wyvrnpm 1.0.0

package/README.md

@@ -0,0 +1,139 @@
+# wyvrnpm
+
+A simple, private C++ package manager that works with any static file hosting provider — Amazon S3, Azure Blob Storage, a plain nginx server, or anything that can serve files over HTTPS.
+
+There is no central registry. You control where packages are hosted.
+
+---
+
+## Install
+
+```bash
+npm install -g wyvrnpm
+```
+
+Requires Node.js >= 18.
+
+---
+
+## Commands
+
+### `wyvrnpm init`
+
+Creates a `wyvrn.json` manifest in the current directory (or the directory given by `--root`).
+
+```bash
+wyvrnpm init
+wyvrnpm init --root ./my-project
+```
+
+### `wyvrnpm install`
+
+Resolves the full dependency graph and downloads all packages.
+
+```bash
+wyvrnpm install --source https://my-bucket.s3.amazonaws.com/cpp --platform win_x64
+
+# Multiple sources — tried in order, first to respond wins
+wyvrnpm install \
+  --source https://primary.example.com/cpp \
+  --source https://mirror.example.com/cpp \
+  --platform linux_x64
+
+# Aliases
+wyvrnpm install -s https://pkg.example.com/cpp -s https://mirror.example.com/cpp
+```
+
+**Options**
+
+| Option | Default | Description |
+|---|---|---|
+| `--source` / `-s` | — | Base URL of a package source. Repeat for multiple sources. |
+| `--platform` | `win_x64` | Target platform. One of: `win_x64`, `win_x86`, `linux_x64`, `linux_x86`, `osx_x64`, `osx_arm64` |
+| `--timeout` | `300` | HTTP request timeout in seconds |
+| `--manifest` | `./wyvrn.json` | Path to the manifest file |
+| `--root` | `./` | Project root (packages extracted to `{root}/wyvrn_internal/`) |
+
+Packages are extracted to `wyvrn_internal/{name}/` and a `wyvrn.lock` file is written alongside the manifest recording the exact resolved versions. On subsequent installs the lock pins all previously resolved versions — only newly added dependencies are resolved fresh.
+
+### `wyvrnpm clean`
+
+Removes the `wyvrn_internal/` package cache and `wyvrn.lock`.
+
+```bash
+wyvrnpm clean
+```
+
+---
+
+## Registry Layout
+
+Packages must be hosted at the following URL structure:
+
+```
+{source}/{platform}/{name}/{version}/wyvrn.json   <- package manifest (preferred)
+{source}/{platform}/{name}/{version}/wyvrn.zip    <- package archive (preferred)
+```
+
+The tool tries `wyvrn.json` / `wyvrn.zip` first and falls back to `razer.json` / `razer.zip` if not found, for backwards compatibility.
+
+**Example:**
+
+```
+https://my-bucket.s3.amazonaws.com/cpp/win_x64/OpenSSL/3.0.0.0/wyvrn.json
+https://my-bucket.s3.amazonaws.com/cpp/win_x64/OpenSSL/3.0.0.0/wyvrn.zip
+```
+
+### Package manifest format (wyvrn.json / razer.json)
+
+```json
+{
+  "Name": "OpenSSL",
+  "Version": "3.0.0.0",
+  "Description": "TLS/SSL toolkit",
+  "Dependencies": [
+    { "Name": "zlib", "Version": "1.3.0.0" }
+  ]
+}
+```
+
+Fields use PascalCase. `Dependencies` is an array — transitive dependencies are resolved automatically.
+
+---
+
+## Project Manifest (wyvrn.json)
+
+```json
+{
+  "name": "my-app",
+  "version": "1.0.0.0",
+  "description": "My C++ application",
+  "kind": "ConsoleApp",
+  "dependencies": {
+    "OpenSSL": "3.0.0.0",
+    "zlib": "1.3.0.0"
+  }
+}
+```
+
+**`kind` values:** `ConsoleApp`, `StaticLib`, `DynamicLib`, `HeaderOnlyLib`, `WebApp`, `Utility`, `Service`, `TestProject`
+
+**`dependencies`** maps package names to version strings (`"major.minor.patch.build"`).
+
+---
+
+## Version Conflict Resolution
+
+When the dependency graph requires the same package at multiple versions, the highest version wins. If a `wyvrn.lock` exists, locked versions always take priority over any conflicting transitive request. A warning is printed for every conflict detected.
+
+---
+
+## Ignoring generated files
+
+Add the following to your `.gitignore`:
+
+```
+wyvrn_internal/
+wyvrn.lock
+*.zip
+```

package/bin/wyvrn.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+
+'use strict';
+
+const yargs = require('yargs');
+const init = require('../src/commands/init');
+const install = require('../src/commands/install');
+const clean = require('../src/commands/clean');
+
+yargs
+  .option('manifest', {
+    type: 'string',
+    description: 'Path to manifest file',
+    default: './wyvrn.json',
+  })
+  .option('root', {
+    type: 'string',
+    description: 'Root directory',
+    default: './',
+  })
+  .command(
+    'init',
+    'Initialise a new wyvrn.json manifest in the current project',
+    () => {},
+    (argv) => init(argv),
+  )
+  .command(
+    'install',
+    'Resolve and download all dependencies listed in the manifest',
+    (yargs) => {
+      yargs
+        .option('source', {
+          alias: 's',
+          type: 'string',
+          description: 'Base URL of a package source (can be repeated)',
+          array: true,
+        })
+        .option('platform', {
+          type: 'string',
+          description: 'Target platform',
+          choices: ['win_x64', 'win_x86', 'linux_x64', 'linux_x86', 'osx_x64', 'osx_arm64'],
+          default: 'win_x64',
+        })
+        .option('timeout', {
+          type: 'number',
+          description: 'HTTP timeout in seconds',
+          default: 300,
+        });
+    },
+    (argv) => install(argv),
+  )
+  .command(
+    'clean',
+    'Remove downloaded packages and lock file',
+    () => {},
+    (argv) => clean(argv),
+  )
+  .demandCommand(1)
+  .strict()
+  .help()
+  .parse();

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "wyvrnpm",
+  "version": "1.0.0",
+  "description": "A simple, static-hosting-compatible C++ package manager",
+  "keywords": [
+    "c++",
+    "package-manager",
+    "cpp",
+    "dependency-management",
+    "s3",
+    "azure"
+  ],
+  "license": "MIT",
+  "bin": {
+    "wyvrnpm": "bin/wyvrn.js"
+  },
+  "main": "src/index.js",
+  "type": "commonjs",
+  "files": [
+    "bin/",
+    "src/",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node --test tests/*.test.js"
+  },
+  "dependencies": {
+    "adm-zip": "^0.5.16",
+    "yargs": "^17.7.2"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/src/commands/clean.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Removes the wyvrn_internal/ package cache directory and the wyvrn.lock file.
+ *
+ * @param {object} argv - Parsed yargs arguments.
+ * @param {string} argv.root - Project root directory.
+ * @param {string} argv.manifest - Path to the manifest file (used to locate wyvrn.lock).
+ * @returns {Promise<void>}
+ */
+async function clean(argv) {
+  const rootDir = path.resolve(argv.root);
+  const razerDir = path.join(rootDir, 'wyvrn_internal');
+  const lockPath = path.join(path.dirname(path.resolve(argv.manifest)), 'wyvrn.lock');
+
+  let removedAnything = false;
+
+  if (fs.existsSync(razerDir)) {
+    fs.rmSync(razerDir, { recursive: true, force: true });
+    console.log(`[wyvrn] Removed ${razerDir}`);
+    removedAnything = true;
+  } else {
+    console.log(`[wyvrn] Nothing to clean at ${razerDir}`);
+  }
+
+  if (fs.existsSync(lockPath)) {
+    fs.unlinkSync(lockPath);
+    console.log(`[wyvrn] Removed ${lockPath}`);
+    removedAnything = true;
+  }
+
+  if (!removedAnything) {
+    console.log('[wyvrn] Nothing to clean.');
+  }
+}
+
+module.exports = clean;

package/src/commands/init.js

@@ -0,0 +1,33 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { defaultManifest, writeManifest } = require('../manifest');
+
+/**
+ * Initialises a new wyvrn.json manifest in the project root.
+ * If a manifest already exists the command exits early without overwriting it.
+ *
+ * @param {object} argv - Parsed yargs arguments.
+ * @param {string} argv.manifest - Path to the manifest file.
+ * @param {string} argv.root - Project root directory.
+ * @returns {Promise<void>}
+ */
+async function init(argv) {
+  const manifestPath = path.resolve(argv.manifest);
+  const rootDir = path.resolve(argv.root);
+
+  if (fs.existsSync(manifestPath)) {
+    console.log(`[wyvrn] Manifest already exists at ${manifestPath}`);
+    return;
+  }
+
+  const projectName = path.basename(rootDir);
+  const manifest = defaultManifest(projectName);
+
+  writeManifest(manifestPath, manifest);
+
+  console.log(`[wyvrn] Created manifest at ${manifestPath}`);
+}
+
+module.exports = init;

package/src/commands/install.js

@@ -0,0 +1,98 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { readManifest } = require('../manifest');
+const { resolveDependencies } = require('../resolve');
+const { downloadDependencies } = require('../download');
+
+/**
+ * Resolves and downloads all dependencies declared in the manifest, then writes
+ * a wyvrn.lock file recording exactly what was installed.
+ *
+ * @param {object} argv - Parsed yargs arguments.
+ * @param {string} argv.manifest - Path to wyvrn.json.
+ * @param {string} argv.root - Project root directory.
+ * @param {string[]} [argv.source] - One or more base URLs for package sources.
+ * @param {string} argv.platform - Target platform string.
+ * @param {number} argv.timeout - HTTP timeout in seconds.
+ * @returns {Promise<void>}
+ */
+async function install(argv) {
+  const manifestPath = path.resolve(argv.manifest);
+  const rootDir = path.resolve(argv.root);
+
+  // Validate that at least one source is provided.
+  const packageSources = argv.source && argv.source.length > 0 ? argv.source : [];
+  if (packageSources.length === 0) {
+    console.warn(
+      '[wyvrn] Warning: no --source URLs provided. ' +
+        'Pass at least one with --source <url> or -s <url>.',
+    );
+  }
+
+  const lockPath = path.join(path.dirname(manifestPath), 'wyvrn.lock');
+  const lockedVersions = new Map();
+  if (fs.existsSync(lockPath)) {
+    try {
+      const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+      for (const [name, version] of Object.entries(lock.packages || {})) {
+        lockedVersions.set(name, version);
+      }
+      console.log(`[wyvrn] Lock file found — ${lockedVersions.size} pinned package(s)`);
+    } catch {
+      console.warn('[wyvrn] Warning: could not read wyvrn.lock, resolving from scratch');
+    }
+  }
+
+  const manifest = readManifest(manifestPath);
+
+  // Normalize dependencies: support both array [{ Name, Version }] and object { name: version }.
+  const rawDeps = manifest.dependencies || manifest.Dependencies || {};
+  const rootDeps = Array.isArray(rawDeps)
+    ? Object.fromEntries(rawDeps.map((d) => [d.Name ?? d.name, d.Version ?? d.version]))
+    : rawDeps;
+
+  console.log(
+    `[wyvrn] Installing dependencies for "${manifest.name}" (platform: ${argv.platform})`,
+  );
+
+  const resolvedDeps = await resolveDependencies(
+    rootDeps,
+    packageSources,
+    argv.platform,
+    fetch,
+    lockedVersions,
+  );
+
+  const razerDir = path.join(rootDir, 'wyvrn_internal');
+
+  await downloadDependencies(
+    resolvedDeps,
+    packageSources,
+    argv.platform,
+    razerDir,
+    fetch,
+    argv.timeout,
+  );
+
+  // Build lock file — packages sorted alphabetically for deterministic diffs.
+  const sortedPackages = {};
+  for (const key of [...resolvedDeps.keys()].sort()) {
+    sortedPackages[key] = resolvedDeps.get(key);
+  }
+
+  const lockData = {
+    generatedAt: new Date().toISOString(),
+    platform: argv.platform,
+    packages: sortedPackages,
+  };
+
+  fs.writeFileSync(lockPath, JSON.stringify(lockData, null, 2) + '\n', 'utf8');
+  console.log(`[wyvrn] Lock file written to ${lockPath}`);
+
+  const count = resolvedDeps.size;
+  console.log(`[wyvrn] Done — ${count} package${count !== 1 ? 's' : ''} installed.`);
+}
+
+module.exports = install;

package/src/download.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const AdmZip = require('adm-zip');
+
+/**
+ * Downloads a single URL to a local file path, respecting the given timeout.
+ *
+ * @param {string} url - Remote URL to download.
+ * @param {string} destPath - Local path to write the response body to.
+ * @param {Function} httpClient - fetch-compatible function.
+ * @param {number} timeoutMs - Abort timeout in milliseconds.
+ * @returns {Promise<void>}
+ * @throws {Error} On non-OK HTTP status or network / timeout error.
+ */
+async function downloadFile(url, destPath, httpClient, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+
+  let response;
+  try {
+    response = await httpClient(url, { signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status} for ${url}`);
+  }
+
+  const arrayBuffer = await response.arrayBuffer();
+  fs.writeFileSync(destPath, Buffer.from(arrayBuffer));
+}
+
+/**
+ * Resolves which source URL contains a given package by probing each one in order.
+ *
+ * @param {string} name
+ * @param {string} version
+ * @param {string[]} packageSources
+ * @param {string} platform
+ * @param {Function} httpClient
+ * @param {number} timeoutMs
+ * @param {string} destZipPath - Where to save the downloaded zip.
+ * @returns {Promise<boolean>} True if successfully downloaded, false otherwise.
+ */
+async function tryDownloadFromSources(
+  name,
+  version,
+  packageSources,
+  platform,
+  httpClient,
+  timeoutMs,
+  destZipPath,
+) {
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    const candidates = [
+      `${base}/${platform}/${name}/${version}/wyvrn.zip`,
+      `${base}/${platform}/${name}/${version}/razer.zip`,
+    ];
+    for (const url of candidates) {
+      try {
+        await downloadFile(url, destZipPath, httpClient, timeoutMs);
+        return true;
+      } catch (err) {
+        console.warn(`[wyvrn] Could not download ${name}@${version} from ${url}: ${err.message}`);
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Downloads and extracts all resolved dependencies that are not already present on disk.
+ *
+ * @param {Map<string, string>} resolvedDeps - Map of package name -> version string.
+ * @param {string[]} packageSources - Ordered list of base URLs to try.
+ * @param {string} platform - Target platform string (e.g. "win_x64").
+ * @param {string} razerDir - Local directory used for extraction (e.g. "wyvrn_internal").
+ * @param {Function} httpClient - fetch-compatible function.
+ * @param {number} timeout - HTTP timeout in seconds.
+ * @returns {Promise<void>}
+ */
+async function downloadDependencies(
+  resolvedDeps,
+  packageSources,
+  platform,
+  razerDir,
+  httpClient,
+  timeout,
+) {
+  const timeoutMs = timeout * 1000;
+
+  if (!fs.existsSync(razerDir)) {
+    fs.mkdirSync(razerDir, { recursive: true });
+  }
+
+  for (const [name, version] of resolvedDeps) {
+    const extractDir = path.join(razerDir, name);
+    const versionFile = path.join(extractDir, '.wyvrn-version');
+
+    if (fs.existsSync(extractDir)) {
+      const installedVersion = fs.existsSync(versionFile)
+        ? fs.readFileSync(versionFile, 'utf8').trim()
+        : null;
+      if (installedVersion === version) {
+        console.log(`[wyvrn] Already present: ${name}@${version} — skipping`);
+        continue;
+      }
+      console.log(`[wyvrn] Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
+      fs.rmSync(extractDir, { recursive: true, force: true });
+    }
+
+    console.log(`[wyvrn] Downloading: ${name}@${version}`);
+
+    const destZipPath = path.join(razerDir, `${name}.zip`);
+
+    const ok = await tryDownloadFromSources(
+      name,
+      version,
+      packageSources,
+      platform,
+      httpClient,
+      timeoutMs,
+      destZipPath,
+    );
+
+    if (!ok) {
+      console.warn(
+        `[wyvrn] Warning: package ${name}@${version} was not found in any configured source`,
+      );
+      continue;
+    }
+
+    try {
+      const zip = new AdmZip(destZipPath);
+      zip.extractAllTo(extractDir, /* overwrite */ true);
+      fs.writeFileSync(versionFile, version, 'utf8');
+      console.log(`[wyvrn] Extracted: ${name}@${version} → ${extractDir}`);
+    } catch (err) {
+      console.warn(`[wyvrn] Failed to extract ${name}@${version}: ${err.message}`);
+    } finally {
+      // Always remove the zip, even if extraction failed.
+      try {
+        fs.unlinkSync(destZipPath);
+      } catch {
+        // Ignore cleanup errors.
+      }
+    }
+  }
+}
+
+module.exports = {
+  downloadDependencies,
+};

package/src/index.js

@@ -0,0 +1,7 @@
+'use strict';
+
+module.exports = {
+  init: require('./commands/init'),
+  install: require('./commands/install'),
+  clean: require('./commands/clean'),
+};

package/src/manifest.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Valid project kind values, matching the C# serialisation enum.
+ * @type {string[]}
+ */
+const VALID_KINDS = [
+  'ConsoleApp',
+  'StaticLib',
+  'DynamicLib',
+  'HeaderOnlyLib',
+  'WebApp',
+  'Utility',
+  'Service',
+  'TestProject',
+];
+
+/**
+ * Returns a blank manifest object populated with sensible defaults.
+ *
+ * @param {string} name - Project name (typically the directory basename).
+ * @returns {object}
+ */
+function defaultManifest(name) {
+  return {
+    name: name,
+    version: '1.0.0.0',
+    description: '',
+    kind: 'ConsoleApp',
+    dependencies: {},
+  };
+}
+
+/**
+ * Reads and parses a wyvrn.json manifest from disk.
+ *
+ * @param {string} manifestPath - Absolute or relative path to wyvrn.json.
+ * @returns {object} Parsed manifest data.
+ * @throws {Error} If the file does not exist or contains invalid JSON.
+ */
+function readManifest(manifestPath) {
+  const resolved = path.resolve(manifestPath);
+  if (!fs.existsSync(resolved)) {
+    throw new Error(`Manifest not found: ${resolved}`);
+  }
+  const raw = fs.readFileSync(resolved, 'utf8');
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Failed to parse manifest at ${resolved}: ${err.message}`);
+  }
+}
+
+/**
+ * Serialises and writes manifest data to disk with 2-space indentation.
+ *
+ * @param {string} manifestPath - Absolute or relative path to wyvrn.json.
+ * @param {object} data - Manifest object to serialise.
+ */
+function writeManifest(manifestPath, data) {
+  const resolved = path.resolve(manifestPath);
+  const dir = path.dirname(resolved);
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+  fs.writeFileSync(resolved, JSON.stringify(data, null, 2) + '\n', 'utf8');
+}
+
+module.exports = {
+  VALID_KINDS,
+  defaultManifest,
+  readManifest,
+  writeManifest,
+};

package/src/resolve.js

@@ -0,0 +1,148 @@
+'use strict';
+
+/**
+ * Compares two version strings of the form "major.minor.patch.build".
+ * Each missing component is treated as 0.
+ *
+ * @param {string} a - First version string.
+ * @param {string} b - Second version string.
+ * @returns {-1|0|1} -1 if a < b, 0 if equal, 1 if a > b.
+ */
+function compareVersions(a, b) {
+  const parsePart = (s) => s.split('.').map((n) => parseInt(n, 10) || 0);
+  const pa = parsePart(a);
+  const pb = parsePart(b);
+  const len = Math.max(pa.length, pb.length);
+  for (let i = 0; i < len; i++) {
+    const na = pa[i] !== undefined ? pa[i] : 0;
+    const nb = pb[i] !== undefined ? pb[i] : 0;
+    if (na < nb) return -1;
+    if (na > nb) return 1;
+  }
+  return 0;
+}
+
+/**
+ * Fetches razer.json for a single package from the first source that responds.
+ *
+ * @param {string} name
+ * @param {string} version
+ * @param {string[]} packageSources
+ * @param {string} platform
+ * @param {Function} httpClient
+ * @param {Map<string, object>} cache - In-flight / completed fetch cache.
+ * @returns {Promise<object|null>} Parsed razer.json or null if not found anywhere.
+ */
+async function fetchPackageManifest(name, version, packageSources, platform, httpClient, cache) {
+  const cacheKey = `${name}@${version}`;
+  if (cache.has(cacheKey)) {
+    return cache.get(cacheKey);
+  }
+
+  for (const source of packageSources) {
+    const base = source.replace(/\/$/, '');
+    const candidates = [
+      `${base}/${platform}/${name}/${version}/wyvrn.json`,
+      `${base}/${platform}/${name}/${version}/razer.json`,
+    ];
+    for (const url of candidates) {
+      try {
+        const response = await httpClient(url);
+        if (!response.ok) continue;
+        const data = await response.json();
+        cache.set(cacheKey, data);
+        return data;
+      } catch {
+        // Try next candidate.
+      }
+    }
+  }
+
+  console.warn(`[wyvrn] Warning: could not fetch manifest for ${name}@${version} from any source`);
+  cache.set(cacheKey, null);
+  return null;
+}
+
+/**
+ * Resolves the full, flattened dependency graph starting from rootDeps.
+ * When the same package is required at multiple versions the highest version wins.
+ *
+ * @param {Record<string, string>} rootDeps - Direct dependencies { name: version }.
+ * @param {string[]} packageSources - Ordered list of base URLs to try.
+ * @param {string} platform - Target platform string (e.g. "win_x64").
+ * @param {Function} httpClient - fetch-compatible function.
+ * @returns {Promise<Map<string, string>>} Resolved map of name -> version.
+ */
+async function resolveDependencies(rootDeps, packageSources, platform, httpClient, lockedVersions = new Map()) {
+  /** @type {Map<string, string>} Final resolved versions. */
+  const resolved = new Map();
+
+  /** @type {Map<string, object|null>} Manifest cache to avoid duplicate fetches. */
+  const manifestCache = new Map();
+
+  /**
+   * Pending work queue: each entry is { name, version }.
+   * We process iteratively to avoid deep recursion on large dependency trees.
+   */
+  const queue = Object.entries(rootDeps).map(([name, version]) => ({ name, version }));
+
+  while (queue.length > 0) {
+    let { name, version } = queue.shift();
+
+    // Lock file always wins — use pinned version regardless of what was requested.
+    if (lockedVersions.has(name)) {
+      version = lockedVersions.get(name);
+    }
+
+    if (resolved.has(name)) {
+      const existing = resolved.get(name);
+      if (existing === version) {
+        continue;
+      }
+      // Locked packages never lose to a conflict.
+      if (lockedVersions.has(name)) {
+        continue;
+      }
+      // Conflict: keep the latest version.
+      const winner = compareVersions(version, existing) > 0 ? version : existing;
+      if (winner !== existing) {
+        console.warn(
+          `[wyvrn] Version conflict for "${name}": ${existing} vs ${version} — using ${winner}`,
+        );
+        resolved.set(name, winner);
+        // Re-fetch the winning version's manifest to pull in its transitive deps.
+        queue.push({ name, version: winner });
+      }
+      continue;
+    }
+
+    resolved.set(name, version);
+
+    const manifest = await fetchPackageManifest(
+      name,
+      version,
+      packageSources,
+      platform,
+      httpClient,
+      manifestCache,
+    );
+    if (!manifest) {
+      continue;
+    }
+
+    // razer.json uses PascalCase: { Dependencies: [ { Name, Version }, ... ] }
+    const deps = Array.isArray(manifest.Dependencies) ? manifest.Dependencies : [];
+    for (const dep of deps) {
+      if (dep.Name && dep.Version) {
+        queue.push({ name: dep.Name, version: dep.Version });
+      }
+    }
+  }
+
+  return resolved;
+}
+
+module.exports = {
+  compareVersions,
+  resolveDependencies,
+};