Trait SourcePolicy 

pub trait SourcePolicy: Send + Sync {
    // Provided methods
    fn can_resolve_source(&self, source: &DependencySource) -> bool { ... }
    fn source_is_public_registry_content(
        &self,
        source: &DependencySource,
    ) -> bool { ... }
}

What a DependencySource may be used for: resolution, vulnerability scanning, and cache-key/link trust.

Implementors guarantee can_resolve_source and source_is_public_registry_content answer independent questions — a source can be resolvable without being public-registry content (e.g. a non-mirroring alternate registry), so callers must not assume one implies the other.

Provided Methods

fn can_resolve_source(&self, source: &DependencySource) -> bool

Whether this ecosystem’s registry can resolve version data for source.

Hover, diagnostics, and code actions gate every registry lookup on this instead of crate::parser::DependencySource::is_version_resolvable directly, so an ecosystem whose Registry implementation routes more sources than the generic crates.io-shaped default (e.g. deps-cargo’s CargoRegistry, which additionally resolves a DependencySource::AlternateRegistry against a private sparse index) can opt those sources in without widening the Registry trait itself or touching any of this hook’s call sites.

Default: delegates to DependencySource::is_version_resolvable, so every ecosystem that does not override this method keeps its exact pre-existing resolvability answer.

Examples

use deps_core::lsp_helpers::SourcePolicy;
use deps_core::parser::DependencySource;

struct DefaultFormatter;
impl SourcePolicy for DefaultFormatter {}

assert!(DefaultFormatter.can_resolve_source(&DependencySource::Registry));
assert!(!DefaultFormatter.can_resolve_source(&DependencySource::AlternateRegistry {
    index: "https://index.mycorp.dev".into(),
    mirrors_crates_io: false,
}));

fn source_is_public_registry_content(&self, source: &DependencySource) -> bool

Whether source’s content is exactly the default public registry’s — safe to treat as such for OSV vulnerability scanning, cache-key signature construction, and hover heading links.

Default matches!(source, DependencySource::Registry) — every ecosystem with only one registry concept keeps its existing behavior. deps-cargo’s CargoFormatter overrides this to also accept AlternateRegistry { mirrors_crates_io: true, .. }: Cargo verifies per-version checksum equality against crates.io for a [source.crates-io] replace-with mirror, so its content is exactly as trustworthy as crates.io’s own, even though the fetch itself goes to the mirror’s index, not to crates.io (plan .local/specs/023-cargo-custom-registries/plan-1b.md §1.3, F1/F1b/F2).

Deliberately distinct from Self::can_resolve_source: an AlternateRegistry that is not a crates.io mirror is resolvable (this LSP can fetch its version data) but is not public-registry content (its data must not be treated as crates.io’s own for vulnerability-advisory or link purposes) — the two questions are orthogonal, and a single hook conflating them would force every non-Cargo ecosystem to answer a mirror-specific question it has no concept of.

Examples

use deps_core::lsp_helpers::SourcePolicy;
use deps_core::parser::DependencySource;

struct DefaultFormatter;
impl SourcePolicy for DefaultFormatter {}

assert!(DefaultFormatter.source_is_public_registry_content(&DependencySource::Registry));
assert!(!DefaultFormatter.source_is_public_registry_content(&DependencySource::AlternateRegistry {
    index: "https://index.mycorp.dev".into(),
    mirrors_crates_io: true,
}));

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors