Skip to content

feat: admit Pub package targets in CLI and MCP - #487

Draft
jlitola wants to merge 4 commits into
mainfrom
jlitola/pub-registry-client
Draft

jlitola wants to merge 4 commits into
mainfrom
jlitola/pub-registry-client

Conversation

@jlitola

@jlitola jlitola commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Pub package addresses currently fail shared client validation before reaching package APIs. Add pub / PUB to the shared registry taxonomy and vulnerability capabilities so CLI and MCP callers can use existing package and source/docs request paths.

Preserve native package-name case, exact versions and build metadata, latest-only package info, download count semantics, and backend graph/error outcomes. Dependency JSON now retains graph registry namespaces on unambiguous transitive package and importer identities; text distinguishes SDK sources. MCP include_importers: true displays provenance while keeping issue summaries compact. Help, audit fixtures, parity coverage and implementation docs are updated. Package Agent Skill guidance remains tied to release preparation.

Validation:

  • 6,713 unit tests pass, including Pub admission/parity and source-identity regressions.
  • Type checking, formatting, lint, both builds, public artifact validation and generated-plugin checks pass.
  • Source CLI/MCP smokes pass their isolated authentication contracts; both built secret-free smoke suites pass.
  • Built CLI and local MCP were exercised across package, source, docs and research paths. Exact/build-version Flutter dependency graphs preserve SDK namespaces with identical CLI/MCP JSON.

CI: build, Linux/Windows tests, Bun/Node compatibility and secret scan pass; MCP package validation passes.

Draft and merge-held pending complete backend qualification across all affected Pub tools and separate merge approval. Client tests and CI do not establish backend readiness.

@jlitola jlitola added the enhancement New feature or request label Oct 18, 2026
Extend the shared registry taxonomy and vulnerability capability list to
accept Pub coordinates through existing request paths. Preserve native
identity, exact versions, and backend response semantics with regression
coverage across CLI and MCP.
Use declarative release-note wording for the pending Pub guidance update. Keep the release-time editing instructions in the implementation documentation.
Retain graph registry identities in transitive package and importer output. Render requested MCP provenance without expanding compact dependency issue summaries.
@jlitola
jlitola force-pushed the jlitola/pub-registry-client branch from 5d8b2da to 931155d Compare October 25, 2026 09:13
Describe registry namespaces in transitive JSON and importer text across CLI and MCP documentation.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant