wyvrnpm 2.8.1 → 2.9.0

package/README.md

@@ -4,7 +4,7 @@ A simple, private C++ package manager that works with any static file hosting pr
 
 There is no central registry. You control where packages are hosted.
 
-> **README version: 2.8.1** — Highlights since 2.4.0: non-ABI build-time `conf` block (CMake cache variables via recipe / team profile / `wyvrn.local.json` / CLI `--conf`), per-package `source` pin for multi-source defense, profile inheritance via `extends`, pattern-based `settingsOverrides` (`boost*: {...}`), `wyvrnpm cache list` / `cache prune` for selective source-build-cache cleanup, `install --dry-run` (JSON plan without side effects), `install --build=always` to force source-rebuild, `--token-env` for CI credentials, and a raft of security hardening (Zip Slip, MSVC arch allow-list). Full list in `claude/EVALUATION.md`.
+> **README version: 2.8.3** — Highlights since 2.4.0: non-ABI build-time `conf` block (CMake cache variables via recipe / team profile / `wyvrn.local.json` / CLI `--conf`), per-package `source` pin for multi-source defense, profile inheritance via `extends`, pattern-based `settingsOverrides` (`boost*: {...}`), `wyvrnpm cache list` / `cache prune` for selective source-build-cache cleanup, `install --dry-run` (JSON plan without side effects), `install --build=always` to force source-rebuild, `--token-env` for CI credentials, CloudFront/WAF-compatible HTTP provider (sends `User-Agent`, surfaces non-404 errors), publish preserves dependency ranges verbatim with lock snapshot moved to informational `publishedLock`, and a raft of security hardening (Zip Slip, MSVC arch allow-list). Full list in `claude/EVALUATION.md`.
 
 ---
 
@@ -285,6 +285,13 @@ wyvrnpm build
 # Build Debug, verbose compiler output
 wyvrnpm build --config Debug --verbose
 
+# Build multiple configs in one go — configure runs once, build loops per config
+wyvrnpm build --config Debug,Release --install
+
+# Build every config the recipe declares (recipe's build.configs, or all four
+# canonical configs if no recipe is present). Pairs naturally with --install.
+wyvrnpm build --all-configs --install
+
 # Use a specific profile's preset
 wyvrnpm build --profile release
 
@@ -318,7 +325,8 @@ wyvrnpm build -- -j 8
 |---|---|---|
 | `--preset` / `-P` | `wyvrn-<profile>` | CMake configure preset name. |
 | `--profile` / `-p` | *(config / "default")* | Build profile — determines the default preset name. |
-| `--config` / `-c` | `Release` | Build configuration (`Debug` \| `Release` \| `RelWithDebInfo` \| `MinSizeRel`). |
+| `--config` / `-c` | `Release` | Build configuration (`Debug` \| `Release` \| `RelWithDebInfo` \| `MinSizeRel`). Comma-separated to build multiple in one invocation (e.g. `Debug,Release`) — configure runs once, build (+ `--install`) loops per config. |
+| `--all-configs` | `false` | Build every config from the recipe's `build.configs` (or all four canonical configs when no recipe is present). Takes precedence over `--config`. |
 | `--target` / `-t` | *(all)* | Specific CMake target to build. |
 | `--verbose` / `-v` | `false` | Pass `--verbose` to `cmake --build`. |
 | `--clean` | `false` | Remove the build directory before configuring. |
@@ -546,8 +554,6 @@ You only need this if you want Claude Code to pick up the skill. The CLI itself
 | `--force` | `false` | Overwrite an existing skill install. Without it, the command refuses to clobber. |
 | `--dry-run` | `false` | Print the destination paths and intended actions without writing. |
 
-**CLAUDE.md §9 note for contributors:** the tested path for deploying a locally-edited skill is `node scripts/repack-skill.js && node bin/wyvrn.js install-skill --claude --force` — never `rm -rf` + `cp -r`.
-
 ---
 
 ### `wyvrnpm link`
@@ -1736,6 +1742,15 @@ wyvrnpm build --install --install-prefix C:\out\stage
 
 # Install a specific config
 wyvrnpm build --install --config Debug
+
+# Install multiple configs in one invocation — configure runs once,
+# build + install loops per config. Before 2.9.0 this required two
+# separate `wyvrnpm build --install ...` invocations.
+wyvrnpm build --install --config Debug,Release
+
+# Install every config declared in the recipe's build.configs
+# (or all four canonical configs when no recipe is present).
+wyvrnpm build --install --all-configs
 ```
 
 ### What it does, in order

package/bin/wyvrn.js

@@ -191,9 +191,21 @@ yargs
         .option('config', {
           alias: 'c',
           type: 'string',
-          choices: ['Debug', 'Release', 'RelWithDebInfo', 'MinSizeRel'],
           default: 'Release',
-          description: 'Build configuration',
+          description:
+            'Build configuration. Accepts a single value (Release) or a ' +
+            'comma-separated list (Debug,Release) to build multiple configs ' +
+            'in one invocation — configure runs once, build (+ --install) ' +
+            'loops per config. Valid: Debug | Release | RelWithDebInfo | MinSizeRel.',
+        })
+        .option('all-configs', {
+          type: 'boolean',
+          default: false,
+          description:
+            'Build every config declared in the recipe\'s build.configs ' +
+            '(falls back to all four canonical configs when no recipe is ' +
+            'present). Equivalent to spelling out --config Debug,Release,... ' +
+            'by hand. Pairs naturally with --install.',
         })
         .option('target', {
           alias: 't',
@@ -262,6 +274,7 @@ yargs
       ...argv,
       autoInstall:   argv['auto-install'],
       installPrefix: argv['install-prefix'],
+      allConfigs:    argv['all-configs'],
     }),
   )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wyvrnpm",
-  "version": "2.8.1",
+  "version": "2.9.0",
   "description": "A simple, static-hosting-compatible C++ package manager",
   "keywords": [
     "c++",

package/src/build/index.js

@@ -15,6 +15,7 @@ const { hashProfile, mergeProfile, sha256Of } = require('../profile');
 const { generateToolchain }     = require('../toolchain');
 const { normalizeOptionsDeclaration, resolveEffectiveOptions } = require('../options');
 const { readRecipeConf, cmakeCacheVariables } = require('../conf');
+const { wyvrnFetch }            = require('../http-fetch');
 const log                       = require('../logger');
 
 /**
@@ -195,7 +196,7 @@ async function buildFromSource(args) {
   log.info(`  resolving ${Object.keys(depsForResolution).length} transitive dep(s)`);
   const transitiveManifests = new Map();
   const resolvedDeps = await resolveDependencies(
-    depsForResolution, packageSources, platform, fetch, new Map(),
+    depsForResolution, packageSources, platform, wyvrnFetch, new Map(),
     transitiveManifests,
   );
 
@@ -231,7 +232,7 @@ async function buildFromSource(args) {
   if (enrichedDeps.size > 0) {
     await downloadDependencies(
       enrichedDeps, packageSources, platform, paths.internal,
-      fetch, Math.max(30, Math.round(timeoutMs / 1000)),
+      wyvrnFetch, Math.max(30, Math.round(timeoutMs / 1000)),
       { ...authOptions, buildMode },
     );
   } else {

package/src/commands/add.js

@@ -5,6 +5,7 @@ const path = require('path');
 const { readManifest, writeManifest } = require('../manifest');
 const { resolveLatestVersion }        = require('../resolve');
 const { readConfig }                  = require('../config');
+const { wyvrnFetch }                  = require('../http-fetch');
 const log                             = require('../logger');
 
 /**
@@ -99,7 +100,7 @@ async function add(argv) {
       versionToWrite = spec.version;
       log.info(`${spec.name}: writing "${versionToWrite}" (as given)`);
     } else {
-      const latest = await resolveLatestVersion(spec.name, packageSources, argv.platform, fetch);
+      const latest = await resolveLatestVersion(spec.name, packageSources, argv.platform, wyvrnFetch);
       versionToWrite = `^${latest}`;
       log.info(`${spec.name}: latest is ${latest} → writing "${versionToWrite}"`);
     }

package/src/commands/build.js

@@ -4,14 +4,11 @@ const fs   = require('fs');
 const path = require('path');
 const { spawn } = require('child_process');
 
-const { readConfig }   = require('../config');
-const { loadProfile }  = require('../profile');
-const { readManifest } = require('../manifest');
-const { normalizeRecipe, hasBuildRecipe } = require('../build/recipe');
+const { normalizeRecipe, hasBuildRecipe, VALID_CMAKE_CONFIGS, DEFAULT_RECIPE } = require('../build/recipe');
 const { loadMsvcEnv }  = require('../build/msvc-env');
 const { archToVsPlatform, isVisualStudioGenerator } = require('../toolchain');
-const { parseCliConf } = require('../conf');
 const { LOCAL_OVERLAY_FILENAME } = require('../conf');
+const { buildContext } = require('../context');
 const install          = require('./install');
 const log              = require('../logger');
 
@@ -141,6 +138,51 @@ function buildConfigureArgs({
   return args;
 }
 
+/**
+ * Resolve the list of CMake configs to build (and optionally install).
+ *
+ * Precedence:
+ *   1. `--all-configs` → recipe.configs (falls back to all four canonical
+ *      configs when no recipe declares any).
+ *   2. `--config` → comma-separated list, validated against
+ *      VALID_CMAKE_CONFIGS. Order preserved. Duplicates removed.
+ *   3. default → `['Release']`.
+ *
+ * Configure runs once per `wyvrnpm build` invocation regardless — multi-
+ * config generators (VS, Xcode, Ninja Multi-Config) produce all configs
+ * from one configure step. Single-config generators (plain Ninja, Make)
+ * bake CMAKE_BUILD_TYPE into the cache, so `cmake --build --config X`
+ * effectively ignores X for them; building two configs against a single-
+ * config generator rebuilds the same binary twice. That's wasteful but
+ * correct; fixing it properly requires per-config build dirs, which is
+ * out of scope for this helper.
+ *
+ * @param {{ argv: object, recipeConfigs?: string[] }} args
+ * @returns {string[]}
+ */
+function resolveConfigList({ argv, recipeConfigs = null }) {
+  if (argv.allConfigs) {
+    const fromRecipe = (recipeConfigs ?? []).filter((c) => VALID_CMAKE_CONFIGS.has(c));
+    return fromRecipe.length > 0 ? [...fromRecipe] : [...DEFAULT_RECIPE.configs];
+  }
+
+  const raw  = typeof argv.config === 'string' && argv.config.trim() ? argv.config : 'Release';
+  const list = raw.split(',').map((s) => s.trim()).filter(Boolean);
+
+  const invalid = list.filter((c) => !VALID_CMAKE_CONFIGS.has(c));
+  if (invalid.length > 0) {
+    const valid = [...VALID_CMAKE_CONFIGS].join(' | ');
+    throw new Error(`invalid --config "${invalid.join(', ')}" — expected ${valid}`);
+  }
+
+  const seen = new Set();
+  const deduped = [];
+  for (const c of list) {
+    if (!seen.has(c)) { seen.add(c); deduped.push(c); }
+  }
+  return deduped.length > 0 ? deduped : ['Release'];
+}
+
 /**
  * Args passed to `cmake` for the build step.
  *
@@ -225,13 +267,34 @@ function runCmake(args, env = null) {
  * @param {object} argv
  */
 async function build(argv) {
-  const rootDir      = path.resolve(argv.root);
-  const manifestPath = path.resolve(argv.manifest);
+  // Shared per-invocation state. See src/context.js +
+  // claude/PLAN-COMMAND-CONTEXT.md. Parses --conf up front so a malformed
+  // flag fails here instead of after cmake's already configured.
+  let ctx;
+  try {
+    ctx = buildContext(argv);
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
 
-  const config      = readConfig();
-  const profileName = argv.profile ?? config.defaultProfile ?? 'default';
+  const { rootDir, manifestPath } = ctx;
+  const { name: profileName, profile: activeProfile } = ctx.profiles.host;
   const presetName  = resolvePresetName({ presetOverride: argv.preset, profileName });
-  const buildConfig = argv.config ?? 'Release';
+
+  // Resolve the list of configs up front so a malformed --config fails
+  // before auto-install kicks off. `--all-configs` consults the recipe
+  // (if any); otherwise comma-separated --config, defaulting to Release.
+  let configList;
+  try {
+    const recipe = hasBuildRecipe(ctx.manifest)
+      ? (() => { try { return normalizeRecipe(ctx.manifest.build, null); } catch { return null; } })()
+      : null;
+    configList = resolveConfigList({ argv, recipeConfigs: recipe?.configs ?? null });
+  } catch (err) {
+    log.error(err.message);
+    process.exit(1);
+  }
 
   // ── Stale check / auto-install ────────────────────────────────────────────
   // `--auto-install` gates the "run `wyvrnpm install` first when the
@@ -278,13 +341,12 @@ async function build(argv) {
   let effectiveGenerator = argv.generator ?? null;
   let effectiveProfile   = null;
   try {
-    const { profile: activeProfile } = loadProfile(profileName);
     effectiveProfile = activeProfile;
     // Which generator will the preset actually use? Read it from the
     // project's own recipe if one exists. If not, default to null and let
     // cmake/CMakePresets decide — in which case MSVC env activation is
     // skipped (because VS is usually the default on Windows).
-    const manifest = readManifest(manifestPath);
+    const manifest = ctx.manifest;
     let presetGenerator = null;
     if (hasBuildRecipe(manifest)) {
       try {
@@ -321,16 +383,10 @@ async function build(argv) {
   // CLI --conf → -D / -U passthrough (PLAN-CONF.md §7). The preset's
   // baked-in cacheVariables (from the last install) already reflect the
   // recipe + local-overlay layers; CLI conf layers on top for this
-  // invocation only.
-  let cliConfSets, cliConfUnsets;
-  try {
-    const cli = parseCliConf(argv.conf);
-    cliConfSets   = cli.sets;
-    cliConfUnsets = cli.unsets;
-  } catch (err) {
-    log.error(`--conf parse error: ${err.message}`);
-    process.exit(1);
-  }
+  // invocation only. ctx.cliConf is pre-parsed by buildContext; malformed
+  // values already threw above.
+  const cliConfSets   = ctx.cliConf.sets;
+  const cliConfUnsets = ctx.cliConf.unsets;
 
   const configureArgs = buildConfigureArgs({
     presetName,
@@ -342,35 +398,43 @@ async function build(argv) {
   log.info(`cmake ${configureArgs.join(' ')}`);
   await runCmake(configureArgs, cmakeEnv);
 
-  // ── Build ─────────────────────────────────────────────────────────────────
-  const buildArgs = buildBuildArgs({
-    binaryDir,
-    config:   buildConfig,
-    target:   argv.target,
-    verbose:  argv.verbose,
-    passthru: argv['--'] ?? [],
-  });
-  log.info(`cmake ${buildArgs.join(' ')}`);
-  await runCmake(buildArgs, cmakeEnv);
-
-  // ── Install (optional) ────────────────────────────────────────────────────
-  // `--install` runs `cmake --install <binaryDir>` after the build. Prefix
-  // defaults to whatever was baked into the cache at configure time; pass
-  // `--install-prefix` to override without reconfiguring.
-  if (argv.install) {
-    const installArgs = buildInstallArgs({
+  // ── Build (+ optional install) per config ─────────────────────────────────
+  // Configure ran once above. Multi-config generators (VS, Xcode, Ninja
+  // Multi-Config) produce every config from that one configure step; for
+  // single-config generators each iteration simply re-`cmake --build`s the
+  // same baked CMAKE_BUILD_TYPE (harmless duplication). `--install` runs
+  // per config too — the usual reason to want multi-config is so that a
+  // downstream `find_package()` can pick whichever it needs.
+  if (configList.length > 1) {
+    log.info(`Building ${configList.length} configs: ${configList.join(', ')}`);
+  }
+
+  for (const config of configList) {
+    const buildArgs = buildBuildArgs({
       binaryDir,
-      config: buildConfig,
-      prefix: argv.installPrefix,
+      config,
+      target:   argv.target,
+      verbose:  argv.verbose,
+      passthru: argv['--'] ?? [],
     });
-    log.info(`cmake ${installArgs.join(' ')}`);
-    await runCmake(installArgs, cmakeEnv);
+    log.info(`cmake ${buildArgs.join(' ')}`);
+    await runCmake(buildArgs, cmakeEnv);
+
+    if (argv.install) {
+      const installArgs = buildInstallArgs({
+        binaryDir,
+        config,
+        prefix: argv.installPrefix,
+      });
+      log.info(`cmake ${installArgs.join(' ')}`);
+      await runCmake(installArgs, cmakeEnv);
+    }
   }
 
   const suffix = argv.install
     ? ` + installed${argv.installPrefix ? ` to ${argv.installPrefix}` : ''}`
     : '';
-  log.success(`Build complete: ${binaryDir} (${buildConfig})${suffix}`);
+  log.success(`Build complete: ${binaryDir} (${configList.join(', ')})${suffix}`);
 }
 
 module.exports = build;
@@ -381,6 +445,7 @@ module.exports._helpers = {
   isToolchainStale,
   resolvePresetName,
   resolveBinaryDir,
+  resolveConfigList,
   buildConfigureArgs,
   buildBuildArgs,
   buildInstallArgs,