Dependency cooldown policy

doc/repository-spec-v2.md

@@ -233,6 +233,7 @@ server, this could work in many different ways.
   "latest": {
     "version": "<version>",
     "retracted": true || false, /* optional field, false if omitted */
+    "published": "<date-time>", /* optional field, ISO 8601 format (must include timezone), timestamp of when this version was published */
     "archive_url": "https://.../archive.tar.gz",
     "archive_sha256": "95cbaad58e2cf32d1aa852f20af1fcda1820ead92a4b1447ea7ba1ba18195d27"
     "pubspec": {
@@ -241,8 +242,9 @@ server, this could work in many different ways.
   },
   "versions": [
     {
-      "version": "<package>",
+      "version": "<version>",
       "retracted": true || false, /* optional field, false if omitted */
+      "published": "<date-time>", /* optional field, ISO 8601 format (must include timezone), timestamp of when this version was published */
       "archive_url": "https://.../archive.tar.gz",
       "archive_sha256": "95cbaad58e2cf32d1aa852f20af1fcda1820ead92a4b1447ea7ba1ba18195d27"
       "pubspec": {

lib/src/command/outdated.dart

@@ -269,6 +269,25 @@ Consider using the Dart 2.19 sdk to migrate to null safety.''');
         cache,
       );
 
+      final policy = entrypoint.workspaceRoot.pubspec.policy?.cooldown;
+      var isLatestBlockedByCooldown = false;
+      if (policy != null && latest != null) {
+        final desc = latest.description;
+        if (desc is ResolvedHostedDescription) {
+          final status = await latest.toRef().source.status(
+            latest.toRef(),
+            latest.version,
+            cache,
+          );
+          isLatestBlockedByCooldown = policy.isBlocked(
+            latest.name,
+            latest.version,
+            status.published,
+            [],
+          );
+        }
+      }
+
       final id = current ?? upgradable ?? resolvable ?? latest;
       var packageAdvisories =
           await id?.source.getAdvisoriesForPackage(
@@ -339,6 +358,7 @@ Consider using the Dart 2.19 sdk to migrate to null safety.''');
         discontinuedReplacedBy: discontinuedReplacedBy,
         isCurrentRetracted: isCurrentRetracted,
         isLatest: isLatest,
+        isLatestBlockedByCooldown: isLatestBlockedByCooldown,
         advisories: packageAdvisories,
         isCurrentAffectedBySecurityAdvisory: isCurrentAffectedByAdvisory,
       );
@@ -752,6 +772,7 @@ Future<void> _outputHuman(
   bool displayExtraInfo(_PackageDetails package) =>
       package.isDiscontinued ||
       package.isCurrentRetracted ||
+      package.isLatestBlockedByCooldown ||
       (advisoriesToDisplay[package.name]!.isNotEmpty);
 
   if (rows.any(displayExtraInfo)) {
@@ -774,6 +795,12 @@ Future<void> _outputHuman(
           'See https://dart.dev/go/package-retraction',
         );
       }
+      if (package.isLatestBlockedByCooldown) {
+        log.message(
+          '    Version ${package.latest!._id.version} is too new for '
+          'cooldown policy.',
+        );
+      }
       final displayedAdvisories = advisoriesToDisplay[package.name]!;
       if (displayedAdvisories.isNotEmpty) {
         final advisoriesText =
@@ -990,6 +1017,7 @@ class _PackageDetails implements Comparable<_PackageDetails> {
   final String? discontinuedReplacedBy;
   final bool isCurrentRetracted;
   final bool isLatest;
+  final bool isLatestBlockedByCooldown;
 
   /// List of advisories affecting this package which are not present in the
   /// `ignored_advisories` list in the pubspec.
@@ -1007,6 +1035,7 @@ class _PackageDetails implements Comparable<_PackageDetails> {
     required this.discontinuedReplacedBy,
     required this.isCurrentRetracted,
     required this.isLatest,
+    required this.isLatestBlockedByCooldown,
     required this.advisories,
     required this.isCurrentAffectedBySecurityAdvisory,
   });

lib/src/language_version.dart

@@ -75,6 +75,8 @@ class LanguageVersion implements Comparable<LanguageVersion> {
   bool get respectsFlutterBoundInRoots =>
       this >= firstVersionRespectingFlutterBoundInRoots;
 
+  bool get supportsCooldown => this >= firstVersionWithCooldown;
+
   /// Minimum language version at which short hosted syntax is supported.
   ///
   /// This allows `hosted` dependencies to be expressed as:
@@ -122,6 +124,7 @@ class LanguageVersion implements Comparable<LanguageVersion> {
     3,
     9,
   );
+  static const firstVersionWithCooldown = LanguageVersion(3, 14);
 
   /// Transform language version to string that can be parsed with
   /// [LanguageVersion.parse].

lib/src/package.dart

@@ -519,6 +519,22 @@ Workspace members must have unique names.
     namesSeen[package.name] = package;
   }
 
+  // Check that at most one policy is specified.
+  Policy? policySeen;
+  for (final package in root.transitiveWorkspace) {
+    final currentPolicy = package.pubspec.policy;
+    if (currentPolicy != null) {
+      if (policySeen != null) {
+        fail('''
+Only a single policy specification is allowed across all workspace pubspec.yaml files.
+Found policies in both:
+* ${policySeen.span.sourceUrl?.path ?? 'pubspec.yaml'}
+* ${currentPolicy.span.sourceUrl?.path ?? 'pubspec.yaml'}''');
+      }
+      policySeen = currentPolicy;
+    }
+  }
+
   // Check that the workspace doesn't contain two overrides of the same package.
   // Also check that workspace packages are not overridden.
   final overridesSeen = <String, Package>{};