What determines accessibility of PyPI metadata for external tooling?

Core Metadata Accessibility

Accessibility for external tooling is determined by the package's adherence to PEP 566 and the availability of the PyPI JSON API. Tooling should target the endpoint https://pypi.org/pypi/{package}/json to retrieve a standardized representation of the package metadata regardless of whether the developer used Poetry, Flit, or Setuptools.

Universally Parsable Fields

The following fields are considered standard and are guaranteed to be present in the info block of the JSON response for modern, compliant packages:

• name and version: Basic identity.
• summary and description: Human-readable project details.
• requires_python: The required Python interpreter version range.
• requires_dist: The canonical list of dependencies.
• classifiers: Standardized category strings.

Dependency Resolution and Versioning

Dependency resolution does not strictly enforce "Semantic Versioning" (SemVer) in the way NPM does; instead, it enforces PEP 440. While many developers follow SemVer, PyPI allows for a broader range of version specifiers (including pre-releases and local versions). The requires_dist field uses PEP 508 syntax, which tooling must parse to handle environment markers and optional extras correctly.

Backend Independence

Tooling integrations can expect metadata availability regardless of the packaging backend because PyPI extracts this data from the distribution artifact (the Wheel) into a common format. The JSON API abstracts the underlying build tool, providing a consistent interface for all packages.

Verification and Constraints

To verify metadata accessibility for a specific package, you can query the JSON endpoint directly:

curl -s https://pypi.org/pypi/requests/json | jq '.info.requires_dist'

Uncertainty Note: Legacy packages created before the widespread adoption of PEP 566 may have missing or malformed requires_dist fields. Tooling should implement a fallback or error-handling mechanism for these cases.

Missing Diagnostic: Are you targeting legacy packages (pre-2017) or only modern distributions? This determines if you need a fallback parser for setup.py files.