package_manager/src/PackageManagerUpdateProcessor.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager;
 
+use Drupal\Component\Datetime\TimeInterface;
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\KeyValueStore\KeyValueExpirableFactoryInterface;
 use Drupal\Core\KeyValueStore\KeyValueFactoryInterface;
@@ -48,18 +49,24 @@ final class PackageManagerUpdateProcessor extends UpdateProcessor {
    *   The key/value factory.
    * @param \Drupal\Core\KeyValueStore\KeyValueExpirableFactoryInterface $key_value_expirable_factory
    *   The expirable key/value factory.
+   * @param \Drupal\Component\Datetime\TimeInterface $time
+   *   The time service.
    */
-  public function __construct(ConfigFactoryInterface $config_factory, QueueFactory $queue_factory, UpdateFetcherInterface $update_fetcher, StateInterface $state_store, PrivateKey $private_key, KeyValueFactoryInterface $key_value_factory, KeyValueExpirableFactoryInterface $key_value_expirable_factory) {
-    $this->updateFetcher = $update_fetcher;
-    $this->updateSettings = $config_factory->get('update.settings');
+  public function __construct(
+    ConfigFactoryInterface $config_factory,
+    QueueFactory $queue_factory,
+    UpdateFetcherInterface $update_fetcher,
+    StateInterface $state_store,
+    PrivateKey $private_key,
+    KeyValueFactoryInterface $key_value_factory,
+    KeyValueExpirableFactoryInterface $key_value_expirable_factory,
+    TimeInterface $time,
+  ) {
+    parent::__construct(...func_get_args());
     $this->fetchQueue = $queue_factory->get('package_manager.update_fetch_tasks');
     $this->tempStore = $key_value_expirable_factory->get('package_manager.update');
     $this->fetchTaskStore = $key_value_factory->get('package_manager.update_fetch_task');
     $this->availableReleasesTempStore = $key_value_expirable_factory->get('package_manager.update_available_releases');
-    $this->stateStore = $state_store;
-    $this->privateKey = $private_key;
-    $this->fetchTasks = [];
-    $this->failed = [];
   }
 
   /**

package_manager/src/PathExcluder/GitExcluder.php

@@ -5,7 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\package_manager\PathExcluder;
 
 use Drupal\package_manager\ComposerInspector;
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Drupal\package_manager\PathLocator;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -19,39 +19,38 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 final class GitExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
   /**
    * Constructs a GitExcluder object.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
    * @param \Drupal\package_manager\ComposerInspector $composerInspector
    *   The Composer inspector service.
    */
-  public function __construct(PathLocator $path_locator, private ComposerInspector $composerInspector) {
-    $this->pathLocator = $path_locator;
-  }
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector
+  ) {}
 
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeGitDirectories',
+      CollectPathsToExcludeEvent::class => 'excludeGitDirectories',
     ];
   }
 
   /**
    * Excludes .git directories from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    *
    * @throws \Exception
    *   See \Drupal\package_manager\ComposerInspector::validate().
    */
-  public function excludeGitDirectories(CollectIgnoredPathsEvent $event): void {
+  public function excludeGitDirectories(CollectPathsToExcludeEvent $event): void {
     $project_root = $this->pathLocator->getProjectRoot();
 
     // To determine which .git directories to exclude, the installed packages
@@ -73,7 +72,7 @@ final class GitExcluder implements EventSubscriberInterface {
         $installed_paths[] = $package->path;
       }
     }
-    $paths = $this->scanForDirectoriesByName('.git');
+    $paths = $event->scanForDirectoriesByName('.git');
     foreach ($paths as $git_directory) {
       // Don't exclude any `.git` directory that is directly under an installed
       // package's path, since it means Composer probably installed that package
@@ -83,7 +82,7 @@ final class GitExcluder implements EventSubscriberInterface {
         $paths_to_exclude[] = $git_directory;
       }
     }
-    $this->excludeInProjectRoot($event, $paths_to_exclude);
+    $event->addPathsRelativeToProjectRoot($paths_to_exclude);
   }
 
 }

package_manager/src/PathExcluder/NodeModulesExcluder.php

@@ -4,8 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\PathExcluder;
 
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
-use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -18,27 +17,14 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 class NodeModulesExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
-  /**
-   * Constructs a NodeModulesExcluder object.
-   *
-   * @param \Drupal\package_manager\PathLocator $path_locator
-   *   The path locator service.
-   */
-  public function __construct(PathLocator $path_locator) {
-    $this->pathLocator = $path_locator;
-  }
-
   /**
    * Excludes node_modules directories from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeNodeModulesFiles(CollectIgnoredPathsEvent $event): void {
-    $paths = $this->scanForDirectoriesByName('node_modules');
-    $this->excludeInProjectRoot($event, $paths);
+  public function excludeNodeModulesFiles(CollectPathsToExcludeEvent $event): void {
+    $event->addPathsRelativeToProjectRoot($event->scanForDirectoriesByName('node_modules'));
   }
 
   /**
@@ -46,7 +32,7 @@ class NodeModulesExcluder implements EventSubscriberInterface {
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeNodeModulesFiles',
+      CollectPathsToExcludeEvent::class => 'excludeNodeModulesFiles',
     ];
   }
 

package_manager/src/PathExcluder/SiteConfigurationExcluder.php

@@ -4,7 +4,11 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\PathExcluder;
 
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\Core\File\Exception\FileException;
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
+use Drupal\package_manager\Event\PostCreateEvent;
+use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\PathLocator;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -18,31 +22,36 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 class SiteConfigurationExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
   /**
-   * Constructs an ExcludedPathsSubscriber.
+   * Constructs an SiteConfigurationExcluder.
    *
    * @param string $sitePath
    *   The current site path, relative to the Drupal root.
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
+   * @param \Drupal\Core\File\FileSystemInterface $fileSystem
+   *   The file system service.
    */
-  public function __construct(protected string $sitePath, PathLocator $path_locator) {
-    $this->pathLocator = $path_locator;
-  }
+  public function __construct(
+    protected string $sitePath,
+    private readonly PathLocator $pathLocator,
+    private readonly FileSystemInterface $fileSystem
+  ) {}
 
   /**
    * Excludes site configuration files from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeSiteConfiguration(CollectIgnoredPathsEvent $event): void {
-    // Site configuration files are always excluded relative to the web root.
-    $paths = [];
+  public function excludeSiteConfiguration(CollectPathsToExcludeEvent $event): void {
+    // These two files are never relevant to existing sites.
+    $paths = [
+      'sites/default/default.settings.php',
+      'sites/default/default.services.yml',
+    ];
 
-    // Ignore site-specific settings files, which are always in the web root.
+    // Exclude site-specific settings files, which are always in the web root.
     // By default, Drupal core will always try to write-protect these files.
     $settings_files = [
       'settings.php',
@@ -53,7 +62,82 @@ class SiteConfigurationExcluder implements EventSubscriberInterface {
       $paths[] = $this->sitePath . '/' . $settings_file;
       $paths[] = 'sites/default/' . $settings_file;
     }
-    $this->excludeInWebRoot($event, $paths);
+    // Site configuration files are always excluded relative to the web root.
+    $event->addPathsRelativeToWebRoot($paths);
+  }
+
+  /**
+   * Makes the staged `sites/default` directory owner-writable.
+   *
+   * This is done to allow the core scaffold plugin to make changes in
+   * `sites/default`, if necessary, without breaking if `sites/default` is not
+   * writable (this can happen because rsync preserves directory permissions,
+   * and Drupal will try to harden the site directory's permissions as much as
+   * possible). We specifically exclude the `default.settings.php` and
+   * `default.services.yml` files from Package Manager operations, so we want to
+   * allow the scaffold plugin to make whatever changes it wants to those files
+   * in the stage directory.
+   *
+   * @param \Drupal\package_manager\Event\PostCreateEvent $event
+   *   The event being handled.
+   *
+   * @see ::excludeSiteConfiguration()
+   */
+  public function makeDefaultSiteDirectoryWritable(PostCreateEvent $event): void {
+    $dir = $this->getDefaultSiteDirectoryPath($event->stage->getStageDirectory());
+    // If the directory doesn't even exist, there's nothing to do here.
+    if (!is_dir($dir)) {
+      return;
+    }
+    if (!$this->fileSystem->chmod($dir, 0700)) {
+      throw new FileException("Could not change permissions on '$dir'.");
+    }
+  }
+
+  /**
+   * Makes `sites/default` permissions the same in live and stage directories.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent $event
+   *   The event being handled.
+   *
+   * @throws \Drupal\Core\File\Exception\FileException
+   *   If the permissions of the live `sites/default` cannot be determined, or
+   *   cannot be changed on the staged `sites/default`.
+   */
+  public function syncDefaultSiteDirectoryPermissions(PreApplyEvent $event): void {
+    $staged_dir = $this->getDefaultSiteDirectoryPath($event->stage->getStageDirectory());
+    // If the directory doesn't even exist, there's nothing to do here.
+    if (!is_dir($staged_dir)) {
+      return;
+    }
+    $live_dir = $this->getDefaultSiteDirectoryPath($this->pathLocator->getProjectRoot());
+
+    $permissions = fileperms($live_dir);
+    if ($permissions === FALSE) {
+      throw new FileException("Could not determine permissions for '$live_dir'.");
+    }
+
+    if (!$this->fileSystem->chmod($staged_dir, $permissions)) {
+      throw new FileException("Could not change permissions on '$staged_dir'.");
+    }
+  }
+
+  /**
+   * Returns the full path to `sites/default`, relative to a root directory.
+   *
+   * @param string $root_dir
+   *   The root directory.
+   *
+   * @return string
+   *   The full path to `sites/default` within the given root directory.
+   */
+  private function getDefaultSiteDirectoryPath(string $root_dir): string {
+    $dir = [$root_dir];
+    $web_root = $this->pathLocator->getWebRoot();
+    if ($web_root) {
+      $dir[] = $web_root;
+    }
+    return implode(DIRECTORY_SEPARATOR, [...$dir, 'sites', 'default']);
   }
 
   /**
@@ -61,7 +145,9 @@ class SiteConfigurationExcluder implements EventSubscriberInterface {
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeSiteConfiguration',
+      CollectPathsToExcludeEvent::class => 'excludeSiteConfiguration',
+      PostCreateEvent::class => 'makeDefaultSiteDirectoryWritable',
+      PreApplyEvent::class => 'syncDefaultSiteDirectoryPermissions',
     ];
   }
 

package_manager/src/PathExcluder/SiteFilesExcluder.php

@@ -6,8 +6,7 @@ namespace Drupal\package_manager\PathExcluder;
 
 use Drupal\Core\StreamWrapper\LocalStream;
 use Drupal\Core\StreamWrapper\StreamWrapperManagerInterface;
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
-use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\Filesystem\Filesystem;
 
@@ -21,39 +20,36 @@ use Symfony\Component\Filesystem\Filesystem;
  */
 final class SiteFilesExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
   /**
    * Constructs a SiteFilesExcluder object.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
-   *   The path locator service.
    * @param \Drupal\Core\StreamWrapper\StreamWrapperManagerInterface $streamWrapperManager
    *   The stream wrapper manager service.
    * @param \Symfony\Component\Filesystem\Filesystem $fileSystem
    *   The Symfony file system service.
    */
-  public function __construct(PathLocator $path_locator, protected StreamWrapperManagerInterface $streamWrapperManager, protected Filesystem $fileSystem) {
-    $this->pathLocator = $path_locator;
-  }
+  public function __construct(
+    private readonly StreamWrapperManagerInterface $streamWrapperManager,
+    private readonly Filesystem $fileSystem
+  ) {}
 
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeSiteFiles',
+      CollectPathsToExcludeEvent::class => 'excludeSiteFiles',
     ];
   }
 
   /**
    * Excludes public and private files from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeSiteFiles(CollectIgnoredPathsEvent $event): void {
-    // Ignore public and private files. These paths could be either absolute or
+  public function excludeSiteFiles(CollectPathsToExcludeEvent $event): void {
+    // Exclude public and private files. These paths could be either absolute or
     // relative, depending on site settings. If they are absolute, treat them
     // as relative to the project root. Otherwise, treat them as relative to
     // the web root.
@@ -63,10 +59,12 @@ final class SiteFilesExcluder implements EventSubscriberInterface {
         $path = $wrapper->getDirectoryPath();
 
         if ($this->fileSystem->isAbsolutePath($path)) {
-          $this->excludeInProjectRoot($event, [realpath($path)]);
+          if ($path = realpath($path)) {
+            $event->addPathsRelativeToProjectRoot([$path]);
+          }
         }
         else {
-          $this->excludeInWebRoot($event, [$path]);
+          $event->addPathsRelativeToWebRoot([$path]);
         }
       }
     }

package_manager/src/PathExcluder/SqliteDatabaseExcluder.php

@@ -5,8 +5,8 @@ declare(strict_types = 1);
 namespace Drupal\package_manager\PathExcluder;
 
 use Drupal\Core\Database\Connection;
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
-use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -19,49 +19,56 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 class SqliteDatabaseExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
   /**
    * Constructs a SqliteDatabaseExcluder object.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
-   *   The path locator service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
+   *   The path factory service.
    * @param \Drupal\Core\Database\Connection $database
    *   The database connection.
    */
-  public function __construct(PathLocator $path_locator, protected Connection $database) {
-    $this->pathLocator = $path_locator;
-  }
+  public function __construct(
+    private readonly PathFactoryInterface $pathFactory,
+    private readonly Connection $database,
+  ) {}
 
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeDatabaseFiles',
+      CollectPathsToExcludeEvent::class => 'excludeDatabaseFiles',
     ];
   }
 
   /**
    * Excludes SQLite database files from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeDatabaseFiles(CollectIgnoredPathsEvent $event): void {
-    // If the database is SQLite, it might be located in the active directory
-    // and we should ignore it. Always treat it as relative to the project root.
+  public function excludeDatabaseFiles(CollectPathsToExcludeEvent $event): void {
+    // If the database is SQLite, it might be located in the project directory
+    // and we should exclude it.
     if ($this->database->driver() === 'sqlite') {
-      $options = $this->database->getConnectionOptions();
-      // Nothing to exclude if the database lives outside the project root.
-      if (str_starts_with($options['database'], '/') && !str_starts_with($options['database'], $this->pathLocator->getProjectRoot())) {
-        return;
+      $db_path = $this->database->getConnectionOptions()['database'];
+      // Exclude the database file and auxiliary files created by SQLite.
+      $paths = [$db_path, "$db_path-shm", "$db_path-wal"];
+
+      // If the database path is absolute, it might be outside the project root,
+      // in which case we don't need to do anything.
+      if ($this->pathFactory->create($db_path)->isAbsolute()) {
+        try {
+          $event->addPathsRelativeToProjectRoot($paths);
+        }
+        catch (\LogicException) {
+          // The database is outside of the project root, so we're done.
+        }
+      }
+      else {
+        // The database is in the web root, and must be excluded relative to it.
+        $event->addPathsRelativeToWebRoot($paths);
       }
-      $this->excludeInProjectRoot($event, [
-        $options['database'],
-        $options['database'] . '-shm',
-        $options['database'] . '-wal',
-      ]);
     }
   }
 

package_manager/src/PathExcluder/TestSiteExcluder.php

@@ -4,8 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\PathExcluder;
 
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
-use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -18,37 +17,25 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 final class TestSiteExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
-  /**
-   * Constructs a TestSiteExcluder object.
-   *
-   * @param \Drupal\package_manager\PathLocator $path_locator
-   *   The path locator service.
-   */
-  public function __construct(PathLocator $path_locator) {
-    $this->pathLocator = $path_locator;
-  }
-
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeTestSites',
+      CollectPathsToExcludeEvent::class => 'excludeTestSites',
     ];
   }
 
   /**
    * Excludes sites/simpletest from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeTestSites(CollectIgnoredPathsEvent $event): void {
-    // Always ignore automated test directories. If they exist, they will be in
+  public function excludeTestSites(CollectPathsToExcludeEvent $event): void {
+    // Always exclude automated test directories. If they exist, they will be in
     // the web root.
-    $this->excludeInWebRoot($event, ['sites/simpletest']);
+    $event->addPathsRelativeToWebRoot(['sites/simpletest']);
   }
 
 }

package_manager/src/PathExcluder/UnknownPathExcluder.php

@@ -5,9 +5,15 @@ declare(strict_types = 1);
 namespace Drupal\package_manager\PathExcluder;
 
 use Drupal\Component\Serialization\Json;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\package_manager\ComposerInspector;
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
 use Drupal\package_manager\PathLocator;
+use Psr\Log\LoggerAwareInterface;
+use Psr\Log\LoggerAwareTrait;
+use Psr\Log\NullLogger;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
 /**
@@ -23,25 +29,39 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  *
  * If web root and project root are the same, nothing is excluded.
  *
+ * This excluder can be disabled by changing the config setting
+ * `package_manager.settings:include_unknown_files_in_project_root` to TRUE.
+ * This may be needed for sites that have files outside the web root (besides
+ * the vendor directory) which are nonetheless needed in order for Composer to
+ * assemble the code base correctly; a classic example would be a directory of
+ * patch files used by `cweagans/composer-patches`.
+ *
  * @internal
  *   This is an internal part of Package Manager and may be changed or removed
  *   at any time without warning. External code should not interact with this
  *   class.
  */
-final class UnknownPathExcluder implements EventSubscriberInterface {
+final class UnknownPathExcluder implements EventSubscriberInterface, LoggerAwareInterface {
 
-  use PathExclusionsTrait;
+  use LoggerAwareTrait;
+  use StringTranslationTrait;
 
   /**
    * Constructs a UnknownPathExcluder object.
    *
    * @param \Drupal\package_manager\ComposerInspector $composerInspector
    *   The Composer inspector service.
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
+   *   The config factory service.
    */
-  public function __construct(private ComposerInspector $composerInspector, PathLocator $path_locator) {
-    $this->pathLocator = $path_locator;
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+    private readonly ConfigFactoryInterface $configFactory,
+  ) {
+    $this->setLogger(new NullLogger());
   }
 
   /**
@@ -49,54 +69,111 @@ final class UnknownPathExcluder implements EventSubscriberInterface {
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeUnknownPaths',
+      CollectPathsToExcludeEvent::class => 'excludeUnknownPaths',
+      StatusCheckEvent::class => 'logExcludedPaths',
     ];
   }
 
   /**
-   * Excludes unknown paths from stage operations.
+   * Returns the paths to exclude from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
-   *   The event object.
+   * @return string[]
+   *   The paths that should be excluded from stage operations, relative to the
+   *   project root.
    *
    * @throws \Exception
    *   See \Drupal\package_manager\ComposerInspector::validate().
    */
-  public function excludeUnknownPaths(CollectIgnoredPathsEvent $event): void {
-    $project_root = $this->pathLocator->getProjectRoot();
-    $web_root = $project_root . DIRECTORY_SEPARATOR . $this->pathLocator->getWebRoot();
-    if (realpath($web_root) === $project_root) {
-      return;
+  private function getExcludedPaths(): array {
+    // If this excluder is disabled, or the project root and web root are the
+    // same, we are not excluding any paths.
+    $is_disabled = $this->configFactory->get('package_manager.settings')
+      ->get('include_unknown_files_in_project_root');
+    $web_root = $this->pathLocator->getWebRoot();
+    if ($is_disabled || empty($web_root)) {
+      return [];
     }
 
-    // To determine the scaffold files to exclude, the installed packages must
-    // be known, and that requires Composer commands to be able to run. This
-    // intentionally does not catch exceptions: failed Composer validation in
-    // the project root implies that this excluder cannot function correctly.
-    // Note: the call to ComposerInspector::getInstalledPackagesList() would
+    // To determine the files to include, the installed packages must be known,
+    // and that requires Composer commands to be able to run. This intentionally
+    // does not catch exceptions: failed Composer validation in the project root
+    // implies that this excluder cannot function correctly.
+    // Note: the call to ComposerInspector::getConfig() would
     // also have triggered this, but explicitness is preferred here.
     // @see \Drupal\package_manager\StatusCheckTrait::runStatusCheck()
+    $project_root = $this->pathLocator->getProjectRoot();
     $this->composerInspector->validate($project_root);
 
-    $vendor_dir = $this->pathLocator->getVendorDirectory();
-    $scaffold_files_paths = $this->getScaffoldFiles();
-    // Search for all files (including hidden ones) in project root.
-    $paths_in_project_root = glob("$project_root/{,.}*", GLOB_BRACE);
-    $paths = [];
-    $known_paths = array_merge([$vendor_dir, $web_root, "$project_root/composer.json", "$project_root/composer.lock"], $scaffold_files_paths);
-    foreach ($paths_in_project_root as $path_in_project_root) {
-      if (!in_array($path_in_project_root, $known_paths, TRUE)) {
-        $paths[] = $path_in_project_root;
+    // The vendor directory and web root are always included in staging
+    // operations, along with `composer.json`, `composer.lock`, and any scaffold
+    // files provided by Drupal core.
+    $always_include = [
+      $this->composerInspector->getConfig('vendor-dir', $project_root),
+      $web_root,
+      'composer.json',
+      'composer.lock',
+    ];
+    foreach ($this->getScaffoldFiles() as $scaffold_file_path) {
+      // The web root is always included in staging operations, so we don't need
+      // to do anything special for scaffold files that live in it.
+      if (str_starts_with($scaffold_file_path, '[web-root]')) {
+        continue;
       }
+      $always_include[] = ltrim($scaffold_file_path, '/');
+    }
+
+    // Search for all files (including hidden ones) in the project root. We need
+    // to use readdir() and friends here, rather than glob(), since certain
+    // glob() flags aren't supported on all systems. We also can't use
+    // \Drupal\Core\File\FileSystemInterface::scanDirectory(), because it
+    // unconditionally ignores hidden files and directories.
+    $files_in_project_root = [];
+    $handle = opendir($project_root);
+    if (empty($handle)) {
+      throw new \RuntimeException("Could not scan for files in the project root.");
+    }
+    while ($entry = readdir($handle)) {
+      $files_in_project_root[] = $entry;
+    }
+    closedir($handle);
+
+    return array_diff($files_in_project_root, $always_include, ['.', '..']);
+  }
+
+  /**
+   * Excludes unknown paths from stage operations.
+   *
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
+   *   The event object.
+   */
+  public function excludeUnknownPaths(CollectPathsToExcludeEvent $event): void {
+    // We can exclude the paths as-is; they are already relative to the project
+    // root.
+    $event->add(...$this->getExcludedPaths());
+  }
+
+  /**
+   * Logs the paths that will be excluded from stage operations.
+   */
+  public function logExcludedPaths(): void {
+    $excluded_paths = $this->getExcludedPaths();
+    if ($excluded_paths) {
+      sort($excluded_paths);
+
+      $message = $this->t("The following paths in @project_root aren't recognized as part of your Drupal site, so to be safe, Package Manager is excluding them from all stage operations. If these files are not needed for Composer to work properly in your site, no action is needed. Otherwise, you can disable this behavior by setting the <code>package_manager.settings:include_unknown_files_in_project_root</code> config setting to <code>TRUE</code>.\n\n@list", [
+        '@project_root' => $this->pathLocator->getProjectRoot(),
+        '@list' => implode("\n", $excluded_paths),
+      ]);
+      $this->logger->info($message);
     }
-    $this->excludeInProjectRoot($event, $paths);
   }
 
   /**
    * Gets the path of scaffold files, for example 'index.php' and 'robots.txt'.
    *
-   * @return array
-   *   The array of scaffold file paths.
+   * @return string[]
+   *   The paths of scaffold files provided by `drupal/core`, relative to the
+   *   project root.
    *
    * @todo Intelligently load scaffold files in https://drupal.org/i/3343802.
    */
@@ -104,10 +181,9 @@ final class UnknownPathExcluder implements EventSubscriberInterface {
     $project_root = $this->pathLocator->getProjectRoot();
     $packages = $this->composerInspector->getInstalledPackagesList($project_root);
     $extra = Json::decode($this->composerInspector->getConfig('extra', $packages['drupal/core']->path . '/composer.json'));
-    if (isset($extra['drupal-scaffold']['file-mapping'])) {
-      return array_keys($extra['drupal-scaffold']['file-mapping']);
-    }
-    return [];
+
+    $scaffold_files = $extra['drupal-scaffold']['file-mapping'] ?? [];
+    return str_replace('[project-root]', '', array_keys($scaffold_files));
   }
 
 }

package_manager/src/PathExcluder/VendorHardeningExcluder.php

@@ -4,7 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\PathExcluder;
 
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Drupal\package_manager\PathLocator;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -18,39 +18,35 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  */
 final class VendorHardeningExcluder implements EventSubscriberInterface {
 
-  use PathExclusionsTrait;
-
   /**
    * Constructs a VendorHardeningExcluder object.
    *
-   * @param \Drupal\package_manager\PathLocator $path_locator
+   * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
    */
-  public function __construct(PathLocator $path_locator) {
-    $this->pathLocator = $path_locator;
-  }
+  public function __construct(private readonly PathLocator $pathLocator) {}
 
   /**
    * {@inheritdoc}
    */
   public static function getSubscribedEvents(): array {
     return [
-      CollectIgnoredPathsEvent::class => 'excludeVendorHardeningFiles',
+      CollectPathsToExcludeEvent::class => 'excludeVendorHardeningFiles',
     ];
   }
 
   /**
    * Excludes vendor hardening files from stage operations.
    *
-   * @param \Drupal\package_manager\Event\CollectIgnoredPathsEvent $event
+   * @param \Drupal\package_manager\Event\CollectPathsToExcludeEvent $event
    *   The event object.
    */
-  public function excludeVendorHardeningFiles(CollectIgnoredPathsEvent $event): void {
+  public function excludeVendorHardeningFiles(CollectPathsToExcludeEvent $event): void {
     // If the core-vendor-hardening plugin (used in the legacy-project template)
     // is present, it may have written security hardening files in the vendor
-    // directory. They should always be ignored.
+    // directory. They should always be excluded.
     $vendor_dir = $this->pathLocator->getVendorDirectory();
-    $this->excludeInProjectRoot($event, [
+    $event->addPathsRelativeToProjectRoot([
       $vendor_dir . '/web.config',
       $vendor_dir . '/.htaccess',
     ]);

package_manager/src/Plugin/QueueWorker/Cleaner.php

+<?php
+
+namespace Drupal\package_manager\Plugin\QueueWorker;
+
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\Core\Plugin\ContainerFactoryPluginInterface;
+use Drupal\Core\Queue\QueueWorkerBase;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Processes a queue of defunct stage directories, deleting them.
+ *
+ * @QueueWorker(
+ *   id = "package_manager_cleanup",
+ *   title = @Translation("Stage directory cleaner"),
+ *   cron = {"time" = 30}
+ * )
+ */
+final class Cleaner extends QueueWorkerBase implements ContainerFactoryPluginInterface {
+
+  /**
+   * Constructs a new Cleaner instance.
+   *
+   * @param array $configuration
+   *   A configuration array containing information about the plugin instance.
+   * @param string $plugin_id
+   *   The plugin ID.
+   * @param mixed $plugin_definition
+   *   The plugin implementation definition.
+   * @param \Drupal\Core\File\FileSystemInterface $fileSystem
+   *   The file system service.
+   */
+  public function __construct(array $configuration, string $plugin_id, mixed $plugin_definition, private readonly FileSystemInterface $fileSystem) {
+    parent::__construct($configuration, $plugin_id, $plugin_definition);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container, array $configuration, $plugin_id, $plugin_definition) {
+    return new static(
+      $configuration,
+      $plugin_id,
+      $plugin_definition,
+      $container->get(FileSystemInterface::class),
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function processItem($dir) {
+    assert(is_string($dir));
+
+    if (file_exists($dir)) {
+      $this->fileSystem->deleteRecursive($dir, function (string $path): void {
+        $this->fileSystem->chmod($path, is_dir($path) ? 0700 : 0600);
+      });
+    }
+  }
+
+}

package_manager/src/ProcessFactory.php

@@ -6,9 +6,8 @@ namespace Drupal\package_manager;
 
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\File\FileSystemInterface;
-use PhpTuf\ComposerStager\Infrastructure\Factory\Process\ProcessFactoryInterface;
-use PhpTuf\ComposerStager\Infrastructure\Factory\Process\ProcessFactory as StagerProcessFactory;
-use Symfony\Component\Process\Process;
+use PhpTuf\ComposerStager\API\Process\Factory\ProcessFactoryInterface;
+use PhpTuf\ComposerStager\API\Process\Service\ProcessInterface;
 
 // cspell:ignore BINDIR
 
@@ -22,13 +21,6 @@ use Symfony\Component\Process\Process;
  */
 final class ProcessFactory implements ProcessFactoryInterface {
 
-  /**
-   * The decorated process factory.
-   *
-   * @var \PhpTuf\ComposerStager\Infrastructure\Factory\Process\ProcessFactoryInterface
-   */
-  private $decorated;
-
   /**
    * Constructs a ProcessFactory object.
    *
@@ -36,10 +28,14 @@ final class ProcessFactory implements ProcessFactoryInterface {
    *   The file system service.
    * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
    *   The config factory service.
+   * @param \PhpTuf\ComposerStager\API\Process\Factory\ProcessFactoryInterface $decorated
+   *   The decorated process factory service.
    */
-  public function __construct(private FileSystemInterface $fileSystem, private ConfigFactoryInterface $configFactory) {
-    $this->decorated = new StagerProcessFactory();
-  }
+  public function __construct(
+    private readonly FileSystemInterface $fileSystem,
+    private readonly ConfigFactoryInterface $configFactory,
+    private readonly ProcessFactoryInterface $decorated,
+  ) {}
 
   /**
    * Returns the value of an environment variable.
@@ -60,30 +56,12 @@ final class ProcessFactory implements ProcessFactoryInterface {
   /**
    * {@inheritdoc}
    */
-  public function create(array $command): Process {
+  public function create(array $command): ProcessInterface {
     $process = $this->decorated->create($command);
 
     $env = $process->getEnv();
-    if ($this->isComposerCommand($command)) {
+    if ($command && $this->isComposerCommand($command)) {
       $env['COMPOSER_HOME'] = $this->getComposerHomePath();
-      // Work around Composer not being designed to be run massively in parallel
-      // which it may in the context of Package Manager, at least for tests. It
-      // is trivial to work around though: create a unique temporary directory
-      // per process.
-      // @see https://www.drupal.org/i/3338789#comment-14961390
-      // @see https://github.com/composer/composer/commit/28e9193e9ebde743c19f334a7294830fc6429d06
-      // @see https://github.com/composer/composer/commit/43eb471ec293822d377b618a4a14d8d3651f5d13
-      // @todo Remove this once Composer 2.5.5 is required in https://www.drupal.org/i/3350568 (2.5.5 is the first release to contain the upstream fix: https://github.com/composer/composer/releases/tag/2.5.5)
-      static $race_condition_proof_tmpdir;
-      if (!isset($race_condition_proof_tmpdir)) {
-        $race_condition_proof_tmpdir = sys_get_temp_dir() . '/' . getmypid();
-        // The same PHP process may run multiple tests: create the directory
-        // only once.
-        if (!is_dir($race_condition_proof_tmpdir)) {
-          mkdir($race_condition_proof_tmpdir);
-        }
-      }
-      $env['TMPDIR'] = $race_condition_proof_tmpdir;
     }
     // Ensure that the current PHP installation is the first place that will be
     // searched when looking for the PHP interpreter.
@@ -102,7 +80,7 @@ final class ProcessFactory implements ProcessFactoryInterface {
    * @see php_sapi_name()
    * @see https://www.php.net/manual/en/reserved.constants.php
    */
-  protected static function getPhpDirectory(): string {
+  private static function getPhpDirectory(): string {
     if (PHP_SAPI === 'cli' || PHP_SAPI === 'cli-server') {
       return dirname(PHP_BINARY);
     }

package_manager/src/ProcessOutputCallback.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager;
+
+use PhpTuf\ComposerStager\API\Process\Service\OutputCallbackInterface;
+use PhpTuf\ComposerStager\API\Process\Value\OutputTypeEnum;
+use Psr\Log\LoggerAwareInterface;
+use Psr\Log\LoggerAwareTrait;
+use Psr\Log\NullLogger;
+
+/**
+ * A process callback for capturing output.
+ *
+ * @see \Symfony\Component\Process\Process
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class ProcessOutputCallback implements OutputCallbackInterface, LoggerAwareInterface {
+
+  use LoggerAwareTrait;
+
+  /**
+   * The output buffer.
+   *
+   * @var string
+   */
+  private string $outBuffer = '';
+
+  /**
+   * The error buffer.
+   *
+   * @var string
+   */
+  private string $errorBuffer = '';
+
+  /**
+   * Constructs a ProcessOutputCallback object.
+   */
+  public function __construct() {
+    $this->setLogger(new NullLogger());
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function __invoke(OutputTypeEnum $type, string $buffer): void {
+
+    if ($type === OutputTypeEnum::OUT) {
+      $this->outBuffer .= $buffer;
+    }
+    elseif ($type === OutputTypeEnum::ERR) {
+      $this->errorBuffer .= $buffer;
+    }
+  }
+
+  /**
+   * Gets the output.
+   *
+   * If there is anything in the error buffer, it will be logged as a warning.
+   *
+   * @return string|null
+   *   The output or NULL if there is none.
+   */
+  public function getOutput(): ?string {
+    $error_output = $this->getErrorOutput();
+    if ($error_output) {
+      $this->logger->warning($error_output);
+    }
+    return trim($this->outBuffer) !== '' ? $this->outBuffer : NULL;
+  }
+
+  /**
+   * Gets the parsed JSON output.
+   *
+   * @return mixed
+   *   The decoded JSON output or NULL if there isn't any.
+   */
+  public function parseJsonOutput(): mixed {
+    $output = $this->getOutput();
+    if ($output !== NULL) {
+      return json_decode($output, TRUE, flags: JSON_THROW_ON_ERROR);
+    }
+    return NULL;
+  }
+
+  /**
+   * Gets the error output.
+   *
+   * @return string|null
+   *   The error output or NULL if there isn't any.
+   */
+  public function getErrorOutput(): ?string {
+    return trim($this->errorBuffer) !== '' ? $this->errorBuffer : NULL;
+  }
+
+  /**
+   * Resets buffers.
+   *
+   * @return self
+   */
+  public function reset(): self {
+    $this->errorBuffer = '';
+    $this->outBuffer = '';
+    return $this;
+  }
+
+}

package_manager/src/ProjectInfo.php

@@ -27,7 +27,7 @@ final class ProjectInfo {
    * @param string $name
    *   The project name.
    */
-  public function __construct(protected string $name) {
+  public function __construct(private readonly string $name) {
   }
 
   /**
@@ -192,7 +192,7 @@ final class ProjectInfo {
     // update processor service.
     if (!isset($available_projects[$this->name])) {
       /** @var \Drupal\package_manager\PackageManagerUpdateProcessor $update_processor */
-      $update_processor = \Drupal::service('package_manager.update_processor');
+      $update_processor = \Drupal::service(PackageManagerUpdateProcessor::class);
       if ($project_data = $update_processor->getProjectData($this->name)) {
         $available_projects[$this->name] = $project_data;
       }

package_manager/src/Stage.php → package_manager/src/StageBase.php

@@ -6,21 +6,19 @@ namespace Drupal\package_manager;
 
 use Composer\Semver\VersionParser;
 use Drupal\Component\Datetime\TimeInterface;
-use Drupal\Component\Utility\Crypt;
-use Drupal\Core\File\Exception\FileException;
-use Drupal\Core\File\FileSystemInterface;
+use Drupal\Component\Utility\Random;
+use Drupal\Core\Queue\QueueFactory;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\Core\TempStore\SharedTempStore;
 use Drupal\Core\TempStore\SharedTempStoreFactory;
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\Core\Utility\Error;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Drupal\package_manager\Event\PostApplyEvent;
 use Drupal\package_manager\Event\PostCreateEvent;
-use Drupal\package_manager\Event\PostDestroyEvent;
 use Drupal\package_manager\Event\PostRequireEvent;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
-use Drupal\package_manager\Event\PreDestroyEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
 use Drupal\package_manager\Event\PreRequireEvent;
 use Drupal\package_manager\Event\StageEvent;
@@ -28,13 +26,13 @@ use Drupal\package_manager\Exception\ApplyFailedException;
 use Drupal\package_manager\Exception\StageEventException;
 use Drupal\package_manager\Exception\StageException;
 use Drupal\package_manager\Exception\StageOwnershipException;
-use PhpTuf\ComposerStager\Domain\Core\Beginner\BeginnerInterface;
-use PhpTuf\ComposerStager\Domain\Core\Committer\CommitterInterface;
-use PhpTuf\ComposerStager\Domain\Core\Stager\StagerInterface;
-use PhpTuf\ComposerStager\Domain\Exception\InvalidArgumentException;
-use PhpTuf\ComposerStager\Domain\Exception\PreconditionException;
-use PhpTuf\ComposerStager\Infrastructure\Factory\Path\PathFactoryInterface;
-use PhpTuf\ComposerStager\Infrastructure\Value\PathList\PathList;
+use PhpTuf\ComposerStager\API\Core\BeginnerInterface;
+use PhpTuf\ComposerStager\API\Core\CommitterInterface;
+use PhpTuf\ComposerStager\API\Core\StagerInterface;
+use PhpTuf\ComposerStager\API\Exception\InvalidArgumentException;
+use PhpTuf\ComposerStager\API\Exception\PreconditionException;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
+use PhpTuf\ComposerStager\API\Path\Value\PathListInterface;
 use Psr\Log\LoggerAwareInterface;
 use Psr\Log\LoggerAwareTrait;
 use Psr\Log\NullLogger;
@@ -64,7 +62,7 @@ use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  * site (e.g. `/tmp/.package_managerSITE_UUID`), which is deleted when any stage
  * created by that site is destroyed.
  */
-class Stage implements LoggerAwareInterface {
+abstract class StageBase implements LoggerAwareInterface {
 
   use LoggerAwareTrait;
   use StringTranslationTrait;
@@ -161,46 +159,82 @@ class Stage implements LoggerAwareInterface {
    */
   protected SharedTempStore $tempStore;
 
+  /**
+   * The stage type.
+   *
+   * To ensure that stage classes do not unintentionally use another stage's
+   * type, all concrete subclasses MUST explicitly define this property.
+   * The recommended pattern is `MODULE:TYPE`.
+   *
+   * @var string
+   */
+  protected string $type;
+
   /**
    * Constructs a new Stage object.
    *
    * @param \Drupal\package_manager\PathLocator $pathLocator
    *   The path locator service.
-   * @param \PhpTuf\ComposerStager\Domain\Core\Beginner\BeginnerInterface $beginner
+   * @param \PhpTuf\ComposerStager\API\Core\BeginnerInterface $beginner
    *   The beginner service.
-   * @param \PhpTuf\ComposerStager\Domain\Core\Stager\StagerInterface $stager
+   * @param \PhpTuf\ComposerStager\API\Core\StagerInterface $stager
    *   The stager service.
-   * @param \PhpTuf\ComposerStager\Domain\Core\Committer\CommitterInterface $committer
+   * @param \PhpTuf\ComposerStager\API\Core\CommitterInterface $committer
    *   The committer service.
-   * @param \Drupal\Core\File\FileSystemInterface $fileSystem
-   *   The file system service.
+   * @param \Drupal\Core\Queue\QueueFactory $queueFactory
+   *   The queue factory.
    * @param \Symfony\Contracts\EventDispatcher\EventDispatcherInterface $eventDispatcher
    *   The event dispatcher service.
    * @param \Drupal\Core\TempStore\SharedTempStoreFactory $tempStoreFactory
    *   The shared tempstore factory.
    * @param \Drupal\Component\Datetime\TimeInterface $time
    *   The time service.
-   * @param \PhpTuf\ComposerStager\Infrastructure\Factory\Path\PathFactoryInterface $pathFactory
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
    *   The path factory service.
    * @param \Drupal\package_manager\FailureMarker $failureMarker
    *   The failure marker service.
    */
   public function __construct(
-    protected PathLocator $pathLocator,
-    protected BeginnerInterface $beginner,
-    protected StagerInterface $stager,
-    protected CommitterInterface $committer,
-    protected FileSystemInterface $fileSystem,
+    protected readonly PathLocator $pathLocator,
+    protected readonly BeginnerInterface $beginner,
+    protected readonly StagerInterface $stager,
+    protected readonly CommitterInterface $committer,
+    protected readonly QueueFactory $queueFactory,
     protected EventDispatcherInterface $eventDispatcher,
-    protected SharedTempStoreFactory $tempStoreFactory,
-    protected TimeInterface $time,
-    protected PathFactoryInterface $pathFactory,
-    protected FailureMarker $failureMarker,
+    protected readonly SharedTempStoreFactory $tempStoreFactory,
+    protected readonly TimeInterface $time,
+    protected readonly PathFactoryInterface $pathFactory,
+    protected readonly FailureMarker $failureMarker,
   ) {
     $this->tempStore = $tempStoreFactory->get('package_manager_stage');
     $this->setLogger(new NullLogger());
   }
 
+  /**
+   * Gets the stage type.
+   *
+   * The stage type can be used by stage event subscribers to implement logic
+   * specific to certain stages, without relying on the class name (which may
+   * not be part of module's public API).
+   *
+   * @return string
+   *   The stage type.
+   *
+   * @throws \LogicException
+   *   Thrown if $this->type is not explicitly overridden.
+   */
+  final public function getType(): string {
+    $reflector = new \ReflectionProperty($this, 'type');
+
+    // The $type property must ALWAYS be overridden. This means that different
+    // subclasses can return the same value (thus allowing one stage to
+    // impersonate another one), but if that happens, it is intentional.
+    if ($reflector->getDeclaringClass()->getName() === static::class) {
+      return $this->type;
+    }
+    throw new \LogicException(static::class . ' must explicitly override the $type property.');
+  }
+
   /**
    * Determines if the stage directory can be created.
    *
@@ -223,7 +257,7 @@ class Stage implements LoggerAwareInterface {
    * @return mixed
    *   The metadata value, or NULL if it is not set.
    */
-  protected function getMetadata(string $key) {
+  public function getMetadata(string $key) {
     $this->checkOwnership();
 
     $metadata = $this->tempStore->get(static::TEMPSTORE_METADATA_KEY) ?: [];
@@ -237,11 +271,13 @@ class Stage implements LoggerAwareInterface {
    * claimed by its owner, or created during the current request.
    *
    * @param string $key
-   *   The key under which to store the metadata.
+   *   The key under which to store the metadata. To prevent conflicts, it is
+   *   strongly recommended that this be prefixed with the name of the module
+   *   storing the data.
    * @param mixed $data
    *   The metadata to store.
    */
-  protected function setMetadata(string $key, $data): void {
+  public function setMetadata(string $key, $data): void {
     $this->checkOwnership();
 
     $metadata = $this->tempStore->get(static::TEMPSTORE_METADATA_KEY);
@@ -250,27 +286,26 @@ class Stage implements LoggerAwareInterface {
   }
 
   /**
-   * Collects paths that Composer Stager should ignore.
+   * Collects paths that Composer Stager should exclude.
    *
-   * @return string[]
-   *   A list of paths that Composer Stager should ignore when creating the
+   * @return \PhpTuf\ComposerStager\API\Path\Value\PathListInterface
+   *   A list of paths that Composer Stager should exclude when creating the
    *   stage directory and applying staged changes to the active directory.
    *
    * @throws \Drupal\package_manager\Exception\StageException
-   *   Thrown if an exception occurs while collecting ignored paths.
+   *   Thrown if an exception occurs while collecting paths to exclude.
    *
    * @see ::create()
    * @see ::apply()
    */
-  protected function getIgnoredPaths(): array {
-    $event = new CollectIgnoredPathsEvent($this);
+  protected function getPathsToExclude(): PathListInterface {
+    $event = new CollectPathsToExcludeEvent($this, $this->pathLocator, $this->pathFactory);
     try {
-      $this->eventDispatcher->dispatch($event);
+      return $this->eventDispatcher->dispatch($event);
     }
     catch (\Throwable $e) {
       $this->rethrowAsStageException($e);
     }
-    return $event->getAll();
   }
 
   /**
@@ -309,26 +344,40 @@ class Stage implements LoggerAwareInterface {
     // to create a stage directory at around the same time. If an error occurs
     // while the event is being processed, the stage is marked as available.
     // @see ::dispatch()
-    $id = Crypt::randomBytesBase64();
+    // We specifically generate a random 32-character alphanumeric name in order
+    // to guarantee that the the stage ID won't start with -, which could cause
+    // it to be interpreted as an option if it's used as a command-line
+    // argument. (For example,
+    // \Drupal\Component\Utility\Crypt::randomBytesBase64() would be vulnerable
+    // to this; the stage ID needs to be unique, but not cryptographically so.)
+    $id = (new Random())->name(32);
     // Re-acquire the tempstore to ensure that the lock is written by whoever is
     // actually logged in (or not) right now, since it's possible that the stage
     // was instantiated (i.e., __construct() was called) by a different session,
     // which would result in the lock having the wrong owner and the stage not
     // being claimable by whoever is actually creating it.
     $this->tempStore = $this->tempStoreFactory->get('package_manager_stage');
-    $this->tempStore->set(static::TEMPSTORE_LOCK_KEY, [$id, static::class]);
+    // For the lock value, we use both the stage's class and its type in order
+    // to prevent a stage from being manipulated by two different classes during
+    // a single life cycle.
+    $this->tempStore->set(static::TEMPSTORE_LOCK_KEY, [
+      $id,
+      static::class,
+      $this->getType(),
+    ]);
     $this->claim($id);
 
     $active_dir = $this->pathFactory->create($this->pathLocator->getProjectRoot());
     $stage_dir = $this->pathFactory->create($this->getStageDirectory());
 
-    $event = new PreCreateEvent($this, $this->getIgnoredPaths());
+    $excluded_paths = $this->getPathsToExclude();
+    $event = new PreCreateEvent($this, $excluded_paths);
     // If an error occurs and we won't be able to create the stage, mark it as
     // available.
     $this->dispatch($event, [$this, 'markAsAvailable']);
 
     try {
-      $this->beginner->begin($active_dir, $stage_dir, new PathList($event->getExcludedPaths()), NULL, $timeout);
+      $this->beginner->begin($active_dir, $stage_dir, $excluded_paths, NULL, $timeout);
     }
     catch (\Throwable $error) {
       $this->destroy();
@@ -407,7 +456,7 @@ class Stage implements LoggerAwareInterface {
 
     // If constraints were changed, update those packages.
     if ($runtime || $dev) {
-      $command = array_merge(['update', '--with-all-dependencies'], $runtime, $dev);
+      $command = array_merge(['update', '--with-all-dependencies', '--optimize-autoloader'], $runtime, $dev);
       $do_stage($command);
     }
     $this->dispatch(new PostRequireEvent($this, $runtime, $dev));
@@ -440,27 +489,24 @@ class Stage implements LoggerAwareInterface {
     $active_dir = $this->pathFactory->create($this->pathLocator->getProjectRoot());
     $stage_dir = $this->pathFactory->create($this->getStageDirectory());
 
+    $excluded_paths = $this->getPathsToExclude();
+    $event = new PreApplyEvent($this, $excluded_paths);
     // If an error occurs while dispatching the events, ensure that ::destroy()
     // doesn't think we're in the middle of applying the staged changes to the
     // active directory.
-    $event = new PreApplyEvent($this, $this->getIgnoredPaths());
     $this->tempStore->set(self::TEMPSTORE_APPLY_TIME_KEY, $this->time->getRequestTime());
-    $this->dispatch($event, $this->setNotApplying());
+    $this->dispatch($event, $this->setNotApplying(...));
 
     // Create a marker file so that we can tell later on if the commit failed.
     $this->failureMarker->write($this, $this->getFailureMarkerMessage());
-    // Exclude the failure file from the commit operation.
-    $ignored_paths = new PathList($event->getExcludedPaths());
-    $ignored_paths->add([
-      $this->failureMarker->getPath(),
-    ]);
 
     try {
-      $this->committer->commit($stage_dir, $active_dir, $ignored_paths, NULL, $timeout);
+      $this->committer->commit($stage_dir, $active_dir, $excluded_paths, NULL, $timeout);
     }
     catch (InvalidArgumentException | PreconditionException $e) {
       // The commit operation has not started yet, so we can clear the failure
-      // marker.
+      // marker and release the flag that says we're applying.
+      $this->setNotApplying();
       $this->failureMarker->clear();
       $this->rethrowAsStageException($e);
     }
@@ -469,8 +515,10 @@ class Stage implements LoggerAwareInterface {
       // is in an indeterminate state. Release the flag which says we're still
       // applying, because in this situation, the site owner should probably
       // restore everything from a backup.
-      $this->setNotApplying()();
-      throw new ApplyFailedException($this, (string) $this->getFailureMarkerMessage(), $throwable->getCode(), $throwable);
+      $this->setNotApplying();
+      // Update the marker file with the information from the throwable.
+      $this->failureMarker->write($this, $this->getFailureMarkerMessage(), $throwable);
+      throw new ApplyFailedException($this, $this->failureMarker->getMessage(), $throwable->getCode(), $throwable);
     }
     $this->failureMarker->clear();
     $this->setMetadata(self::TEMPSTORE_CHANGES_APPLIED, TRUE);
@@ -478,15 +526,9 @@ class Stage implements LoggerAwareInterface {
 
   /**
    * Returns a closure that marks this stage as no longer being applied.
-   *
-   * @return \Closure
-   *   A closure that, when called, marks this stage as no longer in the process
-   *   of being applied to the active directory.
    */
-  private function setNotApplying(): \Closure {
-    return function (): void {
-      $this->tempStore->delete(self::TEMPSTORE_APPLY_TIME_KEY);
-    };
+  private function setNotApplying(): void {
+    $this->tempStore->delete(self::TEMPSTORE_APPLY_TIME_KEY);
   }
 
   /**
@@ -511,7 +553,7 @@ class Stage implements LoggerAwareInterface {
     // unlikely to call newly added code during the current request.
     $this->eventDispatcher = \Drupal::service('event_dispatcher');
 
-    $release_apply = $this->setNotApplying();
+    $release_apply = $this->setNotApplying(...);
     $this->dispatch(new PostApplyEvent($this), $release_apply);
     $release_apply();
   }
@@ -537,26 +579,16 @@ class Stage implements LoggerAwareInterface {
       throw new StageException($this, 'Cannot destroy the stage directory while it is being applied to the active directory.');
     }
 
-    $this->dispatch(new PreDestroyEvent($this));
-    $staging_root = $this->getStagingRoot();
-    // If the stage root directory exists, delete it and everything in it.
-    if (file_exists($staging_root)) {
-      try {
-        $this->fileSystem->deleteRecursive($staging_root, function (string $path): void {
-          $this->fileSystem->chmod($path, 0777);
-        });
-      }
-      catch (FileException) {
-        // Deliberately swallow the exception so that the stage will be marked
-        // as available and the post-destroy event will be fired, even if the
-        // stage directory can't actually be deleted. The file system service
-        // logs the exception, so we don't need to do anything else here.
-      }
+    // If the stage directory exists, queue it to be automatically cleaned up
+    // later by a queue (which may or may not happen during cron).
+    // @see \Drupal\package_manager\Plugin\QueueWorker\Cleaner
+    if ($this->stageDirectoryExists()) {
+      $this->queueFactory->get('package_manager_cleanup')
+        ->createItem($this->getStageDirectory());
     }
 
     $this->storeDestroyInfo($force, $message);
     $this->markAsAvailable();
-    $this->dispatch(new PostDestroyEvent($this));
   }
 
   /**
@@ -596,6 +628,8 @@ class Stage implements LoggerAwareInterface {
     }
 
     if (isset($error)) {
+      // Ensure the error is logged for post-mortem diagnostics.
+      Error::logException($this->logger, $error);
       if ($on_error) {
         $on_error();
       }
@@ -649,7 +683,7 @@ class Stage implements LoggerAwareInterface {
       )->render());
     }
 
-    if ($stored_lock === [$unique_id, static::class]) {
+    if ($stored_lock === [$unique_id, static::class, $this->getType()]) {
       $this->lock = $stored_lock;
       return $this;
     }
@@ -738,6 +772,21 @@ class Stage implements LoggerAwareInterface {
     return $dir;
   }
 
+  /**
+   * Determines if the stage directory exists.
+   *
+   * @return bool
+   *   TRUE if the directory exists, otherwise FALSE.
+   */
+  public function stageDirectoryExists(): bool {
+    try {
+      return is_dir($this->getStageDirectory());
+    }
+    catch (\LogicException) {
+      return FALSE;
+    }
+  }
+
   /**
    * Checks if staged changes are being applied to the active directory.
    *

package_manager/src/StatusCheckTrait.php

@@ -4,8 +4,9 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager;
 
-use Drupal\package_manager\Event\CollectIgnoredPathsEvent;
+use Drupal\package_manager\Event\CollectPathsToExcludeEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
 use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 
 /**
@@ -21,36 +22,32 @@ trait StatusCheckTrait {
   /**
    * Runs a status check for a stage and returns the results, if any.
    *
-   * @param \Drupal\package_manager\Stage $stage
+   * @param \Drupal\package_manager\StageBase $stage
    *   The stage to run the status check for.
    * @param \Symfony\Contracts\EventDispatcher\EventDispatcherInterface $event_dispatcher
    *   (optional) The event dispatcher service.
+   * @param \Drupal\package_manager\PathLocator $path_locator
+   *   (optional) The path locator service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $path_factory
+   *   (optional) The path factory service.
    *
    * @return \Drupal\package_manager\ValidationResult[]
    *   The results of the status check. If a readiness check was also done,
    *   its results will be included.
    */
-  protected function runStatusCheck(Stage $stage, EventDispatcherInterface $event_dispatcher = NULL): array {
+  protected function runStatusCheck(StageBase $stage, EventDispatcherInterface $event_dispatcher = NULL, PathLocator $path_locator = NULL, PathFactoryInterface $path_factory = NULL): array {
     $event_dispatcher ??= \Drupal::service('event_dispatcher');
+    $path_locator ??= \Drupal::service(PathLocator::class);
+    $path_factory ??= \Drupal::service(PathFactoryInterface::class);
     try {
-      $ignored_paths_event = new CollectIgnoredPathsEvent($stage);
-      $event_dispatcher->dispatch($ignored_paths_event);
-      $event = new StatusCheckEvent($stage, $ignored_paths_event->getAll());
+      $paths_to_exclude_event = new CollectPathsToExcludeEvent($stage, $path_locator, $path_factory);
+      $event_dispatcher->dispatch($paths_to_exclude_event);
     }
     catch (\Throwable $throwable) {
-      // We can dispatch the status check event without the ignored paths, but
-      // it must be set explicitly to NULL, to allow those status checks to run
-      // that do not need the ignored paths.
-      $event = new StatusCheckEvent($stage, NULL);
-      // Add the error that was encountered so that regardless of any other
-      // validation errors BaseRequirementsFulfilledValidator will stop the
-      // event propagation after the base requirement validators have run.
-      // @see \Drupal\package_manager\Validator\BaseRequirementsFulfilledValidator
-      $event->addErrorFromThrowable($throwable, t('Unable to collect the ignored paths.'));
+      $paths_to_exclude_event = $throwable;
     }
-
-    $event_dispatcher->dispatch($event);
-    return $event->getResults();
+    $event = new StatusCheckEvent($stage, $paths_to_exclude_event);
+    return $event_dispatcher->dispatch($event)->getResults();
   }
 
 }

package_manager/src/TranslatableStringAdapter.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager;
+
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use PhpTuf\ComposerStager\API\Translation\Service\TranslatorInterface;
+use PhpTuf\ComposerStager\API\Translation\Value\TranslatableInterface;
+use PhpTuf\ComposerStager\API\Translation\Value\TranslationParametersInterface;
+
+/**
+ * An adapter for interoperable string translation.
+ *
+ * This class is designed to adapt Drupal's style of string translation so it
+ * can be used with the Symfony-inspired architecture used by Composer Stager.
+ *
+ * If this object is cast to a string, it will be translated by Drupal's
+ * translation system. It will ONLY be translated by Composer Stager if the
+ * trans() method is explicitly called.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class TranslatableStringAdapter extends TranslatableMarkup implements TranslatableInterface, TranslationParametersInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getAll(): array {
+    return $this->getArguments();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function trans(?TranslatorInterface $translator = NULL, ?string $locale = NULL): string {
+    // This method is NEVER used by Drupal to translate the underlying string;
+    // it exists solely for Composer Stager's translation system to
+    // transparently translate Drupal strings using its own architecture.
+    return $translator->trans(
+      $this->getUntranslatedString(),
+      $this,
+      // The 'context' option is the closest analogue to the Symfony-inspired
+      // concept of translation domains.
+      $this->getOption('context'),
+      $locale ?? $this->getOption('langcode'),
+    );
+  }
+
+}

package_manager/src/TranslatableStringFactory.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\package_manager;
+
+use Drupal\Core\StringTranslation\TranslationInterface;
+use PhpTuf\ComposerStager\API\Translation\Factory\TranslatableFactoryInterface;
+use PhpTuf\ComposerStager\API\Translation\Service\DomainOptionsInterface;
+use PhpTuf\ComposerStager\API\Translation\Value\TranslatableInterface;
+use PhpTuf\ComposerStager\API\Translation\Value\TranslationParametersInterface;
+
+/**
+ * Creates translatable strings that can interoperate with Composer Stager.
+ *
+ * @internal
+ *   This is an internal part of Package Manager and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class TranslatableStringFactory implements TranslatableFactoryInterface {
+
+  /**
+   * Constructs a TranslatableStringFactory object.
+   *
+   * @param \PhpTuf\ComposerStager\API\Translation\Factory\TranslatableFactoryInterface $decorated
+   *   The decorated translatable factory service.
+   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
+   *   The string translation service.
+   */
+  public function __construct(
+    private readonly TranslatableFactoryInterface $decorated,
+    private readonly TranslationInterface $translation,
+  ) {}
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createDomainOptions(): DomainOptionsInterface {
+    return $this->decorated->createDomainOptions();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createTranslatableMessage(string $message, ?TranslationParametersInterface $parameters = NULL, ?string $domain = NULL,): TranslatableInterface {
+    return new TranslatableStringAdapter(
+      $message,
+      $parameters?->getAll() ?? [],
+      // TranslatableMarkup's 'context' option is the closest analogue to the
+      // $domain parameter.
+      ['context' => $domain ?? ''],
+      $this->translation,
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createTranslationParameters(array $parameters = []): TranslationParametersInterface {
+    return $this->decorated->createTranslationParameters($parameters);
+  }
+
+}

package_manager/src/ValidationResult.php

@@ -7,9 +7,12 @@ namespace Drupal\package_manager;
 use Drupal\Component\Assertion\Inspector;
 use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\system\SystemManager;
+use PhpTuf\ComposerStager\API\Exception\ExceptionInterface;
 
 /**
  * A value object to contain the results of a validation.
+ *
+ * @property \Drupal\Core\StringTranslation\TranslatableMarkup[] $messages
  */
 final class ValidationResult {
 
@@ -20,9 +23,9 @@ final class ValidationResult {
    *   The severity of the result. Should be one of the
    *   SystemManager::REQUIREMENT_* constants.
    * @param \Drupal\Core\StringTranslation\TranslatableMarkup[]|string[] $messages
-   *   The error messages.
+   *   The result messages.
    * @param \Drupal\Core\StringTranslation\TranslatableMarkup|null $summary
-   *   A summary of the result messages.
+   *   A succinct summary of the result.
    * @param bool $assert_translatable
    *   Whether to assert the messages are translatable. Internal use only.
    *
@@ -30,7 +33,12 @@ final class ValidationResult {
    *   Thrown if $messages is empty, or if it has 2 or more items but $summary
    *   is NULL.
    */
-  private function __construct(protected int $severity, protected array $messages, protected ?TranslatableMarkup $summary, bool $assert_translatable) {
+  private function __construct(
+    public readonly int $severity,
+    private array $messages,
+    public readonly ?TranslatableMarkup $summary,
+    bool $assert_translatable
+  ) {
     if ($assert_translatable) {
       assert(Inspector::assertAll(fn ($message) => $message instanceof TranslatableMarkup, $messages));
     }
@@ -42,6 +50,18 @@ final class ValidationResult {
     }
   }
 
+  /**
+   * Implements magic ::__get() method.
+   */
+  public function __get(string $name): mixed {
+    return match ($name) {
+      // The messages must be private so that they cannot be mutated by external
+      // code, but we want to allow callers to access them in the same way as
+      // $this->summary and $this->severity.
+      'messages' => $this->messages,
+    };
+  }
+
   /**
    * Creates an error ValidationResult object from a throwable.
    *
@@ -52,8 +72,11 @@ final class ValidationResult {
    *
    * @return static
    */
-  public static function createErrorFromThrowable(\Throwable $throwable, ?TranslatableMarkup $summary = NULL): self {
-    return new static(SystemManager::REQUIREMENT_ERROR, [$throwable->getMessage()], $summary, FALSE);
+  public static function createErrorFromThrowable(\Throwable $throwable, ?TranslatableMarkup $summary = NULL): static {
+    // All Composer Stager exceptions are translatable.
+    $is_translatable = $throwable instanceof ExceptionInterface;
+    $message = $is_translatable ? $throwable->getTranslatableMessage() : $throwable->getMessage();
+    return new static(SystemManager::REQUIREMENT_ERROR, [$message], $summary, $is_translatable);
   }
 
   /**
@@ -66,7 +89,7 @@ final class ValidationResult {
    *
    * @return static
    */
-  public static function createError(array $messages, ?TranslatableMarkup $summary = NULL): self {
+  public static function createError(array $messages, ?TranslatableMarkup $summary = NULL): static {
     return new static(SystemManager::REQUIREMENT_ERROR, $messages, $summary, TRUE);
   }
 
@@ -80,41 +103,10 @@ final class ValidationResult {
    *
    * @return static
    */
-  public static function createWarning(array $messages, ?TranslatableMarkup $summary = NULL): self {
+  public static function createWarning(array $messages, ?TranslatableMarkup $summary = NULL): static {
     return new static(SystemManager::REQUIREMENT_WARNING, $messages, $summary, TRUE);
   }
 
-  /**
-   * Gets the summary.
-   *
-   * @return \Drupal\Core\StringTranslation\TranslatableMarkup|null
-   *   The summary.
-   */
-  public function getSummary(): ?TranslatableMarkup {
-    return $this->summary;
-  }
-
-  /**
-   * Gets the messages.
-   *
-   * @return \Drupal\Core\StringTranslation\TranslatableMarkup[]|string[]
-   *   The error or warning messages.
-   */
-  public function getMessages(): array {
-    return $this->messages;
-  }
-
-  /**
-   * The severity of the result.
-   *
-   * @return int
-   *   Either SystemManager::REQUIREMENT_ERROR or
-   *   SystemManager::REQUIREMENT_WARNING.
-   */
-  public function getSeverity(): int {
-    return $this->severity;
-  }
-
   /**
    * Returns the overall severity for a set of validation results.
    *
@@ -127,7 +119,7 @@ final class ValidationResult {
    */
   public static function getOverallSeverity(array $results): int {
     foreach ($results as $result) {
-      if ($result->getSeverity() === SystemManager::REQUIREMENT_ERROR) {
+      if ($result->severity === SystemManager::REQUIREMENT_ERROR) {
         return SystemManager::REQUIREMENT_ERROR;
       }
     }
@@ -149,9 +141,9 @@ final class ValidationResult {
    */
   public static function isEqual(self $a, self $b): bool {
     return (
-      $a->getSeverity() === $b->getSeverity() &&
-      strval($a->getSummary()) === strval($b->getSummary()) &&
-      array_map('strval', $a->getMessages()) === array_map('strval', $b->getMessages())
+      $a->severity === $b->severity &&
+      strval($a->summary) === strval($b->summary) &&
+      array_map('strval', $a->messages) === array_map('strval', $b->messages)
     );
   }
 

package_manager/src/Validator/AllowedScaffoldPackagesValidator.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\package_manager\Validator;
 
+use Drupal\Component\Serialization\Json;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\package_manager\Event\StatusCheckEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -34,8 +35,8 @@ final class AllowedScaffoldPackagesValidator implements EventSubscriberInterface
    *   The path locator service.
    */
   public function __construct(
-    private ComposerInspector $composerInspector,
-    private PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
   ) {}
 
   /**
@@ -52,7 +53,7 @@ final class AllowedScaffoldPackagesValidator implements EventSubscriberInterface
       "drupal/legacy-scaffold-assets",
       "drupal/core",
     ];
-    $extra = json_decode($this->composerInspector->getConfig('extra', $path . '/composer.json'), TRUE);
+    $extra = Json::decode($this->composerInspector->getConfig('extra', $path . '/composer.json'));
     $allowed_packages = $extra['drupal-scaffold']['allowed-packages'] ?? [];
     $extra_packages = array_diff($allowed_packages, $implicitly_allowed_packages);
     if (!empty($extra_packages)) {

package_manager/src/Validator/BaseRequirementValidatorTrait.php

@@ -7,6 +7,7 @@ namespace Drupal\package_manager\Validator;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreOperationStageEvent;
+use Drupal\package_manager\Event\PreRequireEvent;
 use Drupal\package_manager\Event\StatusCheckEvent;
 
 /**
@@ -40,6 +41,7 @@ trait BaseRequirementValidatorTrait {
 
     return [
       PreCreateEvent::class => ['validate', $priority],
+      PreRequireEvent::class => ['validate', $priority],
       PreApplyEvent::class => ['validate', $priority],
       StatusCheckEvent::class => ['validate', $priority],
     ];