Function resolve 

pub fn resolve(
    referenced_aliases: &HashSet<String>,
    workspace_config_paths: &[PathBuf],
    cargo_home_config_path: Option<&Path>,
    config_cache: &ConfigFileCache,
    policy: &RegistryAccessPolicy,
) -> (CargoConfig, SourceReplacement)

Resolves referenced_aliases against the .cargo/config.toml hierarchy and $CARGO_HOME/config.toml.

Separately resolves the [source.crates-io] replace-with chain (if any) for plain dependencies.

referenced_aliases is every distinct registry = "<alias>" value this manifest’s dependencies declared; workspace_config_paths and cargo_home_config_path come from crate::parser’s merged ancestor walk (closest-first); config_cache memoizes each distinct config file’s raw contents (spec NFR-005); policy gates every WorkspaceDeclared RegistryIndex this call constructs.

Precedence

For one alias (or the [source] chain): the closest workspace .cargo/config.toml entry wins outright — if it resolves, the $CARGO_HOME tier (config file and environment variables alike) is never consulted for that alias at all. This is a deliberate divergence from Cargo’s own env-beats-all-config-files precedence: since environment variables and $CARGO_HOME/config.toml are folded into one $CARGO_HOME-provenance tier here, an environment variable can never resurrect a credential for an alias a workspace file has shadowed (spec FR-009/US-004) — see the module-level security-model docs.

Examples

use deps_cargo::config::{ConfigFileCache, SourceReplacement, resolve};
use deps_core::net_policy::RegistryAccessPolicy;
use std::collections::HashSet;

let aliases: HashSet<String> = std::iter::once("unconfigured".to_string()).collect();
let cache = ConfigFileCache::new();
let policy = RegistryAccessPolicy::default();
let (config, source_replacement) = resolve(&aliases, &[], None, &cache, &policy);
assert!(config.get("unconfigured").is_none());
assert_eq!(source_replacement, SourceReplacement::None);