Enum DependencySource 

#[non_exhaustive]
pub enum DependencySource {
    Registry,
    Git {
        url: String,
        rev: Option<String>,
    },
    Path {
        path: String,
    },
    Url {
        url: String,
    },
    Sdk {
        sdk: String,
    },
    Workspace,
    CustomRegistry {
        url: String,
    },
    AlternateRegistry {
        index: String,
        mirrors_crates_io: bool,
    },
}

Dependency source location (shared across all ecosystems).

Covers the union of all source types across Cargo, npm, PyPI, Go, Dart, Bundler, Maven, and Gradle ecosystems.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Registry

Default package registry (crates.io, npm, PyPI, pub.dev, rubygems.org, Maven Central).

Git

Git repository dependency.

Fields

url: String

rev: Option<String>

Git ref: commit SHA, tag, or branch name (ecosystem-specific semantics).

Path

Local filesystem path dependency.

Fields

path: String

Url

Direct URL to artifact (PyPI wheels, npm tarballs).

Fields

url: String

Sdk

SDK-provided dependency (Dart: sdk: flutter).

Fields

sdk: String

Workspace

Workspace-inherited dependency (Cargo: workspace = true).

CustomRegistry

Custom/alternative registry, named by an unresolved alias or raw index URL (Bundler custom sources, an unresolved Cargo registry = "my-corp").

This variant’s meaning is unchanged by AlternateRegistry’s addition: it always means “not yet resolved to a concrete index this LSP can query” — url may hold a bare alias ("my-corp") or a URL string, but never a value this LSP has validated and can fetch against. See AlternateRegistry for the resolved counterpart.

url is never redacted (unlike every tracing::warn! naming the same raw value — see deps_core::net_policy::redact_userinfo’s doc, #536): a literal registry-index carrying user:pass@ userinfo that fails to resolve lands here verbatim. Currently latent — nothing renders CustomRegistry::url in hover/diagnostics text today — but a future caller surfacing it must redact first, matching every logging call site.

Fields

url: String

AlternateRegistry

A custom/alternative registry resolved to a concrete, fetchable index URL.

Distinct from CustomRegistry so “resolved” is a type-level state instead of string-sniffing an unresolved alias vs. a URL. Produced only by a parser that validated index against its own registry-configuration source (e.g. deps-cargo’s .cargo/config.toml resolution) — deps-core itself never constructs this variant. index is the sparse+ prefix-stripped, https-only index URL; it carries no credential and is not itself an authorization decision — see the originating crate’s config-resolution module for how (and whether) a request against it is authenticated.

Fields

index: String

The resolved index URL, validated and normalized by the originating parser.

mirrors_crates_io: bool

true exactly when this source was reached via a [source.crates-io] replace-with chain (Cargo [source] mirroring, spec .local/specs/023-cargo-custom-registries/plan-1b.md §1.3) — as opposed to an explicit registry/registry-index naming a genuinely different, private registry.

Affects presentation and advisory gating only, never routing: Cargo verifies per-version checksum equality against crates.io for a mirror, so its content is exactly as trustworthy as crates.io’s own for vulnerability-scanning and hover-link purposes, even though the fetch itself still goes to index, not to crates.io. See crate::lsp_helpers::SourcePolicy::source_is_public_registry_content.

Implementations

impl DependencySource

pub fn is_registry(&self) -> bool

Returns true if this dependency comes from any registry (default or custom).

Registry dependencies support version fetching and update checks. Git, Path, Url, Sdk, and Workspace dependencies do not.

pub fn is_version_resolvable(&self) -> bool

Returns true if this LSP can resolve version data for this source against the registry client it actually queries.

Registry resolves to the ecosystem’s default public registry (crates.io, npm, PyPI, …), which every deps-* crate implements a client for. CustomRegistry names a private/alternative registry (e.g. Bundler source "https://gems.mycorp.com", Cargo registry = "my-corp") that this LSP has no client for — known limitation, tracked until private-registry client support exists. Diagnostics and hover must not silently fall back to checking a CustomRegistry dependency’s name against the public registry, so this deliberately diverges from is_registry() and returns false for it, alongside Git/Path/Url/Sdk/Workspace sources.

Also false for AlternateRegistry, even though it is resolved: this method answers “does the generic Registry trait (crates.io-shaped, one client per ecosystem) resolve this”, not “is version data reachable at all”. An ecosystem whose registry implements per-source routing (deps-cargo’s CargoRegistry) must use crate::lsp_helpers::SourcePolicy::can_resolve_source instead, which defaults to this method and is the only override point — see that method’s docs.

Trait Implementations

impl Clone for DependencySource

fn clone(&self) -> DependencySource

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DependencySource

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for DependencySource

impl PartialEq for DependencySource

fn eq(&self, other: &DependencySource) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for DependencySource