pub VS meta-package-manager

Agreed. Version resolution is the interesting problem.

Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2].

[1] https://github.com/dart-lang/pub/blob/master/doc/solver.md

[2] https://research.swtch.com/vgo-mvs

Official documentation.

As I understand Custom package repositories it's possible to host one's own package repository. The Repository Specification is public, but dart.dev only references cloud based paid services like Cloudsmith and OnePub.

As u/Which-Adeptness6908 already pointed out, the repository specification is small, and that's all you need to implement a server: https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md

https://docs.github.com/en/code-security/secret-scanning/sec...

A bit sad, they don't publish the list of regexes, etc.

--------------

I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation:

https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8...

It was heavily inspired by the researchers in:

Heres are some issues I've faced when trying with the dart-version cli: - The installation - dart pub global activate needs to have flutter/dart global installed already. - Global activated fvm cli got invalid after flutter upgrade, see issue - The cli does not work with customized fork of flutter. - You should run fvm flutter , not flutter , this changes CI/CD workflow

This will add the args dependency in your pubspec file. We used the Darts package manager pub to add this dependency.

Something like Meta Package Manager? https://github.com/kdeldycke/meta-package-manager

I use https://github.com/kdeldycke/meta-package-manager

The result: https://github.com/kdeldycke/meta-package-manager/commit/3ab...

Source: https://github.com/kdeldycke/meta-package-manager/

With regular snapshots you can at least eliminate new installed software as the root cause of an issue. Doesn't solve the issue with preferences though.

and let it figure out which package manager to use to install your package.

The project is open-source: https://github.com/kdeldycke/meta-package-manager#readme

This CLI has some other capabilities, like listing the duplicate packages on your system:

    $ mpm list --duplicates

Potentially somewhat answering my own question (but not completely; i am still interested in your answer) you might be interested in https://github.com/kdeldycke/meta-package-manager is it along the same lines?