@exodus/stasis 1.0.0-beta.3 → 1.0.0-beta.5

package/src/loaders/cargo.js

@@ -0,0 +1,1699 @@
+// Cargo manifests for the Rust loader: Cargo.toml, Cargo.lock and cargo's configuration read by
+// @preventive/lockfile, per-bundle package lookup, dependency resolution among in-tree crates (the
+// package's own lib, workspace `path` deps, `cargo vendor`ed registry crates) and feature
+// resolution done the way `cargo build` does it, so `#[cfg(feature = "…")]` can be decided per
+// crate: @preventive/lockfile's, cargo's own resolver, where the build's lockfile and target are
+// known; a replay of the manifests otherwise.
+
+import { spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, isAbsolute, join, parse, posix, relative, resolve, sep } from 'node:path'
+
+import { readText } from '@exodus/stasis-core/bundle-util'
+import { diskHost } from '@exodus/stasis-core/host'
+import { canonicalizePath } from '@exodus/stasis-core/state-util'
+import { relativeEscapes, toPosix } from '@exodus/stasis-core/util'
+
+import { LockfileError, linkCargo, parseCargoConfig, parseCargoLock, parseCargoManifest as readCargoManifest, readCargoVendor, resolveCargoFeatures } from '@preventive/lockfile/cargo.js'
+import { matches, parseVersion, parseVersionReq } from '@preventive/lockfile/rust-semver.js'
+
+import { isFile } from '../resolve-typescript.js'
+import { TomlError, isTomlTable, nameErrors, readToml, splitTopLevel } from './toml.js'
+
+// `cargo vendor` copies registry crates in-tree under this dir.
+export const VENDOR_DIR = 'vendor'
+
+// A crate name as source spells it (`use proc_macro2`): Cargo allows `-`, rustc doesn't.
+export const normName = (name) => name.replaceAll('-', '_')
+
+// The file's bytes, or null when it can't be read.
+function readFileOrNull(file) {
+  try {
+    return readFileSync(file)
+  } catch {
+    return null
+  }
+}
+
+// `map`'s value for `key` (a Map or WeakMap), computed on the first ask.
+export function cached(map, key, compute) {
+  let value = map.get(key)
+  if (value === undefined) {
+    value = compute()
+    map.set(key, value)
+  }
+  return value
+}
+
+// `dir` and each directory above it, the root last.
+function* ancestors(dir) {
+  for (;;) {
+    yield dir
+    const parent = dirname(dir)
+    if (parent === dir) return
+    dir = parent
+  }
+}
+
+// A TOML value that is a table, else null.
+const table = (v) => (isTomlTable(v) ? v : null)
+
+// --- Paths ---------------------------------------------------------------------------
+
+// Project-relative `sub` under `dir`, normalized; null when it escapes the bundle root.
+export function normalizeRel(dir, sub) {
+  if (isAbsolute(sub) || posix.isAbsolute(sub)) return null
+  const rel = posix.normalize(posix.join(dir === '.' ? '' : dir, sub))
+  if (rel === '..' || rel.startsWith('../') || posix.isAbsolute(rel)) return null
+  return rel
+}
+
+// --- Cargo.toml -----------------------------------------------------------------------
+
+// A `[features]` entry asking a feature of a dependency: `key/feat` or `key?/feat`.
+const DEP_FEATURE_RE = /^([^/?]+)(\?)?\/(.+)$/u
+
+// `--features a,b pkg/c` (cargo's syntax: repeatable, comma- or space-separated) → the list of names.
+export function parseFeatureList(values) {
+  return [...new Set(values.flatMap((s) => s.split(/[\s,]+/u)).map((s) => s.trim()).filter(Boolean))]
+}
+
+// Whether a source file belongs to a test or bench target of the package at `pkgDir` (`tests/*.rs`,
+// `benches/*.rs` and what they declare): rustc compiles those with `cfg(test)`.
+export function isTestTargetPath(pkgDir, fileRel) {
+  const first = targetDirOf(pkgDir, fileRel)
+  return first === 'tests' || first === 'benches'
+}
+// Whether a file belongs to a target cargo builds with the dev-dependencies: a test, bench or
+// example (`examples/*.rs`), which unlike the other two isn't compiled with `cfg(test)`.
+function linksDevDepsPath(pkgDir, fileRel) {
+  return isTestTargetPath(pkgDir, fileRel) || targetDirOf(pkgDir, fileRel) === 'examples'
+}
+// The first directory of a file's path inside its package.
+function targetDirOf(pkgDir, fileRel) {
+  const inside = pkgDir === '.' || pkgDir === '' ? fileRel : (fileRel.startsWith(`${pkgDir}/`) ? fileRel.slice(pkgDir.length + 1) : fileRel)
+  return inside.split('/')[0]
+}
+
+// `read()`, with a TomlError or LockfileError it throws naming `file`: what @preventive/lockfile
+// refuses stops the build, saying which file.
+const readNamed = (file, read) => nameErrors(file, read, [TomlError, LockfileError])
+
+// A Cargo.toml as the loader reads it: @preventive/lockfile's reading (`cargo`) -- the package, its
+// features (with the one each optional dependency no `dep:` names turns on) and every dependency
+// table, what a member inherits from its workspace applied, refused where cargo would refuse it or
+// the reader can't tell how cargo reads it -- plus what that reading leaves out: the lib target
+// (`[lib] name`, `path`) and the build script (`[package] build`). `workspace` is the workspace
+// root's, read before, for a member that inherits from it. Dependency keys are the `use` spelling
+// (`-` → `_`); each table is a request of its own, `<kind>` or `<kind>@<platform>` (`normal`,
+// `build`, `dev@cfg(windows)`): `[dependencies] rand = "0.7"` beside `[build-dependencies] rand =
+// "0.8"` are two crates, and sha2's dev-dependency on digest asks digest for nothing a build of
+// sha2's dependents sees; each entry has its `kind` and `target` (null for none) apart too. Throws
+// a TomlError or LockfileError naming `file`.
+export const parseCargoManifest = (text, file = null, workspace = null) => manifestOf(text, readToml(text, file), file, workspace)
+// parseCargoManifest of `text` read as `doc` already.
+function manifestOf(text, doc, file, workspace) {
+  const root = workspace?.cargo.workspace === undefined ? undefined : workspace.cargo
+  const cargo = readNamed(file, () => readCargoManifest(text, isTomlTable(doc.workspace) ? undefined : root))
+  const pkg = cargo.package
+  const lib = table(doc.lib)
+  const build = table(doc.package ?? doc.project)?.build
+  const deps = new Map()
+  for (const d of pkg?.dependencies ?? []) {
+    const key = normName(d.name)
+    if (!deps.has(key)) deps.set(key, { key, name: d.name, kinds: new Map() })
+    deps.get(key).kinds.set(d.target === undefined ? d.kind : `${d.kind}@${d.target}`, {
+      kind: d.kind,
+      target: d.target ?? null,
+      version: d.version ?? null,
+      path: d.source.type === 'path' ? d.source.path : null,
+      source: d.source.type,
+      // where from: a git dependency's repository URL, another registry's name or index than
+      // crates.io's
+      origin: d.source.type === 'git' ? d.source.url : (d.source.type === 'registry' ? d.source.registry ?? d.source.index ?? null : null),
+      package: d.package,
+      renamed: d.package !== d.name,
+      inherited: d.inherited,
+      optional: d.optional,
+      defaultFeatures: d.defaultFeatures,
+      features: d.features,
+    })
+  }
+  return {
+    cargo,
+    package: pkg === undefined ? null : { name: pkg.name, version: pkg.version, edition: pkg.edition, build: typeof build === 'string' || build === false ? build : null },
+    resolver: cargo.workspace?.resolver ?? pkg?.resolver ?? null,
+    isWorkspace: cargo.workspace !== undefined,
+    lib: { name: typeof lib?.name === 'string' ? lib.name : null, path: typeof lib?.path === 'string' ? lib.path : null, procMacro: pkg?.procMacro === true },
+    deps,
+  }
+}
+
+// Whether `version` satisfies the Cargo requirement `req`, by the semver crate's rules
+// (@preventive/lockfile's rust-semver.js): a prerelease only where the requirement names one of
+// its major, minor and patch.
+const satisfies = (version, req) => {
+  const v = parseVersion(version)
+  const comparators = parseVersionReq(req)
+  return v !== undefined && comparators !== undefined && matches(comparators, v)
+}
+
+// --- cargo metadata -------------------------------------------------------------------
+
+// The Cargo.lock governing `baseDir`: beside the workspace root's Cargo.toml -- the nearest manifest
+// at or above `baseDir` with a `[workspace]` table, as cargo finds it -- else beside `baseDir`'s
+// own. A lock further up belongs to some other project: passing `--locked` for it would make
+// cargo refuse to create the one it needs.
+export function findCargoLock(baseDir) {
+  let root = baseDir
+  for (const dir of ancestors(baseDir)) {
+    const file = join(dir, 'Cargo.toml')
+    const text = readText(diskHost, file)
+    if (text !== null && 'workspace' in readToml(text, file)) {
+      root = dir
+      break
+    }
+  }
+  const candidate = join(root, 'Cargo.lock')
+  return existsSync(candidate) ? candidate : null
+}
+
+// --- cfg predicates ---------------------------------------------------------------------
+
+// A cfg predicate with its whitespace collapsed outside string literals: `my = "a  b"` and
+// `my = "a b"` are two values.
+export const normalizeCfg = (pred) => pred.replaceAll(/"(?:[^"\\]|\\.)*"|\s+/gu, (m) => (m.startsWith('"') ? m : ' ')).trim()
+
+// A cfg name as written, a raw identifier's `r#` dropped -- but `r#true` and `r#false`, names apart
+// from the literals `true` and `false`.
+export const cfgName = (written) => (/^r#(?:true|false)$/u.test(written) ? written : written.replace(/^r#/u, ''))
+
+// A leaf: `unix`, `target_os = "linux"`, a raw identifier's `r#` dropped.
+const CFG_LEAF_RE = /^(?:r#)?([A-Za-z_]\w*)\s*(?:=\s*"([^"]*)")?$/u
+
+// The cfg keys rustc sets from the target alone (`rustc --print cfg --target <triple>`), decided by
+// membership in that set when the target is known. Not among them: `debug_assertions`, `panic`,
+// `overflow_checks` and the like, which the build profile sets; `target_feature`, which the build
+// may add to or take from (`-C target-feature=-crt-static`, `-C target-cpu=native`); and
+// `target_thread_local`, which a stable rustc never prints.
+export const TARGET_CFG_KEYS = new Set(['unix', 'windows', 'target_abi', 'target_arch', 'target_endian', 'target_env', 'target_family', 'target_has_atomic', 'target_os', 'target_pointer_width', 'target_vendor'])
+
+// Three-valued evaluation of a cfg predicate: `false` when it can never hold in the build (so the
+// item it gates is dead code for the bundle), `true` when it always does, `null` when the loader
+// can't tell. `all`/`any`/`not` compose. `test` holds only in a test/bench target (`env.test`);
+// `doctest` and `doc` never do when a program is built; `feature = "x"` is decided against
+// `env.features`, the crate's features on for certain (see createCargoContext) -- unknown for one
+// of `env.maybeFeatures`, on only in some builds, and without either set; a target leaf (`unix`,
+// `target_os = …`) against `env.target`, the platform's cfg set as rustc prints it
+// (rustcTargetCfgs), and unknown without one; every other leaf stays unknown. `env.units`, a list
+// of such envs, is code compiled several ways (a crate built for the target and, as a
+// build-dependency, for the host): false only when false in each, true only when true in each.
+// A predicate an unknown leaf occurs in more than once is decided when it comes out the same
+// whatever the unknown leaves are (up to six of them): `all(any(test, kani), not(kani))` -- zerocopy's
+// `#[cfg(any(test, kani))] mod tests { #[cfg(not(kani))] mod compatibility { … } }` -- never holds.
+const MAX_FREE_CFG_LEAVES = 6
+export function evalCfg(pred, env = {}) {
+  if (env.units) return unanimous(env.units.map((u) => evalCfg(pred, u)))
+  const free = { counts: null } // unknown leaf → how often it occurs, once one is met
+  const r = evalCfgWith(pred, env, null, free)
+  if (r !== null || free.counts === null || free.counts.size > MAX_FREE_CFG_LEAVES || [...free.counts.values()].every((n) => n === 1)) return r
+  const leaves = [...free.counts.keys()]
+  let out
+  for (let bits = 0; bits < 1 << leaves.length; bits++) {
+    const v = evalCfgWith(pred, env, new Map(leaves.map((l, k) => [l, ((bits >> k) & 1) === 1])))
+    if (out === undefined) out = v
+    else if (v !== out) return null
+  }
+  return out
+}
+// evalCfg's three-valued pass: an unknown leaf takes its value from `assume` (leaf → value) when
+// that has it, else is counted in `free.counts`.
+function evalCfgWith(pred, env, assume, free = null) {
+  const p = pred.trim()
+  const m = /^(all|any|not)\s*\(([\s\S]*)\)$/u.exec(p)
+  if (!m) {
+    if (p === 'true' || p === 'false') return p === 'true' // the literals (rustc 1.88); `r#true` is a name
+    const kv = CFG_LEAF_RE.exec(p)
+    const known = kv === null ? null : evalCfgKey(kv[1], kv[2] ?? null, env)
+    if (known !== null) return known
+    // The same leaf however it is spaced, its value as written.
+    const leaf = kv === null ? p : (kv[2] === undefined ? kv[1] : `${kv[1]}="${kv[2]}"`)
+    if (assume?.has(leaf)) return assume.get(leaf)
+    if (free !== null) (free.counts ??= new Map()).set(leaf, (free.counts.get(leaf) ?? 0) + 1)
+    return null
+  }
+  const args = splitTopLevel(m[2]).map((a) => a.trim()).filter(Boolean).map((a) => evalCfgWith(a, env, assume, free))
+  if (m[1] === 'not') return args.length === 1 && args[0] !== null ? !args[0] : null
+  if (m[1] === 'all') return args.includes(false) ? false : (args.every((a) => a === true) ? true : null)
+  return args.includes(true) ? true : (args.every((a) => a === false) ? false : null)
+}
+// The verdict on one leaf other than a literal, by its key and value (`target_os = "linux"`; null
+// for a bare `unix`), as evalCfg gives it -- `env.units` too.
+export function evalCfgKey(key, value, env) {
+  if (env.units) return unanimous(env.units.map((u) => evalCfgKey(key, value, u)))
+  if (value === null && key === 'test') return env.test === true
+  if (value === null && (key === 'doctest' || key === 'doc')) return false
+  if (key === 'feature' && value !== null) return env.features ? (env.features.has(value) ? true : (env.maybeFeatures?.has(value) ? null : false)) : null
+  if (env.target && TARGET_CFG_KEYS.has(key)) return env.target.has(value === null ? key : `${key}="${value}"`)
+  return null
+}
+// Code compiled several ways: false only when false in each, true only when true in each.
+const unanimous = (each) => (each.every((r) => r === false) ? false : (each.every((r) => r === true) ? true : null))
+
+// `rustc --print cfg` output → the set of cfg leaves as printed, one per line (`unix`,
+// `target_os="linux"`).
+export function parseRustcCfg(text) {
+  return new Set(text.split('\n').map((l) => l.trim()).filter(Boolean))
+}
+
+// How long a toolchain query may take before it counts as hung.
+const TOOL_TIMEOUT_MS = 60_000
+// Never let rustup install a toolchain on the loader's behalf, whatever a `rust-toolchain` file says.
+const TOOL_ENV = { ...process.env, RUSTUP_AUTO_INSTALL: '0' }
+// Where rustc is run from: the user's home directory, else the filesystem root. A rustup proxy
+// picks its toolchain from the `rust-toolchain(.toml)` files of the working directory and its
+// parents, and such a file may name a `path` to any binary -- so never the project being bundled
+// (untrusted input: its toolchain file must not choose what runs), and never a temp dir (anyone
+// can plant a file in a world-writable one). The home directory is the user's -- unless it is the
+// bundle root (`baseDir`) or lies inside it (a project bundled from a home directory, a CI job
+// whose HOME is its checkout): then the root, whose toolchain file, if any, is the machine's.
+function toolCwd(baseDir) {
+  const home = homedir()
+  const root = parse(process.cwd()).root
+  if (!home) return root
+  if (baseDir === null) return home
+  // Real paths: a home directory or bundle root reached through a link is where it really is.
+  const base = canonicalizePath(baseDir)
+  const homeAbs = canonicalizePath(home)
+  return homeAbs === base || homeAbs.startsWith(base.endsWith(sep) ? base : base + sep) ? root : home
+}
+
+// Run rustc: `$RUSTC` when set, as cargo honours it (a target only another toolchain knows, such
+// as Solana's `sbf-solana-solana` in its platform-tools), else `rustc` from PATH -- a rustup proxy
+// resolving to the user's default toolchain (or `RUSTUP_TOOLCHAIN`), from toolCwd. With
+// RUSTUP_AUTO_INSTALL=0 an uninstalled toolchain is an error, not a download.
+function rustc(args, what, baseDir) {
+  const bin = process.env.RUSTC || 'rustc'
+  const r = spawnSync(bin, args, { cwd: toolCwd(baseDir), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: TOOL_TIMEOUT_MS, env: TOOL_ENV })
+  if (r.error) throw new Error(`${bin} could not run (${r.error.message}); ${what} needs rustc on PATH (or $RUSTC)`, { cause: r.error })
+  if (r.status !== 0) throw new Error(`${bin} ${args.join(' ')} failed (exit ${r.status}):\n${(r.stderr ?? '').trim()}`)
+  return r.stdout
+}
+
+// The cfg set of a target: `{ triple, cfgs }` from `rustc --print cfg --target <triple>`, which
+// needs only rustc's built-in knowledge of the target, not its standard library. `host` is the
+// running rustc's host triple (`rustc -vV`). `baseDir` is the bundle root, which rustc is never
+// run from (toolCwd).
+export function rustcTargetCfgs(target, baseDir = null) {
+  const triple = target === 'host' ? /^host: (\S+)$/mu.exec(rustc(['-vV'], '--cargo-target=host', baseDir))?.[1] ?? null : target
+  if (triple === null) throw new Error('rustc -vV printed no host triple')
+  return { triple, cfgs: parseRustcCfg(rustc(['--print', 'cfg', '--target', triple], '--cargo-target', baseDir)) }
+}
+
+// Run `cargo metadata` in `dir` (the directory the build runs in, inside the bundle root) and
+// return its JSON. Opt-in (`--cargo`) because it runs cargo, which reads the project's
+// `.cargo/config.toml` and may touch the registry and Cargo.lock (doc/file-formats.md has the full
+// caveat); never run on a bundle root unasked. With a lockfile present, `--locked` keeps the
+// resolution the one the build uses. The feature flags pass through; `platform`, a target triple,
+// restricts the graph to that target's dependencies.
+function runCargoMetadata(dir, { features = [], noDefaultFeatures = false, allFeatures = false, platform = null } = {}) {
+  const args = ['metadata', '--format-version', '1']
+  // The workspace's lock may sit above the bundle root: never let metadata rewrite it.
+  if (findCargoLock(dir) !== null) args.push('--locked')
+  if (allFeatures) args.push('--all-features')
+  if (noDefaultFeatures) args.push('--no-default-features')
+  for (const f of features) args.push('--features', f)
+  if (platform !== null) args.push('--filter-platform', platform)
+  const r = spawnSync('cargo', args, { cwd: dir, encoding: 'utf8', maxBuffer: 1024 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] })
+  if (r.error) throw new Error(`cargo metadata could not run (${r.error.message}); is cargo on PATH?`, { cause: r.error })
+  if (r.status !== 0) throw new Error(`cargo metadata failed (exit ${r.status}):\n${(r.stderr ?? '').trim()}`)
+  return JSON.parse(r.stdout)
+}
+
+// `cargo metadata` JSON → `{ enabled: Map<dir, Set<feature>>, deps: Map<dir, Map<useName, dir>>,
+// lacking: [{ dir, key, name, kinds }] }` over the packages the bundle can carry: those whose
+// manifest lies inside the bundle root, plus registry packages cargo read from `~/.cargo/registry`
+// (no `.cargo/config.toml` redirecting crates.io to `vendor/`) that `locate(name, version)` finds
+// vendored in-tree -- `cargo vendor` copies exactly the lockfile's versions, so name + version
+// identify the dir. Anything else (an unvendored registry crate, a path dep outside the root)
+// can't be bundled: it is in `lacking`, once per package depending on it (`dir`), by its package
+// name (`name`; `key` with `-` → `_`), with the kinds of the tables naming it (`normal`, `dev`,
+// `build`). `deps` maps each package's dependencies by the name code refers to them with (renames
+// applied, `-` → `_`).
+export function resolutionFromMetadata(metadata, baseDir, { locate = null } = {}) {
+  let realBase = baseDir
+  try {
+    realBase = realpathSync(baseDir)
+  } catch { /* keep the lexical path */ }
+  const relDir = (manifestPath) => {
+    if (typeof manifestPath !== 'string') return null
+    const dir = dirname(manifestPath)
+    for (const base of new Set([baseDir, realBase])) {
+      const rel = toPosix(relative(base, dir))
+      if (rel === '') return '.'
+      if (!relativeEscapes(rel)) return rel
+    }
+    return null
+  }
+  const dirOf = new Map()
+  for (const p of metadata.packages ?? []) {
+    const dir = relDir(p.manifest_path) ?? locate?.(p.name, p.version) ?? null
+    if (dir !== null) dirOf.set(p.id, dir)
+  }
+  const nameOf = new Map((metadata.packages ?? []).map((p) => [p.id, p.name]))
+  const enabled = new Map()
+  const deps = new Map()
+  const lacking = []
+  for (const node of metadata.resolve?.nodes ?? []) {
+    const dir = dirOf.get(node.id)
+    if (dir === undefined) continue
+    enabled.set(dir, new Set((node.features ?? []).filter((f) => typeof f === 'string')))
+    const byName = new Map()
+    for (const d of node.deps ?? []) {
+      const target = dirOf.get(d.pkg)
+      if (target !== undefined && typeof d.name === 'string') byName.set(normName(d.name), target)
+      else if (target === undefined) {
+        const name = nameOf.get(d.pkg) ?? d.name
+        lacking.push({ dir, key: normName(name), name, kinds: new Set((Array.isArray(d.dep_kinds) ? d.dep_kinds : [{ kind: null }]).map((k) => k?.kind ?? 'normal')) })
+      }
+    }
+    deps.set(dir, byName)
+  }
+  return { enabled, deps, lacking }
+}
+
+// The cargo config file in absolute directory `abs`: `.cargo/config` when it exists -- cargo
+// prefers the extensionless file over `.cargo/config.toml` when both are there -- else
+// `.cargo/config.toml`; null when there is neither.
+const cargoConfigAt = (abs) => ['.cargo/config', '.cargo/config.toml'].map((f) => join(abs, f)).find((file) => isFile(file)) ?? null
+
+// The cargo configs a build run in `from` (a project-relative dir) reads, as cargo finds them: the
+// config of that directory and of every one above it to the filesystem's root, the nearest first
+// -- those above the bundle root too, read but never bundled; `$CARGO_HOME`'s, the machine's, is
+// not -- as `{ dir, abs, file, text, doc }`: `dir` the directory holding its `.cargo`,
+// project-relative (null above the bundle root), `abs` the same absolute, `file` the config's
+// path from the bundle root. Throws a TomlError naming a config that isn't TOML.
+function cargoConfigs(baseDir, from) {
+  const baseAbs = resolve(baseDir)
+  const out = []
+  for (const abs of ancestors(join(baseAbs, from))) {
+    const found = cargoConfigAt(abs)
+    const text = found === null ? null : readText(diskHost, found)
+    if (text !== null) {
+      const file = toPosix(relative(baseAbs, found))
+      out.push({ dir: projectRel(baseAbs, abs), abs, file, text, doc: readToml(text, file) })
+    }
+  }
+  return out
+}
+// A path a cargo config or a manifest in absolute directory `absDir` writes (`.`: that directory),
+// as cargo takes it -- relative to that directory, an absolute one as it is -- project-relative
+// from the bundle root `baseAbs`; null outside it. A config's paths are relative to the directory
+// holding its `.cargo` (cargoConfigs' `abs`).
+const projectRel = (baseAbs, absDir, path = '.') => normalizeRel('.', toPosix(relative(baseAbs, resolve(absDir, path))))
+
+// The directory `cargo vendor` filled, as cargo configs `configs` (cargoConfigs) say: their
+// `[source]` tables merged as cargo merges them, each source's each key from the nearest config
+// writing it -- the `directory` of the source `[source.crates-io] replace-with` names, through any
+// chain of replacements (`cargo vendor` suggests `vendored-sources`, but any name does), else of
+// the one source some `replace-with` names, relative to the directory holding the `.cargo` of the
+// config writing it; the default `vendor` (at the bundle root) when nothing replaces a source
+// with a directory. A configured directory outside the bundle root, or that doesn't exist, is
+// warned about (a stale `vendor/` beside it is not what cargo builds from) unless `quiet`.
+function vendorDirOf(baseDir, configs, { quiet = false } = {}) {
+  // source name -> { replaceWith, directory: { path, config } }
+  const sources = new Map()
+  for (const config of configs) {
+    for (const [name, fields] of Object.entries(isTomlTable(config.doc.source) ? config.doc.source : {})) {
+      if (!isTomlTable(fields)) continue
+      const s = sources.get(name) ?? sources.set(name, { replaceWith: null, directory: null }).get(name)
+      if (s.replaceWith === null && typeof fields['replace-with'] === 'string') s.replaceWith = fields['replace-with']
+      if (s.directory === null && typeof fields.directory === 'string') s.directory = { path: fields.directory, config }
+    }
+  }
+  const follow = (name) => {
+    const seen = new Set()
+    for (let s = sources.get(name); s && !seen.has(s); s = sources.get(s.replaceWith)) {
+      seen.add(s)
+      if (s.directory !== null) return s.directory
+      if (s.replaceWith === null) return null
+    }
+    return null
+  }
+  const replaced = new Set([...sources.values()].map((s) => (s.replaceWith === null ? null : follow(s.replaceWith))).filter((d) => d !== null))
+  const found = follow('crates-io') ?? (replaced.size === 1 ? [...replaced][0] : null)
+  if (found === null) return VENDOR_DIR
+  const norm = projectRel(resolve(baseDir), found.config.abs, found.path)?.replace(/\/+$/u, '') || null
+  if (norm === null) {
+    if (!quiet) console.warn(`[loader.cargo] ${found.config.file} names a vendored source directory outside the bundle root: ${found.path}`)
+    return VENDOR_DIR
+  }
+  if (!quiet && !existsSync(join(baseDir, norm))) console.warn(`[loader.cargo] ${found.config.file} names a vendored source directory that doesn't exist: ${norm}`)
+  return norm
+}
+
+// The `--cfg` names in rustflags: `--cfg name`, `--cfg=name`, `--cfg 'name="value"'`.
+function cfgFlags(flags) {
+  const out = []
+  for (let i = 0; i < flags.length; i++) {
+    const flag = flags[i]
+    const arg = flag === '--cfg' ? flags[++i] : (flag.startsWith('--cfg=') ? flag.slice('--cfg='.length) : null)
+    const name = typeof arg === 'string' ? /^(?:r#)?[A-Za-z_]\w*/u.exec(arg)?.[0] : undefined
+    if (name !== undefined) out.push(cfgName(name))
+  }
+  return out
+}
+// The cfgs the rustflags of a build may set: those of the `build.rustflags` and
+// `target.<…>.rustflags` of each of its cargo configs (`configs`, see cargoConfigs: which applies,
+// and how cargo joins them, is the build's business), and of the environment cargo reads them
+// from (CARGO_ENCODED_RUSTFLAGS, RUSTFLAGS, CARGO_BUILD_RUSTFLAGS).
+function rustflagsCfgsOf(configs) {
+  const names = new Set()
+  const add = (value) => {
+    const flags = Array.isArray(value) ? value.filter((f) => typeof f === 'string') : (typeof value === 'string' ? value.split(/\s+/u).filter(Boolean) : [])
+    for (const name of cfgFlags(flags)) names.add(name)
+  }
+  // The `rustflags` of the `build` table and of every `target.<…>` one.
+  for (const { doc } of configs) {
+    add(table(doc.build)?.rustflags)
+    for (const target of Object.values(table(doc.target) ?? {})) add(table(target)?.rustflags)
+  }
+  const { env } = process
+  if (env.CARGO_ENCODED_RUSTFLAGS) add(env.CARGO_ENCODED_RUSTFLAGS.split('\u001F'))
+  for (const v of [env.RUSTFLAGS, env.CARGO_BUILD_RUSTFLAGS]) if (v) add(v)
+  return names
+}
+// What code a build script runs -- its own, or a lib it calls -- prints as
+// `cargo:rustc-cfg=<name>` (or `cargo::`), among the texts of its files, by what they write
+// outside full-line comments: the names it may set, and whether it may set one the loader can't
+// read -- a name it formats, whole (`rustc-cfg={}`, as cfg_aliases' `cfg_aliases!` does) or in
+// part (`rustc-cfg=os_{}`), the directive written apart from the name (build-rs's `rustc_cfg`),
+// `autocfg`'s probes.
+const RUSTC_CFG_RE = /cargo::?rustc-cfg=((?:r#)?[A-Za-z_]\w*)?(\{)?/gu
+const CFG_MENTION_RE = /rustc[-_]cfg|\bautocfg\b/u
+function cfgsPrinted(texts) {
+  const names = new Set()
+  let any = false
+  for (const raw of texts) {
+    if (!CFG_MENTION_RE.test(raw)) continue // most code says nothing of cfgs: no comments to strip
+    const text = raw.replaceAll(/^[ \t]*\/\/.*$/gmu, '')
+    for (const m of text.matchAll(RUSTC_CFG_RE)) {
+      if (m[1] === undefined || m[2] !== undefined) any = true
+      else names.add(cfgName(m[1]))
+    }
+    if (CFG_MENTION_RE.test(text.replaceAll(RUSTC_CFG_RE, ''))) any = true
+  }
+  return { names, any }
+}
+
+// Whether a JSON value is a plain object (not an array, not null).
+const isPlainObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
+
+// A source URL as cargo compares them: no trailing `/` or `.git`, the scheme and host lowercased.
+const canonicalUrl = (url) => url.trim().replace(/\/+$/u, '').replace(/\.git$/u, '').replace(/^([a-z][\w+.-]*:\/\/)([^/]*)/iu, (m) => m.toLowerCase())
+// crates.io's index, as a `[patch.<url>]` may name it.
+const CRATES_IO_INDEXES = new Set(['https://github.com/rust-lang/crates.io-index', 'sparse+https://index.crates.io'].map(canonicalUrl))
+
+// A `members` pattern's segment as a regex (glob's syntax, as cargo takes it: `*`, `?`, `[…]`).
+const globSegment = (seg) => new RegExp(`^${seg.replaceAll(/[.+^${}()|\\]/gu, '\\$&').replaceAll('[!', '[^').replaceAll('*', '[^/]*').replaceAll('?', '[^/]')}$`, 'u')
+
+// The stand-in platforms cargo's resolver is run against (see resolveGraph): each carries a mark
+// of its own, and the cfgs and a mark of the name of the platform it stands in for, where known.
+const MARK_TARGET = '__stasis_target'
+const MARK_HOST = '__stasis_host'
+const MARK_NAME = '__stasis_target_name'
+const standInPlatform = (mark, info) => ({ name: mark, cfg: [mark, ...(info === null ? [] : [...info.cfgs, `${MARK_NAME}="${info.triple}"`])] })
+// `graph` with the platform of every target-specific dependency `to(platform)`.
+function retarget(graph, to) {
+  const packages = Object.create(null)
+  for (const [key, pkg] of Object.entries(graph.packages)) {
+    packages[key] = { ...pkg, dependencies: pkg.dependencies.map((d) => (d.target === undefined ? d : { ...d, target: to(d.target) })) }
+  }
+  return { ...graph, packages }
+}
+
+// --- Context ----------------------------------------------------------------------------
+
+// No custom cfg a build sets (see cfgsSetFor).
+const NO_CFGS_SET = { names: new Set(), any: false }
+
+// A compile unit: the feature context a file's code sees (`target`: the build's; `host`: that of
+// what is built for the host -- build-dependencies, proc-macro crates and their dependencies --
+// which resolver 2 keeps apart) and the platform it is compiled for, as `<features>|<platform>`.
+// A package's code is compiled as `target|target`, its build script as `target|host`, a
+// build-dependency's or proc-macro's code as `host|host`; one file may be compiled as several.
+const unitKey = (featureCtx, platform) => `${featureCtx}|${platform}`
+export const TARGET_UNIT = unitKey('target', 'target')
+export const HOST_UNIT = unitKey('host', 'host')
+const unitFeatureCtx = (unit) => unit.slice(0, unit.indexOf('|'))
+const unitPlatform = (unit) => unit.slice(unit.indexOf('|') + 1)
+
+// Per-bundle Cargo state: manifest lookup (memoized per directory), crate-name resolution against
+// in-tree sources, and feature resolution for the packages owning `entries` (the crate roots being
+// bundled, like `cargo build -p …`). `features` / `noDefaultFeatures` / `allFeatures` mirror
+// cargo's flags for those root packages (`pkg/feat` targets one of them). `cargo: true` takes the
+// dependency graph and features from `cargo metadata` (see runCargoMetadata) instead. `target`
+// names the build's target -- a triple or `host`, asked of rustc (rustcTargetCfgs), or its `{
+// triple, cfgs }` outright -- so target-specific dependency tables and `#[cfg(unix)]`-style code
+// are decided; without one they are kept. The host's platform is known when the target is the
+// host, or given as `host` (`{ triple, cfgs }`). `baseDir` is the bundle root; every path in and
+// out is project-relative POSIX.
+export function createCargoContext(baseDir, { entries = [], features = [], noDefaultFeatures = false, allFeatures = false, cargo = false, target = null, host = null } = {}) {
+  const targetInfo = target === null ? null : (typeof target === 'string' ? rustcTargetCfgs(target, baseDir) : target)
+  const hostInfo = target === 'host' ? targetInfo : host
+  const manifests = new Map()
+  // dir -> the manifest as `{ file, text, buf, doc }` (its bytes, and its table tree), or null
+  // (rootOf's look for [workspace])
+  const tables = new Map()
+  const tableOf = (dir) => cached(tables, dir, () => {
+    const file = posix.join(dir, 'Cargo.toml')
+    const buf = readFileOrNull(join(baseDir, file))
+    const text = buf === null ? null : buf.toString('utf8')
+    return text === null ? null : { file, text, buf, doc: readToml(text, file) }
+  })
+  // The workspace root of the package whose manifest is at `dir` (its table tree `doc`), as cargo
+  // finds it: its `[package] workspace` path, else the nearest manifest above it with a
+  // [workspace] that doesn't exclude it -- one that does is passed over, as cargo passes it --
+  // inside the bundle root (a project-relative dir), else above it (outerWorkspace). A [workspace]
+  // that doesn't exclude the package is its workspace, `members` or not: cargo either takes it as
+  // a member there (a member's path dependency is one) or refuses to build it. Null for a root, a
+  // vendored crate (a published manifest inherits nothing) or a package outside any workspace.
+  const rootOf = (dir, doc) => {
+    if (isTomlTable(doc.workspace) || isVendoredDir(dir)) return null
+    const named = table(doc.package)?.workspace
+    if (typeof named === 'string') return normalizeRel(dir, named) ?? outerWorkspace(join(baseAbs, dir, named)) ?? null
+    const pkgAbs = join(baseAbs, dir)
+    for (let d = dir; d !== '.' && d !== '';) {
+      d = posix.dirname(d)
+      const ws = tableOf(d)?.doc
+      if (isTomlTable(ws?.workspace) && !excludes(ws, join(baseAbs, d), pkgAbs)) return d
+    }
+    for (const abs of ancestors(dirname(baseAbs))) {
+      const ws = outerWorkspace(abs)
+      if (ws !== undefined && !excludes(ws.doc, abs, pkgAbs)) return ws
+    }
+    return null
+  }
+  // Whether the [workspace] of the manifest `doc` at absolute `abs` excludes the package at
+  // absolute `pkgAbs`, as cargo has it: under an `exclude` path and under no `members` one.
+  const excludes = (doc, abs, pkgAbs) => {
+    const under = (p) => typeof p === 'string' && (pkgAbs === join(abs, p) || pkgAbs.startsWith(`${join(abs, p)}${sep}`))
+    const list = (v) => (Array.isArray(v) ? v : [])
+    return list(doc.workspace.exclude).some(under) && !list(doc.workspace.members).some(under)
+  }
+  // The workspace root at absolute `abs`, above the bundle root: the manifest there with a
+  // [workspace], read for what members inherit, the resolver it sets and its `[patch]` -- never
+  // bundled, nor its lockfile read -- as `{ dir: null, outside: abs, file, doc, … }` (see
+  // readManifest; `file` its path from the bundle root); undefined for no [workspace] there.
+  const baseAbs = resolve(baseDir)
+  const outer = new Map()
+  const outerWorkspace = (abs) => {
+    if (!outer.has(abs)) {
+      const file = join(abs, 'Cargo.toml')
+      const text = readText(diskHost, file)
+      const label = toPosix(relative(baseAbs, file))
+      const doc = text === null ? null : readToml(text, label)
+      outer.set(abs, isTomlTable(doc?.workspace) ? { dir: null, outside: abs, file: label, doc, ...manifestOf(text, doc, label, null) } : undefined)
+    }
+    return outer.get(abs)
+  }
+  // A manifest as parseCargoManifest reads it, at `file` (`dir`'s Cargo.toml), with each path
+  // dependency's directory, project-relative, on its entry (`dir`; null outside the bundle root):
+  // an inherited one's path is the workspace root's.
+  // `workspaceRoot` is the manifest of the workspace root it inherits from (rootOf), or null.
+  // A vendored package's is as the vendor directory lists it, not yet checked (see readManifest).
+  const manifestAt = (dir) => cached(manifests, dir, () => {
+    const raw = tableOf(dir)
+    const root = raw === null ? null : rootOf(dir, raw.doc)
+    const ws = root === null ? null : (typeof root === 'string' ? readManifest(root) : root)
+    const m = raw === null ? null : { dir, file: raw.file, ...manifestOf(raw.text, raw.doc, raw.file, ws), workspaceRoot: ws, unchecked: isVendoredDir(dir) }
+    for (const d of m?.deps.values() ?? []) {
+      for (const r of d.kinds.values()) r.dir = r.path === null ? null : manifestPath(r.inherited && ws !== null ? ws : m, r.path)
+    }
+    return m
+  })
+  // The manifest at `dir` as the build takes it in (manifestAt): a vendored package's checked
+  // against its `.cargo-checksum.json` (checkVendored), the bytes read, before what it says --
+  // features, dependencies -- decides anything. Only a listing of the vendor directory reads a copy
+  // unchecked: cargo checks the files of a copy it builds, not of every copy there.
+  const readManifest = (dir) => {
+    const m = manifestAt(dir)
+    if (m?.unchecked) {
+      checkVendored(dir, m.file, tableOf(dir).buf)
+      m.unchecked = false
+    }
+    return m
+  }
+  // The directory a path manifest `m` writes names, project-relative (null outside the bundle
+  // root): relative to its directory, inside the bundle root or above it (`outside`).
+  const manifestPath = (m, path) => (m.outside === undefined ? normalizeRel(m.dir, path) : projectRel(baseAbs, m.outside, path))
+  // Manifests at or above `dir`, nearest first, up to the bundle root.
+  const manifestsAbove = function* (dir) {
+    for (;;) {
+      const m = readManifest(dir)
+      if (m) yield m
+      if (dir === '.' || dir === '') return
+      dir = posix.dirname(dir)
+    }
+  }
+  // The package owning a file: the nearest manifest above it with a [package]; memoized per
+  // directory (every lookup below starts here, several times per file).
+  const packageByDir = new Map()
+  const packageFor = (fileRel) => {
+    const dir = posix.dirname(fileRel)
+    return cached(packageByDir, dir, () => {
+      for (const m of manifestsAbove(dir)) if (m.package) return m
+      return null
+    })
+  }
+  // The workspace root manifest of package `m` (see rootOf): its own when it is a root, an outer
+  // one above the bundle root (`outside`) too; `m` itself outside any workspace.
+  const rootManifestOf = (m) => (m.isWorkspace ? m : (m.workspaceRoot ?? m))
+  // The workspace root of the package at `dir` inside the bundle root, or null (outside any, or
+  // one above the bundle root).
+  const workspaceFor = (dir) => {
+    const m = readManifest(dir)
+    const root = m === null ? null : rootManifestOf(m)
+    return root?.isWorkspace === true && root.outside === undefined ? root : null
+  }
+  // The manifest's lib target root when it is on disk (`[lib] path`, default `src/lib.rs`);
+  // memoized on the manifest, since it is asked for once per crate reference.
+  // A vendored package's `[lib] path` may not leave its directory (a published crate's never
+  // does; one that tries is reaching for the project's files).
+  const libPath = (m) => {
+    if (m.libRoot === undefined) {
+      const rel = normalizeRel(m.dir, m.lib.path ?? 'src/lib.rs')
+      const inside = rel !== null && (!isVendoredDir(m.dir) || rel.startsWith(`${m.dir}/`))
+      if (rel !== null && !inside) console.warn(`[loader.cargo] Refusing lib path outside its package: ${m.lib.path} in ${m.dir}`)
+      m.libRoot = inside && isFile(join(baseDir, rel)) ? rel : null
+    }
+    return m.libRoot
+  }
+  const libName = (m) => normName(m.lib.name ?? m.package?.name ?? '')
+  // The package's build script when it is on disk (see buildScriptOf); memoized on the manifest.
+  const buildScript = (m) => {
+    if (m.buildScript === undefined) {
+      const rel = m.package.build === false ? null : normalizeRel(m.dir, m.package.build ?? 'build.rs')
+      const inside = rel !== null && (!isVendoredDir(m.dir) || rel.startsWith(`${m.dir}/`))
+      if (rel !== null && !inside && isFile(join(baseDir, rel))) console.warn(`[loader.cargo] Refusing build script outside its package: ${m.package.build} in ${m.dir}`)
+      m.buildScript = inside && isFile(join(baseDir, rel)) ? rel : null
+    }
+    return m.buildScript
+  }
+  // Whether `fileRel` belongs to a test or bench target of its package (compiled with `cfg(test)`).
+  const isTestTarget = (fileRel) => isTestTargetPath(packageFor(fileRel)?.dir ?? '.', fileRel)
+  // Whether `fileRel` belongs to a target built with the dev-dependencies (tests, benches,
+  // examples).
+  const linksDevDeps = (fileRel) => linksDevDepsPath(packageFor(fileRel)?.dir ?? '.', fileRel)
+  // The packages an entry is a test, bench or example target of: their dev-dependencies are
+  // linked (that build is `cargo test`'s). Memoized.
+  let devRoots = null
+  const devRootDirs = () => (devRoots ??= new Set(entries.filter((e) => linksDevDeps(e)).map((e) => packageFor(e)?.dir)))
+  const version = (m) => m.package.version
+
+  // --- dependency resolution
+
+  // The directory cargo is taken to run in for the build (`runDir`): the one of the package the
+  // first entry belongs to -- `cargo build` there, which finds its workspace root above -- unless
+  // that entry is a vendored crate's (in the vendor directory the bundle root's configs name),
+  // whose own config cargo never reads; else the bundle root. What the cargo config sets for the
+  // build -- the vendor directory, `[patch]`, rustflags -- is what the configs cargo reads when
+  // run there say (`configs`, see cargoConfigs), and those are the configs a bundle carries.
+  const rootConfigs = cargoConfigs(baseDir, '.')
+  const rootVendorDir = vendorDirOf(baseDir, rootConfigs, { quiet: true })
+  const ownEntry = entries.find((e) => !e.startsWith(`${rootVendorDir}/`))
+  const packageDirAbove = (dir) => {
+    for (let d = dir; ; d = posix.dirname(d)) {
+      const doc = tableOf(d)?.doc
+      if (isTomlTable(doc?.package ?? doc?.project)) return d
+      if (d === '.' || d === '') return '.'
+    }
+  }
+  const runDir = ownEntry === undefined ? '.' : packageDirAbove(posix.dirname(ownEntry))
+  const configs = runDir === '.' ? rootConfigs : cargoConfigs(baseDir, runDir)
+  // The vendor directory of the build the entries are in, as those configs say.
+  const vendorDir = vendorDirOf(baseDir, configs)
+  // Whether a package directory is a vendored crate's (a registry crate `cargo vendor` copied in).
+  const isVendoredDir = (dir) => dir !== vendorDir && dir.startsWith(`${vendorDir}/`)
+  // The vendored crates, `<vendorDir>/<dir>/`, as `[{ version, dir, git }]`, indexed `byName`
+  // (normalized package name; the dir may hyphenate a snake_case name, and an older duplicate
+  // version lives in `<name>-<version>/`) and `byLib` (lib name, for the crates whose `[lib] name`
+  // differs: `md-5` → `md5`). `git`: whether the copy is of a git repository -- its
+  // `.cargo-checksum.json` has no package checksum, which a registry's always does -- or null
+  // without that file.
+  let vendorIndex = null
+  const vendored = () => {
+    if (vendorIndex === null) {
+      vendorIndex = { byName: new Map(), byLib: new Map() }
+      let dirs = []
+      try {
+        dirs = readdirSync(join(baseDir, vendorDir))
+      } catch { /* no vendor dir */ }
+      for (const d of dirs) {
+        if (d.startsWith('.')) continue // a directory source reads none of these
+        const m = manifestAt(`${vendorDir}/${d}`)
+        if (!m?.package) continue
+        const sums = checksumOf(m.dir)
+        const entry = { version: version(m), dir: m.dir, git: sums?.git ?? null }
+        for (const [index, key] of [[vendorIndex.byName, normName(m.package.name)], [vendorIndex.byLib, libName(m)]]) {
+          if (!index.has(key)) index.set(key, [])
+          index.get(key).push(entry)
+        }
+      }
+    }
+    return vendorIndex
+  }
+  // A vendored package's `.cargo-checksum.json`, parsed, or null when it has none.
+  const checksums = new Map()
+  const checksumOf = (dir) => cached(checksums, dir, () => {
+    const file = posix.join(dir, '.cargo-checksum.json')
+    const text = readText(diskHost, join(baseDir, file))
+    let value = null
+    if (text !== null) {
+      try {
+        value = JSON.parse(text)
+      } catch (err) {
+        throw new Error(`${file}: not JSON: ${err.message}`, { cause: err })
+      }
+    }
+    // A registry's copy has a package checksum; a git checkout's has none. `files`: each file's
+    // sha256, as `cargo vendor` listed them, path relative to the package.
+    return value === null ? null : { text, git: (value?.package ?? null) === null, files: isPlainObject(value?.files) ? value.files : {} }
+  })
+  // Throws when `fileRel`, a file of the vendored package at `dir`, isn't byte for byte (`buf`) the
+  // file its `.cargo-checksum.json` lists -- edited after `cargo vendor`: cargo refuses to build
+  // the package, and so the bundle does. A file the list doesn't name, or a package without one,
+  // passes. Once per file (`verified`): what passed isn't hashed again.
+  const verified = new Set()
+  const checkVendored = (dir, fileRel, buf) => {
+    if (verified.has(fileRel)) return
+    const listed = checksumOf(dir)?.files[fileRel.slice(dir.length + 1)]
+    if (typeof listed === 'string') {
+      const actual = createHash('sha256').update(buf).digest('hex')
+      if (actual !== listed) throw new Error(`${fileRel} isn't the file ${dir}/.cargo-checksum.json lists (sha256 ${actual}, listed ${listed}): changed since \`cargo vendor\`, which cargo refuses to build`)
+    }
+    verified.add(fileRel)
+  }
+  // The package the build is of: the first entry's package that isn't vendored -- the one cargo is
+  // run in (runDir), taken now that the vendor directory is known; null when no entry has one.
+  // Memoized.
+  let buildPkg
+  const buildPackage = () => {
+    if (buildPkg === undefined) buildPkg = entries.map(packageFor).find((m) => m && !isVendoredDir(m.dir)) ?? null
+    return buildPkg
+  }
+  // The workspace root of the build: its package's (rootManifestOf), inside the bundle root or
+  // above it (`outside`: read, never bundled), the package itself outside any workspace; the bundle
+  // root's manifest when no entry has a package. Its Cargo.lock is the build's, and its resolver
+  // and `[patch]` apply to every package of the build.
+  const buildWorkspaceRoot = () => {
+    const pkg = buildPackage()
+    return pkg === null ? readManifest('.') : rootManifestOf(pkg)
+  }
+  // The build's Cargo.lock, project-relative: beside its workspace root, as cargo finds it -- a
+  // vendored crate's own published lock plays no part; null when that root lies above the bundle
+  // root (its lockfile is cargo's, never read, and one beside the package isn't the build's).
+  const buildLockPath = () => {
+    const root = buildWorkspaceRoot()
+    return root?.outside === undefined ? posix.join(root?.dir ?? '.', 'Cargo.lock') : null
+  }
+  // The build's Cargo.lock (buildLockPath), read by @preventive/lockfile (`version = 3` or `4`; an
+  // older one, or a lock that isn't what cargo writes or could be read two ways, stops the build),
+  // as `{ file, text, lock, byId }` (`byId`: `name version` → the keys of that version's
+  // packages); null when there is none in the bundle root.
+  let lock
+  const lockfile = () => {
+    if (lock === undefined) {
+      const file = buildLockPath()
+      const text = file === null ? null : readText(diskHost, join(baseDir, file))
+      lock = null
+      if (text !== null) {
+        const parsed = readNamed(file, () => parseCargoLock(text))
+        const byId = new Map()
+        for (const [key, p] of Object.entries(parsed.packages)) {
+          const id = `${normName(p.name)} ${p.version}`
+          if (!byId.has(id)) byId.set(id, [])
+          byId.get(id).push(key)
+        }
+        lock = { file, lock: parsed, byId }
+      }
+    }
+    return lock
+  }
+  // `--cargo`: the graph and features as cargo resolved them, with registry packages it read from
+  // the registry cache matched to their `vendor/` copy by name + version.
+  const metadata = cargo
+    ? resolutionFromMetadata(runCargoMetadata(join(baseDir, runDir), { features, noDefaultFeatures, allFeatures, platform: targetInfo?.triple ?? null }), baseDir, {
+        locate: (name, ver) => (typeof name === 'string' ? vendored().byName.get(normName(name))?.find((c) => c.version === ver)?.dir ?? null : null),
+      })
+    : null
+  // Where the build takes its `[patch]` tables from, in the order they apply: the cargo configs'
+  // (`configs`, nearest first), as @preventive/lockfile reads them, then the workspace root
+  // manifest's (buildWorkspaceRoot), as `{ patch, at, from }`: `at(path)` the directory a patch's
+  // path names, project-relative (null outside the bundle root) -- relative to the directory
+  // holding a config's `.cargo`, or to the manifest's -- `from` the file. Throws a TomlError or
+  // LockfileError naming a config.
+  let patchMemo = null
+  const patchSources = () => {
+    if (patchMemo === null) {
+      const root = buildWorkspaceRoot()
+      patchMemo = [
+        ...configs.map((c) => ({ patch: readNamed(c.file, () => parseCargoConfig([c.text])).patch, at: (path) => projectRel(baseAbs, c.abs, path), from: c.file })),
+        ...(root ? [{ patch: root.cargo.patch, at: (path) => manifestPath(root, path), from: root.file }] : []),
+      ]
+    }
+    return patchMemo
+  }
+  // The `[patch]` of crate `crate` for what request `r` comes from, as `{ spec, dir, from }`, the
+  // first patchSources has -- `spec` as @preventive/lockfile reads it, `dir` the patch's directory
+  // for a path (null outside the bundle root), `from` the file saying so. Undefined when nothing
+  // patches it.
+  const patchFor = (crate, r) => {
+    for (const { patch, at, from } of patchSources()) {
+      for (const [source, specs] of Object.entries(patch)) {
+        if (!patchesSource(source, r)) continue
+        for (const [name, spec] of Object.entries(specs)) {
+          if (normName(name) !== crate) continue
+          return { spec, dir: spec.source.type === 'path' ? at(spec.source.path) : null, from }
+        }
+      }
+    }
+    return undefined
+  }
+  // Whether a `[patch.<source>]` table patches what request `r` comes from: crates.io's
+  // (`crates-io`, or its index URL) for a crates.io dependency, the registry's name or index for
+  // another, the repository for a git dependency -- URLs compared as cargo canonicalizes them (no
+  // trailing `/` or `.git`, the scheme's and host's case aside).
+  const patchesSource = (source, r) => {
+    if (r.source === 'git') return r.origin !== null && canonicalUrl(source) === canonicalUrl(r.origin)
+    if (r.source !== 'registry') return false
+    if (r.origin === null) return source === 'crates-io' || CRATES_IO_INDEXES.has(canonicalUrl(source))
+    return source === r.origin || canonicalUrl(source) === canonicalUrl(r.origin)
+  }
+  // Where a lockfile's package comes from: `path`, `git` or `registry` (sparse or not).
+  const sourceKind = (source) => (source === undefined ? 'path' : (source.startsWith('git+') ? 'git' : 'registry'))
+  // The keys of the build's lockfile that are package `m`: its path package, or for a vendored copy
+  // the locked package of its name and version from where the copy came from (a git checkout or a
+  // registry, see vendored).
+  const lockKeysOf = (lk, m) => {
+    const keys = lk.byId.get(`${normName(m.package.name)} ${version(m)}`) ?? []
+    if (!isVendoredDir(m.dir)) return keys.filter((k) => lk.lock.packages[k].source === undefined)
+    const git = checksumOf(m.dir)?.git
+    const kind = git === undefined ? null : (git ? 'git' : 'registry')
+    return keys.filter((k) => lk.lock.packages[k].source !== undefined && (kind === null || sourceKind(lk.lock.packages[k].source) === kind))
+  }
+  // Dependency → package, memoized per (package, request): the fixed-point loop asks many times.
+  const depTargets = new Map()
+  // The in-tree package a dependency of `m` resolves to through one of its tables (`request`): a
+  // `path` dep, else a `[patch]` path override (patchFor) whose version satisfies the requirement,
+  // else the vendored crate of that name from where the dependency says (a git dependency, or one a
+  // git `[patch]` replaces, takes a copy of a git checkout; any other a registry's) -- the version
+  // Cargo.lock records for `m` from that source when it satisfies the requirement, else the one
+  // vendored version that does. A package can depend on two versions of one crate (`borsh = "1"`
+  // beside `borsh0-9 = { package = "borsh", version = "0.9" }`, or one per table): the lock then
+  // lists both under it, and the requirement tells which is which. Null when it isn't in-tree -- a
+  // path (or patch) outside the bundle root, or no vendored copy -- and, warned, when the vendored
+  // copies don't settle it: the locked version isn't among them, none satisfies the requirement,
+  // or several do and no lock chooses. Cargo would build none of those from what the bundle holds,
+  // so none is guessed.
+  // What it warns of is said once, when it is first asked for unless `quiet`, else when
+  // warnDep asks: the replay lays out every declaration, and warns only of those the build links.
+  const resolveDep = (m, dep, request, { quiet = false } = {}) => {
+    const byRequest = cached(depTargets, m.dir, () => new Map())
+    const found = cached(byRequest, request, () => {
+      const warnings = []
+      return { t: resolveDepUncached(m, dep, request, (w) => warnings.push(w)), warnings }
+    })
+    if (!quiet) warnDep(m, request)
+    return found.t
+  }
+  const warnDep = (m, request) => {
+    for (const w of depTargets.get(m.dir)?.get(request)?.warnings.splice(0) ?? []) console.warn(w)
+  }
+  const resolveDepUncached = (m, dep, request, warn) => {
+    const asPackage = (dir) => {
+      const t = dir === null ? null : readManifest(dir)
+      return t?.package ? t : null
+    }
+    // cargo metadata knows exactly which package each dependency edge points at.
+    const known = metadata?.deps.get(m.dir)?.get(dep.key)
+    if (known !== undefined) return asPackage(known)
+    const who = `${m.package.name} ${version(m)}`
+    if (request.path) {
+      const t = asPackage(request.dir)
+      if (request.dir === null) warn(`[loader.cargo] ${who}'s dependency ${dep.name} is a path outside the bundle root: ${request.path}`)
+      else if (t === null) warn(`[loader.cargo] ${who}'s dependency ${dep.name} names ${request.dir}, which holds no Cargo.toml with a [package]`)
+      return t
+    }
+    const crate = normName(request.package)
+    const req = request.version
+    const fits = (ver) => req === null || satisfies(ver, req)
+    let kind = request.source
+    const patch = patchFor(crate, request)
+    if (patch?.spec.source.type === 'path') {
+      if (patch.dir === null) {
+        warn(`[loader.cargo] ${patch.from} patches ${crate} with a path outside the bundle root`)
+        return null
+      }
+      const t = asPackage(patch.dir)
+      // cargo uses a patch only where its version satisfies the requirement ("patch … was not used").
+      if (t !== null && fits(version(t))) return t
+      warn(t === null
+        ? `[loader.cargo] ${patch.from} patches ${crate} with ${patch.dir}, which holds no Cargo.toml with a [package]`
+        : `[loader.cargo] ${patch.from}'s patch of ${crate} (${version(t)}) doesn't satisfy ${who}'s requirement ${req}: not used`)
+    } else if (patch?.spec.source.type === 'git') {
+      kind = 'git'
+    }
+    // A copy of where the dependency comes from (a copy without `.cargo-checksum.json` could be either).
+    const candidates = (vendored().byName.get(crate) ?? []).filter((c) => c.git === null || c.git === (kind === 'git'))
+    if (candidates.length === 0) return null
+    const vendoredList = candidates.map((c) => c.version).toSorted((a, b) => b.localeCompare(a, 'en', { numeric: true })).join(', ')
+    const lk = lockfile()
+    if (lk) {
+      const pins = lockKeysOf(lk, m)
+        .flatMap((k) => lk.lock.packages[k].dependencies)
+        .map((k) => lk.lock.packages[k])
+        .filter((p) => normName(p.name) === crate && sourceKind(p.source) === kind)
+        .map((p) => p.version)
+      const want = pins.find(fits) ?? null
+      // A lock whose pin the requirement no longer allows is out of date: cargo would resolve
+      // again, so the requirement decides.
+      if (want === null && pins.length > 0) warn(`[loader.cargo] ${lk.file} pins ${who} to ${crate} ${pins.join(', ')}, which ${req} doesn't allow: the lock is out of date`)
+      if (want !== null) {
+        const hit = candidates.find((c) => c.version === want)
+        if (hit) return readManifest(hit.dir)
+        warn(`[loader.cargo] ${who} is locked to ${crate} ${want}, which isn't vendored (vendored: ${vendoredList})`)
+        return null
+      }
+    }
+    const fitting = candidates.filter((c) => fits(c.version))
+    if (fitting.length === 1) return readManifest(fitting[0].dir)
+    if (fitting.length === 0) warn(`[loader.cargo] No vendored version of ${crate} satisfies ${who}'s requirement ${req} (vendored: ${vendoredList})`)
+    else warn(`[loader.cargo] Several vendored versions of ${crate} satisfy ${who}'s requirement ${req ?? '*'} (${fitting.map((c) => c.version).join(', ')}) and no Cargo.lock says which`)
+    return null
+  }
+
+  // --- feature resolution
+
+  // Cargo's feature resolver: v2 (edition 2021+, or `resolver = "2"`/`"3"`) leaves dev-dependencies
+  // out of a normal build's unification, resolves what is built for the host apart from what is
+  // built for the target, and ignores the tables of platforms not being built; v1 unifies them all.
+  // It is the workspace's setting: the build's workspace root's (buildWorkspaceRoot) `resolver`,
+  // else its edition -- never that of a vendored crate an entry is in, where cargo isn't run.
+  let resolverMemo = null
+  const resolverVersion = () => {
+    if (resolverMemo === null) {
+      const root = buildWorkspaceRoot()
+      resolverMemo = root?.resolver ?? (Number(root?.package?.edition ?? 0) >= 2021 ? 2 : 1)
+    }
+    return resolverMemo
+  }
+  // The feature context a unit's code sees (resolver 2 keeps the host's apart; resolver 1 has one).
+  const featureCtx = (c) => (resolverVersion() === 1 ? 'target' : c)
+  const isProcMacroPkg = (m) => m?.lib.procMacro === true
+  // The platform a context compiles for, as far as the loader knows it: the target's triple and
+  // cfgs when `target` was given; the host's only when the target is the host (`host`), since the
+  // machine that builds need not be the one that bundles.
+  const platformInfo = (platform) => (platform === 'target' ? targetInfo : hostInfo)
+  // Whether a table for platform `spec` (a `cfg(…)` or a triple; null or undefined for none) is
+  // one for `platform`: `yes`, `no`, or `maybe` when its cfgs aren't known or don't decide it.
+  const tableOn = (spec, platform) => {
+    if (spec === null || spec === undefined) return 'yes'
+    const info = platformInfo(platform)
+    if (info === null) return 'maybe'
+    const cfg = /^cfg\((.*)\)$/u.exec(spec)
+    const holds = cfg ? evalCfg(cfg[1], { target: info.cfgs }) : spec === info.triple
+    return holds === true ? 'yes' : (holds === false ? 'no' : 'maybe')
+  }
+  // A package in a context, as the resolutions key it: resolver 1's one context is `target`'s.
+  const nodeKey = (c, dir) => `${featureCtx(c)}\0${dir}`
+
+  // Both feature resolutions of `graph` (linkCargo's, or the replay's) by cargo's resolver, for the
+  // build of `packages`, members of it, per (context, dir) as nodeKey keys them -- `dirOf(key)` the
+  // dir of a package key, undefined for none -- resolver 1's one set under `target`, the normal one
+  // where there is one: `sure` with the features on for certain, `all` with those that may be, and
+  // `result`, the resolver's own answer for `all`. Cargo's resolver takes the platforms it builds
+  // for as known, and the loader may not know them: it runs against stand-ins (standInPlatform), a
+  // target-specific table the loader can't decide on one -- a platform it doesn't know, a cfg it
+  // can't decide there (`cfg(loom)`, which rustflags may set) -- off for `sure` and on for `all`,
+  // the rest for cargo to decide as written. What cargo's resolver refuses -- a feature asked of a
+  // package that hasn't it -- stops the build, naming `file`.
+  const resolveGraph = (graph, packages, file, dirOf) => {
+    const build = { packages, features, allFeatures, noDefaultFeatures, dev: entries.some((e) => linksDevDeps(e)), host: standInPlatform(MARK_HOST, hostInfo), targets: [standInPlatform(MARK_TARGET, targetInfo)] }
+    let undecided = false
+    const decided = (on) => retarget(graph, (spec) => {
+      const at = (platform) => {
+        if (tableOn(spec, platform) !== 'maybe') return /^cfg\((.*)\)$/su.exec(spec)?.[1] ?? `${MARK_NAME} = "${spec}"`
+        undecided = true
+        return String(on)
+      }
+      return `cfg(any(all(${MARK_TARGET}, ${at('target')}), all(${MARK_HOST}, ${at('host')})))`
+    })
+    const featuresOf = (g) => readNamed(file, () => resolveCargoFeatures(g, build))
+    const sure = featuresOf(decided(false))
+    const all = undecided ? featuresOf(decided(true)) : sure
+    const byNode = (result) => {
+      const out = new Map()
+      for (const [key, { normal, host: onHost }] of Object.entries(result)) {
+        const dir = dirOf(key)
+        if (dir === undefined) continue
+        if (onHost !== undefined) out.set(nodeKey('host', dir), new Set(onHost))
+        if (normal !== undefined) out.set(nodeKey('target', dir), new Set(normal))
+      }
+      return out
+    }
+    return { sure: byNode(sure), all: byNode(all), result: all }
+  }
+
+  // --- the replay: cargo's feature resolver, by @preventive/lockfile, over the manifests
+
+  // The graph cargo's feature resolver takes, as linkCargo gives one, laid out from the manifests
+  // where the lockfile's can't be: each package in-tree the entries' packages (`roots`) reach, by
+  // its dir, each of its declarations resolved as resolveDep resolves it -- a path, a `[patch]`, the
+  // vendored copy the lockfile or the requirement picks -- but a dependency's own dev-dependencies,
+  // which no build of the entries has. A declaration nothing in-tree answers resolves to a stand-in
+  // of its own, which depends on nothing and has every feature its dependent may ask of it: the
+  // declaration's, `default`, and what a `name/feature` or `name?/feature` of the package's
+  // features, or of `--cargo-features` for a root, names. So does, unresolved (`unbuilt`), a
+  // dev-dependency of a root that no entry is a test, bench or example of, under resolver 2: cargo's
+  // resolver takes the dev targets of every member as built or none, and the entries build only
+  // theirs. The members are the roots, and there is no root package: `--cargo-features` goes to each
+  // that has it. `edges`: each declaration's resolved key, with its package and request (`m`, `d`,
+  // `request`), and whether it is a stand-in.
+  const replayGraph = (roots) => {
+    const packages = Object.create(null)
+    const edges = []
+    const rootDirs = new Set(roots.map((m) => m.dir))
+    const unbuiltDev = (m) => resolverVersion() !== 1 && !devRootDirs().has(m.dir)
+    const queue = [...roots]
+    for (const m of queue) {
+      if (m.dir in packages) continue
+      const pkg = m.cargo.package
+      const dependencies = pkg.dependencies.map((d, index) => {
+        if (d.kind === 'dev' && !rootDirs.has(m.dir)) return { ...d, resolved: undefined, active: false }
+        const dep = m.deps.get(normName(d.name))
+        const request = dep.kinds.get(d.target === undefined ? d.kind : `${d.kind}@${d.target}`)
+        const unbuilt = d.kind === 'dev' && unbuiltDev(m)
+        const t = unbuilt ? null : resolveDep(m, dep, request, { quiet: true })
+        if (t !== null) queue.push(t)
+        const key = t?.dir ?? `\0${m.dir}\0${index}`
+        edges.push({ key, m, d, request, standIn: t === null, unbuilt })
+        return { ...d, resolved: key, active: true }
+      })
+      packages[m.dir] = { name: pkg.name, version: pkg.version, source: undefined, checksum: undefined, manifest: pkg, dependencies }
+    }
+    for (const { key, m, d } of edges.filter((e) => e.standIn)) {
+      const asked = new Set(['default', ...d.features])
+      for (const value of [...Object.values(m.cargo.package.features).flat(), ...(rootDirs.has(m.dir) ? parseFeatureList(features) : [])]) {
+        const named = DEP_FEATURE_RE.exec(value)
+        if (named?.[1] === d.name) asked.add(named[3])
+      }
+      const manifest = { name: d.package, features: Object.fromEntries([...asked].map((f) => [f, []])), dependencies: [], procMacro: false, procMacroTarget: false }
+      Object.setPrototypeOf(manifest.features, null)
+      packages[key] = { name: d.package, version: '0.0.0', source: undefined, checksum: undefined, manifest, dependencies: [] }
+    }
+    return { graph: { resolver: resolverVersion(), root: undefined, members: [...rootDirs], packages }, edges }
+  }
+
+  // The replay's resolution, as resolveGraph gives it, and the dependencies the build links that
+  // nothing in-tree answers -- a stand-in it reaches -- as `dir key` → `{ dir, key, name, kinds }`,
+  // the kinds of their tables (see lackingDependencies). What resolveDep warned of, it says now of
+  // the declarations whose package the build reaches.
+  const replay = () => {
+    const roots = [...new Set(entries.map(packageFor).filter(Boolean))]
+    if (roots.length === 0) return { resolved: { sure: new Map(), all: new Map() }, lacking: new Map() }
+    const { graph, edges } = replayGraph(roots)
+    const standIns = new Set(edges.filter((e) => e.standIn).map((e) => e.key))
+    const resolved = resolveGraph(graph, graph.members, buildWorkspaceRoot()?.file ?? null, (key) => (standIns.has(key) ? undefined : key))
+    const lacking = new Map()
+    for (const { key, m, d, request, standIn, unbuilt } of edges) {
+      if (unbuilt || !(key in resolved.result)) continue
+      warnDep(m, request)
+      if (!standIn) continue
+      const id = `${m.dir}\0${normName(d.name)}`
+      if (!lacking.has(id)) lacking.set(id, { dir: m.dir, key: normName(d.name), name: d.name, kinds: new Set() })
+      lacking.get(id).kinds.add(d.kind)
+    }
+    return { resolved, lacking }
+  }
+
+  // --- the exact resolution: cargo's resolver, by @preventive/lockfile
+
+  // The directories a workspace `members` pattern names, project-relative (glob's syntax, as cargo
+  // takes it: `*`, `?` and `[…]` within a segment, `**` for any depth); null when it leaves the
+  // bundle root.
+  const subdirs = (dir) => {
+    try {
+      return readdirSync(join(baseDir, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => (dir === '.' ? e.name : `${dir}/${e.name}`))
+    } catch {
+      return []
+    }
+  }
+  const globDirs = (rootDir, pattern) => {
+    let dirs = [rootDir]
+    for (const seg of pattern.split('/').filter((x) => x !== '' && x !== '.')) {
+      const next = []
+      for (const dir of dirs) {
+        if (seg === '**') {
+          const all = [dir]
+          for (let i = 0; i < all.length; i++) all.push(...subdirs(all[i]).filter((d) => !posix.basename(d).startsWith('.')))
+          next.push(...all)
+        } else if (/[*?[]/u.test(seg)) {
+          const re = globSegment(seg)
+          next.push(...subdirs(dir).filter((d) => re.test(posix.basename(d))))
+        } else {
+          const rel = normalizeRel(dir, seg)
+          if (rel === null) return null
+          next.push(rel)
+        }
+      }
+      dirs = next
+    }
+    return dirs
+  }
+  // The workspace's members, project-relative, as cargo finds them: the root package, the
+  // packages its `members` patterns name, and the path dependencies of members inside the root's
+  // directory, less what `exclude` names; null when a pattern leaves the bundle root.
+  const membersOf = (root) => {
+    const ws = root.cargo.workspace
+    if (ws === undefined) return [root.dir]
+    const excluded = ws.exclude.map((e) => normalizeRel(root.dir, e)).filter((e) => e !== null)
+    const isExcluded = (dir) => excluded.some((e) => dir === e || dir.startsWith(`${e}/`))
+    const inRoot = (dir) => root.dir === '.' || dir === root.dir || dir.startsWith(`${root.dir}/`)
+    const out = new Set(root.package ? [root.dir] : [])
+    for (const pattern of ws.members) {
+      const dirs = globDirs(root.dir, pattern)
+      if (dirs === null) return null
+      for (const dir of dirs) if (!isExcluded(dir) && readManifest(dir)?.package) out.add(dir)
+    }
+    // Set iteration is live: a path dependency added is walked in turn.
+    for (const dir of out) {
+      for (const d of readManifest(dir).deps.values()) {
+        for (const r of d.kinds.values()) {
+          const sub = r.dir
+          if (sub !== null && inRoot(sub) && !isExcluded(sub) && readManifest(sub)?.package) out.add(sub)
+        }
+      }
+    }
+    return [...out]
+  }
+  // The build as cargo resolves it, where the loader holds all that takes -- the build's lockfile
+  // and target, a manifest for every package the lockfile has (each path package inside the
+  // bundle root, every other one vendored, `.cargo-checksum.json` and all) and entries whose
+  // packages are workspace members: @preventive/lockfile lays the lockfile's graph over the
+  // manifests (linkCargo) and turns on the features `cargo build -p <the entries' packages>` does
+  // (resolveCargoFeatures), cargo's rules throughout -- each table's own source, a [patch] from the
+  // root manifest or the cargo config, proc-macros and build-dependencies built for the host, the
+  // command line's features handed out as cargo hands them out. What either refuses -- a lockfile
+  // out of date with the manifests, a vendored copy whose checksum isn't the lockfile's, a feature
+  // asked of a package that hasn't it -- stops the build. A table the loader can't decide on a
+  // platform -- the host's, where the target isn't `host` -- is resolved both ways (resolveGraph).
+  // `{ graph, dirOf, keyOf, resolved }` -- package key ↔ dir, and the features per (context, dir)
+  // as resolveGraph gives them -- or null when something it takes is missing, for the replay to
+  // decide: no lockfile, no target, a package not vendored, a path outside the bundle root.
+  let exactMemo
+  let exactWhy = null // why there is none, for the replay to say
+  const exact = () => {
+    if (exactMemo === undefined) exactMemo = exactUncached()
+    return exactMemo
+  }
+  const notExact = (why) => {
+    exactWhy = why
+    return null
+  }
+  const exactUncached = () => {
+    if (metadata) return null
+    if (targetInfo === null) return notExact('no --cargo-target')
+    const lockPath = buildLockPath()
+    if (lockPath === null) return notExact('the workspace root lies above the bundle root')
+    const lk = lockfile()
+    if (lk === null) return notExact(`no ${lockPath}`)
+    const root = buildWorkspaceRoot()
+    if (root === null) return notExact('no package owns the entries')
+    const memberDirs = membersOf(root)
+    if (memberDirs === null) return notExact(`a members pattern of ${root.file} leaves the bundle root`)
+    // The path packages: the members, the path dependencies of each, the path [patch]es.
+    const keyOf = new Map() // dir -> package key
+    const dirOf = new Map() // package key -> dir
+    const queue = [...memberDirs]
+    for (const { patch, at, from } of patchSources()) {
+      for (const specs of Object.values(patch)) {
+        for (const spec of Object.values(specs)) {
+          if (spec.source.type !== 'path') continue
+          const dir = at(spec.source.path)
+          if (dir === null) return notExact(`${from} patches with a path outside the bundle root`)
+          queue.push(dir)
+        }
+      }
+    }
+    for (const dir of queue) {
+      if (keyOf.has(dir)) continue
+      const m = readManifest(dir)
+      if (!m?.package) return notExact(`${posix.join(dir, 'Cargo.toml')} isn't a package's`)
+      const key = `${m.package.name} ${m.package.version}`
+      keyOf.set(dir, key)
+      dirOf.set(key, dir)
+      for (const d of m.deps.values()) {
+        for (const r of d.kinds.values()) {
+          if (r.path === null) continue
+          if (r.dir === null) return notExact(`${m.package.name}'s path dependency ${r.path} lies outside the bundle root`)
+          queue.push(r.dir)
+        }
+      }
+    }
+    // The vendor directory as a directory source reads it, and every package of the lockfile there
+    // (a copy the lockfile doesn't list needs no checksums: cargo never reads it).
+    const vendor = Object.create(null)
+    const held = new Map() // `name version` -> whether its copy has its checksums
+    for (const sub of subdirs(vendorDir)) {
+      const name = posix.basename(sub)
+      const m = name.startsWith('.') ? null : manifestAt(sub)
+      if (!m?.package) continue
+      const sums = checksumOf(sub)
+      const id = `${m.package.name} ${m.package.version}`
+      held.set(id, held.get(id) === true || sums !== null)
+      if (sums !== null) vendor[name] = { manifest: tableOf(sub).text, checksum: sums.text }
+    }
+    for (const [key, p] of Object.entries(lk.lock.packages)) {
+      if (p.source === undefined && !dirOf.has(key)) return notExact(`${lk.file} locks the path package ${p.name} ${p.version}, which isn't in-tree`)
+      if (p.source !== undefined && !held.has(`${p.name} ${p.version}`)) return notExact(`${p.name} ${p.version} is locked but not vendored`)
+      if (p.source !== undefined && !held.get(`${p.name} ${p.version}`)) return notExact(`the vendored copy of ${p.name} ${p.version} has no .cargo-checksum.json`)
+    }
+    const copies = readNamed(lk.file, () => readCargoVendor(lk.lock, vendor))
+    const manifestsByKey = Object.create(null)
+    for (const [key, dir] of dirOf) manifestsByKey[key] = readManifest(dir).cargo
+    for (const [key, { directory }] of Object.entries(copies)) {
+      const dir = `${vendorDir}/${directory}`
+      keyOf.set(dir, key)
+      dirOf.set(key, dir)
+      manifestsByKey[key] = readManifest(dir).cargo
+    }
+    const memberKeys = memberDirs.map((dir) => keyOf.get(dir))
+    const entryKeys = [...new Set(entries.map(packageFor).filter(Boolean).map((m) => keyOf.get(m.dir)))]
+    if (entryKeys.length === 0) return notExact('no package owns the entries')
+    if (entryKeys.some((k) => !memberKeys.includes(k))) return notExact('an entry\'s package isn\'t a member of the workspace')
+    const config = readNamed(configs[0]?.file ?? null, () => parseCargoConfig(configs.map((c) => c.text)))
+    const graph = readNamed(lk.file, () => linkCargo(lk.lock, manifestsByKey, { workspace: root.cargo, members: memberKeys, config }))
+    return { graph, dirOf, keyOf, resolved: resolveGraph(graph, entryKeys, root.file, (key) => dirOf.get(key)) }
+  }
+
+  // Both resolutions, per (context, package dir): `sure` without the undecided tables, `all` with
+  // them -- the exact resolution's where there is one, the replay's otherwise. `--cargo`: cargo
+  // metadata gives one feature set per package, the union over everything cargo would build for
+  // the workspace (dev and build dependencies, every platform), so a feature in it is on only maybe
+  // in either context -- code a `cfg(not(feature = "x"))` keeps in some build is never dropped --
+  // and one outside it is off. `lacking` (the replay's): the dependencies no package in-tree
+  // answers, `dir key` → `{ dir, key, name, kinds }` -- the kinds of its active tables -- as
+  // `cargo metadata`'s (see lackingDependencies).
+  let resolved = null
+  let lacking = null
+  const ensureResolved = () => {
+    if (resolved !== null) return resolved
+    if (metadata) {
+      const byNode = new Map([...metadata.enabled].flatMap(([dir, set]) => [[nodeKey('target', dir), set], [nodeKey('host', dir), set]]))
+      resolved = { sure: new Map(), all: byNode }
+    } else {
+      resolved = exact()?.resolved ?? null
+      if (resolved === null) ({ resolved, lacking } = replay())
+    }
+    return resolved
+  }
+  // Per node, the features on only maybe: in `all`, not in `sure` (one object per node).
+  const maybeByNode = new Map()
+  const maybeOf = (node) => cached(maybeByNode, node, () => {
+    const { sure, all } = ensureResolved()
+    const on = sure.get(node)
+    const maybe = new Set([...(all.get(node) ?? [])].filter((f) => !on?.has(f)))
+    return maybe.size === 0 ? null : maybe
+  })
+  // A package in the `all` resolution but not the `sure` one is built only maybe: nothing of its
+  // is on for certain.
+  const NO_FEATURES = new Set()
+
+  // --- cfgs a build may set
+  let rustflagCfgs = null
+  const cfgsSetMemo = new Map()
+  // A crate root's text -- a build script's, a lib's -- and that of the modules it declares (`mod
+  // probe;`, beside it), a few levels down: where its `cargo:rustc-cfg=` lines are.
+  const crateTexts = (root) => {
+    const texts = []
+    const queue = [[root, 0]]
+    const seen = new Set()
+    for (let qi = 0; qi < queue.length; qi++) {
+      const [rel, depth] = queue[qi]
+      if (seen.has(rel)) continue
+      seen.add(rel)
+      const text = readText(diskHost, join(baseDir, rel))
+      if (text === null) continue
+      texts.push(text)
+      if (depth >= 3) continue
+      const dir = posix.dirname(rel)
+      const sub = qi === 0 || posix.basename(rel) === 'mod.rs' ? dir : posix.join(dir, posix.basename(rel, '.rs'))
+      for (const m of text.matchAll(/\bmod\s+([A-Za-z_]\w*)\s*;/gu)) {
+        for (const f of [posix.join(sub, `${m[1]}.rs`), posix.join(sub, m[1], 'mod.rs')]) if (isFile(join(baseDir, f))) queue.push([f, depth + 1])
+      }
+    }
+    return texts
+  }
+
+  // What the build script of package `m` may print through the crates it calls (cfgsPrinted of
+  // their libs: cfg_aliases' `cfg_aliases!` prints the names its input gives) -- its
+  // build-dependencies for the host, and what they depend on in turn. One the bundle root lacks
+  // may print any for all the loader knows, which needs no lib read. Asked once per package
+  // (cfgsSetFor).
+  const helpersPrinted = (m) => {
+    const crates = new Map() // dir -> manifest
+    if (linksLacking(m, 'build', crates)) return { names: new Set(), any: true }
+    const names = new Set()
+    for (const t of crates.values()) {
+      const printed = libPrinted(t)
+      if (printed.any) return printed
+      for (const name of printed.names) names.add(name)
+    }
+    return { names, any: false }
+  }
+  // Whether package `p` links, through its `kind` dependencies for the host and what they depend
+  // on in turn, a crate the bundle root lacks; those it links in-tree go into `crates` (dir →
+  // manifest).
+  const linksLacking = (p, kind, crates) => [...p.deps.values()].some((d) => [...d.kinds.values()].some((r) => {
+    if (r.kind !== kind || tableOn(r.target, 'host') === 'no') return false
+    const t = resolveDep(p, d, r)
+    if (t === null) return true
+    if (crates.has(t.dir)) return false
+    crates.set(t.dir, t)
+    return linksLacking(t, 'normal', crates)
+  }))
+  // What package `t`'s lib may print for a build script calling it (cfgsPrinted); memoized per
+  // package.
+  const libPrints = new Map()
+  const libPrinted = (t) => cached(libPrints, t.dir, () => {
+    const lib = libPath(t)
+    return lib === null ? NO_CFGS_SET : cfgsPrinted(crateTexts(lib))
+  })
+
+  // The in-tree crate roots a name resolves to from package `m` (null: no owning package), leaving
+  // out `m`'s own lib (which depends on the asking file), as `[{ file, key }]`: the package its
+  // dependency of that name resolves to (path dep, `[patch]`, or the vendored version Cargo.lock
+  // says); a dependency whose lib is named that (`md-5` is used as `md5`); or -- for a file no
+  // manifest claims -- the one vendored crate of that lib or package name. A package's own name for
+  // a crate is its manifest's word: a declared dependency that doesn't resolve in-tree (a path
+  // outside the bundle root, a version no vendored copy has) never falls back to some vendored copy
+  // of that name, and a name it doesn't declare is no crate of its. Which of the dependency's
+  // tables count is the asking code's (`roles`, one per crate root the file is compiled in): a build
+  // script's are the `[build-dependencies]`, a test, bench or example target's the
+  // `[dependencies]` and `[dev-dependencies]`, other code's the `[dependencies]` (any table when
+  // none of those has it) -- each only where its platform may be one the code is compiled for
+  // (`platforms`, the file's units'; a build script's the host): a table the target's cfgs rule out
+  // is no dependency of a build for it, under either resolver. Tables that may each apply -- one
+  // per platform when no target decides them, or one per role -- give one candidate each, `key`
+  // naming which (`*` for the untargeted table, else its platform; `build-script ` before a build
+  // script's beside another role's). Memoized per (package, name, roles, platforms): every file of
+  // a package asks for the same few crates.
+  const crateTargets = new Map()
+  const depCrate = (m, norm, roles, platforms) => {
+    const memo = `${m?.dir ?? ''}\0${norm}\0${roles.join()}\0${platforms.join()}`
+    return cached(crateTargets, memo, () => depCrateUncached(m, norm, roles, platforms))
+  }
+  const ROLE_KINDS = { build: ['build'], test: ['normal', 'dev'], normal: ['normal'] }
+  // The role of the code of crate root `root` in package `m` (see depCrate).
+  const roleOf = (m, root) => (root === buildScript(m) ? 'build' : (linksDevDeps(root) ? 'test' : 'normal'))
+  // Of a dependency's tables (`{ kind, target, … }`, the manifest's or the linked graph's, in
+  // order), the packages the asking code links: for each role, the first table of each platform
+  // that may apply and that `find` finds a package for, as `{ t, key }` (see depCrate). `any`: a
+  // role with no table of its kinds takes any table instead (a declared name).
+  const linkedTables = (all, roles, platforms, find, any) => {
+    const out = []
+    const seen = new Set()
+    for (const role of roles) {
+      const own = all.filter((r) => ROLE_KINDS[role].includes(r.kind))
+      const plats = role === 'build' ? ['host'] : platforms
+      for (const r of own.length === 0 && any ? all : own) {
+        const on = r.target ?? null
+        const key = `${role === 'build' && roles.length > 1 ? 'build-script ' : ''}${on === null ? '*' : (/^cfg\((.*)\)$/su.exec(on)?.[1] ?? on)}`
+        if (seen.has(key) || !plats.some((p) => tableOn(on, r.kind === 'build' ? 'host' : p) !== 'no')) continue
+        const t = find(r)
+        if (t === null) continue
+        seen.add(key)
+        out.push({ t, key })
+      }
+    }
+    return out
+  }
+  // The candidates as crate roots, one per file.
+  const asRoots = (found) => {
+    const out = []
+    for (const { t, key } of found) {
+      const file = libPath(t)
+      if (file !== null && !out.some((c) => c.file === file)) out.push({ file, key })
+    }
+    return out
+  }
+  // depCrate from the exact resolution: the package's dependency of that key, else the unrenamed
+  // one whose lib is named that, as the lockfile resolves it.
+  const exactCrate = (x, key, norm, roles, platforms) => {
+    const deps = x.graph.packages[key].dependencies
+    const packageOf = (d) => (d.resolved === undefined ? null : readManifest(x.dirOf.get(d.resolved)))
+    const declared = deps.filter((d) => normName(d.name) === norm)
+    if (declared.length > 0) return asRoots(linkedTables(declared, roles, platforms, packageOf, true))
+    return asRoots(linkedTables(deps.filter((d) => d.name === d.package && d.resolved !== undefined && libName(packageOf(d)) === norm), roles, platforms, packageOf, false))
+  }
+  const depCrateUncached = (m, norm, roles, platforms) => {
+    const x = m ? exact() : null
+    const key = x?.keyOf.get(m.dir)
+    if (key !== undefined) return exactCrate(x, key, norm, roles, platforms)
+    if (m) {
+      const d = m.deps.get(norm)
+      if (d) return asRoots(linkedTables([...d.kinds.values()], roles, platforms, (r) => resolveDep(m, d, r), true))
+      // A dependency whose lib is named `norm`: only one that may be is resolved (a path
+      // dependency's manifest says, a vendored crate's must have that lib name), so a name that is
+      // no crate (`u8::MAX`) resolves -- and warns about -- nothing.
+      const mayBe = (r) => {
+        if (!r.path) return vendored().byLib.has(norm)
+        const t = r.dir === null ? null : readManifest(r.dir)
+        return Boolean(t?.package) && libName(t) === norm
+      }
+      for (const other of m.deps.values()) {
+        const named = [...other.kinds.values()].filter((r) => !r.renamed && mayBe(r)) // a rename is used by its key, not its lib name
+        const found = linkedTables(named, roles, platforms, (r) => {
+          const t = resolveDep(m, other, r)
+          return t && libName(t) === norm ? t : null
+        }, false)
+        if (found.length > 0) return asRoots(found)
+      }
+      return []
+    }
+    const { byLib, byName } = vendored()
+    const found = new Set()
+    for (const index of [byLib, byName]) for (const c of index.get(norm) ?? []) found.add(c.dir)
+    if (found.size > 1) {
+      console.warn(`[loader.cargo] Several vendored crates are named ${norm} (${[...found].join(', ')}) and no manifest says which`)
+      return []
+    }
+    return asRoots([...found].map((dir) => ({ t: readManifest(dir), key: '*' })))
+  }
+
+  const crateCandidates = (name, fromFile, { roots = null, units = null } = {}) => {
+    const norm = normName(name)
+    const m = packageFor(fromFile)
+    if (m && libName(m) === norm) {
+      const lib = libPath(m)
+      if (lib && lib !== fromFile) return [{ file: lib, key: '*' }]
+    }
+    const roles = m === null ? ['normal'] : [...new Set((roots === null || roots.size === 0 ? [fromFile] : [...roots]).map((r) => roleOf(m, r)))]
+    const platforms = units === null || units.size === 0 ? ['target'] : [...new Set([...units].map(unitPlatform))]
+    return depCrate(m, norm, roles, platforms)
+  }
+
+  // The files describing package `m`'s build, on disk (see buildFilesFor).
+  const buildFiles = (m) => {
+    const out = [{ path: posix.join(m.dir, 'Cargo.toml'), kind: 'manifest' }]
+    if (isVendoredDir(m.dir)) {
+      const checksum = posix.join(m.dir, '.cargo-checksum.json')
+      if (isFile(join(baseDir, checksum))) out.push({ path: checksum, kind: 'checksum' })
+      return out
+    }
+    const ws = workspaceFor(m.dir)
+    if (ws && ws.dir !== m.dir) out.push({ path: posix.join(ws.dir, 'Cargo.toml'), kind: 'manifest' })
+    // The build's lockfile and cargo configs, not the package's own: cargo reads only those.
+    const lockPath = buildLockPath()
+    if (lockPath !== null && isFile(join(baseDir, lockPath))) out.push({ path: lockPath, kind: 'lock' })
+    for (const c of configs) if (c.dir !== null) out.push({ path: c.file, kind: 'config' })
+    return out
+  }
+
+  return {
+    // Where `cargo vendor` put the registry crates (project-relative): `vendor`, or what
+    // .cargo/config.toml names. A package under it is a vendored dependency.
+    vendorDir,
+    // Identity of the package owning `fileRel` -- `{ dir, name, version }` from the nearest
+    // Cargo.toml with a [package] -- or null when no manifest claims it.
+    packageInfo(fileRel) {
+      const m = packageFor(fileRel)
+      return m ? { dir: m.dir, name: m.package.name, version: version(m) } : null
+    },
+    // Whether `fileRel` is the lib target root of the package owning it (a crate root by role,
+    // whatever its name).
+    isLibRoot(fileRel) {
+      const m = packageFor(fileRel)
+      return m !== null && libPath(m) === fileRel
+    },
+    // The in-tree crate roots a crate name as used in source (`use name::…`, `extern crate name`)
+    // names from `fromFile`, as `[{ file, key }]`: the owning package's own lib (from another of
+    // its files), else what depCrate finds -- for the code of each crate root the file is compiled
+    // in (`roots`; the file's own role without them), on the platforms of its compile units
+    // (`units`; the target's without them). Several when tables that may each apply name different
+    // packages (see depCrate); none for anything else (a registry dep that isn't vendored, std, a
+    // name that isn't a crate).
+    crateCandidates,
+    // The first of crateCandidates, or null.
+    resolveCrate: (name, fromFile, opts) => crateCandidates(name, fromFile, opts)[0]?.file ?? null,
+    // Where the features come from: `{ mode, why }` -- `cargo` (cargo's resolver over the
+    // lockfile), `metadata` (`cargo metadata`), or `replay` (the manifests replayed) with `why`
+    // cargo's resolver couldn't run.
+    resolution() {
+      ensureResolved()
+      return metadata ? { mode: 'metadata', why: null } : (exact() === null ? { mode: 'replay', why: exactWhy } : { mode: 'cargo', why: null })
+    },
+    isTestTarget,
+    // The dependencies the build links that nothing in-tree answers, for the packages at `dirs` (the
+    // bundled ones): declared, and active in the build as far as the resolution tells (its tables
+    // for the build's platforms, an optional one turned on; maybe ones too), but a registry crate
+    // not vendored, a path outside the bundle root -- as `{ key, name, from }` (the dependency's
+    // key and name in its dependent's manifest, and that package as `name version`). Code may name
+    // such a crate by another name than the manifest's (`md-5` is used as `md5`), or not at all, so
+    // the bundle can't tell from the code that it lacks one. Dev-dependencies count only for a
+    // package an entry is a test, bench or example target of; build-dependencies only for a
+    // package with a build script, and with `buildScripts` (build scripts bundled). Cargo's
+    // resolver needs every locked package in-tree, so it has none.
+    lackingDependencies(dirs, { buildScripts = false } = {}) {
+      ensureResolved()
+      const counts = (kind, dir) => (kind === 'dev' ? devRootDirs().has(dir) : (kind !== 'build' || (buildScripts && buildScript(readManifest(dir)) !== null)))
+      const out = []
+      const seen = new Set()
+      for (const { dir, key, name, kinds } of [...(lacking?.values() ?? []), ...(metadata?.lacking ?? [])]) {
+        const m = dirs.has(dir) ? readManifest(dir) : null
+        const from = m?.package ? `${m.package.name} ${version(m)}` : null
+        if (from === null || seen.has(`${from}\0${key}`) || ![...kinds].some((k) => counts(k, dir))) continue
+        seen.add(`${from}\0${key}`)
+        out.push({ key, name, from })
+      }
+      return out
+    },
+    // Whether `fromFile`'s package declares a dependency of that name (in any table, by the key
+    // code uses): then the name is that crate -- rustc refuses a `use` path whose lead a glob
+    // import also provides, as ambiguous (E0659) -- in-tree or not.
+    declaresCrate(name, fromFile) {
+      return packageFor(fromFile)?.deps.has(normName(name)) === true
+    },
+    // The build's target: its triple and cfg set (`unix`, `target_os="linux"`, … as rustc prints
+    // them), or null for both when none was given.
+    targetTriple: targetInfo?.triple ?? null,
+    targetCfgs: targetInfo?.cfgs ?? null,
+    // The files that describe the build of `fileRel`'s package, project-relative, as `{ path,
+    // kind }`, those on disk. A vendored package's: its Cargo.toml (`manifest`) and the
+    // `.cargo-checksum.json` cargo checks its files against (`checksum`) -- the lock and config a
+    // registry crate was published with play no part in a build that depends on it. Any other
+    // package's: its own Cargo.toml and, inside the bundle root, the workspace's above it
+    // (`manifest`); and the build's Cargo.lock (`lock`) and the cargo configs it reads (`config`,
+    // see `runDir`), those inside the bundle root -- not a path dependency's own, which no build
+    // of the entries reads. Empty for a file no manifest claims.
+    buildFilesFor(fileRel) {
+      const m = packageFor(fileRel)
+      if (!m) return []
+      m.buildFiles ??= buildFiles(m)
+      return m.buildFiles
+    },
+    // Throws when `fileRel` is a vendored package's file whose bytes (`buf`) aren't the ones its
+    // `.cargo-checksum.json` lists -- edited after `cargo vendor`: cargo refuses to build it, and
+    // so the bundle does. A file the list doesn't name, or a package without one, passes; one
+    // checked already -- a vendored Cargo.toml, as its package was read -- isn't hashed again.
+    checkVendoredFile(fileRel, buf) {
+      const m = packageFor(fileRel)
+      if (m !== null && isVendoredDir(m.dir)) checkVendored(m.dir, fileRel, buf)
+    },
+    // Whether `fileRel` belongs to a vendored package (a registry crate `cargo vendor` copied in).
+    isVendored(fileRel) {
+      const m = packageFor(fileRel)
+      return m !== null && isVendoredDir(m.dir)
+    },
+    // The build script of `fileRel`'s package, project-relative, when there is one on disk:
+    // `[package] build = "…"`, else `build.rs` beside the manifest; `build = false` means none. A
+    // vendored package's may not name a file outside the package (a published crate never does).
+    buildScriptOf(fileRel) {
+      const m = packageFor(fileRel)
+      return m ? buildScript(m) : null
+    },
+    // The custom cfgs the build of `fileRel`'s package may set (a `--cfg` a default build lacks is
+    // otherwise presumed off): `{ names, any }` -- the names its build script prints as
+    // `cargo:rustc-cfg=…`, itself or through a crate it calls, and those the rustflags set, and
+    // whether the script may set one the loader can't read. One object per package (and one for
+    // every package that sets none).
+    cfgsSetFor(fileRel) {
+      const m = packageFor(fileRel)
+      return cached(cfgsSetMemo, m?.dir ?? '\0', () => {
+        rustflagCfgs ??= rustflagsCfgsOf(configs)
+        const script = m ? buildScript(m) : null
+        const printed = script === null ? NO_CFGS_SET : cfgsPrinted(crateTexts(script))
+        const helpers = script === null || printed.any ? NO_CFGS_SET : helpersPrinted(m)
+        const any = printed.any || helpers.any
+        const names = new Set([...rustflagCfgs, ...printed.names, ...helpers.names])
+        return names.size === 0 && !any ? NO_CFGS_SET : { names, any }
+      })
+    },
+    // The features on for certain for the package owning `fileRel`, compiled as `unit` (see
+    // unitOfCrate), in the build of the root packages; null when that is unknown: no owning
+    // manifest, no root package to resolve from, or a package the resolved build doesn't pull in
+    // (its gated code is then kept, not dropped).
+    featuresFor(fileRel, unit = TARGET_UNIT) {
+      const m = packageFor(fileRel)
+      if (!m) return null
+      const node = nodeKey(unitFeatureCtx(unit), m.dir)
+      const { sure, all } = ensureResolved()
+      return sure.get(node) ?? (all.has(node) ? NO_FEATURES : null)
+    },
+    // The features on only in some of the builds the loader can't tell apart (a target-specific
+    // table it can't decide, or what only such a table requests), for the same package and unit;
+    // null when there are none.
+    maybeFeaturesFor(fileRel, unit = TARGET_UNIT) {
+      const m = packageFor(fileRel)
+      if (!m) return null
+      return maybeOf(nodeKey(unitFeatureCtx(unit), m.dir))
+    },
+    // Every package of a context the build may pull in: dir -> { on, maybe }, the features on for
+    // certain and those on only maybe (a package only an undecided table pulls in has every
+    // feature of its maybe). For diagnostics and tests.
+    featureResolution(context = 'target') {
+      const out = new Map()
+      const prefix = nodeKey(context, '')
+      for (const node of ensureResolved().all.keys()) {
+        if (node.startsWith(prefix)) out.set(node.slice(prefix.length), { on: ensureResolved().sure.get(node) ?? NO_FEATURES, maybe: maybeOf(node) ?? NO_FEATURES })
+      }
+      return out
+    },
+    // Every resolved package of a context: dir -> Set<feature on for certain>. For diagnostics and tests.
+    resolvedFeatures(context = 'target') {
+      const out = new Map()
+      const prefix = nodeKey(context, '')
+      for (const [node, set] of ensureResolved().sure) if (node.startsWith(prefix)) out.set(node.slice(prefix.length), set)
+      return out
+    },
+    // The compile unit of a crate root `libFile` named from code compiled as `fromUnit`: a proc-macro
+    // crate, and anything code compiled for the host names (a build script's build-dependencies,
+    // a proc-macro's dependencies), is built for the host in the host's feature context; else the
+    // namer's unit.
+    unitOfCrate(libFile, fromUnit = TARGET_UNIT) {
+      return isProcMacroPkg(packageFor(libFile)) || unitPlatform(fromUnit) === 'host' ? HOST_UNIT : fromUnit
+    },
+    // The unit of a build script of a package compiled as `pkgUnit`: for the host, with the
+    // package's features.
+    buildScriptUnit(pkgUnit = TARGET_UNIT) {
+      return unitKey(unitFeatureCtx(pkgUnit), 'host')
+    },
+    // The cfgs and triple of the platform `unit` compiles for, as far as known (see platformInfo).
+    platformOf(unit = TARGET_UNIT) {
+      return platformInfo(unitPlatform(unit))
+    },
+  }
+}