nab-python 0.0.7__py3-none-any.whl → 0.0.9__py3-none-any.whl

nab_python/_build/env.py

@@ -12,7 +12,7 @@
   resolved wheels into a temp directory.
 * :func:`installer.install` writes each wheel into the venv via
   ``installer.SchemeDictionaryDestination``, configured from the
-  venv's own ``sysconfig.get_paths()``.
+  venv's own scheme paths.
 
 The env is a context manager.  Entering it builds the venv and
 installs the requirements; exiting removes the temp tree.  The
@@ -40,6 +40,7 @@ from nab_index.urllib3_async_transport import Urllib3AsyncTransport
 from .._vcs_admission import UnsupportedVcsError
 from ..config import NabProjectConfig
 from ..download import download_lock
+from ..requirements_file import InvalidProjectRequirementError
 
 if TYPE_CHECKING:
     from collections.abc import Callable, Mapping
@@ -82,6 +83,15 @@ _LAUNCHER_KIND = (
     else "posix"
 )
 
+_SCHEME_PROBE = (
+    "import json, sys, sysconfig;"
+    "print(json.dumps({"
+    "'paths': sysconfig.get_paths(),"
+    "'prefix': sys.prefix,"
+    "'py_version': '%d.%d' % sys.version_info[:2],"
+    "}))"
+)
+
 
 class BuildEnvError(Exception):
     """The build env could not be set up (resolve, download, or install)."""
@@ -103,6 +113,12 @@ class NabBuildEnv:
     marker overlay) before the inner resolve so the build env is
     computed against PyPI alone.
 
+    The venv is created from the host interpreter and the PEP 517
+    hooks run in it, so the build requirements resolve for the host
+    and not for any ``--python`` retarget: a wheel for another
+    Python's ABI would not import, and a build requirement the host
+    needs would be dropped by its marker.
+
     Construction is cheap; the work happens in ``__enter__``.
     """
 
@@ -111,13 +127,11 @@ class NabBuildEnv:
         requires: list[str],
         *,
         config: NabProjectConfig,
-        python_version: str | None = None,
         transport_factory: Callable[[], AsyncHttpTransport] = Urllib3AsyncTransport,
     ) -> None:
         """Capture inputs; the venv and inner resolve happen in __enter__."""
         self._requires = list(requires)
         self._config = config
-        self._python_version = python_version
         self._transport_factory = transport_factory
 
         self._tmpdir: tempfile.TemporaryDirectory[str] | None = None
@@ -151,21 +165,27 @@ class NabBuildEnv:
         self._python_executable = _venv_python(self._venv_path)
         self._scripts_dir = self._python_executable.parent
 
-        scheme_dict = _venv_scheme_paths(self._python_executable)
+        scheme_paths = _venv_scheme_paths(self._python_executable)
 
         if not self._requires:
             return
-        wheel_paths = self._resolve_and_download(wheel_dir)
-        destination = _FastSchemeDictionaryDestination(
-            scheme_dict=scheme_dict,
-            interpreter=str(self._python_executable),
-            script_kind=_LAUNCHER_KIND,
-            bytecode_optimization_levels=(),
-            overwrite_existing=True,
-        )
+
+        self._install_wheels(self._resolve_and_download(wheel_dir), scheme_paths)
+
+    def _install_wheels(
+        self, wheel_paths: list[Path], scheme_paths: dict[str, str]
+    ) -> None:
+        """Write each wheel into the venv with ``installer``."""
         for wheel_path in wheel_paths:
             logger.debug("installing %s", wheel_path.name)
             with WheelFile.open(wheel_path) as source:
+                destination = _FastSchemeDictionaryDestination(
+                    scheme_dict=_dist_scheme_paths(scheme_paths, source.distribution),
+                    interpreter=str(self._python_executable),
+                    script_kind=_LAUNCHER_KIND,
+                    bytecode_optimization_levels=(),
+                    overwrite_existing=True,
+                )
                 installer_install(
                     source=source,
                     destination=destination,
@@ -224,21 +244,7 @@ class NabBuildEnv:
         sub = wheel_dir / f"_extra_{len(list(wheel_dir.iterdir()))}"
         sub.mkdir(parents=True, exist_ok=True)
         wheel_paths = self._resolve_and_download(sub, extra=requirements)
-        scheme_dict = _venv_scheme_paths(self._python_executable)
-        destination = SchemeDictionaryDestination(
-            scheme_dict=scheme_dict,
-            interpreter=str(self._python_executable),
-            script_kind=_LAUNCHER_KIND,
-            bytecode_optimization_levels=(),
-            overwrite_existing=True,
-        )
-        for wheel_path in wheel_paths:
-            with WheelFile.open(wheel_path) as source:
-                installer_install(
-                    source=source,
-                    destination=destination,
-                    additional_metadata={"INSTALLER": b"nab\n"},
-                )
+        self._install_wheels(wheel_paths, _venv_scheme_paths(self._python_executable))
 
     def _resolve_and_download(
         self,
@@ -249,7 +255,7 @@ class NabBuildEnv:
         """Resolve ``requires`` (+ ``extra``) and write wheels under ``wheel_dir``.
 
         The inner resolve runs against a synthetic pyproject so it
-        can reuse :func:`nab_python.resolve.resolve_pyproject` and
+        can reuse :func:`nab_python.resolve.resolve_for_targets` and
         :func:`nab_python.download.download_lock` end-to-end.  No
         local sources / workspace / marker overlay; build deps
         come from the configured indexes only.
@@ -257,7 +263,7 @@ class NabBuildEnv:
         # Late import: avoids a cycle through ``resolve.py`` which
         # itself imports ``pypi.py`` which imports ``build_backend``
         # which imports this module.
-        from ..resolve import resolve_pyproject
+        from ..resolve import build_lock_input, resolve_for_targets
 
         requires = list(self._requires)
         if extra:
@@ -279,27 +285,40 @@ class NabBuildEnv:
         # build a fresh transport each time.
         transport = self._transport_factory()
         try:
-            result = resolve_pyproject(
+            result = resolve_for_targets(
                 synthetic,
                 transport,
                 config=inner_config,
-                python_version=self._python_version,
             )
-        except (UnsupportedVcsError, NotImplementedError) as exc:
-            # A direct-URL/VCS build requirement means nab cannot build this
-            # sdist. Report it as a build-env failure so the outer resolve
-            # skips the version instead of aborting on the raw error.
+            # The build env resolves for the host alone, so its one
+            # target's failure is the whole resolve's.
+            result.raise_for_failure()
+        except (
+            UnsupportedVcsError,
+            NotImplementedError,
+            InvalidProjectRequirementError,
+        ) as exc:
+            # A build requirement nab cannot resolve: a direct-URL/VCS pin, or
+            # a string that is not valid PEP 508. Wrap it so the outer resolve
+            # skips this sdist rather than aborting on the raw error.
             msg = f"build env resolve failed: {exc}"
             raise BuildEnvError(msg) from exc
 
+        lock_input = build_lock_input(result, config=inner_config)
+
         # Reject sdist-only pins early: build deps that ship only an
         # sdist trigger a recursive backend invocation that this
         # builder does not handle.  Most build tools (hatchling,
         # setuptools, flit, pdm-backend) publish wheels.
         from ..lockfile import IndexPin
 
+        pins = {
+            name: pin
+            for lock in lock_input.targets.values()
+            for name, pin in lock.pins.items()
+        }
         sdist_only: list[str] = []
-        for canonical, pin in result.lock_input.pins.items():
+        for canonical, pin in pins.items():
             if isinstance(pin, IndexPin) and not pin.wheels:
                 sdist_only.append(f"{canonical}=={pin.version}")
         if sdist_only:
@@ -310,7 +329,7 @@ class NabBuildEnv:
             )
             raise BuildEnvError(msg)
 
-        download_result = download_lock(result.lock_input, transport, wheel_dir)
+        download_result = download_lock(lock_input, transport, wheel_dir)
         # Both wheels and sdists are downloaded; only wheels feed
         # ``installer.install``.  The sdists are inert clutter under
         # the temp dir, cleaned up with the env.
@@ -326,24 +345,39 @@ def _venv_python(venv_path: Path) -> Path:
 
 
 def _venv_scheme_paths(python_executable: Path) -> dict[str, str]:
-    """Ask the venv's interpreter for its own ``sysconfig.get_paths()``.
+    """Ask the venv's interpreter for the scheme paths ``installer`` writes to.
 
     Subprocessing the venv guarantees the returned paths reflect the
     venv's layout (``site-packages`` under the venv root, scripts in
     its ``bin``/``Scripts`` dir, etc.) regardless of how nab itself
     was installed.  One subprocess per env construction; negligible.
+
+    ``sysconfig`` has no ``headers`` scheme, and its ``include`` names
+    the base interpreter rather than the venv, so the header root comes
+    from the venv's own prefix instead.
     """
     result = subprocess.run(  # noqa: S603 - controlled command, no shell
-        [
-            str(python_executable),
-            "-c",
-            "import json, sysconfig; print(json.dumps(sysconfig.get_paths()))",
-        ],
+        [str(python_executable), "-c", _SCHEME_PROBE],
         capture_output=True,
         text=True,
         check=True,
     )
-    return dict(json.loads(result.stdout))
+    probe = json.loads(result.stdout)
+
+    paths: dict[str, str] = dict(probe["paths"])
+    paths["headers"] = str(
+        Path(probe["prefix"], "include", "site", f"python{probe['py_version']}")
+    )
+    return paths
+
+
+def _dist_scheme_paths(
+    scheme_paths: dict[str, str], distribution: str
+) -> dict[str, str]:
+    """Scheme paths for one wheel; its headers go in a directory of its own."""
+    paths = dict(scheme_paths)
+    paths["headers"] = str(Path(paths["headers"], distribution))
+    return paths
 
 
 def _supports_symlinks() -> bool:
@@ -371,6 +405,20 @@ def _render_synthetic_pyproject(requires: list[str]) -> str:
 
 
 def _toml_str(value: str) -> str:
-    """Single-line TOML string literal escape."""
-    escaped = value.replace("\\", "\\\\").replace('"', '\\"')
-    return f'"{escaped}"'
+    """Escape a string as a single-line TOML basic-string literal.
+
+    Backslash, double-quote, and the control characters TOML forbids bare in a
+    basic string (below U+0020, plus U+007F) are escaped, so a requirement
+    carrying a newline stays valid TOML instead of splitting across a line.
+    """
+    out: list[str] = []
+    for ch in value:
+        if ch == "\\":
+            out.append("\\\\")
+        elif ch == '"':
+            out.append('\\"')
+        elif ch < "\x20" or ch == "\x7f":
+            out.append(f"\\u{ord(ch):04x}")
+        else:
+            out.append(ch)
+    return '"' + "".join(out) + '"'

nab_python/_build/runner.py

@@ -62,7 +62,6 @@ def run_build_backend(
     source_dir: Path,
     *,
     config: NabProjectConfig,
-    python_version: str | None = None,
 ) -> WheelMetadata:
     """Extract wheel metadata for ``source_dir`` via the build backend.
 
@@ -80,7 +79,7 @@ def run_build_backend(
     if pyproject.is_file():
         try:
             data = tomli.loads(pyproject.read_text(encoding="utf-8"))
-        except (OSError, tomli.TOMLDecodeError) as exc:
+        except (OSError, UnicodeDecodeError, tomli.TOMLDecodeError) as exc:
             msg = f"could not read pyproject.toml at {source_dir}: {exc}"
             raise BuildBackendError(msg) from exc
     elif (source_dir / "setup.py").is_file():
@@ -97,11 +96,7 @@ def run_build_backend(
     skip_prepare = _should_skip_prepare(backend, data)
 
     try:
-        with NabBuildEnv(
-            requires=list(requires),
-            config=config,
-            python_version=python_version,
-        ) as env:
+        with NabBuildEnv(requires=list(requires), config=config) as env:
             project = build.ProjectBuilder.from_isolated_env(
                 env,
                 source_dir=str(source_dir),
@@ -120,7 +115,11 @@ def run_build_backend(
                 else:
                     metadata_dir = Path(project.metadata_path(output_dir))
                 return _parse_metadata(metadata_dir / "METADATA")
-    except build.BuildBackendException as exc:
+    except (
+        build.BuildException,
+        build.BuildBackendException,
+        build.FailedProcessError,
+    ) as exc:
         msg = f"build backend {backend!r} failed: {exc}"
         raise BuildBackendError(msg) from exc
     except (BuildEnvError, ResolutionError) as exc:

nab_python/_conflict_kind.py

@@ -1,7 +1,7 @@
 """Conflict-kind constants and PEP 508 marker-variable mapping.
 
-A leaf module that :mod:`nab_python.config`, :mod:`nab_python.universal.matrix`,
-and :mod:`nab_python._lockfile.disjointness` can import without forming a
+A leaf module that :mod:`nab_python.config`, :mod:`nab_python.target`, and
+:mod:`nab_python._lockfile.disjointness` can import without forming a
 cycle.  :class:`nab_python.config.ConflictKind` takes its enum values from
 ``KIND_EXTRA`` / ``KIND_GROUP`` so a rename here flows to every consumer.
 """

nab_python/_iso8601.py

@@ -0,0 +1,34 @@
+"""Shared parsing for the ISO 8601 timestamps that indexes and pylock files carry."""
+
+from __future__ import annotations
+
+import re
+from datetime import datetime
+
+_FRACTIONAL_SECONDS = re.compile(r"\.(\d+)")
+
+
+def parse_iso_datetime(raw: str) -> datetime:
+    """Parse an ISO 8601 datetime, raising ``ValueError`` when it cannot be read.
+
+    The offset in ``raw`` is preserved, and the result is naive when there is
+    none, so each caller decides what a missing offset means.
+    """
+    return datetime.fromisoformat(_to_isoformat(raw))
+
+
+def _to_isoformat(raw: str) -> str:
+    """Rewrite ``raw`` into the shape ``datetime.isoformat`` emits.
+
+    Before Python 3.11, ``datetime.fromisoformat`` parses only that shape: an
+    explicit ``+HH:MM`` offset rather than ``Z``, and a fraction of exactly 3 or
+    6 digits. PEP 700 serves ``Z`` and permits 0 through 6, so those are the two
+    parts normalized here; the rest is left for ``fromisoformat`` to judge.
+    """
+    iso = f"{raw[:-1]}+00:00" if raw.endswith("Z") else raw
+    return _FRACTIONAL_SECONDS.sub(_microseconds, iso)
+
+
+def _microseconds(match: re.Match[str]) -> str:
+    # A datetime holds microseconds, so digits past the sixth are dropped.
+    return "." + match.group(1)[:6].ljust(6, "0")

nab_python/_lockfile/builder.py

@@ -19,6 +19,7 @@ import tomli
 
 from nab_index.client import SdistFile, WheelFile
 
+from .._iso8601 import parse_iso_datetime
 from .._toml import tool_nab_section
 from .._vendor.packaging.pylock import Pylock, PylockValidationError
 from .._vendor.packaging.specifiers import InvalidSpecifier, SpecifierSet
@@ -36,17 +37,19 @@ if TYPE_CHECKING:
         LockInput,
         PinShape,
         SdistArtifact,
+        TargetLock,
         VcsPin,
         WheelArtifact,
     )
     from ..provider import ArchiveSource, DistPolicy, LocalSource, VcsSource
+    from ..target import ResolveTarget
 
 
 __all__ = [
     "MissingHashError",
     "MissingSdistError",
     "MissingVcsCommitError",
-    "build_lock_input_from_provider",
+    "build_target_lock",
     "read_lockfile_anchor",
     "read_lockfile_packages",
     "require_artifact_hashes",
@@ -74,7 +77,7 @@ class LockInputProvider(Protocol):
     """Structural protocol for the provider slice the builder reads.
 
     Mirrors the public surface :class:`~nab_python.provider.Provider`
-    exposes that :func:`build_lock_input_from_provider` consumes; tests
+    exposes that :func:`build_target_lock` consumes; tests
     may supply a stub without inheriting the full Provider class.
     """
 
@@ -178,17 +181,15 @@ def read_lockfile_anchor(path: Path) -> datetime | None:
     try:
         with path.open("rb") as f:
             data = tomli.load(f)
-    except (OSError, tomli.TOMLDecodeError):
+    except (OSError, UnicodeDecodeError, tomli.TOMLDecodeError):
         return None
     nab = tool_nab_section(data)
     raw = nab.get("created-at") if isinstance(nab, dict) else None
     if isinstance(raw, datetime):
         return raw if raw.tzinfo else raw.replace(tzinfo=timezone.utc)
     if isinstance(raw, str):
-        # Python 3.10's fromisoformat rejects a trailing 'Z'; 3.11+ accept it.
-        iso = raw[:-1] + "+00:00" if raw.endswith("Z") else raw
         try:
-            dt = datetime.fromisoformat(iso)
+            dt = parse_iso_datetime(raw)
         except ValueError:
             return None
         return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)
@@ -212,7 +213,7 @@ def read_lockfile_packages(path: Path) -> dict[str, Version] | None:
         with path.open("rb") as f:
             data = tomli.load(f)
         pylock = Pylock.from_dict(data)
-    except (OSError, tomli.TOMLDecodeError, PylockValidationError):
+    except (OSError, UnicodeDecodeError, tomli.TOMLDecodeError, PylockValidationError):
         return None
     return {
         str(pkg.name): pkg.version for pkg in pylock.packages if pkg.version is not None
@@ -239,37 +240,50 @@ def _strip_userinfo(url: str) -> str:
     return urlunsplit(parts._replace(netloc=host))
 
 
-def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a distinct lockfile field
+def build_target_lock(
     provider: LockInputProvider,
+    target: ResolveTarget,
     pins: Mapping[str, Version],
     *,
-    requires_python: str | None = None,
-    extras: Sequence[str] = (),
-    dependency_groups: Sequence[str] = (),
-    default_groups: Sequence[str] = (),
-    created_by: str = "nab",
     indexes: Sequence[IndexConfig] = (),
     resolved_keys: Iterable[str] = (),
-) -> LockInput:
-    """Build a :class:`LockInput` from a finished resolve.
+    base_roots: Iterable[str] | None = None,
+    selector_roots: Mapping[tuple[str, str], Iterable[str]] | None = None,
+) -> TargetLock:
+    """Build one target's :class:`~nab_python.lockfile.TargetLock`.
 
-    ``provider`` is the :class:`Provider` that drove the resolve;
-    its caches still hold the listings the resolver consumed.  ``pins``
-    is the canonical-name -> :class:`Version` mapping returned by the
-    resolver after extras keys have been stripped.
-
-    ``dependency_groups`` lists the PEP 735 groups whose requirements
-    were folded into this resolve; ``default_groups`` is the subset
-    that a default install (no ``--group`` flag) should apply.
+    ``provider`` is the :class:`Provider` that drove the resolve for
+    ``target``; its caches still hold the listings the resolver
+    consumed.  ``pins`` is the canonical-name -> :class:`Version`
+    mapping returned by the resolver after extras keys have been
+    stripped.
 
     ``resolved_keys`` is the full set of resolver result keys, including
     ``name[extra]`` proxies; it is read to find which extras activated
     so their edges join the forward dependency graph.
 
-    All wheels and the sdist for each pinned version are recorded so
-    the lockfile is portable across architectures of the same Python.
+    ``base_roots`` and ``selector_roots`` are the resolver keys each
+    install context requires directly: the project's own dependencies,
+    and those of each selected extra and each selected group, keyed by
+    its ``(kind, name)`` member.  :func:`_membership_gates` walks the
+    resolve from them to find the packages only a selection reaches.  An
+    empty ``base_roots`` is a project with no dependencies of its own, so
+    it does not stand in for ``None``: omitting it while passing selector
+    roots raises.
+
+    Every wheel the target can install, plus the sdist, is recorded for
+    each pinned version.
     """
-    from ..lockfile import LocalPin, LockInput
+    from ..lockfile import LocalPin, TargetLock
+
+    if base_roots is None:
+        if selector_roots:
+            msg = (
+                "selector_roots need base_roots:"
+                " without them every package looks selector-only"
+            )
+            raise ValueError(msg)
+        base_roots = ()
 
     lock_pins: dict[str, PinShape] = {}
     for raw_name, version in pins.items():
@@ -302,30 +316,113 @@ def build_lock_input_from_provider(  # noqa: PLR0913 - each flag maps to a disti
         lock_pins[canonical] = _index_pin_from_listing(
             provider, canonical, version, indexes
         )
-    return LockInput(
+
+    dependencies, base_dependencies = _forward_dependency_graph(
+        provider, pins, resolved_keys
+    )
+    return TargetLock(
+        target=target,
         pins=lock_pins,
-        requires_python=requires_python,
-        created_by=created_by,
-        extras=tuple(extras),
-        dependency_groups=tuple(dependency_groups),
-        default_groups=tuple(default_groups),
-        dependencies=_forward_dependency_graph(provider, pins, resolved_keys),
+        dependencies=dependencies,
+        base_dependencies=base_dependencies,
+        package_gates=_membership_gates(
+            provider,
+            pins,
+            base_roots=base_roots,
+            selector_roots=selector_roots or {},
+        ),
     )
 
 
+def _membership_gates(
+    provider: LockInputProvider,
+    pins: Mapping[str, Version],
+    *,
+    base_roots: Iterable[str],
+    selector_roots: Mapping[tuple[str, str], Iterable[str]],
+) -> dict[str, tuple[tuple[str, str], ...]]:
+    """Name the selections that gate each package no base dependency reaches.
+
+    A selected extra or group is folded into the resolve that produces
+    the lock, so its requirements pin packages a default install must not
+    receive.  PEP 751 defaults an install to no extras and to
+    ``default-groups``, and decides per package from ``packages.marker``,
+    so a package only a selection reaches has to name every selection
+    that reaches it; the writer turns each ``(kind, name)`` member into
+    ``'name' in extras`` / ``'name' in dependency_groups``.  A package
+    the project's own dependencies reach is unconditional.
+
+    Reachability is over this target's resolved graph, so an extras proxy
+    (an extra requiring ``pkg[fancy]`` while the project requires plain
+    ``pkg``) gates what ``fancy`` adds without gating ``pkg``.
+    """
+    if not selector_roots:
+        return {}
+
+    pinned = {canonicalize_name(name): version for name, version in pins.items()}
+    base_reachable = _reachable_names(provider, pinned, base_roots)
+
+    gates: defaultdict[str, list[tuple[str, str]]] = defaultdict(list)
+    for member in sorted(selector_roots):
+        gated = _reachable_names(provider, pinned, selector_roots[member])
+        for name in gated - base_reachable:
+            gates[name].append(member)
+    return {name: tuple(members) for name, members in gates.items()}
+
+
+def _reachable_names(
+    provider: LockInputProvider,
+    pinned: Mapping[str, Version],
+    roots: Iterable[str],
+) -> set[str]:
+    """Return the pinned names reachable from ``roots`` at their pinned versions.
+
+    The walk is over resolver keys, so a ``name[extra]`` root pulls in
+    that extra's dependencies on top of the package's own.
+    """
+    from ..provider import split_extra
+
+    reached: set[str] = set()
+    seen: set[str] = set()
+    stack = list(roots)
+
+    while stack:
+        key = stack.pop()
+        if key in seen:
+            continue
+        seen.add(key)
+
+        raw_name, extra = split_extra(key)
+        canonical = canonicalize_name(raw_name)
+        version = pinned.get(canonical)
+        if version is None:
+            continue
+        reached.add(canonical)
+
+        cache_key = (canonical, version)
+        stack.extend(provider.deps_cache.get(cache_key, {}))
+        if extra is not None:
+            stack.extend(provider.extra_deps_map.get(cache_key, {}).get(extra, {}))
+
+    return reached
+
+
 def _forward_dependency_graph(
     provider: LockInputProvider,
     pins: Mapping[str, Version],
     resolved_keys: Iterable[str],
-) -> dict[str, tuple[str, ...]]:
+) -> tuple[dict[str, tuple[str, ...]], dict[str, tuple[str, ...]]]:
     """Build the forward dependency graph among the locked packages.
 
-    Each pinned package maps to the canonical names of its direct
-    dependencies that are themselves pinned.  Base dependencies come
-    from ``deps_cache``; an activated extra (a ``name[extra]`` key in
-    ``resolved_keys``) folds that extra's dependencies in too.  Names
-    not in ``pins`` are dropped so every edge points at a real
-    ``[[packages]]`` entry.
+    Returns ``(full, base)``.  ``full`` maps each pinned package to the
+    canonical names of its direct dependencies that are themselves
+    pinned; an activated extra (a ``name[extra]`` key in
+    ``resolved_keys``) folds that extra's dependencies in.  ``base`` is
+    the subset from each package's own metadata (``deps_cache``), before
+    any extra is folded in, so it holds only the edges that fire
+    regardless of which extra was activated.  Names not in ``pins`` are
+    dropped from both so every edge points at a real ``[[packages]]``
+    entry.
     """
     from ..provider import split_extra
 
@@ -337,26 +434,32 @@ def _forward_dependency_graph(
 
     pinned = {canonicalize_name(name) for name in pins}
     graph: dict[str, tuple[str, ...]] = {}
+    base_graph: dict[str, tuple[str, ...]] = {}
     for raw_name, version in pins.items():
         canonical = canonicalize_name(raw_name)
         cache_key = (canonical, version)
-        dep_names = {
+        base_deps = {
             canonicalize_name(split_extra(dep)[0])
             for dep in provider.deps_cache.get(cache_key, {})
         }
+        all_deps = set(base_deps)
         extra_map = provider.extra_deps_map.get(cache_key, {})
         for extra in activated_extras.get(canonical, ()):
-            dep_names.update(
+            all_deps.update(
                 canonicalize_name(split_extra(dep)[0])
                 for dep in extra_map.get(extra, {})
             )
-        dep_names &= pinned
+        base_deps &= pinned
+        all_deps &= pinned
         # An umbrella extra (pkg[all] pulling pkg[graphviz]) can name its own
         # package; drop it so pkg is never an edge to itself.
-        dep_names.discard(canonical)
-        if dep_names:
-            graph[canonical] = tuple(sorted(dep_names))
-    return graph
+        base_deps.discard(canonical)
+        all_deps.discard(canonical)
+        if all_deps:
+            graph[canonical] = tuple(sorted(all_deps))
+        if base_deps:
+            base_graph[canonical] = tuple(sorted(base_deps))
+    return graph, base_graph
 
 
 def _index_pin_from_listing(
@@ -478,7 +581,7 @@ def _parse_upload_time(raw: str | None) -> datetime | None:
     if raw is None:
         return None
     try:
-        parsed = datetime.fromisoformat(raw.replace("Z", "+00:00"))
+        parsed = parse_iso_datetime(raw)
     except ValueError:
         return None
     if parsed.tzinfo is None:
@@ -514,12 +617,8 @@ def require_artifact_hashes(lock_input: LockInput) -> None:
     """
     from ..lockfile import ACCEPTED_HASH_ALGORITHMS, IndexPin
 
-    pin_groups: Iterable[Mapping[str, PinShape]] = (
-        lock_input.pins,
-        *lock_input.per_tuple_pins.values(),
-    )
-    for pins in pin_groups:
-        for pin in pins.values():
+    for lock in lock_input.targets.values():
+        for pin in lock.pins.values():
             if not isinstance(pin, IndexPin):
                 continue
             artefacts = (*pin.wheels, *((pin.sdist,) if pin.sdist is not None else ()))