Use off-the-shelf dependency resolver instead of handrolled code

.pre-commit-config.yaml

@@ -25,7 +25,9 @@ repos:
     additional_dependencies:
       - "argcomplete>=3.6.3"
       - "GitPython>=3.1.43"
+      - "nab-resolver>=0.0.11"
       - "semantic_version>=2.10.0"
+      - "typing_extensions>=4.0"
       - "types-docutils>=0.21.0.20250809"
       - "types-setuptools>=80.9.0.20250809"
       - "pytest>=9.0.3"

pyproject.toml

@@ -39,6 +39,8 @@ dependencies = [
     # Technically not a zkg dependency, but typically expected by users to be present.
     "btest>=1.1",
     "argcomplete>=3.6.3",
+    "nab-resolver==0.0.11",
+    "typing_extensions>=4.0",
 ]
 
 [project.optional-dependencies]

testing/baselines/tests.builtin-spicy-version-error/output

@@ -1,2 +1,8 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-error: failed to resolve dependencies: unsatisfiable dependency: "zeek-builtin/spicy-plugin" (X.X.X) is installed, but "one/alice/foo" requires <X.X.X (X.X.X not in <X.X.X)
+error: failed to resolve dependencies: because no versions of one/alice/foo <X.X.X | >X.X.X are available
+because one/alice/foo =X.X.X depends on zeek-builtin/spicy-plugin <X.X.X
+so one/alice/foo * and not zeek-builtin/spicy-plugin <X.X.X
+because no versions of zeek-builtin/spicy-plugin <X.X.X are available
+so one/alice/foo *
+because your project depends on one/alice/foo *
+so <root> =X.X.X

testing/baselines/tests.dependency-ordering/build.log

@@ -1,11 +1,11 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
 building grault
+building bar
 building corge
 building baz
-building bar
 building foo
 building grault
+building bar
 building corge
 building baz
-building bar
 building foo

testing/baselines/tests.installed-dependency-conflict-resolution/conflict.out

@@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+error: failed to resolve dependencies: because the user constrained one/alice/bar 1.0.0

testing/baselines/tests.installed-dependency-conflict-resolution/installed-final.out

@@ -0,0 +1,3 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+one/alice/bar (installed: 2.0.0)
+one/alice/foo (installed: 2.0.0)

testing/baselines/tests.unsatisfied-version-tag-dependency/fail.out

@@ -1,4 +1,8 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
-error: failed to resolve dependencies: "one/alice/bar" has no version satisfying dependencies:
-	"one/alice/foo" requires: "=1.0.0"
-
+error: failed to resolve dependencies: because no versions of one/alice/foo <0.0.0 | >0.0.0 are available
+because one/alice/foo =0.0.0 depends on one/alice/bar =1.0.0
+so one/alice/foo * and not one/alice/bar =1.0.0
+because no versions of one/alice/bar =1.0.0 are available
+so one/alice/foo *
+because your project depends on one/alice/foo *
+so <root> =0.0.0

testing/baselines/tests.upgrade-via-dependency/conflict.out

@@ -0,0 +1,2 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+error: failed to resolve dependencies: because no versions of one/alice/foo <0.0.0 | >0.0.0 are available

testing/baselines/tests.upgrade-via-dependency/installed-final.out

@@ -0,0 +1,3 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+one/alice/bar (installed: 2.0.0)
+one/alice/foo (installed: main)

testing/baselines/tests.installed-dependency-conflict/installed-final.out → testing/baselines/tests.upgrade-via-dependency/installed-initial.out

@@ -1,3 +1,2 @@
 ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
 one/alice/bar (installed: 1.0.0)
-one/alice/foo (installed: 1.0.0)

testing/test_manager.py

@@ -9,6 +9,8 @@
 import git
 import pytest
 
+from zeekpkg._resolver import _deps_at_version
+from zeekpkg._util import _semver_versions
 from zeekpkg.manager import (
     GitResolution,
     Manager,
@@ -540,6 +542,76 @@ def test_directory_package(
         assert "cannot bundle directory package" in result
 
 
+def _make_tagged_repo(
+    tmp_path: pathlib.Path,
+    tag: str,
+    meta_filename: str,
+    meta_content: str,
+) -> git.Repo:
+    r = git.Repo.init(tmp_path, initial_branch="main")
+    r.config_writer().set_value("user", "name", "Test").release()
+    r.config_writer().set_value("user", "email", "test@test").release()
+    (tmp_path / meta_filename).write_text(meta_content)
+    r.index.add([meta_filename])
+    r.index.commit("init")
+    r.create_tag(tag)
+    return r
+
+
+class TestDepsAtVersion:
+    def test_reads_from_zkg_meta(self, tmp_path: pathlib.Path) -> None:
+        content = "[package]\ndescription = test\ndepends = dep-a >=1.0.0 dep-b *\n"
+        r = _make_tagged_repo(tmp_path, "v1.0.0", "zkg.meta", content)
+        result = _deps_at_version(r, "v1.0.0")
+        assert result == {"dep-a": ">=1.0.0", "dep-b": "*"}
+
+    def test_falls_back_to_legacy_meta(self, tmp_path: pathlib.Path) -> None:
+        content = "[package]\ndescription = test\ndepends = dep-c >=2.0.0\n"
+        r = _make_tagged_repo(tmp_path, "v1.0.0", "bro-pkg.meta", content)
+        result = _deps_at_version(r, "v1.0.0")
+        assert result == {"dep-c": ">=2.0.0"}
+
+    def test_returns_empty_when_no_meta_file(self, tmp_path: pathlib.Path) -> None:
+        r = git.Repo.init(tmp_path, initial_branch="main")
+        r.config_writer().set_value("user", "name", "Test").release()
+        r.config_writer().set_value("user", "email", "test@test").release()
+        (tmp_path / "README").write_text("hi")
+        r.index.add(["README"])
+        r.index.commit("init")
+        r.create_tag("v1.0.0")
+        result = _deps_at_version(r, "v1.0.0")
+        assert result == {}
+
+    def test_returns_empty_when_no_depends_field(self, tmp_path: pathlib.Path) -> None:
+        content = "[package]\ndescription = no deps here\n"
+        r = _make_tagged_repo(tmp_path, "v1.0.0", "zkg.meta", content)
+        result = _deps_at_version(r, "v1.0.0")
+        assert result == {}
+
+
+class TestSemverVersions:
+    def test_filters_invalid(self) -> None:
+        tags = ["v1.0.0", "not-a-version", "v2.3.4", "branch-name"]
+        result = _semver_versions(tags)
+        assert result == [("v1.0.0", "1.0.0"), ("v2.3.4", "2.3.4")]
+
+    def test_strips_v_prefix(self) -> None:
+        result = _semver_versions(["v1.2.3"])
+        assert result == [("v1.2.3", "1.2.3")]
+
+    def test_coerces_partial(self) -> None:
+        result = _semver_versions(["1.2"])
+        assert result == [("1.2", "1.2")]
+
+    def test_drops_branch_names(self) -> None:
+        result = _semver_versions(["main", "feature/foo"])
+        assert result == []
+
+    def test_drops_sha_hashes(self) -> None:
+        result = _semver_versions(["a" * 40])
+        assert result == []
+
+
 class TestInfoCache:
     """Manager.info() should return cached results on repeated calls."""