Build, admit and consume packages

What travels in a package#

A .mbpkg contains a package manifest, component API metadata, runtime assemblies and declared supporting assets. Its profile identifies Library, UserControlLibrary or CSharpComponent. Dependencies name exact package identities and versions. Paths are package-relative; an absolute filesystem path is not a portable package asset.

Build the authoring project#

mcbasic check CustomerCard.mcproj
mcbasic package build CustomerCard.mcproj --rid osx-arm64

Use the archive path reported by the command. Package build can produce an archive even when later certification gates have not been run. Keep that distinction in release notes.

Verify the archive deliberately#

For a trusted release, supply the selected publisher public-key file. For a package you built yourself in a disposable development exercise, developer mode and unsigned acknowledgement are explicit opt-ins. They are not the default trust policy and should not be applied to an unknown third-party archive.

mcbasic package verify CustomerCard.mbpkg --target osx-arm64 --developer-mode true --acknowledge-unsigned true

Read the reported static admission result. To compare two rebuilt archives use package compare with the same target/trust inputs. Runtime-check builds and runs an owned generated consumer and is a separate, executable gate.

Resolve a consumer reproducibly#

Put your locally built archive beside the extracted consumer and name that copy CustomerCard.mbpkg. The download declares its intended dependency but does not contain your locally generated package lock. For this first installation only, open CustomerCardConsumer.mcproj and replace its packages array with "packages": [], keeping all other fields. Package add then writes both the exact dependency and McBasic.lock together. Do not remove an established lockfile from an existing project. From that new consumer directory, run the following. The shell variables name this practice folder only; no global package installation is implied.

tutorialRoot="$(pwd -P)"
mkdir -p "$tutorialRoot/package-cache"
mcbasic package add CustomerCardConsumer.mcproj CustomerCard.mbpkg \
  --package-cache "$tutorialRoot/package-cache" --package-target osx-arm64 \
  --developer-mode true --acknowledge-unsigned true
mcbasic check CustomerCardConsumer.mcproj \
  --package-lock "$tutorialRoot/McBasic.lock" --package-cache "$tutorialRoot/package-cache" \
  --package-target osx-arm64 --developer-mode true --acknowledge-unsigned true
mcbasic run CustomerCardConsumer.mcproj \
  --package-lock "$tutorialRoot/McBasic.lock" --package-cache "$tutorialRoot/package-cache" \
  --package-target osx-arm64 --developer-mode true --acknowledge-unsigned true

For MoneyToolsConsumer use MoneyToolsConsumer.mcproj and the locally built MoneyTools.mbpkg instead. Keep the package’s original ID and version; changing the filename does not change its identity. Commit the resulting project declaration and lockfile when you accept the dependency.

Do not collapse the gates#

Capabilities are denied by default#

The current SDK capability catalog is empty. Packages must declare an empty capabilities array. A component cannot request an undocumented host privilege by inventing a capability string; new host services require a supported contract and policy update.