Enum DependencySource 

#[non_exhaustive]
pub enum DependencySource {
    Registry,
    Git {
        url: String,
        rev: Option<String>,
    },
    Path {
        path: String,
    },
    Url {
        url: String,
    },
    Sdk {
        sdk: String,
    },
    Workspace,
    CustomRegistry {
        url: String,
    },
    AlternateRegistry {
        index: String,
        mirrors_crates_io: bool,
    },
}

Dependency source location (shared across all ecosystems).

Covers the union of all source types across Cargo, npm, PyPI, Go, Dart, Bundler, Maven, and Gradle ecosystems.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Registry

Default package registry (crates.io, npm, PyPI, pub.dev, rubygems.org, Maven Central).

Git

Git repository dependency.

Fields

url: String

Repository URL.

rev: Option<String>

Git ref: commit SHA, tag, or branch name (ecosystem-specific semantics).

Path

Local filesystem path dependency.

Fields

path: String

Filesystem path, relative or absolute, as written in the manifest.

Url

Direct URL to artifact (PyPI wheels, npm tarballs).

Fields

url: String

URL the artifact is fetched from.

Sdk

SDK-provided dependency (Dart: sdk: flutter).

Fields

sdk: String

Name of the SDK providing this dependency.

Workspace

Workspace-inherited dependency (Cargo: workspace = true).

CustomRegistry

Custom/alternative registry, named by an unresolved alias or raw index URL (Bundler custom sources, an unresolved Cargo registry = "my-corp").

This variant’s meaning is unchanged by AlternateRegistry’s addition: it always means “not yet resolved to a concrete index this LSP can query” — url may hold a bare alias ("my-corp") or a URL string, but never a value this LSP has validated and can fetch against. See AlternateRegistry for the resolved counterpart.

url itself is stored raw (unresolved alias or a literal registry-index, possibly carrying user:pass@ userinfo or a credential-bearing query string) — never redact this field in place, since dedup_dependencies_by_source’s collision check and other equality-based logic must keep comparing the real value. DependencySource’s own Debug impl redacts it via RedactedUrl before it can reach a log line; any future caller rendering url into hover/diagnostics text (currently latent — nothing does today) must redact it the same way rather than relying on Debug alone.

Fields

url: String

Unresolved alias or raw index URL — redacted only when Debug-formatted (see the variant’s own doc).

AlternateRegistry

A custom/alternative registry resolved to a concrete, fetchable index URL.

Distinct from CustomRegistry so “resolved” is a type-level state instead of string-sniffing an unresolved alias vs. a URL. Produced only by a parser that validated index against its own registry-configuration source (e.g. deps-cargo’s .cargo/config.toml resolution) — deps-core itself never constructs this variant. index is the sparse+ prefix-stripped, https-only index URL — userinfo is rejected by validate_index_url before a URL can resolve to this variant, but a credential-bearing query string is not stripped there and CAN still be present (#935); DependencySource’s own Debug impl redacts index via RedactedUrl so a tracing::warn!(?source, ...) call site can never leak one. index is not itself an authorization decision — see the originating crate’s config-resolution module for how (and whether) a request against it is authenticated.

Fields

index: String

The resolved index URL, validated and normalized by the originating parser — redacted only when Debug-formatted (see the variant’s own doc).

mirrors_crates_io: bool

true exactly when this source was reached via a [source.crates-io] replace-with chain (Cargo [source] mirroring, spec .local/specs/023-cargo-custom-registries/plan-1b.md §1.3) — as opposed to an explicit registry/registry-index naming a genuinely different, private registry.

Affects presentation and advisory gating only, never routing: Cargo verifies per-version checksum equality against crates.io for a mirror, so its content is exactly as trustworthy as crates.io’s own for vulnerability-scanning and hover-link purposes, even though the fetch itself still goes to index, not to crates.io. See crate::lsp_helpers::SourcePolicy::source_is_public_registry_content.

Implementations

impl DependencySource

pub fn is_registry(&self) -> bool

Returns true if this dependency comes from any registry (default or custom).

Registry dependencies support version fetching and update checks. Git, Path, Url, Sdk, and Workspace dependencies do not.

pub fn is_version_resolvable(&self) -> bool

Returns true if this LSP can resolve version data for this source against the registry client it actually queries.

Registry resolves to the ecosystem’s default public registry (crates.io, npm, PyPI, …), which every deps-* crate implements a client for. CustomRegistry names a private/alternative registry (e.g. Bundler source "https://gems.mycorp.com", Cargo registry = "my-corp") that this LSP has no client for — known limitation, tracked until private-registry client support exists. Diagnostics and hover must not silently fall back to checking a CustomRegistry dependency’s name against the public registry, so this deliberately diverges from is_registry() and returns false for it, alongside Git/Path/Url/Sdk/Workspace sources.

Also false for AlternateRegistry, even though it is resolved: this method answers “does the generic Registry trait (crates.io-shaped, one client per ecosystem) resolve this”, not “is version data reachable at all”. An ecosystem whose registry implements per-source routing (deps-cargo’s CargoRegistry) must use crate::lsp_helpers::SourcePolicy::can_resolve_source instead, which defaults to this method and is the only override point — see that method’s docs.

Trait Implementations

impl Clone for DependencySource

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DependencySource

Hand-written, not derived (#935): a derived Debug would have printed Git.url, Url.url, CustomRegistry.url, and AlternateRegistry.index raw — every one of them can carry a credential (userinfo or a query-string secret) that never gets a chance to be stripped, since none of these fields is validated/redacted before construction on every code path (see DependencySource::AlternateRegistry and DependencySource::CustomRegistry’s own docs). Any tracing::warn!(?source, ...) or {source:?} call site — a common, idiomatic alternative to a hand-rolled Display — must not be able to reopen this leak, so it is closed once here at the type level instead of at each logging call site. Every variant and field is still shown (this is not a summary); only URL-bearing field values are routed through RedactedUrl first.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DependencySource

impl PartialEq for DependencySource

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DependencySource