We (CocoaPods) have some existing tools that might be of interest for you and which could probably be ported easily:
• Molinillo (https://github.com/CocoaPods/Molinillo): This is our dependency resolver, which since has been adopted by Bundler (http://bundler.io) and RubyGems (https://rubygems.org). It does conflict resolution, has support for locking (lock file) and has been battle-tested.
• Trunk (https://github.com/CocoaPods/trunk.cocoapods.org): As you mention wanting to look into a centralised index in the future: this is our web-service that is the gate keeper to our centralised index. Specifically it adds an ACL to who is allowed to push releases for which lib and pushes the lib’s manifest to a GitHub repo, which is where we keep our index. It has been a reliable service with very little maintenance required.
We would be happy to assist with porting these to be compatible with the Swift Package Manager.