refactor(repository): make read methods fallible and take &mut self

Change RepositoryInterface and WritableRepositoryInterface read methods
(find_package, find_packages, get_packages, load_packages, search,
get_providers, get_canonical_packages) to take &mut self and return
anyhow::Result, so lazy-loading repositories such as ComposerRepository
can perform fallible I/O and mutate internal state on access. Update all
implementors and call sites to propagate the Result and pass mutable
references.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

21 files changed, 629 insertions, 394 deletions

diff --git a/crates/shirabe/src/repository/advisory_provider_interface.rs b/crates/shirabe/src/repository/advisory_provider_interface.rs
index 4b93eca..6b94ca9 100644
--- a/crates/shirabe/src/repository/advisory_provider_interface.rs
+++ b/crates/shirabe/src/repository/advisory_provider_interface.rs
@@ -11,10 +11,10 @@ pub struct SecurityAdvisoryResult {
 }
 
 pub trait AdvisoryProviderInterface {
-    fn has_security_advisories(&self) -> bool;
+    fn has_security_advisories(&mut self) -> anyhow::Result<bool>;
 
     fn get_security_advisories(
-        &self,
+        &mut self,
         package_constraint_map: IndexMap<String, AnyConstraint>,
         allow_partial_advisories: bool,
     ) -> anyhow::Result<SecurityAdvisoryResult>;
diff --git a/crates/shirabe/src/repository/array_repository.rs b/crates/shirabe/src/repository/array_repository.rs
index 3a05513..8c23eb3 100644
--- a/crates/shirabe/src/repository/array_repository.rs
+++ b/crates/shirabe/src/repository/array_repository.rs
@@ -37,6 +37,33 @@ pub struct ArrayRepository {
 }
 
 impl ArrayRepository {
+    fn get_packages_internal(&self) -> Vec<BasePackageHandle> {
+        if self.packages.borrow().is_none() {
+            self.initialize();
+        }
+
+        if self.packages.borrow().is_none() {
+            // TODO(phase-b): propagate the error.
+            // PHP: throw new \LogicException('initialize failed to initialize the packages array')
+            panic!(
+                "{}",
+                LogicException {
+                    message: "initialize failed to initialize the packages array".to_string(),
+                    code: 0,
+                }
+                .message
+            );
+        }
+
+        self.packages
+            .borrow()
+            .as_ref()
+            .unwrap()
+            .iter()
+            .map(|p| p.clone())
+            .collect()
+    }
+
     /// @param array<PackageInterface> $packages
     pub fn new(packages: Vec<PackageInterfaceHandle>) -> Result<Self> {
         let this = Self {
@@ -153,13 +180,13 @@ impl RepositoryInterface for ArrayRepository {
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
-        let packages = self.get_packages();
+    ) -> anyhow::Result<LoadPackagesResult> {
+        let packages = self.get_packages_internal();
 
         let mut result: IndexMap<String, BasePackageHandle> = IndexMap::new();
         let mut names_found: IndexMap<String, bool> = IndexMap::new();
@@ -214,17 +241,17 @@ impl RepositoryInterface for ArrayRepository {
             }
         }
 
-        LoadPackagesResult {
+        Ok(LoadPackagesResult {
             names_found: names_found.into_keys().collect(),
             packages: result,
-        }
+        })
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         let name = strtolower(name);
 
         let constraint: AnyConstraint = match constraint {
@@ -235,7 +262,7 @@ impl RepositoryInterface for ArrayRepository {
             }
         };
 
-        for package in self.get_packages() {
+        for package in self.get_packages_internal() {
             if name == package.get_name() {
                 let pkg_constraint = SimpleConstraint::new(
                     "==".to_string(),
@@ -243,19 +270,19 @@ impl RepositoryInterface for ArrayRepository {
                     None,
                 );
                 if constraint.matches(&pkg_constraint.into()) {
-                    return Some(package);
+                    return Ok(Some(package));
                 }
             }
         }
 
-        None
+        Ok(None)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         // normalize name
         let name = strtolower(name);
         let mut packages = vec![];
@@ -269,7 +296,7 @@ impl RepositoryInterface for ArrayRepository {
             }
         };
 
-        for package in self.get_packages() {
+        for package in self.get_packages_internal() {
             if name == package.get_name() {
                 if constraint.is_none()
                     || constraint.as_ref().unwrap().matches(
@@ -286,10 +313,15 @@ impl RepositoryInterface for ArrayRepository {
             }
         }
 
-        packages
+        Ok(packages)
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         let regex = if mode == crate::repository::SEARCH_FULLTEXT {
             let parts = Preg::split("{\\s+}", &preg_quote(&query, None)).unwrap_or_default();
             format!("{{(?:{})}}i", implode("|", &parts))
@@ -300,7 +332,7 @@ impl RepositoryInterface for ArrayRepository {
         };
 
         let mut matches: IndexMap<String, SearchResult> = IndexMap::new();
-        for package in self.get_packages() {
+        for package in self.get_packages_internal() {
             let mut name = package.get_name();
             if mode == crate::repository::SEARCH_VENDOR {
                 // PHP: [$name] = explode('/', $name);
@@ -373,13 +405,13 @@ impl RepositoryInterface for ArrayRepository {
             }
         }
 
-        matches.into_values().collect()
+        Ok(matches.into_values().collect())
     }
 
     fn has_package(&self, package: PackageInterfaceHandle) -> bool {
         if self.package_map.borrow().is_none() {
             let mut map: IndexMap<String, BasePackageHandle> = IndexMap::new();
-            for repo_package in self.get_packages() {
+            for repo_package in self.get_packages_internal() {
                 map.insert(repo_package.get_unique_name(), repo_package);
             }
             *self.package_map.borrow_mut() = Some(map);
@@ -392,10 +424,13 @@ impl RepositoryInterface for ArrayRepository {
             .contains_key(&package.get_unique_name())
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         let mut result: IndexMap<String, ProviderInfo> = IndexMap::new();
 
-        'candidates: for candidate in self.get_packages() {
+        'candidates: for candidate in self.get_packages_internal() {
             if result.contains_key(&candidate.get_name()) {
                 continue;
             }
@@ -416,33 +451,11 @@ impl RepositoryInterface for ArrayRepository {
             }
         }
 
-        result
+        Ok(result)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
-        if self.packages.borrow().is_none() {
-            self.initialize();
-        }
-
-        if self.packages.borrow().is_none() {
-            // PHP: throw new \LogicException('initialize failed to initialize the packages array')
-            panic!(
-                "{}",
-                LogicException {
-                    message: "initialize failed to initialize the packages array".to_string(),
-                    code: 0,
-                }
-                .message
-            );
-        }
-
-        self.packages
-            .borrow()
-            .as_ref()
-            .unwrap()
-            .iter()
-            .map(|p| p.clone())
-            .collect()
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
+        Ok(self.get_packages_internal())
     }
 
     fn as_any(&self) -> &dyn std::any::Any {
diff --git a/crates/shirabe/src/repository/canonical_packages_trait.rs b/crates/shirabe/src/repository/canonical_packages_trait.rs
index 5f0ecff..11088aa 100644
--- a/crates/shirabe/src/repository/canonical_packages_trait.rs
+++ b/crates/shirabe/src/repository/canonical_packages_trait.rs
@@ -1,15 +1,14 @@
 //! ref: composer/src/Composer/Repository/CanonicalPackagesTrait.php
 
 use crate::package::PackageInterfaceHandle;
+use crate::repository::RepositoryInterface;
 use indexmap::IndexMap;
 
 /// Provides get_canonical_packages() to various repository implementations.
-pub trait CanonicalPackagesTrait {
-    fn get_packages(&self) -> Vec<PackageInterfaceHandle>;
-
+pub trait CanonicalPackagesTrait: RepositoryInterface {
     /// Get unique packages (at most one package of each name), with aliases resolved and removed.
-    fn get_canonical_packages(&self) -> Vec<PackageInterfaceHandle> {
-        let packages = self.get_packages();
+    fn get_canonical_packages(&mut self) -> anyhow::Result<Vec<PackageInterfaceHandle>> {
+        let packages = self.get_packages()?;
 
         // get at most one package of each name, preferring non-aliased ones
         let mut packages_by_name: IndexMap<String, PackageInterfaceHandle> = IndexMap::new();
@@ -34,6 +33,6 @@ pub trait CanonicalPackagesTrait {
             canonical_packages.push(package);
         }
 
-        canonical_packages
+        Ok(canonical_packages)
     }
 }
diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs
index 591497d..5ef156c 100644
--- a/crates/shirabe/src/repository/composer_repository.rs
+++ b/crates/shirabe/src/repository/composer_repository.rs
@@ -328,148 +328,6 @@ impl ComposerRepository {
         self.repo_config.clone()
     }
 
-    /// @inheritDoc
-    pub fn find_package(
-        &mut self,
-        name: String,
-        constraint: PhpMixed,
-    ) -> anyhow::Result<Option<BasePackageHandle>> {
-        // this call initializes loadRootServerFile which is needed for the rest below to work
-        let has_providers = self.has_providers()?;
-
-        let name = strtolower(&name);
-        let constraint: AnyConstraint = match constraint {
-            PhpMixed::String(s) => self.version_parser.parse_constraints(&s)?.clone(),
-            _ => {
-                // already a ConstraintInterface object passed as opaque PhpMixed
-                self.version_parser.parse_constraints("")?.clone()
-            }
-        };
-
-        if self.lazy_providers_url.is_some() {
-            if self.has_partial_packages()?
-                && self
-                    .partial_packages_by_name
-                    .as_ref()
-                    .map_or(false, |m| m.contains_key(&name))
-            {
-                let packages = self.what_provides(&name, None, None, IndexMap::new())?;
-                let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
-                return Ok(
-                    match self.filter_packages(packages_vec, Some(&constraint), true) {
-                        FindPackageReturn::Package(p) => Some(p),
-                        _ => None,
-                    },
-                );
-            }
-
-            if self.has_available_package_list && !self.lazy_providers_repo_contains(&name)? {
-                return Ok(None);
-            }
-
-            let mut map: IndexMap<String, Option<AnyConstraint>> = IndexMap::new();
-            map.insert(name.clone(), Some(constraint));
-            let packages = self.load_async_packages(map, None, None, IndexMap::new())?;
-
-            if !packages.packages.is_empty() {
-                return Ok(packages.packages.into_iter().next().map(|(_, v)| v));
-            }
-
-            return Ok(None);
-        }
-
-        if has_providers {
-            for provider_name in self.get_provider_names()? {
-                if name == provider_name {
-                    let packages =
-                        self.what_provides(&provider_name, None, None, IndexMap::new())?;
-                    let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
-                    return Ok(
-                        match self.filter_packages(packages_vec, Some(&constraint), true) {
-                            FindPackageReturn::Package(p) => Some(p),
-                            _ => None,
-                        },
-                    );
-                }
-            }
-
-            return Ok(None);
-        }
-
-        Ok(self.inner.find_package(
-            &name,
-            crate::repository::FindPackageConstraint::Constraint(constraint),
-        ))
-    }
-
-    /// @inheritDoc
-    pub fn find_packages(
-        &mut self,
-        name: String,
-        constraint: Option<PhpMixed>,
-    ) -> anyhow::Result<Vec<BasePackageHandle>> {
-        // this call initializes loadRootServerFile which is needed for the rest below to work
-        let has_providers = self.has_providers()?;
-
-        let name = strtolower(&name);
-        let constraint: Option<AnyConstraint> = match constraint {
-            None => None,
-            Some(PhpMixed::String(s)) => Some(self.version_parser.parse_constraints(&s)?.clone()),
-            Some(_) => None,
-        };
-
-        if self.lazy_providers_url.is_some() {
-            if self.has_partial_packages()?
-                && self
-                    .partial_packages_by_name
-                    .as_ref()
-                    .map_or(false, |m| m.contains_key(&name))
-            {
-                let packages = self.what_provides(&name, None, None, IndexMap::new())?;
-                let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
-                return Ok(
-                    match self.filter_packages(packages_vec, constraint.as_ref(), false) {
-                        FindPackageReturn::Packages(v) => v,
-                        _ => vec![],
-                    },
-                );
-            }
-
-            if self.has_available_package_list && !self.lazy_providers_repo_contains(&name)? {
-                return Ok(vec![]);
-            }
-
-            let mut map: IndexMap<String, Option<AnyConstraint>> = IndexMap::new();
-            map.insert(name.clone(), constraint);
-            let result = self.load_async_packages(map, None, None, IndexMap::new())?;
-
-            return Ok(result.packages.into_values().collect());
-        }
-
-        if has_providers {
-            for provider_name in self.get_provider_names()? {
-                if name == provider_name {
-                    let packages =
-                        self.what_provides(&provider_name, None, None, IndexMap::new())?;
-                    let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
-                    return Ok(
-                        match self.filter_packages(packages_vec, constraint.as_ref(), false) {
-                            FindPackageReturn::Packages(v) => v,
-                            _ => vec![],
-                        },
-                    );
-                }
-            }
-
-            return Ok(vec![]);
-        }
-
-        Ok(self.inner.find_packages(
-            &name,
-            constraint.map(crate::repository::FindPackageConstraint::Constraint),
-        ))
-    }
-
     fn filter_packages(
         &self,
         packages: Vec<BasePackageHandle>,
@@ -560,7 +418,7 @@ impl ComposerRepository {
             }.into());
         }
 
-        Ok(self.inner.get_packages())
+        Ok(self.inner.get_packages()?)
     }
 
     /// @param packageFilter Package pattern filter which can include "*" as a wildcard
@@ -734,7 +592,7 @@ impl ComposerRepository {
                 acceptable_stabilities,
                 stability_flags,
                 already_loaded,
-            );
+            )?;
             return Ok(inner_result);
         }
 
@@ -997,7 +855,7 @@ impl ComposerRepository {
         }
 
         // TODO(phase-b): inner.search returns Vec<SearchResult>; convert to PHP-shaped map
-        let inner_results = self.inner.search(query, mode, None);
+        let inner_results = self.inner.search(query, mode, None)?;
         let converted: Vec<IndexMap<String, PhpMixed>> = inner_results
             .into_iter()
             .map(|sr| {
@@ -1350,7 +1208,7 @@ impl ComposerRepository {
         }
 
         if Countable::count(&self.inner) > 0 {
-            for (k, v) in self.inner.get_providers(package_name.to_string()) {
+            for (k, v) in self.inner.get_providers(package_name.to_string())? {
                 // TODO(phase-b): ProviderInfo -> IndexMap<String, PhpMixed> conversion needed
                 let mut entry: IndexMap<String, PhpMixed> = IndexMap::new();
                 entry.insert("name".to_string(), PhpMixed::String(v.name));
@@ -3523,3 +3381,277 @@ fn clone_root_data(rd: &RootData) -> RootData {
         RootData::Data(d) => RootData::Data(d.clone()),
     }
 }
+
+impl shirabe_php_shim::Countable for ComposerRepository {
+    fn count(&self) -> i64 {
+        self.inner.count()
+    }
+}
+
+impl RepositoryInterface for ComposerRepository {
+    fn has_package(&self, package: PackageInterfaceHandle) -> bool {
+        self.inner.has_package(package)
+    }
+
+    /// @inheritDoc
+    fn find_package(
+        &mut self,
+        name: &str,
+        constraint: crate::repository::FindPackageConstraint,
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
+        // this call initializes loadRootServerFile which is needed for the rest below to work
+        let has_providers = self.has_providers()?;
+
+        let name = strtolower(name);
+        let constraint: AnyConstraint = match constraint {
+            crate::repository::FindPackageConstraint::String(s) => {
+                self.version_parser.parse_constraints(&s)?.clone()
+            }
+            crate::repository::FindPackageConstraint::Constraint(c) => c,
+        };
+
+        if self.lazy_providers_url.is_some() {
+            if self.has_partial_packages()?
+                && self
+                    .partial_packages_by_name
+                    .as_ref()
+                    .map_or(false, |m| m.contains_key(&name))
+            {
+                let packages = self.what_provides(&name, None, None, IndexMap::new())?;
+                let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
+                return Ok(
+                    match self.filter_packages(packages_vec, Some(&constraint), true) {
+                        FindPackageReturn::Package(p) => Some(p),
+                        _ => None,
+                    },
+                );
+            }
+
+            if self.has_available_package_list && !self.lazy_providers_repo_contains(&name)? {
+                return Ok(None);
+            }
+
+            let mut map: IndexMap<String, Option<AnyConstraint>> = IndexMap::new();
+            map.insert(name.clone(), Some(constraint));
+            let packages = self.load_async_packages(map, None, None, IndexMap::new())?;
+
+            if !packages.packages.is_empty() {
+                return Ok(packages.packages.into_iter().next().map(|(_, v)| v));
+            }
+
+            return Ok(None);
+        }
+
+        if has_providers {
+            for provider_name in self.get_provider_names()? {
+                if name == provider_name {
+                    let packages =
+                        self.what_provides(&provider_name, None, None, IndexMap::new())?;
+                    let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
+                    return Ok(
+                        match self.filter_packages(packages_vec, Some(&constraint), true) {
+                            FindPackageReturn::Package(p) => Some(p),
+                            _ => None,
+                        },
+                    );
+                }
+            }
+
+            return Ok(None);
+        }
+
+        self.inner.find_package(
+            &name,
+            crate::repository::FindPackageConstraint::Constraint(constraint),
+        )
+    }
+
+    /// @inheritDoc
+    fn find_packages(
+        &mut self,
+        name: &str,
+        constraint: Option<crate::repository::FindPackageConstraint>,
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
+        // this call initializes loadRootServerFile which is needed for the rest below to work
+        let has_providers = self.has_providers()?;
+
+        let name = strtolower(name);
+        let constraint: Option<AnyConstraint> = match constraint {
+            None => None,
+            Some(crate::repository::FindPackageConstraint::String(s)) => {
+                Some(self.version_parser.parse_constraints(&s)?.clone())
+            }
+            Some(crate::repository::FindPackageConstraint::Constraint(c)) => Some(c),
+        };
+
+        if self.lazy_providers_url.is_some() {
+            if self.has_partial_packages()?
+                && self
+                    .partial_packages_by_name
+                    .as_ref()
+                    .map_or(false, |m| m.contains_key(&name))
+            {
+                let packages = self.what_provides(&name, None, None, IndexMap::new())?;
+                let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
+                return Ok(
+                    match self.filter_packages(packages_vec, constraint.as_ref(), false) {
+                        FindPackageReturn::Packages(v) => v,
+                        _ => vec![],
+                    },
+                );
+            }
+
+            if self.has_available_package_list && !self.lazy_providers_repo_contains(&name)? {
+                return Ok(vec![]);
+            }
+
+            let mut map: IndexMap<String, Option<AnyConstraint>> = IndexMap::new();
+            map.insert(name.clone(), constraint);
+            let result = self.load_async_packages(map, None, None, IndexMap::new())?;
+
+            return Ok(result.packages.into_values().collect());
+        }
+
+        if has_providers {
+            for provider_name in self.get_provider_names()? {
+                if name == provider_name {
+                    let packages =
+                        self.what_provides(&provider_name, None, None, IndexMap::new())?;
+                    let packages_vec: Vec<BasePackageHandle> = packages.into_values().collect();
+                    return Ok(
+                        match self.filter_packages(packages_vec, constraint.as_ref(), false) {
+                            FindPackageReturn::Packages(v) => v,
+                            _ => vec![],
+                        },
+                    );
+                }
+            }
+
+            return Ok(vec![]);
+        }
+
+        self.inner.find_packages(
+            &name,
+            constraint.map(crate::repository::FindPackageConstraint::Constraint),
+        )
+    }
+
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
+        ComposerRepository::get_packages(self)
+    }
+
+    fn load_packages(
+        &mut self,
+        package_name_map: IndexMap<String, Option<shirabe_semver::constraint::AnyConstraint>>,
+        acceptable_stabilities: IndexMap<String, i64>,
+        stability_flags: IndexMap<String, i64>,
+        already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
+    ) -> anyhow::Result<LoadPackagesResult> {
+        ComposerRepository::load_packages(
+            self,
+            package_name_map,
+            acceptable_stabilities,
+            stability_flags,
+            already_loaded,
+        )
+    }
+
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<crate::repository::SearchResult>> {
+        let raw = ComposerRepository::search(self, query, mode, r#type)?;
+        Ok(raw
+            .into_iter()
+            .map(|m| crate::repository::SearchResult {
+                name: m
+                    .get("name")
+                    .and_then(|v| v.as_string())
+                    .unwrap_or("")
+                    .to_string(),
+                description: m
+                    .get("description")
+                    .and_then(|v| v.as_string())
+                    .map(|s| s.to_string()),
+                abandoned: None,
+                url: m
+                    .get("url")
+                    .and_then(|v| v.as_string())
+                    .map(|s| s.to_string()),
+            })
+            .collect())
+    }
+
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, crate::repository::ProviderInfo>> {
+        let raw = ComposerRepository::get_providers(self, &package_name)?;
+        Ok(raw
+            .into_iter()
+            .map(|(k, m)| {
+                (
+                    k,
+                    crate::repository::ProviderInfo {
+                        name: m
+                            .get("name")
+                            .and_then(|v| v.as_string())
+                            .unwrap_or("")
+                            .to_string(),
+                        description: m
+                            .get("description")
+                            .and_then(|v| v.as_string())
+                            .map(|s| s.to_string()),
+                        r#type: m
+                            .get("type")
+                            .and_then(|v| v.as_string())
+                            .unwrap_or("")
+                            .to_string(),
+                    },
+                )
+            })
+            .collect())
+    }
+
+    fn get_repo_name(&self) -> String {
+        ComposerRepository::get_repo_name(self)
+    }
+
+    fn as_advisory_provider(&self) -> Option<&dyn crate::repository::AdvisoryProviderInterface> {
+        Some(self)
+    }
+
+    fn as_advisory_provider_mut(
+        &mut self,
+    ) -> Option<&mut dyn crate::repository::AdvisoryProviderInterface> {
+        Some(self)
+    }
+
+    fn as_any(&self) -> &dyn std::any::Any {
+        self
+    }
+
+    fn set_self_handle(&self, weak: RepositoryInterfaceWeakHandle) {
+        ComposerRepository::set_self_handle(self, weak);
+    }
+}
+
+impl crate::repository::AdvisoryProviderInterface for ComposerRepository {
+    fn has_security_advisories(&mut self) -> anyhow::Result<bool> {
+        ComposerRepository::has_security_advisories(self)
+    }
+
+    fn get_security_advisories(
+        &mut self,
+        package_constraint_map: IndexMap<String, shirabe_semver::constraint::AnyConstraint>,
+        allow_partial_advisories: bool,
+    ) -> anyhow::Result<SecurityAdvisoryResult> {
+        ComposerRepository::get_security_advisories(
+            self,
+            package_constraint_map,
+            allow_partial_advisories,
+        )
+    }
+}
diff --git a/crates/shirabe/src/repository/composite_repository.rs b/crates/shirabe/src/repository/composite_repository.rs
index 6c167f2..78bbc6a 100644
--- a/crates/shirabe/src/repository/composite_repository.rs
+++ b/crates/shirabe/src/repository/composite_repository.rs
@@ -84,46 +84,46 @@ impl RepositoryInterface for CompositeRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         for repository in &self.repositories {
-            let package = repository.find_package(name, constraint.clone());
+            let package = repository.find_package(name, constraint.clone())?;
             if package.is_some() {
-                return package;
+                return Ok(package);
             }
         }
-        None
+        Ok(None)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         let mut packages = vec![];
         for repository in &self.repositories {
-            packages.extend(repository.find_packages(name, constraint.clone()));
+            packages.extend(repository.find_packages(name, constraint.clone())?);
         }
-        packages
+        Ok(packages)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         let mut packages = vec![];
         for repository in &self.repositories {
-            packages.extend(repository.get_packages());
+            packages.extend(repository.get_packages()?);
         }
-        packages
+        Ok(packages)
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         let mut all_packages = IndexMap::new();
         let mut all_names_found = vec![];
 
@@ -137,7 +137,7 @@ impl RepositoryInterface for CompositeRepository {
                 acceptable_stabilities.clone(),
                 stability_flags.clone(),
                 already_loaded.clone(),
-            );
+            )?;
             all_packages.extend(result.packages);
             all_names_found.extend(result.names_found);
         }
@@ -148,26 +148,34 @@ impl RepositoryInterface for CompositeRepository {
             .filter(|s| seen.insert(s.clone()))
             .collect();
 
-        LoadPackagesResult {
+        Ok(LoadPackagesResult {
             packages: all_packages,
             names_found: unique_names,
-        }
+        })
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         let mut matches = vec![];
         for repository in &self.repositories {
-            matches.extend(repository.search(query.clone(), mode, r#type.clone()));
+            matches.extend(repository.search(query.clone(), mode, r#type.clone())?);
         }
-        matches
+        Ok(matches)
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         let mut results = IndexMap::new();
         for repository in &self.repositories {
-            results.extend(repository.get_providers(package_name.clone()));
+            results.extend(repository.get_providers(package_name.clone())?);
         }
-        results
+        Ok(results)
     }
 
     fn as_any(&self) -> &dyn std::any::Any {
diff --git a/crates/shirabe/src/repository/filesystem_repository.rs b/crates/shirabe/src/repository/filesystem_repository.rs
index db9a8c6..c373bd9 100644
--- a/crates/shirabe/src/repository/filesystem_repository.rs
+++ b/crates/shirabe/src/repository/filesystem_repository.rs
@@ -463,7 +463,7 @@ impl FilesystemRepository {
 
     /// @param array<string, string> $installPaths
     fn generate_installed_versions(
-        &self,
+        &mut self,
         installation_manager: &InstallationManager,
         install_paths: &IndexMap<String, Option<String>>,
         dev_mode: bool,
@@ -478,7 +478,7 @@ impl FilesystemRepository {
         ));
         let mut packages: Vec<PackageInterfaceHandle> = self
             .inner
-            .get_packages()
+            .get_packages()?
             .into_iter()
             .map(|p| p.into())
             .collect();
diff --git a/crates/shirabe/src/repository/filter_repository.rs b/crates/shirabe/src/repository/filter_repository.rs
index ecf1f0f..a49382a 100644
--- a/crates/shirabe/src/repository/filter_repository.rs
+++ b/crates/shirabe/src/repository/filter_repository.rs
@@ -151,7 +151,16 @@ impl FilterRepository {
 impl shirabe_php_shim::Countable for FilterRepository {
     fn count(&self) -> i64 {
         if self.repo.count() > 0 {
-            self.get_packages().len() as i64
+            // TODO(phase-b): propagate the error
+            // self.get_packages()?.len() as i64
+            self.repo
+                .get_packages()
+                .map(|pkgs| {
+                    pkgs.iter()
+                        .filter(|p| self.is_allowed(&p.get_name()))
+                        .count() as i64
+                })
+                .unwrap_or(0)
         } else {
             0
         }
@@ -164,43 +173,43 @@ impl RepositoryInterface for FilterRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         if !self.is_allowed(name) {
-            return None;
+            return Ok(None);
         }
 
         self.repo.find_package(name, constraint)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         if !self.is_allowed(name) {
-            return Vec::new();
+            return Ok(Vec::new());
         }
 
         self.repo.find_packages(name, constraint)
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         mut package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         package_name_map.retain(|name, _| self.is_allowed(name));
 
         if package_name_map.is_empty() {
-            return LoadPackagesResult {
+            return Ok(LoadPackagesResult {
                 names_found: Vec::new(),
                 packages: IndexMap::new(),
-            };
+            });
         }
 
         let mut result = self.repo.load_packages(
@@ -208,46 +217,54 @@ impl RepositoryInterface for FilterRepository {
             acceptable_stabilities,
             stability_flags,
             already_loaded,
-        );
+        )?;
         if !self.canonical {
             result.names_found = Vec::new();
         }
 
-        result
+        Ok(result)
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         let mut result = Vec::new();
 
-        for package in self.repo.search(query, mode, r#type) {
+        for package in self.repo.search(query, mode, r#type)? {
             if self.is_allowed(&package.name) {
                 result.push(package);
             }
         }
 
-        result
+        Ok(result)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         let mut result = Vec::new();
-        for package in self.repo.get_packages() {
+        for package in self.repo.get_packages()? {
             if self.is_allowed(&package.get_name()) {
                 result.push(package);
             }
         }
 
-        result
+        Ok(result)
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         let mut result = IndexMap::new();
-        for (name, provider) in self.repo.get_providers(package_name) {
+        for (name, provider) in self.repo.get_providers(package_name)? {
             if self.is_allowed(&provider.name) {
                 result.insert(name, provider);
             }
         }
 
-        result
+        Ok(result)
     }
 
     fn get_repo_name(&self) -> String {
@@ -264,29 +281,37 @@ impl RepositoryInterface for FilterRepository {
         }
     }
 
+    fn as_advisory_provider_mut(&mut self) -> Option<&mut dyn AdvisoryProviderInterface> {
+        if self.repo.borrow().as_advisory_provider().is_some() {
+            Some(self)
+        } else {
+            None
+        }
+    }
+
     fn as_any(&self) -> &dyn std::any::Any {
         self
     }
 }
 
 impl AdvisoryProviderInterface for FilterRepository {
-    fn has_security_advisories(&self) -> bool {
-        let repo = self.repo.borrow();
-        if let Some(advisory_repo) = repo.as_advisory_provider() {
+    fn has_security_advisories(&mut self) -> anyhow::Result<bool> {
+        let mut repo = self.repo.borrow_mut();
+        if let Some(advisory_repo) = repo.as_advisory_provider_mut() {
             advisory_repo.has_security_advisories()
         } else {
-            false
+            Ok(false)
         }
     }
 
     fn get_security_advisories(
-        &self,
+        &mut self,
         mut package_constraint_map: IndexMap<String, AnyConstraint>,
         allow_partial_advisories: bool,
     ) -> anyhow::Result<SecurityAdvisoryResult> {
-        let repo = self.repo.borrow();
-        if let Some(advisory_repo) = repo.as_advisory_provider() {
-            package_constraint_map.retain(|name, _| self.is_allowed(name));
+        package_constraint_map.retain(|name, _| self.is_allowed(name));
+        let mut repo = self.repo.borrow_mut();
+        if let Some(advisory_repo) = repo.as_advisory_provider_mut() {
             advisory_repo.get_security_advisories(package_constraint_map, allow_partial_advisories)
         } else {
             Ok(SecurityAdvisoryResult {
diff --git a/crates/shirabe/src/repository/handle.rs b/crates/shirabe/src/repository/handle.rs
index 73d4493..0d02b83 100644
--- a/crates/shirabe/src/repository/handle.rs
+++ b/crates/shirabe/src/repository/handle.rs
@@ -74,8 +74,8 @@ impl RepositoryInterfaceHandle {
         self.0.borrow().get_repo_name()
     }
 
-    pub fn get_packages(&self) -> Vec<BasePackageHandle> {
-        self.0.borrow().get_packages()
+    pub fn get_packages(&self) -> anyhow::Result<Vec<BasePackageHandle>> {
+        self.0.borrow_mut().get_packages()
     }
 
     pub fn has_package(&self, package: PackageInterfaceHandle) -> bool {
@@ -86,16 +86,16 @@ impl RepositoryInterfaceHandle {
         &self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
-        self.0.borrow().find_package(name, constraint)
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
+        self.0.borrow_mut().find_package(name, constraint)
     }
 
     pub fn find_packages(
         &self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
-        self.0.borrow().find_packages(name, constraint)
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
+        self.0.borrow_mut().find_packages(name, constraint)
     }
 
     pub fn load_packages(
@@ -104,8 +104,8 @@ impl RepositoryInterfaceHandle {
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
-        self.0.borrow().load_packages(
+    ) -> anyhow::Result<LoadPackagesResult> {
+        self.0.borrow_mut().load_packages(
             package_name_map,
             acceptable_stabilities,
             stability_flags,
@@ -113,12 +113,20 @@ impl RepositoryInterfaceHandle {
         )
     }
 
-    pub fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
-        self.0.borrow().search(query, mode, r#type)
+    pub fn search(
+        &self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
+        self.0.borrow_mut().search(query, mode, r#type)
     }
 
-    pub fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
-        self.0.borrow().get_providers(package_name)
+    pub fn get_providers(
+        &self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
+        self.0.borrow_mut().get_providers(package_name)
     }
 
     // --- InstalledRepositoryInterface helpers (valid only when the wrapped repository is one) ---
@@ -137,12 +145,11 @@ impl RepositoryInterfaceHandle {
             .and_then(|r| r.get_dev_mode())
     }
 
-    pub fn get_canonical_packages(&self) -> Vec<PackageInterfaceHandle> {
-        self.0
-            .borrow()
-            .as_installed_repository_interface()
-            .map(|r| r.get_canonical_packages())
-            .unwrap_or_default()
+    pub fn get_canonical_packages(&self) -> anyhow::Result<Vec<PackageInterfaceHandle>> {
+        match self.0.borrow_mut().as_installed_repository_interface_mut() {
+            Some(r) => r.get_canonical_packages(),
+            None => Ok(Vec::new()),
+        }
     }
 
     pub fn get_dev_package_names(&self) -> Vec<String> {
diff --git a/crates/shirabe/src/repository/installed_array_repository.rs b/crates/shirabe/src/repository/installed_array_repository.rs
index 1520497..2d3965b 100644
--- a/crates/shirabe/src/repository/installed_array_repository.rs
+++ b/crates/shirabe/src/repository/installed_array_repository.rs
@@ -68,7 +68,9 @@ impl WritableRepositoryInterface for InstalledArrayRepository {
         todo!()
     }
 
-    fn get_canonical_packages(&self) -> Vec<crate::package::PackageInterfaceHandle> {
+    fn get_canonical_packages(
+        &mut self,
+    ) -> anyhow::Result<Vec<crate::package::PackageInterfaceHandle>> {
         todo!()
     }
 
@@ -96,35 +98,43 @@ impl RepositoryInterface for InstalledArrayRepository {
         todo!()
     }
     fn find_package(
-        &self,
+        &mut self,
         _name: &str,
         _constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         todo!()
     }
     fn find_packages(
-        &self,
+        &mut self,
         _name: &str,
         _constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         todo!()
     }
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         todo!()
     }
     fn load_packages(
-        &self,
+        &mut self,
         _package_name_map: IndexMap<String, Option<AnyConstraint>>,
         _acceptable_stabilities: IndexMap<String, i64>,
         _stability_flags: IndexMap<String, i64>,
         _already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         todo!()
     }
-    fn search(&self, _query: String, _mode: i64, _type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        _query: String,
+        _mode: i64,
+        _type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         todo!()
     }
-    fn get_providers(&self, _package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        _package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         todo!()
     }
     fn get_repo_name(&self) -> String {
diff --git a/crates/shirabe/src/repository/installed_filesystem_repository.rs b/crates/shirabe/src/repository/installed_filesystem_repository.rs
index 73a9f1a..84bf1ca 100644
--- a/crates/shirabe/src/repository/installed_filesystem_repository.rs
+++ b/crates/shirabe/src/repository/installed_filesystem_repository.rs
@@ -78,7 +78,9 @@ impl WritableRepositoryInterface for InstalledFilesystemRepository {
         todo!()
     }
 
-    fn get_canonical_packages(&self) -> Vec<crate::package::PackageInterfaceHandle> {
+    fn get_canonical_packages(
+        &mut self,
+    ) -> anyhow::Result<Vec<crate::package::PackageInterfaceHandle>> {
         todo!()
     }
 
@@ -106,35 +108,43 @@ impl RepositoryInterface for InstalledFilesystemRepository {
         todo!()
     }
     fn find_package(
-        &self,
+        &mut self,
         _name: &str,
         _constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         todo!()
     }
     fn find_packages(
-        &self,
+        &mut self,
         _name: &str,
         _constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         todo!()
     }
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         todo!()
     }
     fn load_packages(
-        &self,
+        &mut self,
         _package_name_map: IndexMap<String, Option<AnyConstraint>>,
         _acceptable_stabilities: IndexMap<String, i64>,
         _stability_flags: IndexMap<String, i64>,
         _already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         todo!()
     }
-    fn search(&self, _query: String, _mode: i64, _type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        _query: String,
+        _mode: i64,
+        _type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         todo!()
     }
-    fn get_providers(&self, _package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        _package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         todo!()
     }
     fn get_repo_name(&self) -> String {
diff --git a/crates/shirabe/src/repository/installed_repository.rs b/crates/shirabe/src/repository/installed_repository.rs
index b857bc2..e199556 100644
--- a/crates/shirabe/src/repository/installed_repository.rs
+++ b/crates/shirabe/src/repository/installed_repository.rs
@@ -53,7 +53,7 @@ impl InstalledRepository {
         &self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         let name = name.to_lowercase();
 
         let constraint: Option<AnyConstraint> = match constraint {
@@ -67,7 +67,7 @@ impl InstalledRepository {
 
         let mut matches = vec![];
         for repo in self.inner.get_repositories() {
-            'candidates: for candidate in repo.get_packages() {
+            'candidates: for candidate in repo.get_packages()? {
                 if name == candidate.get_name() {
                     if constraint.is_none()
                         || constraint.as_ref().unwrap().matches(
@@ -105,17 +105,17 @@ impl InstalledRepository {
             }
         }
 
-        matches
+        Ok(matches)
     }
 
     pub fn get_dependents(
-        &self,
+        &mut self,
         needle: NeedleInput,
         constraint: Option<AnyConstraint>,
         invert: bool,
         recurse: bool,
         packages_found: Option<Vec<String>>,
-    ) -> Vec<DependentsEntry> {
+    ) -> anyhow::Result<Vec<DependentsEntry>> {
         let mut needles: Vec<String> = match needle {
             NeedleInput::Single(s) => vec![s.to_lowercase()],
             NeedleInput::Multiple(v) => v.into_iter().map(|s| s.to_lowercase()).collect(),
@@ -125,14 +125,14 @@ impl InstalledRepository {
         let mut packages_found = packages_found.unwrap_or_else(|| needles.clone());
 
         let mut root_package: Option<BasePackageHandle> = None;
-        for package in self.inner.get_packages() {
+        for package in self.inner.get_packages()? {
             if package.as_root().is_some() {
                 root_package = Some(package.clone());
                 break;
             }
         }
 
-        for package in self.inner.get_packages() {
+        for package in self.inner.get_packages()? {
             let mut links: IndexMap<String, Link> = package.get_requires();
             let mut packages_in_tree = packages_found.clone();
 
@@ -164,7 +164,7 @@ impl InstalledRepository {
                                         false,
                                         true,
                                         Some(packages_in_tree.clone()),
-                                    )
+                                    )?
                                 } else {
                                     vec![]
                                 };
@@ -205,7 +205,7 @@ impl InstalledRepository {
                                     false,
                                     true,
                                     Some(packages_in_tree.clone()),
-                                )
+                                )?
                             } else {
                                 vec![]
                             };
@@ -221,7 +221,7 @@ impl InstalledRepository {
 
             if invert && needles.contains(&package.get_name().to_string()) {
                 for link in package.get_conflicts().values() {
-                    for pkg in self.find_packages(link.get_target(), None) {
+                    for pkg in self.find_packages(link.get_target(), None)? {
                         let version = SimpleConstraint::new(
                             "=".to_string(),
                             pkg.get_version().to_string(),
@@ -236,7 +236,7 @@ impl InstalledRepository {
 
             for link in package.get_conflicts().values() {
                 if needles.contains(&link.get_target().to_string()) {
-                    for pkg in self.find_packages(link.get_target(), None) {
+                    for pkg in self.find_packages(link.get_target(), None)? {
                         let version = SimpleConstraint::new(
                             "=".to_string(),
                             pkg.get_version().to_string(),
@@ -267,7 +267,7 @@ impl InstalledRepository {
                             .find_package(
                                 link.get_target(),
                                 FindPackageConstraint::Constraint(link.get_constraint().clone()),
-                            )
+                            )?
                             .is_some()
                         {
                             continue;
@@ -276,7 +276,7 @@ impl InstalledRepository {
                         let platform_pkg = self.find_package(
                             link.get_target(),
                             FindPackageConstraint::String("*".to_string()),
-                        );
+                        )?;
                         let description = platform_pkg
                             .as_ref()
                             .map(|p| format!("but {} is installed", p.get_pretty_version()))
@@ -300,7 +300,7 @@ impl InstalledRepository {
                         continue;
                     }
 
-                    for pkg in self.get_packages() {
+                    for pkg in self.get_packages()? {
                         if !pkg.get_names(true).contains(&link.get_target().to_string()) {
                             continue;
                         }
@@ -379,7 +379,7 @@ impl InstalledRepository {
         }
 
         // ksort($results) - no-op for a numerically-indexed Vec
-        results
+        Ok(results)
     }
 
     pub fn add_repository(&mut self, repository: RepositoryInterfaceHandle) -> anyhow::Result<()> {
@@ -425,32 +425,32 @@ impl RepositoryInterface for InstalledRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         self.inner.find_package(name, constraint)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         self.inner.find_packages(name, constraint)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         self.inner.get_packages()
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         self.inner.load_packages(
             package_name_map,
             acceptable_stabilities,
@@ -459,11 +459,19 @@ impl RepositoryInterface for InstalledRepository {
         )
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         self.inner.search(query, mode, r#type)
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         self.inner.get_providers(package_name)
     }
 
diff --git a/crates/shirabe/src/repository/lock_array_repository.rs b/crates/shirabe/src/repository/lock_array_repository.rs
index 08e888a..250ca90 100644
--- a/crates/shirabe/src/repository/lock_array_repository.rs
+++ b/crates/shirabe/src/repository/lock_array_repository.rs
@@ -17,11 +17,7 @@ pub struct LockArrayRepository {
     inner: ArrayRepository,
 }
 
-impl CanonicalPackagesTrait for LockArrayRepository {
-    fn get_packages(&self) -> Vec<PackageInterfaceHandle> {
-        RepositoryInterface::get_packages(&self.inner)
-    }
-}
+impl CanonicalPackagesTrait for LockArrayRepository {}
 
 impl LockArrayRepository {
     pub fn new(packages: Vec<PackageInterfaceHandle>) -> anyhow::Result<Self> {
@@ -47,32 +43,32 @@ impl RepositoryInterface for LockArrayRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         self.inner.find_package(name, constraint)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         self.inner.find_packages(name, constraint)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
-        RepositoryInterface::get_packages(&self.inner)
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
+        RepositoryInterface::get_packages(&mut self.inner)
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult {
+    ) -> anyhow::Result<LoadPackagesResult> {
         self.inner.load_packages(
             package_name_map,
             acceptable_stabilities,
@@ -81,11 +77,19 @@ impl RepositoryInterface for LockArrayRepository {
         )
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         self.inner.search(query, mode, r#type)
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         self.inner.get_providers(package_name)
     }
 
diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs
index b5280a8..83e13d0 100644
--- a/crates/shirabe/src/repository/package_repository.rs
+++ b/crates/shirabe/src/repository/package_repository.rs
@@ -82,12 +82,12 @@ impl PackageRepository {
 }
 
 impl AdvisoryProviderInterface for PackageRepository {
-    fn has_security_advisories(&self) -> bool {
-        !self.security_advisories.is_empty()
+    fn has_security_advisories(&mut self) -> anyhow::Result<bool> {
+        Ok(!self.security_advisories.is_empty())
     }
 
     fn get_security_advisories(
-        &self,
+        &mut self,
         package_constraint_map: IndexMap<String, AnyConstraint>,
         allow_partial_advisories: bool,
     ) -> anyhow::Result<SecurityAdvisoryResult> {
diff --git a/crates/shirabe/src/repository/platform_repository.rs b/crates/shirabe/src/repository/platform_repository.rs
index 0d10e3a..957e335 100644
--- a/crates/shirabe/src/repository/platform_repository.rs
+++ b/crates/shirabe/src/repository/platform_repository.rs
@@ -1615,7 +1615,7 @@ impl PlatformRepository {
             let overrider = self.inner.find_package(
                 &name,
                 crate::repository::FindPackageConstraint::String("*".to_string()),
-            );
+            )?;
             let actual_text = if let Some(ref ov) = overrider {
                 if package.get_version() == ov.get_version() {
                     "same as actual".to_string()
@@ -1888,14 +1888,14 @@ impl PlatformRepository {
     }
 
     pub fn search(
-        &self,
+        &mut self,
         query: String,
         mode: i64,
         r#type: Option<String>,
-    ) -> Vec<crate::repository::SearchResult> {
+    ) -> anyhow::Result<Vec<crate::repository::SearchResult>> {
         // suppress vendor search as there are no vendors to match in platform packages
         if mode == crate::repository::SEARCH_VENDOR {
-            return Vec::new();
+            return Ok(Vec::new());
         }
 
         self.inner.search(query, mode, r#type)
@@ -1954,32 +1954,32 @@ impl crate::repository::RepositoryInterface for PlatformRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: crate::repository::FindPackageConstraint,
-    ) -> Option<crate::package::BasePackageHandle> {
+    ) -> anyhow::Result<Option<crate::package::BasePackageHandle>> {
         self.inner.find_package(name, constraint)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<crate::repository::FindPackageConstraint>,
-    ) -> Vec<crate::package::BasePackageHandle> {
+    ) -> anyhow::Result<Vec<crate::package::BasePackageHandle>> {
         self.inner.find_packages(name, constraint)
     }
 
-    fn get_packages(&self) -> Vec<crate::package::BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<crate::package::BasePackageHandle>> {
         self.inner.get_packages()
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<shirabe_semver::constraint::AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, crate::package::PackageInterfaceHandle>>,
-    ) -> crate::repository::LoadPackagesResult {
+    ) -> anyhow::Result<crate::repository::LoadPackagesResult> {
         self.inner.load_packages(
             package_name_map,
             acceptable_stabilities,
@@ -1989,18 +1989,18 @@ impl crate::repository::RepositoryInterface for PlatformRepository {
     }
 
     fn search(
-        &self,
+        &mut self,
         query: String,
         mode: i64,
         r#type: Option<String>,
-    ) -> Vec<crate::repository::SearchResult> {
+    ) -> anyhow::Result<Vec<crate::repository::SearchResult>> {
         self.inner.search(query, mode, r#type)
     }
 
     fn get_providers(
-        &self,
+        &mut self,
         package_name: String,
-    ) -> IndexMap<String, crate::repository::ProviderInfo> {
+    ) -> anyhow::Result<IndexMap<String, crate::repository::ProviderInfo>> {
         self.inner.get_providers(package_name)
     }
 
diff --git a/crates/shirabe/src/repository/repository_interface.rs b/crates/shirabe/src/repository/repository_interface.rs
index e75f54e..249bd85 100644
--- a/crates/shirabe/src/repository/repository_interface.rs
+++ b/crates/shirabe/src/repository/repository_interface.rs
@@ -56,30 +56,38 @@ pub trait RepositoryInterface: Countable + std::fmt::Debug {
     fn has_package(&self, package: PackageInterfaceHandle) -> bool;
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: FindPackageConstraint,
-    ) -> Option<BasePackageHandle>;
+    ) -> anyhow::Result<Option<BasePackageHandle>>;
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle>;
+    ) -> anyhow::Result<Vec<BasePackageHandle>>;
 
-    fn get_packages(&self) -> Vec<BasePackageHandle>;
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>>;
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> LoadPackagesResult;
+    ) -> anyhow::Result<LoadPackagesResult>;
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult>;
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>>;
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo>;
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>>;
 
     fn get_repo_name(&self) -> String;
 
@@ -87,6 +95,10 @@ pub trait RepositoryInterface: Countable + std::fmt::Debug {
         None
     }
 
+    fn as_advisory_provider_mut(&mut self) -> Option<&mut dyn AdvisoryProviderInterface> {
+        None
+    }
+
     fn as_installed_repository_interface(
         &self,
     ) -> Option<&dyn crate::repository::InstalledRepositoryInterface> {
diff --git a/crates/shirabe/src/repository/repository_manager.rs b/crates/shirabe/src/repository/repository_manager.rs
index dd69731..9b1d9ab 100644
--- a/crates/shirabe/src/repository/repository_manager.rs
+++ b/crates/shirabe/src/repository/repository_manager.rs
@@ -55,23 +55,23 @@ impl RepositoryManager {
         &self,
         name: &str,
         constraint: &AnyConstraint,
-    ) -> Option<PackageInterfaceHandle> {
+    ) -> anyhow::Result<Option<PackageInterfaceHandle>> {
         for repository in &self.repositories {
             if let Some(package) = repository.find_package(
                 name,
                 crate::repository::FindPackageConstraint::Constraint(constraint.clone()),
-            ) {
-                return Some(package.into());
+            )? {
+                return Ok(Some(package.into()));
             }
         }
-        None
+        Ok(None)
     }
 
     pub fn find_packages(
         &self,
         name: &str,
         constraint: &AnyConstraint,
-    ) -> Vec<PackageInterfaceHandle> {
+    ) -> anyhow::Result<Vec<PackageInterfaceHandle>> {
         let mut packages: Vec<PackageInterfaceHandle> = vec![];
         for repository in self.get_repositories() {
             for p in repository.find_packages(
@@ -79,11 +79,11 @@ impl RepositoryManager {
                 Some(crate::repository::FindPackageConstraint::Constraint(
                     constraint.clone(),
                 )),
-            ) {
+            )? {
                 packages.push(p);
             }
         }
-        packages
+        Ok(packages)
     }
 
     pub fn add_repository(&mut self, repository: RepositoryInterfaceHandle) {
diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs
index 077c3f6..3cc4b9f 100644
--- a/crates/shirabe/src/repository/repository_set.rs
+++ b/crates/shirabe/src/repository/repository_set.rs
@@ -206,7 +206,7 @@ impl RepositorySet {
         name: &str,
         constraint: Option<AnyConstraint>,
         flags: i64,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         let ignore_stability = (flags & Self::ALLOW_UNACCEPTABLE_STABILITIES) != 0;
         let load_from_all_repos = (flags & Self::ALLOW_SHADOWED_REPOSITORIES) != 0;
 
@@ -217,7 +217,7 @@ impl RepositorySet {
                 let constraint_clone = constraint
                     .as_ref()
                     .map(|c| FindPackageConstraint::Constraint(c.clone()));
-                let found = repository.find_packages(name, constraint_clone);
+                let found = repository.find_packages(name, constraint_clone)?;
                 packages.push(found);
             }
         } else {
@@ -243,7 +243,7 @@ impl RepositorySet {
                     acceptable,
                     stability_flags,
                     IndexMap::new(),
-                );
+                )?;
 
                 packages.push(result.packages.into_values().collect());
                 for name_found in result.names_found {
@@ -264,7 +264,7 @@ impl RepositorySet {
 
         // when using loadPackages above (!$loadFromAllRepos) the repos already filter for stability so no need to do it again
         if ignore_stability || !load_from_all_repos {
-            return candidates;
+            return Ok(candidates);
         }
 
         let mut result: Vec<BasePackageHandle> = vec![];
@@ -274,7 +274,7 @@ impl RepositorySet {
             }
         }
 
-        result
+        Ok(result)
     }
 
     /// @param string[] $packageNames
@@ -375,17 +375,16 @@ impl RepositorySet {
         let mut repo_advisories: Vec<IndexMap<String, Vec<PartialOrFullSecurityAdvisory>>> = vec![];
         for repository in &self.repositories {
             let attempt: Result<()> = (|| -> Result<()> {
-                let repo_ref = repository.borrow();
-                let Some(advisory_repo) = repo_ref.as_advisory_provider() else {
+                let mut repo_ref = repository.borrow_mut();
+                let Some(advisory_repo) = repo_ref.as_advisory_provider_mut() else {
                     return Ok(());
                 };
-                if !advisory_repo.has_security_advisories() {
+                if !advisory_repo.has_security_advisories()? {
                     return Ok(());
                 }
 
                 let result = advisory_repo.get_security_advisories(
-                    // TODO(phase-b): clone package_constraint_map values
-                    todo!("clone package_constraint_map"),
+                    package_constraint_map.clone(),
                     allow_partial_advisories,
                 )?;
                 repo_advisories.push(result.advisories);
@@ -429,16 +428,16 @@ impl RepositorySet {
     pub fn get_providers(
         &self,
         package_name: &str,
-    ) -> IndexMap<String, crate::repository::ProviderInfo> {
+    ) -> anyhow::Result<IndexMap<String, crate::repository::ProviderInfo>> {
         let mut providers: IndexMap<String, crate::repository::ProviderInfo> = IndexMap::new();
         for repository in &self.repositories {
-            let repo_providers = repository.get_providers(package_name.to_string());
+            let repo_providers = repository.get_providers(package_name.to_string())?;
             if !repo_providers.is_empty() {
                 providers.extend(repo_providers);
             }
         }
 
-        providers
+        Ok(providers)
     }
 
     /// Check for each given package name whether it would be accepted by this RepositorySet in the given $stability
@@ -531,7 +530,7 @@ impl RepositorySet {
 
         let mut packages: Vec<BasePackageHandle> = vec![];
         for repository in &self.repositories {
-            for mut package in repository.get_packages() {
+            for mut package in repository.get_packages()? {
                 let name = package.get_name();
                 let version = package.get_version();
                 packages.push(package.clone());
diff --git a/crates/shirabe/src/repository/root_package_repository.rs b/crates/shirabe/src/repository/root_package_repository.rs
index 22ca437..985f86e 100644
--- a/crates/shirabe/src/repository/root_package_repository.rs
+++ b/crates/shirabe/src/repository/root_package_repository.rs
@@ -37,32 +37,32 @@ impl RepositoryInterface for RootPackageRepository {
     }
 
     fn find_package(
-        &self,
+        &mut self,
         name: &str,
         constraint: crate::repository::FindPackageConstraint,
-    ) -> Option<BasePackageHandle> {
+    ) -> anyhow::Result<Option<BasePackageHandle>> {
         self.inner.find_package(name, constraint)
     }
 
     fn find_packages(
-        &self,
+        &mut self,
         name: &str,
         constraint: Option<crate::repository::FindPackageConstraint>,
-    ) -> Vec<BasePackageHandle> {
+    ) -> anyhow::Result<Vec<BasePackageHandle>> {
         self.inner.find_packages(name, constraint)
     }
 
-    fn get_packages(&self) -> Vec<BasePackageHandle> {
+    fn get_packages(&mut self) -> anyhow::Result<Vec<BasePackageHandle>> {
         self.inner.get_packages()
     }
 
     fn load_packages(
-        &self,
+        &mut self,
         package_name_map: IndexMap<String, Option<shirabe_semver::constraint::AnyConstraint>>,
         acceptable_stabilities: IndexMap<String, i64>,
         stability_flags: IndexMap<String, i64>,
         already_loaded: IndexMap<String, IndexMap<String, PackageInterfaceHandle>>,
-    ) -> crate::repository::LoadPackagesResult {
+    ) -> anyhow::Result<crate::repository::LoadPackagesResult> {
         self.inner.load_packages(
             package_name_map,
             acceptable_stabilities,
@@ -71,11 +71,19 @@ impl RepositoryInterface for RootPackageRepository {
         )
     }
 
-    fn search(&self, query: String, mode: i64, r#type: Option<String>) -> Vec<SearchResult> {
+    fn search(
+        &mut self,
+        query: String,
+        mode: i64,
+        r#type: Option<String>,
+    ) -> anyhow::Result<Vec<SearchResult>> {
         self.inner.search(query, mode, r#type)
     }
 
-    fn get_providers(&self, package_name: String) -> IndexMap<String, ProviderInfo> {
+    fn get_providers(
+        &mut self,
+        package_name: String,
+    ) -> anyhow::Result<IndexMap<String, ProviderInfo>> {
         self.inner.get_providers(package_name)
     }
 
diff --git a/crates/shirabe/src/repository/vcs_repository.rs b/crates/shirabe/src/repository/vcs_repository.rs
index 7a570c6..9a39b76 100644
--- a/crates/shirabe/src/repository/vcs_repository.rs
+++ b/crates/shirabe/src/repository/vcs_repository.rs
@@ -520,7 +520,7 @@ impl VcsRepository {
                         )
                         .into(),
                     ),
-                ) {
+                )? {
                     if is_very_verbose {
                         self.io.write_error(&format!(
                             "<warning>Skipped tag {}, it conflicts with an another tag ({}) as both resolve to {} internally</warning>",
@@ -763,7 +763,7 @@ impl VcsRepository {
                 .overwrite_error4("", false, None, io_interface::NORMAL);
         }
 
-        if self.inner.get_packages().is_empty() {
+        if self.inner.get_packages()?.is_empty() {
             return Err(InvalidRepositoryException::new(format!(
                 "No valid composer.json was found in any branch or tag of {}, could not load a package from it.",
                 self.url
@@ -948,7 +948,7 @@ impl VcsRepository {
                     SimpleConstraint::new("=".to_string(), version_normalized.to_string(), None)
                         .into(),
                 ),
-            ) {
+            )? {
                 if is_very_verbose {
                     self.io.write_error(&format!(
                         "<warning>Skipped cached version {}, it conflicts with an another tag ({}) as both resolve to {} internally</warning>",
diff --git a/crates/shirabe/src/repository/writable_array_repository.rs b/crates/shirabe/src/repository/writable_array_repository.rs
index ac9df8f..1c07b8c 100644
--- a/crates/shirabe/src/repository/writable_array_repository.rs
+++ b/crates/shirabe/src/repository/writable_array_repository.rs
@@ -76,8 +76,8 @@ impl WritableArrayRepository {
         Vec::new()
     }
 
-    pub fn get_packages(&self) -> Vec<crate::package::BasePackageHandle> {
-        crate::repository::RepositoryInterface::get_packages(&self.inner)
+    pub fn get_packages(&mut self) -> anyhow::Result<Vec<crate::package::BasePackageHandle>> {
+        self.inner.get_packages()
     }
 
     pub fn get_repo_name(&self) -> String {
diff --git a/crates/shirabe/src/repository/writable_repository_interface.rs b/crates/shirabe/src/repository/writable_repository_interface.rs
index abbcbe7..ae62e1e 100644
--- a/crates/shirabe/src/repository/writable_repository_interface.rs
+++ b/crates/shirabe/src/repository/writable_repository_interface.rs
@@ -12,7 +12,7 @@ pub trait WritableRepositoryInterface: RepositoryInterface {
 
     fn remove_package(&mut self, package: PackageInterfaceHandle) -> Result<()>;
 
-    fn get_canonical_packages(&self) -> Vec<PackageInterfaceHandle>;
+    fn get_canonical_packages(&mut self) -> Result<Vec<PackageInterfaceHandle>>;
 
     fn reload(&mut self);