-
Identify the consumer(s) and the new dep slug. The consumer is the lib whose <slug>/src/ now references the dep's classes (namespace SugarCraft\<Sub>\). If the dep is a NEW transitive dep introduced deep in the graph (e.g. candy-forms newly required by sugar-bits), the consumers are ALL libs that transitively require sugar-bits, not just sugar-bits. Verify: grep -rl '"sugarcraft/<consumer>"' */composer.json lists every lib that will need the closure update. Confirm the dep dir exists (ls <dep>/composer.json) before proceeding.
-
Add the require entry to the direct consumer's <slug>/composer.json. Insert into the "require": { ... } block, keeping keys grouped with the other sugarcraft/* lines (they are conventionally listed after "php": "^8.3"). Use the same constraint form the sibling deps in that file already use ("dev-master" or "@dev"):
"require": {
"php": "^8.3",
"sugarcraft/candy-core": "dev-master",
"sugarcraft/<dep>": "dev-master"
},
If the dep is a test-only harness (candy-testing), put it in require-dev instead — it still needs a path-repo. Verify the JSON still parses: php -r 'json_decode(file_get_contents("<slug>/composer.json"),true,512,JSON_THROW_ON_ERROR);' (uses the file from this step).
-
Run the closure fixer to insert ALL missing path-repos. From the monorepo root:
php tools/check-path-repos.php --fix
This walks the full transitive sugarcraft/* require graph for every lib and appends any missing { "type": "path", "url": "../<dep>", "options": { "symlink": true } } entry to each affected repositories[]. It re-encodes with JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES. It prints check-path-repos: all N issues fixed on success. This step depends on Step 2's require edit — the fixer only inserts repos for deps that are actually required.
-
Verify closure is clean (read-only pass). Re-run WITHOUT --fix:
php tools/check-path-repos.php
Must print check-path-repos: closure clean and exit 0. Any missing path-repo for <x> (required transitively via <path>) line means the graph is still broken — re-run Step 3. Do not proceed until this is clean.
-
Install and test the affected lib(s) to prove the symlinks resolve. composer.lock/vendor/ go stale per-lib, so update before trusting a failure:
cd <slug> && composer update --quiet && vendor/bin/phpunit
Green tests confirm the path-repo symlinks resolved the new dep. If a downstream consumer (from Step 1's grep) also gained transitive entries, repeat this install+test for each.
-
Update the root composer.json only if you added a brand-new lib (not for wiring an existing dep into an existing consumer). Existing-dep wiring touches only the consumer manifests. Skip this step otherwise.
