better story for local dependencies

[dakom]

this is more of a discussion point than a definite bug or feature request, but I figured it could help to share my anecdotal experience and a pain point, maybe someone will have ideas about how to improve.

When I point to a wit on a registry, everything just works, all dependencies are resolved automatically, I don't need to do anything "extra".

However, when I point to a wit locally, I have to redefine the dependencies in Cargo.toml

This feels a bit weird - if it's already denoted in the .wit, why do I need to redefine these same exact dependencies again?

From a technical perspective - I think I see a problem here, and it does make sense to punt on this until there's a well-reasoned solution: when you define the dependencies locally, you have a choice of loading them from the registry (i.e. semver syntax) or loading locally (i.e. a direct path), and, in fact, one might think that the default should be to load locally in this case - but in practice, this is usually not what you actually want to do (i.e. I might be working on my local custom wit, but it depends on wasi::io, but I have no need to maintain a local copy of that)

My handwavey suggestion would be to not force listing the dependencies locally, make it so that everything "just works" by following the .wit and loading dependencies from the registry, but if the user lists the dependencies in their Cargo.toml (i.e. they are working on that too locally), then it overrides this default.

That said - I understand there's ongoing work to move away from Cargo-component.lock, perhaps make all of this more language-agnostic with a separate toml file, etc... needs careful thought to resolve this issue with future-proofing in mind :)