wyvrnpm 2.4.1 → 2.9.0

package/src/providers/s3.js

@@ -9,21 +9,13 @@ const RE_S3_URI           = /^s3:\/\//;
 const RE_S3_VIRTUAL_HOSTED = /^https?:\/\/([^.]+)\.s3[.-][^/]*\.amazonaws\.com/;
 const RE_S3_PATH_STYLE    = /^https?:\/\/s3[.-][^/]*\.amazonaws\.com\/([^/]+)/;
 
-function pinDependencies(rawDeps, lockedDeps) {
-  if (!rawDeps || !lockedDeps || Object.keys(lockedDeps).length === 0) return rawDeps;
-  const result = {};
-  for (const [pkgName, value] of Object.entries(rawDeps)) {
-    const locked = lockedDeps[pkgName];
-    if (locked) {
-      result[pkgName] = typeof value === 'object' && value !== null
-        ? { ...value, version: locked }
-        : locked;
-    } else {
-      result[pkgName] = value;
-    }
-  }
-  return result;
-}
+// CloudFront TTL cap for mutable manifest JSON (versions.json, latest.json)
+// and the per-profile wyvrn.json / source.json. 5 min is short enough that
+// a publish is visible to `install` / `add` well within a coffee break, but
+// long enough that `install` at scale doesn't hammer the origin. Applied
+// on every JSON PUT — consumers of the ZIPs get default (long) TTLs since
+// a (name, version, profileHash) artefact is immutable by construction.
+const JSON_CACHE_CONTROL = 'public, max-age=300';
 
 class S3Provider extends BaseProvider {
   static canHandle(source) {
@@ -76,25 +68,36 @@ class S3Provider extends BaseProvider {
 
   _makeClient(awsProfile) {
     const { S3Client, fromSSO } = this._loadSdk();
-    return new S3Client(awsProfile ? { credentials: fromSSO({ profile: awsProfile }) } : {});
+    if (!awsProfile) return new S3Client({});
+
+    // fromSSO supplies credentials only. The SDK's region resolver is
+    // independent and consults AWS_REGION / AWS_DEFAULT_REGION / the profile
+    // named by AWS_PROFILE — NOT the profile handed to fromSSO. Propagate
+    // --aws-profile so its `region = …` line in ~/.aws/config is the fallback.
+    process.env.AWS_PROFILE = awsProfile;
+    return new S3Client({ credentials: fromSSO({ profile: awsProfile }) });
   }
 
   async _putFile(client, bucket, key, filePath, contentType, PutObjectCommand) {
     log.info(`  → s3://${bucket}/${key}`);
-    await client.send(new PutObjectCommand({
+    const params = {
       Bucket: bucket, Key: key,
       Body: fs.readFileSync(filePath),
       ContentType: contentType,
-    }));
+    };
+    if (contentType === 'application/json') params.CacheControl = JSON_CACHE_CONTROL;
+    await client.send(new PutObjectCommand(params));
   }
 
   async _putBuffer(client, bucket, key, content, contentType, PutObjectCommand) {
     log.info(`  → s3://${bucket}/${key}`);
-    await client.send(new PutObjectCommand({
+    const params = {
       Bucket: bucket, Key: key,
       Body: content,
       ContentType: contentType,
-    }));
+    };
+    if (contentType === 'application/json') params.CacheControl = JSON_CACHE_CONTROL;
+    await client.send(new PutObjectCommand(params));
   }
 
   async _getJson(client, bucket, key, GetObjectCommand) {
@@ -177,7 +180,7 @@ class S3Provider extends BaseProvider {
   async v2Publish(files, options) {
     const {
       source, name, version, profileHash, buildSettings,
-      contentSha256, gitSha, gitRepo, lockedDependencies, awsProfile,
+      contentSha256, gitSha, gitRepo, publishedLock, awsProfile,
       updateLatest = true, uploadedBy,
     } = options;
     const { PutObjectCommand, GetObjectCommand } = this._loadSdk();
@@ -190,14 +193,14 @@ class S3Provider extends BaseProvider {
     // 1) Upload zip
     await this._putFile(client, bucket, `${buildRoot}/wyvrn.zip`, files.zip, 'application/zip', PutObjectCommand);
 
-    // 2) Upload enriched wyvrn.json
+    // 2) Upload enriched wyvrn.json.
     //    buildSettings is stored for debugging purposes only.
-    //    Dependencies are replaced with locked versions so the server never sees "latest".
+    //    Dependencies are published verbatim from wyvrn.json — ranges stay as
+    //    ranges so consumers can intersect them with their own. The author's
+    //    lockfile snapshot is preserved in `publishedLock` for audit.
     const rawManifest = JSON.parse(fs.readFileSync(files.manifest, 'utf8'));
-    const pinnedDeps = pinDependencies(rawManifest.dependencies, lockedDependencies);
     const v2Meta = {
       ...rawManifest,
-      ...(pinnedDeps !== undefined ? { dependencies: pinnedDeps } : {}),
       schemaVersion: 2,
       profileHash,
       buildSettings,
@@ -205,6 +208,7 @@ class S3Provider extends BaseProvider {
       gitSha:      gitSha  ?? null,
       gitRepo:     gitRepo ?? null,
       publishedAt: new Date().toISOString(),
+      ...(publishedLock && Object.keys(publishedLock).length > 0 ? { publishedLock } : {}),
       ...(uploadedBy ? { uploadedBy } : {}),
     };
     await this._putBuffer(

package/src/resolve.js

@@ -141,15 +141,27 @@ async function resolveLatestVersion(name, packageSources, platform, httpClient)
 /**
  * Fetches razer.json for a single package from the first source that responds.
  *
+ * When `preferredProfileHash` is provided (EVALUATION.md F13 — closes the
+ * "picks arbitrary profileHash" latent bug), the v2 lookup tries that hash
+ * first and only falls back to the first-available profile if the preferred
+ * hash isn't on the registry. Dependency declarations are invariant across
+ * profiles today, so picking any hash gives the same answer — but the
+ * consumer's own hash is stable across re-resolves and future-proofs
+ * against any schema that starts varying wyvrn.json per profile.
+ *
  * @param {string} name
  * @param {string} version
  * @param {string[]} packageSources
  * @param {string} platform
  * @param {Function} httpClient
  * @param {Map<string, object>} cache - In-flight / completed fetch cache.
+ * @param {string|null} [preferredProfileHash] - try this hash first.
  * @returns {Promise<object|null>} Parsed razer.json or null if not found anywhere.
  */
-async function fetchPackageManifest(name, version, packageSources, platform, httpClient, cache) {
+async function fetchPackageManifest(
+  name, version, packageSources, platform, httpClient, cache,
+  preferredProfileHash = null,
+) {
   const cacheKey = `${name}@${version}`;
   if (cache.has(cacheKey)) {
     return cache.get(cacheKey);
@@ -158,14 +170,19 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
   for (const source of packageSources) {
     const base = source.replace(/\/$/, '');
 
-    // v2: look up any available profile hash from versions.json, then fetch that manifest
+    // v2: prefer the consumer's own profileHash; fall back to the first
+    // available if that hash isn't published.
     try {
       const idxResp = await httpClient(`${base}/v2/${name}/versions.json`);
       if (idxResp.ok) {
         const idx = await idxResp.json();
         const profiles = idx?.versions?.[version]?.profiles;
         if (profiles) {
-          const profileHash = Object.keys(profiles)[0];
+          const available = Object.keys(profiles);
+          const profileHash =
+            (preferredProfileHash && available.includes(preferredProfileHash))
+              ? preferredProfileHash
+              : available[0];
           if (profileHash) {
             const mResp = await httpClient(`${base}/v2/${name}/${version}/${profileHash}/wyvrn.json`);
             if (mResp.ok) {
@@ -215,15 +232,37 @@ async function fetchPackageManifest(name, version, packageSources, platform, htt
  * PLAN-OPTIONS) use this to avoid a second round of HTTP round-trips.
  * Passing `null` / omitting it keeps the legacy behaviour.
  *
+ * Per-package source pinning (EVALUATION.md S4): when `pinnedSources` is
+ * provided, any entry `name → url` restricts that package's manifest +
+ * latest + versions lookups to just that URL — typo-squatting and mirror
+ * shadowing are closed for pinned deps. Pins propagate to direct deps
+ * only; transitive deps continue to fan out across all sources (a pinned
+ * dep's own recipe is authoritative for its own transitives).
+ *
  * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
  * @param {string[]} packageSources - Ordered list of base URLs to try.
  * @param {string} platform - Target platform string (e.g. "win_x64").
  * @param {Function} httpClient - fetch-compatible function.
  * @param {Map<string, string>} [lockedVersions]
  * @param {Map<string, object>} [manifestsOut] - populated in-place when provided
+ * @param {string|null} [preferredProfileHash] - consumer's own profileHash;
+ *   threaded to fetchPackageManifest so v2 manifest lookups prefer the
+ *   consumer's own build entry over an arbitrary one (EVALUATION.md F13).
+ * @param {Map<string,string>|null} [pinnedSources] - per-package source URL pin (S4).
  * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
  */
-async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map(), manifestsOut = null) {
+async function resolveDependencies(
+  rootDeps, packageSources, platform, httpClient,
+  lockedVersions = new Map(), manifestsOut = null,
+  preferredProfileHash = null,
+  pinnedSources = null,
+) {
+  // For pinned deps, restrict the source list to the single pinned URL.
+  // `null` / no pin → fall back to the full caller-supplied list.
+  const sourcesFor = (name) => {
+    const pin = pinnedSources?.get?.(name);
+    return pin ? [pin] : packageSources;
+  };
   /** @type {Map<string, string>} Final resolved versions. */
   const resolved = new Map();
 
@@ -254,7 +293,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
   const publishedCache = new Map();
   const fetchPublished = async (name) => {
     if (publishedCache.has(name)) return publishedCache.get(name);
-    const list = await fetchPublishedVersions(name, packageSources, httpClient);
+    const list = await fetchPublishedVersions(name, sourcesFor(name), httpClient);
     publishedCache.set(name, list);
     return list;
   };
@@ -280,7 +319,7 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
     // Skip this for linked packages which have "linked:" prefix.
     if (version === 'latest') {
       try {
-        version = await resolveLatestVersion(name, packageSources, platform, httpClient);
+        version = await resolveLatestVersion(name, sourcesFor(name), platform, httpClient);
         log.info(`Resolved "${name}@latest" → ${version}`);
       } catch (err) {
         log.warn(err.message);
@@ -405,10 +444,11 @@ async function resolveDependencies(rootDeps, packageSources, platform, httpClien
       manifest = await fetchPackageManifest(
         name,
         version,
-        packageSources,
+        sourcesFor(name),
         platform,
         httpClient,
         manifestCache,
+        preferredProfileHash,
       );
     }
 

package/src/settings-overrides.js

@@ -0,0 +1,152 @@
+'use strict';
+
+// Pattern-based settings overrides (EVALUATION.md F11).
+//
+// `wyvrn.json` may declare a top-level `settingsOverrides` block whose
+// keys are glob patterns over dependency names. Every matching pattern
+// contributes to the resolved dep's `settings` merge; the per-dep
+// literal settings (inside `dependencies`) still win over patterns.
+//
+// Conan users know this feature as profile-side `boost*:compiler.cppstd=17`.
+// Ours lives in the manifest because that's where literal settings
+// overrides already live — one fewer concept for recipe authors.
+//
+// Pure, no I/O. Exported helpers:
+//   - normalizeSettingsOverrides: validate + sort by specificity
+//   - resolveOverrideSettings: compute the merged settings for a dep name
+
+/**
+ * Valid profile field keys that settings overrides may target.
+ * Mirrors `HASHED_PROFILE_FIELDS` in src/profile.js, but as the allow-
+ * list for OVERRIDE values (os/arch/compiler/etc.). If a pattern
+ * override tries to set something else, reject at parse time rather
+ * than silently letting it through into mergeProfile.
+ */
+const ALLOWED_SETTINGS_KEYS = new Set([
+  'os', 'arch', 'compiler', 'compiler.version', 'compiler.cppstd', 'compiler.runtime',
+]);
+
+/**
+ * Convert a glob pattern to a RegExp. Supports `*` (any chars),
+ * `?` (single char), literal everything else. No brace expansion,
+ * no negation — keep the mental model small.
+ *
+ * @param {string} glob
+ * @returns {RegExp}
+ */
+function globToRegExp(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+  const pattern = escaped.replace(/\*/g, '.*').replace(/\?/g, '.');
+  return new RegExp(`^${pattern}$`);
+}
+
+/**
+ * Specificity heuristic: fewer wildcards = more specific. Ties broken
+ * by longer literal prefix, then lexical order for determinism. More
+ * specific patterns get applied LAST so they override less-specific
+ * ones in the merge.
+ *
+ * @param {string} glob
+ * @returns {[number, number, string]} sort key — lower = less specific
+ */
+function specificityKey(glob) {
+  const wildcards = (glob.match(/[*?]/g) ?? []).length;
+  const literalPrefix = glob.match(/^[^*?]*/)?.[0].length ?? 0;
+  // Invert sort order: more wildcards → lower score; more prefix → higher score.
+  return [-wildcards, literalPrefix, glob];
+}
+
+/**
+ * Validate + sort a raw `settingsOverrides` block. Returns an array of
+ * `{ pattern, regex, settings }` in application order (least-specific
+ * first). A string pattern alone (literal `"openssl"`) works too — it
+ * matches only that exact name.
+ *
+ * Throws on:
+ *  - non-object block
+ *  - non-string keys (JSON can't produce these but defensive)
+ *  - non-object values
+ *  - empty pattern strings
+ *  - unknown settings keys in a value
+ *  - non-string value leaves (settings values must be strings like
+ *    the profile itself: "dynamic", "17", "gcc")
+ *
+ * @param {unknown} block
+ * @returns {Array<{ pattern: string, regex: RegExp, settings: Record<string, string> }>}
+ */
+function normalizeSettingsOverrides(block) {
+  if (block === undefined || block === null) return [];
+  if (typeof block !== 'object' || Array.isArray(block)) {
+    throw new Error('settingsOverrides must be an object mapping globs to settings');
+  }
+
+  const entries = [];
+  for (const [rawPattern, rawValue] of Object.entries(block)) {
+    if (typeof rawPattern !== 'string' || rawPattern.length === 0) {
+      throw new Error(`settingsOverrides: pattern must be a non-empty string, got ${JSON.stringify(rawPattern)}`);
+    }
+    if (!rawValue || typeof rawValue !== 'object' || Array.isArray(rawValue)) {
+      throw new Error(`settingsOverrides["${rawPattern}"]: value must be an object of settings`);
+    }
+
+    const settings = {};
+    for (const [k, v] of Object.entries(rawValue)) {
+      if (!ALLOWED_SETTINGS_KEYS.has(k)) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"]: unknown key "${k}" — ` +
+          `allowed: ${[...ALLOWED_SETTINGS_KEYS].join(', ')}`,
+        );
+      }
+      if (typeof v !== 'string' || v.length === 0) {
+        throw new Error(
+          `settingsOverrides["${rawPattern}"].${k}: value must be a non-empty string, ` +
+          `got ${JSON.stringify(v)}`,
+        );
+      }
+      settings[k] = v;
+    }
+
+    entries.push({ pattern: rawPattern, regex: globToRegExp(rawPattern), settings });
+  }
+
+  // Sort by specificity ascending so more-specific patterns apply LAST
+  // (their settings therefore win on per-key merge).
+  entries.sort((a, b) => {
+    const ka = specificityKey(a.pattern);
+    const kb = specificityKey(b.pattern);
+    for (let i = 0; i < ka.length; i++) {
+      if (ka[i] < kb[i]) return -1;
+      if (ka[i] > kb[i]) return  1;
+    }
+    return 0;
+  });
+
+  return entries;
+}
+
+/**
+ * Merge all matching pattern overrides for `depName` into a flat
+ * settings object. Less-specific patterns apply first; more-specific
+ * patterns overlay on top. Does NOT include the literal per-dep
+ * `settings` (caller layers that on after — literal always wins).
+ *
+ * @param {string} depName
+ * @param {ReturnType<typeof normalizeSettingsOverrides>} normalized
+ * @returns {Record<string, string>}
+ */
+function resolveOverrideSettings(depName, normalized) {
+  const out = {};
+  for (const entry of normalized) {
+    if (entry.regex.test(depName)) {
+      Object.assign(out, entry.settings);
+    }
+  }
+  return out;
+}
+
+module.exports = {
+  ALLOWED_SETTINGS_KEYS,
+  globToRegExp,
+  normalizeSettingsOverrides,
+  resolveOverrideSettings,
+};

package/src/toolchain/presets.js

@@ -72,6 +72,20 @@ function isWyvrnGenerated(presets) {
  *                                             so `cmake --preset` produces
  *                                             binaries matching the profile
  *                                             (VS otherwise defaults to x64).
+ * @param {string[]|null} [args.configs]       Build recipe's `configs` list
+ *                                             (e.g. ['Debug','Release','MinSizeRel']).
+ *                                             When provided, drives
+ *                                             `CMAKE_CONFIGURATION_TYPES` so
+ *                                             multi-config generators (Ninja
+ *                                             Multi-Config, VS) actually
+ *                                             produce every config the recipe
+ *                                             declares. Null/empty → omitted
+ *                                             (let CMake use its generator
+ *                                             default). `extraCacheVariables`
+ *                                             wins on explicit collision so
+ *                                             authors that already bake the
+ *                                             list into `build.configure`
+ *                                             aren't overridden.
  */
 function buildConfigurePreset({
   profileName,
@@ -81,16 +95,20 @@ function buildConfigurePreset({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   const binaryDir = `\${sourceDir}/build/wyvrn-${profileName}`;
-  // Spread `extraCacheVariables` FIRST, then the wyvrn-owned entries. This
-  // means the recipe cannot redirect `CMAKE_TOOLCHAIN_FILE` — our dep
-  // injection is always the authoritative toolchain pointer. A malicious
-  // or sloppy recipe trying to override it is silently ignored, not
-  // quietly obeyed. Same protection applies to `CMAKE_INSTALL_PREFIX`:
-  // if a recipe declares `build.installDir`, we resolve it under the
-  // binary dir; any cacheVariables override is overwritten below.
+  // CMAKE_CONFIGURATION_TYPES is a defensible default from the recipe's
+  // declared `configs` list. Applied FIRST (lowest precedence) so an
+  // explicit `-DCMAKE_CONFIGURATION_TYPES=...` in `build.configure`
+  // still wins — authors who already pin the list shouldn't silently
+  // lose their override. The wyvrn-owned entries (toolchain, install
+  // prefix) still win over both below.
+  const configsDefault = (Array.isArray(configs) && configs.length > 0)
+    ? { CMAKE_CONFIGURATION_TYPES: configs.join(';') }
+    : {};
   const cacheVariables = {
+    ...configsDefault,
     ...(extraCacheVariables ?? {}),
     CMAKE_TOOLCHAIN_FILE: `\${sourceDir}/${toolchainRelPath}`,
   };
@@ -128,27 +146,32 @@ function buildConfigurePreset({
 }
 
 /**
- * Two build presets per configure preset: Debug and Release.
+ * One build preset per configuration the recipe declares (or the
+ * legacy default pair `Debug` + `Release` when no list is provided).
+ *
+ * The preset name suffix is the configuration name lower-cased — matches
+ * the previous Debug/Release naming for those two, and extends to
+ * `wyvrn-<profile>-relwithdebinfo` / `-minsizerel` for the multi-config
+ * cases. Authors whose recipes include `MinSizeRel` in `build.configs`
+ * can now `cmake --build --preset wyvrn-<profile>-minsizerel` directly.
  *
  * @param {string} profileName
+ * @param {string[]|null} [configs]  Recipe's declared configurations. When
+ *   null/empty, emits the pre-2.8.1 `Debug` + `Release` pair so existing
+ *   CMakePresets.json files remain byte-identical.
  * @returns {Array<object>}
  */
-function buildBuildPresets(profileName) {
-  const config = `wyvrn-${profileName}`;
-  return [
-    {
-      name:            `${config}-debug`,
-      displayName:     `wyvrn ${profileName} (Debug)`,
-      configurePreset: config,
-      configuration:   'Debug',
-    },
-    {
-      name:            `${config}-release`,
-      displayName:     `wyvrn ${profileName} (Release)`,
-      configurePreset: config,
-      configuration:   'Release',
-    },
-  ];
+function buildBuildPresets(profileName, configs = null) {
+  const base = `wyvrn-${profileName}`;
+  const list = (Array.isArray(configs) && configs.length > 0)
+    ? configs
+    : ['Debug', 'Release'];
+  return list.map((cfg) => ({
+    name:            `${base}-${cfg.toLowerCase()}`,
+    displayName:     `wyvrn ${profileName} (${cfg})`,
+    configurePreset: base,
+    configuration:   cfg,
+  }));
 }
 
 /**
@@ -162,6 +185,7 @@ function buildFreshPresetsFile({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   return {
     version: SCHEMA_VERSION,
@@ -173,9 +197,9 @@ function buildFreshPresetsFile({
       },
     },
     configurePresets: [buildConfigurePreset({
-      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch,
+      profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
     })],
-    buildPresets: buildBuildPresets(profileName),
+    buildPresets: buildBuildPresets(profileName, configs),
   };
 }
 
@@ -197,18 +221,33 @@ function mergeIntoExisting(existing, {
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
   const newConfigure = buildConfigurePreset({
-    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch,
+    profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs,
   });
-  const newBuilds    = buildBuildPresets(profileName);
+  const newBuilds    = buildBuildPresets(profileName, configs);
   const newConfigureNames = new Set([newConfigure.name]);
-  const newBuildNames     = new Set(newBuilds.map((b) => b.name));
+  // When replacing THIS profile's build presets, drop every pre-existing
+  // one that targets the same configurePreset — the fresh `newBuilds`
+  // list fully replaces them. Scoping to configurePreset avoids stepping
+  // on presets for OTHER profiles in the same file, which is the whole
+  // point of the merge path.
+  //
+  // Without this, editing `build.configs` from 4 configs down to 2 would
+  // leave orphan build presets pointing at configurations CMake won't
+  // generate.
+  const myBase = `wyvrn-${profileName}`;
+  const isMyBuildPreset = (p) => p && p.configurePreset === myBase;
 
   const configurePresets = (existing.configurePresets ?? []).filter((p) => !newConfigureNames.has(p.name));
   configurePresets.push(newConfigure);
 
-  const buildPresets = (existing.buildPresets ?? []).filter((p) => !newBuildNames.has(p.name));
+  // Drop every pre-existing build preset that targets THIS profile's
+  // configurePreset — the fresh `newBuilds` list (one per current
+  // `configs` entry) fully replaces them. Presets for OTHER profiles
+  // stay untouched so the multi-profile merge story is preserved.
+  const buildPresets = (existing.buildPresets ?? []).filter((p) => !isMyBuildPreset(p));
   buildPresets.push(...newBuilds);
 
   return {
@@ -260,8 +299,9 @@ function generateCMakePresets({
   extraCacheVariables = null,
   installDir = null,
   profileArch = null,
+  configs = null,
 }) {
-  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch };
+  const args = { profileName, profileHash, toolchainRelPath, generator, extraCacheVariables, installDir, profileArch, configs };
   const candidates = [
     { filePath: path.join(projectRoot, 'CMakePresets.json'),     isUser: false },
     { filePath: path.join(projectRoot, 'CMakeUserPresets.json'), isUser: true  },

package/src/upload-built.js

@@ -7,6 +7,7 @@ const path = require('path');
 const { getProvider }        = require('./providers');
 const { defaultCompatBlock } = require('./compat');
 const { getBuildPaths }      = require('./build/cache');
+const { resolveSourceAuth }  = require('./auth');
 const log                    = require('./logger');
 
 const WYVRNPM_VERSION = require('../package.json').version;
@@ -193,6 +194,7 @@ function resolveUploadDestination(argv, config) {
   let src = argv.uploadSource;
   let awsProfile = argv.awsProfile;
   let token      = argv.token;
+  let sourceEntry = null;
 
   const publishSources = config.publishSources ?? [];
 
@@ -202,17 +204,24 @@ function resolveUploadDestination(argv, config) {
     if (named) {
       src        = named.url;
       awsProfile = awsProfile ?? named.profile;
-      token      = token      ?? named.token;
+      sourceEntry = named;
       log.info(`upload-built: using publish source "${named.name}" from config`);
     }
   } else if (publishSources.length > 0) {
     const first = publishSources[0];
     src        = first.url;
     awsProfile = awsProfile ?? first.profile;
-    token      = token      ?? first.token;
+    sourceEntry = first;
     log.info(`upload-built: using first configured publish source "${first.name}"`);
   }
 
+  // Fall back to the matched source entry's own token / tokenEnv only if
+  // the caller didn't pass one already (argv.token wins). resolveSourceAuth
+  // handles the literal-vs-env-backed precedence per side.
+  if (token === undefined || token === null) {
+    token = resolveSourceAuth({}, sourceEntry).token;
+  }
+
   if (!src) return null;
   return { uploadSource: src, uploadAuth: { awsProfile, token } };
 }

package/src/zip-safe.js

@@ -0,0 +1,52 @@
+'use strict';
+
+/**
+ * Defense-in-depth against Zip Slip (CVE-2018-1002200 family). Both
+ * node-stream-zip and adm-zip claim to handle this upstream, but we
+ * don't want to take the library's word for it on a supply-chain-
+ * critical code path. Pre-scan zip entry names before extraction and
+ * reject anything that could write outside the target directory.
+ *
+ * The ZIP spec uses forward slashes only, but Windows-produced archives
+ * sometimes leak backslashes — normalise both.
+ *
+ * @param {string} entryName   zip-internal path as reported by the zip library
+ * @param {string} [context]   optional archive identifier for the error message
+ * @throws {Error} if the entry name is absolute, contains a path-traversal
+ *                 segment, or starts with a Windows drive-letter prefix.
+ */
+function assertSafeZipEntryName(entryName, context) {
+  const where = context ? ` in ${context}` : '';
+
+  if (/^[A-Za-z]:[\\/]/.test(entryName)) {
+    throw new Error(`unsafe zip entry${where}: drive-letter absolute path ${JSON.stringify(entryName)}`);
+  }
+  if (entryName.startsWith('/') || entryName.startsWith('\\')) {
+    throw new Error(`unsafe zip entry${where}: absolute path ${JSON.stringify(entryName)}`);
+  }
+
+  const segments = entryName.split(/[\\/]+/);
+  for (const seg of segments) {
+    if (seg === '..') {
+      throw new Error(`unsafe zip entry${where}: path-traversal segment in ${JSON.stringify(entryName)}`);
+    }
+  }
+}
+
+/**
+ * Convenience: validate every name in an iterable. Throws on the first
+ * offender (fail-fast) rather than collecting all violations.
+ *
+ * @param {Iterable<string>} names
+ * @param {string} [context]
+ */
+function assertAllSafeZipEntryNames(names, context) {
+  for (const name of names) {
+    assertSafeZipEntryName(name, context);
+  }
+}
+
+module.exports = {
+  assertSafeZipEntryName,
+  assertAllSafeZipEntryNames,
+};