vivacity_resolver/

session.rs

//! Setup of an `update`: what `Factory::createComposer` then
//! `Installer::doUpdate` do before `createPool`: root, platform,
//! repositories (global config + composer.json, same merge rules as
//! `Config::merge`), lock repository, `Request`. Rust-side replica of
//! tools/oracle-pool.php.

use crate::constraint::{Constraint, Op};
use crate::lockfile::{dump_package, lock_data, lock_packages, LockInput};
use crate::optimizer::PoolOptimizer;
use crate::package::{Origin, Package};
use crate::platform::{platform_packages, probe};
use crate::platform_filter::PlatformRequirementFilter;
use crate::policy::DefaultPolicy;
use crate::pool::{OrderedMap, Pool, PoolError, Repository, RepositorySet, Request};
use crate::repository::{
    locked_repository, ComposerRepository, FileTransport, HttpTransport, HttpTransports,
};
use crate::root::RootPackage;
use crate::solver::{SolveError, Solver};
use crate::transaction::LockTransaction;
use crate::version::{parse_stability, regex, stability_rank};
use pcre2::bytes::Regex;
use serde_json::{Map, Value};
use std::collections::{BTreeMap, BTreeSet};
use std::path::Path;
use std::sync::OnceLock;

#[derive(Debug, thiserror::Error)]
#[error("{message}")]
pub struct SessionError {
    pub message: String,
    pub kind: SessionErrorKind,
    /// A line Composer writes on STDOUT next to the error (`$io->write`
    /// after `$io->writeError`), as `UpdateCommand` does for a temporary
    /// constraint that misses the root's.
    pub stdout: Option<String>,
    /// The message as Composer writes it, piece by piece with each piece's
    /// level (`IOInterface::QUIET` for the headline of an unsolvable set and
    /// the `--no-dev` warning, the default level for the problems). Empty
    /// when the whole message has one level, the caller's.
    pub parts: Vec<(vivacity_core::io::Verbosity, String)>,
}

/// What Composer does with the error: an unsolvable set
/// (`SolverProblemsException`) means exit code 2 from `Installer::run`,
/// everything else is an exception that propagates.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum SessionErrorKind {
    Other,
    Unsolvable,
    /// Composer would carry this as a `TransportException`, whose code it
    /// rewrites to 100 (`Application.php:502-506`, `Installer.php:92`).
    Transport,
    /// The command prints the message itself and returns a code, with no
    /// `Error:` prefix and nothing written: `UpdateCommand`'s temporary
    /// constraint refusal (1), `Installer::run`'s partial update without a
    /// lock (3).
    Printed(i32),
}

impl SessionError {
    pub fn new(message: impl Into<String>) -> Self {
        Self {
            message: message.into(),
            kind: SessionErrorKind::Other,
            stdout: None,
            parts: Vec::new(),
        }
    }
}

impl From<PoolError> for SessionError {
    fn from(e: PoolError) -> SessionError {
        let transport = e.is_transport();
        SessionError {
            message: e.0,
            kind: if transport {
                SessionErrorKind::Transport
            } else {
                SessionErrorKind::Other
            },
            stdout: None,
            parts: Vec::new(),
        }
    }
}

/// The newtype errors of the other layers: a message, and nothing to
/// distinguish — none of them is a transport failure.
macro_rules! session_error_from {
    ($($ty:path),+ $(,)?) => {
        $(impl From<$ty> for SessionError {
            fn from(e: $ty) -> SessionError {
                SessionError::new(e.0)
            }
        })+
    };
}

session_error_from!(
    crate::loader::LoadError,
    crate::platform::PlatformError,
    crate::policy_config::PolicyError,
    crate::root::RootError,
);

/// A filter error, on the other hand, can be either.
impl From<crate::pool_filters::FilterError> for SessionError {
    fn from(e: crate::pool_filters::FilterError) -> SessionError {
        SessionError {
            kind: if e.1 == crate::repository::RepoErrorKind::Transport {
                SessionErrorKind::Transport
            } else {
                SessionErrorKind::Other
            },
            message: e.0,
            stdout: None,
            parts: Vec::new(),
        }
    }
}

/// A repository error keeps its nature: Composer rewrites a
/// `TransportException`'s code to `Installer::ERROR_TRANSPORT_EXCEPTION`
/// (100) before Symfony turns it into an exit code, so a failure to FETCH
/// something does not exit like a failure to understand it.
impl From<crate::repository::RepoError> for SessionError {
    fn from(e: crate::repository::RepoError) -> SessionError {
        let transport = e.is_transport();
        SessionError {
            message: e.0,
            kind: if transport {
                SessionErrorKind::Transport
            } else {
                SessionErrorKind::Other
            },
            stdout: None,
            parts: Vec::new(),
        }
    }
}

/// `Config::$repositories` after merging: (name or index, definition).
#[derive(Debug, Clone, PartialEq)]
pub struct RepoConfig {
    pub key: RepoKey,
    pub definition: Value,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub enum RepoKey {
    Named(String),
    Indexed(u64),
}

/// `Config::merge` for the `repositories` key, applied in order (defaults,
/// global config, composer.json).
pub fn merge_repositories(current: &mut Vec<RepoConfig>, new: &Value) {
    static PACKAGIST: OnceLock<Regex> = OnceLock::new();
    let entries: Vec<(RepoKey, Value)> = match new {
        Value::Array(list) => list
            .iter()
            .enumerate()
            .map(|(i, v)| (RepoKey::Indexed(i as u64), v.clone()))
            .collect(),
        Value::Object(map) => map
            .iter()
            .map(|(k, v)| {
                let key = match k.parse::<u64>() {
                    Ok(i) if i.to_string() == *k => RepoKey::Indexed(i),
                    _ => RepoKey::Named(k.clone()),
                };
                (key, v.clone())
            })
            .collect(),
        _ => return,
    };
    if entries.is_empty() {
        return;
    }
    current.reverse();
    // `disableRepoByName((string) $name)`: a numeric string falls back to
    // the integer key of the PHP array.
    let disable = |current: &mut Vec<RepoConfig>, name: &str| {
        let key = match name.parse::<u64>() {
            Ok(i) if i.to_string() == name => RepoKey::Indexed(i),
            _ => RepoKey::Named(name.to_owned()),
        };
        if current.iter().any(|r| r.key == key) {
            current.retain(|r| r.key != key);
        } else if name == "packagist" {
            current.retain(|r| r.key != RepoKey::Named("packagist.org".into()));
        }
    };
    for (key, repository) in entries.into_iter().rev() {
        if repository == Value::Bool(false) {
            let name = match &key {
                RepoKey::Named(n) => n.clone(),
                RepoKey::Indexed(i) => i.to_string(),
            };
            disable(current, &name);
            continue;
        }
        if let Some(obj) = repository.as_object() {
            if obj.len() == 1 && obj.values().next() == Some(&Value::Bool(false)) {
                disable(current, obj.keys().next().map(String::as_str).unwrap_or(""));
                continue;
            }
        }
        if repository.get("type").and_then(Value::as_str) == Some("composer") {
            if let Some(url) = repository.get("url").and_then(Value::as_str) {
                let re = regex(
                    &PACKAGIST,
                    r"^https?://(?:[a-z0-9-.]+\.)?packagist.org(/|$)",
                    false,
                );
                if re.is_match(url.as_bytes()).unwrap_or(false) {
                    disable(current, "packagist.org");
                }
            }
        }
        match key {
            RepoKey::Indexed(i) => {
                if current.iter().any(|r| r.key == RepoKey::Indexed(i)) {
                    let next = current
                        .iter()
                        .filter_map(|r| match r.key {
                            RepoKey::Indexed(j) => Some(j + 1),
                            _ => None,
                        })
                        .max()
                        .unwrap_or(0);
                    current.push(RepoConfig {
                        key: RepoKey::Indexed(next),
                        definition: repository,
                    });
                } else {
                    current.push(RepoConfig {
                        key: RepoKey::Indexed(i),
                        definition: repository,
                    });
                }
            }
            RepoKey::Named(name) => {
                let name = if name == "packagist" {
                    "packagist.org".to_owned()
                } else {
                    name
                };
                let key = RepoKey::Named(name);
                if let Some(slot) = current.iter_mut().find(|r| r.key == key) {
                    slot.definition = repository;
                } else {
                    current.push(RepoConfig {
                        key,
                        definition: repository,
                    });
                }
            }
        }
    }
    current.reverse();
}

/// Merged configuration relevant to the resolver.
#[derive(Debug, Clone, Default)]
pub struct MergedConfig {
    pub repositories: Vec<RepoConfig>,
    /// `config.platform` (the last definition replaces the previous one).
    pub platform: Map<String, Value>,
    /// `config.policy` and `config.audit` merged (`Config::merge`).
    pub policy: crate::policy_config::RawPolicyConfig,
}

impl MergedConfig {
    /// Defaults + `COMPOSER_HOME/config.json` + composer.json, like
    /// `Factory::createConfig` then `Config::merge($localConfig)`.
    pub fn load(
        manifest: &Value,
        composer_home: Option<&Path>,
    ) -> Result<MergedConfig, SessionError> {
        let mut cfg = MergedConfig {
            repositories: vec![RepoConfig {
                key: RepoKey::Named("packagist.org".into()),
                definition: serde_json::json!({"type": "composer", "url": "https://repo.packagist.org"}),
            }],
            platform: Map::new(),
            policy: crate::policy_config::RawPolicyConfig::default(),
        };
        if let Some(home) = composer_home {
            let global = home.join("config.json");
            if global.is_file() {
                let text = std::fs::read_to_string(&global)
                    .map_err(|e| SessionError::new(format!("{}: {e}", global.display())))?;
                let v: Value = serde_json::from_str(&text)
                    .map_err(|e| SessionError::new(format!("{}: {e}", global.display())))?;
                cfg.merge(&v);
            }
        }
        cfg.merge(manifest);
        Ok(cfg)
    }

    fn merge(&mut self, config: &Value) {
        // `$this->config['platform'] = $val`: any value replaces the
        // previous one (`[]` or `null` clear it).
        if let Some(platform) = config.get("config").and_then(|c| c.get("platform")) {
            self.platform = platform.as_object().cloned().unwrap_or_default();
        }
        if let Some(repos) = config.get("repositories") {
            merge_repositories(&mut self.repositories, repos);
        }
        if let Some(cfg) = config.get("config").and_then(Value::as_object) {
            self.policy.merge(cfg);
        }
    }
}

/// Result of a `solve`: the transaction and what is needed to compare it
/// with Composer.
pub struct SolveReport {
    pub transaction: LockTransaction,
    /// Decided literals, in order.
    pub decisions: Vec<i64>,
    /// `getRuleSetSize()`.
    pub rules: usize,
    /// Learned rules (conflicts encountered).
    pub learned: usize,
    /// What `Installer::doUpdate` writes after a successful resolution and
    /// before the lock operations, in order, each line with its level: the
    /// resolution's duration, the `Analyzed …` counts, `Nothing to modify in
    /// lock file`, the dev extraction's duration. Held rather than written so
    /// that the command prints them once it knows the run stays here.
    pub events: Vec<(vivacity_core::io::Verbosity, String)>,
}

/// Options of an `update` (`Installer::setUpdateAllowList`,
/// `setUpdateAllowTransitiveDependencies`).
#[derive(Debug, Clone, Default)]
pub struct UpdateOptions {
    /// `composer update a/b c/*`: patterns, lowercased and deduplicated.
    pub allow_list: Vec<String>,
    pub transitive: Option<crate::pool::UpdateMode>,
    /// `--no-blocking` / `--no-security-blocking`.
    pub no_blocking: bool,
    /// Dry run of `require`/`remove`: the root package is patched in
    /// memory, composer.json is not touched.
    pub root_patch: Option<crate::root::RootPatch>,
    /// composer-merge-plugin active: the root as its INIT /
    /// `PRE_UPDATE_CMD` merges left it (the merged manifest, the
    /// included files' own requirements for the stability flags).
    pub merged: Option<crate::merge_plugin::Merged>,
    /// `update --with a/b:^1` (and the `update a/b:^1` shorthand), as
    /// written: name → constraint text, in command order. Parsed and
    /// checked against the root requirements by `prepare_update`.
    pub temporary_requirements: Vec<(String, String)>,
}

impl UpdateOptions {
    /// `Installer::setUpdateAllowList`: `strtolower` + `array_unique`.
    pub fn partial(packages: &[String], transitive: crate::pool::UpdateMode) -> UpdateOptions {
        let mut allow_list: Vec<String> = Vec::new();
        for p in packages {
            let l = p.to_lowercase();
            if !allow_list.contains(&l) {
                allow_list.push(l);
            }
        }
        UpdateOptions {
            allow_list,
            transitive: Some(transitive),
            ..Default::default()
        }
    }
}

/// `UpdateCommand::execute`'s temporary-constraint block: the root's
/// references and stability flags take the requirements in, a name with
/// `*` expands over the root requirements, and every constraint must
/// intersect the one in composer.json — otherwise the command fails with
/// its own message (exit 1), before anything is written.
fn temporary_constraints(
    reqs: &[(String, String)],
    root: &mut RootPackage,
) -> Result<BTreeMap<String, crate::pool::TemporaryConstraint>, SessionError> {
    if reqs.is_empty() {
        return Ok(BTreeMap::new());
    }
    let pairs: Vec<(String, String)> = reqs.to_vec();
    crate::root::extract_references(&pairs, &mut root.references);
    let minimum = root.minimum_stability.clone();
    crate::root::extract_stability_flags(&pairs, &minimum, &mut root.stability_flags);
    // `$rootRequirements = array_merge(getRequires(), getDevRequires())`:
    // composer.json's order, which is the order a wildcard reports its
    // first mismatch in.
    let root_requires: Vec<(String, String, Constraint)> = root
        .all_requires()
        .iter()
        .map(|l| {
            (
                l.target.clone(),
                l.pretty_constraint.clone(),
                l.constraint.clone(),
            )
        })
        .collect();
    let fail = |message: String, stdout: Option<String>| SessionError {
        message,
        kind: SessionErrorKind::Printed(1),
        stdout,
        parts: Vec::new(),
    };
    let mut out: BTreeMap<String, crate::pool::TemporaryConstraint> = BTreeMap::new();
    for (name, text) in &pairs {
        let name = name.to_lowercase();
        let parsed = crate::pool::TemporaryConstraint {
            pretty: text.clone(),
            constraint: crate::constraint::parse_constraints(text)
                .map_err(|e| SessionError::new(format!("{name}: {e}")))?
                .constraint,
        };
        if name.contains('*') {
            let re = crate::pool::package_name_regexp(&name);
            for (target, pretty, constraint) in &root_requires {
                if !re.is_match(target.as_bytes()).unwrap_or(false) {
                    continue;
                }
                out.insert(target.clone(), parsed.clone());
                if !crate::intervals::have_intersections(&parsed.constraint, constraint) {
                    return Err(fail(
                        format!(
                            "The temporary constraint \"{text}\" for \"{name}\" matching \"{target}\" must be a subset of the constraint in your composer.json ({pretty})"
                        ),
                        None,
                    ));
                }
            }
        } else {
            out.insert(name.clone(), parsed.clone());
            if let Some((_, pretty, constraint)) = root_requires.iter().find(|(t, _, _)| *t == name)
            {
                if !crate::intervals::have_intersections(&parsed.constraint, constraint) {
                    return Err(fail(
                        format!(
                            "The temporary constraint \"{text}\" for \"{name}\" must be a subset of the constraint in your composer.json ({pretty})"
                        ),
                        Some(format!(
                            "Run `composer require {name}` or `composer require {name}:{text}` instead to replace the constraint"
                        )),
                    ));
                }
            }
        }
    }
    Ok(out)
}

/// Everything `Installer::doUpdate` has at hand right before `createPool`.
/// symfony/flex active for this resolution: its requirement and index.
#[derive(Debug, Clone)]
pub struct FlexSession {
    pub symfony_require: String,
    pub symfony: Constraint,
    pub versions: crate::flex_filter::FlexVersions,
}

pub struct UpdateSession {
    /// `None`: no Flex filter at `PRE_POOL_CREATE`.
    pub flex: Option<FlexSession>,
    pub arena: Vec<Package>,
    pub root: RootPackage,
    /// Arena indices of the fixed root (requires emptied) and of its alias.
    pub fixed_root: usize,
    pub fixed_root_alias: Option<usize>,
    pub platform: Vec<usize>,
    pub locked: Option<Vec<usize>>,
    pub set: RepositorySet,
    pub request: Request,
    pub config: MergedConfig,
    pub dev_mode: bool,
    /// `--prefer-stable` / `--prefer-lowest` from the command line.
    pub prefer_stable: bool,
    pub prefer_lowest: bool,
    /// `PHP_MAJOR.MINOR.RELEASE` of the probed PHP (`ext-*` rule of the
    /// `VersionSelector`).
    pub php_version: String,
    /// The pool blocking policies (`createPolicyConfig`).
    pub policy_config: crate::policy_config::PolicyConfig,
    /// `XdebugHandler::getAllIniFiles()` of the probed PHP (extension hint
    /// of an unsolvable set).
    pub ini_files: Vec<String>,
    /// `ext-*` loaded by the probed PHP, before `config.platform`.
    pub loaded_extensions: BTreeSet<String>,
    /// `Installer::$devMode` (`--no-dev` / `--update-no-dev` clear it):
    /// only the `--no-dev` warning of an unsolvable set reads it.
    pub installer_dev_mode: bool,
}

impl UpdateSession {
    pub fn prepare(
        project_dir: &Path,
        composer_home: Option<&Path>,
        dev_mode: bool,
    ) -> Result<UpdateSession, SessionError> {
        Self::prepare_with(project_dir, composer_home, dev_mode, None)
    }

    /// Like `prepare`, with a network transport for `https://` repositories.
    pub fn prepare_with(
        project_dir: &Path,
        composer_home: Option<&Path>,
        dev_mode: bool,
        http: Option<HttpTransports>,
    ) -> Result<UpdateSession, SessionError> {
        Self::prepare_full(project_dir, composer_home, dev_mode, http, None)
    }

    /// Like `prepare_with`, with Composer's `cache-repo-dir` directory for
    /// the metadata cache (read and written in Composer's format).
    pub fn prepare_full(
        project_dir: &Path,
        composer_home: Option<&Path>,
        dev_mode: bool,
        http: Option<HttpTransports>,
        cache_repo_dir: Option<&Path>,
    ) -> Result<UpdateSession, SessionError> {
        Self::prepare_update(
            project_dir,
            composer_home,
            dev_mode,
            http,
            cache_repo_dir,
            &UpdateOptions::default(),
        )
    }

    /// Like `prepare_full`, with the allow list of a partial update
    /// (`composer update a/b`).
    pub fn prepare_update(
        project_dir: &Path,
        composer_home: Option<&Path>,
        dev_mode: bool,
        http: Option<HttpTransports>,
        cache_repo_dir: Option<&Path>,
        options: &UpdateOptions,
    ) -> Result<UpdateSession, SessionError> {
        let partial_update = !options.allow_list.is_empty();
        let manifest_path = project_dir.join("composer.json");
        let manifest_text = std::fs::read_to_string(&manifest_path)
            .map_err(|e| SessionError::new(format!("{}: {e}", manifest_path.display())))?;
        let manifest: Value = serde_json::from_str(&manifest_text)
            .map_err(|e| SessionError::new(format!("{}: {e}", manifest_path.display())))?;
        let config = MergedConfig::load(&manifest, composer_home)?;
        let mut policy_config = crate::policy_config::PolicyConfig::from_raw(&config.policy)
            .map_err(SessionError::from)?;
        policy_config
            .apply_no_blocking(options.no_blocking)
            .map_err(SessionError::from)?;
        let mut root = RootPackage::load(&manifest, project_dir).map_err(SessionError::from)?;
        if let Some(merged) = &options.merged {
            // `RootPackageLoader` ran on the file: its stability flags are
            // the starting point. The plugin then merges each file's
            // links, aliases and references into the root; the flags of a
            // merged file come from its own `require` (and `require-dev`
            // in dev mode), `mergeStabilityFlags` — not from the merged
            // constraint text, which the loader never sees.
            let flags = std::mem::take(&mut root.stability_flags);
            root = RootPackage::load(&merged.manifest, project_dir).map_err(SessionError::from)?;
            root.stability_flags = flags;
            // (`require_dev` is recorded only when the merge ran in dev
            // mode — `mergeDevInto`, a second pass over the files.)
            for include in &merged.include_links {
                crate::root::merge_plugin_stability_flags(
                    &mut root.stability_flags,
                    &root.minimum_stability,
                    &include.require,
                );
            }
            for include in &merged.include_links {
                crate::root::merge_plugin_stability_flags(
                    &mut root.stability_flags,
                    &root.minimum_stability,
                    &include.require_dev,
                );
            }
        }
        if let Some(patch) = &options.root_patch {
            root.apply_patch(patch).map_err(SessionError::from)?;
        }
        // `UpdateCommand`: the temporary requirements feed the root's
        // references and stability flags before anything else reads them,
        // then become the pool's temporary constraints.
        let temporary_constraints =
            temporary_constraints(&options.temporary_requirements, &mut root)?;
        let probed = probe().map_err(SessionError::from)?;
        // `PHP_MAJOR_VERSION.PHP_MINOR_VERSION.PHP_RELEASE_VERSION` of the
        // actual PHP (no `config.platform.php` here): the first three
        // numbers of PHP_VERSION.
        let php_version = probed
            .iter()
            .find(|p| p.get("name").and_then(Value::as_str) == Some("php"))
            .and_then(|p| p.get("version").and_then(Value::as_str))
            .map(|v| {
                v.split(['.', '-', '+'])
                    .take(3)
                    .map(|part| part.trim_end_matches(|c: char| !c.is_ascii_digit()))
                    .collect::<Vec<_>>()
                    .join(".")
            })
            .unwrap_or_default();
        let platform_pkgs =
            platform_packages(&probed, &config.platform).map_err(SessionError::from)?;

        let mut arena: Vec<Package> = Vec::new();

        // `$fixedRootPackage = clone $package; setRequires([]); setDevRequires([])`.
        let mut fixed = root.package.clone();
        fixed.requires = Default::default();
        fixed.dev_requires = Default::default();
        arena.push(fixed);
        let fixed_root = 0;
        let fixed_root_alias = root.branch_alias.as_ref().map(|(normalized, pretty)| {
            let a = arena[fixed_root].alias(fixed_root, normalized, pretty);
            arena.push(a);
            arena.len() - 1
        });
        let root_members: Vec<usize> = fixed_root_alias
            .into_iter()
            .chain(std::iter::once(fixed_root))
            .collect();

        let mut platform: Vec<usize> = Vec::new();
        for p in platform_pkgs {
            arena.push(p);
            platform.push(arena.len() - 1);
        }

        // `Locker::isLocked()` = file present and `isset($data['packages'])`;
        // an unreadable lock is ignored for a full update (`doUpdate`
        // swallows the ParsingException), fatal for a partial one.
        let lock_path = project_dir.join("composer.lock");
        let lock: Option<Value> = if lock_path.is_file() {
            let text = std::fs::read_to_string(&lock_path)
                .map_err(|e| SessionError::new(format!("{}: {e}", lock_path.display())))?;
            match serde_json::from_str::<Value>(&text) {
                Ok(v) if v.get("packages").is_some_and(|p| !p.is_null()) => Some(v),
                Ok(_) => None,
                Err(e) => {
                    if partial_update {
                        return Err(SessionError::new(format!(
                            "\"{}\" does not contain valid JSON\n{e}",
                            lock_path.display()
                        )));
                    }
                    None
                }
            }
        } else {
            None
        };
        let locked = match &lock {
            Some(v) => Some(locked_repository(v, &mut arena).map_err(SessionError::from)?),
            None => None,
        };

        // `$stabilityFlags[$package->getName()] = STABILITIES[parseStability($package->getVersion())]`:
        // the version seen is that of the root alias if there is one.
        let mut stability_flags = root.stability_flags.clone();
        let root_version = match fixed_root_alias {
            Some(a) => arena[a].version.clone(),
            None => arena[fixed_root].version.clone(),
        };
        stability_flags.insert(
            root.package.name.clone(),
            stability_rank(parse_stability(&root_version)),
        );

        // `createRepositorySet(forUpdate)` and `requirePackagesForUpdate(..., true)`
        // always take require + require-dev, `--no-dev` or not; and with a
        // root alias, `$this->package` is the RootAliasPackage, whose
        // `self.version` links target the alias version.
        let mut root_requires: OrderedMap<Constraint> = OrderedMap::default();
        let requires = match &root.branch_alias {
            Some((normalized, pretty)) => {
                let aliased = root.package.alias(0, normalized, pretty);
                let mut all = aliased.requires.clone();
                for l in aliased.dev_requires.iter() {
                    all.insert(l.clone());
                }
                all
            }
            None => root.all_requires(),
        };
        for link in requires.iter() {
            root_requires.insert(&link.target, link.constraint.clone());
        }

        let mut set = RepositorySet::new(
            &root.minimum_stability,
            stability_flags,
            &root.aliases,
            root.references.clone(),
            root_requires,
            temporary_constraints,
        );
        set.add_repository(Repository::Root(root_members));
        set.add_repository(Repository::Platform(platform.clone()));
        for repo in &config.repositories {
            let origin = Origin::Repository(set.repositories.len());
            set.add_repository(open_repository(
                repo,
                http.as_ref(),
                cache_repo_dir,
                project_dir,
                origin,
                &mut arena,
            )?);
        }
        if let Some(ids) = &locked {
            set.add_repository(Repository::Locked(ids.clone()));
        }

        // `Installer::run`: a partial update requires a lock — the message
        // alone on stderr, exit 3.
        if partial_update && locked.is_none() {
            return Err(SessionError {
                message: "Cannot update only a partial set of packages without a lock file present. Run `composer update` to generate a lock file.".to_owned(),
                kind: SessionErrorKind::Printed(3),
                stdout: None,
                // `Installer.php:508`: at QUIET.
                parts: vec![(
                    vivacity_core::io::Verbosity::Quiet,
                    "Cannot update only a partial set of packages without a lock file present. Run `composer update` to generate a lock file.".to_owned(),
                )],
            });
        }
        let mut request = Request::new(locked.clone());
        if partial_update {
            request.set_update_allow_list(
                options.allow_list.clone(),
                options
                    .transitive
                    .unwrap_or(crate::pool::UpdateMode::OnlyListed),
            );
        }
        if let Some(a) = fixed_root_alias {
            request.fix_package(a);
        }
        request.fix_package(fixed_root);
        for &p in &platform {
            let provided = arena[fixed_root]
                .provides
                .get(&arena[p].name)
                .map(|l| l.constraint.clone());
            let provided_here = provided
                .is_some_and(|c| c.matches(&Constraint::new(Op::Eq, arena[p].version.clone())));
            if !provided_here {
                request.fix_package(p);
            }
        }
        for link in requires.iter() {
            request.require_name_pretty(
                &link.target,
                Some(link.constraint.clone()),
                &link.pretty_constraint,
            )?;
        }

        Ok(UpdateSession {
            flex: None,
            arena,
            root,
            fixed_root,
            fixed_root_alias,
            platform,
            locked,
            set,
            request,
            config,
            dev_mode,
            prefer_stable: false,
            prefer_lowest: false,
            php_version,
            policy_config,
            ini_files: crate::platform::ini_files(&probed),
            loaded_extensions: crate::platform::loaded_extensions(&probed),
            installer_dev_mode: true,
        })
    }

    pub fn create_pool(&mut self) -> Result<Pool, SessionError> {
        let pre_pool = self.flex.as_ref().map(|f| {
            // `$rootPackage->getRequires() + $rootPackage->getDevRequires()`:
            // a name in both keeps the `require` constraint.
            let mut root_constraints = BTreeMap::new();
            for link in self
                .root
                .package
                .requires
                .0
                .iter()
                .chain(self.root.package.dev_requires.0.iter())
            {
                root_constraints
                    .entry(link.target.clone())
                    .or_insert_with(|| link.constraint.clone());
            }
            crate::pool::PrePoolFilter {
                symfony_require: f.symfony_require.clone(),
                symfony: f.symfony.clone(),
                root_constraints,
                versions: f.versions.clone(),
            }
        });
        Ok(self
            .set
            .create_pool(&mut self.request, &mut self.arena, pre_pool.as_ref())?)
    }

    /// `Installer::createPolicy(true, ...)` without `--minimal-changes`.
    /// With Flex active, `COMPOSER_PREFER_DEV_OVER_PRERELEASE` is what Flex
    /// sets before Composer builds the policy.
    pub fn policy(&self) -> DefaultPolicy {
        let mut policy = DefaultPolicy::new(
            self.prefer_stable || self.root.prefer_stable,
            self.prefer_lowest,
            None,
        );
        if self.flex.is_some() {
            policy.prefer_dev_over_prerelease = true;
        }
        policy
    }

    /// `Installer::extractDevPackages`: second solve without the
    /// require-dev, on only the packages kept by the first, to classify
    /// `packages` / `packages-dev`.
    pub fn extract_dev_packages(
        &mut self,
        transaction: &mut LockTransaction,
        policy: &mut DefaultPolicy,
        filter: &PlatformRequirementFilter,
        events: &mut Vec<(vivacity_core::io::Verbosity, String)>,
    ) -> Result<(), SessionError> {
        if self.root.package.dev_requires.is_empty() {
            return Ok(());
        }
        // `$resultRepo`: each package reloaded from its dump (`load`, one at
        // a time), branch aliases recreated -> [alias, base].
        let dumps: Vec<Value> = transaction
            .new_lock_packages(&self.arena, false)
            .iter()
            .map(|&idx| Value::Object(dump_package(&self.arena[idx])))
            .collect();
        let result_ids =
            crate::loader::load_packages(&dumps, Origin::Result, &mut self.arena, false)
                .map_err(SessionError::from)?;
        // createPoolWithAllPackages: root, platform, result, with the root
        // aliases applied along the way.
        let mut members: Vec<usize> = Vec::new();
        members.extend(self.fixed_root_alias);
        members.push(self.fixed_root);
        members.extend(self.platform.iter().copied());
        members.extend(result_ids);
        let mut pool_packages: Vec<usize> = Vec::new();
        for idx in members {
            pool_packages.push(idx);
            let (name, version) = (
                self.arena[idx].name.clone(),
                self.arena[idx].version.clone(),
            );
            if let Some((alias, alias_normalized)) = self
                .set
                .root_aliases
                .get(&name)
                .and_then(|m| m.get(&version))
            {
                let mut base = idx;
                while let Some(b) = self.arena[base].alias_of {
                    base = b;
                }
                let mut a = self.arena[base].alias(base, alias_normalized, alias);
                a.root_package_alias = true;
                a.origin = Origin::Detached;
                self.arena.push(a);
                pool_packages.push(self.arena.len() - 1);
            }
        }
        let pool = Pool::new(pool_packages, Vec::new(), &self.arena);
        // createRequest (without lock) + requirePackagesForUpdate(..., false).
        let mut request = Request::new(None);
        if let Some(a) = self.fixed_root_alias {
            request.fix_package(a);
        }
        request.fix_package(self.fixed_root);
        for &p in &self.platform {
            let provided = self.arena[self.fixed_root]
                .provides
                .get(&self.arena[p].name)
                .map(|l| l.constraint.clone());
            let provided_here = provided.is_some_and(|c| {
                c.matches(&Constraint::new(Op::Eq, self.arena[p].version.clone()))
            });
            if !provided_here {
                request.fix_package(p);
            }
        }
        let requires = match &self.root.branch_alias {
            Some((normalized, pretty)) => self.root.package.alias(0, normalized, pretty).requires,
            None => self.root.package.requires.clone(),
        };
        for link in requires.iter() {
            request.require_name_pretty(
                &link.target,
                Some(link.constraint.clone()),
                &link.pretty_constraint,
            )?;
        }
        let mut solver = Solver::new(&pool, &self.arena);
        let before = std::time::Instant::now();
        let solved = solver.solve(&request, policy, filter);
        // `Solver::solve`: the duration at VERBOSE, before any problem —
        // held with the caller's lines on success.
        events.push(resolution_completed(before));
        let non_dev = match solved {
            Ok(t) => t,
            Err(SolveError::Problems(problems)) => {
                drop(solver);
                // `Installer::extractDevPackages`: `$isDevExtraction`, on a
                // request without lock built for this solve.
                let pretty = {
                    let mut ctx = crate::problem::MessageContext {
                        arena: &mut self.arena,
                        set: &self.set,
                        pool: &pool,
                        request: &request,
                        is_verbose: vivacity_core::io::shows(vivacity_core::io::Verbosity::Verbose),
                        ini_files: &self.ini_files,
                        loaded_extensions: &self.loaded_extensions,
                    };
                    crate::problem::pretty_string(&mut ctx, &problems, true)
                };
                // `Installer::extractDevPackages`: the headline at QUIET, the
                // rest at the default level.
                let head = "Unable to find a compatible set of packages based on your non-dev requirements alone.";
                let rest = format!("Your requirements can be resolved successfully when require-dev packages are present.\nYou may need to move packages from require-dev or some of their dependencies to require.\n{pretty}");
                return Err(SessionError {
                    message: format!("{head}\n{rest}"),
                    kind: SessionErrorKind::Unsolvable,
                    stdout: None,
                    parts: vec![
                        (vivacity_core::io::Verbosity::Quiet, head.to_owned()),
                        (vivacity_core::io::Verbosity::Normal, rest),
                    ],
                });
            }
            Err(SolveError::Bug(b)) => return Err(SessionError::new(b)),
        };
        transaction.set_non_dev_packages(&self.arena, &non_dev);
        Ok(())
    }

    /// `extractPlatformRequirements($links)`.
    fn platform_requirements(links: &crate::package::Links) -> Map<String, Value> {
        let mut out = Map::new();
        for l in links.iter() {
            if crate::platform::is_platform_package(&l.target) {
                out.insert(l.target.clone(), Value::String(l.pretty_constraint.clone()));
            }
        }
        out
    }

    /// `Locker::setLockData(...)`: the lock JSON to write.
    pub fn lock_json(
        &self,
        transaction: &LockTransaction,
        manifest_text: &str,
    ) -> Result<Value, SessionError> {
        let content_hash = vivacity_core::content_hash::content_hash(manifest_text)
            .map_err(|e| SessionError::new(e.to_string()))?;
        let packages = lock_packages(
            &self.arena,
            &transaction.new_lock_packages(&self.arena, false),
        )
        .map_err(SessionError::new)?;
        let packages_dev = lock_packages(
            &self.arena,
            &transaction.new_lock_packages(&self.arena, true),
        )
        .map_err(SessionError::new)?;
        let (requires, dev_requires) = match &self.root.branch_alias {
            Some((normalized, pretty)) => {
                let a = self.root.package.alias(0, normalized, pretty);
                (a.requires, a.dev_requires)
            }
            None => (
                self.root.package.requires.clone(),
                self.root.package.dev_requires.clone(),
            ),
        };
        Ok(lock_data(LockInput {
            content_hash: &content_hash,
            packages,
            packages_dev: Some(packages_dev),
            platform: Self::platform_requirements(&requires),
            platform_dev: Self::platform_requirements(&dev_requires),
            aliases: &transaction.aliases(&self.arena, &self.root.aliases),
            minimum_stability: &self.root.minimum_stability,
            stability_flags: &self.root.stability_flags,
            prefer_stable: self.prefer_stable || self.root.prefer_stable,
            prefer_lowest: self.prefer_lowest,
            platform_overrides: &self.config.platform,
        }))
    }

    /// Full `composer update --no-install`: solve, dev package extraction,
    /// lock data. Returns the lock JSON and the report of the first solve.
    pub fn update(
        &mut self,
        manifest_text: &str,
        filter: &PlatformRequirementFilter,
    ) -> Result<(Value, SolveReport), SessionError> {
        let trace = std::env::var_os("VIVACITY_TRACE").is_some();
        let t = std::time::Instant::now();
        let lap = |label: &str, t: &std::time::Instant| {
            if trace {
                eprintln!(
                    "trace: {label:<22} {:>7.1} ms",
                    t.elapsed().as_secs_f64() * 1000.0
                );
            }
        };
        let mut policy = self.policy();
        let pool = self.create_filtered_pool()?;
        // `Installer::doUpdate`: the pool is built (Flex's notice comes out
        // of it), then `Updating dependencies`, then the policy filters'
        // warnings as they happened.
        if let Some(notice) = &pool.flex_notice {
            vivacity_core::say!("{notice}");
        }
        vivacity_core::say!("Updating dependencies");
        for w in &pool.warnings {
            vivacity_core::say!("{w}");
        }
        lap("pool", &t);
        let pool = if std::env::var("COMPOSER_POOL_OPTIMIZER").as_deref() == Ok("0") {
            pool
        } else {
            PoolOptimizer::new().optimize(&self.request, &pool, &self.arena, &mut policy)
        };
        lap("optimize", &t);
        let before = std::time::Instant::now();
        let solved = self.solve(&pool, &mut policy, filter);
        let completed = resolution_completed(before);
        let mut report = match solved {
            Ok(mut r) => {
                r.events.push(completed);
                r
            }
            Err(SolveError::Problems(problems)) => {
                // `Solver::solve` wrote its duration before throwing.
                say_event(&completed);
                // `Installer::doUpdate`: the headline, the pretty problems,
                // the `--no-dev` warning.
                // The headline and the warning at QUIET, the problems at the
                // default level.
                let pretty = self.pretty_problems(&pool, &problems, false);
                let head =
                    "Your requirements could not be resolved to an installable set of packages.";
                let mut parts = vec![
                    (vivacity_core::io::Verbosity::Quiet, head.to_owned()),
                    (vivacity_core::io::Verbosity::Normal, pretty),
                ];
                if !self.installer_dev_mode {
                    parts.push((vivacity_core::io::Verbosity::Quiet, "Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems.".to_owned()));
                }
                let message = parts
                    .iter()
                    .map(|(_, p)| p.as_str())
                    .collect::<Vec<_>>()
                    .join("\n");
                return Err(SessionError {
                    message,
                    kind: SessionErrorKind::Unsolvable,
                    stdout: None,
                    parts,
                });
            }
            Err(SolveError::Bug(b)) => {
                say_event(&completed);
                return Err(SessionError::new(b));
            }
        };
        lap("solve", &t);
        // `ValidatingArrayLoader::validatePackage` on every kept package
        // (`LockTransaction::setResultPackages`, inside `Solver::solve`): a
        // SecurityException stops the update before anything else is written.
        for &idx in &report.transaction.all {
            if let Err(e) = crate::lockfile::validate_package(&self.arena[idx]) {
                say_events(&report.events);
                return Err(SessionError::new(e));
            }
        }
        // `Installer::doUpdate`, in its order: the pool and rule set sizes
        // at VERBOSE, `Nothing to modify in lock file`, then the dev
        // extraction (its own resolution line).
        use vivacity_core::io::Verbosity;
        report.events.push((
            Verbosity::Verbose,
            format!("Analyzed {} packages to resolve dependencies", pool.len()),
        ));
        report.events.push((
            Verbosity::Verbose,
            format!("Analyzed {} rules to resolve dependencies", report.rules),
        ));
        if report.transaction.transaction.operations.is_empty() {
            report.events.push((
                Verbosity::Normal,
                "Nothing to modify in lock file".to_owned(),
            ));
        }
        drop(pool);
        let mut transaction = std::mem::replace(&mut report.transaction, LockTransaction::empty());
        if let Err(e) =
            self.extract_dev_packages(&mut transaction, &mut policy, filter, &mut report.events)
        {
            // Composer wrote the lines above before the extraction failed.
            say_events(&report.events);
            return Err(e);
        }
        lap("extract dev", &t);
        let lock = self.lock_json(&transaction, manifest_text)?;
        lap("lock data", &t);
        report.transaction = transaction;
        Ok((lock, report))
    }

    /// `SolverProblemsException::getPrettyString` for problems found on
    /// `pool` with this session's request.
    pub fn pretty_problems(
        &mut self,
        pool: &Pool,
        problems: &[crate::solver::SolvedProblem],
        is_dev_extraction: bool,
    ) -> String {
        let mut ctx = crate::problem::MessageContext {
            arena: &mut self.arena,
            set: &self.set,
            pool,
            request: &self.request,
            is_verbose: vivacity_core::io::shows(vivacity_core::io::Verbosity::Verbose),
            ini_files: &self.ini_files,
            loaded_extensions: &self.loaded_extensions,
        };
        crate::problem::pretty_string(&mut ctx, problems, is_dev_extraction)
    }

    /// `createPool` with the PoolOptimizer (unless `COMPOSER_POOL_OPTIMIZER=0`),
    /// like `Installer::doUpdate`.
    /// `RepositorySet::findPackages($name)` on the `CompositeRepository` of
    /// `require` (platform then project repositories, all merged) with a
    /// `RepositorySet` reduced to `minimum-stability` (no flags);
    /// `ignore_stability` means `ALLOW_UNACCEPTABLE_STABILITIES`.
    pub fn find_packages_for_require(
        &mut self,
        name: &str,
        ignore_stability: bool,
    ) -> Result<Vec<usize>, SessionError> {
        let name = name.to_lowercase();
        let mut acceptable = BTreeMap::new();
        let min = crate::version::stability_rank(&self.root.minimum_stability);
        for st in ["stable", "RC", "beta", "alpha", "dev"] {
            let rank = crate::version::stability_rank(st);
            if ignore_stability || rank <= min {
                acceptable.insert(st.to_owned(), rank);
            }
        }
        let flags = BTreeMap::new();
        let already = BTreeMap::new();
        let map = vec![(name.clone(), Constraint::MatchAll)];
        let mut found: Vec<usize> = Vec::new();
        let (_, ids) = crate::pool::array_repository_load_packages(
            &self.platform,
            &map,
            &acceptable,
            &flags,
            &already,
            &self.arena,
        );
        found.extend(ids);
        for (i, repo) in self.set.repositories.iter().enumerate() {
            if let Repository::Composer(repo) = repo {
                let (_, ids) = repo
                    .load_packages(
                        &map,
                        &acceptable,
                        &flags,
                        &already,
                        Origin::Repository(i),
                        &mut self.arena,
                    )
                    .map_err(SessionError::from)?;
                found.extend(ids);
            }
        }
        Ok(found)
    }

    pub fn create_optimized_pool(
        &mut self,
        policy: &mut DefaultPolicy,
    ) -> Result<Pool, SessionError> {
        let pool = self.create_filtered_pool()?;
        if std::env::var("COMPOSER_POOL_OPTIMIZER").as_deref() == Ok("0") {
            return Ok(pool);
        }
        Ok(PoolOptimizer::new().optimize(&self.request, &pool, &self.arena, policy))
    }

    /// `buildPool` up to the policy filters (advisories, lists), without the
    /// optimizer; their warnings go into `pool.warnings`.
    pub fn create_filtered_pool(&mut self) -> Result<Pool, SessionError> {
        let mut pool = self.create_pool()?;
        let before = pool.len();
        // The policy filters rebuild the pool: what PRE_POOL_CREATE noted
        // rides along.
        let flex_notice = pool.flex_notice.take();
        let mut warnings = Vec::new();
        pool = crate::pool_filters::security_advisory_filter(
            pool,
            &self.arena,
            &self.set.repositories,
            &self.request,
            &self.policy_config,
            &mut warnings,
        )
        .map_err(SessionError::from)?;
        pool = crate::pool_filters::filter_list_filter(
            pool,
            &self.arena,
            &self.set.repositories,
            &self.request,
            &self.policy_config,
            "update",
            &mut warnings,
        )
        .map_err(SessionError::from)?;
        pool.warnings.extend(warnings);
        pool.flex_notice = flex_notice;
        if std::env::var_os("VIVACITY_TRACE").is_some() {
            eprintln!(
                "trace: policy filters      {before} → {} package versions ({} removed by lists)",
                pool.len(),
                pool.filter_list_removed
                    .values()
                    .map(Vec::len)
                    .sum::<usize>()
            );
        }
        Ok(pool)
    }

    /// `Solver::solve` on this pool; returns the transaction and the
    /// decisions (pool literals, in order) with the rule set size.
    pub fn solve(
        &self,
        pool: &Pool,
        policy: &mut DefaultPolicy,
        filter: &PlatformRequirementFilter,
    ) -> Result<SolveReport, SolveError> {
        let mut solver = Solver::new(pool, &self.arena);
        let transaction = solver.solve(&self.request, policy, filter)?;
        let decisions = solver.decisions.queue.iter().map(|d| d.literal).collect();
        Ok(SolveReport {
            learned: solver
                .rules
                .ids_of_type(crate::rule::RuleType::Learned)
                .len(),
            rules: solver.rule_set_size(),
            decisions,
            transaction,
            events: Vec::new(),
        })
    }
}

/// `Solver.php:231`: `Dependency resolution completed in %.3f seconds` at
/// VERBOSE, after every resolution, before its problems are thrown.
fn resolution_completed(before: std::time::Instant) -> (vivacity_core::io::Verbosity, String) {
    (
        vivacity_core::io::Verbosity::Verbose,
        format!(
            "Dependency resolution completed in {:.3} seconds",
            before.elapsed().as_secs_f64()
        ),
    )
}

/// A held line, written at its level.
fn say_event((level, line): &(vivacity_core::io::Verbosity, String)) {
    if vivacity_core::io::shows(*level) {
        eprintln!("{line}");
    }
}

/// The held lines, in order — on the error paths, where the command never
/// gets a report to print them from.
fn say_events(events: &[(vivacity_core::io::Verbosity, String)]) {
    events.iter().for_each(say_event);
}

/// Running the lock pool through the filter list filter in `install` scope
/// (`Installer::doInstall` -> `createFilterListPoolFilter(BLOCK_SCOPE_INSTALL)`):
/// Composer's problems for the removed locked versions, in lock order;
/// empty when nothing blocks. Warnings (ignored unreachable repositories)
/// are returned separately.
pub fn install_policy_problems(
    project_dir: &Path,
    composer_home: Option<&Path>,
    http: Option<HttpTransports>,
    cache_repo_dir: Option<&Path>,
    with_dev: bool,
    no_blocking: bool,
) -> Result<(Vec<String>, Vec<String>), SessionError> {
    let manifest_text = std::fs::read_to_string(project_dir.join("composer.json"))
        .map_err(|e| SessionError::new(format!("composer.json: {e}")))?;
    let manifest: Value = serde_json::from_str(&manifest_text)
        .map_err(|e| SessionError::new(format!("composer.json: {e}")))?;
    let config = MergedConfig::load(&manifest, composer_home)?;
    let mut policy =
        crate::policy_config::PolicyConfig::from_raw(&config.policy).map_err(SessionError::from)?;
    policy
        .apply_no_blocking(no_blocking)
        .map_err(SessionError::from)?;
    if !policy.malware_blocks("install") {
        return Ok((Vec::new(), Vec::new()));
    }
    let lock_text = std::fs::read_to_string(project_dir.join("composer.lock"))
        .map_err(|e| SessionError::new(format!("composer.lock: {e}")))?;
    let lock: Value = serde_json::from_str(&lock_text)
        .map_err(|e| SessionError::new(format!("composer.lock: {e}")))?;
    // Only `composer` repositories carry lists; the other types (which
    // `install` otherwise accepts) are left aside here.
    let mut repositories: Vec<Repository> = Vec::new();
    for repo in &config.repositories {
        if repo.definition.get("type").and_then(Value::as_str) != Some("composer") {
            continue;
        }
        // The constructor does no I/O: an error here is a configuration
        // error, fatal as in Composer.
        repositories.push(open_repository_with(
            repo,
            http.as_ref(),
            cache_repo_dir,
            true,
        )?);
    }
    let mut arena: Vec<Package> = Vec::new();
    let locked = crate::repository::locked_repository_with(&lock, &mut arena, with_dev)
        .map_err(SessionError::from)?;
    let mut request = Request::new(Some(locked.clone()));
    for &idx in &locked {
        request.fix_locked_package(idx);
    }
    let pool = Pool::new(locked.clone(), Vec::new(), &arena);
    let mut warnings = Vec::new();
    let pool = crate::pool_filters::filter_list_filter(
        pool,
        &arena,
        &repositories,
        &request,
        &policy,
        "install",
        &mut warnings,
    )
    .map_err(SessionError::from)?;
    let problems: Vec<String> = locked
        .iter()
        .map(|&idx| &arena[idx])
        .filter(|p| pool.is_filter_list_removed(&p.name, &p.version))
        .map(|p| crate::pool_filters::locked_removed_problem_text(&pool, p))
        .collect();
    Ok((problems, warnings))
}

/// `RepositoryManager::createRepository` for the `composer` and `path`
/// types (`vcs` and the others are not supported yet). A `path` repository
/// reads its packages now, into the arena, as `origin`.
fn open_repository(
    repo: &RepoConfig,
    http: Option<&HttpTransports>,
    cache_repo_dir: Option<&Path>,
    project_dir: &Path,
    origin: Origin,
    arena: &mut Vec<Package>,
) -> Result<Repository, SessionError> {
    if repo.definition.get("type").and_then(Value::as_str) == Some("path") {
        if repo.definition.get("only").is_some()
            || repo.definition.get("exclude").is_some()
            || repo.definition.get("canonical").is_some()
        {
            return Err(SessionError::new(format!(
                "repository filters (only/exclude/canonical) are not supported by vivacity update yet ({})",
                key_string(&repo.key)
            )));
        }
        let path_repo = crate::path_repo::open(&repo.definition, project_dir, origin, arena)
            .map_err(SessionError::from)?;
        return Ok(Repository::Path(path_repo));
    }
    open_repository_with(repo, http, cache_repo_dir, false)
}

/// `for_policies`: a repository with `only`/`exclude`/`canonical`
/// (`FilterRepository`) is accepted (the advisory and list paths honor
/// `only`/`exclude`) where resolution still rejects it.
fn open_repository_with(
    repo: &RepoConfig,
    http: Option<&HttpTransports>,
    cache_repo_dir: Option<&Path>,
    for_policies: bool,
) -> Result<Repository, SessionError> {
    let def = &repo.definition;
    let kind = def.get("type").and_then(Value::as_str).ok_or_else(|| {
        SessionError::new(format!(
            "Repository \"{}\" ({def}) must have a type defined",
            key_string(&repo.key)
        ))
    })?;
    if kind != "composer" {
        return Err(SessionError::new(format!(
            "repository type \"{kind}\" is not supported by vivacity update yet ({})",
            key_string(&repo.key)
        )));
    }
    if !for_policies
        && (def.get("only").is_some()
            || def.get("exclude").is_some()
            || def.get("canonical").is_some())
    {
        return Err(SessionError::new(format!(
            "repository filters (only/exclude/canonical) are not supported by vivacity update yet ({})",
            key_string(&repo.key)
        )));
    }
    let url = def.get("url").and_then(Value::as_str).ok_or_else(|| {
        SessionError::new(format!("repository {} has no url", key_string(&repo.key)))
    })?;
    let transport: Box<dyn crate::repository::Transport> = if url.starts_with("file://") {
        Box::new(FileTransport)
    } else if url.starts_with("http://") || url.starts_with("https://") || !url.contains("://") {
        match http {
            Some(h) => Box::new(HttpTransport {
                fetch: h.0.clone(),
                fetch_many: h.1.clone(),
                post: h.2.clone(),
            }),
            None => {
                return Err(SessionError::new(format!(
                    "remote composer repositories need a network transport ({url})"
                )))
            }
        }
    } else {
        return Err(SessionError::new(format!(
            "unsupported repository url scheme ({url})"
        )));
    };
    let mut repo = ComposerRepository::open(url, transport).map_err(SessionError::from)?;
    if let Some(options) = def.get("options") {
        repo.options = options.clone();
    }
    repo.set_user_filter(def.get("filter"))
        .map_err(SessionError::from)?;
    if for_policies {
        repo.set_name_filter(def.get("only"), def.get("exclude"))
            .map_err(SessionError::from)?;
    }
    if let Some(dir) = cache_repo_dir {
        repo.cache = Some(crate::metacache::MetadataCache::new(dir, &repo.url));
    }
    Ok(Repository::Composer(Box::new(repo)))
}

fn key_string(key: &RepoKey) -> String {
    match key {
        RepoKey::Named(n) => n.clone(),
        RepoKey::Indexed(i) => i.to_string(),
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::json;

    fn names(repos: &[RepoConfig]) -> Vec<String> {
        repos.iter().map(|r| key_string(&r.key)).collect()
    }

    #[test]
    fn merges_repositories_like_composer_config() {
        let mut cfg = MergedConfig::load(&json!({}), None).unwrap();
        assert_eq!(names(&cfg.repositories), vec!["packagist.org"]);
        // global config: snapshot + packagist disabled.
        cfg.merge(&json!({"repositories": {"snapshot": {"type": "composer", "url": "file:///s"}, "packagist.org": false}}));
        assert_eq!(names(&cfg.repositories), vec!["snapshot"]);
        // composer.json: an indexed repository goes first.
        cfg.merge(&json!({"repositories": [{"type": "composer", "url": "https://packages.drupal.org/8"}]}));
        assert_eq!(names(&cfg.repositories), vec!["0", "snapshot"]);
        // two indexed ones while 0 exists: 1 takes its key, 0 is renumbered
        // (`$this->repositories[] = ...`); the new ones stay in front.
        cfg.merge(
            &json!({"repositories": [{"type": "vcs", "url": "a"}, {"type": "vcs", "url": "b"}]}),
        );
        assert_eq!(names(&cfg.repositories), vec!["2", "1", "0", "snapshot"]);
        assert_eq!(cfg.repositories[0].definition["url"], "a");
        assert_eq!(cfg.repositories[1].definition["url"], "b");
        assert_eq!(
            cfg.repositories[2].definition["url"],
            "https://packages.drupal.org/8"
        );
    }

    #[test]
    fn packagist_url_disables_default() {
        let mut cfg = MergedConfig::load(&json!({}), None).unwrap();
        cfg.merge(
            &json!({"repositories": [{"type": "composer", "url": "https://repo.packagist.org"}]}),
        );
        assert_eq!(names(&cfg.repositories), vec!["0"]);
        let mut cfg = MergedConfig::load(&json!({}), None).unwrap();
        cfg.merge(&json!({"repositories": [{"packagist": false}]}));
        assert!(cfg.repositories.is_empty());
    }
}