rattler_lock 0.27.7

#![deny(missing_docs, dead_code)]

//! Definitions for a lock-file format that stores information about pinned
//! dependencies from both the Conda and Pypi ecosystem.
//!
//! The crate is structured in two API levels.
//!
//! 1. The top level API accessible through the [`LockFile`] type that exposes
//!    high level access to the lock-file. This API is intended to be relatively
//!    stable and is the preferred way to interact with the lock-file.
//! 2. The `*Data` types. These are lower level types that expose more of the
//!    internal data structures used in the crate. These types are not intended
//!    to be stable and are subject to change over time. These types are used
//!    internally by the top level API. Also note that only a subset of the
//!    `*Data` types are exposed. See `[crate::PyPiPackageData]`,
//!    `[crate::CondaPackageData]` for examples.
//!
//! ## Design goals
//!
//! The goal of the lock-file format is:
//!
//! * To be complete. The lock-file should contain all the information needed to
//!   recreate environments even years after it was created. As long as the
//!   package data persists that a lock-file refers to, it should be possible to
//!   recreate the environment.
//! * To be human readable. Although lock-files are not intended to be edited by
//!   hand, they should be relatively easy to read and understand. So that when
//!   a lock-file is checked into version control and someone looks at the diff,
//!   they can understand what changed.
//! * To be easily parse-able. It should be fairly straightforward to create a
//!   parser for the format so that it can be used in other tools.
//! * To reduce diff size when the content changes. The order of content in the
//!   serialized lock-file should be fixed to ensure that the diff size is
//!   minimized when the content changes.
//! * To be reproducible. Recreating the lock-file with the exact same input
//!   (including externally fetched data) should yield the same lock-file
//!   byte-for-byte.
//! * To be statically verifiable. Given the specifications of the packages that
//!   went into a lock-file it should be possible to cheaply verify whether or
//!   not the specifications are still satisfied by the packages stored in the
//!   lock-file.
//! * Backward compatible. Older version of lock-files should still be readable
//!   by never versions of this crate.
//!
//! ## Relation to conda-lock
//!
//! Initially the lock-file format was based on [`conda-lock`](https://github.com/conda/conda-lock)
//! but over time significant changes have been made compared to the original
//! conda-lock format. Conda-lock files (e.g. `conda-lock.yml` files) can still
//! be parsed by this crate but the serialization format changed significantly.
//! This means files created by this crate are not compatible with conda-lock.
//!
//! Conda-lock stores a lot of metadata to be able to verify if the lock-file is
//! still valid given the sources/inputs. For example conda-lock contains a
//! `content-hash` which is a hash of all the input data of the lock-file.
//! This crate approaches this differently by storing enough information in the
//! lock-file to be able to verify if the lock-file still satisfies an
//! input/source without requiring additional input (e.g. network requests) or
//! expensive solves. We call this static satisfiability verification.
//!
//! Conda-lock stores a custom __partial__ representation of a
//! [`rattler_conda_types::RepoDataRecord`] in the lock-file. This poses a
//! problem when incrementally updating an environment. To only partially update
//! packages in the lock-file without completely recreating it, the records
//! stored in the lock-file need to be passed to the solver as "preferred"
//! packages. Since [`rattler_conda_types::MatchSpec`] can match on any field
//! present in a [`rattler_conda_types::PackageRecord`] we need to store all
//! fields in the lock-file not just a subset.
//! To that end this crate stores the full
//! [`rattler_conda_types::PackageRecord`] in the lock-file. This allows
//! completely recreating the record that was read from repodata when the
//! lock-file was created which will allow a correct incremental update.
//!
//! Conda-lock requires users to create multiple lock-files when they want to
//! store multiple environments. This crate allows storing multiple environments
//! for different platforms and with different channels in a single lock-file.
//! This allows storing production- and test environments in a single file.

use std::{collections::HashMap, io::Read, path::Path, sync::Arc};

use indexmap::IndexSet;

mod builder;
mod channel;
mod conda;
mod file_format_version;
mod hash;
pub mod options;
mod parse;
mod platform;
mod pypi;
mod pypi_indexes;
pub mod source;
mod source_identifier;
mod source_timestamps;
mod url_or_path;
mod utils;
mod verbatim;

pub use builder::{LockFileBuilder, LockedPackage};
pub use channel::Channel;
pub use conda::{
    CondaBinaryData, CondaPackageData, CondaSourceData, ConversionError, FullSourceMetadata,
    GitShallowSpec, InputHash, PackageBuildSource, PartialSourceMetadata, SourceMetadata,
    VariantValue,
};
pub use file_format_version::FileFormatVersion;
pub use hash::PackageHashes;
pub use options::{PypiPrereleaseMode, SolveOptions};
pub use parse::ParseCondaLockError;
pub use platform::{OwnedPlatform, ParsePlatformError, Platform, PlatformData, PlatformName};
pub use pypi::{PypiDistributionData, PypiPackageData, PypiSourceData, PypiSourceTreeHashable};
pub use pypi_indexes::{FindLinksUrlOrPath, PypiIndexes};
pub use rattler_conda_types::{Matches, RepoDataRecord};
pub use source_identifier::{ParseSourceIdentifierError, SourceIdentifier};
pub use source_timestamps::SourceTimestamps;
pub use url_or_path::UrlOrPath;
pub use verbatim::Verbatim;

/// The name of the default environment in a [`LockFile`]. This is the
/// environment name that is used when no explicit environment name is
/// specified.
pub const DEFAULT_ENVIRONMENT_NAME: &str = "default";

/// Represents a lock-file for both Conda packages and Pypi packages.
///
/// Lock-files can store information for multiple platforms and for multiple
/// environments.
///
/// The high-level API provided by this type holds internal references to the
/// data. Its is therefore cheap to clone this type.
#[derive(Clone, Default, Debug)]
pub struct LockFile {
    inner: Arc<LockFileInner>,
}

/// Internal data structure that stores the lock-file data.
#[derive(Default, Debug)]
struct LockFileInner {
    version: FileFormatVersion,
    platforms: Vec<PlatformData>,
    environments: Vec<EnvironmentData>,
    conda_packages: Vec<CondaPackageData>,
    pypi_packages: Vec<PypiPackageData>,

    environment_lookup: ahash::HashMap<String, usize>,
}

/// An package used in an environment. Selects a type of package based on the
/// enum and might contain additional data that is specific to the environment.
/// For instance different environments might select the same Pypi package but
/// with different extras.
#[derive(Clone, Copy, Debug, Hash, Eq, PartialEq)]
enum EnvironmentPackageData {
    Conda(usize),
    Pypi(usize),
}

/// Information about a specific environment in the lock file.
///
/// This only needs to store information about an environment that cannot be
/// derived from the packages itself.
///
/// The default environment is called "default".
#[derive(Clone, Debug)]
struct EnvironmentData {
    /// The channels used to solve the environment. Note that the order matters.
    channels: Vec<Channel>,

    /// The pypi indexes used to solve the environment.
    indexes: Option<PypiIndexes>,

    /// The options that were used to solve the environment.
    options: SolveOptions,

    /// For each individual platform this environment supports we store the
    /// package identifiers associated with the environment.
    packages: ahash::HashMap<usize, IndexSet<EnvironmentPackageData>>,
}

impl LockFile {
    /// Constructs a new lock-file builder. This is the preferred way to
    /// constructs a lock-file programmatically.
    pub fn builder() -> LockFileBuilder {
        LockFileBuilder::new()
    }

    /// Parses an conda-lock file from a reader.
    pub fn from_reader(
        mut reader: impl Read,
        base_dir: Option<&Path>,
    ) -> Result<Self, ParseCondaLockError> {
        let mut str = String::new();
        reader.read_to_string(&mut str)?;
        parse::from_str_with_base_directory(&str, base_dir)
    }

    /// Parses an conda-lock file from a file.
    pub fn from_path(path: &Path) -> Result<Self, ParseCondaLockError> {
        let base_dir = path.parent();
        let source = std::fs::read_to_string(path)?;
        parse::from_str_with_base_directory(&source, base_dir)
    }

    /// Parses an conda-lock file from a file.
    pub fn from_str_with_base_directory(
        source: &str,
        base_dir: Option<&Path>,
    ) -> Result<Self, ParseCondaLockError> {
        parse::from_str_with_base_directory(source, base_dir)
    }

    /// Writes the conda lock to a file
    pub fn to_path(&self, path: &Path) -> Result<(), std::io::Error> {
        let file = std::fs::File::create(path)?;
        serde_yaml::to_writer(file, self).map_err(std::io::Error::other)
    }

    /// Writes the conda lock to a string
    pub fn render_to_string(&self) -> Result<String, std::io::Error> {
        serde_yaml::to_string(self).map_err(std::io::Error::other)
    }

    /// Returns the platform with the given name.
    pub fn platform(&self, name: &str) -> Option<Platform<'_>> {
        crate::platform::find_index_by_name(&self.inner.platforms, name)
            .map(|index| Platform::new(&self.inner, index))
    }

    /// Returns `PlatformRefs` for all the platforms.
    pub fn platforms(&self) -> impl ExactSizeIterator<Item = Platform<'_>> {
        self.inner
            .platforms
            .iter()
            .enumerate()
            .map(|(index, _)| Platform::new(&self.inner, index))
    }

    /// Returns the environment with the given name.
    pub fn environment(&self, name: &str) -> Option<Environment<'_>> {
        let index = *self.inner.environment_lookup.get(name)?;
        Some(Environment {
            lock_file: self,
            index,
        })
    }

    /// Returns the environment with the default name as defined by
    /// [`DEFAULT_ENVIRONMENT_NAME`].
    pub fn default_environment(&self) -> Option<Environment<'_>> {
        self.environment(DEFAULT_ENVIRONMENT_NAME)
    }

    /// Returns an iterator over all environments defined in the lock-file.
    pub fn environments(&self) -> impl ExactSizeIterator<Item = (&str, Environment<'_>)> + '_ {
        self.inner
            .environment_lookup
            .iter()
            .map(move |(name, index)| {
                (
                    name.as_str(),
                    Environment {
                        lock_file: self,
                        index: *index,
                    },
                )
            })
    }

    /// Returns the version of the lock-file.
    pub fn version(&self) -> FileFormatVersion {
        self.inner.version
    }

    /// Check if there are any packages in the lockfile
    pub fn is_empty(&self) -> bool {
        self.inner.conda_packages.is_empty() && self.inner.pypi_packages.is_empty()
    }
}

/// Information about a specific environment in the lock-file.
#[derive(Clone, Copy)]
pub struct Environment<'lock> {
    lock_file: &'lock LockFile,
    index: usize,
}

impl<'lock> Environment<'lock> {
    /// Returns a reference to the internal data structure.
    fn data(&self) -> &'lock EnvironmentData {
        &self.lock_file.inner.environments[self.index]
    }

    /// Returns the lock file to which this environment belongs.
    pub fn lock_file(&self) -> &'lock LockFile {
        self.lock_file
    }

    /// Returns all the platforms for which we have a locked-down environment.
    pub fn platforms(&self) -> impl ExactSizeIterator<Item = Platform<'lock>> + '_ {
        let indices = self
            .data()
            .packages
            .keys()
            .map(|index| Platform::new(&self.lock_file.inner, *index))
            .collect::<Vec<_>>();
        crate::platform::PlatformIterator::new(indices)
    }

    /// Returns the channels that are used by this environment.
    ///
    /// Note that the order of the channels is significant. The first channel is
    /// the highest priority channel.
    pub fn channels(&self) -> &[Channel] {
        &self.data().channels
    }

    /// Returns the Pypi indexes that were used to solve this environment.
    ///
    /// If there are no pypi packages in the lock-file this will return `None`.
    ///
    /// Starting with version `5` of the format this should not be optional.
    pub fn pypi_indexes(&self) -> Option<&PypiIndexes> {
        self.data().indexes.as_ref()
    }

    /// Returns the `PyPI` prerelease mode that was used to solve this environment.
    ///
    /// Returns `None` if no prerelease mode was explicitly set.
    pub fn pypi_prerelease_mode(&self) -> PypiPrereleaseMode {
        self.data().options.pypi_prerelease_mode
    }

    /// Returns the solver options that were used to create this environment.
    pub fn solve_options(&self) -> &SolveOptions {
        &self.data().options
    }

    /// Returns all the packages for a specific platform in this environment.
    pub fn packages(
        &self,
        platform: Platform<'lock>,
    ) -> Option<impl DoubleEndedIterator<Item = LockedPackageRef<'lock>> + ExactSizeIterator + '_>
    {
        if std::ptr::from_ref(self.lock_file.inner.as_ref())
            != std::ptr::from_ref(platform.lock_file_inner)
        {
            return None;
        }
        Some(
            self.data()
                .packages
                .get(&platform.index)?
                .iter()
                .map(move |package| match package {
                    EnvironmentPackageData::Conda(data) => {
                        LockedPackageRef::Conda(&self.lock_file.inner.conda_packages[*data])
                    }
                    EnvironmentPackageData::Pypi(data) => {
                        LockedPackageRef::Pypi(&self.lock_file.inner.pypi_packages[*data])
                    }
                }),
        )
    }

    /// Returns an iterator over all packages and platforms defined for this
    /// environment.
    pub fn packages_by_platform(
        &self,
    ) -> impl ExactSizeIterator<
        Item = (
            Platform<'lock>,
            impl DoubleEndedIterator<Item = LockedPackageRef<'lock>> + ExactSizeIterator + '_,
        ),
    > + '_ {
        self.data()
            .packages
            .iter()
            .map(|(platform_index, data)| {
                (Platform::new(&self.lock_file.inner, *platform_index), data)
            })
            .map(move |(platform, data)| {
                (
                    platform,
                    data.iter().map(move |package| match package {
                        EnvironmentPackageData::Conda(data) => {
                            LockedPackageRef::Conda(&self.lock_file.inner.conda_packages[*data])
                        }
                        EnvironmentPackageData::Pypi(data) => {
                            LockedPackageRef::Pypi(&self.lock_file.inner.pypi_packages[*data])
                        }
                    }),
                )
            })
    }

    /// Returns all pypi packages for all platforms
    pub fn pypi_packages_by_platform(
        &self,
    ) -> impl ExactSizeIterator<
        Item = (
            Platform<'_>,
            impl DoubleEndedIterator<Item = &'_ PypiPackageData>,
        ),
    > + '_ {
        self.packages_by_platform()
            .map(move |(platform, packages)| {
                (platform, packages.filter_map(LockedPackageRef::as_pypi))
            })
    }

    /// Returns all conda packages for all platforms.
    pub fn conda_packages_by_platform(
        &self,
    ) -> impl ExactSizeIterator<
        Item = (
            Platform<'lock>,
            impl DoubleEndedIterator<Item = &'lock CondaPackageData> + '_,
        ),
    > + '_ {
        self.packages_by_platform()
            .map(move |(platform, packages)| {
                (platform, packages.filter_map(LockedPackageRef::as_conda))
            })
    }

    /// Returns all binary conda packages for all platforms and converts them to
    /// [`RepoDataRecord`].
    pub fn conda_repodata_records_by_platform(
        &self,
    ) -> Result<HashMap<Platform<'lock>, Vec<RepoDataRecord>>, ConversionError> {
        self.conda_packages_by_platform()
            .map(|(platform, packages)| {
                Ok((
                    platform,
                    packages
                        .filter_map(CondaPackageData::as_binary)
                        .map(RepoDataRecord::try_from)
                        .collect::<Result<Vec<_>, ConversionError>>()?,
                ))
            })
            .collect()
    }

    /// Returns all conda packages for a specific platform.
    pub fn conda_packages(
        &self,
        platform: Platform<'lock>,
    ) -> Option<impl DoubleEndedIterator<Item = &'lock CondaPackageData> + '_> {
        self.packages(platform)
            .map(|packages| packages.filter_map(LockedPackageRef::as_conda))
    }

    /// Takes all the conda packages, converts them to [`RepoDataRecord`] and
    /// returns them or returns an error if the conversion failed. Returns
    /// `None` if the specified platform is not defined for this
    /// environment.
    ///
    /// This method ignores any conda packages that do not refer to repodata
    /// records.
    pub fn conda_repodata_records(
        &self,
        platform: Platform<'lock>,
    ) -> Result<Option<Vec<RepoDataRecord>>, ConversionError> {
        self.conda_packages(platform)
            .map(|packages| {
                packages
                    .filter_map(CondaPackageData::as_binary)
                    .map(RepoDataRecord::try_from)
                    .collect()
            })
            .transpose()
    }

    /// Returns all the pypi packages and their associated environment data for
    /// the specified platform. Returns `None` if the platform is not
    /// defined for this environment.
    pub fn pypi_packages(
        &self,
        platform: Platform<'lock>,
    ) -> Option<impl DoubleEndedIterator<Item = &'lock PypiPackageData> + '_> {
        self.packages(platform)
            .map(|pkgs| pkgs.filter_map(LockedPackageRef::as_pypi))
    }

    /// Returns whether this environment has any pypi packages for the specified platform.
    pub fn has_pypi_packages(&self, platform: Platform<'lock>) -> bool {
        self.pypi_packages(platform)
            .is_some_and(|mut packages| packages.next().is_some())
    }

    /// Creates a [`OwnedEnvironment`] from this environment.
    pub fn to_owned(self) -> OwnedEnvironment {
        OwnedEnvironment {
            lock_file: self.lock_file.clone(),
            index: self.index,
        }
    }
}

/// An owned version of an [`Environment`].
///
/// Use [`OwnedEnvironment::as_ref`] to get a reference to the environment data.
#[derive(Clone)]
pub struct OwnedEnvironment {
    lock_file: LockFile,
    index: usize,
}

impl OwnedEnvironment {
    /// Returns a reference to the environment data.
    pub fn as_ref(&self) -> Environment<'_> {
        Environment {
            lock_file: &self.lock_file,
            index: self.index,
        }
    }

    /// Returns the lock-file this environment is part of.
    pub fn lock_file(&self) -> LockFile {
        self.lock_file.clone()
    }
}

/// Data related to a single locked package in an [`Environment`].
#[derive(Clone, Copy)]
pub enum LockedPackageRef<'lock> {
    /// A conda package
    Conda(&'lock CondaPackageData),

    /// A pypi package
    Pypi(&'lock PypiPackageData),
}

impl<'lock> LockedPackageRef<'lock> {
    /// Returns the name of the package as it occurs in the lock file. This
    /// might not be the normalized name.
    pub fn name(self) -> &'lock str {
        match self {
            LockedPackageRef::Conda(data) => data.name().as_source(),
            LockedPackageRef::Pypi(data) => data.name().as_ref(),
        }
    }

    /// Returns the location of the package.
    pub fn location(self) -> &'lock UrlOrPath {
        match self {
            LockedPackageRef::Conda(data) => data.location(),
            LockedPackageRef::Pypi(data) => data.location().inner(),
        }
    }

    /// Returns the pypi package if this is a pypi package.
    pub fn as_pypi(self) -> Option<&'lock PypiPackageData> {
        match self {
            LockedPackageRef::Conda(_) => None,
            LockedPackageRef::Pypi(data) => Some(data),
        }
    }

    /// Returns the conda package if this is a conda package.
    pub fn as_conda(self) -> Option<&'lock CondaPackageData> {
        match self {
            LockedPackageRef::Conda(data) => Some(data),
            LockedPackageRef::Pypi(..) => None,
        }
    }

    /// Returns the package as a binary conda package if this is a binary conda
    /// package.
    pub fn as_binary_conda(self) -> Option<&'lock CondaBinaryData> {
        self.as_conda().and_then(CondaPackageData::as_binary)
    }

    /// Returns the package as a source conda package if this is a source conda
    /// package.
    pub fn as_source_conda(self) -> Option<&'lock CondaSourceData> {
        self.as_conda().and_then(CondaPackageData::as_source)
    }
}

#[cfg(test)]
mod test {
    use std::path::{Path, PathBuf};

    use rattler_conda_types::RepoDataRecord;
    use rstest::*;

    use crate::platform::PlatformName;

    use super::{LockFile, DEFAULT_ENVIRONMENT_NAME};

    fn test_path() -> PathBuf {
        if cfg!(windows) {
            PathBuf::from("C:\\tmp\\some\\test\\path")
        } else {
            PathBuf::from("/tmp/some/test/path")
        }
    }

    #[rstest]
    #[case::v0_numpy("v0/numpy-conda-lock.yml")]
    #[case::v0_python("v0/python-conda-lock.yml")]
    #[case::v0_pypi_matplotlib("v0/pypi-matplotlib-conda-lock.yml")]
    #[case::v3_robostack("v3/robostack-turtlesim-conda-lock.yml")]
    #[case::v3_numpy("v4/numpy-lock.yml")]
    #[case::v4_python("v4/python-lock.yml")]
    #[case::v4_pypi_matplotlib("v4/pypi-matplotlib-lock.yml")]
    #[case::v4_turtlesim("v4/turtlesim-lock.yml")]
    #[case::v4_pypi_path("v4/path-based-lock.yml")]
    #[case::v4_pypi_absolute_path("v4/absolute-path-lock.yml")]
    #[case::v5_pypi_flat_index("v5/flat-index-lock.yml")]
    #[case::v5_with_and_without_purl("v5/similar-with-and-without-purl.yml")]
    #[case::v6_conda_source_path("v6/conda-path-lock.yml")]
    #[case::v6_derived_channel("v6/derived-channel-lock.yml")]
    #[case::v6_sources("v6/sources-lock.yml")]
    #[case::v6_options("v6/options-lock.yml")]
    #[case::v6_pixi_build_pinned_source("v6/pixi-build-pinned-source-lock.yml")]
    #[case::v6_pixi_build_url_source("v6/pixi-build-url-source-lock.yml")]
    #[case::v6_pixi_build_git_tag_source("v6/pixi-build-git-tag-source-lock.yml")]
    #[case::v6_pixi_build_git_rev_only_source("v6/pixi-build-git-rev-only-source-lock.yml")]
    #[case::v6_source_package_with_variants("v6/source-package-with-variants-lock.yml")]
    #[case::v6_multiple_source_packages_with_variants(
        "v6/multiple-source-packages-with-variants-lock.yml"
    )]
    #[case::v7_conda_source_path("v7/conda-path-lock.yml")]
    #[case::v7_derived_channel("v7/derived-channel-lock.yml")]
    #[case::v7_sources("v7/sources-lock.yml")]
    #[case::v7_source_timestamps_map("v7/source-timestamps-map-lock.yml")]
    #[case::v7_options("v7/options-lock.yml")]
    #[case::v7_pixi_build_pinned_source("v7/pixi-build-pinned-source-lock.yml")]
    #[case::v7_pixi_build_url_source("v7/pixi-build-url-source-lock.yml")]
    #[case::v7_pixi_build_git_tag_source("v7/pixi-build-git-tag-source-lock.yml")]
    #[case::v7_pixi_build_git_rev_only_source("v7/pixi-build-git-rev-only-source-lock.yml")]
    #[case::v7_source_package_with_variants("v7/source-package-with-variants-lock.yml")]
    #[case::v7_multiple_source_packages_with_variants(
        "v7/multiple-source-packages-with-variants-lock.yml"
    )]
    #[case::v7_pypi_absolute_url("v7/pypi_absolute_url.yml")]
    #[case::v7_pypi_relative_url("v7/pypi_relative_url.yml")]
    #[case::v7_pypi_relative_outside_url("v7/pypi_relative_outside_url.yml")]
    #[case::v7_pypi_custom_index("v7/pypi_custom_index.yml")]
    fn test_parse(#[case] file_name: &str) {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join(file_name);
        let conda_lock = LockFile::from_path(&path).unwrap();
        insta::assert_yaml_snapshot!(file_name, conda_lock);
    }

    #[rstest]
    #[case::v7_invalid_platform("v7/invalid_platform_name.yml")]
    #[case::v7_invalid_platform("v7/invalid_platform_subdir.yml")]
    #[case::v7_missing_platform("v7/missing_platform.yml")]
    #[case::v7_missing_platform("v7/duplicate_platform_definition.yml")]
    #[case::v7_missing_platform("v7/duplicate_platform_use.yml")]
    fn test_parse_fail(#[case] file_name: &str) {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/lock_parse_fails")
            .join(file_name);
        let error_message = if let Err(error) = LockFile::from_path(&path) {
            format!("{error}")
        } else {
            "Lockfile was read fine, this is unexpected in a test for error cases".to_string()
        };
        insta::assert_yaml_snapshot!(file_name, error_message);
    }

    #[rstest]
    fn test_roundtrip(
        #[files("../../test-data/conda-lock/**/*.yml")]
        #[exclude("forward-compatible-lock")]
        path: PathBuf,
    ) {
        // Load the lock-file
        let conda_lock = LockFile::from_path(&path).unwrap();

        // Serialize the lock-file
        let rendered_lock_file = conda_lock.render_to_string().unwrap();

        // Parse the rendered lock-file again
        let source_path = test_path();
        let parsed_lock_file =
            LockFile::from_str_with_base_directory(&rendered_lock_file, Some(&source_path))
                .unwrap();

        // And re-render again
        let rerendered_lock_file = parsed_lock_file.render_to_string().unwrap();

        similar_asserts::assert_eq!(rendered_lock_file, rerendered_lock_file);
    }

    /// Absolute paths on Windows are not properly parsed.
    /// See: <https://github.com/conda/rattler/issues/615>
    #[test]
    fn test_issue_615() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock/v4/absolute-path-lock.yml");
        let conda_lock = LockFile::from_path(&path);
        assert!(conda_lock.is_ok());
    }

    #[test]
    fn packages_for_platform() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v0/numpy-conda-lock.yml");

        // Try to read conda_lock
        let conda_lock = LockFile::from_path(&path).unwrap();

        let linux = conda_lock.platform("linux-64").unwrap();
        let osx = conda_lock.platform("osx-64").unwrap();

        insta::assert_yaml_snapshot!(conda_lock
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .map(|p| p.location().to_string())
            .collect::<Vec<_>>());

        insta::assert_yaml_snapshot!(conda_lock
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(osx)
            .unwrap()
            .map(|p| p.location().to_string())
            .collect::<Vec<_>>());
    }

    #[test]
    fn test_has_pypi_packages() {
        // v4
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v4/pypi-matplotlib-lock.yml");
        let conda_lock = LockFile::from_path(&path).unwrap();

        let linux = conda_lock.platform("linux-64").unwrap();

        assert!(conda_lock
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .has_pypi_packages(linux));

        // v6
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v6/numpy-as-pypi-lock.yml");
        let conda_lock = LockFile::from_path(&path).unwrap();

        let osx_arm64 = conda_lock.platform("osx-arm64").unwrap();

        assert!(conda_lock
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .has_pypi_packages(osx_arm64));

        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v6/python-from-conda-only-lock.yml");
        let conda_lock = LockFile::from_path(&path).unwrap();

        let osx_arm64 = conda_lock.platform("osx-arm64").unwrap();

        assert!(!conda_lock
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .has_pypi_packages(osx_arm64));
    }

    #[test]
    fn test_pypi_index_url() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock/v7/pypi_custom_index.yml");
        let lock_file = LockFile::from_path(&path).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let env = lock_file.environment(DEFAULT_ENVIRONMENT_NAME).unwrap();
        let pypi_packages: Vec<_> = env
            .packages(linux)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_pypi)
            .collect();

        // Package from a custom index should have that index_url
        let requests = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "requests")
            .expect("requests package");
        assert_eq!(
            requests
                .as_wheel()
                .unwrap()
                .index_url
                .as_ref()
                .map(url::Url::as_str),
            Some("https://my-custom-index.example.com/simple")
        );

        // Package without explicit index_url defaults to the
        // environment's first index
        let numpy = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "numpy")
            .expect("numpy package");
        assert_eq!(
            numpy
                .as_wheel()
                .unwrap()
                .index_url
                .as_ref()
                .map(url::Url::as_str),
            Some("https://my-custom-index.example.com/simple")
        );

        // Path-based package has no index_url
        let local_pkg = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "local-pkg")
            .expect("local-pkg package");
        assert!(local_pkg.as_source().is_some());
    }

    /// In v7 lockfiles, a package without an explicit `index:` field
    /// should use the first index from the environment's `indexes:` list.
    #[test]
    fn v7_pypi_default_index_from_environment() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://first-index.example.com/simple
      - https://second-index.example.com/simple
    packages:
      linux-64:
        - pypi: https://first-index.example.com/packages/requests-2.31.0-py3-none-any.whl
        - pypi: https://second-index.example.com/packages/numpy-1.26.0-cp311-linux_x86_64.whl
packages:
  - pypi: https://first-index.example.com/packages/requests-2.31.0-py3-none-any.whl
    name: requests
    version: 2.31.0
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
  - pypi: https://second-index.example.com/packages/numpy-1.26.0-cp311-linux_x86_64.whl
    name: numpy
    version: 1.26.0
    index: https://second-index.example.com/simple
    sha256: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let env = lock_file.environment(DEFAULT_ENVIRONMENT_NAME).unwrap();
        let pypi_packages: Vec<_> = env
            .packages(linux)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_pypi)
            .collect();

        // Package without explicit index: should use the first environment index
        let requests = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "requests")
            .expect("requests package");
        assert_eq!(
            requests
                .as_wheel()
                .unwrap()
                .index_url
                .as_ref()
                .map(url::Url::as_str),
            Some("https://first-index.example.com/simple"),
        );

        // Package with explicit index: should keep that index
        let numpy = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "numpy")
            .expect("numpy package");
        assert_eq!(
            numpy
                .as_wheel()
                .unwrap()
                .index_url
                .as_ref()
                .map(url::Url::as_str),
            Some("https://second-index.example.com/simple"),
        );
    }

    /// Lockfiles before v7 didn't store per-package index URLs, so
    /// `index_url` must be `None` after parsing.
    #[test]
    fn v5_pypi_index_url_is_none() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock/v5/flat-index-lock.yml");
        let lock_file = LockFile::from_path(&path).unwrap();
        let platform = lock_file.platform("osx-arm64").unwrap();
        let env = lock_file.environment(DEFAULT_ENVIRONMENT_NAME).unwrap();

        for pkg in env
            .packages(platform)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_pypi)
        {
            if let Some(wheel) = pkg.as_wheel() {
                assert!(
                    wheel.index_url.is_none(),
                    "v5 package {:?} should have no index_url",
                    wheel.name
                );
            }
        }
    }

    /// Lockfiles before v7 didn't store per-package index URLs, so
    /// `index_url` must be `None` after parsing.
    #[test]
    fn v6_pypi_index_url_is_none() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock/v6/numpy-as-pypi-lock.yml");
        let lock_file = LockFile::from_path(&path).unwrap();
        let platform = lock_file.platform("osx-arm64").unwrap();
        let env = lock_file.environment(DEFAULT_ENVIRONMENT_NAME).unwrap();

        let numpy = env
            .packages(platform)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_pypi)
            .find(|p| p.name().as_ref() == "numpy")
            .expect("numpy package");
        assert!(numpy.as_wheel().unwrap().index_url.is_none());
    }

    /// Lockfiles before v7 didn't store per-package index URLs, so
    /// `index_url` must be `None` after parsing.
    #[test]
    fn v3_pypi_index_url_is_none() {
        let lock_file_str = "\
version: 3
metadata:
  content_hash:
    linux-64: abc123
  channels:
    - url: https://conda.anaconda.org/conda-forge/
      used_env_vars: []
  platforms:
    - linux-64
  sources: []
package:
  - platform: linux-64
    name: requests
    version: '2.31.0'
    category: main
    manager: pip
    dependencies: []
    url: https://files.pythonhosted.org/packages/requests-2.31.0-py3-none-any.whl
    hash:
      sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        assert!(pkg.as_wheel().unwrap().index_url.is_none());
    }

    /// When a v7 environment has no `indexes:` list, wheels without an
    /// explicit `index:` should fall back to `https://pypi.org/simple`.
    #[test]
    fn v7_pypi_no_indexes_falls_back_to_pypi() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    packages:
      linux-64:
        - pypi: https://files.pythonhosted.org/packages/requests-2.31.0-py3-none-any.whl
packages:
  - pypi: https://files.pythonhosted.org/packages/requests-2.31.0-py3-none-any.whl
    name: requests
    version: 2.31.0
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        assert_eq!(
            pkg.as_wheel()
                .unwrap()
                .index_url
                .as_ref()
                .map(url::Url::as_str),
            Some("https://pypi.org/simple"),
        );
    }

    #[test]
    fn test_is_empty() {
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v6/empty-lock.yml");
        let conda_lock = LockFile::from_path(&path).unwrap();
        assert!(conda_lock.is_empty());

        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/conda-lock")
            .join("v6/python-from-conda-only-lock.yml");
        let conda_lock = LockFile::from_path(&path).unwrap();
        assert!(!conda_lock.is_empty());
    }

    #[test]
    fn solve_roundtrip() {
        // load repodata from JSON
        let path = Path::new(env!("CARGO_MANIFEST_DIR"))
            .join("../../test-data/repodata-records/_libgcc_mutex-0.1-conda_forge.json");
        let content = std::fs::read_to_string(&path).unwrap();
        let repodata_record: RepoDataRecord = serde_json::from_str(&content).unwrap();

        // check that the repodata record is as expected
        assert_eq!(repodata_record.package_record.arch, None);
        assert_eq!(repodata_record.package_record.platform, None);

        // create a lockfile with the repodata record
        let lock_file = LockFile::builder()
            .with_platforms(vec![crate::PlatformData {
                name: PlatformName::try_from("linux-64").unwrap(),
                subdir: rattler_conda_types::Platform::Linux64,
                virtual_packages: Vec::new(),
            }])
            .unwrap()
            .with_conda_package(
                DEFAULT_ENVIRONMENT_NAME,
                "linux-64",
                repodata_record.clone().into(),
            )
            .unwrap()
            .finish();

        // serialize the lockfile
        let rendered_lock_file = lock_file.render_to_string().unwrap();

        // parse the lockfile
        let parsed_lock_file =
            LockFile::from_str_with_base_directory(&rendered_lock_file, None).unwrap();

        let linux = parsed_lock_file.platform("linux-64").unwrap();
        // get repodata record from parsed lockfile
        let repodata_records = parsed_lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .conda_repodata_records(linux)
            .unwrap()
            .unwrap();

        // These are not equal because the one from `repodata_records[0]` contains arch and platform.
        let repodata_record_two = repodata_records[0].clone();
        assert_eq!(
            repodata_record_two.package_record.arch,
            Some("x86_64".to_string())
        );
        assert_eq!(
            repodata_record_two.package_record.platform,
            Some("linux".to_string())
        );

        // But if we render it again, the lockfile should look the same at least
        let rerendered_lock_file_two = parsed_lock_file.render_to_string().unwrap();
        assert_eq!(rendered_lock_file, rerendered_lock_file_two);
    }

    /// Verify that a source package with partial metadata (no version/subdir)
    /// round-trips correctly: `record()` returns `None`, the name is preserved,
    /// and re-serializing + re-parsing produces identical output.
    #[test]
    fn test_partial_metadata_roundtrip() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    packages:
      linux-64:
        - conda_source: \"my-partial-pkg[abcd1234] @ my-partial-pkg\"
packages:
  - conda_source: \"my-partial-pkg[abcd1234] @ my-partial-pkg\"
    depends:
      - python >=3.10
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();

        let platform = lock_file.platform("linux-64").unwrap();
        let source_data = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(platform)
            .unwrap()
            .find_map(super::LockedPackageRef::as_source_conda)
            .expect("expected a source package");

        // Partial metadata: record() should return None, name() should work.
        assert!(source_data.record().is_none());
        assert_eq!(source_data.name().as_source(), "my-partial-pkg");
        assert_eq!(source_data.depends(), &["python >=3.10".to_string()]);

        // Roundtrip: serialize → re-parse → re-serialize should be identical.
        let rendered = lock_file.render_to_string().unwrap();
        let reparsed = LockFile::from_str_with_base_directory(&rendered, None).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }

    /// Verify that a source identifier hash read from a lock file is stored
    /// verbatim in the resulting [`crate::CondaSourceData`] and reproduced
    /// unchanged when the lock file is re-serialized, even if the stored hash
    /// differs from what the current hash algorithm would compute.
    #[test]
    fn test_source_identifier_hash_is_preserved() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    packages:
      linux-64:
        - conda_source: \"my-package[deadbeef] @ my-package\"
packages:
  - conda_source: \"my-package[deadbeef] @ my-package\"
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();

        let platform = lock_file.platform("linux-64").unwrap();
        let source_data = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(platform)
            .unwrap()
            .find_map(super::LockedPackageRef::as_source_conda)
            .expect("expected a source package");

        // The hash read from the lock file must be stored verbatim, not recomputed.
        assert_eq!(source_data.identifier_hash.as_deref(), Some("deadbeef"));

        // Re-serializing must reproduce the same hash unchanged.
        let rendered = lock_file.render_to_string().unwrap();
        assert!(rendered.contains("my-package[deadbeef]"));
    }

    /// Verify that two source packages with identical data but different stored
    /// hashes both survive a parse→serialize cycle with their hashes intact.
    #[test]
    fn test_identical_source_packages_different_hashes_roundtrip() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    packages:
      linux-64:
        - conda_source: \"my-package[aaaaaaaa] @ my-package\"
        - conda_source: \"my-package[bbbbbbbb] @ my-package\"
packages:
  - conda_source: \"my-package[aaaaaaaa] @ my-package\"
  - conda_source: \"my-package[bbbbbbbb] @ my-package\"
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();

        let platform = lock_file.platform("linux-64").unwrap();
        let source_packages: Vec<_> = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(platform)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_source_conda)
            .collect();

        assert_eq!(source_packages.len(), 2);
        let hashes: Vec<_> = source_packages
            .iter()
            .map(|s| s.identifier_hash.as_deref())
            .collect();
        assert!(hashes.contains(&Some("aaaaaaaa")));
        assert!(hashes.contains(&Some("bbbbbbbb")));

        // Re-serializing must preserve both hashes unchanged.
        let rendered = lock_file.render_to_string().unwrap();
        assert!(rendered.contains("my-package[aaaaaaaa]"));
        assert!(rendered.contains("my-package[bbbbbbbb]"));

        // Parsing the rendered output must be stable (parse→render idempotent).
        let reparsed = LockFile::from_str_with_base_directory(&rendered, None).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }

    /// Verify that pypi source packages with relative paths (both `./` and
    /// `../`) roundtrip correctly and that the `SerializablePackageSelector`
    /// values in the environment section always match the `pypi:` keys in
    /// the top-level `packages` section.
    #[test]
    fn test_pypi_relative_source_packages_roundtrip() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./
        - pypi: ./my_subdir
        - pypi: ../external_pkg
packages:
  - pypi: ../external_pkg
    name: external-pkg
  - pypi: ./my_subdir
    name: my-subdir
  - pypi: ./
    name: my-project
    requires_dist:
      - my-subdir @ file:my_subdir
      - external-pkg @ file:../external_pkg
";
        let base_dir = test_path();
        let lock_file =
            LockFile::from_str_with_base_directory(lock_file_str, Some(&base_dir)).unwrap();

        let platform = lock_file.platform("linux-64").unwrap();
        let env = lock_file.environment(DEFAULT_ENVIRONMENT_NAME).unwrap();
        let pypi_packages: Vec<_> = env
            .packages(platform)
            .unwrap()
            .filter_map(super::LockedPackageRef::as_pypi)
            .collect();

        assert_eq!(pypi_packages.len(), 3);

        // Check the root package (location = "./")
        let root_pkg = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "my-project")
            .expect("my-project package");
        let root_source = root_pkg.as_source().unwrap();
        assert_eq!(
            root_source.location.given(),
            Some("./"),
            "verbatim relative path for root should be preserved"
        );
        assert!(
            root_pkg.as_source().is_some(),
            "local-path pypi packages must be the Source variant"
        );
        assert_eq!(root_source.requires_dist.len(), 2);

        // Check the subdirectory package (location = "./my_subdir")
        let subdir_pkg = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "my-subdir")
            .expect("my-subdir package");
        let subdir_source = subdir_pkg.as_source().unwrap();
        assert_eq!(subdir_source.location.given(), Some("./my_subdir"));
        assert!(
            subdir_pkg.as_source().is_some(),
            "local-path pypi packages must be the Source variant"
        );

        // Check the parent-relative package (location = "../external_pkg")
        let external_pkg = pypi_packages
            .iter()
            .find(|p| p.name().as_ref() == "external-pkg")
            .expect("external-pkg package");
        let external_source = external_pkg.as_source().unwrap();
        assert_eq!(external_source.location.given(), Some("../external_pkg"));
        assert!(
            external_pkg.as_source().is_some(),
            "local-path pypi packages must be the Source variant"
        );

        // Roundtrip: serialize → re-parse → re-serialize must be identical.
        let rendered = lock_file.render_to_string().unwrap();

        // Parse the rendered YAML and verify that every pypi selector in the
        // environment section has a matching pypi key in the packages section.
        // This catches mismatches between SerializablePackageSelector (which
        // serializes the inner UrlOrPath via Display) and the package data
        // (which serializes via Verbatim, preferring the `given` string).
        let yaml: serde_yaml::Value = serde_yaml::from_str(&rendered).unwrap();

        let package_pypi_keys: std::collections::HashSet<&str> = yaml["packages"]
            .as_sequence()
            .unwrap()
            .iter()
            .filter_map(|pkg| pkg["pypi"].as_str())
            .collect();

        let selector_pypi_keys: Vec<&str> = yaml["environments"]["default"]["packages"]["linux-64"]
            .as_sequence()
            .unwrap()
            .iter()
            .filter_map(|sel| sel["pypi"].as_str())
            .collect();

        assert_eq!(
            selector_pypi_keys.len(),
            3,
            "expected 3 pypi selectors in environment"
        );
        for selector_key in &selector_pypi_keys {
            assert!(
                package_pypi_keys.contains(selector_key),
                "environment selector `pypi: {selector_key}` has no matching \
                 entry in the packages section (available: {package_pypi_keys:?})"
            );
        }

        let reparsed = LockFile::from_str_with_base_directory(&rendered, Some(&base_dir)).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }

    /// Verify that `file:///` URLs in pypi package locations produce matching
    /// selectors. `UrlOrPath::from_str("file:///...")` normalizes to a bare
    /// path internally, but `Verbatim` preserves the original `file:///`
    /// string. `SerializablePackageSelector` serializes the inner `UrlOrPath`
    /// (bare path) while the package data serializes the `Verbatim` wrapper
    /// (`file:///`), causing a mismatch.
    #[test]
    fn test_pypi_file_url_selector_matches_package() {
        let base_dir = test_path();
        let lock_file_str = format!(
            r#"version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: file://{0}/my_pkg
packages:
  - pypi: file://{0}/my_pkg
    name: my-pkg
    version: 1.0.0
    sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
"#,
            base_dir.display()
        );
        eprintln!("Lockfile:\n{lock_file_str}");
        let lock_file =
            LockFile::from_str_with_base_directory(&lock_file_str, Some(&base_dir)).unwrap();

        let rendered = lock_file.render_to_string().unwrap();

        // Parse the rendered YAML and verify that the selector path matches
        // the package path. This fails because the selector serializes the
        // inner UrlOrPath (producing "/tmp/project/my_pkg") while the package
        // serializes via Verbatim (producing "file:///tmp/project/my_pkg").
        let yaml: serde_yaml::Value = serde_yaml::from_str(&rendered).unwrap();

        let package_pypi_keys: std::collections::HashSet<&str> = yaml["packages"]
            .as_sequence()
            .unwrap()
            .iter()
            .filter_map(|pkg| pkg["pypi"].as_str())
            .collect();

        let selector_pypi_keys: Vec<&str> = yaml["environments"]["default"]["packages"]["linux-64"]
            .as_sequence()
            .unwrap()
            .iter()
            .filter_map(|sel| sel["pypi"].as_str())
            .collect();

        assert_eq!(selector_pypi_keys.len(), 1);
        for selector_key in &selector_pypi_keys {
            assert!(
                package_pypi_keys.contains(selector_key),
                "environment selector `pypi: {selector_key}` has no matching \
                 entry in the packages section (available: {package_pypi_keys:?})"
            );
        }
    }

    /// Verify that pypi source packages from local paths never expose hash
    /// data, even when the lockfile YAML contains one.  Version 5 (v4/v5)
    /// uses `kind: pypi` + `path:` for the location.
    #[test]
    fn v5_local_path_pypi_package_hash_is_stripped() {
        let lock_file_str = "\
version: 5
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./local-pkg
packages:
  - kind: pypi
    name: local-pkg
    version: '0.1.0'
    path: ./local-pkg
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let base_dir = test_path();
        let lock_file =
            LockFile::from_str_with_base_directory(lock_file_str, Some(&base_dir)).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let source = pkg
            .as_source()
            .expect("local-path pypi package must be the Source variant");
        assert_eq!(source.name.as_ref(), "local-pkg");
    }

    /// Same as above but for lockfile format version 6.
    #[test]
    fn v6_local_path_pypi_package_hash_is_stripped() {
        let lock_file_str = "\
version: 6
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./local-pkg
packages:
  - pypi: ./local-pkg
    name: local-pkg
    version: '0.1.0'
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let source = pkg
            .as_source()
            .expect("local-path pypi package must be the Source variant");
        assert_eq!(source.name.as_ref(), "local-pkg");
    }

    /// Same as above but for v7 where the YAML *does* include a version field.
    /// Even when present in the YAML, the version must be stripped for local
    /// paths.
    #[test]
    fn v7_local_path_pypi_package_version_stripped_even_when_present() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./local-pkg
packages:
  - pypi: ./local-pkg
    name: local-pkg
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let source = pkg
            .as_source()
            .expect("local-path pypi package must be the Source variant");
        assert_eq!(source.name.as_ref(), "local-pkg");
    }

    /// Verify that URL-based pypi packages still retain their version and
    /// hash (only local paths should have them stripped).
    #[test]
    fn v7_url_pypi_package_hash_is_preserved() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: https://files.pythonhosted.org/packages/numpy-1.26.0-cp311-cp311-linux_x86_64.whl
packages:
  - pypi: https://files.pythonhosted.org/packages/numpy-1.26.0-cp311-cp311-linux_x86_64.whl
    name: numpy
    version: 1.26.0
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let wheel = pkg
            .as_wheel()
            .expect("URL-based pypi package must be the Wheel variant");
        assert_eq!(wheel.name.as_ref(), "numpy");
        assert!(
            wheel.hash.is_some(),
            "hash must be preserved for URL-based pypi packages"
        );
    }

    /// Verify that a local-path wheel file preserves version and hash in v5.
    /// Wheel files are immutable artifacts, unlike source directories.
    #[test]
    fn v5_local_path_wheel_preserves_version_and_hash() {
        let lock_file_str = "\
version: 5
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./dist/my_pkg-1.0.0-py3-none-any.whl
packages:
  - kind: pypi
    name: my-pkg
    version: '1.0.0'
    path: ./dist/my_pkg-1.0.0-py3-none-any.whl
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let base_dir = test_path();
        let lock_file =
            LockFile::from_str_with_base_directory(lock_file_str, Some(&base_dir)).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let wheel = pkg
            .as_wheel()
            .expect("local wheel file must be the Wheel variant");
        assert_eq!(wheel.name.as_ref(), "my-pkg");
        assert_eq!(wheel.version.to_string(), "1.0.0");
        assert!(
            wheel.hash.is_some(),
            "hash must be preserved for local wheel files, got None"
        );
    }

    /// Verify that a local-path wheel file preserves version and hash in v6.
    #[test]
    fn v6_local_path_wheel_preserves_version_and_hash() {
        let lock_file_str = "\
version: 6
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./dist/my_pkg-1.0.0-py3-none-any.whl
packages:
  - pypi: ./dist/my_pkg-1.0.0-py3-none-any.whl
    name: my-pkg
    version: '1.0.0'
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let wheel = pkg
            .as_wheel()
            .expect("local wheel file must be the Wheel variant");
        assert_eq!(wheel.name.as_ref(), "my-pkg");
        assert_eq!(wheel.version.to_string(), "1.0.0");
        assert!(
            wheel.hash.is_some(),
            "hash must be preserved for local wheel files, got None"
        );
    }

    /// Verify that a local-path wheel file preserves version and hash in v7.
    #[test]
    fn v7_local_path_wheel_preserves_version_and_hash() {
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: ./dist/my_pkg-1.0.0-py3-none-any.whl
packages:
  - pypi: ./dist/my_pkg-1.0.0-py3-none-any.whl
    name: my-pkg
    version: '1.0.0'
    sha256: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let wheel = pkg
            .as_wheel()
            .expect("local wheel file must be the Wheel variant");
        assert_eq!(wheel.name.as_ref(), "my-pkg");
        assert_eq!(wheel.version.to_string(), "1.0.0");
        assert!(
            wheel.hash.is_some(),
            "hash must be preserved for local wheel files, got None"
        );
    }

    /// Verify that a file:// URL pointing to a wheel preserves version and
    /// hash — the file:// scheme doesn't change the fact that it's an
    /// immutable artifact.
    #[test]
    fn v7_file_url_wheel_preserves_version_and_hash() {
        let base_dir = test_path();
        let lock_file_str = format!(
            "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: file://{0}/dist/my_pkg-1.0.0-py3-none-any.whl
packages:
  - pypi: file://{0}/dist/my_pkg-1.0.0-py3-none-any.whl
    name: my-pkg
    version: 1.0.0
    sha256: abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890
",
            base_dir.display()
        );
        let lock_file =
            LockFile::from_str_with_base_directory(&lock_file_str, Some(&base_dir)).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let wheel = pkg
            .as_wheel()
            .expect("file:// wheel URL must be the Wheel variant");
        assert_eq!(wheel.name.as_ref(), "my-pkg");
        assert!(
            wheel.hash.is_some(),
            "hash must be preserved for file:// wheel URLs, got None"
        );
    }

    /// Verify that `file://` URL pypi packages also have version and hash
    /// stripped, since they resolve to local paths.
    #[test]
    fn v7_file_url_pypi_package_version_is_stripped() {
        let base_dir = test_path();
        let lock_file_str = format!(
            "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: file://{0}/my_pkg
packages:
  - pypi: file://{0}/my_pkg
    name: my-pkg
",
            base_dir.display()
        );
        let lock_file =
            LockFile::from_str_with_base_directory(&lock_file_str, Some(&base_dir)).unwrap();
        let linux = lock_file.platform("linux-64").unwrap();
        let pkg = lock_file
            .environment(DEFAULT_ENVIRONMENT_NAME)
            .unwrap()
            .packages(linux)
            .unwrap()
            .find_map(super::LockedPackageRef::as_pypi)
            .expect("expected a pypi package");

        let source = pkg
            .as_source()
            .expect("file:// pypi package (local path) must be the Source variant");
        assert_eq!(source.name.as_ref(), "my-pkg");
    }

    /// Adding the same conda source package to two environments via the builder
    /// must produce exactly one entry in the serialized packages list. This
    /// is a regression test for a bug where the builder unconditionally
    /// appended source packages, creating duplicates that were only collapsed
    /// on a subsequent parse→serialize cycle (making `pixi update`
    /// non-idempotent).
    #[test]
    fn builder_deduplicates_conda_source_packages() {
        use std::collections::BTreeMap;

        use rattler_conda_types::{PackageName, PackageRecord};

        use crate::{
            CondaPackageData, CondaSourceData, FullSourceMetadata, PlatformData, SourceMetadata,
            UrlOrPath,
        };

        let source_pkg = CondaPackageData::Source(Box::new(CondaSourceData {
            location: UrlOrPath::Path("my-source-pkg".into()),
            package_build_source: None,
            variants: BTreeMap::from([(
                "target_platform".to_string(),
                crate::VariantValue::String("noarch".to_string()),
            )]),
            timestamp: None,
            identifier_hash: None,
            metadata: SourceMetadata::Full(Box::new(FullSourceMetadata {
                package_record: {
                    let version: rattler_conda_types::Version = "1.0.0".parse().unwrap();
                    let mut r = PackageRecord::new(
                        PackageName::new_unchecked("my-source-pkg"),
                        version,
                        "py_0".to_string(),
                    );
                    r.subdir = "noarch".to_string();
                    r
                },
                sources: BTreeMap::new(),
            })),
        }));

        let lock_file = LockFile::builder()
            .with_platforms(vec![PlatformData {
                name: PlatformName::try_from("linux-64").unwrap(),
                subdir: rattler_conda_types::Platform::Linux64,
                virtual_packages: Vec::new(),
            }])
            .unwrap()
            .with_conda_package("default", "linux-64", source_pkg.clone())
            .unwrap()
            .with_conda_package("dev", "linux-64", source_pkg)
            .unwrap()
            .finish();

        let rendered = lock_file.render_to_string().unwrap();

        // The source package must appear exactly once in the top-level packages
        // list. It also appears once per environment as a selector, so with two
        // environments we expect 3 total occurrences (2 selectors + 1 package).
        let count = rendered.matches("conda_source:").count();
        assert_eq!(
            count, 3,
            "expected 3 conda_source occurrences (2 selectors + 1 package) \
             but found {count}:\n{rendered}"
        );

        // Roundtrip must be stable (no duplicates introduced or removed).
        let reparsed = LockFile::from_str_with_base_directory(&rendered, None).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }

    /// A v7 lockfile with duplicate pypi git-source entries that differ only
    /// in `requires_dist` must collapse to a single entry with the merged
    /// (superset) dependency list on parse→serialize. This is a regression
    /// test for a bug where `pixi update` produced duplicate pypi entries for
    /// git dependencies used across multiple environments (each environment
    /// contributing a slightly different `requires_dist` from marker evaluation),
    /// and a second `pixi update` removed the duplicates — making the
    /// lockfile non-idempotent.
    #[test]
    fn duplicate_pypi_git_entries_collapsed_on_roundtrip() {
        // Lockfile with the same git+https pypi package listed twice in the
        // packages section with different requires_dist (as observed in the
        // wild after `pixi update` — different environments produce different
        // marker-evaluated dependency lists for the same package).
        let lock_file_str = "\
version: 7
platforms:
  - name: linux-64
environments:
  default:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: git+https://github.com/example/minimalloc.git?rev=abc123#abc123
  dev:
    channels:
      - url: https://conda.anaconda.org/conda-forge/
    indexes:
      - https://pypi.org/simple
    packages:
      linux-64:
        - pypi: git+https://github.com/example/minimalloc.git?rev=abc123#abc123
packages:
  - pypi: git+https://github.com/example/minimalloc.git?rev=abc123#abc123
    name: minimalloc
    version: 0.1.0
    requires_dist:
      - numpy>=1.0
    requires_python: '>=3.7'
  - pypi: git+https://github.com/example/minimalloc.git?rev=abc123#abc123
    name: minimalloc
    version: 0.1.0
    requires_dist:
      - numpy>=1.0
      - scipy>=1.0 ; extra == 'test'
    requires_python: '>=3.7'
";
        let lock_file = LockFile::from_str_with_base_directory(lock_file_str, None).unwrap();
        let rendered = lock_file.render_to_string().unwrap();

        // After roundtrip, the two entries should be collapsed to a single entry.
        // 2 selectors (one per env) + 1 package entry = 3 occurrences of the URL.
        let url = "git+https://github.com/example/minimalloc.git";
        let count = rendered.matches(url).count();
        assert_eq!(
            count, 3,
            "expected 3 occurrences of git URL (2 selectors + 1 package) \
             but found {count}:\n{rendered}"
        );

        // A second roundtrip must be stable.
        let reparsed = LockFile::from_str_with_base_directory(&rendered, None).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }

    /// Adding the same pypi git package to two environments via the builder
    /// with different `requires_dist` (as happens when pixi evaluates markers
    /// per-environment) must produce exactly one entry in the serialized
    /// packages list. This is a regression test for a bug where the builder's
    /// `IndexSet` treated entries with different `requires_dist` as distinct,
    /// creating duplicates that were only collapsed on a subsequent
    /// parse→serialize cycle.
    #[test]
    fn builder_deduplicates_pypi_git_packages() {
        use crate::{PlatformData, PypiPackageData, UrlOrPath, Verbatim};

        let url: url::Url = "git+https://github.com/example/minimalloc.git?rev=abc123#abc123"
            .parse()
            .unwrap();

        let pkg_a = PypiPackageData::Distribution(Box::new(crate::PypiDistributionData {
            name: "minimalloc".parse().unwrap(),
            version: "0.1.0".parse().unwrap(),
            location: Verbatim::new(UrlOrPath::Url(url.clone())),
            index_url: None,
            hash: None,
            requires_dist: vec!["numpy>=1.0".parse().unwrap()],
            requires_python: Some(">=3.7".parse().unwrap()),
        }));

        // Same package but with an extra marker-guarded dependency, as would
        // happen when pixi evaluates markers for a different environment.
        let pkg_b = PypiPackageData::Distribution(Box::new(crate::PypiDistributionData {
            name: "minimalloc".parse().unwrap(),
            version: "0.1.0".parse().unwrap(),
            location: Verbatim::new(UrlOrPath::Url(url)),
            index_url: None,
            hash: None,
            requires_dist: vec![
                "numpy>=1.0".parse().unwrap(),
                "scipy>=1.0 ; extra == 'test'".parse().unwrap(),
            ],
            requires_python: Some(">=3.7".parse().unwrap()),
        }));

        let lock_file = LockFile::builder()
            .with_platforms(vec![PlatformData {
                name: PlatformName::try_from("linux-64").unwrap(),
                subdir: rattler_conda_types::Platform::Linux64,
                virtual_packages: Vec::new(),
            }])
            .unwrap()
            .with_pypi_package("default", "linux-64", pkg_a)
            .unwrap()
            .with_pypi_package("dev", "linux-64", pkg_b)
            .unwrap()
            .finish();

        let rendered = lock_file.render_to_string().unwrap();

        // The git URL should appear exactly 3 times: 2 selectors + 1 package entry.
        let url_str = "git+https://github.com/example/minimalloc.git";
        let count = rendered.matches(url_str).count();
        assert_eq!(
            count, 3,
            "expected 3 occurrences of git URL (2 selectors + 1 package) \
             but found {count}:\n{rendered}"
        );

        // Roundtrip must be stable.
        let reparsed = LockFile::from_str_with_base_directory(&rendered, None).unwrap();
        let rerendered = reparsed.render_to_string().unwrap();
        similar_asserts::assert_eq!(rendered, rerendered);
    }
}