wyvrnpm 2.3.2 → 2.8.1

package/src/profile.js

@@ -162,6 +162,13 @@ function detectProfile() {
   };
 }
 
+// Profile fields that participate in profileHash — mirror Conan's
+// `[settings]` strictly. Anything else at the top level (e.g. `conf`)
+// is non-ABI and must never fold into the hash (PLAN-CONF.md constitution).
+const HASHED_PROFILE_FIELDS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
 /**
  * Compute a stable 16-char SHA256 prefix identifying a unique build.
  * Inputs:
@@ -169,14 +176,19 @@ function detectProfile() {
  *   - `options`: (optional) recipe-declared feature toggles resolved to
  *     their effective values for this build.
  *
- * Backward-compat contract: when `options` is null / undefined / empty,
- * the hash is byte-identical to what pre-F1 wyvrnpm produced. Packages
- * without an `options` block keep their existing registry addresses.
- * The caller therefore passes `null` (not `{}`) to mean "this recipe
- * has no options declared" — consistent with what
- * `resolveEffectiveOptions` returns in that case.
+ * Backward-compat contract:
+ *   - When `options` is null / undefined / empty, the hash is
+ *     byte-identical to what pre-F1 wyvrnpm produced. Packages
+ *     without an `options` block keep their existing registry
+ *     addresses. The caller passes `null` (not `{}`) to mean "this
+ *     recipe has no options declared" — consistent with what
+ *     `resolveEffectiveOptions` returns in that case.
+ *   - When a profile carries a `conf` block (phase 2 — PLAN-CONF.md),
+ *     the hash is byte-identical to the same profile WITHOUT `conf`.
+ *     Build-time knobs are non-ABI by design (constitution).
  *
- * See claude/PLAN-OPTIONS.md §3.2 for the full design.
+ * See claude/PLAN-OPTIONS.md §3.2 and claude/PLAN-CONF.md for the
+ * full design.
  *
  * @param {WyvrnProfile} profile
  * @param {Record<string, any>|null} [options]  effective options (after defaults + overrides)
@@ -185,7 +197,10 @@ function detectProfile() {
 function hashProfile(profile, options = null) {
   const significant = Object.fromEntries(
     Object.entries(profile)
-      .filter(([, v]) => v !== null && v !== undefined && v !== '*' && v !== '')
+      .filter(([k, v]) =>
+        HASHED_PROFILE_FIELDS.has(k) &&
+        v !== null && v !== undefined && v !== '*' && v !== '',
+      )
       .sort(([a], [b]) => a.localeCompare(b)),
   );
 
@@ -267,6 +282,8 @@ function isShaOnRemote(sha, cwd) {
 
 /**
  * Format a profile for human-readable display (Conan-style).
+ * Emits a `[conf]` block with flat dotted keys when the profile
+ * carries a non-empty `conf` block (PLAN-CONF.md phase 2).
  *
  * @param {WyvrnProfile} profile
  * @returns {string}
@@ -282,6 +299,23 @@ function formatProfile(profile) {
       lines.push(`${key}=${val}`);
     }
   }
+
+  // [conf] block, Conan-style. Rendered flat so it's clear these are
+  // dotted namespaced keys, not nested JSON. Alphabetical for stable diffs.
+  const confBlock = profile.conf;
+  if (confBlock && typeof confBlock === 'object' && !Array.isArray(confBlock)) {
+    // Lazy-require to avoid circular dep (src/conf/* → src/manifest → src/profile).
+    const { flattenConf } = require('./conf');
+    let flat;
+    try { flat = flattenConf(confBlock); } catch { flat = null; }
+    if (flat && Object.keys(flat).length > 0) {
+      lines.push('[conf]');
+      for (const key of Object.keys(flat).sort()) {
+        lines.push(`${key}=${flat[key]}`);
+      }
+    }
+  }
+
   return lines.join('\n');
 }
 
@@ -386,15 +420,116 @@ function listProfiles() {
 }
 
 /**
- * Load the active build profile by name. Falls back to auto-detection if the
- * named profile file does not exist yet.
+ * Resolve a profile-inheritance chain (F8). A profile may declare
+ *
+ *   { "extends": "base-profile", ... }
+ *   { "extends": ["base1", "base2"], ... }      // later wins over earlier
+ *
+ * `extends` is resolved recursively; the child's fields overlay the
+ * merged parent(s). Cycle detection throws a clear error. Missing
+ * parents throw — we don't silently drop `extends`, that would hide
+ * typos.
+ *
+ * Merge rules:
+ *  - `[settings]` fields: child overrides parent, per-key.
+ *  - `conf` block: parent + child flattened with child wins per-leaf
+ *    (same pattern as PLAN-CONF.md §4.2 within the single profile).
+ *  - `extends` itself is stripped from the resolved output — the
+ *    returned object carries no inheritance metadata, so existing
+ *    consumers (formatProfile, hashProfile, readProfileConf) work
+ *    unchanged.
+ *
+ * @param {string} name
+ * @param {string[]} [stack] visited names — for cycle detection
+ * @returns {WyvrnProfile|null} Fully-resolved profile, or null if `name`
+ *   does not exist on disk at the root of the chain.
+ */
+function resolveProfileChain(name, stack = []) {
+  if (stack.includes(name)) {
+    throw new Error(
+      `profile inheritance cycle: ${[...stack, name].join(' → ')}`,
+    );
+  }
+
+  const raw = readProfile(name);
+  if (!raw) return null;
+
+  const rawExtends = raw.extends;
+  if (rawExtends === undefined || rawExtends === null) {
+    // Flat profile — just strip any accidental `extends` and return.
+    const { extends: _, ...rest } = raw;
+    return rest;
+  }
+
+  const parents = Array.isArray(rawExtends) ? rawExtends : [rawExtends];
+  for (const p of parents) {
+    if (typeof p !== 'string' || p.length === 0) {
+      throw new Error(
+        `profile "${name}": extends entries must be non-empty strings, got ${JSON.stringify(p)}`,
+      );
+    }
+  }
+
+  // Merge parents left-to-right, then overlay the child.
+  let merged = {};
+  for (const parentName of parents) {
+    const parent = resolveProfileChain(parentName, [...stack, name]);
+    if (!parent) {
+      throw new Error(
+        `profile "${name}": extends parent "${parentName}" not found ` +
+        `at ${getProfilesDir()}`,
+      );
+    }
+    merged = mergeResolvedProfiles(merged, parent);
+  }
+
+  const { extends: _, ...child } = raw;
+  return mergeResolvedProfiles(merged, child);
+}
+
+/**
+ * Merge two already-resolved profile objects. Top-level `[settings]`
+ * fields: right wins. `conf` block: per-leaf merge, right wins.
+ * @param {object} base
+ * @param {object} overlay
+ * @returns {object}
+ */
+function mergeResolvedProfiles(base, overlay) {
+  const out = { ...base, ...overlay };
+  // Nullable override semantics: `null` on the overlay explicitly
+  // unsets a field from the base (matches how Conan profiles
+  // handle `compiler.runtime=None`).
+  for (const k of Object.keys(overlay)) {
+    if (overlay[k] === null) delete out[k];
+  }
+  // Conf block is merged per-leaf, not per-branch.
+  if (base.conf || overlay.conf) {
+    const { flattenConf, unflattenConf } = require('./conf');
+    let baseFlat    = {};
+    let overlayFlat = {};
+    try { if (base.conf)    baseFlat    = flattenConf(base.conf);    } catch { /* leave empty */ }
+    try { if (overlay.conf) overlayFlat = flattenConf(overlay.conf); } catch { /* leave empty */ }
+    const merged = { ...baseFlat, ...overlayFlat };
+    if (Object.keys(merged).length > 0) {
+      out.conf = unflattenConf(merged);
+    } else {
+      delete out.conf;
+    }
+  }
+  return out;
+}
+
+/**
+ * Load the active build profile by name, resolving any `extends` chain.
+ * Falls back to auto-detection if the named profile file does not
+ * exist yet.
  *
  * @param {string} [name='default']
  * @returns {{ profile: WyvrnProfile, fromFile: boolean }}
  */
 function loadProfile(name = 'default') {
-  const stored = readProfile(name);
-  if (stored) return { profile: stored, fromFile: true };
+  const resolved = resolveProfileChain(name);
+  if (resolved) return { profile: resolved, fromFile: true };
   return { profile: detectProfile(), fromFile: false };
 }
 
@@ -415,6 +550,7 @@ module.exports = {
   deleteProfile,
   listProfiles,
   loadProfile,
+  resolveProfileChain,
 };
 
 /**

package/src/resolve.js

@@ -141,15 +141,27 @@ async function resolveLatestVersion(name, packageSources, platform, httpClient)
 /**
  * Fetches razer.json for a single package from the first source that responds.
  *
+ * When `preferredProfileHash` is provided (EVALUATION.md F13 — closes the
+ * "picks arbitrary profileHash" latent bug), the v2 lookup tries that hash
+ * first and only falls back to the first-available profile if the preferred
+ * hash isn't on the registry. Dependency declarations are invariant across
+ * profiles today, so picking any hash gives the same answer — but the
+ * consumer's own hash is stable across re-resolves and future-proofs
+ * against any schema that starts varying wyvrn.json per profile.
+ *
  * @param {string} name
  * @param {string} version
  * @param {string[]} packageSources
  * @param {string} platform
  * @param {Function} httpClient
  * @param {Map<string, object>} cache - In-flight / completed fetch cache.
+ * @param {string|null} [preferredProfileHash] - try this hash first.
  * @returns {Promise<object|null>} Parsed razer.json or null if not found anywhere.
  */
-async function fetchPackageManifest(name, version, packageSources, platform, httpClient, cache) {
+async function fetchPackageManifest(
+  name, version, packageSources, platform, httpClient, cache,
+  preferredProfileHash = null,
+) {
   const cacheKey = `${name}@${version}`;
   if (cache.has(cacheKey)) {
     return cache.get(cacheKey);
@@ -158,14 +170,19 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
   for (const source of packageSources) {
     const base = source.replace(/\/$/, '');
 
-    // v2: look up any available profile hash from versions.json, then fetch that manifest
+    // v2: prefer the consumer's own profileHash; fall back to the first
+    // available if that hash isn't published.
     try {
       const idxResp = await httpClient(`${base}/v2/${name}/versions.json`);
       if (idxResp.ok) {
         const idx = await idxResp.json();
         const profiles = idx?.versions?.[version]?.profiles;
         if (profiles) {
-          const profileHash = Object.keys(profiles)[0];
+          const available = Object.keys(profiles);
+          const profileHash =
+            (preferredProfileHash && available.includes(preferredProfileHash))
+              ? preferredProfileHash
+              : available[0];
           if (profileHash) {
             const mResp = await httpClient(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`);
             if (mResp.ok) {
@@ -215,15 +232,37 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
  * Passing `null` / omitting it keeps the legacy behaviour.
  *
+ * Per-package source pinning (EVALUATION.md S4): when `pinnedSources` is
+ * provided, any entry `name → url` restricts that package's manifest +
+ * latest + versions lookups to just that URL — typo-squatting and mirror
+ * shadowing are closed for pinned deps. Pins propagate to direct deps
+ * only; transitive deps continue to fan out across all sources (a pinned
+ * dep's own recipe is authoritative for its own transitives).
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
  * @param {Map<string, string>} [lockedVersions]
  * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
+ * @param {string|null} [preferredProfileHash] - consumer's own profileHash;
+ *   threaded to fetchPackageManifest so v2 manifest lookups prefer the
+ *   consumer's own build entry over an arbitrary one (EVALUATION.md F13).
+ * @param {Map<string,string>|null} [pinnedSources] - per-package source URL pin (S4).
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
+async function resolveDependencies(
+  rootDeps, packageSources, platform, httpClient,
+  lockedVersions = new Map(), manifestsOut = null,
+  preferredProfileHash = null,
+  pinnedSources = null,
+) {
+  // For pinned deps, restrict the source list to the single pinned URL.
+  // `null` / no pin → fall back to the full caller-supplied list.
+  const sourcesFor = (name) => {
+    const pin = pinnedSources?.get?.(name);
+    return pin ? [pin] : packageSources;
+  };
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -254,7 +293,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const publishedCache = new Map();
   const fetchPublished = async (name) => {
     if (publishedCache.has(name)) return publishedCache.get(name);
-    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    const list = await fetchPublishedVersions(name, sourcesFor(name), httpClient);
     publishedCache.set(name, list);
     return list;
   };
@@ -280,7 +319,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
     // Skip this for linked packages which have "linked:" prefix.
     if (version === 'latest') {
       try {
-        version = await resolveLatestVersion(name, packageSources, platform, httpClient);
+        version = await resolveLatestVersion(name, sourcesFor(name), platform, httpClient);
         log.info(`Resolved "${name}@latest" → ${version}`);
       } catch (err) {
         log.warn(err.message);
@@ -405,10 +444,11 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       manifest = await fetchPackageManifest(
         name,
         version,
-        packageSources,
+        sourcesFor(name),
         platform,
         httpClient,
         manifestCache,
+        preferredProfileHash,
       );
     }
 

package/src/settings-overrides.js

@@ -0,0 +1,152 @@
+'use strict';
+
+// Pattern-based settings overrides (EVALUATION.md F11).
+//
+// `wyvrn.json` may declare a top-level `settingsOverrides` block whose
+// keys are glob patterns over dependency names. Every matching pattern
+// contributes to the resolved dep's `settings` merge; the per-dep
+// literal settings (inside `dependencies`) still win over patterns.
+//
+// Conan users know this feature as profile-side `boost*:compiler.cppstd=17`.
+// Ours lives in the manifest because that's where literal settings
+// overrides already live — one fewer concept for recipe authors.
+//
+// Pure, no I/O. Exported helpers:
+//   - normalizeSettingsOverrides: validate + sort by specificity
+//   - resolveOverrideSettings: compute the merged settings for a dep name
+
+/**
+ * Valid profile field keys that settings overrides may target.
+ * Mirrors `HASHED_PROFILE_FIELDS` in src/profile.js, but as the allow-
+ * list for OVERRIDE values (os/arch/compiler/etc.). If a pattern
+ * override tries to set something else, reject at parse time rather
+ * than silently letting it through into mergeProfile.
+ */
+const ALLOWED_SETTINGS_KEYS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
+/**
+ * Convert a glob pattern to a RegExp. Supports `*` (any chars),
+ * `?` (single char), literal everything else. No brace expansion,
+ * no negation — keep the mental model small.
+ *
+ * @param {string} glob
+ * @returns {RegExp}
+ */
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  const pattern = escaped.replace(/\*/g, '.*').replace(/\?/g, '.');
+  return new RegExp(`^${pattern}$`);
+}
+
+/**
+ * Specificity heuristic: fewer wildcards = more specific. Ties broken
+ * by longer literal prefix, then lexical order for determinism. More
+ * specific patterns get applied LAST so they override less-specific
+ * ones in the merge.
+ *
+ * @param {string} glob
+ * @returns {[number, number, string]} sort key — lower = less specific
+ */
+function specificityKey(glob) {
+  const wildcards = (glob.match(/[*?]/g) ?? []).length;
+  const literalPrefix = glob.match(/^[^*?]*/)?.[0].length ?? 0;
+  // Invert sort order: more wildcards → lower score; more prefix → higher score.
+  return [-wildcards, literalPrefix, glob];
+}
+
+/**
+ * Validate + sort a raw `settingsOverrides` block. Returns an array of
+ * `{ pattern, regex, settings }` in application order (least-specific
+ * first). A string pattern alone (literal `"openssl"`) works too — it
+ * matches only that exact name.
+ *
+ * Throws on:
+ *  - non-object block
+ *  - non-string keys (JSON can't produce these but defensive)
+ *  - non-object values
+ *  - empty pattern strings
+ *  - unknown settings keys in a value
+ *  - non-string value leaves (settings values must be strings like
+ *    the profile itself: "dynamic", "17", "gcc")
+ *
+ * @param {unknown} block
+ * @returns {Array<{ pattern: string, regex: RegExp, settings: Record<string, string> }>}
+ */
+function normalizeSettingsOverrides(block) {
+  if (block === undefined || block === null) return [];
+  if (typeof block !== 'object' || Array.isArray(block)) {
+    throw new Error('settingsOverrides must be an object mapping globs to settings');
+  }
+
+  const entries = [];
+  for (const [rawPattern, rawValue] of Object.entries(block)) {
+    if (typeof rawPattern !== 'string' || rawPattern.length === 0) {
+      throw new Error(`settingsOverrides: pattern must be a non-empty string, got ${JSON.stringify(rawPattern)}`);
+    }
+    if (!rawValue || typeof rawValue !== 'object' || Array.isArray(rawValue)) {
+      throw new Error(`settingsOverrides["${rawPattern}"]: value must be an object of settings`);
+    }
+
+    const settings = {};
+    for (const [k, v] of Object.entries(rawValue)) {
+      if (!ALLOWED_SETTINGS_KEYS.has(k)) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"]: unknown key "${k}" — ` +
+          `allowed: ${[...ALLOWED_SETTINGS_KEYS].join(', ')}`,
+        );
+      }
+      if (typeof v !== 'string' || v.length === 0) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"].${k}: value must be a non-empty string, ` +
+          `got ${JSON.stringify(v)}`,
+        );
+      }
+      settings[k] = v;
+    }
+
+    entries.push({ pattern: rawPattern, regex: globToRegExp(rawPattern), settings });
+  }
+
+  // Sort by specificity ascending so more-specific patterns apply LAST
+  // (their settings therefore win on per-key merge).
+  entries.sort((a, b) => {
+    const ka = specificityKey(a.pattern);
+    const kb = specificityKey(b.pattern);
+    for (let i = 0; i < ka.length; i++) {
+      if (ka[i] < kb[i]) return -1;
+      if (ka[i] > kb[i]) return  1;
+    }
+    return 0;
+  });
+
+  return entries;
+}
+
+/**
+ * Merge all matching pattern overrides for `depName` into a flat
+ * settings object. Less-specific patterns apply first; more-specific
+ * patterns overlay on top. Does NOT include the literal per-dep
+ * `settings` (caller layers that on after — literal always wins).
+ *
+ * @param {string} depName
+ * @param {ReturnType<typeof normalizeSettingsOverrides>} normalized
+ * @returns {Record<string, string>}
+ */
+function resolveOverrideSettings(depName, normalized) {
+  const out = {};
+  for (const entry of normalized) {
+    if (entry.regex.test(depName)) {
+      Object.assign(out, entry.settings);
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  ALLOWED_SETTINGS_KEYS,
+  globToRegExp,
+  normalizeSettingsOverrides,
+  resolveOverrideSettings,
+};

package/src/toolchain/index.js

@@ -17,6 +17,73 @@ function getBundledCmakeDir() {
   return dir.replace(/\\/g, '/');
 }
 
+// Arch bit-width mapping. Kept exhaustive against `ARCH_MAP` in profile.js
+// so any arch a profile can hold has a deterministic "32"/"64" suffix.
+// Unknown arch strings fall back to an empty suffix — the consumer's
+// CMakeLists should then use another discriminator (e.g. profile hash).
+const ARCH_BIT_SUFFIX = {
+  x86_64:  '64',
+  x86:     '32',
+  armv8:   '64',
+  armv7:   '32',
+  ppc64le: '64',
+  s390x:   '64',
+  mips:    '32',
+  mipsel:  '32',
+};
+
+/**
+ * Map a profile `arch` value to the canonical "64" / "32" suffix that
+ * `WYVRN_ARCH_SUFFIX` exposes to consumer CMakeLists. Empty string for
+ * unknown arches — callers can pattern-match on that to fall back.
+ *
+ * @param {string|null|undefined} arch
+ * @returns {string}
+ */
+function archToBitSuffix(arch) {
+  if (!arch) return '';
+  return ARCH_BIT_SUFFIX[arch] ?? '';
+}
+
+// Visual Studio generator `-A <platform>` mapping. VS defaults to x64
+// when `-A` is unspecified — which silently wins against a 32-bit profile
+// and causes consumer-side `find_package()` to reject 32-bit artefacts
+// with "The version found is not compatible" (a CMake pointer-size check,
+// not a version-number check). Auto-emitting `-A` keeps VS + x86 honest.
+const ARCH_VS_PLATFORM = {
+  x86_64: 'x64',
+  x86:    'Win32',
+  armv8:  'ARM64',
+  armv7:  'ARM',
+};
+
+/**
+ * Map a profile arch to the Visual Studio generator's `-A <platform>` value.
+ * Returns null for arches that don't map to a known VS platform — callers
+ * should skip `-A` in that case and let the user pass one explicitly.
+ *
+ * @param {string|null|undefined} arch
+ * @returns {string|null}
+ */
+function archToVsPlatform(arch) {
+  if (!arch) return null;
+  return ARCH_VS_PLATFORM[arch] ?? null;
+}
+
+/**
+ * True when the generator name identifies a Visual Studio generator (e.g.
+ * "Visual Studio 17 2022"). VS generators require `-A <platform>` /
+ * `architecture` in the preset; everyone else (Ninja, Make, Xcode, …)
+ * ignores it.
+ *
+ * @param {string|null|undefined} name
+ * @returns {boolean}
+ */
+function isVisualStudioGenerator(name) {
+  if (!name) return false;
+  return /^Visual Studio \d/.test(name);
+}
+
 /**
  * Substitute `{{KEY}}` placeholders in a template string.
  *
@@ -54,6 +121,7 @@ function buildPlaceholders({ profile, profileName, profileHash, packageNames })
     PROFILE_HASH:             profileHash,
     PROFILE_OS:               profile.os ?? '',
     PROFILE_ARCH:             profile.arch ?? '',
+    PROFILE_ARCH_SUFFIX:      archToBitSuffix(profile.arch),
     PROFILE_COMPILER:         profile.compiler ?? '',
     PROFILE_COMPILER_VERSION: profile['compiler.version'] ?? '',
     PROFILE_CPPSTD:           profile['compiler.cppstd'] ?? '20',
@@ -135,7 +203,10 @@ module.exports = {
   generateToolchain,
   generateCMakePresets,
   getBundledCmakeDir,
+  archToVsPlatform,
+  isVisualStudioGenerator,
   // Exported for tests
+  archToBitSuffix,
   buildPlaceholders,
   renderTemplate,
 };