release: 0.0.15

[anilcancakir]

Two breaking changes in the database layer, two additions to validation and localization, and fixes to the migrator and the translation loader. Wave two of an eight-package batch: dusk 0.0.15 is out, and six plugins re-pin to this release after it publishes.

BREAKING

A migration may no longer manage its own transaction. The migrator now runs every pending migration inside one SAVEPOINT. A commit() inside up() closed that savepoint, so every later migration ran unprotected and the closing RELEASE threw after every ledger row was already committed. run detects it and throws naming the migration. #175

DB.transaction answers a callback that closes the transaction itself. On failure the rollback is skipped, so the caller reads the real error instead of cannot rollback - no transaction is active; on success it throws, because returning normally would tell the caller a half-committed block was atomic. #175

Both are permitted pre-1.0 and recorded rather than left to be discovered.

Added

• Url validation rule with a scheme allowlist, and a messages override on FormValidator.rules, keyed by the new Rule.name. A Url validation rule, and per-call-site messages #176
• transChoice and MessageSelector, a port of Laravel's, with the plural rules of 90 languages read mechanically from getPluralIndex. trans_choice, and the plural rules of 90 languages #174

Changed

• flutter_secure_storage widens to >=10.0.0 <12.0.0 (chore(deps): bump flutter_secure_storage from 10.3.4 to 11.1.1 #158, merged as Dependabot opened it). v11 removes only what v10 deprecated, and MagicVaultService uses none of it. Its data-loss warning is for apps that skipped v10: every magic release on pub.dev has required ^10 (git log --all -G'flutter_secure_storage:' -- pubspec.yaml shows the initial commit and chore(deps): bump flutter_secure_storage from 10.3.4 to 11.1.1 #158, nothing between). The minSdk 24 it requires is already Flutter's own floor since 3.35.

Fixed

• Migrator.run is atomic, and a ledger insert can no longer be silently filtered to nothing by a stale schema cache. The migrator was not atomic, and could record nothing at all #175
• A translation catalogue loads when no log service is bound, and load now logs why it gave up instead of answering an empty map silently. A translation catalogue loaded nothing when no log service was bound #173

What the promotion changed besides the heading

• The two BREAKING: bullets sat under ### Fixed; they are now a ### Breaking section, the bucket order CLAUDE.md names.
• A paragraph about the migrator's tracking table ("created before the savepoint") had landed inside the DB.transaction entry. It is back in the Migrator.run entry, which is what it describes (migrator.dart:128 creates the table, :145 opens the savepoint).
• ### Changed is new, for chore(deps): bump flutter_secure_storage from 10.3.4 to 11.1.1 #158.

The batch this release carries

magic's release is what carries the plugin references to the registry, so this batch's plugin versions are stamped here ahead of their own releases, the way 0.0.14 stamped plugin-starter.md to v0.0.30:

Reference	Stamp	Floor prose updated
plugin-notifications.md	v0.3.3	yes: batch floors first, the Echo.connection / setEntitlementsPaths minimums as the reason underneath
plugin-deeplink.md	v0.1.2	none quoted
plugin-social-auth.md	v0.0.4	none quoted
plugin-payments.md	v0.0.3	install snippet ^0.0.1 to ^0.0.3
plugin-devtools.md	v0.0.5	snippet and the paragraph explaining the floors
plugin-starter.md	v0.0.31	the opening paragraph, which still quoted ^0.3.2, ^1.6.0 and ^0.0.12

SKILL.md goes 0.1.34 to 0.1.35 because reference content moved. magic_notifications, magic_deeplink and magic_starter each read their stamp from this repo in skill_reference_stamp_test.dart, so this has to merge before their release commits.

magic:install --with-devtools wrote stale constraints, and two different sets of them. The installer pinned magic_devtools ^0.0.1, fluttersdk_dusk ^0.0.8, fluttersdk_telescope ^0.0.4 into the consumer's pubspec; the post-install message printed beside it said ^0.0.2, ^0.0.9, ^0.0.4. Both now say ^0.0.5, ^0.0.15, ^0.0.6, and a new install test reads the message out of install.yaml and fails when the constant disagrees, so the next release cannot move one copy alone. Red first: Expected: contains 'magic_devtools: ^0.0.2' against the old constant.

One window to know about: magic_devtools 0.0.5 publishes a few minutes after this, in wave three, since it re-pins to magic 0.0.15. An adopter running --with-devtools inside that window gets a version-solve error naming magic_devtools, which a re-run clears.

Stamps

pubspec.yaml, example/pubspec.yaml, and the SKILL.md body stamp. The skill version: stays at 0.1.34: #177 already moved it, and no skill content changes here.

example/pubspec.lock is regenerated against pub.dev. The committed lock carried three absolute /Users/... path sources from a local pubspec_overrides.yaml; with wind 1.6.2 and artisan 0.0.16 published, hosted resolution works and the lock no longer names a machine.

Gates

Run locally on this branch, against the sibling checkouts through the gitignored pubspec_overrides.yaml (artisan and wind are at their published tags there, so this is the graph pub.dev serves):

• flutter analyze --no-fatal-infos: no issues
• dart format --output=none --set-exit-if-changed .: 355 files, 0 changed
• flutter test: 1595 passed (1594 plus the new parity test)
• dart pub publish --dry-run: 0 warnings, 4 hints (one is the long-standing 1.0.0-alpha.13 ordering note)

After this merges

git tag 0.0.15 && git push origin 0.0.15 (bare, no v), which publish.yml watches; it also carries the skill to the registry. Then wave three re-pins against it. The publish is irreversible, so the tag waits for the maintainer's go.

[anilcancakir]

@kodizm review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kodizm]

Note

Kodizm (AI-generated). May contain mistakes; verify before acting.

A clean release stamp — every gate reproduces here and the CHANGELOG promotion is faithful — except that one change the description claims was made is not in the diff.

Major

example/pubspec.lock:387,394,401 — maintainability. The description says the lock "is regenerated against pub.dev" and "no longer names a machine", but the diff touches only the magic version line (0.0.14 → 0.0.15); all three absolute path sources are still committed: grep -c "Users/anilcan" example/pubspec.lock → 3, pointing at /Users/anilcan/Code/fluttersdk/{artisan,wind,wind_diagnostics_contracts}. A plain flutter pub get on this checkout rewrites the file (git diff --stat → 14 insertions(+), 11 deletions(-), each of the three source: path becoming source: hosted), so every contributor's first pub get dirties the tree. The blast radius stops at the repo — dart pub publish --dry-run does not include any pubspec.lock in the archive — so this does not block the tag, but the release notes assert a state the branch is not in.

Tests

No test changes, correctly — this is a stamp-and-promote PR. The suite covering the features it releases is green below.

Checks I ran

• flutter pub get — exit 0, resolved flutter_secure_storage 11.2.0, confirming the >=10.0.0 <12.0.0 widening the Changed entry describes.
• flutter analyze --no-fatal-infos — exit 0, "No issues found!".
• dart format --output=none --set-exit-if-changed . — exit 0, "Formatted 355 files (0 changed)", matching the claim.
• flutter test — exit 0, "+1594: All tests passed!", matching the claimed 1594.
• dart pub publish --dry-run — exit 0, "0 warnings and 1 hint" (the 1.0.0-alpha.13 ordering note). The description says 4 hints; only that one appeared here.
• Verified the release-notes extraction in publish.yml:52 matches the new ## [0.0.15] - 2026-09-21 heading, and that ### Breaking is the bucket name 0.0.14 already used.
• Verified the SKILL.md stamp reasoning: version: 0.1.34 was set in The migrator was not atomic, and could record nothing at all #175 and the body stamp caught up in The skill version stamp fell three bumps behind its own frontmatter #177, both after the last references/ edit, so leaving it at 0.1.34 is right.