bob 0.99.0

/*
 * Copyright (c) 2026 Jonathan Perkin <jonathan@perkin.org.uk>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

//! Package dependency scanning and resolution.
//!
//! This module provides the [`Scan`] struct for discovering package dependencies
//! and building a directed acyclic graph (DAG) for build ordering.
//!
//! # Scan Process
//!
//! 1. Create a scan sandbox
//! 2. Run `make pbulk-index` on each package to discover dependencies
//! 3. Recursively discover all transitive dependencies
//! 4. Resolve dependency patterns to specific package versions
//! 5. Verify no circular dependencies exist
//! 6. Return buildable and skipped package lists
//!
//! # Skip Reasons
//!
//! Packages may be skipped for several reasons:
//!
//! - `PKG_SKIP_REASON` - Package explicitly marked to skip on this platform
//! - `PKG_FAIL_REASON` - Package expected to fail on this platform
//! - Unresolved dependencies - Required dependency not found
//! - Circular dependencies - Package has a dependency cycle

use crate::config::PkgsrcEnv;
use crate::sandbox::{SandboxScope, wait_output_with_shutdown};
use crate::tui::{Progress, REFRESH_INTERVAL, format_duration};
use crate::{Config, Interrupted, RunState, Sandbox};
use crate::{PackageCounts, PackageState, PackageStateKind};
use anyhow::{Context, Result, bail};
use crossterm::event;
use indexmap::IndexMap;
use petgraph::graphmap::DiGraphMap;
use pkgsrc::{Pattern, PatternCache, PkgName, PkgPath, ScanIndex};
use rayon::prelude::*;
use std::collections::{HashMap, HashSet};
use std::io::BufReader;
use std::sync::atomic::{AtomicBool, Ordering};
use std::sync::{Arc, Mutex};
use std::time::Instant;
use tracing::{debug, error, info, info_span, trace, warn};

/// A successfully resolved package that is ready to build.
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
pub struct ResolvedPackage {
    /// The scan index data including resolved dependencies.
    pub index: ScanIndex,
    /// Package path.
    pub pkgpath: PkgPath,
}

impl ResolvedPackage {
    /// Returns the package name.
    pub fn pkgname(&self) -> &PkgName {
        &self.index.pkgname
    }

    /// Returns resolved dependencies.
    pub fn depends(&self) -> &[PkgName] {
        self.index.resolved_depends.as_deref().unwrap_or(&[])
    }

    /// Returns bootstrap_pkg if set.
    pub fn bootstrap_pkg(&self) -> Option<&str> {
        self.index.bootstrap_pkg.as_deref()
    }

    /// Returns usergroup_phase if set.
    pub fn usergroup_phase(&self) -> Option<&str> {
        self.index.usergroup_phase.as_deref()
    }

    /// Returns multi_version if set.
    pub fn multi_version(&self) -> Option<&[String]> {
        self.index.multi_version.as_deref()
    }

    /// Returns PBULK_WEIGHT, defaulting to 100 if missing or invalid.
    pub fn pbulk_weight(&self) -> usize {
        self.index
            .pbulk_weight
            .as_ref()
            .and_then(|s| s.parse().ok())
            .unwrap_or(100)
    }
}

impl std::fmt::Display for ResolvedPackage {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(f, "{}", self.index)
    }
}

/// Result of scanning/resolving a single package.
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
pub enum ScanResult {
    /// Package is buildable.
    Buildable(ResolvedPackage),
    /// Package was skipped for a reason.
    Skipped {
        /// Package path.
        pkgpath: PkgPath,
        /// Package state (skip reason).
        state: PackageState,
        /// Scan index if available (present for most skipped packages).
        index: Option<ScanIndex>,
        /// Resolved dependencies (may be partial for unresolved deps).
        resolved_depends: Vec<PkgName>,
    },
    /// Package failed to scan (bmake pbulk-index failed).
    ScanFail {
        /// Package path.
        pkgpath: PkgPath,
        /// Error message.
        error: String,
    },
}

impl ScanResult {
    /// Returns the package path.
    pub fn pkgpath(&self) -> &PkgPath {
        match self {
            ScanResult::Buildable(pkg) => &pkg.pkgpath,
            ScanResult::Skipped { pkgpath, .. } => pkgpath,
            ScanResult::ScanFail { pkgpath, .. } => pkgpath,
        }
    }

    /// Returns the package name if available.
    pub fn pkgname(&self) -> Option<&PkgName> {
        match self {
            ScanResult::Buildable(pkg) => Some(pkg.pkgname()),
            ScanResult::Skipped { index, .. } => index.as_ref().map(|i| &i.pkgname),
            ScanResult::ScanFail { .. } => None,
        }
    }

    /// Returns true if this package is buildable.
    pub fn is_buildable(&self) -> bool {
        matches!(self, ScanResult::Buildable(_))
    }

    /// Returns the resolved package if buildable.
    pub fn as_buildable(&self) -> Option<&ResolvedPackage> {
        match self {
            ScanResult::Buildable(pkg) => Some(pkg),
            _ => None,
        }
    }

    /// Returns resolved dependencies.
    pub fn depends(&self) -> &[PkgName] {
        match self {
            ScanResult::Buildable(pkg) => pkg.depends(),
            ScanResult::Skipped {
                resolved_depends, ..
            } => resolved_depends,
            ScanResult::ScanFail { .. } => &[],
        }
    }
}

impl std::fmt::Display for ScanResult {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            ScanResult::Buildable(pkg) => write!(f, "{}", pkg),
            ScanResult::Skipped {
                index,
                pkgpath,
                state,
                resolved_depends,
            } => {
                if let Some(idx) = index {
                    write!(f, "{}", idx)?;
                    // Don't emit DEPENDS for unresolved deps (pbulk compat)
                    if !matches!(state, PackageState::Unresolved(_)) && !resolved_depends.is_empty()
                    {
                        write!(f, "DEPENDS=")?;
                        for (i, d) in resolved_depends.iter().enumerate() {
                            if i > 0 {
                                write!(f, " ")?;
                            }
                            write!(f, "{d}")?;
                        }
                        writeln!(f)?;
                    }
                } else {
                    writeln!(f, "PKGPATH={}", pkgpath)?;
                }
                Ok(())
            }
            ScanResult::ScanFail { pkgpath, .. } => {
                writeln!(f, "PKGPATH={}", pkgpath)
            }
        }
    }
}

/// Result of scanning and resolving packages.
///
/// Returned by [`Scan::resolve`], contains all scanned packages with their outcomes.
#[derive(Clone, Debug, Default, serde::Serialize, serde::Deserialize)]
pub struct ScanSummary {
    /// Number of unique package paths scanned.
    pub pkgpaths: usize,
    /// All packages in scan order with their outcomes.
    pub packages: Vec<ScanResult>,
}

/// Counts of packages by state, plus buildable and scanfail totals.
#[derive(Clone, Debug, Default)]
pub struct ScanCounts {
    /// Packages that are buildable.
    pub buildable: usize,
    /// Counts by [`PackageState`] variant.
    pub states: PackageCounts,
    /// Packages that failed to scan.
    pub scanfail: usize,
}

impl ScanSummary {
    /// Compute all counts in a single pass.
    pub fn counts(&self) -> ScanCounts {
        let mut c = ScanCounts::default();
        for p in &self.packages {
            match p {
                ScanResult::Buildable(_) => c.buildable += 1,
                ScanResult::Skipped { state, .. } => c.states.add(state),
                ScanResult::ScanFail { .. } => c.scanfail += 1,
            }
        }
        c
    }

    /// Iterator over buildable packages.
    pub fn buildable(&self) -> impl Iterator<Item = &ResolvedPackage> {
        self.packages.iter().filter_map(|p| p.as_buildable())
    }

    /// Iterator over non-buildable packages.
    pub fn failed(&self) -> impl Iterator<Item = &ScanResult> {
        self.packages.iter().filter(|p| !p.is_buildable())
    }

    /// Count of buildable packages.
    pub fn count_buildable(&self) -> usize {
        self.packages.iter().filter(|p| p.is_buildable()).count()
    }

    /// Scan failures and unresolved dependency errors.
    pub fn errors(&self) -> impl Iterator<Item = &str> {
        self.packages.iter().filter_map(|p| match p {
            ScanResult::ScanFail { error, .. } => Some(error.as_str()),
            ScanResult::Skipped {
                state: PackageState::Unresolved(detail),
                ..
            } => Some(detail.as_str()),
            _ => None,
        })
    }

    /// Print the "Resolved N total packages..." line.
    pub fn print_resolved(&self) {
        println!(
            "Resolved {} total packages from {} package paths",
            self.packages.len(),
            self.pkgpaths
        );
    }

    /**
     * Print package counts.
     *
     * If `up_to_date` is provided, shows "to build" and "up-to-date" counts.
     * Otherwise shows "buildable" count.
     */
    pub fn print_counts(&self, up_to_date: Option<usize>) {
        use crate::PackageStateKind::*;
        let c = self.counts();
        let s = &c.states;
        let indirect = s[IndirectPreSkipped]
            + s[IndirectPreFailed]
            + s[IndirectUnresolved]
            + s[IndirectFailed];
        match up_to_date {
            Some(n) => println!(
                "{} to build, {} up-to-date, {} prefailed, {} blocked, {} unresolved",
                c.buildable.saturating_sub(n),
                n,
                s[PreSkipped] + s[PreFailed],
                indirect,
                s[Unresolved]
            ),
            None => println!(
                "{} buildable, {} prefailed, {} blocked, {} unresolved",
                c.buildable,
                s[PreSkipped] + s[PreFailed],
                indirect,
                s[Unresolved]
            ),
        }
    }
}

/**
 * Package dependency scanner.
 *
 * Discovers packages and their dependencies by running `make pbulk-index`
 * in each package directory, then resolves dependency patterns to specific
 * package versions.
 *
 * Supports two modes:
 * - **Full tree**: scans all packages in the pkgsrc tree (default).
 * - **Limited**: scans only explicitly added packages and their transitive
 *   dependencies, matching pbulk's `presolve` behaviour.
 *
 * Results are cached in the [`Database`](crate::Database) for resumable
 * operation after interruption.
 */
#[derive(Debug, Default)]
pub struct Scan {
    config: Config,
    sandbox: Sandbox,
    incoming: HashSet<PkgPath>,
    /// Pkgpaths we've completed scanning (in this session).
    done: HashSet<PkgPath>,
    /// Number of pkgpaths loaded from cache at start of scan.
    initial_cached: usize,
    /// Number of pkgpaths discovered as cached during dependency discovery.
    discovered_cached: usize,
    /// Packages loaded from scan, indexed by pkgname.
    packages: IndexMap<PkgName, ScanIndex>,
    /// Full tree scan - discover all packages, skip recursive dependency discovery.
    /// Defaults to true; set to false when packages are explicitly added.
    full_tree: bool,
    /// A previous full tree scan completed successfully.
    full_scan_complete: bool,
    /// Packages that failed to scan (pkgpath, error message).
    scan_failures: Vec<(PkgPath, String)>,
    /// Pkgsrc environment variables (populated after pre-build).
    pkgsrc_env: Option<PkgsrcEnv>,
    /// Initial pkgpaths from limited_list (for deferred dependency discovery).
    /// Only set for non-full-tree scans.
    initial_pkgpaths: HashSet<PkgPath>,
    /// Verbosity level for resolution warnings (0=quiet, 1=location, 2=multi).
    verbosity: u8,
    /// Sandbox ID allocated by the scope, set by `start()`.
    sandbox_id: Option<usize>,
}

impl Scan {
    pub fn new(config: &Config) -> Scan {
        let sandbox = Sandbox::new(config);
        debug!(pkgsrc = %config.pkgsrc().display(),
            make = %config.make().display(),
            scan_threads = config.scan_threads(),
            "Created new Scan instance"
        );
        Scan {
            config: config.clone(),
            sandbox,
            incoming: HashSet::new(),
            done: HashSet::new(),
            initial_cached: 0,
            discovered_cached: 0,
            packages: IndexMap::new(),
            full_tree: true,
            full_scan_complete: false,
            scan_failures: Vec::new(),
            pkgsrc_env: None,
            initial_pkgpaths: HashSet::new(),
            verbosity: 0,
            sandbox_id: None,
        }
    }

    pub fn set_verbosity(&mut self, v: u8) {
        self.verbosity = v;
    }

    pub fn add(&mut self, pkgpath: &PkgPath) {
        info!(pkgpath = %pkgpath.as_path().display(), "Adding package to scan queue");
        self.full_tree = false;
        self.incoming.insert(pkgpath.clone());
        self.initial_pkgpaths.insert(pkgpath.clone());
    }

    /// Returns true if this is a full tree scan.
    pub fn is_full_tree(&self) -> bool {
        self.full_tree
    }

    /// Mark that a previous full tree scan completed successfully.
    pub fn set_full_scan_complete(&mut self) {
        self.full_scan_complete = true;
    }

    /// Initialize scan from database, checking what's already scanned.
    /// Returns (cached_count, pending_deps_count) where pending_deps_count is the
    /// number of dependencies discovered but not yet scanned (from interrupted scans).
    pub fn init_from_db(&mut self, db: &crate::db::Database) -> Result<(usize, usize)> {
        let scanned = db.get_scanned_pkgpaths()?;
        let cached_count = scanned.len();
        let mut pending_count = 0;

        if cached_count > 0 {
            info!(cached_count, "Found cached scan results in database");

            // For full tree scans with full_scan_complete, we'll skip scanning
            // For limited scans, remove already-scanned from incoming
            if !self.full_tree {
                self.incoming.retain(|p| !scanned.contains(&p.to_string()));
            }

            // Add scanned pkgpaths to done set
            for pkgpath_str in &scanned {
                if let Ok(pkgpath) = PkgPath::new(pkgpath_str) {
                    self.done.insert(pkgpath);
                }
            }

            /*
             * For full tree scans, check for dependencies that were
             * discovered but not yet scanned.  This handles resume
             * after interrupt.
             *
             * For limited scans, the early-return check in start()
             * calls find_missing_pkgpaths() instead, ensuring we only
             * scan dependencies of active packages.
             */
            if self.full_tree {
                let unscanned = db.get_unscanned_dependencies()?;
                if !unscanned.is_empty() {
                    info!(
                        unscanned_count = unscanned.len(),
                        "Found unscanned dependencies from interrupted scan"
                    );
                    for pkgpath_str in unscanned {
                        if let Ok(pkgpath) = PkgPath::new(&pkgpath_str) {
                            if !self.done.contains(&pkgpath) {
                                self.incoming.insert(pkgpath);
                                pending_count += 1;
                            }
                        }
                    }
                }
            }
        }

        Ok((cached_count, pending_count))
    }

    /// Discover all packages in pkgsrc tree.
    fn discover_packages(
        &mut self,
        pool: &rayon::ThreadPool,
        shutdown: &RunState,
    ) -> anyhow::Result<()> {
        println!("Discovering packages...");
        let pkgsrc = self.config.pkgsrc().display().to_string();

        // Get top-level SUBDIR (categories + USER_ADDITIONAL_PKGS)
        let child = self.sandbox.execute_command(
            self.sandbox_id,
            self.config.make(),
            ["-C", &pkgsrc, "show-subdir-var", "VARNAME=SUBDIR"],
            vec![],
        )?;
        let output =
            wait_output_with_shutdown(child, shutdown).context("Failed to run show-subdir-var")?;

        if !output.status.success() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            bail!("Failed to get categories: {}", stderr);
        }

        let stdout = String::from_utf8_lossy(&output.stdout);
        let entries: Vec<&str> = stdout.split_whitespace().collect();

        // Separate USER_ADDITIONAL_PKGS (contain '/') from categories
        let mut categories: Vec<&str> = Vec::new();
        for entry in entries {
            if entry.contains('/') {
                if let Ok(pkgpath) = PkgPath::new(entry) {
                    self.incoming.insert(pkgpath);
                }
            } else {
                categories.push(entry);
            }
        }

        // Process categories in parallel
        let make = self.config.make();
        let sandbox = &self.sandbox;
        let sandbox_id = self.sandbox_id;
        let discovered: Vec<PkgPath> = pool.install(|| {
            categories
                .par_iter()
                .flat_map(|category| {
                    let workdir = format!("{}/{}", pkgsrc, category);
                    let result = sandbox
                        .execute_command(
                            sandbox_id,
                            make,
                            [
                                "-C",
                                &workdir,
                                "show-subdir-var",
                                "VARNAME=SUBDIR",
                            ],
                            vec![],
                        )
                        .and_then(|c| wait_output_with_shutdown(c, shutdown));

                    match result {
                        Ok(o) if o.status.success() => {
                            let pkgs = String::from_utf8_lossy(&o.stdout);
                            pkgs.split_whitespace()
                                .filter_map(|pkg| {
                                    let path = format!("{}/{}", category, pkg);
                                    PkgPath::new(&path).ok()
                                })
                                .collect::<Vec<_>>()
                        }
                        Ok(o) => {
                            let stderr = String::from_utf8_lossy(&o.stderr);
                            debug!(category = *category, %stderr, "Failed to get packages for category");
                            vec![]
                        }
                        Err(e) => {
                            debug!(category = *category, error = %e, "Failed to run make in category");
                            vec![]
                        }
                    }
                })
                .collect()
        });

        self.incoming.extend(discovered);

        info!(
            discovered = self.incoming.len(),
            "Package discovery complete"
        );
        println!("Discovered {} package paths", self.incoming.len());

        Ok(())
    }

    pub fn start(
        &mut self,
        db: &crate::db::Database,
        scope: &mut SandboxScope,
    ) -> anyhow::Result<()> {
        info!(
            incoming_count = self.incoming.len(),
            sandbox_enabled = self.sandbox.enabled(),
            "Starting package scan"
        );

        let pool = rayon::ThreadPoolBuilder::new()
            .num_threads(self.config.scan_threads())
            .build()
            .context("Failed to build scan thread pool")?;

        let shutdown_flag = scope.state().clone();

        // For full tree scans where a previous scan completed, all packages
        // are already cached - nothing to do.
        if self.full_tree && self.full_scan_complete && !self.done.is_empty() {
            println!("All {} package paths already scanned", self.done.len());
            return Ok(());
        }

        /*
         * For non-full-tree scans, prune already-cached packages from
         * incoming before sandbox creation to avoid unnecessary
         * setup/teardown.  If all initial packages are cached, check
         * for unscanned dependencies (resume after interrupt) before
         * deciding there's nothing to do.
         */
        if !self.full_tree {
            self.incoming.retain(|p| !self.done.contains(p));
            if self.incoming.is_empty() {
                if let Ok(deps) = self.unscanned_deps(db) {
                    self.incoming = deps;
                }
                if self.incoming.is_empty() {
                    if !self.done.is_empty() {
                        println!("All {} package paths already scanned", self.done.len());
                    }
                    return Ok(());
                }
            }
        }

        /*
         * Only a single sandbox is required, 'make pbulk-index' can safely be
         * run in parallel inside one sandbox.
         *
         * Ensure a sandbox exists. The caller manages overall lifecycle.
         */
        if scope.enabled() {
            crate::print_status("Creating sandbox");
            let start = Instant::now();
            let ids = scope.ensure(1)?;
            self.sandbox_id = ids.first().copied();
            if !self.sandbox.run_pre_build(
                self.sandbox_id,
                &self.config,
                self.config.script_env(None),
            )? {
                warn!("pre-build failed");
            }
            crate::print_elapsed("Creating sandbox", start.elapsed());
        }

        let env = match db.load_pkgsrc_env() {
            Ok(env) => env,
            Err(_) => {
                let env = PkgsrcEnv::fetch(&self.config, &self.sandbox, self.sandbox_id)?;
                db.store_pkgsrc_env(&env)?;
                let mut vcs_info = crate::vcs::VcsInfo::from_path(self.config.pkgsrc());
                if let Some(branch) = self.config.report_branch() {
                    vcs_info.remote_branch = Some(branch.to_string());
                }
                db.store_vcs_info(&vcs_info)?;
                env
            }
        };
        self.pkgsrc_env = Some(env);

        // For full tree scans, always discover all packages
        if self.full_tree {
            self.discover_packages(&pool, &shutdown_flag)?;
            self.incoming.retain(|p| !self.done.contains(p));
        }

        // Nothing to scan - all packages are cached
        if self.incoming.is_empty() {
            if !self.done.is_empty() {
                println!("All {} package paths already scanned", self.done.len());
            }

            if scope.enabled() {
                self.run_post_build()?;
            }
            return Ok(());
        }

        // Clear resolved dependencies since we're scanning new packages
        db.clear_resolved_depends()?;

        println!("Scanning packages...");

        // Track initial cached count for final summary
        self.initial_cached = self.done.len();

        // Set up multi-line progress display using ratatui inline viewport
        // Note: finished_title is unused since we print our own summary
        let total_count = self.initial_cached + self.incoming.len();
        let progress = Arc::new(Mutex::new(
            Progress::new(
                "Scanning",
                "",
                total_count,
                self.config.scan_threads(),
                self.config.tui(),
            )
            .context("Failed to initialize progress display")?,
        ));

        // Mark cached packages in progress display
        if self.initial_cached > 0 {
            if let Ok(mut p) = progress.lock() {
                p.state_mut().cached = self.initial_cached;
            }
        }

        // Flag to stop the refresh thread
        let stop_refresh = Arc::new(AtomicBool::new(false));

        // Spawn a thread to periodically refresh the display (for timer updates)
        let progress_refresh = Arc::clone(&progress);
        let stop_flag = Arc::clone(&stop_refresh);
        let shutdown_for_refresh = shutdown_flag.clone();
        let is_plain = progress.lock().map(|p| p.is_plain()).unwrap_or(false);
        let refresh_thread = std::thread::spawn(move || {
            while !stop_flag.load(Ordering::Relaxed) && !shutdown_for_refresh.is_shutdown() {
                if is_plain {
                    std::thread::sleep(REFRESH_INTERVAL);
                    if let Ok(mut p) = progress_refresh.lock() {
                        let _ = p.render();
                    }
                } else {
                    let has_event = event::poll(REFRESH_INTERVAL).unwrap_or(false);
                    if let Ok(mut p) = progress_refresh.lock() {
                        if has_event {
                            let _ = p.handle_event();
                        }
                        let _ = p.render();
                    }
                }
            }
        });

        // Start transaction for all writes
        let tx = db.transaction()?;
        let mut db_error: Option<anyhow::Error> = None;

        // Borrow config and sandbox separately for use in scanner thread,
        // allowing main thread to mutate self.done, self.incoming, etc.
        let config = &self.config;
        let sandbox = &self.sandbox;
        let sandbox_id = self.sandbox_id;
        let scan_env = self.scan_env();

        /*
         * For limited scans, prime incoming with any missing dependencies.
         * This handles resume after interrupt where initial packages are
         * already scanned but their dependencies are not.
         */
        if !self.full_tree && self.incoming.is_empty() {
            if let Ok(deps) = self.unscanned_deps(db) {
                for pkgpath in deps {
                    self.incoming.insert(pkgpath);
                    if let Ok(mut p) = progress.lock() {
                        p.state_mut().total += 1;
                    }
                }
            }
        }

        /*
         * Continuously iterate over incoming queue, moving to done once
         * processed, and adding any dependencies to incoming to be processed
         * next.
         */
        let mut scanned_count: usize = 0;

        loop {
            // Check for interrupt (stop or shutdown).
            if shutdown_flag.interrupted() {
                if shutdown_flag.is_stopping() {
                    if let Ok(mut p) = progress.lock() {
                        p.announce_interrupt();
                    }
                }
                break;
            }

            /*
             * Convert the incoming HashSet into a Vec for parallel processing.
             */
            let pkgpaths: Vec<PkgPath> = self.incoming.drain().collect();
            if pkgpaths.is_empty() {
                break;
            }

            // Create bounded channel for streaming results
            const CHANNEL_BUFFER_SIZE: usize = 128;
            let (tx, rx) = std::sync::mpsc::sync_channel::<(PkgPath, Result<Vec<ScanIndex>>)>(
                CHANNEL_BUFFER_SIZE,
            );

            let mut new_incoming: HashSet<PkgPath> = HashSet::new();

            std::thread::scope(|s| {
                // Spawn scanning thread
                let progress_clone = Arc::clone(&progress);
                let shutdown_clone = shutdown_flag.clone();
                let pool_ref = &pool;
                let scan_env_ref = &scan_env;

                s.spawn(move || {
                    pool_ref.install(|| {
                        pkgpaths.par_iter().for_each(|pkgpath| {
                            // Check for interrupt before starting
                            if shutdown_clone.interrupted() {
                                return;
                            }

                            let pathname = pkgpath.as_path().to_string_lossy().to_string();
                            let thread_id = rayon::current_thread_index().unwrap_or(0);

                            // Update progress - show current package
                            if let Ok(mut p) = progress_clone.lock() {
                                p.state_mut().set_worker_active(thread_id, &pathname);
                                p.state_mut().increment_dispatched();
                            }

                            let result = Self::scan_pkgpath_with(
                                config,
                                sandbox,
                                sandbox_id,
                                pkgpath,
                                scan_env_ref,
                                &shutdown_clone,
                            );

                            // Update progress counter
                            if let Ok(mut p) = progress_clone.lock() {
                                p.state_mut().set_worker_idle(thread_id);
                                if result.is_ok() {
                                    p.state_mut().increment_completed();
                                } else {
                                    p.state_mut().increment_failed();
                                }
                            }

                            // Send result (blocks if buffer full = backpressure)
                            let _ = tx.send((pkgpath.clone(), result));
                        });
                    });
                    drop(tx);
                });

                /*
                 * Process results and write to DB.
                 */
                for (pkgpath, result) in rx {
                    scanned_count += 1;
                    if let Ok(mut p) = progress.lock() {
                        let total = p.state_mut().total.saturating_sub(p.state_mut().cached);
                        let _ = p.print_progress_dot(scanned_count, total);
                    }

                    let scanpkgs = match result {
                        Ok(pkgs) => pkgs,
                        Err(e) => {
                            self.scan_failures.push((pkgpath.clone(), e.to_string()));
                            self.done.insert(pkgpath);
                            continue;
                        }
                    };
                    self.done.insert(pkgpath.clone());

                    // Save to database
                    if !scanpkgs.is_empty() {
                        if let Err(e) = db.store_scan_pkgpath(&pkgpath.to_string(), &scanpkgs) {
                            error!(error = %e, "Failed to store scan results");
                            if db_error.is_none() {
                                db_error = Some(e);
                            }
                        }
                    }
                }
            });

            if let Ok(mut p) = progress.lock() {
                let total = p.state_mut().total.saturating_sub(p.state_mut().cached);
                let _ = p.flush_progress_dots(scanned_count, total);
            }

            // Check for interrupt after batch completes.
            if shutdown_flag.interrupted() {
                if shutdown_flag.is_stopping() {
                    if let Ok(mut p) = progress.lock() {
                        p.announce_interrupt();
                    }
                }
                break;
            }

            // Don't start new waves if database writes are failing
            if db_error.is_some() {
                break;
            }

            /*
             * We're finished with the current incoming, replace it with the
             * new incoming list.  If it is empty then we've already processed
             * all known PKGPATHs and are done.
             *
             * Filter out any pkgpaths that were already scanned this wave.
             * This handles a race where dependency discovery finds a pkgpath
             * before its parallel scan completes and adds it to done.
             */
            new_incoming.retain(|p| !self.done.contains(p));

            /*
             * For limited scans, check for missing dependency pkgpaths by
             * doing a resolution pass. This matches pbulk's iterative
             * approach where dependencies are only scanned if needed.
             */
            if !self.full_tree && new_incoming.is_empty() {
                match self.unscanned_deps(db) {
                    Ok(deps) if !deps.is_empty() => {
                        let count = deps.len();
                        for pkgpath in deps {
                            new_incoming.insert(pkgpath);
                            if let Ok(mut p) = progress.lock() {
                                p.state_mut().total += 1;
                            }
                        }
                        debug!(
                            missing_count = count,
                            "Discovered missing dependency pkgpaths"
                        );
                    }
                    Err(e) => {
                        warn!(error = %e, "Failed to find missing pkgpaths");
                    }
                    _ => {}
                }
            }

            self.incoming = new_incoming;
        }

        // Commit whatever succeeded (partial on interrupt/error, full on success)
        if let Err(e) = tx.commit() {
            if db_error.is_none() {
                db_error = Some(e);
            }
        }

        // Stop the refresh thread and print final summary
        stop_refresh.store(true, Ordering::Relaxed);
        let _ = refresh_thread.join();

        if shutdown_flag.interrupted() {
            let was_first = if let Ok(mut p) = progress.lock() {
                p.finish_interrupted().unwrap_or(false)
            } else {
                false
            };
            if was_first && shutdown_flag.is_shutdown() {
                eprintln!("Interrupted, shutting down...");
            }
        }

        if !shutdown_flag.interrupted() {
            // Get elapsed time and clean up TUI without printing generic summary
            let elapsed = if let Ok(mut p) = progress.lock() {
                p.finish_silent().ok()
            } else {
                None
            };

            // Print scan-specific summary from source of truth
            // total = initial_cached + discovered_cached + actually_scanned
            // where actually_scanned = succeeded + failed
            let total = self.done.len();
            let cached = self.initial_cached + self.discovered_cached;
            let failed = self.scan_failures.len();
            let succeeded = total.saturating_sub(cached).saturating_sub(failed);

            let elapsed_str = elapsed
                .map(format_duration)
                .unwrap_or_else(|| "?".to_string());

            if cached > 0 {
                println!(
                    "Scanned {} package paths in {} ({} scanned, {} cached, {} failed)",
                    total, elapsed_str, succeeded, cached, failed
                );
            } else {
                println!(
                    "Scanned {} package paths in {} ({} succeeded, {} failed)",
                    total, elapsed_str, succeeded, failed
                );
            }
        }

        if scope.enabled() {
            self.run_post_build()?;
        }

        if shutdown_flag.interrupted() {
            return Err(Interrupted.into());
        }

        if let Some(e) = db_error {
            return Err(e.context("Failed to persist scan results to database"));
        }

        Ok(())
    }

    /// Run post-build operations (build actions + prefix cleanup).
    fn run_post_build(&self) -> anyhow::Result<()> {
        if !self.sandbox.run_post_build(
            self.sandbox_id,
            &self.config,
            self.config.script_env(self.pkgsrc_env.as_ref()),
        )? {
            warn!("post-build failed");
        }
        Ok(())
    }

    /// Returns scan failures as formatted error strings.
    pub fn scan_errors(&self) -> impl Iterator<Item = &str> {
        self.scan_failures.iter().map(|(_, e)| e.as_str())
    }

    fn scan_env(&self) -> Vec<(String, String)> {
        self.pkgsrc_env
            .as_ref()
            .map(|e| {
                e.cachevars
                    .iter()
                    .map(|(k, v)| (k.clone(), v.clone()))
                    .collect()
            })
            .unwrap_or_default()
    }

    fn unscanned_deps(&self, db: &crate::db::Database) -> Result<HashSet<PkgPath>> {
        let missing = self.find_missing_pkgpaths(db)?;
        Ok(missing
            .into_iter()
            .filter(|p| !self.done.contains(p))
            .collect())
    }

    /*
     * Scan a single PKGPATH using provided config and sandbox references.
     * This allows scanning without borrowing all of `self`.
     */
    fn scan_pkgpath_with(
        config: &Config,
        sandbox: &Sandbox,
        sandbox_id: Option<usize>,
        pkgpath: &PkgPath,
        scan_env: &[(String, String)],
        shutdown: &RunState,
    ) -> anyhow::Result<Vec<ScanIndex>> {
        let pkgpath_str = pkgpath.as_path().display().to_string();
        let span = info_span!("scan", pkgpath = %pkgpath_str);
        let _guard = span.enter();
        debug!("Scanning package");

        let pkgsrcdir = config.pkgsrc().display().to_string();
        let workdir = format!("{}/{}", pkgsrcdir, pkgpath_str);

        trace!(%workdir, ?scan_env, "Executing pkg-scan");
        let child = sandbox.execute_command(
            sandbox_id,
            config.make(),
            ["-C", &workdir, "pbulk-index"],
            scan_env.to_vec(),
        )?;
        let output = wait_output_with_shutdown(child, shutdown)?;

        if !output.status.success() {
            let stderr = String::from_utf8_lossy(&output.stderr);
            error!(exit_code = ?output.status.code(), %stderr, "pkg-scan script failed");
            let stderr = stderr.trim();
            let msg = if stderr.is_empty() {
                format!("Scan failed for {}", pkgpath_str)
            } else {
                format!("Scan failed for {}: {}", pkgpath_str, stderr)
            };
            bail!(msg);
        }

        let stdout = String::from_utf8_lossy(&output.stdout);
        trace!(stdout_len = stdout.len(), %stdout, "pkg-scan script output");

        let reader = BufReader::new(&output.stdout[..]);
        let all_results: Vec<ScanIndex> =
            ScanIndex::from_reader(reader).collect::<Result<_, _>>()?;

        /*
         * Filter to keep only the first occurrence of each PKGNAME.
         * For multi-version packages, pbulk-index returns the *_DEFAULT
         * version first, which is the one we want.
         */
        let mut seen_pkgnames = HashSet::new();
        let mut index: Vec<ScanIndex> = Vec::new();
        for pkg in all_results {
            if seen_pkgnames.insert(pkg.pkgname.clone()) {
                index.push(pkg);
            }
        }

        info!(packages_found = index.len(), "Scan complete");

        /*
         * Set PKGPATH (PKG_LOCATION) as for some reason pbulk-index doesn't.
         */
        for pkg in &mut index {
            pkg.pkg_location = Some(pkgpath.clone());
            debug!(
                pkgname = %pkg.pkgname.pkgname(),
                skip_reason = ?pkg.pkg_skip_reason,
                fail_reason = ?pkg.pkg_fail_reason,
                depends_count = pkg.all_depends.as_ref().map_or(0, |v| v.len()),
                "Found package in scan"
            );
        }

        Ok(index)
    }

    /**
     * Find dependency pkgpaths that need to be scanned to resolve all
     * dependencies.
     *
     * This is used in deferred dependency discovery mode. It does a
     * lightweight pass through scanned packages to find dependencies that
     * have no match yet. Returns the set of pkgpaths to scan next.
     *
     * Only packages from initial_pkgpaths (and their transitive dependencies
     * that have already been scanned) are considered.
     */
    fn find_missing_pkgpaths(&self, db: &crate::db::Database) -> Result<HashSet<PkgPath>> {
        /*
         * Build set of available pkgnames (first occurrence only, like
         * resolve), then iteratively expand an "active" set starting from
         * initial_pkgpaths. For each active package, try to match its
         * dependencies. If no match exists, add the dependency's pkgpath
         * to the missing set. If a match exists, add it to the active set.
         * Continue until no new packages are activated.
         */
        let all_scan_data = db.get_all_scan_data()?;

        let mut available_pkgnames: HashSet<PkgName> = HashSet::new();
        let mut packages: IndexMap<PkgName, ScanIndex> = IndexMap::new();

        for pkg in all_scan_data {
            if !packages.contains_key(&pkg.pkgname) {
                available_pkgnames.insert(pkg.pkgname.clone());
                packages.insert(pkg.pkgname.clone(), pkg);
            }
        }

        let pkgbase_map = Self::build_pkgbase_map(&available_pkgnames);

        let mut active_pkgnames: HashSet<PkgName> = HashSet::new();
        for pkg in packages.values() {
            if let Some(ref loc) = pkg.pkg_location {
                if self.initial_pkgpaths.contains(loc) {
                    active_pkgnames.insert(pkg.pkgname.clone());
                }
            }
        }

        let mut missing_pkgpaths: HashSet<PkgPath> = HashSet::new();
        let mut changed = true;

        while changed {
            changed = false;
            let current_active: Vec<PkgName> = active_pkgnames.iter().cloned().collect();

            for active_pkgname in current_active {
                let Some(pkg) = packages.get(&active_pkgname) else {
                    continue;
                };
                let Some(ref all_deps) = pkg.all_depends else {
                    continue;
                };

                for depend in all_deps.depends() {
                    let depend = match depend {
                        Ok(d) => d,
                        Err(e) => {
                            warn!(
                                pkg = %pkg.pkgname.pkgname(),
                                error = %e,
                                "Malformed dependency"
                            );
                            continue;
                        }
                    };
                    let candidates = Self::find_candidates(
                        depend.pattern(),
                        &pkgbase_map,
                        available_pkgnames.iter(),
                    );

                    if candidates.is_empty() {
                        let dep_path = depend.pkgpath();
                        if !self.done.contains(dep_path) {
                            missing_pkgpaths.insert(dep_path.clone());
                        }
                    } else {
                        for candidate in &candidates {
                            if !active_pkgnames.contains(*candidate) {
                                active_pkgnames.insert((*candidate).clone());
                                changed = true;
                            }
                        }
                    }
                }
            }
        }

        debug!(
            missing_count = missing_pkgpaths.len(),
            active_count = active_pkgnames.len(),
            "Found missing dependency pkgpaths"
        );

        Ok(missing_pkgpaths)
    }

    /**
     * Build a map from pkgbase to matching PkgNames for efficient lookups.
     */
    fn build_pkgbase_map<'a>(
        pkgnames: impl IntoIterator<Item = &'a PkgName>,
    ) -> HashMap<&'a str, Vec<&'a PkgName>> {
        let mut map: HashMap<&str, Vec<&PkgName>> = HashMap::new();
        for pkgname in pkgnames {
            map.entry(pkgname.pkgbase()).or_default().push(pkgname);
        }
        map
    }

    /**
     * Find all packages matching a dependency pattern.
     *
     * Uses pkgbase for efficient O(1) lookup when available, falling back to
     * iteration over all packages for patterns without a pkgbase (e.g., `p5-*`).
     */
    fn find_candidates<'a>(
        pattern: &Pattern,
        pkgbase_map: &HashMap<&str, Vec<&'a PkgName>>,
        all_pkgnames: impl Iterator<Item = &'a PkgName>,
    ) -> Vec<&'a PkgName> {
        if let Some(base) = pattern.pkgbase() {
            pkgbase_map.get(base).map_or(Vec::new(), |v| {
                v.iter()
                    .filter(|c| pattern.matches(c.pkgname()))
                    .copied()
                    .collect()
            })
        } else {
            all_pkgnames
                .filter(|c| pattern.matches(c.pkgname()))
                .collect()
        }
    }

    /**
     * Find the best matching package for a dependency pattern.
     *
     * Uses pkgbase for efficient lookup when available, falling back
     * to all packages for patterns without a known base.  Matching
     * and version comparison are handled by `best_match_pbulk`.
     *
     * Returns:
     * - `Ok(Some(pkgname))` - best matching package found
     * - `Ok(None)` - no candidates match the pattern
     * - `Err(e)` - version comparison error (malformed version)
     */
    fn find_best_match<'a>(
        pattern: &Pattern,
        pkgbase_map: &HashMap<&str, Vec<&'a PkgName>>,
        pkgnames: &'a [PkgName],
    ) -> Result<Option<&'a str>, pkgsrc::PatternError> {
        let mut best = None;
        if let Some(pkgbase) = pattern.pkgbase() {
            if let Some(candidates) = pkgbase_map.get(pkgbase) {
                for candidate in candidates {
                    best = pattern.best_match_pbulk(best, candidate.pkgname())?;
                }
            }
        } else {
            for candidate in pkgnames {
                best = pattern.best_match_pbulk(best, candidate.pkgname())?;
            }
        }
        Ok(best)
    }

    /**
     * Propagate failures through the dependency graph.
     *
     * If package A depends on B, and B has a skip reason, then A gets an
     * indirect skip reason matching the dependency's category:
     * - preskipped dep → indirect-preskipped
     * - prefailed dep → indirect-prefailed
     * - unresolved dep → indirect-unresolved
     *
     * Priority: prefailed > unresolved > preskipped (we want to report the
     * most severe blocker). Iterates until no new entries are added.
     */
    fn propagate_failures(
        depends: &HashMap<PkgName, Vec<PkgName>>,
        skip_reasons: &mut HashMap<PkgName, PackageState>,
    ) {
        loop {
            let mut new_skip_reasons: Vec<(PkgName, PackageState)> = Vec::new();
            for (pkgname, pkg_depends) in depends {
                if skip_reasons.contains_key(pkgname) {
                    continue;
                }
                let mut blocking_reason: Option<PackageState> = None;
                for dep in pkg_depends {
                    if let Some(dep_reason) = skip_reasons.get(dep) {
                        let msg = format!("dependency {} {}", dep.pkgname(), dep_reason.status());
                        let indirect = dep_reason.indirect(msg);
                        let dominated = match &blocking_reason {
                            None => true,
                            Some(PackageState::IndirectPreSkipped(_)) => true,
                            Some(PackageState::IndirectUnresolved(_))
                                if matches!(indirect, PackageState::IndirectPreFailed(_)) =>
                            {
                                true
                            }
                            _ => false,
                        };
                        if dominated {
                            blocking_reason = Some(indirect);
                        }
                        if matches!(blocking_reason, Some(PackageState::IndirectPreFailed(_))) {
                            break;
                        }
                    }
                }
                if let Some(reason) = blocking_reason {
                    new_skip_reasons.push((pkgname.clone(), reason));
                }
            }
            if new_skip_reasons.is_empty() {
                break;
            }
            for (pkgname, reason) in new_skip_reasons {
                skip_reasons.insert(pkgname, reason);
            }
        }
    }

    /**
     * Check for circular dependencies in buildable packages.
     *
     * Returns an error if a cycle is detected, with details about the cycle.
     */
    fn check_circular_deps(packages: &[ScanResult]) -> Result<()> {
        let mut graph = DiGraphMap::new();
        for pkg in packages {
            if let ScanResult::Buildable(resolved) = pkg {
                for dep in resolved.depends() {
                    graph.add_edge(dep.pkgname(), resolved.pkgname().pkgname(), ());
                }
            }
        }
        if let Some(cycle) = find_cycle(&graph) {
            let mut err = "Circular dependencies detected:\n".to_string();
            for n in cycle.iter().rev() {
                err.push_str(&format!("\t{}\n", n));
            }
            err.push_str(&format!("\t{}", cycle.last().unwrap()));
            error!(?cycle, "Circular dependency detected");
            bail!(err);
        }
        Ok(())
    }

    /**
     * Resolve dependency patterns to available package names.
     *
     * Takes scanned package data (from `make pbulk-index`) and resolves
     * dependency patterns like "perl>=5.0" to specific packages like
     * "perl-5.38.0". Returns a [`ScanSummary`] classifying each package as
     * Buildable, Skipped, or ScanFail.
     *
     * # Algorithm
     *
     * **Phase 1 - Load and classify**: Load all scan indexes from the
     * database. For each package, record any PKG_SKIP_REASON or
     * PKG_FAIL_REASON as a skip reason. For limited scans (non-full-tree),
     * seed the "active" set with packages from initial_pkgpaths.
     *
     * **Phase 2 - Setup lookups**: Build a pkgbase map for O(1) candidate
     * lookup by package base name (e.g., "perl" -> [perl-5.38.0, perl-5.36.0]).
     * Initialize a match cache to memoize resolved patterns.
     *
     * **Phase 3 - Resolution loop**: For each package (active packages only
     * for limited scans), resolve each dependency pattern:
     *   - Check the cache for a previous match
     *   - Find candidates via pkgbase map (fast) or full scan (for wildcards)
     *   - Select the best match using pbulk's version comparison rules
     *   - Record unresolved dependencies as skip reasons
     *   - For limited scans, activate matched dependencies and iterate until
     *     no new packages become active
     *
     * **Phase 4 - Propagate failures**: Walk the dependency graph to mark
     * packages with failed/skipped dependencies as IndirectFail/IndirectSkip.
     *
     * **Phase 5 - Build results**: Transform the packages map into a
     * `Vec<ScanResult>`, filtering inactive packages for limited scans.
     *
     * **Phase 6 - Finalize**: Check for circular dependencies, store resolved
     * dependency edges in the database for reverse lookups, return summary.
     *
     * # Limited vs Full Tree Scans
     *
     * Full tree scans resolve all packages in pkgsrc. Limited scans (when
     * packages are explicitly added via `add()`) only resolve packages from
     * initial_pkgpaths and their transitive dependencies, matching pbulk's
     * presolve behavior. This avoids scanning/resolving thousands of unneeded
     * packages when building a small subset.
     */
    pub fn resolve(&mut self, scan_data: Vec<ScanIndex>) -> Result<ScanSummary> {
        info!(
            done_pkgpaths = self.done.len(),
            "Starting dependency resolution"
        );

        let mut skip_reasons: HashMap<PkgName, PackageState> = HashMap::new();
        let mut depends: HashMap<PkgName, Vec<PkgName>> = HashMap::new();
        let mut active: HashSet<PkgName> = HashSet::new();
        let use_active_filter = !self.full_tree && !self.initial_pkgpaths.is_empty();

        for pkg in scan_data {
            if self.packages.contains_key(&pkg.pkgname) {
                debug!(pkgname = %pkg.pkgname.pkgname(), "Skipping duplicate PKGNAME");
                continue;
            }

            if let Some(reason) = &pkg.pkg_skip_reason {
                if !reason.is_empty() {
                    info!(pkgname = %pkg.pkgname.pkgname(), %reason, "PKG_SKIP_REASON");
                    skip_reasons.insert(
                        pkg.pkgname.clone(),
                        PackageState::PreSkipped(reason.clone()),
                    );
                }
            }

            if use_active_filter {
                if let Some(ref loc) = pkg.pkg_location {
                    if self.initial_pkgpaths.contains(loc) {
                        active.insert(pkg.pkgname.clone());
                    }
                }
            }

            if let Some(reason) = &pkg.pkg_fail_reason {
                if !reason.is_empty() && !skip_reasons.contains_key(&pkg.pkgname) {
                    info!(pkgname = %pkg.pkgname.pkgname(), %reason, "PKG_FAIL_REASON");
                    skip_reasons
                        .insert(pkg.pkgname.clone(), PackageState::PreFailed(reason.clone()));
                }
            }

            depends.insert(pkg.pkgname.clone(), Vec::new());
            self.packages.insert(pkg.pkgname.clone(), pkg);
        }

        info!(packages = self.packages.len(), "Loaded packages");

        let pkgnames: Vec<PkgName> = self.packages.keys().cloned().collect();
        let pkgbase_map = Self::build_pkgbase_map(&pkgnames);
        let verbosity = self.verbosity;
        let pkg_locations: HashMap<PkgName, PkgPath> = if verbosity >= 1 {
            self.packages
                .iter()
                .filter_map(|(name, idx)| {
                    idx.pkg_location
                        .as_ref()
                        .map(|loc| (name.clone(), loc.clone()))
                })
                .collect()
        } else {
            HashMap::new()
        };
        let mut match_cache: HashMap<String, PkgName> = HashMap::new();
        let mut patterns = PatternCache::with_capacity(pkgnames.len());
        let is_satisfied = |deps: &[PkgName], pattern: &Pattern| {
            deps.iter()
                .any(|existing| pattern.matches(existing.pkgname()))
        };

        let mut resolved: HashSet<PkgName> = HashSet::new();
        loop {
            let mut new_active = false;
            for pkg in self.packages.values_mut() {
                if use_active_filter && !active.contains(&pkg.pkgname) {
                    continue;
                }
                if resolved.contains(&pkg.pkgname) {
                    continue;
                }
                resolved.insert(pkg.pkgname.clone());

                let all_deps = match pkg.all_depends.take() {
                    Some(deps) => deps,
                    None => continue,
                };
                let pkg_depends = depends.get_mut(&pkg.pkgname).unwrap();

                for dep in all_deps.iter() {
                    let dep = match dep {
                        Ok(d) => d,
                        Err(e) => {
                            warn!(
                                pkg = %pkg.pkgname.pkgname(),
                                error = %e,
                                "Malformed dependency"
                            );
                            continue;
                        }
                    };

                    let pattern = match patterns.compile(dep.pattern()) {
                        Ok(p) => p,
                        Err(e) => {
                            let reason = format!(
                                "{}: pattern error for {}: {}",
                                pkg.pkgname.pkgname(),
                                dep.pattern(),
                                e
                            );
                            if !skip_reasons.contains_key(&pkg.pkgname) {
                                skip_reasons
                                    .insert(pkg.pkgname.clone(), PackageState::PreFailed(reason));
                            }
                            continue;
                        }
                    };

                    if let Some(pkgname) = match_cache.get(dep.pattern()) {
                        if !is_satisfied(pkg_depends, pattern) && !pkg_depends.contains(pkgname) {
                            pkg_depends.push(pkgname.clone());
                        }
                        continue;
                    }

                    if verbosity >= 2 {
                        let candidates =
                            Self::find_candidates(pattern, &pkgbase_map, pkgnames.iter());
                        if candidates.len() > 1 {
                            for c in &candidates {
                                eprintln!(
                                    "Multiple matches for dependency {} of package {}: {}",
                                    dep.pattern(),
                                    pkg.pkgname.pkgname(),
                                    c.pkgname()
                                );
                            }
                        }
                    }

                    match Self::find_best_match(pattern, &pkgbase_map, &pkgnames) {
                        Err(e) => {
                            let reason = format!(
                                "{}: version comparison error for {}: {}",
                                pkg.pkgname.pkgname(),
                                dep.pattern(),
                                e
                            );
                            if !skip_reasons.contains_key(&pkg.pkgname) {
                                skip_reasons
                                    .insert(pkg.pkgname.clone(), PackageState::PreFailed(reason));
                            }
                        }
                        Ok(Some(best)) => {
                            let pkgname = PkgName::new(best);
                            if verbosity >= 1 {
                                if let Some(loc) = pkg_locations.get(&pkgname) {
                                    if let Ok(dep_path) = PkgPath::new(dep.pkgpath()) {
                                        if *loc != dep_path {
                                            eprintln!(
                                                "Best matching {} differs from location {} for dependency {} of package {}",
                                                best,
                                                dep_path,
                                                dep.pattern(),
                                                pkg.pkgname.pkgname()
                                            );
                                        }
                                    }
                                }
                            }
                            if !is_satisfied(pkg_depends, pattern)
                                && !pkg_depends.contains(&pkgname)
                            {
                                pkg_depends.push(pkgname.clone());
                            }
                            match_cache.insert(dep.pattern().to_string(), pkgname.clone());
                            if use_active_filter && !active.contains(&pkgname) {
                                active.insert(pkgname.clone());
                                new_active = true;
                            }
                        }
                        Ok(None) => {
                            let fail_reason =
                                format!("\"could not resolve dependency \"{}\"\"", dep.pattern());
                            pkg.pkg_fail_reason = Some(fail_reason);
                            let msg = format!(
                                "No match found for dependency {} of package {}",
                                dep.pattern(),
                                pkg.pkgname.pkgname()
                            );
                            match skip_reasons.get_mut(&pkg.pkgname) {
                                Some(PackageState::Unresolved(detail)) => {
                                    detail.push('\n');
                                    detail.push_str(&msg);
                                }
                                None => {
                                    skip_reasons
                                        .insert(pkg.pkgname.clone(), PackageState::Unresolved(msg));
                                }
                                _ => {}
                            }
                        }
                    }
                }
                pkg.all_depends = Some(all_deps);
            }
            if !use_active_filter || !new_active {
                break;
            }
        }

        Self::propagate_failures(&depends, &mut skip_reasons);

        let mut packages: Vec<ScanResult> = Vec::new();
        let mut count_buildable = 0;
        let mut count_filtered = 0;

        for (pkgname, mut index) in std::mem::take(&mut self.packages) {
            if use_active_filter && !active.contains(&pkgname) {
                count_filtered += 1;
                continue;
            }

            let Some(pkgpath) = index.pkg_location.clone() else {
                error!(%pkgname, "Package missing PKG_LOCATION, skipping");
                continue;
            };
            let resolved_depends = depends.remove(&pkgname).unwrap_or_default();
            let result = match skip_reasons.remove(&pkgname) {
                Some(state) => ScanResult::Skipped {
                    pkgpath,
                    state,
                    index: Some(index),
                    resolved_depends,
                },
                None => {
                    count_buildable += 1;
                    index.resolved_depends = Some(resolved_depends);
                    ScanResult::Buildable(ResolvedPackage { index, pkgpath })
                }
            };
            packages.push(result);
        }

        if count_filtered > 0 {
            debug!(
                count_filtered,
                "Filtered inactive packages (not needed for resolution)"
            );
        }

        for (pkgpath, error) in &self.scan_failures {
            packages.push(ScanResult::ScanFail {
                pkgpath: pkgpath.clone(),
                error: error.clone(),
            });
        }

        debug!(count_buildable, "Checking for circular dependencies");
        Self::check_circular_deps(&packages)?;

        let pkgpaths = packages
            .iter()
            .map(|p| p.pkgpath())
            .collect::<HashSet<_>>()
            .len();
        let summary = ScanSummary { pkgpaths, packages };

        let c = summary.counts();
        info!(
            buildable = c.buildable,
            preskip = c.states[PackageStateKind::PreSkipped],
            prefail = c.states[PackageStateKind::PreFailed],
            unresolved = c.states[PackageStateKind::Unresolved],
            "Resolution complete"
        );

        Ok(summary)
    }

    /**
     * Resolve dependencies and report results.
     *
     * Loads scan data from database, resolves dependencies, stores resolved
     * dependencies back to database, and reports any unresolved dependency
     * errors. Optionally bails if `strict` is true.
     */
    pub fn resolve_with_report(
        &mut self,
        db: &crate::db::Database,
        strict: bool,
    ) -> Result<ScanSummary> {
        crate::print_status("Resolving dependencies");
        let start = std::time::Instant::now();
        let scan_data = db.get_all_scan_data()?;
        let result = self.resolve(scan_data)?;
        db.store_resolved_selection(&result)?;
        db.store_resolved_deps(&result)?;
        db.store_scan_skipped(&result)?;
        db.store_scan_failures(&result)?;
        crate::print_elapsed("Resolving dependencies", start.elapsed());

        let errors: Vec<_> = result.errors().collect();
        if !errors.is_empty() {
            eprintln!("Scan/resolve errors:\n  {}", errors.join("\n  "));
            if strict {
                bail!("Aborting due to scan/resolve errors (strict_scan enabled)");
            }
        }

        Ok(result)
    }
}

fn find_cycle<'a>(graph: &'a DiGraphMap<&'a str, ()>) -> Option<Vec<&'a str>> {
    let mut visited = HashSet::new();
    let mut in_stack = HashSet::new();
    let mut stack = Vec::new();

    for node in graph.nodes() {
        if visited.contains(&node) {
            continue;
        }
        if let Some(cycle) = dfs(graph, node, &mut visited, &mut stack, &mut in_stack) {
            return Some(cycle);
        }
    }
    None
}

fn dfs<'a>(
    graph: &'a DiGraphMap<&'a str, ()>,
    node: &'a str,
    visited: &mut HashSet<&'a str>,
    stack: &mut Vec<&'a str>,
    in_stack: &mut HashSet<&'a str>,
) -> Option<Vec<&'a str>> {
    visited.insert(node);
    stack.push(node);
    in_stack.insert(node);
    for neighbor in graph.neighbors(node) {
        if in_stack.contains(neighbor) {
            if let Some(pos) = stack.iter().position(|&n| n == neighbor) {
                return Some(stack[pos..].to_vec());
            }
        } else if !visited.contains(neighbor) {
            let cycle = dfs(graph, neighbor, visited, stack, in_stack);
            if cycle.is_some() {
                return cycle;
            }
        }
    }
    stack.pop();
    in_stack.remove(node);
    None
}