deps-core 1.0.0

use tower_lsp_server::ls_types::{CodeLens, Command, Position, Range, TextEdit, Uri};

use crate::ParseResult;
#[cfg(test)]
use crate::PublishTime;

use super::{
    EcosystemFormatter, LineOffsetTable, RequirementStatus, VersionData, is_safe_version_string,
    literal_span_matches, slice_for_range, strip_whitespace, warn_rejected_value,
};

/// `workspace/executeCommand` id for the bulk "Pin N {noun} to commit SHA" code lens.
///
/// Issue #633, generalized cross-ecosystem in #640 — shared by every ecosystem that
/// overrides [`crate::Ecosystem::collect_pin_all_to_sha_edits`], mirroring
/// `deps-lsp.updateAllOutdated`'s single-command-for-every-ecosystem shape.
pub const PIN_ALL_TO_SHA_COMMAND_ID: &str = "deps-lsp.pinAllToSha";

/// Singular/plural noun for an ecosystem's bulk "Pin N {noun} to commit SHA" lens title,
/// consulted by [`build_pin_all_to_sha_lens`] — see
/// [`crate::Ecosystem::pin_all_to_sha_noun`].
// Exhaustive: closed singular/plural pair — every ecosystem implementing
// `pin_all_to_sha_noun` constructs this by literal, and a third field would need a new
// concept entirely, not an extension of this one (issue #769).
#[derive(Debug, Clone, Copy)]
pub struct PinNoun {
    /// Singular form, e.g. `"action"`.
    pub singular: &'static str,
    /// Plural form, e.g. `"actions"`.
    pub plural: &'static str,
}

/// Manifest edits bringing every safely-editable outdated dependency to `latest`.
///
/// A dependency is included when all of the following hold:
/// - it declares a `version_range` (a span to rewrite exists);
/// - a `latest` version is known in `versions.cached` (normalized name first, then raw —
///   mirroring [`crate::lsp_helpers::generate_diagnostics_from_cache`]);
/// - `formatter.is_requirement_up_to_date` reports the declared requirement as *not*
///   satisfying `latest` — the same predicate diagnostics use, so on a fixture where the
///   guard below is a no-op, `collect_update_all_edits(..).len()` equals the number of
///   `generate_diagnostics_from_cache` "Newer version available" diagnostics;
/// - the **literal-span guard** (`literal_span_matches`): `content` sliced over
///   `version_range` must still be (up to whitespace and NuGet's bracket wrap) the
///   literal text — [`Dependency::version_literal`](crate::Dependency::version_literal)
///   when the ecosystem provides one (e.g. `deps-swift`, whose synthesized comparator
///   requirement string diverges from the bare literal `version_range` spans), falling
///   back to the declared requirement text otherwise. Some ecosystems point
///   `version_range` at something that is not a version literal at all — a Maven
///   `${property}` reference or a Gradle DSL variable/version-catalog alias — and
///   rewriting those spans would corrupt the manifest instead of fixing it. A dependency
///   that fails the guard is skipped entirely: neither counted nor edited.
///
/// Accepted edits are sorted by start position; a later edit whose start falls before the
/// previous edit's end (an overlap — a `WorkspaceEdit` protocol violation) is dropped with
/// a `tracing::warn!`. No current parser produces overlapping `version_range`s, so this is
/// a guard against future parser changes, not an expected code path.
///
/// `content` is the manifest source, needed for the literal-span guard above — the same
/// parameter [`Ecosystem::generate_completions`](crate::Ecosystem::generate_completions)
/// already threads through for a similar reason.
///
/// # Examples
///
/// ```
/// use deps_core::lsp_helpers::{
///     collect_update_all_edits, DiagnosticMessages, DiagnosticPolicy, OsvNaming, PackageNaming,
///     PackageRendering, PackageVersions, RequirementResolution, SourcePolicy, VersionData,
/// };
/// use deps_core::{ConcreteVersion, Dependency, ParseResult, PackageName, VersionReq};
/// use std::any::Any;
/// use std::collections::HashMap;
/// use tower_lsp_server::ls_types::{Position, Range, Uri};
///
/// struct MockFormatter;
/// impl PackageNaming for MockFormatter {}
/// impl PackageRendering for MockFormatter {
///     fn format_version_for_text_edit(&self, version: &ConcreteVersion) -> String {
///         version.to_string()
///     }
///     fn package_url(&self, name: &PackageName) -> String {
///         format!("https://example.com/{name}")
///     }
/// }
/// impl RequirementResolution for MockFormatter {}
/// impl DiagnosticMessages for MockFormatter {}
/// impl DiagnosticPolicy for MockFormatter {}
/// impl SourcePolicy for MockFormatter {}
/// impl OsvNaming for MockFormatter {}
///
/// struct MockDep {
///     name: PackageName,
///     version_req: VersionReq,
///     version_range: Range,
///     name_range: Range,
/// }
/// impl Dependency for MockDep {
///     fn name(&self) -> &PackageName { &self.name }
///     fn name_range(&self) -> Range { self.name_range }
///     fn version_requirement(&self) -> Option<&VersionReq> { Some(&self.version_req) }
///     fn version_range(&self) -> Option<Range> { Some(self.version_range) }
///     fn source(&self) -> deps_core::parser::DependencySource {
///         deps_core::parser::DependencySource::Registry
///     }
///     fn as_any(&self) -> &dyn Any { self }
/// }
///
/// struct MockParseResult { deps: Vec<MockDep>, uri: Uri }
/// impl ParseResult for MockParseResult {
///     fn dependencies(&self) -> Vec<&dyn Dependency> {
///         self.deps.iter().map(|d| d as &dyn Dependency).collect()
///     }
///     fn workspace_root(&self) -> Option<&std::path::Path> { None }
///     fn uri(&self) -> &Uri { &self.uri }
///     fn as_any(&self) -> &dyn Any { self }
/// }
///
/// let content = r#"serde = "1.0.0""#;
/// let parse_result = MockParseResult {
///     deps: vec![MockDep {
///         name: PackageName::new("serde"),
///         version_req: VersionReq::new("1.0.0"),
///         version_range: Range::new(Position::new(0, 9), Position::new(0, 14)),
///         name_range: Range::new(Position::new(0, 0), Position::new(0, 5)),
///     }],
///     uri: deps_core::test_util::test_uri("/test/Cargo.toml"),
/// };
///
/// let mut cached = HashMap::new();
/// cached.insert("serde".into(), PackageVersions::latest_only("1.2.0"));
/// let resolved = HashMap::new();
///
/// let edits = collect_update_all_edits(
///     &parse_result,
///     content,
///     VersionData::new(&cached, &resolved),
///     &MockFormatter,
/// );
///
/// assert_eq!(edits.len(), 1);
/// assert_eq!(edits[0].new_text, "1.2.0");
/// ```
pub fn collect_update_all_edits(
    parse_result: &dyn ParseResult,
    content: &str,
    versions: VersionData<'_>,
    formatter: &dyn EcosystemFormatter,
) -> Vec<TextEdit> {
    let deps = parse_result.dependencies();
    let mut edits: Vec<TextEdit> = Vec::with_capacity(deps.len());
    // Built once and reused for every dependency below — content is fixed for the
    // whole call, so re-scanning it per dependency would be O(n²) in dependency count.
    let line_offsets = LineOffsetTable::new(content);

    for dep in deps {
        let Some(version_range) = dep.version_range() else {
            continue;
        };

        let normalized_name = formatter.normalize_package_name(dep.name());
        let Some(latest) = versions
            .cached
            .get(normalized_name.as_str())
            .or_else(|| versions.cached.get(dep.name()))
            .map(|v| &v.latest)
        else {
            continue;
        };
        if !is_safe_version_string(latest.as_str()) {
            warn_rejected_value(
                "is_safe_version_string",
                "update-all code lens edit",
                latest.as_str(),
            );
            continue;
        }

        let Some(version_req) = dep.version_requirement() else {
            continue;
        };
        if version_req.as_str().is_empty() {
            // Defense-in-depth: an empty requirement would trivially satisfy the guard
            // below (both sides normalize to ""), so without this, a future formatter
            // whose `is_requirement_up_to_date` doesn't treat "" as up to date could
            // emit an edit anchored on a span that was never a version literal.
            continue;
        }
        // `requirement_status_for` (not the bare `is_requirement_up_to_date`), matching
        // `diagnostics.rs`'s `apply_outdated_rule` and `inlay_hints.rs` (#907 review
        // follow-up): lets e.g. `GithubActionsFormatter` prefer a SHA pin's
        // registry-confirmed tag over trusting its own comment text, so the "Update N
        // outdated" count/bulk-edit agrees with what inlay hints/diagnostics show for
        // the same dependency instead of silently excluding it.
        if formatter.requirement_status_for(dep, version_req, latest) != RequirementStatus::Outdated
        {
            continue;
        }

        // TODO(critic): intentionally not calling `dependency_version_range_is_literal`
        // (#919) here — empty-requirement semantics differ (edit: nothing to update;
        // completion: everything to offer), and this loop hoists its own `line_offsets`
        // across every dependency rather than rebuilding one per call.
        let slice = slice_for_range(content, &line_offsets, version_range);
        let literal_target = dep
            .version_literal()
            .unwrap_or_else(|| version_req.as_str());
        if !literal_span_matches(slice, literal_target) {
            continue;
        }

        let new_text = formatter.format_version_replacing_for(dep, latest, version_req.as_str());
        // No-op guard, mirroring the REFACTOR-loop dedup and vulnerability-fix N1
        // guard in `code_actions`: a formatter can decide a declared
        // requirement has no single unambiguous rewrite (e.g. `deps-gradle`'s
        // `{strictly}!!{preferred}` shorthand, left unchanged rather than risking a
        // destructive or misleading edit) and return it unchanged. Without this
        // check, such a dependency would still count toward — and appear fixed
        // by — the "Update N outdated dependencies" lens while its click applies
        // nothing. Compares against `literal_target` (not `version_req`) for the same
        // reason the literal-span guard above does: for `deps-swift`, `version_req` is a
        // synthesized comparator that never equals the bare-literal formatted text even
        // when the edit genuinely is a no-op.
        if strip_whitespace(&new_text) == strip_whitespace(literal_target) {
            continue;
        }

        edits.push(TextEdit {
            range: version_range,
            new_text,
        });
    }

    dedup_overlapping_edits(edits, "collect_update_all_edits")
}

/// Sorts `edits` by start position and drops any edit whose start falls before the
/// previous (surviving) edit's end — a `WorkspaceEdit` protocol violation no LSP client
/// can apply.
///
/// `caller` names the collector in the `tracing::warn!` emitted for each dropped edit, so
/// a log line is traceable back to which bulk command produced it.
///
/// Shared by every "collect edits for a bulk `WorkspaceEdit`" aggregator in the
/// workspace (issue #633 critic M3: a sibling collector omitting this pass — while every
/// current parser happens not to produce overlapping spans — is exactly the kind of
/// divergence the project's cross-ecosystem-consistency rule exists to catch) —
/// currently [`collect_update_all_edits`] and
/// `deps_github_actions::ecosystem::collect_pin_all_to_sha_edits`.
pub fn dedup_overlapping_edits(mut edits: Vec<TextEdit>, caller: &str) -> Vec<TextEdit> {
    edits.sort_by_key(|edit| (edit.range.start.line, edit.range.start.character));

    let mut non_overlapping: Vec<TextEdit> = Vec::with_capacity(edits.len());
    for edit in edits {
        let overlaps_prev = non_overlapping.last().is_some_and(|prev: &TextEdit| {
            (edit.range.start.line, edit.range.start.character)
                < (prev.range.end.line, prev.range.end.character)
        });
        if overlaps_prev {
            tracing::warn!(
                range = ?edit.range,
                caller,
                "dropping overlapping TextEdit"
            );
            continue;
        }
        non_overlapping.push(edit);
    }

    non_overlapping
}

/// Zero or one lens for the document, bound to `command_id`.
///
/// Delegates to [`collect_update_all_edits`] for the count in the lens title — the same
/// call the command handler makes to produce the edits it applies, so `title N == edits
/// applied` holds by construction rather than by two implementations agreeing. Returns no
/// lens when there is nothing to update: a permanent line-0 annotation on every
/// up-to-date manifest would be noise.
///
/// # Examples
///
/// ```
/// use deps_core::lsp_helpers::{
///     generate_code_lenses, DiagnosticMessages, DiagnosticPolicy, OsvNaming, PackageNaming,
///     PackageRendering, RequirementResolution, SourcePolicy, VersionData,
/// };
/// use deps_core::{ConcreteVersion, PackageName, ParseResult};
/// use std::collections::HashMap;
///
/// struct MockFormatter;
/// impl PackageNaming for MockFormatter {}
/// impl PackageRendering for MockFormatter {
///     fn format_version_for_text_edit(&self, version: &ConcreteVersion) -> String {
///         version.to_string()
///     }
///     fn package_url(&self, name: &PackageName) -> String {
///         format!("https://example.com/{name}")
///     }
/// }
/// impl RequirementResolution for MockFormatter {}
/// impl DiagnosticMessages for MockFormatter {}
/// impl DiagnosticPolicy for MockFormatter {}
/// impl SourcePolicy for MockFormatter {}
/// impl OsvNaming for MockFormatter {}
///
/// // An empty parse result yields no outdated dependencies, so no lens is generated.
/// # struct EmptyParseResult { uri: tower_lsp_server::ls_types::Uri }
/// # impl deps_core::ParseResult for EmptyParseResult {
/// #     fn dependencies(&self) -> Vec<&dyn deps_core::Dependency> { vec![] }
/// #     fn workspace_root(&self) -> Option<&std::path::Path> { None }
/// #     fn uri(&self) -> &tower_lsp_server::ls_types::Uri { &self.uri }
/// #     fn as_any(&self) -> &dyn std::any::Any { self }
/// # }
/// let parse_result = EmptyParseResult { uri: deps_core::test_util::test_uri("/test/Cargo.toml") };
/// let cached = HashMap::new();
/// let resolved = HashMap::new();
///
/// let lenses = generate_code_lenses(
///     &parse_result,
///     "",
///     VersionData::new(&cached, &resolved),
///     &MockFormatter,
///     parse_result.uri(),
///     "deps-lsp.updateAllOutdated",
/// );
///
/// assert!(lenses.is_empty());
/// ```
pub fn generate_code_lenses(
    parse_result: &dyn ParseResult,
    content: &str,
    versions: VersionData<'_>,
    formatter: &dyn EcosystemFormatter,
    uri: &Uri,
    command_id: &str,
) -> Vec<CodeLens> {
    let edits = collect_update_all_edits(parse_result, content, versions, formatter);
    if edits.is_empty() {
        return Vec::new();
    }

    let count = edits.len();
    let title = if count == 1 {
        "Update 1 outdated dependency".to_string()
    } else {
        format!("Update {count} outdated dependencies")
    };

    vec![CodeLens {
        range: Range::new(Position::new(0, 0), Position::new(0, 0)),
        command: Some(Command {
            title,
            command: command_id.to_string(),
            arguments: Some(vec![serde_json::json!({ "uri": uri })]),
        }),
        data: None,
    }]
}

/// Zero or one lens for the bulk "Pin N {noun} to commit SHA" command, from an
/// already-computed edit `count`.
///
/// Issue #633, generalized cross-ecosystem in #640 — the caller (`deps-lsp`'s
/// `handlers::code_lens`) takes `count = ecosystem.collect_pin_all_to_sha_edits(..).len()`
/// itself, so the lens title and the edits the `deps-lsp.pinAllToSha` command applies can
/// never disagree about how many there are. Returns no lens when `count` is zero — a
/// permanent line-0 annotation on a manifest with nothing to pin would be noise.
///
/// # Examples
///
/// ```
/// use deps_core::lsp_helpers::{PinNoun, build_pin_all_to_sha_lens};
///
/// let uri = deps_core::test_util::test_uri("/repo/.github/workflows/ci.yml");
/// let noun = PinNoun { singular: "action", plural: "actions" };
///
/// assert!(build_pin_all_to_sha_lens(0, noun, &uri).is_none());
///
/// let lens = build_pin_all_to_sha_lens(1, noun, &uri).unwrap();
/// let command = lens.command.unwrap();
/// assert_eq!(command.title, "Pin 1 action to commit SHA");
/// assert_eq!(command.command, deps_core::lsp_helpers::PIN_ALL_TO_SHA_COMMAND_ID);
///
/// let lens = build_pin_all_to_sha_lens(3, noun, &uri).unwrap();
/// assert_eq!(lens.command.unwrap().title, "Pin 3 actions to commit SHA");
/// ```
#[must_use]
pub fn build_pin_all_to_sha_lens(count: usize, noun: PinNoun, uri: &Uri) -> Option<CodeLens> {
    if count == 0 {
        return None;
    }

    let title = if count == 1 {
        format!("Pin 1 {} to commit SHA", noun.singular)
    } else {
        format!("Pin {count} {} to commit SHA", noun.plural)
    };

    Some(CodeLens {
        range: Range::new(Position::new(0, 0), Position::new(0, 0)),
        command: Some(Command {
            title,
            command: PIN_ALL_TO_SHA_COMMAND_ID.to_string(),
            arguments: Some(vec![serde_json::json!({ "uri": uri })]),
        }),
        data: None,
    })
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::lsp_helpers::test_support::*;
    use crate::lsp_helpers::*;
    use crate::{ConcreteVersion, Dependency, PackageName, VersionReq};
    use std::any::Any;
    use std::collections::HashMap;

    mod update_all_edits_tests {
        use super::*;
        use tower_lsp_server::ls_types::{Position, Range};

        struct UaeDep {
            name: PackageName,
            version_req: Option<VersionReq>,
            version_range: Option<Range>,
        }

        impl Dependency for UaeDep {
            fn name(&self) -> &PackageName {
                &self.name
            }
            fn name_range(&self) -> Range {
                Range::default()
            }
            fn version_requirement(&self) -> Option<&VersionReq> {
                self.version_req.as_ref()
            }
            fn version_range(&self) -> Option<Range> {
                self.version_range
            }
            fn source(&self) -> crate::parser::DependencySource {
                crate::parser::DependencySource::Registry
            }
            fn as_any(&self) -> &dyn Any {
                self
            }
        }

        struct UaeParseResult {
            deps: Vec<UaeDep>,
            uri: Uri,
        }

        impl ParseResult for UaeParseResult {
            fn dependencies(&self) -> Vec<&dyn Dependency> {
                self.deps.iter().map(|d| d as &dyn Dependency).collect()
            }
            fn workspace_root(&self) -> Option<&std::path::Path> {
                None
            }
            fn uri(&self) -> &Uri {
                &self.uri
            }
            fn as_any(&self) -> &dyn Any {
                self
            }
        }

        fn range(sl: u32, sc: u32, el: u32, ec: u32) -> Range {
            Range::new(Position::new(sl, sc), Position::new(el, ec))
        }

        fn dep(name: &str, req: Option<&str>, vr: Option<Range>) -> UaeDep {
            UaeDep {
                name: PackageName::new(name),
                version_req: req.map(VersionReq::new),
                version_range: vr,
            }
        }

        fn parse_result(deps: Vec<UaeDep>) -> UaeParseResult {
            UaeParseResult {
                deps,
                uri: crate::test_util::test_uri("/test/Cargo.toml"),
            }
        }

        /// A formatter whose `is_requirement_up_to_date` ignores range semantics and
        /// always reports "not up to date" — mirrors NuGet's bare-requirement-is-a-floor
        /// override (`crates/deps-nuget/src/formatter.rs`), used to prove the override
        /// point is actually consulted rather than the trait default. Appends `-forced`
        /// in `format_version_for_text_edit` so the resulting edit is never a no-op: the
        /// override-is-honored test below intentionally declares a requirement already
        /// textually identical to `latest` (to isolate "was the hook consulted" from "is
        /// this genuinely outdated"), which would otherwise be indistinguishable from a
        /// real no-op and get filtered by `collect_update_all_edits`'s no-op guard.
        struct FloorFormatter;

        impl PackageNaming for FloorFormatter {}

        impl PackageRendering for FloorFormatter {
            fn format_version_for_text_edit(&self, version: &ConcreteVersion) -> String {
                format!("{version}-forced")
            }

            fn package_url(&self, name: &PackageName) -> String {
                format!("https://example.com/{name}")
            }
        }

        impl RequirementResolution for FloorFormatter {
            fn is_requirement_up_to_date(
                &self,
                _requirement: &VersionReq,
                _latest: &ConcreteVersion,
            ) -> bool {
                false
            }
        }

        impl DiagnosticMessages for FloorFormatter {}

        impl DiagnosticPolicy for FloorFormatter {}

        impl SourcePolicy for FloorFormatter {}

        impl OsvNaming for FloorFormatter {}

        #[test]
        fn test_zero_outdated_returns_empty_edits_and_no_lens() {
            let content = r#"serde = "1.0.0""#;
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14)))]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("1.0.0"));
            let resolved = HashMap::new();
            let versions = VersionData::new(&cached, &resolved);

            let edits = collect_update_all_edits(&pr, content, versions, &MockFormatter);
            assert!(edits.is_empty());

            let lenses = generate_code_lenses(
                &pr,
                content,
                versions,
                &MockFormatter,
                pr.uri(),
                "deps-lsp.updateAllOutdated",
            );
            assert!(lenses.is_empty());
        }

        #[test]
        fn test_n_outdated_produces_n_edits_with_expected_range_and_text() {
            let content = "serde = \"1.0.0\"\ntokio = \"1.0.0\"\n";
            let pr = parse_result(vec![
                dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14))),
                dep("tokio", Some("1.0.0"), Some(range(1, 9, 1, 14))),
            ]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("1.2.0"));
            cached.insert("tokio".into(), PackageVersions::latest_only("1.3.0"));
            let resolved = HashMap::new();
            let versions = VersionData::new(&cached, &resolved);

            let edits = collect_update_all_edits(&pr, content, versions, &MockFormatter);
            assert_eq!(edits.len(), 2);
            assert_eq!(edits[0].range, range(0, 9, 0, 14));
            assert_eq!(
                edits[0].new_text,
                MockFormatter.format_version_for_text_edit(&ConcreteVersion::new("1.2.0"))
            );
            assert_eq!(edits[1].range, range(1, 9, 1, 14));
            assert_eq!(
                edits[1].new_text,
                MockFormatter.format_version_for_text_edit(&ConcreteVersion::new("1.3.0"))
            );

            let lenses = generate_code_lenses(
                &pr,
                content,
                versions,
                &MockFormatter,
                pr.uri(),
                "deps-lsp.updateAllOutdated",
            );
            assert_eq!(lenses.len(), 1);
            let command = lenses[0].command.as_ref().expect("lens has a command");
            assert_eq!(command.title, "Update 2 outdated dependencies");
            assert_eq!(command.command, "deps-lsp.updateAllOutdated");
        }

        #[test]
        fn test_singular_title_for_one_outdated_dependency() {
            let content = r#"serde = "1.0.0""#;
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14)))]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("1.2.0"));
            let resolved = HashMap::new();
            let versions = VersionData::new(&cached, &resolved);

            let lenses = generate_code_lenses(
                &pr,
                content,
                versions,
                &MockFormatter,
                pr.uri(),
                "deps-lsp.updateAllOutdated",
            );
            assert_eq!(lenses.len(), 1);
            assert_eq!(
                lenses[0].command.as_ref().unwrap().title,
                "Update 1 outdated dependency"
            );
        }

        #[test]
        fn test_missing_version_range_is_skipped() {
            let content = "serde = \"1.0.0\"\n";
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), None)]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("1.2.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_empty_version_requirement_is_skipped() {
            // Defense-in-depth (H2): an empty requirement would trivially satisfy
            // `literal_span_matches` if the guard were reached (both sides normalize to
            // "") and the span text would then be discarded and overwritten outright —
            // this must never reach the guard in the first place.
            let content = "pkg = \"\"\n";
            let pr = parse_result(vec![dep("pkg", Some(""), Some(range(0, 6, 0, 6)))]);
            let mut cached = HashMap::new();
            cached.insert("pkg".into(), PackageVersions::latest_only("1.0.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(
                edits.is_empty(),
                "an empty version requirement must never produce an edit"
            );
        }

        #[test]
        fn test_dependency_absent_from_cache_is_skipped() {
            let content = "git-dep = \"1.0.0\"\n";
            let pr = parse_result(vec![dep(
                "git-dep",
                Some("1.0.0"),
                Some(range(0, 11, 0, 16)),
            )]);
            let cached = HashMap::new();
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_empty_cached_latest_is_skipped() {
            // Regression for #303: an empty cached `latest` must never produce an
            // edit — the old no-op guard (comparing formatted text to the declared
            // requirement) doesn't catch this because `"" != "1.0.0"`, so without an
            // explicit guard the requirement gets erased instead of updated.
            let content = "serde = \"1.0.0\"\n";
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14)))]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only(""));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(
                edits.is_empty(),
                "an empty cached latest must never produce a requirement-erasing edit"
            );
        }

        #[test]
        fn test_whitespace_only_cached_latest_is_skipped() {
            let content = "serde = \"1.0.0\"\n";
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14)))]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("   "));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_cached_latest_with_unsafe_characters_is_skipped() {
            // Regression for #302: a registry-cached `latest` containing manifest-
            // structural characters must never be written verbatim into a `TextEdit`.
            let content = "serde = \"1.0.0\"\n";
            let pr = parse_result(vec![dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14)))]);
            let mut cached = HashMap::new();
            cached.insert(
                "serde".into(),
                PackageVersions::latest_only("1.2.0\", \"evil\": \"true"),
            );
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_requirement_already_accepts_latest_is_not_counted() {
            // "^1.0" already accepts "1.2.0" per the default `is_requirement_up_to_date`,
            // so no edit is produced even though `latest` differs from the source text.
            let content = "serde = \"^1.0\"\n";
            let pr = parse_result(vec![dep("serde", Some("^1.0"), Some(range(0, 9, 0, 13)))]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("1.2.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_formatter_is_requirement_up_to_date_override_is_honored() {
            // With the trait default, "1.0.0" satisfying "1.0.0" would be up to date.
            // `FloorFormatter` overrides the hook to always report outdated, proving
            // `collect_update_all_edits` calls through the formatter, not the default.
            let content = r#"pkg = "1.0.0""#;
            let pr = parse_result(vec![dep("pkg", Some("1.0.0"), Some(range(0, 7, 0, 12)))]);
            let mut cached = HashMap::new();
            cached.insert("pkg".into(), PackageVersions::latest_only("1.0.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &FloorFormatter,
            );
            assert_eq!(edits.len(), 1);
            assert_eq!(edits[0].new_text, "1.0.0-forced");
        }

        #[test]
        fn test_no_op_edit_is_excluded() {
            // M2: a formatter can decide a declared requirement has no single
            // unambiguous rewrite and return it unchanged (e.g. `deps-gradle`'s
            // `{strictly}!!{preferred}` infix shorthand). Without a no-op guard, this
            // dependency would still count toward, and be "fixed" by, the "Update N
            // outdated dependencies" lens while applying nothing.
            struct NoOpFormatter;
            impl PackageNaming for NoOpFormatter {}

            impl PackageRendering for NoOpFormatter {
                fn format_version_for_text_edit(&self, version: &ConcreteVersion) -> String {
                    version.to_string()
                }

                fn package_url(&self, name: &PackageName) -> String {
                    format!("https://example.com/{name}")
                }

                fn format_version_replacing(
                    &self,
                    _version: &ConcreteVersion,
                    current: &str,
                ) -> String {
                    current.to_string()
                }
            }

            impl RequirementResolution for NoOpFormatter {
                fn is_requirement_up_to_date(
                    &self,
                    _requirement: &VersionReq,
                    _latest: &ConcreteVersion,
                ) -> bool {
                    false
                }
            }

            impl DiagnosticMessages for NoOpFormatter {}

            impl DiagnosticPolicy for NoOpFormatter {}

            impl SourcePolicy for NoOpFormatter {}

            impl OsvNaming for NoOpFormatter {}

            let content = r#"pkg = "1.0.0""#;
            let pr = parse_result(vec![dep("pkg", Some("1.0.0"), Some(range(0, 7, 0, 12)))]);
            let mut cached = HashMap::new();
            cached.insert("pkg".into(), PackageVersions::latest_only("1.2.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &NoOpFormatter,
            );
            assert!(edits.is_empty());
        }

        #[test]
        fn test_guard_rejects_span_that_is_not_the_requirement() {
            // Simulates the Maven `${property}` class: version_range spans a reference,
            // version_requirement is the already-resolved value.
            let content = "<version>${slf4j.version}</version>";
            let pr = parse_result(vec![dep(
                "slf4j-api",
                Some("2.0.16"),
                Some(range(0, 9, 0, 25)),
            )]);
            let mut cached = HashMap::new();
            cached.insert("slf4j-api".into(), PackageVersions::latest_only("2.1.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(
                edits.is_empty(),
                "a version_range spanning a property reference must not be edited"
            );
        }

        #[test]
        fn test_guard_accepts_whitespace_only_difference() {
            // PyPI's pep508 round-trip: `version_requirement()` is normalized to
            // ">=1.7, <2.0" while `version_range` still spans the un-normalized source.
            let content = "pkg>=1.7,<2.0";
            let pr = parse_result(vec![dep(
                "pkg",
                Some(">=1.7, <2.0"),
                Some(range(0, 3, 0, 13)),
            )]);
            let mut cached = HashMap::new();
            cached.insert("pkg".into(), PackageVersions::latest_only("3.0.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(edits.len(), 1, "whitespace-only divergence must not skip");
        }

        #[test]
        fn test_guard_accepts_nuget_bracket_wrap() {
            // NuGet wraps a bare source version as the requirement: source "1.0.0" ->
            // requirement "[1.0.0]". The guard's bracket branch is the exact inverse.
            let content = r#"<PackageReference Include="Newtonsoft.Json" Version="1.0.0" />"#;
            let pr = parse_result(vec![dep(
                "Newtonsoft.Json",
                Some("[1.0.0]"),
                Some(range(0, 53, 0, 58)),
            )]);
            let mut cached = HashMap::new();
            cached.insert(
                "Newtonsoft.Json".into(),
                PackageVersions::latest_only("13.0.3"),
            );
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(
                edits.len(),
                1,
                "NuGet's bracket-wrapped requirement must be kept"
            );
        }

        #[test]
        fn test_guard_accepts_nuget_already_bracketed_source() {
            // The real reason the guard wraps only the slice, not both operands: NuGet's
            // parser wraps *unconditionally* — a source that is already bracketed,
            // `Version="[1.0.0]"`, still yields a double-wrapped requirement `[[1.0.0]]`
            // (`crates/deps-nuget/src/parser.rs`). A symmetric strip would compare
            // `[1.0.0]` against `1.0.0` here and falsely reject an editable dependency;
            // the asymmetric wrap-the-slice rule handles it correctly.
            let content = r#"<PackageReference Include="Newtonsoft.Json" Version="[1.0.0]" />"#;
            let pr = parse_result(vec![dep(
                "Newtonsoft.Json",
                Some("[[1.0.0]]"),
                Some(range(0, 53, 0, 60)),
            )]);
            let mut cached = HashMap::new();
            cached.insert(
                "Newtonsoft.Json".into(),
                PackageVersions::latest_only("13.0.3"),
            );
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(
                edits.len(),
                1,
                "an already-bracketed NuGet source must not be falsely rejected"
            );
        }

        #[test]
        fn test_guard_accepts_nuget_open_ended_lower_bound_spelling() {
            // Another double-bracket NuGet spelling from §4.4's table: source
            // "[1.0.0,]" (open-ended lower bound) wraps to requirement "[[1.0.0,]]".
            let content = r#"<PackageReference Include="Newtonsoft.Json" Version="[1.0.0,]" />"#;
            let pr = parse_result(vec![dep(
                "Newtonsoft.Json",
                Some("[[1.0.0,]]"),
                Some(range(0, 53, 0, 61)),
            )]);
            let mut cached = HashMap::new();
            cached.insert(
                "Newtonsoft.Json".into(),
                PackageVersions::latest_only("13.0.3"),
            );
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(
                edits.len(),
                1,
                "the open-ended-lower-bound NuGet spelling must not be falsely rejected"
            );
        }

        #[test]
        fn test_guard_accepts_nuget_exclusive_upper_bound_spelling() {
            // Third double-bracket NuGet spelling from §4.4's table: source
            // "[1.0,2.0)" (exclusive upper bound) wraps to requirement "[[1.0,2.0)]".
            let content = r#"<PackageReference Include="Newtonsoft.Json" Version="[1.0,2.0)" />"#;
            let pr = parse_result(vec![dep(
                "Newtonsoft.Json",
                Some("[[1.0,2.0)]"),
                Some(range(0, 53, 0, 62)),
            )]);
            let mut cached = HashMap::new();
            cached.insert(
                "Newtonsoft.Json".into(),
                PackageVersions::latest_only("13.0.3"),
            );
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(
                edits.len(),
                1,
                "the exclusive-upper-bound NuGet spelling must not be falsely rejected"
            );
        }

        #[test]
        fn test_guard_rejects_bracketed_interval_against_unbracketed_requirement() {
            // Regression guard for the OLD (broken) symmetric-strip rule: stripping
            // brackets from *both* operands would wrongly match a Maven-style bracketed
            // interval span `[1.0,2.0]` against an unbracketed requirement `1.0,2.0`.
            // The corrected asymmetric rule only wraps the *slice*, so
            // `format!("[{slice}]")` produces `[[1.0,2.0]]`, which does not equal
            // `1.0,2.0` either — the dependency must be skipped.
            let content = "<version>[1.0,2.0]</version>";
            let pr = parse_result(vec![dep(
                "interval-dep",
                Some("1.0,2.0"),
                Some(range(0, 9, 0, 18)),
            )]);
            let mut cached = HashMap::new();
            cached.insert("interval-dep".into(), PackageVersions::latest_only("3.0.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert!(
                edits.is_empty(),
                "a bracketed interval span must not match an unbracketed requirement"
            );
        }

        #[test]
        fn test_invariant_edit_count_matches_diagnostic_count_when_guard_is_noop() {
            // On a fixture where every span already equals its requirement (the guard is
            // a no-op), the edit count must equal the diagnostic count — same predicate.
            let content = "serde = \"1.0.0\"\ntokio = \"^1.5\"\nunknown = \"1.0.0\"\n";
            let pr = parse_result(vec![
                dep("serde", Some("1.0.0"), Some(range(0, 9, 0, 14))),
                dep("tokio", Some("^1.5"), Some(range(1, 9, 1, 13))),
                dep("unknown", Some("1.0.0"), Some(range(2, 11, 2, 16))),
            ]);
            let mut cached = HashMap::new();
            cached.insert("serde".into(), PackageVersions::latest_only("2.0.0"));
            cached.insert("tokio".into(), PackageVersions::latest_only("1.9.0"));
            let resolved = HashMap::new();
            let versions = VersionData::new(&cached, &resolved);

            let edits = collect_update_all_edits(&pr, content, versions, &MockFormatter);
            let diagnostics = generate_diagnostics_from_cache(
                &pr,
                versions,
                &MockFormatter,
                pr.uri(),
                crate::FreshnessSettings::default(),
                DiagnosticSeverities::default(),
                PublishTime::now(),
            );
            let newer_version_diagnostics = diagnostics
                .iter()
                .filter(|d| d.message.contains("Newer version available"))
                .count();

            assert_eq!(edits.len(), newer_version_diagnostics);
            assert_eq!(edits.len(), 1);
        }

        #[test]
        fn test_overlapping_edits_are_dropped_keeping_the_first() {
            let content = "aaaa = \"1.0.0\"\n";
            // Two dependencies whose declared version_range identically overlaps —
            // synthesizes the protocol-violation case the sort+assert guard exists for.
            let pr = parse_result(vec![
                dep("aaaa", Some("1.0.0"), Some(range(0, 8, 0, 13))),
                dep("aaaa-dup", Some("1.0.0"), Some(range(0, 8, 0, 13))),
            ]);
            let mut cached = HashMap::new();
            cached.insert("aaaa".into(), PackageVersions::latest_only("2.0.0"));
            cached.insert("aaaa-dup".into(), PackageVersions::latest_only("3.0.0"));
            let resolved = HashMap::new();

            let edits = collect_update_all_edits(
                &pr,
                content,
                VersionData::new(&cached, &resolved),
                &MockFormatter,
            );
            assert_eq!(edits.len(), 1, "the overlapping later edit must be dropped");
        }
    }

    mod pin_all_to_sha_lens_tests {
        use super::*;

        fn noun() -> PinNoun {
            PinNoun {
                singular: "action",
                plural: "actions",
            }
        }

        #[test]
        fn test_zero_count_returns_no_lens() {
            let uri = crate::test_util::test_uri("/repo/.github/workflows/ci.yml");
            assert!(build_pin_all_to_sha_lens(0, noun(), &uri).is_none());
        }

        #[test]
        fn test_singular_title_for_one() {
            let uri = crate::test_util::test_uri("/repo/.github/workflows/ci.yml");
            let lens = build_pin_all_to_sha_lens(1, noun(), &uri).unwrap();
            let command = lens.command.unwrap();
            assert_eq!(command.title, "Pin 1 action to commit SHA");
            assert_eq!(command.command, PIN_ALL_TO_SHA_COMMAND_ID);
        }

        #[test]
        fn test_plural_title_for_n() {
            let uri = crate::test_util::test_uri("/repo/.github/workflows/ci.yml");
            let lens = build_pin_all_to_sha_lens(3, noun(), &uri).unwrap();
            assert_eq!(lens.command.unwrap().title, "Pin 3 actions to commit SHA");
        }

        #[test]
        fn test_command_arguments_carry_uri() {
            let uri = crate::test_util::test_uri("/repo/.github/workflows/ci.yml");
            let lens = build_pin_all_to_sha_lens(1, noun(), &uri).unwrap();
            let command = lens.command.unwrap();
            let args = command.arguments.expect("command has arguments");
            assert_eq!(args[0]["uri"], uri.as_str());
        }

        #[test]
        fn test_trait_default_returns_empty() {
            use crate::Ecosystem as _;

            struct DefaultEcosystem;
            impl crate::ecosystem::private::Sealed for DefaultEcosystem {}
            impl crate::Ecosystem for DefaultEcosystem {
                fn ecosystem_id(&self) -> crate::EcosystemId {
                    crate::EcosystemId::Cargo
                }
                fn display_name(&self) -> &'static str {
                    "Default"
                }
                fn manifest_filenames(&self) -> &[&'static str] {
                    &[]
                }
                fn parse_manifest<'a>(
                    &'a self,
                    _content: &'a str,
                    _uri: &'a Uri,
                ) -> crate::ecosystem::BoxFuture<'a, crate::error::Result<Box<dyn ParseResult>>>
                {
                    unimplemented!()
                }
                fn registry(&self) -> std::sync::Arc<dyn crate::Registry> {
                    unimplemented!()
                }
                fn formatter(&self) -> &dyn EcosystemFormatter {
                    unimplemented!()
                }
                fn generate_completions<'a>(
                    &'a self,
                    _parse_result: &'a dyn ParseResult,
                    _position: Position,
                    _content: &'a str,
                    _freshness: crate::FreshnessSettings,
                ) -> crate::ecosystem::BoxFuture<'a, crate::completion::Completions>
                {
                    unimplemented!()
                }
                fn complete_version<'a>(
                    &'a self,
                    _request: crate::completion::CompletionRequest<'a>,
                    _package_name: crate::PackageName,
                    _prefix: String,
                ) -> crate::ecosystem::BoxFuture<'a, crate::completion::Completions>
                {
                    unimplemented!()
                }
                fn completion_insert_text(
                    &self,
                    _metadata: &dyn crate::Metadata,
                ) -> Option<String> {
                    unimplemented!()
                }
                fn as_any(&self) -> &dyn std::any::Any {
                    self
                }
            }

            let eco = DefaultEcosystem;
            let uri = crate::test_util::test_uri("/test/manifest");
            let cached = std::collections::HashMap::new();
            let resolved = std::collections::HashMap::new();
            struct EmptyParseResult {
                uri: Uri,
            }
            impl ParseResult for EmptyParseResult {
                fn dependencies(&self) -> Vec<&dyn crate::Dependency> {
                    vec![]
                }
                fn workspace_root(&self) -> Option<&std::path::Path> {
                    None
                }
                fn uri(&self) -> &Uri {
                    &self.uri
                }
                fn as_any(&self) -> &dyn std::any::Any {
                    self
                }
            }
            let pr = EmptyParseResult { uri };

            let edits = eco.collect_pin_all_to_sha_edits(&pr, VersionData::new(&cached, &resolved));
            assert!(edits.is_empty());
            assert_eq!(eco.pin_all_to_sha_noun().singular, "ref");
            assert_eq!(eco.pin_all_to_sha_noun().plural, "refs");
        }
    }
}