wyvrnpm 2.3.2 → 2.8.1

package/src/build/index.js

@@ -14,6 +14,7 @@ const { resolveDependencies }   = require('../resolve');
 const { hashProfile, mergeProfile, sha256Of } = require('../profile');
 const { generateToolchain }     = require('../toolchain');
 const { normalizeOptionsDeclaration, resolveEffectiveOptions } = require('../options');
+const { readRecipeConf, cmakeCacheVariables } = require('../conf');
 const log                       = require('../logger');
 
 /**
@@ -155,8 +156,28 @@ async function buildFromSource(args) {
   }
   // Pass effective options into the recipe so `${options.<name>}` tokens in
   // `build.configure` / `build.buildArgs` expand to the concrete values that
-  // produced this build's profileHash.
-  const recipe = normalizeRecipe(clonedManifest.build, options);
+  // produced this build's profileHash. Pass the cloned manifest so PLAN-CONF.md
+  // §4.7 collision detection catches a publisher who declared the same KEY in
+  // both build.configure and conf.cmake.cache.
+  const recipe = normalizeRecipe(clonedManifest.build, options, clonedManifest);
+
+  // PLAN-CONF.md §4.8.2: source-build of a dep consumes ONLY the dep's own
+  // recipe conf — never the root project's merged conf. Translating the
+  // dep's cmake.cache namespace into -D args here keeps the dep's source-
+  // build CMake invocation aligned with its author's declared defaults
+  // while preserving cross-consumer reproducibility. The root's CLI
+  // --conf / wyvrn.local.json overlay is invisible at this seam.
+  const clonedConfFlat    = readRecipeConf(clonedManifest);
+  const clonedCacheVars   = cmakeCacheVariables(clonedConfFlat);
+  if (Object.keys(clonedCacheVars).length > 0) {
+    const confDerivedArgs = Object.entries(clonedCacheVars)
+      .map(([k, v]) => `-D${k}=${v}`);
+    recipe.configure = [...recipe.configure, ...confDerivedArgs];
+    log.info(
+      `  conf.cmake.cache → ${confDerivedArgs.length} source-build ` +
+      `configure arg(s) from the dep's own recipe`,
+    );
+  }
 
   // ── 4. Recursively resolve + download this package's OWN deps ──────────
   // Lazy-require: downloadDependencies is where we were called from, so

package/src/build/msvc-env.js

@@ -75,17 +75,35 @@ function findVcvarsall(vsInstallPath) {
   return fs.existsSync(p) ? p : null;
 }
 
+/**
+ * The complete set of arch arguments `vcvarsall.bat` accepts AND that we
+ * are willing to splice into a shell command. Explicit allow-list — any
+ * value outside this set is rejected (EVALUATION.md S5).
+ */
+const VCVARSALL_ARCH_ALLOWLIST = new Set(['x64', 'x86', 'arm64', 'arm']);
+
+const ARCH_MAP = {
+  x86_64: 'x64',
+  x86:    'x86',
+  armv8:  'arm64',
+  armv7:  'arm',
+};
+
 /**
  * Map a wyvrnpm profile arch to the argument `vcvarsall.bat` expects.
+ * Throws on an unknown profile arch — silently defaulting to `x64` would
+ * (a) produce a build for the wrong target, and (b) hand any shell-unsafe
+ * input to cmd.exe through captureVcvarsEnv's template.
  */
 function mapArch(profileArch) {
-  switch (profileArch) {
-    case 'x86_64': return 'x64';
-    case 'x86':    return 'x86';
-    case 'armv8':  return 'arm64';
-    case 'armv7':  return 'arm';
-    default:       return 'x64';
+  const arg = ARCH_MAP[profileArch];
+  if (!arg || !VCVARSALL_ARCH_ALLOWLIST.has(arg)) {
+    throw new Error(
+      `unsupported MSVC profile arch ${JSON.stringify(profileArch)}; ` +
+      `expected one of ${Object.keys(ARCH_MAP).join(', ')}`,
+    );
   }
+  return arg;
 }
 
 /**
@@ -105,6 +123,18 @@ function mapArch(profileArch) {
  * @returns {Promise<object|null>}
  */
 async function captureVcvarsEnv(vcvarsallPath, archArg) {
+  // Defense-in-depth at the shell boundary (EVALUATION.md S5). mapArch
+  // already restricts archArg to the allow-list; re-assert here so this
+  // function is safe to call directly (e.g. from a future caller that
+  // skips mapArch). Likewise refuse a vcvarsall path containing a
+  // double-quote — it would break out of the quoted command template.
+  if (!VCVARSALL_ARCH_ALLOWLIST.has(archArg)) {
+    throw new Error(`refusing to spawn cmd.exe with unsafe arch arg ${JSON.stringify(archArg)}`);
+  }
+  if (vcvarsallPath.includes('"')) {
+    throw new Error(`refusing to spawn cmd.exe with quote in vcvarsall path ${JSON.stringify(vcvarsallPath)}`);
+  }
+
   const MARKER = '___WYVRN_ENV_MARKER___';
   // `call` is required so the batch file returns control instead of
   // `exit`-ing the cmd shell; otherwise the `echo` + `set` after it
@@ -197,7 +227,18 @@ async function loadMsvcEnv({ profile, skipForGenerator }) {
     return null;
   }
 
-  const archArg = mapArch(profile.arch);
+  let archArg;
+  try {
+    archArg = mapArch(profile.arch);
+  } catch (err) {
+    // Unknown arch for an MSVC profile is genuinely a configuration bug
+    // (MSVC only ships toolsets for x64/x86/arm64/arm). Surface clearly
+    // and fall through to the ambient env — CMake will then error with
+    // a usable compiler-detection message instead of us silently
+    // cross-targeting x64.
+    log.warn(`  ${err.message}`);
+    return null;
+  }
   log.info(`  activating MSVC build env: vcvarsall.bat ${archArg} (${vsPath})`);
   const env = await captureVcvarsEnv(vcvarsall, archArg);
   if (!env) {
@@ -214,4 +255,6 @@ module.exports = {
   findVsInstall,
   findVcvarsall,
   mapArch,
+  captureVcvarsEnv,
+  VCVARSALL_ARCH_ALLOWLIST,
 };

package/src/build/recipe.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { substituteTemplateAll } = require('../options');
+const { readRecipeConf }        = require('../conf');
 
 /**
  * The `build` section of a source-repo `wyvrn.json` tells wyvrnpm how to
@@ -60,15 +61,22 @@ const SUPPORTED_SYSTEMS = new Set(['cmake']);
  * no options), any `${options.*}` token in the recipe also fails fast —
  * recipes don't get to reference undeclared options.
  *
+ * When `manifestForConfCollisionCheck` is supplied, PLAN-CONF.md §4.7's
+ * collision detection runs: any `-DKEY=...` in `build.configure` whose
+ * KEY is ALSO declared in recipe-level `conf.cmake.cache` is a hard
+ * error. Recipes pick ONE route, avoiding silent duplication.
+ *
  * @param {object|null|undefined} rawBuild
  * @param {Record<string, any>|null} [effectiveOptions]
+ * @param {object|null} [manifestForConfCollisionCheck]
  * @returns {{ system: string, generators: string[], configure: string[],
  *            buildArgs: string[], installDir: string, sourceSubdir: string,
  *            requiredTools: string[] }}
- * @throws {Error} when `system` is set but not supported, or when a
- *                 `${options.<name>}` template references an undeclared option
+ * @throws {Error} when `system` is set but not supported, when a
+ *                 `${options.<name>}` template references an undeclared option,
+ *                 or when `build.configure` collides with `conf.cmake.cache`.
  */
-function normalizeRecipe(rawBuild, effectiveOptions = null) {
+function normalizeRecipe(rawBuild, effectiveOptions = null, manifestForConfCollisionCheck = null) {
   const b = rawBuild ?? {};
   const system = b.system ?? DEFAULT_RECIPE.system;
   if (!SUPPORTED_SYSTEMS.has(system)) {
@@ -124,6 +132,31 @@ function normalizeRecipe(rawBuild, effectiveOptions = null) {
     'build.buildArgs',
   );
 
+  // PLAN-CONF.md §4.7: recipe-side collision between `build.configure`
+  // `-DKEY=...` args and declared `conf.cmake.cache.KEY` is a hard
+  // error. Forces the author to pick one route; avoids silent
+  // duplication where one route wins opaquely.
+  if (manifestForConfCollisionCheck) {
+    const recipeConfFlat = readRecipeConf(manifestForConfCollisionCheck);
+    const confCacheKeys = new Set(
+      Object.keys(recipeConfFlat)
+        .filter((k) => k.startsWith('cmake.cache.'))
+        .map((k) => k.slice('cmake.cache.'.length)),
+    );
+    if (confCacheKeys.size > 0) {
+      for (const arg of configure) {
+        const m = arg.match(/^-D([^=]+)=/);
+        if (m && confCacheKeys.has(m[1])) {
+          throw new Error(
+            `recipe collision: "${m[1]}" is set in both ` +
+            `build.configure (as ${JSON.stringify(arg)}) and ` +
+            `conf.cmake.cache. Pick one route — see claude/PLAN-CONF.md §4.7.`,
+          );
+        }
+      }
+    }
+  }
+
   return {
     system,
     generators,

package/src/commands/add.js

@@ -0,0 +1,140 @@
+'use strict';
+
+const path = require('path');
+
+const { readManifest, writeManifest } = require('../manifest');
+const { resolveLatestVersion }        = require('../resolve');
+const { readConfig }                  = require('../config');
+const log                             = require('../logger');
+
+/**
+ * Parse a `<name>[@<version>]` positional into its parts.
+ *
+ * `@` inside the version (e.g. tags like `latest`) is allowed — only the
+ * first `@` is treated as the separator.
+ *
+ * @param {string} spec
+ * @returns {{ name: string, version: string | null }}
+ */
+function parseSpec(spec) {
+  const at = spec.indexOf('@');
+  if (at === -1)  return { name: spec, version: null };
+  if (at === 0)   throw new Error(`invalid package spec "${spec}" — missing name before "@"`);
+  const name    = spec.slice(0, at);
+  const version = spec.slice(at + 1);
+  if (!version) throw new Error(`invalid package spec "${spec}" — missing version after "@"`);
+  return { name, version };
+}
+
+/**
+ * Add one or more dependencies to wyvrn.json.
+ *
+ *   wyvrnpm add <name>              → resolves latest, writes "^<latest>"
+ *   wyvrnpm add <name>@<version>    → writes "<version>" verbatim (exact or range)
+ *
+ * Existing entries are replaced. If the prior entry was an object
+ * (`{ version, settings, options }`), its settings/options are preserved —
+ * only `version` is updated.
+ *
+ * Does not run install. The user must `wyvrnpm install` afterwards.
+ *
+ * @param {object} argv
+ */
+async function add(argv) {
+  const manifestPath = path.resolve(argv.manifest);
+  const specs = (argv.packages ?? []).map(parseSpec);
+
+  if (specs.length === 0) {
+    log.error('no packages given. Usage: wyvrnpm add <name>[@<version>] [...]');
+    process.exit(1);
+  }
+
+  // Install sources — only needed when at least one spec omits @version and
+  // we have to hit `latest.json`.
+  let packageSources;
+  if (argv.source && argv.source.length > 0) {
+    packageSources = argv.source;
+  } else {
+    const config   = readConfig();
+    packageSources = config.installSources.map((s) => s.url);
+  }
+
+  const needsResolve = specs.some((s) => s.version === null);
+  if (needsResolve && packageSources.length === 0) {
+    log.error(
+      'no install sources configured — cannot look up latest versions.\n' +
+      '  Pass --source <url>, pin versions explicitly (`name@1.2.3.4`), or run:\n' +
+      '    wyvrnpm configure add-source --kind install --name ... --url ...',
+    );
+    process.exit(1);
+  }
+
+  const manifest = readManifest(manifestPath);
+
+  // Preserve whichever dependencies key the manifest already uses. If neither
+  // exists, create lowercase `dependencies` (the v2 convention).
+  const depsKey =
+    Object.prototype.hasOwnProperty.call(manifest, 'dependencies') ? 'dependencies' :
+    Object.prototype.hasOwnProperty.call(manifest, 'Dependencies') ? 'Dependencies' :
+    'dependencies';
+
+  let deps = manifest[depsKey];
+  // Legacy array form → object. Editing by name is the whole point of `add`,
+  // and round-tripping as an array would silently drop per-dep settings.
+  if (Array.isArray(deps)) {
+    const obj = {};
+    for (const d of deps) {
+      const n = d.Name ?? d.name;
+      const v = d.Version ?? d.version;
+      if (n && v) obj[n] = v;
+    }
+    deps = obj;
+  } else if (!deps || typeof deps !== 'object') {
+    deps = {};
+  }
+
+  for (const spec of specs) {
+    let versionToWrite;
+    if (spec.version) {
+      versionToWrite = spec.version;
+      log.info(`${spec.name}: writing "${versionToWrite}" (as given)`);
+    } else {
+      const latest = await resolveLatestVersion(spec.name, packageSources, argv.platform, fetch);
+      versionToWrite = `^${latest}`;
+      log.info(`${spec.name}: latest is ${latest} → writing "${versionToWrite}"`);
+    }
+
+    const prior = deps[spec.name];
+    if (prior !== undefined) {
+      const priorVer =
+        typeof prior === 'string' ? prior :
+        (prior && typeof prior === 'object') ? (prior.version ?? prior.Version ?? '(unknown)') :
+        '(unknown)';
+      log.info(`  replacing existing entry: "${priorVer}"`);
+    }
+
+    // If the prior entry was an object with settings/options, keep those —
+    // only bump the version field. Otherwise write the short-form string.
+    if (prior && typeof prior === 'object' && !Array.isArray(prior)) {
+      const updated = { ...prior };
+      if ('Version' in updated && !('version' in updated)) {
+        updated.Version = versionToWrite;
+      } else {
+        updated.version = versionToWrite;
+      }
+      deps[spec.name] = updated;
+    } else {
+      deps[spec.name] = versionToWrite;
+    }
+  }
+
+  manifest[depsKey] = deps;
+  writeManifest(manifestPath, manifest);
+
+  const n = specs.length;
+  log.success(`Updated ${manifestPath} — ${n} package${n !== 1 ? 's' : ''}.`);
+  log.info('Run `wyvrnpm install` to download.');
+}
+
+module.exports = add;
+module.exports.parseSpec = parseSpec;

package/src/commands/build.js

@@ -9,6 +9,9 @@ const { loadProfile }  = require('../profile');
 const { readManifest } = require('../manifest');
 const { normalizeRecipe, hasBuildRecipe } = require('../build/recipe');
 const { loadMsvcEnv }  = require('../build/msvc-env');
+const { archToVsPlatform, isVisualStudioGenerator } = require('../toolchain');
+const { parseCliConf } = require('../conf');
+const { LOCAL_OVERLAY_FILENAME } = require('../conf');
 const install          = require('./install');
 const log              = require('../logger');
 
@@ -28,8 +31,10 @@ const log              = require('../logger');
  * @returns {{ stale: boolean, reason: string }}
  */
 function isToolchainStale({ rootDir, manifestPath }) {
-  const lockPath      = path.join(path.dirname(manifestPath), 'wyvrn.lock');
-  const toolchainPath = path.join(rootDir, 'wyvrn_internal', 'wyvrn_toolchain.cmake');
+  const lockPath         = path.join(path.dirname(manifestPath), 'wyvrn.lock');
+  const toolchainPath    = path.join(rootDir, 'wyvrn_internal', 'wyvrn_toolchain.cmake');
+  const localOverlayPath = path.join(rootDir, LOCAL_OVERLAY_FILENAME);
+  const presetPath       = path.join(rootDir, 'CMakePresets.json');
 
   if (!fs.existsSync(toolchainPath)) {
     return { stale: true, reason: 'toolchain-missing' };
@@ -43,6 +48,19 @@ function isToolchainStale({ rootDir, manifestPath }) {
   if (lockMtime > toolchainMtime) {
     return { stale: true, reason: 'lock-newer-than-toolchain' };
   }
+
+  // PLAN-CONF.md §7: if wyvrn.local.json was edited after the preset was
+  // written, the preset's cacheVariables no longer reflect the consumer's
+  // intent. Re-run install (which regenerates the preset) rather than
+  // silently running a stale configure.
+  if (fs.existsSync(localOverlayPath) && fs.existsSync(presetPath)) {
+    const overlayMtime = fs.statSync(localOverlayPath).mtimeMs;
+    const presetMtime  = fs.statSync(presetPath).mtimeMs;
+    if (overlayMtime > presetMtime) {
+      return { stale: true, reason: 'local-overlay-newer-than-preset' };
+    }
+  }
+
   return { stale: false, reason: 'fresh' };
 }
 
@@ -70,11 +88,57 @@ function resolveBinaryDir({ rootDir, presetName }) {
 
 /**
  * Args passed to `cmake` for the configure step.
- * @param {{ presetName: string }} args
+ *
+ * `generator`, when set, appends `-G <name>` after `--preset`. CMake 3.21+
+ * lets CLI args override a preset's declared fields, so this swaps the
+ * generator at configure time without touching CMakePresets.json. Note:
+ * CMake bakes the chosen generator into the cache, so switching generators
+ * for an existing build directory requires `--clean` (otherwise CMake
+ * errors with "CMAKE_GENERATOR has changed").
+ *
+ * `vsPlatform`, when set, appends `-A <platform>`. Only meaningful for
+ * Visual Studio generators — they default to x64 when unspecified, which
+ * silently produces a 64-bit build even for a 32-bit profile. The caller
+ * is responsible for deriving this from the profile arch only when the
+ * effective generator is VS (see `isVisualStudioGenerator` +
+ * `archToVsPlatform`).
+ *
+ * @param {{ presetName: string, generator?: string|null, vsPlatform?: string|null }} args
  * @returns {string[]}
  */
-function buildConfigureArgs({ presetName }) {
-  return ['--preset', presetName];
+function buildConfigureArgs({
+  presetName,
+  generator = null,
+  vsPlatform = null,
+  confSets = null,
+  confUnsets = null,
+}) {
+  const args = ['--preset', presetName];
+  if (generator)  args.push('-G', generator);
+  if (vsPlatform) args.push('-A', vsPlatform);
+
+  // PLAN-CONF.md §7: CLI --conf at build time applies as -D / -U
+  // overrides on top of whatever's baked into the preset. We do NOT
+  // silently regenerate the preset — that's a separate install.
+  // Confined to the cmake.cache namespace; other namespaces have
+  // different sinks (phase 3) and don't apply to `cmake --preset`.
+  if (confSets) {
+    const prefix = 'cmake.cache.';
+    for (const key of Object.keys(confSets).sort()) {
+      if (!key.startsWith(prefix)) continue;
+      const cmakeKey = key.slice(prefix.length);
+      args.push('-D', `${cmakeKey}=${confSets[key]}`);
+    }
+  }
+  if (confUnsets) {
+    const prefix = 'cmake.cache.';
+    for (const key of [...confUnsets].sort()) {
+      if (!key.startsWith(prefix)) continue;
+      args.push('-U', key.slice(prefix.length));
+    }
+  }
+
+  return args;
 }
 
 /**
@@ -211,8 +275,11 @@ async function build(argv) {
   //
   // Same mechanism the source-build path already uses (src/build/msvc-env.js).
   let cmakeEnv = null;
+  let effectiveGenerator = argv.generator ?? null;
+  let effectiveProfile   = null;
   try {
     const { profile: activeProfile } = loadProfile(profileName);
+    effectiveProfile = activeProfile;
     // Which generator will the preset actually use? Read it from the
     // project's own recipe if one exists. If not, default to null and let
     // cmake/CMakePresets decide — in which case MSVC env activation is
@@ -225,16 +292,53 @@ async function build(argv) {
         if (recipe.generators.length > 0) [presetGenerator] = recipe.generators;
       } catch { /* templates need options → skip env activation */ }
     }
+    // CLI --generator wins — that is the generator CMake will actually use,
+    // so it is the one that determines whether vcvarsall must be activated.
+    if (!effectiveGenerator) effectiveGenerator = presetGenerator;
     cmakeEnv = await loadMsvcEnv({
       profile:          activeProfile,
-      skipForGenerator: presetGenerator,
+      skipForGenerator: effectiveGenerator,
     });
   } catch (err) {
     log.warn(`Could not resolve MSVC env activation: ${err.message}`);
   }
 
   // ── Configure ─────────────────────────────────────────────────────────────
-  const configureArgs = buildConfigureArgs({ presetName });
+  // Auto-emit `-A <platform>` for Visual Studio generators, mapped from the
+  // active profile's arch. VS otherwise defaults to x64 regardless of the
+  // profile, which breaks x86 builds: CMake produces 64-bit artefacts but
+  // find_package() rejects the 32-bit installed dependencies with "version
+  // not compatible" (actually a CMAKE_SIZEOF_VOID_P mismatch, not a
+  // version-number check).
+  let vsPlatform = null;
+  if (isVisualStudioGenerator(effectiveGenerator) && effectiveProfile) {
+    vsPlatform = archToVsPlatform(effectiveProfile.arch);
+    if (vsPlatform) {
+      log.info(`Visual Studio generator + arch=${effectiveProfile.arch} → passing -A ${vsPlatform}`);
+    }
+  }
+
+  // CLI --conf → -D / -U passthrough (PLAN-CONF.md §7). The preset's
+  // baked-in cacheVariables (from the last install) already reflect the
+  // recipe + local-overlay layers; CLI conf layers on top for this
+  // invocation only.
+  let cliConfSets, cliConfUnsets;
+  try {
+    const cli = parseCliConf(argv.conf);
+    cliConfSets   = cli.sets;
+    cliConfUnsets = cli.unsets;
+  } catch (err) {
+    log.error(`--conf parse error: ${err.message}`);
+    process.exit(1);
+  }
+
+  const configureArgs = buildConfigureArgs({
+    presetName,
+    generator:  argv.generator,
+    vsPlatform,
+    confSets:   cliConfSets,
+    confUnsets: cliConfUnsets,
+  });
   log.info(`cmake ${configureArgs.join(' ')}`);
   await runCmake(configureArgs, cmakeEnv);