@taiga-ai/mcp-server 0.26.0-dev.499 → 0.26.0-dev.501

package/dist/index.js

@@ -1919,6 +1919,7 @@ const ENVIRONMENT_TYPES = [
 const MAINTENANCE_FINDING_KINDS = [
 	"vulnerable_dependency",
 	"outdated_dependency",
+	"license_violation",
 	"secret",
 	"sast",
 	"iac_misconfig"
@@ -1943,7 +1944,11 @@ const CODE_REMEDIATION_KINDS = [
 	"iac_misconfig"
 ];
 new Map(Object.entries({
-	deps: ["vulnerable_dependency", "outdated_dependency"],
+	deps: [
+		"vulnerable_dependency",
+		"outdated_dependency",
+		"license_violation"
+	],
 	secrets: ["secret"],
 	sast: ["sast"],
 	iac: ["iac_misconfig"]
@@ -2030,6 +2035,19 @@ function lockfileScope(path, groups) {
 	}
 }
 /**
+* The kinds that are a package in a lockfile (PRO-2862): the ones with a
+* dependency scope, a relation and an inventory entry. A code kind reuses the
+* dependency columns for its rule and category and has none of those.
+*/
+const DEPENDENCY_FINDING_KINDS = [
+	"vulnerable_dependency",
+	"outdated_dependency",
+	"license_violation"
+];
+function isDependencyFindingKind(kind) {
+	return DEPENDENCY_FINDING_KINDS.includes(kind);
+}
+/**
 * Whether a dependency finding sits only in development dependencies, in at
 * least one runtime dependency set, or in lockfiles that do not say. Decided
 * per lockfile (`lockfileScope`) and combined pessimistically: one runtime
@@ -2040,8 +2058,12 @@ function lockfileScope(path, groups) {
 * install script in any group.
 */
 function dependencyScope(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const entries = Object.entries(finding.dependencyGroups ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return scopeFromGroups(finding.dependencyGroups);
+}
+/** The scope read from per-lockfile groups alone: for an inventory record, which is a package by construction. */
+function scopeFromGroups(dependencyGroups) {
+	const entries = Object.entries(dependencyGroups ?? {});
 	if (entries.length === 0) return "unknown";
 	return combineScopes(entries.map(([path, groups]) => lockfileScope(path, Array.isArray(groups) ? groups : [])));
 }
@@ -2059,8 +2081,12 @@ function combineScopes(scopes) {
 * remediation step already finds every resolved copy and its parent itself.
 */
 function dependencyRelation(finding) {
-	if (finding.kind !== "vulnerable_dependency" && finding.kind !== "outdated_dependency") return "unknown";
-	const values = Object.values(finding.dependencyRelation ?? {});
+	if (!isDependencyFindingKind(finding.kind)) return "unknown";
+	return relationFromLockfiles(finding.dependencyRelation);
+}
+/** The relation read from per-lockfile answers alone: for an inventory record, which is a package by construction. */
+function relationFromLockfiles(dependencyRelation) {
+	const values = Object.values(dependencyRelation ?? {});
 	if (values.includes("direct")) return "direct";
 	if (values.length > 0 && values.every((v) => v === "transitive")) return "transitive";
 	return "unknown";
@@ -5346,6 +5372,11 @@ const FINDING_ROW_FIELDS = [
 * read off the row; remediableBy stays as the sweep recorded it.
 */
 function withFixability(row) {
+	if (row["kind"] === "license_violation") return {
+		...row,
+		fixable: false,
+		fixNote: "A license violation has no fix version: review the license or replace the package; taiga_fix_finding refuses it."
+	};
 	if ((row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency") && !row["recommendedVersion"] && row["remediableBy"] === "coding_agent") return {
 		...row,
 		fixable: false,
@@ -5363,7 +5394,7 @@ function withDependencyScope(row, { keepGroups = false } = {}) {
 		...row,
 		dependencyRelation: void 0
 	} : lean;
-	if (!(row["kind"] === "vulnerable_dependency" || row["kind"] === "outdated_dependency")) return rest;
+	if (!isDependencyFindingKind(String(row["kind"]))) return rest;
 	const kind = row["kind"];
 	return {
 		...rest,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taiga-ai/mcp-server",
-  "version": "0.26.0-dev.499",
+  "version": "0.26.0-dev.501",
   "description": "Taiga for AI coding assistants: read products, policies, initiatives and runs, and operate the line, over MCP",
   "mcpName": "ga.tai/mcp-server",
   "type": "module",