What is the reason composer can't resolve dependencies?

Question

Composer

Hello. Ask for help from the community.
There is a private package structure that looks like this:

Scheme

In words: there is a basis package that the common package needs. These two packages are needed by all the packages below, which usually require only basis and common + other dependencies from public packages.
What is the problem: individually, each module quietly installs the basis and common packages for itself, but as soon as these modules are loaded as a dependency of the final application, a problem arises:

Scheme

Mistake:

Problem 1
- Installation request for vendor/letters dev-master -> satisfiable by vendor/letters[dev-master].
- vendor/letters dev-master requires vendor/common dev-master -> no matching package found.
Problem 2
- Installation request for vendor/tasks dev-master -> satisfiable by vendor/tasks[dev-master].
- vendor/tasks dev-master requires vendor/common dev-master -> no matching package found.
Problem 3
- Installation request for vendor/contractors dev-master -> satisfiable by vendor/contractors[dev-master].
- vendor/contractors dev-master requires vendor/common dev-master -> no matching package found.
Problem 4
- Installation request for vendor/filestorage dev-master -> satisfiable by vendor/filestorage[dev-master].
- vendor/filestorage dev-master requires vendor/common dev-master -> no matching package found.
Problem 5
- Installation request for vendor/partners dev-master -> satisfiable by vendor/partners[dev-master].
- vendor/partners dev-master requires vendor/common dev-master -> no matching package found.
Problem 6
- Installation request for vendor/userauth dev-master -> satisfiable by vendor/userauth[dev-master].
- vendor/userauth dev-master requires vendor/common dev-master -> no matching package found.
Problem 7
- vendor/keys dev-master requires vendor/common dev-master -> no matching package found.
- vendor/keys dev-master requires vendor/common dev-master -> no matching package found.
- Installation request for vendor/keys dev-master -> satisfiable by vendor/keys[dev-master].
Potential causes:
- A typo in the package name
- The package is not available in a stable-enough version according to your minimum-stability setting
see for more details.
- It's a private package and you forgot to add a custom repository to find it

application composer.json

{
  "type" : "project",
  "minimum-stability" : "dev",
  "require" : {
    "php" : ">=7.2.0",
    "yiisoft/yii2" : "~2.0.6",
    "yiisoft/yii2-bootstrap" : "~2.0.0",
    "yiisoft/yii2-swiftmailer" : "~2.0.0 || ~2.1.0",
    "yiisoft/yii2-httpclient" : "~2.0.0",
    "mustache/mustache" : "*",
    "2amigos/yii2-ckeditor-widget" : "*",
    "kartik-v/yii2-mpdf" : "dev-master",
    "vendor/letters": "dev-master",
    "vendor/tasks": "dev-master",
    "vendor/contractors": "dev-master",
    "vendor/filestorage": "dev-master",
    "vendor/partners": "dev-master",
    "vendor/keys": "dev-master",
    "vendor/documents": "dev-master",
    "vendor/userauth": "dev-master"
  },
  "require-dev" : {
    "yiisoft/yii2-debug" : "~2.0.0",
    "yiisoft/yii2-gii" : "~2.0.0",
    "yiisoft/yii2-faker" : "~2.0.0",
    "codeception/base" : "^2.2.3",
    "codeception/verify" : "~0.3.1"
  },
  "config" : {
    "process-timeout" : 1800,
    "fxp-asset" : {
      "enabled" : false
    }
  },
  "repositories" : [
    {
      "type" : "composer",
      "url" : "https://asset-packagist.org"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/letters.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/keys.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/tasks.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/filestorage.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/userauth.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/partners.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/documents.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/keys.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/documents.git"
    },
    {
      "type": "git",
      "url": "[email protected]:vendor/contractors.git"
    }
  ]
}

I will attach all composer.json files in the comments, because toaster prohibits creating questions with more than 10k characters.

Answer 1

I can assume that the cause of the problem is that in the "repositories" section of the main composer.json you do not specify where to look for the vendor/basis and vendor/common packages. Because these repositories are private and not found through a public package index, Composer needs to know where they are (similar to other private packages). I can assume that for the sake of optimization, Composer parses only the main descriptor to determine the location of packages.
There is also the option that the vendor/basis and vendor/common packages will need to be added directly to the main composer.json of the application. At least when I last encountered such a situation - it helped.