_CHECK=1` or `--no-update-check`. Hand-rolled (~120 lines, zero new deps).
-> - **Resolver caches `@latest` lookups** within a single `wyvrnpm install`. When a package is referenced as `@latest` from multiple parents (or already resolved via a range), the registry round-trip is reused. Eliminates ~12 redundant HTTPS round-trips on a typical 16-dep graph behind CloudFront. Brings `latestCache` into line with the existing `manifestCache` / `publishedCache`.
-> - **Per-config artefact slicing.** Recipes opt in via `build.publishPerConfig: true`; `wyvrnpm publish` emits one `wyvrn-<Config>.zip` per declared CMake config under one `profileHash` URL. Consumers fetch only what they need — `wyvrnpm install --request-configs Release` pulls 1.93 GB of gRPC instead of 14.96 GB across all four configs (~87% saving). Driven by CMake's own `*Targets-<config>.cmake` exports, so both the MSVC convention (`lib/<Config>/foo.lib`) and the postfix convention (`lib/foo.lib` vs `lib/food.lib`) classify correctly. `wyvrn.local.json` gains `requestConfigs` + `depRequestConfigs`. Attestation v2 binds an `artefactSha256: { config → sha }` map under one signature.
-> - `wyvrnpm publish --dry-run` materialises the would-be-uploaded artefacts to `<build>/dry-run-publish/` for inspection (override with `--dry-run-out`), and tolerates expired AWS credentials (`wouldOverwrite: null` instead of crashing).
->
-> **Highlights since 2.8.3:**
->
-> - **S1 artefact signing.** Ed25519 detached signatures over a canonical attestation, verified against a per-registry `.trust/keys.json`. `wyvrnpm key gen / show-pub`, `wyvrnpm trust list / refresh`, `wyvrnpm configure signing set-default / show / unset`. `--require-signatures` on install; `--no-sign` / `--signing-key-env` / `--signing-key-file` on publish. Pure-Node `crypto` — no external tooling, identical on Windows / Linux / macOS. Closes **S1** + **S3**.
-> - **`compiler.cppstd` is authoritative.** `CMAKE_CXX_STANDARD` is set unconditionally before `project()`; `cpp.cmake` no longer touches it post-`project()`. A `-DCMAKE_CXX_STANDARD=23` on the cmake CLI cannot defeat a `cppstd=20` profile.
-> - **Honest install exit codes.** `wyvrnpm install` exits non-zero on partial failure (sha256-mismatch, extract-failed, no-exact-match, source-build-failed, not-found) with a per-dep failure summary, instead of misreporting "Done — N installed".
-> - **Streaming publish via `archiver`.** Handles >2 GiB artefacts that `adm-zip` choked on — e.g. gRPC's `RelWithDebInfo` static libs.
-> - **`--build-dir <path>` + `wyvrn.local.json:binaryDirRoot`.** Sidesteps `build/` case-insensitive-FS collisions on repos with a Bazel/Buck `BUILD` file at the root (gRPC, …).
-> - **`wyvrnpm version`** — read / set / partially update the top-level `version` field from CI (`wyvrnpm version --build "$BUILD_ID"`).
-> - **`wyvrnpm bootstrap <git-url>`** — scaffold a first-draft `wyvrn.json` for OSS C++ libraries (fmt, spdlog, zlib, …) with cookbook-driven defaults.
-> - **`wyvrnpm publish --dry-run`** — npm-style preview of the upload plan; `wouldOverwrite` flag in `--format json`.
-> - **`wyvrnpm build --config Debug,Release` / `--all-configs`** — build multiple configurations from a single configure.
-> - **CloudFront brotli-vs-identity cache split fix** — resolved a class of bugs where `show` listed a freshly-published version that `install` claimed didn't exist.
->
-> Full list in [claude/EVALUATION.md](claude/EVALUATION.md).
+> **Earlier:** `buildDependencies` + `whenOption` gating · npm self-update notifier · `@latest` lookup caching · per-config artefact slicing + `--request-configs` · `publish --dry-run` · S1 Ed25519 signing · authoritative `compiler.cppstd` · honest install exit codes · streaming publish via `archiver` · `--build-dir` / `binaryDirRoot` · `wyvrnpm version` · `wyvrnpm bootstrap` · `build --config Debug,Release` / `--all-configs` · CloudFront cache-split fix.
 
 ---
 
@@ -461,6 +439,9 @@ wyvrnpm build --install --install-prefix C:\out\stage
 # Skip the auto-install step
 wyvrnpm build --no-auto-install
 
+# Generate the .sln / build.ninja project files without compiling
+wyvrnpm build --configure-only
+
 # Pass extra args through to cmake --build
 wyvrnpm build -- -j 8
 ```
@@ -476,6 +457,7 @@ wyvrnpm build -- -j 8
 | `--target` / `-t` | *(all)* | Specific CMake target to build. |
 | `--verbose` / `-v` | `false` | Pass `--verbose` to `cmake --build`. |
 | `--clean` | `false` | Remove the build directory before configuring. |
+| `--configure-only` | `false` | Run only the CMake configure step (generate the `.sln` / `build.ninja` project files) and stop before compiling. Still auto-installs a stale toolchain and applies the MSVC env + Visual Studio `-A` arch pin. |
 | `--generator` / `-G` | *(from preset)* | Override the CMake generator used at configure time (e.g. `"Visual Studio 17 2022"`, `"Ninja"`, `"Ninja Multi-Config"`). CMake bakes the generator into the cache, so pair with `--clean` when switching. When the effective generator is Visual Studio, `-A <platform>` is auto-derived from the profile's arch (`x86→Win32`, `x86_64→x64`, `armv8→ARM64`, `armv7→ARM`) so VS doesn't silently default to x64 on 32-bit profiles. |
 | `--install` | `false` | Run `cmake --install` after a successful build. |
 | `--install-prefix` | *(baked in)* | Override `CMAKE_INSTALL_PREFIX` for `--install` without reconfiguring. |
@@ -2165,7 +2147,7 @@ wyvrnpm build --install --all-configs
 
 1. **Staleness check** — if `wyvrn_internal/wyvrn_toolchain.cmake` is missing or `wyvrn.lock` is newer than it, auto-runs `wyvrnpm install` first. Disable with `--no-auto-install`.
 2. **Optional clean** — `--clean` wipes the build directory before configuring.
-3. **Configure** — `cmake --preset wyvrn-<profile>` (or the value of `--preset`).
+3. **Configure** — `cmake --preset wyvrn-<profile>` (or the value of `--preset`). `--configure-only` stops here, leaving the generated project files in place.
 4. **Build** — `cmake --build <binaryDir> --config <config>`.
 5. **Install** — `cmake --install <binaryDir> --config <config> [--prefix <install-prefix>]`.
 

package/bin/wyvrnpm.js

@@ -392,6 +392,14 @@ yargs
           default: true,
           description: 'Auto-run `wyvrnpm install` when the toolchain is stale. Disable with --no-auto-install.',
         })
+        .option('configure-only', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Run only the CMake configure step (generate the .sln / build.ninja ' +
+            'project files) and stop before compiling. Still auto-installs a stale ' +
+            'toolchain and applies the MSVC env + Visual Studio -A arch pin.',
+        })
         .option('source', {
           alias: 's',
           type: 'string',
@@ -433,6 +441,7 @@ yargs
       installPrefix: argv['install-prefix'],
       allConfigs:    argv['all-configs'],
       buildDir:      argv['build-dir'],
+      configureOnly: argv['configure-only'],
     }),
   )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.21.3",
+  "version": "2.22.0",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/commands/build.js

@@ -475,6 +475,16 @@ async function build(argv) {
   log.info(`cmake ${configureArgs.join(' ')}`);
   await runCmake(configureArgs, cmakeEnv);
 
+  // ── Configure-only short-circuit ───────────────────────────────────────────
+  // `--configure-only` stops here: the project files (.sln / build.ninja) are
+  // generated but nothing is compiled. Deliberately placed after configure so
+  // the caller still gets the auto-install, stale-toolchain, MSVC-env, and VS
+  // `-A` arch-pin handling that raw `cmake --preset` skips.
+  if (argv.configureOnly) {
+    log.success(`Configure complete: ${binaryDir} — project files generated (build skipped)`);
+    return;
+  }
+
   // ── Build (+ optional install) per config ─────────────────────────────────
   // Configure ran once above. Multi-config generators (VS, Xcode, Ninja
   // Multi-Config) produce every config from that one configure step; for