enable cargo-component lock files

Cargo.toml

@@ -38,7 +38,7 @@ tracing-subscriber = { version = "0.3.18", default-features = false, features =
 ] }
 wasm-pkg-common = { version = "0.8.5", path = "crates/wasm-pkg-common" }
 wasm-pkg-client = { version = "0.8.5", path = "crates/wasm-pkg-client" }
+wasm-metadata = "0.220"
+wit-component = "0.220"
+wit-parser = "0.220"
 wasm-pkg-core = { version = "0.8.5", path = "crates/wasm-pkg-core" }
-wasm-metadata = "0.219"
-wit-component = "0.219"
-wit-parser = "0.219"

crates/wasm-pkg-core/src/lock.rs

@@ -16,7 +16,7 @@ use tokio::{
 };
 use wasm_pkg_client::{ContentDigest, PackageRef};
 
-use crate::resolver::{DependencyResolution, DependencyResolutionMap};
+use crate::resolver::{DependencyResolution, DependencyResolutionMap, DEFAULT_REGISTRY_NAME};
 
 /// The default name of the lock file.
 pub const LOCK_FILE_NAME: &str = "wkg.lock";
@@ -279,6 +279,17 @@ pub struct LockedPackage {
     pub versions: Vec<LockedPackageVersion>,
 }
 
+impl LockedPackage {
+    /// Gets the key used in sorting and searching the package list.
+    pub fn key(&self) -> (&str, &str, &str) {
+        (
+            self.name.namespace().as_ref(),
+            self.name.name().as_ref(),
+            self.registry.as_deref().unwrap_or(DEFAULT_REGISTRY_NAME),
+        )
+    }
+}
+
 impl Ord for LockedPackage {
     fn cmp(&self, other: &Self) -> Ordering {
         if self.name == other.name {
@@ -306,6 +317,13 @@ pub struct LockedPackageVersion {
     pub digest: ContentDigest,
 }
 
+impl LockedPackageVersion {
+    /// Gets the sort key for the locked package version.
+    pub fn key(&self) -> String {
+        self.requirement.to_string()
+    }
+}
+
 #[derive(Debug, Deserialize)]
 struct LockFileIntermediate {
     version: u64,

crates/wasm-pkg-core/src/resolver.rs

@@ -364,63 +364,116 @@ impl<'a> DependencyResolver<'a> {
         name: &PackageRef,
         dependency: &Dependency,
     ) -> Result<()> {
-        self.add_dependency_internal(name, dependency, false).await
+        self.add_dependency_internal(name, dependency, false)
+            .await
     }
 
-    /// Add a dependency to the resolver. If the dependency already exists, then it will be
-    /// overridden.
-    pub async fn override_dependency(
+    /// Add a concrete component dependency to the resolver. If the dependency already exists, then it will be ignored.
+    /// To override an existing dependency, use [`override_dependency`](Self::override_dependency).
+    pub async fn add_shallow_dependency(
         &mut self,
         name: &PackageRef,
         dependency: &Dependency,
     ) -> Result<()> {
-        self.add_dependency_internal(name, dependency, true).await
+        self.add_shallow_dependency_internal(name, dependency, false)
+            .await
     }
 
-    async fn add_dependency_internal(
+    async fn add_shallow_dependency_internal(
         &mut self,
         name: &PackageRef,
         dependency: &Dependency,
         force_override: bool,
     ) -> Result<()> {
         match dependency {
             Dependency::Package(package) => {
-                // Dependency comes from a registry, add a dependency to the resolver
-                let registry_name = package.registry.as_deref().or_else(|| {
-                    self.client.client().ok().and_then(|client| {
-                        client
-                            .config()
-                            .resolve_registry(name)
-                            .map(|reg| reg.as_ref())
-                    })
+                self.add_registry_package(name, force_override, package)?
+            }
+            Dependency::Local(p) => {
+                // A local path dependency, insert a resolution immediately
+                let res = DependencyResolution::Local(LocalResolution {
+                    name: name.clone(),
+                    path: p.clone(),
                 });
-                let package_name = package.name.clone().unwrap_or_else(|| name.clone());
-
-                // Resolve the version from the lock file if there is one
-                let locked = match self.lock_file.as_ref().and_then(|resolver| {
-                    resolver
-                        .resolve(registry_name, &package_name, &package.version)
-                        .transpose()
-                }) {
-                    Some(Ok(locked)) => Some(locked),
-                    Some(Err(e)) => return Err(e),
-                    _ => None,
-                };
-
-                if !force_override
-                    && (self.resolutions.contains_key(name) || self.dependencies.contains_key(name))
-                {
+
+                if !force_override && self.resolutions.contains_key(name) {
                     tracing::debug!(%name, "dependency already exists and override is not set, ignoring");
                     return Ok(());
                 }
-                self.dependencies.insert(
-                    name.to_owned(),
-                    RegistryDependency {
-                        package: package_name,
-                        version: package.version.clone(),
-                        locked: locked.map(|l| (l.version.clone(), l.digest.clone())),
-                    },
-                );
+
+                let prev = self.resolutions.insert(name.clone(), res);
+                assert!(prev.is_none());
+            }
+        }
+
+        Ok(())
+    }
+
+    /// Add a dependency to the resolver. If the dependency already exists, then it will be
+    /// overridden.
+    pub async fn override_dependency(
+        &mut self,
+        name: &PackageRef,
+        dependency: &Dependency,
+    ) -> Result<()> {
+        self.add_dependency_internal(name, dependency, true)
+            .await
+    }
+
+    fn add_registry_package(
+        &mut self,
+        name: &PackageRef,
+        force_override: bool,
+        package: &RegistryPackage,
+    ) -> Result<()> {
+        // Dependency comes from a registry, add a dependency to the resolver
+        let registry_name = package.registry.as_deref().or_else(|| {
+            self.client.client().ok().and_then(|client| {
+                client
+                    .config()
+                    .resolve_registry(name)
+                    .map(|reg| reg.as_ref())
+            })
+        });
+        let package_name = package.name.clone().unwrap_or_else(|| name.clone());
+
+        // Resolve the version from the lock file if there is one
+        let locked = match self.lock_file.as_ref().and_then(|resolver| {
+            resolver
+                .resolve(registry_name, &package_name, &package.version)
+                .transpose()
+        }) {
+            Some(Ok(locked)) => Some(locked),
+            Some(Err(e)) => return Err(e),
+            _ => None,
+        };
+
+        if !force_override
+            && (self.resolutions.contains_key(name) || self.dependencies.contains_key(name))
+        {
+            tracing::debug!(%name, "dependency already exists and override is not set, ignoring");
+            return Ok(());
+        }
+        self.dependencies.insert(
+            name.to_owned(),
+            RegistryDependency {
+                package: package_name,
+                version: package.version.clone(),
+                locked: locked.map(|l| (l.version.clone(), l.digest.clone())),
+            },
+        );
+        Ok(())
+    }
+
+    async fn add_dependency_internal(
+        &mut self,
+        name: &PackageRef,
+        dependency: &Dependency,
+        force_override: bool,
+    ) -> Result<()> {
+        match dependency {
+            Dependency::Package(package) => {
+                self.add_registry_package(name, force_override, package)?
             }
             Dependency::Local(p) => {
                 // A local path dependency, insert a resolution immediately
@@ -588,10 +641,11 @@ fn find_latest_release<'a>(
     versions: &'a [VersionInfo],
     req: &VersionReq,
 ) -> Option<&'a VersionInfo> {
-    versions
+    let versions = versions
         .iter()
         .filter(|info| !info.yanked && req.matches(&info.version))
-        .max_by(|a, b| a.version.cmp(&b.version))
+        .max_by(|a, b| a.version.cmp(&b.version));
+    versions
 }
 
 // NOTE(thomastaylor312): This is copied from the old wit package in the cargo-component and broken