wyvrnpm 2.4.1 → 2.8.1

package/src/commands/install.js

@@ -7,6 +7,8 @@ const { readManifest, normalizeDependencies }               = require('../manife
 const { resolveDependencies }                               = require('../resolve');
 const { downloadDependencies }                              = require('../download');
 const { readConfig }                                        = require('../config');
+const { resolveSourceAuth }                                 = require('../auth');
+const { resolveEffectiveConf, cmakeCacheVariables, unflattenConf } = require('../conf');
 const { loadProfile, hashProfile, formatProfile, mergeProfile } = require('../profile');
 const { generateToolchain, generateCMakePresets }           = require('../toolchain');
 const { normalizeRecipe, hasBuildRecipe }                   = require('../build/recipe');
@@ -15,6 +17,10 @@ const {
   resolveEffectiveOptions,
   parseCliOptions,
 }                                                            = require('../options');
+const {
+  normalizeSettingsOverrides,
+  resolveOverrideSettings,
+}                                                            = require('../settings-overrides');
 const {
   resolveUploadDestination,
   createUploadStats,
@@ -119,6 +125,45 @@ async function install(argv) {
     Object.entries(normalizedDeps).map(([name, d]) => [name, d.version]),
   );
 
+  // Per-package source pinning (EVALUATION.md S4). Deps declaring
+  // `"source": "primary-s3"` restrict to that named source's URL from
+  // config — typosquat / mirror-shadow defense. Unknown name → fail
+  // fast (silent fallback to fan-out would defeat the point).
+  //
+  // `argv.source` overrides config entirely; if the user passes
+  // `--source <url>` but a dep pins a name, we can't resolve the name
+  // → warn and fall back to fan-out across the CLI-supplied URLs.
+  //
+  // Transitive deps continue to fan out — a pinned top-level dep's
+  // recipe can reference whatever it wants.
+  const sourcesByName = new Map();
+  if (!argv.source || argv.source.length === 0) {
+    for (const s of config.installSources ?? []) {
+      if (s.name && s.url) sourcesByName.set(s.name, s.url);
+    }
+  }
+  const pinnedSources = new Map();
+  for (const [name, d] of Object.entries(normalizedDeps)) {
+    if (!d.source) continue;
+    if (argv.source && argv.source.length > 0) {
+      log.warn(
+        `"${name}" pins source "${d.source}" but --source was passed on CLI — ` +
+        `pin ignored for this run`,
+      );
+      continue;
+    }
+    const url = sourcesByName.get(d.source);
+    if (!url) {
+      log.error(
+        `"${name}" pins source "${d.source}" but no install source by that name is configured. ` +
+        `Run "wyvrnpm configure list" to see configured sources.`,
+      );
+      process.exit(1);
+    }
+    pinnedSources.set(name, url);
+    log.info(`${name}: pinned to source "${d.source}"`);
+  }
+
   log.info(
     `Installing dependencies for "${manifest.name}" (platform: ${argv.platform})`,
   );
@@ -134,11 +179,31 @@ async function install(argv) {
     fetch,
     lockedVersions,
     depManifests,
+    // F13: prefer the consumer's own profileHash when picking which build
+    // entry to read wyvrn.json from. Today every published build for a
+    // given (name, version) ships the same manifest, so this is harmless;
+    // it future-proofs against per-profile manifest variance.
+    hashProfile(baseProfile),
+    pinnedSources,
   );
 
   // CLI `-o <pkg>:<name>=<value>` overrides, parsed into { pkg → {name: value} }.
   const cliOptionsByPkg = parseCliOptions(argv.option);
 
+  // F11: pattern-based settings overrides. `manifest.settingsOverrides`
+  // is { "<glob>": { <setting>: <value> }, ... }. Validated + sorted by
+  // specificity once here; `resolveOverrideSettings(depName, ...)` then
+  // returns the merged-from-patterns settings for each dep. Literal
+  // per-dep `settings` still override these (authors pinning a specific
+  // dep win over a team-wide pattern).
+  let settingsOverrides;
+  try {
+    settingsOverrides = normalizeSettingsOverrides(manifest.settingsOverrides);
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
+
   // ── Build per-dependency enriched map ─────────────────────────────────────
   // Each dep gets:
   //   - an effective profile (base + per-dep settings overrides)
@@ -146,7 +211,12 @@ async function install(argv) {
   //   - profileHash computed from both (options only hashed in when declared)
   const enrichedDeps = new Map();
   for (const [name, version] of resolvedDeps) {
-    const depOverrides     = normalizedDeps[name]?.settings ?? {};
+    // F11: layer pattern overrides first (less-specific applied first
+    // inside resolveOverrideSettings), then the literal per-dep
+    // settings on top. Literal wins over any pattern.
+    const patternOverrides = resolveOverrideSettings(name, settingsOverrides);
+    const literalOverrides = normalizedDeps[name]?.settings ?? {};
+    const depOverrides     = { ...patternOverrides, ...literalOverrides };
     const effectiveProfile = mergeProfile(baseProfile, depOverrides);
 
     const depManifest    = depManifests.get(name);
@@ -177,16 +247,85 @@ async function install(argv) {
       profileHash,
       profile: effectiveProfile,
       options: effectiveOptions,
+      // S4: pinned install source (name + URL). Only set for direct
+      // deps that declared `"source": "..."`; transitive deps stay
+      // undefined so they fan out across configured sources.
+      pinnedSource: pinnedSources.has(name)
+        ? { name: normalizedDeps[name].source, url: pinnedSources.get(name) }
+        : undefined,
     });
   }
 
+  // ── Resolve effective conf (PLAN-CONF.md §4) ──────────────────────────────
+  // Four layers (phase 2): CLI > wyvrn.local.json > profile > recipe.
+  // Non-ABI; does not fold into profileHash. Feeds into CMakePresets.json
+  // cacheVariables below. `baseProfile` may carry its own `conf` block —
+  // an auto-detected profile (no on-disk file) does not.
+  let effectiveConfResult;
+  try {
+    effectiveConfResult = resolveEffectiveConf({
+      manifest,
+      rootDir,
+      cliConf: argv.conf,             // yargs array: string[]
+      profile: baseProfile,           // named profile may carry a `conf` block (phase 2)
+    });
+  } catch (err) {
+    log.error(`conf resolution failed: ${err.message}`);
+    process.exit(1);
+  }
+  const effectiveConf = effectiveConfResult.flat;
+  if (effectiveConfResult.localOverlayPath) {
+    log.info(`Local overlay: ${effectiveConfResult.localOverlayPath}`);
+    // One-line nudge when wyvrn.local.json exists but isn't gitignored —
+    // catching the existing-project case init.js's scaffold can't cover.
+    // Non-fatal; we never rewrite the user's .gitignore at install time.
+    const gitignorePath = path.join(rootDir, '.gitignore');
+    if (fs.existsSync(gitignorePath)) {
+      const gi = fs.readFileSync(gitignorePath, 'utf8');
+      const ignored = gi.split(/\r?\n/).some((l) => l.trim() === 'wyvrn.local.json');
+      if (!ignored) {
+        log.warn(
+          `wyvrn.local.json is present but not in ${gitignorePath} — ` +
+          `add a line "wyvrn.local.json" to keep dev-local overrides out of version control.`,
+        );
+      }
+    }
+  }
+  if (Object.keys(effectiveConf).length > 0) {
+    log.info(`Effective conf: ${JSON.stringify(effectiveConf)}`);
+  }
+
+  // ── --dry-run: print the resolved plan and exit (EVALUATION.md F6) ────────
+  // Runs the resolver + profile/options math end-to-end, then reports what
+  // WOULD be installed — no download, no wyvrn.lock, no wyvrn_internal/, no
+  // toolchain. Preserves --format=json for CI ingestion.
+  if (argv.dryRun) {
+    emitDryRunPlan({
+      enrichedDeps,
+      resolvedDeps,
+      baseProfile,
+      profileName,
+      buildMode,
+      packageSources,
+      effectiveConf,
+      jsonOut,
+    });
+    return;
+  }
+
   const razerDir = path.join(rootDir, 'wyvrn_internal');
 
-  // Extract auth from the first install source (if any)
+  // Extract auth from the first install source (if any). Prefer
+  // `tokenEnv` over a literal `token` stored in config — closes
+  // EVALUATION.md S8 (no plaintext secret persisted, value is looked up
+  // fresh each run).
   const firstInstallSrc = config.installSources?.[0];
   const downloadOptions = {
     awsProfile: firstInstallSrc?.profile ?? undefined,
-    token:      firstInstallSrc?.token   ?? undefined,
+    token:      resolveSourceAuth(
+      { token: argv.token, tokenEnv: argv.tokenEnv },
+      firstInstallSrc,
+    ).token,
     buildMode,
     profileName,
   };
@@ -199,7 +338,10 @@ async function install(argv) {
       {
         uploadSource: argv.uploadSource,
         awsProfile:   argv.awsProfile ?? firstInstallSrc?.profile,
-        token:        argv.token      ?? firstInstallSrc?.token,
+        token:        resolveSourceAuth(
+          { token: argv.token, tokenEnv: argv.tokenEnv },
+          firstInstallSrc,
+        ).token,
       },
       config,
     );
@@ -249,6 +391,12 @@ async function install(argv) {
     profile:      baseProfile,
     profileHash:  hashProfile(baseProfile),
     packages:     sortedPackages,
+    // PLAN-CONF.md §4.8.1: informational only, not consulted during
+    // resolution. Omitted entirely when empty so pre-conf locks
+    // remain byte-identical to today's output.
+    ...(Object.keys(effectiveConf).length > 0
+      ? { effectiveConf: unflattenConf(effectiveConf) }
+      : {}),
   };
 
   fs.writeFileSync(lockPath, JSON.stringify(lockData, null, 2) + '\n', 'utf8');
@@ -278,6 +426,7 @@ async function install(argv) {
   let presetGenerator = null;
   let presetCacheVariables = null;
   let presetInstallDir = null;
+  let presetConfigs = null;
   if (hasBuildRecipe(manifest)) {
     try {
       // Resolve the project's own options to expand ${options.*} in its
@@ -291,7 +440,7 @@ async function install(argv) {
       const projectEffectiveOptions = resolveEffectiveOptions(
         projectDeclaration, {}, projectCliOverrides, manifest.name,
       );
-      const recipe = normalizeRecipe(manifest.build, projectEffectiveOptions);
+      const recipe = normalizeRecipe(manifest.build, projectEffectiveOptions, manifest);
 
       if (recipe.generators.length > 0) {
         // First entry in the generator fallback chain. Users whose system
@@ -316,6 +465,14 @@ async function install(argv) {
       // (C:/Program Files on Windows, /usr/local on Unix). Same semantics as
       // the source-build path which passes -DCMAKE_INSTALL_PREFIX explicitly.
       presetInstallDir = recipe.installDir;
+
+      // Propagate `build.configs` so multi-config generators (Ninja
+      // Multi-Config, Visual Studio) generate build files for every
+      // config the recipe declares. Pre-2.8.1 the preset only carried
+      // Debug/Release, so a recipe listing MinSizeRel would fail with
+      // `ninja: error: loading 'build-MinSizeRel.ninja'`. CLAUDE.md §8
+      // documented that sharp edge; this closes it.
+      presetConfigs = recipe.configs;
     } catch (err) {
       log.warn(
         `could not derive CMake preset config from the project's build recipe: ${err.message}\n` +
@@ -325,6 +482,31 @@ async function install(argv) {
     }
   }
 
+  // PLAN-CONF.md §4.3 / §5 presets sink: fold effectiveConf's
+  // cmake.cache namespace into the preset's cacheVariables. Runs
+  // regardless of whether the project has its own build recipe —
+  // a consumer with no recipe but a wyvrn.local.json conf still gets
+  // their overrides into the generated preset.
+  //
+  // Conf wins on collisions with build.configure-derived vars. The
+  // recipe-normaliser blocks author-side collisions (§4.7); a
+  // collision here can only come from a consumer's CLI --conf or
+  // wyvrn.local.json overriding a value the author also sets via
+  // build.configure. Warn so the override is visible.
+  const confCacheVars = cmakeCacheVariables(effectiveConf);
+  if (Object.keys(confCacheVars).length > 0) {
+    presetCacheVariables = presetCacheVariables ?? {};
+    for (const [k, v] of Object.entries(confCacheVars)) {
+      if (k in presetCacheVariables && presetCacheVariables[k] !== v) {
+        log.warn(
+          `conf override: cmake.cache.${k} = ${JSON.stringify(v)} ` +
+          `supersedes build.configure's ${JSON.stringify(presetCacheVariables[k])}`,
+        );
+      }
+      presetCacheVariables[k] = v;
+    }
+  }
+
   const presetResult = generateCMakePresets({
     projectRoot:  rootDir,
     profileName,
@@ -334,6 +516,7 @@ async function install(argv) {
     extraCacheVariables: presetCacheVariables,
     installDir:          presetInstallDir,
     profileArch:         baseProfile.arch ?? null,
+    configs:             presetConfigs,
   });
   if (presetResult.action === 'skipped') {
     log.warn(
@@ -397,4 +580,86 @@ async function install(argv) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// --dry-run plan emitter (EVALUATION.md F6)
+// ---------------------------------------------------------------------------
+
+/**
+ * Render the resolved install plan WITHOUT touching disk. Called from
+ * `install()` when `--dry-run` is passed; exits the install flow before
+ * download, lockfile write, or toolchain generation.
+ *
+ * Text mode: human-readable per-dep summary.
+ * JSON mode (`--format=json`): structured payload on stdout with
+ * `command: "install-dry-run"` so log consumers can disambiguate it
+ * from a real install.
+ */
+function emitDryRunPlan({
+  enrichedDeps, resolvedDeps, baseProfile, profileName, buildMode,
+  packageSources, effectiveConf = {}, jsonOut,
+}) {
+  const baseHash = hashProfile(baseProfile);
+  const packages = [...resolvedDeps.keys()].sort().map((name) => {
+    const entry = enrichedDeps.get(name) ?? {};
+    return {
+      name,
+      version:     resolvedDeps.get(name),
+      profileHash: entry.profileHash ?? null,
+      options:     entry.options ?? null,
+      // Whether the dep's effective profile differs from the consumer's
+      // base (i.e. per-dep settings override produced a distinct hash).
+      overridesBaseProfile: entry.profileHash && entry.profileHash !== baseHash,
+    };
+  });
+
+  if (jsonOut) {
+    const payload = {
+      command:        'install-dry-run',
+      wyvrnpmVersion: require('../../package.json').version,
+      profile:        baseProfile,
+      profileName,
+      profileHash:    baseHash,
+      buildMode,
+      sources:        packageSources,
+      effectiveConf:  Object.keys(effectiveConf).length > 0
+                        ? unflattenConf(effectiveConf)
+                        : {},
+      packages,
+    };
+    process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+    return;
+  }
+
+  log.info('── install plan (--dry-run) ─────────────────────────────────────');
+  log.info(`Profile : "${profileName}" [${baseHash}]`);
+  log.info(`Build   : ${buildMode}`);
+  log.info(`Sources : ${packageSources.length > 0 ? packageSources.join(', ') : '(none)'}`);
+  const confKeys = Object.keys(effectiveConf).sort();
+  if (confKeys.length > 0) {
+    log.info(`Conf    : ${confKeys.map((k) => `${k}=${effectiveConf[k]}`).join(', ')}`);
+  }
+  if (packages.length === 0) {
+    log.info('(no dependencies)');
+    return;
+  }
+
+  const nameW    = Math.max(4, ...packages.map((p) => p.name.length));
+  const versionW = Math.max(7, ...packages.map((p) => p.version.length));
+  const header = `  ${'name'.padEnd(nameW)}  ${'version'.padEnd(versionW)}  profileHash       options`;
+  log.info(header);
+  log.info(`  ${'-'.repeat(nameW)}  ${'-'.repeat(versionW)}  ----------------  --------------------`);
+  for (const p of packages) {
+    const override = p.overridesBaseProfile ? ' *' : '  ';
+    const optStr   = p.options ? JSON.stringify(p.options) : '-';
+    log.info(
+      `  ${p.name.padEnd(nameW)}  ${p.version.padEnd(versionW)}  ${p.profileHash ?? '(none)         '}${override} ${optStr}`,
+    );
+  }
+  log.info('');
+  log.info('(nothing was downloaded; wyvrn.lock / wyvrn_internal / toolchain untouched)');
+  if (packages.some((p) => p.overridesBaseProfile)) {
+    log.info('  * = per-dep settings override produces a profileHash distinct from the base.');
+  }
+}
+
 module.exports = install;

package/src/commands/profile.js

@@ -10,8 +10,10 @@ const {
   listProfiles,
   getProfilesDir,
   mergeProfile,
+  resolveProfileChain,
 } = require('../profile');
 const { readConfig, writeConfig } = require('../config');
+const { parseCliConf, flattenConf, unflattenConf } = require('../conf');
 const log = require('../logger');
 
 // ---------------------------------------------------------------------------
@@ -39,11 +41,13 @@ function list() {
 
   for (const name of names) {
     const marker = name === defName ? ' *' : '';
-    const p = readProfile(name);
+    let p;
+    try { p = resolveProfileChain(name); }
+    catch { p = null; }  // cycle / missing parent — fall through to (unresolved)
     const summary = p
       ? `${p.os}/${p.arch}  ${p.compiler} ${p['compiler.version']}  C++${p['compiler.cppstd']}` +
         (p['compiler.runtime'] ? `  [${p['compiler.runtime']}]` : '')
-      : '(unreadable)';
+      : '(unresolved — check `extends`)';
     console.log(`  ${(name + marker).padEnd(24)} ${summary}`);
   }
 }
@@ -59,12 +63,26 @@ function list() {
 function show(argv) {
   const config  = readConfig();
   const name    = argv.name ?? config.defaultProfile ?? 'default';
-  const stored  = readProfile(name);
 
-  if (stored) {
+  // Raw → displays `extends:` chain for visibility. Resolved → what
+  // loadProfile() actually hands to install / publish / build.
+  const raw = readProfile(name);
+  let resolved;
+  try {
+    resolved = raw ? resolveProfileChain(name) : null;
+  } catch (err) {
+    log.error(`Cannot resolve profile "${name}": ${err.message}`);
+    process.exit(1);
+  }
+
+  if (resolved) {
     log.info(`Profile "${name}":`);
-    console.log(formatProfile(stored));
-    console.log(`\nProfile hash : ${hashProfile(stored)}`);
+    if (raw.extends !== undefined && raw.extends !== null) {
+      const chain = Array.isArray(raw.extends) ? raw.extends.join(', ') : raw.extends;
+      log.info(`  extends: ${chain}`);
+    }
+    console.log(formatProfile(resolved));
+    console.log(`\nProfile hash : ${hashProfile(resolved)}`);
   } else {
     const detected = detectProfile();
     log.info(`Profile "${name}" not found — showing auto-detected environment:`);
@@ -103,9 +121,16 @@ function detect(argv) {
 // ---------------------------------------------------------------------------
 
 /**
- * wyvrnpm configure profile set [--name <name>] [field options]
+ * wyvrnpm configure profile set [--name <name>] [field options] [--conf KEY=VAL]
  * Manually override individual fields in a named profile.
  * Starts from the existing saved profile, or auto-detects if none exists yet.
+ *
+ * --conf <namespace.leaf>=<value>   (repeatable) — set a non-ABI build-time
+ *   knob in the profile's `[conf]` block (PLAN-CONF.md phase 2). Same
+ *   syntax as `install --conf` / `build --conf`; `KEY` alone means
+ *   `KEY=ON`, `KEY=` removes any inherited value from this profile.
+ *   Profile conf never folds into `profileHash`. Allow-listed
+ *   namespaces only — unknown keys fail fast.
  */
 function set(argv) {
   const config = readConfig();
@@ -121,6 +146,44 @@ function set(argv) {
     'compiler.runtime':  argv.runtime         ?? null,
   });
 
+  // Apply --conf edits, if any. Writes at the leaf level, preserving
+  // sibling keys that weren't mentioned. `KEY=` removes the leaf.
+  const cliConf = Array.isArray(argv.conf) ? argv.conf : (argv.conf ? [argv.conf] : []);
+  if (cliConf.length > 0) {
+    let { sets, unsets } = { sets: {}, unsets: new Set() };
+    try { ({ sets, unsets } = parseCliConf(cliConf)); }
+    catch (err) {
+      log.error(`--conf: ${err.message}`);
+      process.exit(1);
+    }
+
+    const existingFlat = (() => {
+      try { return updated.conf ? flattenConf(updated.conf) : {}; }
+      catch (err) {
+        log.error(`existing profile conf is malformed: ${err.message}`);
+        process.exit(1);
+      }
+    })();
+
+    const nextFlat = { ...existingFlat, ...sets };
+    for (const k of unsets) delete nextFlat[k];
+
+    try {
+      // Re-validate as a whole so namespace/leaf checks catch both the
+      // edits AND any previously-saved pre-phase-2 garbage.
+      require('../conf/namespaces').validateFlatConfKeys(nextFlat);
+    } catch (err) {
+      log.error(`--conf: ${err.message}`);
+      process.exit(1);
+    }
+
+    if (Object.keys(nextFlat).length === 0) {
+      delete updated.conf;
+    } else {
+      updated.conf = unflattenConf(nextFlat);
+    }
+  }
+
   writeProfile(name, updated);
 
   log.info(`Profile "${name}" updated:`);

package/src/commands/publish.js

@@ -8,6 +8,13 @@ const AdmZip = require('adm-zip');
 const { readManifest }                                     = require('../manifest');
 const { getProvider }                                      = require('../providers');
 const { readConfig }                                       = require('../config');
+const { resolveSourceAuth }                                = require('../auth');
+const {
+  readRecipeConf,
+  parseCliConf,
+  mergeConfLayers,
+  unflattenConf,
+}                                                          = require('../conf');
 const { loadProfile, hashProfile, sha256Of, getGitSha, getGitRepo, isShaOnRemote } = require('../profile');
 const { defaultCompatBlock }                               = require('../compat');
 const {
@@ -89,8 +96,9 @@ function addInstallTree(zip, installDir) {
 // ---------------------------------------------------------------------------
 
 function resolveSource(argv) {
-  let { source, awsProfile, token } = argv;
+  let { source, awsProfile } = argv;
   const config = readConfig();
+  let sourceEntry = null;
 
   if (source) {
     const named = config.publishSources.find((s) => s.name === source);
@@ -98,7 +106,7 @@ function resolveSource(argv) {
       log.info(`Using publish source "${named.name}" from config`);
       source     = named.url;
       awsProfile = awsProfile ?? named.profile;
-      token      = token      ?? named.token;
+      sourceEntry = named;
     }
   } else {
     if (config.publishSources.length === 0) {
@@ -112,9 +120,15 @@ function resolveSource(argv) {
     log.info(`Using publish source "${first.name}" from config`);
     source     = first.url;
     awsProfile = awsProfile ?? first.profile;
-    token      = token      ?? first.token;
+    sourceEntry = first;
   }
 
+  // Literal --token beats --token-env beats config.token beats config.tokenEnv.
+  const { token } = resolveSourceAuth(
+    { token: argv.token, tokenEnv: argv.tokenEnv },
+    sourceEntry,
+  );
+
   return { source, awsProfile, token };
 }
 
@@ -265,9 +279,32 @@ async function publish(argv) {
     os.tmpdir(),
     `wyvrnpm-manifest-${name}-${version}-${Date.now()}.json`,
   );
+  // ── publishedConf (PLAN-CONF.md §4.6) ────────────────────────────────────
+  // Publish reads ONLY the recipe conf + CLI --conf — wyvrn.local.json is
+  // intentionally ignored (plan §4.5 / §8.4) so dev-local overlays never
+  // leak into shared artefacts. Recorded on the published manifest as
+  // informational metadata: it tells maintainers what the publisher's
+  // CMake cache vars were at build time but does NOT drive resolution on
+  // the consumer side.
+  let publishedConf = {};
+  try {
+    const recipeConfFlat = readRecipeConf(manifest);
+    const cli            = parseCliConf(argv.conf);
+    publishedConf = mergeConfLayers(recipeConfFlat, {}, cli);
+  } catch (err) {
+    log.error(`conf resolution failed: ${err.message}`);
+    process.exit(1);
+  }
+  if (Object.keys(publishedConf).length > 0) {
+    log.info(`Published conf: ${JSON.stringify(publishedConf)}`);
+  }
+
   const manifestForPublish = {
     ...manifest,
     compatibility: manifest.compatibility ?? defaultCompatBlock(),
+    ...(Object.keys(publishedConf).length > 0
+      ? { publishedConf: unflattenConf(publishedConf) }
+      : {}),
   };
   fs.writeFileSync(tmpManifestPath, JSON.stringify(manifestForPublish, null, 2), 'utf8');
   if (!manifest.compatibility) {
@@ -288,7 +325,7 @@ async function publish(argv) {
   let installOverlayPaths = new Set();
   if (hasBuildRecipe(manifest)) {
     try {
-      const recipe = normalizeRecipe(manifest.build, effectiveOptions);
+      const recipe = normalizeRecipe(manifest.build, effectiveOptions, manifest);
       const candidate = path.join(
         srcDir, 'build', `wyvrn-${activeProfileName}`, recipe.installDir,
       );

package/src/commands/show.js

@@ -1,8 +1,9 @@
 'use strict';
 
-const { readConfig }  = require('../config');
-const { getProvider } = require('../providers');
-const log             = require('../logger');
+const { readConfig }       = require('../config');
+const { getProvider }      = require('../providers');
+const { resolveSourceAuth } = require('../auth');
+const log                  = require('../logger');
 
 /**
  * `wyvrnpm show <pkg>` — surface registry metadata for a package.
@@ -145,6 +146,11 @@ async function show(argv) {
             if (meta?.options && Object.keys(meta.options).length > 0) {
               console.log(`      declared: ${formatDeclaredOptions(meta.options)}`);
             }
+            // PLAN-CONF.md §4.6 — surface publisher's publishedConf.
+            // Informational only; absent for pre-2.6.0 author publishes.
+            if (meta?.publishedConf && Object.keys(meta.publishedConf).length > 0) {
+              console.log(`      conf    : ${JSON.stringify(meta.publishedConf)}`);
+            }
           }
         }
 
@@ -157,6 +163,7 @@ async function show(argv) {
           uploadedBy:      meta?.uploadedBy    ?? null,
           compatibility:   meta?.compatibility ?? null,
           declaredOptions: meta?.options       ?? null,
+          publishedConf:   meta?.publishedConf ?? null,
         });
       }
 
@@ -202,7 +209,10 @@ function resolveSources(argv) {
   return {
     sources,
     awsProfile: argv.awsProfile ?? firstConfig?.profile,
-    token:      argv.token      ?? firstConfig?.token,
+    token:      resolveSourceAuth(
+      { token: argv.token, tokenEnv: argv.tokenEnv },
+      firstConfig,
+    ).token,
   };
 }