wyvrnpm 2.4.1 → 2.8.1

package/src/profile.js

@@ -162,6 +162,13 @@ function detectProfile() {
   };
 }
 
+// Profile fields that participate in profileHash — mirror Conan's
+// `[settings]` strictly. Anything else at the top level (e.g. `conf`)
+// is non-ABI and must never fold into the hash (PLAN-CONF.md constitution).
+const HASHED_PROFILE_FIELDS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
 /**
  * Compute a stable 16-char SHA256 prefix identifying a unique build.
  * Inputs:
@@ -169,14 +176,19 @@ function detectProfile() {
  *   - `options`: (optional) recipe-declared feature toggles resolved to
  *     their effective values for this build.
  *
- * Backward-compat contract: when `options` is null / undefined / empty,
- * the hash is byte-identical to what pre-F1 wyvrnpm produced. Packages
- * without an `options` block keep their existing registry addresses.
- * The caller therefore passes `null` (not `{}`) to mean "this recipe
- * has no options declared" — consistent with what
- * `resolveEffectiveOptions` returns in that case.
+ * Backward-compat contract:
+ *   - When `options` is null / undefined / empty, the hash is
+ *     byte-identical to what pre-F1 wyvrnpm produced. Packages
+ *     without an `options` block keep their existing registry
+ *     addresses. The caller passes `null` (not `{}`) to mean "this
+ *     recipe has no options declared" — consistent with what
+ *     `resolveEffectiveOptions` returns in that case.
+ *   - When a profile carries a `conf` block (phase 2 — PLAN-CONF.md),
+ *     the hash is byte-identical to the same profile WITHOUT `conf`.
+ *     Build-time knobs are non-ABI by design (constitution).
  *
- * See claude/PLAN-OPTIONS.md §3.2 for the full design.
+ * See claude/PLAN-OPTIONS.md §3.2 and claude/PLAN-CONF.md for the
+ * full design.
  *
  * @param {WyvrnProfile} profile
  * @param {Record<string, any>|null} [options]  effective options (after defaults + overrides)
@@ -185,7 +197,10 @@ function detectProfile() {
 function hashProfile(profile, options = null) {
   const significant = Object.fromEntries(
     Object.entries(profile)
-      .filter(([, v]) => v !== null && v !== undefined && v !== '*' && v !== '')
+      .filter(([k, v]) =>
+        HASHED_PROFILE_FIELDS.has(k) &&
+        v !== null && v !== undefined && v !== '*' && v !== '',
+      )
       .sort(([a], [b]) => a.localeCompare(b)),
   );
 
@@ -267,6 +282,8 @@ function isShaOnRemote(sha, cwd) {
 
 /**
  * Format a profile for human-readable display (Conan-style).
+ * Emits a `[conf]` block with flat dotted keys when the profile
+ * carries a non-empty `conf` block (PLAN-CONF.md phase 2).
  *
  * @param {WyvrnProfile} profile
  * @returns {string}
@@ -282,6 +299,23 @@ function formatProfile(profile) {
       lines.push(`${key}=${val}`);
     }
   }
+
+  // [conf] block, Conan-style. Rendered flat so it's clear these are
+  // dotted namespaced keys, not nested JSON. Alphabetical for stable diffs.
+  const confBlock = profile.conf;
+  if (confBlock && typeof confBlock === 'object' && !Array.isArray(confBlock)) {
+    // Lazy-require to avoid circular dep (src/conf/* → src/manifest → src/profile).
+    const { flattenConf } = require('./conf');
+    let flat;
+    try { flat = flattenConf(confBlock); } catch { flat = null; }
+    if (flat && Object.keys(flat).length > 0) {
+      lines.push('[conf]');
+      for (const key of Object.keys(flat).sort()) {
+        lines.push(`${key}=${flat[key]}`);
+      }
+    }
+  }
+
   return lines.join('\n');
 }
 
@@ -386,15 +420,116 @@ function listProfiles() {
 }
 
 /**
- * Load the active build profile by name. Falls back to auto-detection if the
- * named profile file does not exist yet.
+ * Resolve a profile-inheritance chain (F8). A profile may declare
+ *
+ *   { "extends": "base-profile", ... }
+ *   { "extends": ["base1", "base2"], ... }      // later wins over earlier
+ *
+ * `extends` is resolved recursively; the child's fields overlay the
+ * merged parent(s). Cycle detection throws a clear error. Missing
+ * parents throw — we don't silently drop `extends`, that would hide
+ * typos.
+ *
+ * Merge rules:
+ *  - `[settings]` fields: child overrides parent, per-key.
+ *  - `conf` block: parent + child flattened with child wins per-leaf
+ *    (same pattern as PLAN-CONF.md §4.2 within the single profile).
+ *  - `extends` itself is stripped from the resolved output — the
+ *    returned object carries no inheritance metadata, so existing
+ *    consumers (formatProfile, hashProfile, readProfileConf) work
+ *    unchanged.
+ *
+ * @param {string} name
+ * @param {string[]} [stack] visited names — for cycle detection
+ * @returns {WyvrnProfile|null} Fully-resolved profile, or null if `name`
+ *   does not exist on disk at the root of the chain.
+ */
+function resolveProfileChain(name, stack = []) {
+  if (stack.includes(name)) {
+    throw new Error(
+      `profile inheritance cycle: ${[...stack, name].join(' → ')}`,
+    );
+  }
+
+  const raw = readProfile(name);
+  if (!raw) return null;
+
+  const rawExtends = raw.extends;
+  if (rawExtends === undefined || rawExtends === null) {
+    // Flat profile — just strip any accidental `extends` and return.
+    const { extends: _, ...rest } = raw;
+    return rest;
+  }
+
+  const parents = Array.isArray(rawExtends) ? rawExtends : [rawExtends];
+  for (const p of parents) {
+    if (typeof p !== 'string' || p.length === 0) {
+      throw new Error(
+        `profile "${name}": extends entries must be non-empty strings, got ${JSON.stringify(p)}`,
+      );
+    }
+  }
+
+  // Merge parents left-to-right, then overlay the child.
+  let merged = {};
+  for (const parentName of parents) {
+    const parent = resolveProfileChain(parentName, [...stack, name]);
+    if (!parent) {
+      throw new Error(
+        `profile "${name}": extends parent "${parentName}" not found ` +
+        `at ${getProfilesDir()}`,
+      );
+    }
+    merged = mergeResolvedProfiles(merged, parent);
+  }
+
+  const { extends: _, ...child } = raw;
+  return mergeResolvedProfiles(merged, child);
+}
+
+/**
+ * Merge two already-resolved profile objects. Top-level `[settings]`
+ * fields: right wins. `conf` block: per-leaf merge, right wins.
+ * @param {object} base
+ * @param {object} overlay
+ * @returns {object}
+ */
+function mergeResolvedProfiles(base, overlay) {
+  const out = { ...base, ...overlay };
+  // Nullable override semantics: `null` on the overlay explicitly
+  // unsets a field from the base (matches how Conan profiles
+  // handle `compiler.runtime=None`).
+  for (const k of Object.keys(overlay)) {
+    if (overlay[k] === null) delete out[k];
+  }
+  // Conf block is merged per-leaf, not per-branch.
+  if (base.conf || overlay.conf) {
+    const { flattenConf, unflattenConf } = require('./conf');
+    let baseFlat    = {};
+    let overlayFlat = {};
+    try { if (base.conf)    baseFlat    = flattenConf(base.conf);    } catch { /* leave empty */ }
+    try { if (overlay.conf) overlayFlat = flattenConf(overlay.conf); } catch { /* leave empty */ }
+    const merged = { ...baseFlat, ...overlayFlat };
+    if (Object.keys(merged).length > 0) {
+      out.conf = unflattenConf(merged);
+    } else {
+      delete out.conf;
+    }
+  }
+  return out;
+}
+
+/**
+ * Load the active build profile by name, resolving any `extends` chain.
+ * Falls back to auto-detection if the named profile file does not
+ * exist yet.
  *
  * @param {string} [name='default']
  * @returns {{ profile: WyvrnProfile, fromFile: boolean }}
  */
 function loadProfile(name = 'default') {
-  const stored = readProfile(name);
-  if (stored) return { profile: stored, fromFile: true };
+  const resolved = resolveProfileChain(name);
+  if (resolved) return { profile: resolved, fromFile: true };
   return { profile: detectProfile(), fromFile: false };
 }
 
@@ -415,6 +550,7 @@ module.exports = {
   deleteProfile,
   listProfiles,
   loadProfile,
+  resolveProfileChain,
 };
 
 /**

package/src/resolve.js

@@ -141,15 +141,27 @@ async function resolveLatestVersion(name, packageSources, platform, httpClient)
 /**
  * Fetches razer.json for a single package from the first source that responds.
  *
+ * When `preferredProfileHash` is provided (EVALUATION.md F13 — closes the
+ * "picks arbitrary profileHash" latent bug), the v2 lookup tries that hash
+ * first and only falls back to the first-available profile if the preferred
+ * hash isn't on the registry. Dependency declarations are invariant across
+ * profiles today, so picking any hash gives the same answer — but the
+ * consumer's own hash is stable across re-resolves and future-proofs
+ * against any schema that starts varying wyvrn.json per profile.
+ *
  * @param {string} name
  * @param {string} version
  * @param {string[]} packageSources
  * @param {string} platform
  * @param {Function} httpClient
  * @param {Map<string, object>} cache - In-flight / completed fetch cache.
+ * @param {string|null} [preferredProfileHash] - try this hash first.
  * @returns {Promise<object|null>} Parsed razer.json or null if not found anywhere.
  */
-async function fetchPackageManifest(name, version, packageSources, platform, httpClient, cache) {
+async function fetchPackageManifest(
+  name, version, packageSources, platform, httpClient, cache,
+  preferredProfileHash = null,
+) {
   const cacheKey = `${name}@${version}`;
   if (cache.has(cacheKey)) {
     return cache.get(cacheKey);
@@ -158,14 +170,19 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
   for (const source of packageSources) {
     const base = source.replace(/\/$/, '');
 
-    // v2: look up any available profile hash from versions.json, then fetch that manifest
+    // v2: prefer the consumer's own profileHash; fall back to the first
+    // available if that hash isn't published.
     try {
       const idxResp = await httpClient(`${base}/v2/${name}/versions.json`);
       if (idxResp.ok) {
         const idx = await idxResp.json();
         const profiles = idx?.versions?.[version]?.profiles;
         if (profiles) {
-          const profileHash = Object.keys(profiles)[0];
+          const available = Object.keys(profiles);
+          const profileHash =
+            (preferredProfileHash && available.includes(preferredProfileHash))
+              ? preferredProfileHash
+              : available[0];
           if (profileHash) {
             const mResp = await httpClient(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`);
             if (mResp.ok) {
@@ -215,15 +232,37 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
  * Passing `null` / omitting it keeps the legacy behaviour.
  *
+ * Per-package source pinning (EVALUATION.md S4): when `pinnedSources` is
+ * provided, any entry `name → url` restricts that package's manifest +
+ * latest + versions lookups to just that URL — typo-squatting and mirror
+ * shadowing are closed for pinned deps. Pins propagate to direct deps
+ * only; transitive deps continue to fan out across all sources (a pinned
+ * dep's own recipe is authoritative for its own transitives).
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
  * @param {Map<string, string>} [lockedVersions]
  * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
+ * @param {string|null} [preferredProfileHash] - consumer's own profileHash;
+ *   threaded to fetchPackageManifest so v2 manifest lookups prefer the
+ *   consumer's own build entry over an arbitrary one (EVALUATION.md F13).
+ * @param {Map<string,string>|null} [pinnedSources] - per-package source URL pin (S4).
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
+async function resolveDependencies(
+  rootDeps, packageSources, platform, httpClient,
+  lockedVersions = new Map(), manifestsOut = null,
+  preferredProfileHash = null,
+  pinnedSources = null,
+) {
+  // For pinned deps, restrict the source list to the single pinned URL.
+  // `null` / no pin → fall back to the full caller-supplied list.
+  const sourcesFor = (name) => {
+    const pin = pinnedSources?.get?.(name);
+    return pin ? [pin] : packageSources;
+  };
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -254,7 +293,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const publishedCache = new Map();
   const fetchPublished = async (name) => {
     if (publishedCache.has(name)) return publishedCache.get(name);
-    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    const list = await fetchPublishedVersions(name, sourcesFor(name), httpClient);
     publishedCache.set(name, list);
     return list;
   };
@@ -280,7 +319,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
     // Skip this for linked packages which have "linked:" prefix.
     if (version === 'latest') {
       try {
-        version = await resolveLatestVersion(name, packageSources, platform, httpClient);
+        version = await resolveLatestVersion(name, sourcesFor(name), platform, httpClient);
         log.info(`Resolved "${name}@latest" → ${version}`);
       } catch (err) {
         log.warn(err.message);
@@ -405,10 +444,11 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       manifest = await fetchPackageManifest(
         name,
         version,
-        packageSources,
+        sourcesFor(name),
         platform,
         httpClient,
         manifestCache,
+        preferredProfileHash,
       );
     }
 

package/src/settings-overrides.js

@@ -0,0 +1,152 @@
+'use strict';
+
+// Pattern-based settings overrides (EVALUATION.md F11).
+//
+// `wyvrn.json` may declare a top-level `settingsOverrides` block whose
+// keys are glob patterns over dependency names. Every matching pattern
+// contributes to the resolved dep's `settings` merge; the per-dep
+// literal settings (inside `dependencies`) still win over patterns.
+//
+// Conan users know this feature as profile-side `boost*:compiler.cppstd=17`.
+// Ours lives in the manifest because that's where literal settings
+// overrides already live — one fewer concept for recipe authors.
+//
+// Pure, no I/O. Exported helpers:
+//   - normalizeSettingsOverrides: validate + sort by specificity
+//   - resolveOverrideSettings: compute the merged settings for a dep name
+
+/**
+ * Valid profile field keys that settings overrides may target.
+ * Mirrors `HASHED_PROFILE_FIELDS` in src/profile.js, but as the allow-
+ * list for OVERRIDE values (os/arch/compiler/etc.). If a pattern
+ * override tries to set something else, reject at parse time rather
+ * than silently letting it through into mergeProfile.
+ */
+const ALLOWED_SETTINGS_KEYS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
+/**
+ * Convert a glob pattern to a RegExp. Supports `*` (any chars),
+ * `?` (single char), literal everything else. No brace expansion,
+ * no negation — keep the mental model small.
+ *
+ * @param {string} glob
+ * @returns {RegExp}
+ */
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  const pattern = escaped.replace(/\*/g, '.*').replace(/\?/g, '.');
+  return new RegExp(`^${pattern}$`);
+}
+
+/**
+ * Specificity heuristic: fewer wildcards = more specific. Ties broken
+ * by longer literal prefix, then lexical order for determinism. More
+ * specific patterns get applied LAST so they override less-specific
+ * ones in the merge.
+ *
+ * @param {string} glob
+ * @returns {[number, number, string]} sort key — lower = less specific
+ */
+function specificityKey(glob) {
+  const wildcards = (glob.match(/[*?]/g) ?? []).length;
+  const literalPrefix = glob.match(/^[^*?]*/)?.[0].length ?? 0;
+  // Invert sort order: more wildcards → lower score; more prefix → higher score.
+  return [-wildcards, literalPrefix, glob];
+}
+
+/**
+ * Validate + sort a raw `settingsOverrides` block. Returns an array of
+ * `{ pattern, regex, settings }` in application order (least-specific
+ * first). A string pattern alone (literal `"openssl"`) works too — it
+ * matches only that exact name.
+ *
+ * Throws on:
+ *  - non-object block
+ *  - non-string keys (JSON can't produce these but defensive)
+ *  - non-object values
+ *  - empty pattern strings
+ *  - unknown settings keys in a value
+ *  - non-string value leaves (settings values must be strings like
+ *    the profile itself: "dynamic", "17", "gcc")
+ *
+ * @param {unknown} block
+ * @returns {Array<{ pattern: string, regex: RegExp, settings: Record<string, string> }>}
+ */
+function normalizeSettingsOverrides(block) {
+  if (block === undefined || block === null) return [];
+  if (typeof block !== 'object' || Array.isArray(block)) {
+    throw new Error('settingsOverrides must be an object mapping globs to settings');
+  }
+
+  const entries = [];
+  for (const [rawPattern, rawValue] of Object.entries(block)) {
+    if (typeof rawPattern !== 'string' || rawPattern.length === 0) {
+      throw new Error(`settingsOverrides: pattern must be a non-empty string, got ${JSON.stringify(rawPattern)}`);
+    }
+    if (!rawValue || typeof rawValue !== 'object' || Array.isArray(rawValue)) {
+      throw new Error(`settingsOverrides["${rawPattern}"]: value must be an object of settings`);
+    }
+
+    const settings = {};
+    for (const [k, v] of Object.entries(rawValue)) {
+      if (!ALLOWED_SETTINGS_KEYS.has(k)) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"]: unknown key "${k}" — ` +
+          `allowed: ${[...ALLOWED_SETTINGS_KEYS].join(', ')}`,
+        );
+      }
+      if (typeof v !== 'string' || v.length === 0) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"].${k}: value must be a non-empty string, ` +
+          `got ${JSON.stringify(v)}`,
+        );
+      }
+      settings[k] = v;
+    }
+
+    entries.push({ pattern: rawPattern, regex: globToRegExp(rawPattern), settings });
+  }
+
+  // Sort by specificity ascending so more-specific patterns apply LAST
+  // (their settings therefore win on per-key merge).
+  entries.sort((a, b) => {
+    const ka = specificityKey(a.pattern);
+    const kb = specificityKey(b.pattern);
+    for (let i = 0; i < ka.length; i++) {
+      if (ka[i] < kb[i]) return -1;
+      if (ka[i] > kb[i]) return  1;
+    }
+    return 0;
+  });
+
+  return entries;
+}
+
+/**
+ * Merge all matching pattern overrides for `depName` into a flat
+ * settings object. Less-specific patterns apply first; more-specific
+ * patterns overlay on top. Does NOT include the literal per-dep
+ * `settings` (caller layers that on after — literal always wins).
+ *
+ * @param {string} depName
+ * @param {ReturnType<typeof normalizeSettingsOverrides>} normalized
+ * @returns {Record<string, string>}
+ */
+function resolveOverrideSettings(depName, normalized) {
+  const out = {};
+  for (const entry of normalized) {
+    if (entry.regex.test(depName)) {
+      Object.assign(out, entry.settings);
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  ALLOWED_SETTINGS_KEYS,
+  globToRegExp,
+  normalizeSettingsOverrides,
+  resolveOverrideSettings,
+};

package/src/toolchain/presets.js

@@ -72,6 +72,20 @@ function isWyvrnGenerated(presets) {
  *                                             so `cmake --preset` produces
  *                                             binaries matching the profile
  *                                             (VS otherwise defaults to x64).
+ * @param {string[]|null} [args.configs]       Build recipe's `configs` list
+ *                                             (e.g. ['Debug','Release','MinSizeRel']).
+ *                                             When provided, drives
+ *                                             `CMAKE_CONFIGURATION_TYPES` so
+ *                                             multi-config generators (Ninja
+ *                                             Multi-Config, VS) actually
+ *                                             produce every config the recipe
+ *                                             declares. Null/empty → omitted
+ *                                             (let CMake use its generator
+ *                                             default). `extraCacheVariables`
+ *                                             wins on explicit collision so
+ *                                             authors that already bake the
+ *                                             list into `build.configure`
+ *                                             aren't overridden.
  */
 function buildConfigurePreset({
   profileName,
@@ -81,16 +95,20 @@ function buildConfigurePreset({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   const binaryDir = `\${sourceDir}/build/wyvrn-${profileName}`;
-  // Spread `extraCacheVariables` FIRST, then the wyvrn-owned entries. This
-  // means the recipe cannot redirect `CMAKE_TOOLCHAIN_FILE` — our dep
-  // injection is always the authoritative toolchain pointer. A malicious
-  // or sloppy recipe trying to override it is silently ignored, not
-  // quietly obeyed. Same protection applies to `CMAKE_INSTALL_PREFIX`:
-  // if a recipe declares `build.installDir`, we resolve it under the
-  // binary dir; any cacheVariables override is overwritten below.
+  // CMAKE_CONFIGURATION_TYPES is a defensible default from the recipe's
+  // declared `configs` list. Applied FIRST (lowest precedence) so an
+  // explicit `-DCMAKE_CONFIGURATION_TYPES=...` in `build.configure`
+  // still wins — authors who already pin the list shouldn't silently
+  // lose their override. The wyvrn-owned entries (toolchain, install
+  // prefix) still win over both below.
+  const configsDefault = (Array.isArray(configs) && configs.length > 0)
+    ? { CMAKE_CONFIGURATION_TYPES: configs.join(';') }
+    : {};
   const cacheVariables = {
+    ...configsDefault,
     ...(extraCacheVariables ?? {}),
     CMAKE_TOOLCHAIN_FILE: `\${sourceDir}/${toolchainRelPath}`,
   };
@@ -128,27 +146,32 @@ function buildConfigurePreset({
 }
 
 /**
- * Two build presets per configure preset: Debug and Release.
+ * One build preset per configuration the recipe declares (or the
+ * legacy default pair `Debug` + `Release` when no list is provided).
+ *
+ * The preset name suffix is the configuration name lower-cased — matches
+ * the previous Debug/Release naming for those two, and extends to
+ * `wyvrn-<profile>-relwithdebinfo` / `-minsizerel` for the multi-config
+ * cases. Authors whose recipes include `MinSizeRel` in `build.configs`
+ * can now `cmake --build --preset wyvrn-<profile>-minsizerel` directly.
  *
  * @param {string} profileName
+ * @param {string[]|null} [configs]  Recipe's declared configurations. When
+ *   null/empty, emits the pre-2.8.1 `Debug` + `Release` pair so existing
+ *   CMakePresets.json files remain byte-identical.
  * @returns {Array<object>}
  */
-function buildBuildPresets(profileName) {
-  const config = `wyvrn-${profileName}`;
-  return [
-    {
-      name:            `${config}-debug`,
-      displayName:     `wyvrn ${profileName} (Debug)`,
-      configurePreset: config,
-      configuration:   'Debug',
-    },
-    {
-      name:            `${config}-release`,
-      displayName:     `wyvrn ${profileName} (Release)`,
-      configurePreset: config,
-      configuration:   'Release',
-    },
-  ];
+function buildBuildPresets(profileName, configs = null) {
+  const base = `wyvrn-${profileName}`;
+  const list = (Array.isArray(configs) && configs.length > 0)
+    ? configs
+    : ['Debug', 'Release'];
+  return list.map((cfg) => ({
+    name:            `${base}-${cfg.toLowerCase()}`,
+    displayName:     `wyvrn ${profileName} (${cfg})`,
+    configurePreset: base,
+    configuration:   cfg,
+  }));
 }
 
 /**
@@ -162,6 +185,7 @@ function buildFreshPresetsFile({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   return {
     version: SCHEMA_VERSION,
@@ -173,9 +197,9 @@ function buildFreshPresetsFile({
       },
     },
     configurePresets: [buildConfigurePreset({
-      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch,
+      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
     })],
-    buildPresets: buildBuildPresets(profileName),
+    buildPresets: buildBuildPresets(profileName, configs),
   };
 }
 
@@ -197,18 +221,33 @@ function mergeIntoExisting(existing, {
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   const newConfigure = buildConfigurePreset({
-    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch,
+    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
   });
-  const newBuilds    = buildBuildPresets(profileName);
+  const newBuilds    = buildBuildPresets(profileName, configs);
   const newConfigureNames = new Set([newConfigure.name]);
-  const newBuildNames     = new Set(newBuilds.map((b) => b.name));
+  // When replacing THIS profile's build presets, drop every pre-existing
+  // one that targets the same configurePreset — the fresh `newBuilds`
+  // list fully replaces them. Scoping to configurePreset avoids stepping
+  // on presets for OTHER profiles in the same file, which is the whole
+  // point of the merge path.
+  //
+  // Without this, editing `build.configs` from 4 configs down to 2 would
+  // leave orphan build presets pointing at configurations CMake won't
+  // generate.
+  const myBase = `wyvrn-${profileName}`;
+  const isMyBuildPreset = (p) => p && p.configurePreset === myBase;
 
   const configurePresets = (existing.configurePresets ?? []).filter((p) => !newConfigureNames.has(p.name));
   configurePresets.push(newConfigure);
 
-  const buildPresets = (existing.buildPresets ?? []).filter((p) => !newBuildNames.has(p.name));
+  // Drop every pre-existing build preset that targets THIS profile's
+  // configurePreset — the fresh `newBuilds` list (one per current
+  // `configs` entry) fully replaces them. Presets for OTHER profiles
+  // stay untouched so the multi-profile merge story is preserved.
+  const buildPresets = (existing.buildPresets ?? []).filter((p) => !isMyBuildPreset(p));
   buildPresets.push(...newBuilds);
 
   return {
@@ -260,8 +299,9 @@ function generateCMakePresets({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
-  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch };
+  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs };
   const candidates = [
     { filePath: path.join(projectRoot, 'CMakePresets.json'),     isUser: false },
     { filePath: path.join(projectRoot, 'CMakeUserPresets.json'), isUser: true  },