refactor(package): pass package handles by value throughout

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

17 files changed, 106 insertions, 118 deletions

diff --git a/crates/shirabe/src/dependency_resolver/default_policy.rs b/crates/shirabe/src/dependency_resolver/default_policy.rs
index 0c6b2fc..541ec44 100644
--- a/crates/shirabe/src/dependency_resolver/default_policy.rs
+++ b/crates/shirabe/src/dependency_resolver/default_policy.rs
@@ -44,8 +44,8 @@ impl DefaultPolicy {
     pub fn compare_by_priority(
         &self,
         pool: &Pool,
-        a: &BasePackageHandle,
-        b: &BasePackageHandle,
+        a: BasePackageHandle,
+        b: BasePackageHandle,
         required_package: Option<String>,
         ignore_replace: bool,
     ) -> i64 {
@@ -61,10 +61,10 @@ impl DefaultPolicy {
         }
 
         if !ignore_replace {
-            if self.replaces(a, b) {
+            if self.replaces(a.clone(), b.clone()) {
                 return 1;
             }
-            if self.replaces(b, a) {
+            if self.replaces(b.clone(), a.clone()) {
                 return -1;
             }
 
@@ -125,10 +125,10 @@ impl DefaultPolicy {
                 continue;
             }
             let package = pool.literal_to_package(literal);
-            if self.version_compare(&package, &best_package, operator) {
+            if self.version_compare(package.clone(), best_package.clone(), operator) {
                 best_package = package;
                 best_literals = vec![literal];
-            } else if self.version_compare(&package, &best_package, "==") {
+            } else if self.version_compare(package.clone(), best_package.clone(), "==") {
                 best_literals.push(literal);
             }
         }
@@ -164,7 +164,7 @@ impl DefaultPolicy {
         selected
     }
 
-    pub(crate) fn replaces(&self, source: &BasePackageHandle, target: &BasePackageHandle) -> bool {
+    pub(crate) fn replaces(&self, source: BasePackageHandle, target: BasePackageHandle) -> bool {
         for link in source.get_replaces().values() {
             if link.get_target() == target.get_name().as_str() {
                 return true;
@@ -175,12 +175,7 @@ impl DefaultPolicy {
 }
 
 impl PolicyInterface for DefaultPolicy {
-    fn version_compare(
-        &self,
-        a: &BasePackageHandle,
-        b: &BasePackageHandle,
-        operator: &str,
-    ) -> bool {
+    fn version_compare(&self, a: BasePackageHandle, b: BasePackageHandle, operator: &str) -> bool {
         if self.prefer_stable {
             let stab_a = a.get_stability().to_string();
             let stab_b = b.get_stability().to_string();
@@ -263,8 +258,8 @@ impl PolicyInterface for DefaultPolicy {
                 }
                 let result = self.compare_by_priority(
                     pool,
-                    &pool.literal_to_package(a),
-                    &pool.literal_to_package(b),
+                    pool.literal_to_package(a),
+                    pool.literal_to_package(b),
                     required_package.clone(),
                     true,
                 );
@@ -296,8 +291,8 @@ impl PolicyInterface for DefaultPolicy {
             }
             let result = self.compare_by_priority(
                 pool,
-                &pool.literal_to_package(a),
-                &pool.literal_to_package(b),
+                pool.literal_to_package(a),
+                pool.literal_to_package(b),
                 required_package.clone(),
                 false,
             );
diff --git a/crates/shirabe/src/dependency_resolver/lock_transaction.rs b/crates/shirabe/src/dependency_resolver/lock_transaction.rs
index 09d4571..dd3dd97 100644
--- a/crates/shirabe/src/dependency_resolver/lock_transaction.rs
+++ b/crates/shirabe/src/dependency_resolver/lock_transaction.rs
@@ -117,7 +117,7 @@ impl LockTransaction {
             }
 
             if update_mirrors && !self.present_map.contains_key(&package.ptr_id().to_string()) {
-                let updated = self.update_mirror_and_urls(package);
+                let updated = self.update_mirror_and_urls(package.clone());
                 packages.push(updated);
             } else {
                 packages.push(package.clone());
@@ -127,7 +127,7 @@ impl LockTransaction {
         packages
     }
 
-    fn update_mirror_and_urls(&self, package: &PackageInterfaceHandle) -> PackageInterfaceHandle {
+    fn update_mirror_and_urls(&self, package: PackageInterfaceHandle) -> PackageInterfaceHandle {
         for present_package in self.present_map.values() {
             if package.get_name() != present_package.get_name() {
                 continue;
diff --git a/crates/shirabe/src/dependency_resolver/operation/install_operation.rs b/crates/shirabe/src/dependency_resolver/operation/install_operation.rs
index 466c877..23be038 100644
--- a/crates/shirabe/src/dependency_resolver/operation/install_operation.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/install_operation.rs
@@ -15,11 +15,11 @@ impl InstallOperation {
         Self { package }
     }
 
-    pub fn get_package(&self) -> &PackageInterfaceHandle {
-        &self.package
+    pub fn get_package(&self) -> PackageInterfaceHandle {
+        self.package.clone()
     }
 
-    pub fn format(package: &dyn PackageInterface, lock: bool) -> String {
+    pub fn format(package: PackageInterfaceHandle, lock: bool) -> String {
         format!(
             "{}<info>{}</info> (<comment>{}</comment>)",
             if lock { "Locking " } else { "Installing " },
@@ -44,7 +44,7 @@ impl OperationInterface for InstallOperation {
     }
 
     fn show(&self, lock: bool) -> String {
-        Self::format(self.package.as_rc().borrow().as_package_interface(), lock)
+        Self::format(self.package.clone(), lock)
     }
 
     fn to_string(&self) -> String {
diff --git a/crates/shirabe/src/dependency_resolver/operation/mark_alias_installed_operation.rs b/crates/shirabe/src/dependency_resolver/operation/mark_alias_installed_operation.rs
index 339f86c..a10186a 100644
--- a/crates/shirabe/src/dependency_resolver/operation/mark_alias_installed_operation.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/mark_alias_installed_operation.rs
@@ -2,21 +2,21 @@
 
 use crate::dependency_resolver::operation::OperationInterface;
 use crate::dependency_resolver::operation::SolverOperation;
-use crate::package::AliasPackage;
+use crate::package::AliasPackageHandle;
 use crate::package::PackageInterface;
 
 #[derive(Debug)]
 pub struct MarkAliasInstalledOperation {
-    pub(crate) package: AliasPackage,
+    pub(crate) package: AliasPackageHandle,
 }
 
 impl MarkAliasInstalledOperation {
-    pub fn new(package: AliasPackage) -> Self {
+    pub fn new(package: AliasPackageHandle) -> Self {
         Self { package }
     }
 
-    pub fn get_package(&self) -> &AliasPackage {
-        &self.package
+    pub fn get_package(&self) -> AliasPackageHandle {
+        self.package.clone()
     }
 }
 
@@ -36,12 +36,9 @@ impl OperationInterface for MarkAliasInstalledOperation {
     fn show(&self, _lock: bool) -> String {
         format!(
             "Marking <info>{}</info> (<comment>{}</comment>) as installed, alias of <info>{}</info> (<comment>{}</comment>)",
-            PackageInterface::get_pretty_name(&self.package),
-            PackageInterface::get_full_pretty_version(
-                &self.package,
-                true,
-                <dyn PackageInterface>::DISPLAY_SOURCE_REF_IF_DEV,
-            ),
+            self.package.get_pretty_name(),
+            self.package
+                .get_full_pretty_version(true, <dyn PackageInterface>::DISPLAY_SOURCE_REF_IF_DEV),
             self.package.get_alias_of().get_pretty_name(),
             self.package
                 .get_alias_of()
diff --git a/crates/shirabe/src/dependency_resolver/operation/mark_alias_uninstalled_operation.rs b/crates/shirabe/src/dependency_resolver/operation/mark_alias_uninstalled_operation.rs
index a5b7b7d..b9ad26e 100644
--- a/crates/shirabe/src/dependency_resolver/operation/mark_alias_uninstalled_operation.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/mark_alias_uninstalled_operation.rs
@@ -2,21 +2,21 @@
 
 use crate::dependency_resolver::operation::OperationInterface;
 use crate::dependency_resolver::operation::SolverOperation;
-use crate::package::AliasPackage;
+use crate::package::AliasPackageHandle;
 use crate::package::PackageInterface;
 
 #[derive(Debug)]
 pub struct MarkAliasUninstalledOperation {
-    pub(crate) package: AliasPackage,
+    pub(crate) package: AliasPackageHandle,
 }
 
 impl MarkAliasUninstalledOperation {
-    pub fn new(package: AliasPackage) -> Self {
+    pub fn new(package: AliasPackageHandle) -> Self {
         Self { package }
     }
 
-    pub fn get_package(&self) -> &AliasPackage {
-        &self.package
+    pub fn get_package(&self) -> AliasPackageHandle {
+        self.package.clone()
     }
 }
 
@@ -36,12 +36,9 @@ impl OperationInterface for MarkAliasUninstalledOperation {
     fn show(&self, _lock: bool) -> String {
         format!(
             "Marking <info>{}</info> (<comment>{}</comment>) as uninstalled, alias of <info>{}</info> (<comment>{}</comment>)",
-            PackageInterface::get_pretty_name(&self.package),
-            PackageInterface::get_full_pretty_version(
-                &self.package,
-                true,
-                <dyn PackageInterface>::DISPLAY_SOURCE_REF_IF_DEV,
-            ),
+            self.package.get_pretty_name(),
+            self.package
+                .get_full_pretty_version(true, <dyn PackageInterface>::DISPLAY_SOURCE_REF_IF_DEV),
             self.package.get_alias_of().get_pretty_name(),
             self.package
                 .get_alias_of()
diff --git a/crates/shirabe/src/dependency_resolver/operation/operation_interface.rs b/crates/shirabe/src/dependency_resolver/operation/operation_interface.rs
index a5b5e5f..3c24ff4 100644
--- a/crates/shirabe/src/dependency_resolver/operation/operation_interface.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/operation_interface.rs
@@ -31,7 +31,7 @@ pub trait OperationInterface: std::fmt::Debug {
 
     /// PHP duck-typed accessor. Only InstallOperation/UninstallOperation/MarkAlias*Operation
     /// expose this; UpdateOperation has getInitialPackage()/getTargetPackage() instead.
-    fn get_package(&self) -> &dyn crate::package::PackageInterface {
+    fn get_package(&self) -> crate::package::PackageInterfaceHandle {
         todo!("get_package is not available on this operation type")
     }
 }
diff --git a/crates/shirabe/src/dependency_resolver/operation/uninstall_operation.rs b/crates/shirabe/src/dependency_resolver/operation/uninstall_operation.rs
index 2757146..3ff547c 100644
--- a/crates/shirabe/src/dependency_resolver/operation/uninstall_operation.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/uninstall_operation.rs
@@ -15,11 +15,11 @@ impl UninstallOperation {
         Self { package }
     }
 
-    pub fn get_package(&self) -> &PackageInterfaceHandle {
-        &self.package
+    pub fn get_package(&self) -> PackageInterfaceHandle {
+        self.package.clone()
     }
 
-    pub fn format(package: &dyn PackageInterface, _lock: bool) -> String {
+    pub fn format(package: PackageInterfaceHandle, _lock: bool) -> String {
         format!(
             "Removing <info>{}</info> (<comment>{}</comment>)",
             package.get_pretty_name(),
@@ -43,7 +43,7 @@ impl OperationInterface for UninstallOperation {
     }
 
     fn show(&self, lock: bool) -> String {
-        Self::format(self.package.as_rc().borrow().as_package_interface(), lock)
+        Self::format(self.package.clone(), lock)
     }
 
     fn to_string(&self) -> String {
diff --git a/crates/shirabe/src/dependency_resolver/operation/update_operation.rs b/crates/shirabe/src/dependency_resolver/operation/update_operation.rs
index 6881782..bc31256 100644
--- a/crates/shirabe/src/dependency_resolver/operation/update_operation.rs
+++ b/crates/shirabe/src/dependency_resolver/operation/update_operation.rs
@@ -20,17 +20,17 @@ impl UpdateOperation {
         }
     }
 
-    pub fn get_initial_package(&self) -> &PackageInterfaceHandle {
-        &self.initial_package
+    pub fn get_initial_package(&self) -> PackageInterfaceHandle {
+        self.initial_package.clone()
     }
 
-    pub fn get_target_package(&self) -> &PackageInterfaceHandle {
-        &self.target_package
+    pub fn get_target_package(&self) -> PackageInterfaceHandle {
+        self.target_package.clone()
     }
 
     pub fn format(
-        initial_package: &dyn PackageInterface,
-        target_package: &dyn PackageInterface,
+        initial_package: PackageInterfaceHandle,
+        target_package: PackageInterfaceHandle,
         lock: bool,
     ) -> String {
         let mut from_version = initial_package
@@ -90,8 +90,8 @@ impl OperationInterface for UpdateOperation {
 
     fn show(&self, lock: bool) -> String {
         Self::format(
-            self.initial_package.as_rc().borrow().as_package_interface(),
-            self.target_package.as_rc().borrow().as_package_interface(),
+            self.initial_package.clone(),
+            self.target_package.clone(),
             lock,
         )
     }
diff --git a/crates/shirabe/src/dependency_resolver/policy_interface.rs b/crates/shirabe/src/dependency_resolver/policy_interface.rs
index 002bfe9..0b37dc5 100644
--- a/crates/shirabe/src/dependency_resolver/policy_interface.rs
+++ b/crates/shirabe/src/dependency_resolver/policy_interface.rs
@@ -4,8 +4,7 @@ use crate::dependency_resolver::Pool;
 use crate::package::BasePackageHandle;
 
 pub trait PolicyInterface: std::fmt::Debug {
-    fn version_compare(&self, a: &BasePackageHandle, b: &BasePackageHandle, operator: &str)
-    -> bool;
+    fn version_compare(&self, a: BasePackageHandle, b: BasePackageHandle, operator: &str) -> bool;
 
     fn select_preferred_packages(
         &self,
diff --git a/crates/shirabe/src/dependency_resolver/pool.rs b/crates/shirabe/src/dependency_resolver/pool.rs
index 388f23f..ddb4df5 100644
--- a/crates/shirabe/src/dependency_resolver/pool.rs
+++ b/crates/shirabe/src/dependency_resolver/pool.rs
@@ -272,7 +272,7 @@ impl Pool {
         let mut matches: Vec<BasePackageHandle> = vec![];
 
         for candidate in candidates {
-            if self.r#match(candidate, name, constraint) {
+            if self.r#match(candidate.clone(), name, constraint) {
                 matches.push(candidate.clone());
             }
         }
@@ -313,7 +313,7 @@ impl Pool {
     /// @param  string              $name       Name of the package to be matched
     pub fn r#match(
         &self,
-        candidate: &BasePackageHandle,
+        candidate: BasePackageHandle,
         name: &str,
         constraint: Option<&AnyConstraint>,
     ) -> bool {
@@ -371,12 +371,12 @@ impl Pool {
         false
     }
 
-    pub fn is_unacceptable_fixed_or_locked_package(&self, package: &BasePackageHandle) -> bool {
+    pub fn is_unacceptable_fixed_or_locked_package(&self, package: BasePackageHandle) -> bool {
         // PHP: \in_array($package, $this->unacceptableFixedOrLockedPackages, true)
         // strict comparison checks reference identity for objects
         self.unacceptable_fixed_or_locked_packages
             .iter()
-            .any(|p| p.ptr_eq(package))
+            .any(|p| p.ptr_eq(&package))
     }
 
     /// @return BasePackage[]
diff --git a/crates/shirabe/src/dependency_resolver/pool_builder.rs b/crates/shirabe/src/dependency_resolver/pool_builder.rs
index 0efaac5..489b358 100644
--- a/crates/shirabe/src/dependency_resolver/pool_builder.rs
+++ b/crates/shirabe/src/dependency_resolver/pool_builder.rs
@@ -164,7 +164,7 @@ impl PoolBuilder {
             for locked_package in
                 CanonicalPackagesTrait::get_packages(request.get_locked_repository().unwrap())
             {
-                if !self.is_update_allowed(locked_package.as_rc().borrow().as_package_interface()) {
+                if !self.is_update_allowed(locked_package.clone()) {
                     // Path repo packages are never loaded from lock, to force them to always remain in sync
                     // unless symlinking is disabled in which case we probably should rather treat them like
                     // regular packages. We mark them specially so they can be reloaded fully including update propagation
@@ -221,7 +221,7 @@ impl PoolBuilder {
                     &package.get_stability(),
                 )
             {
-                self.load_package(request, &repositories, &package, false)?;
+                self.load_package(request, &repositories, package.clone(), false)?;
             } else {
                 self.unacceptable_fixed_or_locked_packages.push(package);
             }
@@ -578,7 +578,7 @@ impl PoolBuilder {
                     }
                     let _ = (pkg_name, pkg_version);
                     let propagate = !self.path_repo_unlocked.contains_key(&package.get_name());
-                    self.load_package(request, repositories, package, propagate)?;
+                    self.load_package(request, repositories, package.clone(), propagate)?;
                 }
             }
 
@@ -612,7 +612,7 @@ impl PoolBuilder {
         &mut self,
         request: &mut Request,
         repositories: &Vec<Box<dyn RepositoryInterface>>,
-        package: &BasePackageHandle,
+        package: BasePackageHandle,
         propagate_update: bool,
     ) -> anyhow::Result<()> {
         let index = self.index_counter;
@@ -805,10 +805,10 @@ impl PoolBuilder {
     }
 
     /// Checks whether the update allow list allows this package in the lock file to be updated
-    fn is_update_allowed(&self, package: &dyn PackageInterface) -> bool {
+    fn is_update_allowed(&self, package: PackageInterfaceHandle) -> bool {
         for pattern in &self.update_allow_list {
             let pattern_regexp = base_package::package_name_to_regexp(pattern);
-            if Preg::is_match3(&pattern_regexp, package.get_name(), None).unwrap_or(false) {
+            if Preg::is_match3(&pattern_regexp, &package.get_name(), None).unwrap_or(false) {
                 return true;
             }
         }
@@ -927,7 +927,7 @@ impl PoolBuilder {
                 .map(|(i, p)| (*i, p.clone()))
                 .collect();
             for (index, package) in &entries {
-                self.remove_loaded_package(request, repositories, package, *index);
+                self.remove_loaded_package(request, repositories, package.clone(), *index);
             }
         }
 
@@ -945,8 +945,13 @@ impl PoolBuilder {
                 // PHP uses array_search with strict identity; map to pointer comparison.
                 let index_opt = pkgs.iter().position(|p| p.ptr_eq(locked_package));
                 if let Some(index) = index_opt {
-                    request.unlock_package(locked_package);
-                    self.remove_loaded_package(request, repositories, locked_package, index as i64);
+                    request.unlock_package(locked_package.clone());
+                    self.remove_loaded_package(
+                        request,
+                        repositories,
+                        locked_package.clone(),
+                        index as i64,
+                    );
 
                     // make sure that any requirements for this package by other locked or fixed packages are now
                     // also loaded, as they were previously ignored because the locked (now unlocked) package already
@@ -1025,7 +1030,7 @@ impl PoolBuilder {
         &mut self,
         _request: &Request,
         repositories: &Vec<Box<dyn RepositoryInterface>>,
-        package: &BasePackageHandle,
+        package: BasePackageHandle,
         index: i64,
     ) {
         let repos_box: Vec<Box<dyn RepositoryInterface>> =
diff --git a/crates/shirabe/src/dependency_resolver/pool_optimizer.rs b/crates/shirabe/src/dependency_resolver/pool_optimizer.rs
index 8aa8324..18c8d01 100644
--- a/crates/shirabe/src/dependency_resolver/pool_optimizer.rs
+++ b/crates/shirabe/src/dependency_resolver/pool_optimizer.rs
@@ -162,18 +162,18 @@ impl PoolOptimizer {
                 SimpleConstraint::OP_EQ,
                 package.get_version().to_string(),
             ) {
-                self.mark_package_irremovable(package);
+                self.mark_package_irremovable(package.clone());
             }
         }
     }
 
-    fn mark_package_irremovable(&mut self, package: &BasePackageHandle) {
+    fn mark_package_irremovable(&mut self, package: BasePackageHandle) {
         self.irremovable_packages.insert(package.id(), true);
         if let Some(alias_pkg) = package.as_alias() {
             // recursing here so aliasesPerPackage for the aliasOf can be checked
             // and all its aliases marked as irremovable as well
             let aliased: BasePackageHandle = alias_pkg.get_alias_of().into();
-            self.mark_package_irremovable(&aliased);
+            self.mark_package_irremovable(aliased);
         }
         // PHP: foreach ($this->aliasesPerPackage[$package->id] as $aliasPackage)
         let alias_ids: Vec<i64> = self
@@ -238,7 +238,7 @@ impl PoolOptimizer {
 
             self.mark_package_for_removal(package.id())?;
 
-            let dependency_hash = self.calculate_dependency_hash(package);
+            let dependency_hash = self.calculate_dependency_hash(package.clone());
 
             for package_name in package.get_names(false) {
                 if !self
@@ -333,7 +333,7 @@ impl PoolOptimizer {
                     // Only one package in this constraint group has the same requirements, we're not allowed to remove that package
                     if 1 == packages.len() {
                         self.keep_package(
-                            &packages[0],
+                            packages[0].clone(),
                             &identical_definitions_per_package,
                             &package_identical_definition_lookup,
                         );
@@ -353,7 +353,7 @@ impl PoolOptimizer {
                             .select_preferred_packages(pool, literals.clone(), None)
                     {
                         self.keep_package(
-                            &pool.literal_to_package(preferred_literal),
+                            pool.literal_to_package(preferred_literal),
                             &identical_definitions_per_package,
                             &package_identical_definition_lookup,
                         );
@@ -365,7 +365,7 @@ impl PoolOptimizer {
         Ok(())
     }
 
-    fn calculate_dependency_hash(&self, package: &BasePackageHandle) -> String {
+    fn calculate_dependency_hash(&self, package: BasePackageHandle) -> String {
         let mut hash = String::new();
 
         let hash_relevant_links: Vec<(&str, Vec<crate::package::Link>)> = vec![
@@ -438,7 +438,7 @@ impl PoolOptimizer {
     /// @param array<int, array<string, array{groupHash: string, dependencyHash: string}>> $packageIdenticalDefinitionLookup
     fn keep_package(
         &mut self,
-        package: &BasePackageHandle,
+        package: BasePackageHandle,
         identical_definitions_per_package: &IndexMap<
             String,
             IndexMap<String, IndexMap<String, Vec<BasePackageHandle>>>,
@@ -460,7 +460,7 @@ impl PoolOptimizer {
             // and all its aliases marked to be kept as well
             let aliased: BasePackageHandle = alias_pkg.get_alias_of().into();
             self.keep_package(
-                &aliased,
+                aliased,
                 identical_definitions_per_package,
                 package_identical_definition_lookup,
             );
@@ -572,7 +572,9 @@ impl PoolOptimizer {
                 continue;
             }
             // Do not remove locked packages
-            if request.is_fixed_package(&package) || request.is_locked_package(&package) {
+            if request.is_fixed_package(package.clone())
+                || request.is_locked_package(package.clone())
+            {
                 continue;
             }
 
diff --git a/crates/shirabe/src/dependency_resolver/problem.rs b/crates/shirabe/src/dependency_resolver/problem.rs
index 509a0dc..58d47f1 100644
--- a/crates/shirabe/src/dependency_resolver/problem.rs
+++ b/crates/shirabe/src/dependency_resolver/problem.rs
@@ -156,9 +156,7 @@ impl Problem {
                 // TODO(phase-b): reason_data is a Link.
                 let source = rule.get_source_package(pool).unwrap();
                 let link_pretty = match rule.get_reason_data() {
-                    rule::ReasonData::Link(link) => {
-                        link.get_pretty_string(source.as_rc().borrow().as_package_interface())
-                    }
+                    rule::ReasonData::Link(link) => link.get_pretty_string(source.clone()),
                     _ => String::new(),
                 };
                 format!("{}//{}", source.get_pretty_string(), link_pretty)
@@ -558,9 +556,7 @@ impl Problem {
         for (_key, package) in request.get_locked_packages() {
             if package.get_name().as_str() == package_name {
                 locked_package = Some(package.clone());
-                // TODO(phase-c): wire Pool::is_unacceptable_fixed_or_locked_package(package) here;
-                // the locked package handle and the pool's identity check are now both handle-based.
-                if todo!("is_unacceptable_fixed_or_locked_package with a request package handle") {
+                if pool.is_unacceptable_fixed_or_locked_package(package.clone()) {
                     return (
                         "- ".to_string(),
                         format!(
@@ -807,9 +803,9 @@ impl Problem {
             }
 
             if pool.is_security_removed_package_version(package_name, constraint) {
-                // TODO(phase-b): get_matching_security_advisories needs Vec<Box<dyn PackageInterface>>
+                // TODO(phase-b): get_matching_security_advisories needs Vec<PackageInterfaceHandle>
                 // and SecurityAdvisory.inner.advisory_id is on the private inner field.
-                // Convert packages to PackageInterface boxes and adjust SecurityAdvisory accessor first.
+                // Convert packages to PackageInterfaceHandle and adjust SecurityAdvisory accessor first.
                 let _ = repository_set;
                 let advisories_list: Vec<String> = pool
                     .get_security_advisory_identifiers_for_package_version(package_name, constraint)
diff --git a/crates/shirabe/src/dependency_resolver/request.rs b/crates/shirabe/src/dependency_resolver/request.rs
index 686373b..0621775 100644
--- a/crates/shirabe/src/dependency_resolver/request.rs
+++ b/crates/shirabe/src/dependency_resolver/request.rs
@@ -125,7 +125,7 @@ impl Request {
         self.fixed_locked_packages.insert(hash, package);
     }
 
-    pub fn unlock_package(&mut self, package: &BasePackageHandle) {
+    pub fn unlock_package(&mut self, package: BasePackageHandle) {
         self.locked_packages.remove(&package.ptr_id().to_string());
     }
 
@@ -161,7 +161,7 @@ impl Request {
         &self.fixed_packages
     }
 
-    pub fn is_fixed_package(&self, package: &BasePackageHandle) -> bool {
+    pub fn is_fixed_package(&self, package: BasePackageHandle) -> bool {
         self.fixed_packages
             .contains_key(&package.ptr_id().to_string())
     }
@@ -170,7 +170,7 @@ impl Request {
         &self.locked_packages
     }
 
-    pub fn is_locked_package(&self, package: &BasePackageHandle) -> bool {
+    pub fn is_locked_package(&self, package: BasePackageHandle) -> bool {
         let hash = package.ptr_id().to_string();
         self.locked_packages.contains_key(&hash) || self.fixed_locked_packages.contains_key(&hash)
     }
diff --git a/crates/shirabe/src/dependency_resolver/rule.rs b/crates/shirabe/src/dependency_resolver/rule.rs
index afb0318..1681509 100644
--- a/crates/shirabe/src/dependency_resolver/rule.rs
+++ b/crates/shirabe/src/dependency_resolver/rule.rs
@@ -234,9 +234,9 @@ impl Rule {
                 if let Some(_locked_repo) = locked_repo {
                     let packages: Vec<BasePackageHandle> = todo!("locked_repo.get_packages()");
                     for package in packages {
-                        let p: &BasePackageHandle = &package;
+                        let p = package.clone();
                         if p.get_name() == link.get_target() {
-                            if pool.is_unacceptable_fixed_or_locked_package(p) {
+                            if pool.is_unacceptable_fixed_or_locked_package(p.clone()) {
                                 return true;
                             }
                             if !link.get_constraint().matches(
@@ -250,8 +250,7 @@ impl Rule {
                                 return true;
                             }
                             // required package was locked but has been unlocked and still matches
-                            if !request.is_locked_package(todo!("package as &dyn PackageInterface"))
-                            {
+                            if !request.is_locked_package(p) {
                                 return true;
                             }
                             break;
@@ -275,9 +274,9 @@ impl Rule {
                 if let Some(_locked_repo) = locked_repo {
                     let packages: Vec<BasePackageHandle> = todo!("locked_repo.get_packages()");
                     for package in packages {
-                        let p: &BasePackageHandle = &package;
+                        let p = package.clone();
                         if p.get_name() == *package_name {
-                            if pool.is_unacceptable_fixed_or_locked_package(p) {
+                            if pool.is_unacceptable_fixed_or_locked_package(p.clone()) {
                                 return true;
                             }
                             if !constraint.matches(
@@ -378,8 +377,7 @@ impl Rule {
                     .collect();
                 if packages_non_alias.len() == 1 {
                     let package = &packages_non_alias[0];
-                    // TODO(phase-b): request.is_locked_package signature
-                    if request.is_locked_package(todo!("package as &dyn PackageInterface")) {
+                    if request.is_locked_package(package.clone()) {
                         return format!(
                             "{} is locked to version {} and an update of this package was not requested.",
                             package.get_pretty_name(),
@@ -409,7 +407,7 @@ impl Rule {
                 };
                 let package = self.deduplicate_default_branch_alias(package_in);
 
-                if request.is_locked_package(todo!("package as &dyn PackageInterface")) {
+                if request.is_locked_package(package.clone()) {
                     return format!(
                         "{} is locked to version {} and an update of this package was not requested.",
                         package.get_pretty_name(),
@@ -504,8 +502,7 @@ impl Rule {
                     requires.push(pool.literal_to_package(*literal));
                 }
 
-                let text =
-                    link.get_pretty_string(source_package.as_rc().borrow().as_package_interface());
+                let text = link.get_pretty_string(source_package.clone());
                 if requires.len() > 0 {
                     format!(
                         "{} -> satisfiable by {}.",
diff --git a/crates/shirabe/src/dependency_resolver/rule_set_generator.rs b/crates/shirabe/src/dependency_resolver/rule_set_generator.rs
index 69f5c4a..fece1e4 100644
--- a/crates/shirabe/src/dependency_resolver/rule_set_generator.rs
+++ b/crates/shirabe/src/dependency_resolver/rule_set_generator.rs
@@ -50,7 +50,7 @@ impl RuleSetGenerator {
     /// one requirement of the package A.
     fn create_require_rule(
         &self,
-        package: &PackageInterfaceHandle,
+        package: PackageInterfaceHandle,
         providers: &[PackageInterfaceHandle],
         reason: i64,
         reason_data: PhpMixed,
@@ -59,7 +59,7 @@ impl RuleSetGenerator {
 
         for provider in providers {
             // self fulfilling rule?
-            if provider.ptr_eq(package) {
+            if provider.ptr_eq(&package) {
                 return None;
             }
             literals.push(provider.get_id());
@@ -92,13 +92,13 @@ impl RuleSetGenerator {
     /// and B the provider.
     fn create_rule2_literals(
         &self,
-        issuer: &PackageInterfaceHandle,
-        provider: &PackageInterfaceHandle,
+        issuer: PackageInterfaceHandle,
+        provider: PackageInterfaceHandle,
         reason: i64,
         reason_data: PhpMixed,
     ) -> Option<Rule2Literals> {
         // ignore self conflict
-        if issuer.ptr_eq(provider) {
+        if issuer.ptr_eq(&provider) {
             return None;
         }
 
@@ -172,7 +172,7 @@ impl RuleSetGenerator {
                 let alias_of: PackageInterfaceHandle = alias_pkg.get_alias_of().into();
                 work_queue.push_back(alias_of.clone());
                 let rule = self.create_require_rule(
-                    &package,
+                    package.clone(),
                     &[alias_of.clone()],
                     rule::RULE_PACKAGE_ALIAS,
                     PhpMixed::Null, // reasonData: $package (BasePackage)
@@ -181,7 +181,7 @@ impl RuleSetGenerator {
 
                 // aliases must be installed with their main package, so create a rule the other way around as well
                 let inverse_rule = self.create_require_rule(
-                    &alias_of,
+                    alias_of.clone(),
                     &[package.clone()],
                     rule::RULE_PACKAGE_INVERSE_ALIAS,
                     PhpMixed::Null, // reasonData: $package->getAliasOf() (BasePackage)
@@ -218,7 +218,7 @@ impl RuleSetGenerator {
                     .collect();
 
                 let rule = self.create_require_rule(
-                    &package,
+                    package.clone(),
                     &possible_requires,
                     rule::RULE_PACKAGE_REQUIRES,
                     PhpMixed::Null, // reasonData: $link (Link)
@@ -274,8 +274,8 @@ impl RuleSetGenerator {
                     let conflict_name_matches = conflict.get_name() == link.get_target();
                     if !conflict_is_alias || conflict_name_matches {
                         let rule = self.create_rule2_literals(
-                            package,
-                            conflict,
+                            package.clone(),
+                            conflict.clone(),
                             rule::RULE_PACKAGE_CONFLICT,
                             PhpMixed::Null, // reasonData: $link (Link)
                         );
diff --git a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
index ba2cf09..785e758 100644
--- a/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
+++ b/crates/shirabe/src/dependency_resolver/security_advisory_pool_filter.rs
@@ -5,7 +5,7 @@ use crate::advisory::Auditor;
 use crate::advisory::PartialSecurityAdvisory;
 use crate::dependency_resolver::Pool;
 use crate::dependency_resolver::Request;
-use crate::package::PackageInterface;
+use crate::package::BasePackageHandle;
 use crate::repository::RepositoryInterface;
 use indexmap::IndexMap;
 use shirabe_semver::constraint::AnyConstraint;
@@ -51,7 +51,7 @@ impl SecurityAdvisoryPoolFilter {
     /// @return list<PartialSecurityAdvisory|SecurityAdvisory>
     fn get_matching_advisories(
         &self,
-        package: &dyn PackageInterface,
+        package: BasePackageHandle,
         advisory_map: &IndexMap<String, Vec<PartialSecurityAdvisory>>,
     ) -> Vec<PartialSecurityAdvisory> {
         if package.is_dev() {