wyvrnpm 2.4.1 → 2.9.0

package/src/http-fetch.js

@@ -0,0 +1,53 @@
+'use strict';
+
+// Shared `fetch` wrapper used by every resolver / downloader call site.
+//
+// 2.8.3 shipped with a split between the HTTP provider (which uses
+// node:https directly and sends `User-Agent: wyvrnpm/<ver>` + no
+// `Accept-Encoding`) and the resolver (which used the bare global
+// `fetch` — undici — defaulting to `Accept-Encoding: gzip, deflate,
+// br`). CloudFront caches a **separate entry per response encoding**,
+// so a `versions.json` freshly updated at origin could be stale in the
+// Brotli cache bucket for up to the full TTL while the identity bucket
+// served fresh bytes. The provider calls (show) happened to land in
+// the identity bucket (fresh); the resolver calls (install, add)
+// landed in the Brotli bucket (stale).
+//
+// Mitigation: force `Accept-Encoding: identity`. Manifest JSONs are
+// small (KB to tens of KB) so the lost compression is negligible, and
+// one encoding means one cache bucket — no split-brain. User-Agent +
+// `Accept: application/json` are included for good measure (CloudFront
+// + some WAFs 403 UA-less requests).
+//
+// Defence-in-depth: src/providers/s3.js caps every manifest-JSON PUT
+// at `CacheControl: public, max-age=300` (2.8.4), so the worst-case
+// staleness for any future publish is 5 min regardless of which
+// cache bucket a client lands in.
+//
+// See claude/PLAN-RESOLVER-HTTP-UNIFY.md for the follow-up plan to
+// route all resolver HTTP through the provider API and retire this
+// wrapper.
+
+const USER_AGENT = `wyvrnpm/${require('../package.json').version}`;
+
+/**
+ * Drop-in replacement for the global `fetch`. Injects wyvrnpm's
+ * `User-Agent`, an `Accept: application/json` hint, and forces
+ * `Accept-Encoding: identity` to avoid CloudFront's per-encoding
+ * cache-key split. Caller-supplied headers win on collision.
+ *
+ * @param {string | URL} url
+ * @param {RequestInit} [init]
+ * @returns {Promise<Response>}
+ */
+function wyvrnFetch(url, init = {}) {
+  const headers = {
+    'User-Agent': USER_AGENT,
+    Accept: 'application/json',
+    'Accept-Encoding': 'identity',
+    ...(init.headers || {}),
+  };
+  return fetch(url, { ...init, headers });
+}
+
+module.exports = { wyvrnFetch, USER_AGENT };

package/src/logger.js

@@ -11,6 +11,32 @@
 
 const PREFIX = '[wyvrn]';
 
+// ── Sensitive-value redaction (EVALUATION.md S8) ──────────────────────────────
+// Defense-in-depth against a token leaking into logs or error traces. Nothing
+// in wyvrnpm deliberately logs tokens today, but callers sometimes paste full
+// commands + error output into bug reports, and some future error path might
+// stringify argv. Two narrow patterns cover every format we handle:
+//
+//   `--token <value>`                    — CLI leak
+//   `Authorization: Bearer <value>`      — HTTP header leak
+//   `Bearer <value>` (standalone)        — header fragment leak
+//
+// Redaction is a last-line mitigation — the primary fix is `--token-env` and
+// per-source `tokenEnv` so the literal value never lands in argv to begin with.
+const TOKEN_PATTERNS = [
+  [/(--token(?:-env)?[= ]+)\S+/g,                          '$1***'],
+  [/(Authorization\s*:\s*Bearer\s+)\S+/gi,                 '$1***'],
+  [/(\bBearer\s+)[A-Za-z0-9._\-+/=]{16,}/g,                '$1***'],
+];
+
+function redactSensitive(text) {
+  let out = String(text);
+  for (const [pattern, replacement] of TOKEN_PATTERNS) {
+    out = out.replace(pattern, replacement);
+  }
+  return out;
+}
+
 const ANSI = {
   reset:  '\x1b[0m',
   bold:   '\x1b[1m',
@@ -49,7 +75,9 @@ function paint(text, code, stream) {
 function emit(stream, consoleFn, coloredPrefix, message) {
   // Every line in a multi-line message gets the prefix — so multi-line errors
   // line up visually without the caller having to repeat `[wyvrn]` per line.
-  const out = String(message)
+  // Redaction runs before the prefix/colour is applied so patterns like
+  // `--token xyz` match regardless of how the caller formatted the line.
+  const out = redactSensitive(message)
     .split('\n')
     .map((line) => `${coloredPrefix} ${line}`)
     .join('\n');
@@ -91,4 +119,4 @@ function debug(message) {
   emit(process.stderr, console.error, `${p} ${tag}`, message);
 }
 
-module.exports = { info, warn, error, success, debug, setJsonMode, isJsonMode };
+module.exports = { info, warn, error, success, debug, setJsonMode, isJsonMode, redactSensitive };

package/src/manifest.js

@@ -3,6 +3,8 @@
 const fs = require('fs');
 const path = require('path');
 
+const { readRecipeConf } = require('./conf');
+
 /** Current manifest schema version emitted by v2 tooling. */
 const SCHEMA_VERSION = 2;
 
@@ -52,18 +54,21 @@ function defaultManifest(name) {
 
 /**
  * Normalise the raw `dependencies` field from a manifest into a consistent
- * `{ name → { version, settings, options } }` map, regardless of input format:
+ * `{ name → { version, settings, options, source? } }` map, regardless of
+ * input format:
  *
- *   • String value  : "1.0.0"                         → { version: "1.0.0", settings: {}, options: {} }
- *   • Object value  : { version, settings?, options? } → kept (missing keys default to {})
- *   • Array format  : [{ Name, Version }]              → converted (no settings/options)
+ *   • String value  : "1.0.0"                                 → { version: "1.0.0", settings: {}, options: {} }
+ *   • Object value  : { version, settings?, options?, source? } → kept (missing keys default to {})
+ *   • Array format  : [{ Name, Version }]                      → converted (no settings/options)
  *
  * `settings` merges on top of the active profile for this dep only.
  * `options` maps to the recipe's declared options; validated against
  * the recipe's `allowed` list at resolve time (see src/options.js).
+ * `source` (EVALUATION.md S4) pins the dep to a named install source
+ * (e.g. `"primary-s3"`); absent = fan out across all configured sources.
  *
  * @param {object|Array|undefined} rawDeps
- * @returns {Record<string, { version: string, settings: object, options: object }>}
+ * @returns {Record<string, { version: string, settings: object, options: object, source?: string }>}
  */
 function normalizeDependencies(rawDeps) {
   if (!rawDeps || typeof rawDeps !== 'object') return {};
@@ -83,11 +88,17 @@ function normalizeDependencies(rawDeps) {
     if (typeof value === 'string') {
       result[n] = { version: value, settings: {}, options: {} };
     } else if (value && typeof value === 'object') {
-      result[n] = {
+      const entry = {
         version:  value.version ?? value.Version ?? '',
         settings: value.settings ?? {},
         options:  value.options  ?? {},
       };
+      // Per-package source pin (S4). Only keep it if it's a non-empty
+      // string so {} / null / 0 don't silently pin to a nonsense value.
+      if (typeof value.source === 'string' && value.source.length > 0) {
+        entry.source = value.source;
+      }
+      result[n] = entry;
     }
   }
   return result;
@@ -106,11 +117,27 @@ function readManifest(manifestPath) {
     throw new Error(`Manifest not found: ${resolved}`);
   }
   const raw = fs.readFileSync(resolved, 'utf8');
+  let parsed;
   try {
-    return JSON.parse(raw);
+    parsed = JSON.parse(raw);
   } catch (err) {
     throw new Error(`Failed to parse manifest at ${resolved}: ${err.message}`);
   }
+
+  // Validate the `conf` block (PLAN-CONF.md phase 1.2). Only runs for
+  // local manifests — registry-side manifests fetched via resolve.js /
+  // download.js go through fetch().json() and deliberately skip this so
+  // a consumer with an older wyvrnpm doesn't fail on a publisher's
+  // forward-compatible conf keys.
+  if (parsed && typeof parsed === 'object' && parsed.conf !== undefined) {
+    try {
+      readRecipeConf(parsed);
+    } catch (err) {
+      throw new Error(`Invalid \`conf\` block in ${resolved}: ${err.message}`);
+    }
+  }
+
+  return parsed;
 }
 
 /**

package/src/profile.js

@@ -162,6 +162,13 @@ function detectProfile() {
   };
 }
 
+// Profile fields that participate in profileHash — mirror Conan's
+// `[settings]` strictly. Anything else at the top level (e.g. `conf`)
+// is non-ABI and must never fold into the hash (PLAN-CONF.md constitution).
+const HASHED_PROFILE_FIELDS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
 /**
  * Compute a stable 16-char SHA256 prefix identifying a unique build.
  * Inputs:
@@ -169,14 +176,19 @@ function detectProfile() {
  *   - `options`: (optional) recipe-declared feature toggles resolved to
  *     their effective values for this build.
  *
- * Backward-compat contract: when `options` is null / undefined / empty,
- * the hash is byte-identical to what pre-F1 wyvrnpm produced. Packages
- * without an `options` block keep their existing registry addresses.
- * The caller therefore passes `null` (not `{}`) to mean "this recipe
- * has no options declared" — consistent with what
- * `resolveEffectiveOptions` returns in that case.
+ * Backward-compat contract:
+ *   - When `options` is null / undefined / empty, the hash is
+ *     byte-identical to what pre-F1 wyvrnpm produced. Packages
+ *     without an `options` block keep their existing registry
+ *     addresses. The caller passes `null` (not `{}`) to mean "this
+ *     recipe has no options declared" — consistent with what
+ *     `resolveEffectiveOptions` returns in that case.
+ *   - When a profile carries a `conf` block (phase 2 — PLAN-CONF.md),
+ *     the hash is byte-identical to the same profile WITHOUT `conf`.
+ *     Build-time knobs are non-ABI by design (constitution).
  *
- * See claude/PLAN-OPTIONS.md §3.2 for the full design.
+ * See claude/PLAN-OPTIONS.md §3.2 and claude/PLAN-CONF.md for the
+ * full design.
  *
  * @param {WyvrnProfile} profile
  * @param {Record<string, any>|null} [options]  effective options (after defaults + overrides)
@@ -185,7 +197,10 @@ function detectProfile() {
 function hashProfile(profile, options = null) {
   const significant = Object.fromEntries(
     Object.entries(profile)
-      .filter(([, v]) => v !== null && v !== undefined && v !== '*' && v !== '')
+      .filter(([k, v]) =>
+        HASHED_PROFILE_FIELDS.has(k) &&
+        v !== null && v !== undefined && v !== '*' && v !== '',
+      )
       .sort(([a], [b]) => a.localeCompare(b)),
   );
 
@@ -267,6 +282,8 @@ function isShaOnRemote(sha, cwd) {
 
 /**
  * Format a profile for human-readable display (Conan-style).
+ * Emits a `[conf]` block with flat dotted keys when the profile
+ * carries a non-empty `conf` block (PLAN-CONF.md phase 2).
  *
  * @param {WyvrnProfile} profile
  * @returns {string}
@@ -282,6 +299,23 @@ function formatProfile(profile) {
       lines.push(`${key}=${val}`);
     }
   }
+
+  // [conf] block, Conan-style. Rendered flat so it's clear these are
+  // dotted namespaced keys, not nested JSON. Alphabetical for stable diffs.
+  const confBlock = profile.conf;
+  if (confBlock && typeof confBlock === 'object' && !Array.isArray(confBlock)) {
+    // Lazy-require to avoid circular dep (src/conf/* → src/manifest → src/profile).
+    const { flattenConf } = require('./conf');
+    let flat;
+    try { flat = flattenConf(confBlock); } catch { flat = null; }
+    if (flat && Object.keys(flat).length > 0) {
+      lines.push('[conf]');
+      for (const key of Object.keys(flat).sort()) {
+        lines.push(`${key}=${flat[key]}`);
+      }
+    }
+  }
+
   return lines.join('\n');
 }
 
@@ -386,15 +420,116 @@ function listProfiles() {
 }
 
 /**
- * Load the active build profile by name. Falls back to auto-detection if the
- * named profile file does not exist yet.
+ * Resolve a profile-inheritance chain (F8). A profile may declare
+ *
+ *   { "extends": "base-profile", ... }
+ *   { "extends": ["base1", "base2"], ... }      // later wins over earlier
+ *
+ * `extends` is resolved recursively; the child's fields overlay the
+ * merged parent(s). Cycle detection throws a clear error. Missing
+ * parents throw — we don't silently drop `extends`, that would hide
+ * typos.
+ *
+ * Merge rules:
+ *  - `[settings]` fields: child overrides parent, per-key.
+ *  - `conf` block: parent + child flattened with child wins per-leaf
+ *    (same pattern as PLAN-CONF.md §4.2 within the single profile).
+ *  - `extends` itself is stripped from the resolved output — the
+ *    returned object carries no inheritance metadata, so existing
+ *    consumers (formatProfile, hashProfile, readProfileConf) work
+ *    unchanged.
+ *
+ * @param {string} name
+ * @param {string[]} [stack] visited names — for cycle detection
+ * @returns {WyvrnProfile|null} Fully-resolved profile, or null if `name`
+ *   does not exist on disk at the root of the chain.
+ */
+function resolveProfileChain(name, stack = []) {
+  if (stack.includes(name)) {
+    throw new Error(
+      `profile inheritance cycle: ${[...stack, name].join(' → ')}`,
+    );
+  }
+
+  const raw = readProfile(name);
+  if (!raw) return null;
+
+  const rawExtends = raw.extends;
+  if (rawExtends === undefined || rawExtends === null) {
+    // Flat profile — just strip any accidental `extends` and return.
+    const { extends: _, ...rest } = raw;
+    return rest;
+  }
+
+  const parents = Array.isArray(rawExtends) ? rawExtends : [rawExtends];
+  for (const p of parents) {
+    if (typeof p !== 'string' || p.length === 0) {
+      throw new Error(
+        `profile "${name}": extends entries must be non-empty strings, got ${JSON.stringify(p)}`,
+      );
+    }
+  }
+
+  // Merge parents left-to-right, then overlay the child.
+  let merged = {};
+  for (const parentName of parents) {
+    const parent = resolveProfileChain(parentName, [...stack, name]);
+    if (!parent) {
+      throw new Error(
+        `profile "${name}": extends parent "${parentName}" not found ` +
+        `at ${getProfilesDir()}`,
+      );
+    }
+    merged = mergeResolvedProfiles(merged, parent);
+  }
+
+  const { extends: _, ...child } = raw;
+  return mergeResolvedProfiles(merged, child);
+}
+
+/**
+ * Merge two already-resolved profile objects. Top-level `[settings]`
+ * fields: right wins. `conf` block: per-leaf merge, right wins.
+ * @param {object} base
+ * @param {object} overlay
+ * @returns {object}
+ */
+function mergeResolvedProfiles(base, overlay) {
+  const out = { ...base, ...overlay };
+  // Nullable override semantics: `null` on the overlay explicitly
+  // unsets a field from the base (matches how Conan profiles
+  // handle `compiler.runtime=None`).
+  for (const k of Object.keys(overlay)) {
+    if (overlay[k] === null) delete out[k];
+  }
+  // Conf block is merged per-leaf, not per-branch.
+  if (base.conf || overlay.conf) {
+    const { flattenConf, unflattenConf } = require('./conf');
+    let baseFlat    = {};
+    let overlayFlat = {};
+    try { if (base.conf)    baseFlat    = flattenConf(base.conf);    } catch { /* leave empty */ }
+    try { if (overlay.conf) overlayFlat = flattenConf(overlay.conf); } catch { /* leave empty */ }
+    const merged = { ...baseFlat, ...overlayFlat };
+    if (Object.keys(merged).length > 0) {
+      out.conf = unflattenConf(merged);
+    } else {
+      delete out.conf;
+    }
+  }
+  return out;
+}
+
+/**
+ * Load the active build profile by name, resolving any `extends` chain.
+ * Falls back to auto-detection if the named profile file does not
+ * exist yet.
  *
  * @param {string} [name='default']
  * @returns {{ profile: WyvrnProfile, fromFile: boolean }}
  */
 function loadProfile(name = 'default') {
-  const stored = readProfile(name);
-  if (stored) return { profile: stored, fromFile: true };
+  const resolved = resolveProfileChain(name);
+  if (resolved) return { profile: resolved, fromFile: true };
   return { profile: detectProfile(), fromFile: false };
 }
 
@@ -415,6 +550,7 @@ module.exports = {
   deleteProfile,
   listProfiles,
   loadProfile,
+  resolveProfileChain,
 };
 
 /**

package/src/providers/file.js

@@ -16,21 +16,6 @@ const log = require('../logger');
  *   //server/share/path                 (SMB UNC — forward slash)
  *   file:///path                        (file URI)
  */
-function pinDependencies(rawDeps, lockedDeps) {
-  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
-  const result = {};
-  for (const [pkgName, value] of Object.entries(rawDeps)) {
-    const locked = lockedDeps[pkgName];
-    if (locked) {
-      result[pkgName] = typeof value === 'object' && value !== null
-        ? { ...value, version: locked }
-        : locked;
-    } else {
-      result[pkgName] = value;
-    }
-  }
-  return result;
-}
 
 class FileProvider extends BaseProvider {
   static canHandle(source) {
@@ -106,7 +91,7 @@ class FileProvider extends BaseProvider {
   async v2Publish(files, options) {
     const {
       source, name, version, profileHash, buildSettings,
-      contentSha256, gitSha, gitRepo, lockedDependencies,
+      contentSha256, gitSha, gitRepo, publishedLock,
       updateLatest = true, uploadedBy,
     } = options;
 
@@ -118,12 +103,12 @@ class FileProvider extends BaseProvider {
     this._copy(files.zip, path.join(buildDir, 'wyvrn.zip'));
 
     // 2) enriched wyvrn.json (buildSettings stored for debugging only)
-    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    //    Dependencies are published verbatim from wyvrn.json — ranges stay as
+    //    ranges so consumers can intersect them with their own. The author's
+    //    lockfile snapshot is preserved in `publishedLock` for audit.
     const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
-    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
     const v2Meta = {
       ...rawManifest,
-      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
       schemaVersion: 2,
       profileHash,
       buildSettings,
@@ -131,6 +116,7 @@ class FileProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(publishedLock && Object.keys(publishedLock).length > 0 ? { publishedLock } : {}),
       ...(uploadedBy ? { uploadedBy } : {}),
     };
     this._writeJson(path.join(buildDir, 'wyvrn.json'), v2Meta);

package/src/providers/http.js

@@ -8,21 +8,11 @@ const { Readable } = require('stream');
 const BaseProvider = require('./base');
 const log = require('../logger');
 
-function pinDependencies(rawDeps, lockedDeps) {
-  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
-  const result = {};
-  for (const [pkgName, value] of Object.entries(rawDeps)) {
-    const locked = lockedDeps[pkgName];
-    if (locked) {
-      result[pkgName] = typeof value === 'object' && value !== null
-        ? { ...value, version: locked }
-        : locked;
-    } else {
-      result[pkgName] = value;
-    }
-  }
-  return result;
-}
+// CloudFront / AWS WAF (and some other fronts) 403 requests that lack a
+// User-Agent header, so we MUST send one on every outbound call. Failing to
+// do so means `_getJson` swallows the 403 as `null` and the compat path
+// silently treats the registry as empty.
+const USER_AGENT = `wyvrnpm/${require('../../package.json').version}`;
 
 class HttpProvider extends BaseProvider {
   static canHandle(source) {
@@ -44,7 +34,7 @@ class HttpProvider extends BaseProvider {
     return new Promise((resolve, reject) => {
       const body = fs.readFileSync(filePath);
       const parsed = new URL(url);
-      const headers = { 'Content-Type': contentType, 'Content-Length': body.length };
+      const headers = { 'User-Agent': USER_AGENT, 'Content-Type': contentType, 'Content-Length': body.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
       log.info(`  → PUT ${url}`);
       const req = this._lib(url).request(
@@ -65,7 +55,7 @@ class HttpProvider extends BaseProvider {
   _putBuffer(url, buffer, contentType, token) {
     return new Promise((resolve, reject) => {
       const parsed = new URL(url);
-      const headers = { 'Content-Type': contentType, 'Content-Length': buffer.length };
+      const headers = { 'User-Agent': USER_AGENT, 'Content-Type': contentType, 'Content-Length': buffer.length };
       if (token) headers['Authorization'] = `Bearer ${token}`;
       log.info(`  → PUT ${url}`);
       const req = this._lib(url).request(
@@ -86,7 +76,7 @@ class HttpProvider extends BaseProvider {
   _head(url, token) {
     return new Promise((resolve, reject) => {
       const parsed = new URL(url);
-      const headers = {};
+      const headers = { 'User-Agent': USER_AGENT };
       if (token) headers['Authorization'] = `Bearer ${token}`;
       const req = this._lib(url).request(
         { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'HEAD', headers },
@@ -104,13 +94,22 @@ class HttpProvider extends BaseProvider {
   _getJson(url, token) {
     return new Promise((resolve) => {
       const parsed = new URL(url);
-      const headers = { Accept: 'application/json' };
+      const headers = { 'User-Agent': USER_AGENT, Accept: 'application/json' };
       if (token) headers['Authorization'] = `Bearer ${token}`;
       const req = this._lib(url).request(
         { hostname: parsed.hostname, port: parsed.port || undefined, path: parsed.pathname, method: 'GET', headers },
         (res) => {
           if (res.statusCode === 404) { res.resume(); resolve(null); return; }
-          if (res.statusCode < 200 || res.statusCode >= 300) { res.resume(); resolve(null); return; }
+          if (res.statusCode < 200 || res.statusCode >= 300) {
+            // A 404 is "not found" — expected. Anything else (403 from a WAF,
+            // 5xx, etc.) is surprising and should NOT be swallowed silently,
+            // or the compat path will treat the registry as empty. See the
+            // CloudFront UA-block case that motivated the default User-Agent.
+            log.warn(`HTTP GET ${url} → ${res.statusCode}; treating as missing`);
+            res.resume();
+            resolve(null);
+            return;
+          }
           const chunks = [];
           res.on('data', (c) => chunks.push(c));
           res.on('end', () => {
@@ -129,7 +128,7 @@ class HttpProvider extends BaseProvider {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs ?? 300_000);
     try {
-      const headers = {};
+      const headers = { 'User-Agent': USER_AGENT };
       if (token) headers['Authorization'] = `Bearer ${token}`;
       const response = await fetch(url, { signal: controller.signal, headers });
       if (!response.ok) return false;
@@ -175,7 +174,7 @@ class HttpProvider extends BaseProvider {
   async v2Publish(files, options) {
     const {
       source, name, version, profileHash, buildSettings,
-      contentSha256, gitSha, gitRepo, lockedDependencies, token,
+      contentSha256, gitSha, gitRepo, publishedLock, token,
       updateLatest = true, uploadedBy,
     } = options;
     const base   = source.replace(/\/$/, '');
@@ -185,14 +184,14 @@ class HttpProvider extends BaseProvider {
     // 1) Upload the binary zip
     await this._put(`${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', token);
 
-    // 2) Upload enriched wyvrn.json (original manifest + v2 metadata)
+    // 2) Upload enriched wyvrn.json (original manifest + v2 metadata).
     //    buildSettings is stored for debugging purposes only — not for configuration.
-    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    //    Dependencies are published verbatim from wyvrn.json — ranges stay as
+    //    ranges so consumers can intersect them with their own. The author's
+    //    lockfile snapshot is preserved in `publishedLock` for audit.
     const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
-    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
     const v2Meta = {
       ...rawManifest,
-      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
       schemaVersion: 2,
       profileHash,
       buildSettings,     // copy of the profile used — for debugging
@@ -200,6 +199,7 @@ class HttpProvider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(publishedLock && Object.keys(publishedLock).length > 0 ? { publishedLock } : {}),
       ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(