@uluops/registry-mcp 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -4,10 +4,16 @@
 
 ### Added
 
+- `batch_users` accepts `format: 'envelope'` to expose validated found/missing user IDs, with canonical lowercase UUIDs deduplicated in request order. Default map output is preserved.
+
 - Unsupported `name-v1` capability errors retain their code/tool context and explain that no keyword fallback was performed.
 - Exact-name and literal-prefix discovery with `name`/`match` on `list_definitions` and `match` on `search_definitions`; existing keyword searches retain their behavior.
 - Page, sort, and order on `search_definitions`, and optional FULLTEXT relevance in compact list rows.
 
+### Changed
+
+- Pin `@uluops/registry-sdk` to 0.60.0 from public npm for the F19 response contract; replace the local Verdaccio SDK lock resolution for cold consumer installs.
+
 ### Fixed
 
 - Resolve the SDK consumer lockfile against npmjs and refresh the existing sdk-core integrity for cold installs.
@@ -15,6 +21,9 @@
 - List page requests without a limit now explicitly send limit 50, keeping offset calculation and server page size aligned.
 - Numeric parameter coercion remains available for schemas with search combination refinements.
 
+### Security
+- Update the Hono override to 4.13.7 and resolve proxy-addr 2.0.8 to clear inherited production advisories before the F19 release.
+
 ## [0.11.4] - 2026-10-03
 
 ### Changed

package/README.md

@@ -198,7 +198,7 @@ Lifecycle refusals now carry `allowedTransitions`; blocked deletion carries `blo
 |------|-------------|
 | `record_execution` | Record a definition execution (idempotent). Admin-only — executions are recorded automatically by the runtime; user keys get a 403 explaining this |
 | `get_user` | Get public user profile |
-| `batch_users` | Batch user lookup (max 100) |
+| `batch_users` | Batch user lookup (max 100); optional `format: 'envelope'` returns `{data,foundIds,missingIds}` |
 
 ### Analytics (P3)
 | Tool | Description |
@@ -302,3 +302,10 @@ by OR-any and are not keyword searched. Actual FULLTEXT rows may include numeric
 `relevance`, retained in compact list output. Search responses retain the full
 list rows. A list request with `page` and no `limit` explicitly uses limit 50,
 matching the API's default; MCP limits remain capped at 100.
+
+`batch_users` defaults to the existing map (`format: 'map'` is also accepted).
+With `format: 'envelope'`, UUID inputs are normalized to lowercase and deduplicated
+in request order; both ID arrays use that order and canonical spelling. Unknown,
+deleted, and null profiles appear in `missingIds`. The 100-input limit applies
+before deduplication. The SDK requires consistent producer `found`/`notFound`
+metadata and returns a response-validation error when it is absent or invalid.

package/dist/tools/batch-users.d.ts

@@ -8,10 +8,13 @@ import type { RegistryClient } from '@uluops/registry-sdk';
 import { type McpServerToolRegistration } from '../types/index.js';
 export declare const BatchUsersInputSchema: z.ZodObject<{
     ids: z.ZodArray<z.ZodString, "many">;
+    format: z.ZodOptional<z.ZodEnum<["map", "envelope"]>>;
 }, "strip", z.ZodTypeAny, {
     ids: string[];
+    format?: "map" | "envelope" | undefined;
 }, {
     ids: string[];
+    format?: "map" | "envelope" | undefined;
 }>;
 export declare function registerBatchUsersTool(server: McpServerToolRegistration, registryClient: RegistryClient): void;
 //# sourceMappingURL=batch-users.d.ts.map

package/dist/tools/batch-users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-users.d.ts","sourceRoot":"","sources":["../../src/tools/batch-users.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAGnE,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAC;AAEH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,yBAAyB,EACjC,cAAc,EAAE,cAAc,GAC7B,IAAI,CAON"}
+{"version":3,"file":"batch-users.d.ts","sourceRoot":"","sources":["../../src/tools/batch-users.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAGnE,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAC;AAEH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,yBAAyB,EACjC,cAAc,EAAE,cAAc,GAC7B,IAAI,CASN"}

package/dist/tools/batch-users.js

@@ -7,8 +7,11 @@ import { z } from 'zod';
 import { createToolHandler } from '../utils/tool-handler.js';
 export const BatchUsersInputSchema = z.object({
     ids: z.array(z.string().min(1)).min(1).max(100),
+    format: z.enum(['map', 'envelope']).optional(),
 });
 export function registerBatchUsersTool(server, registryClient) {
-    server.tool('batch_users', 'Batch lookup of public user profiles by IDs (max 100).', BatchUsersInputSchema.shape, createToolHandler(BatchUsersInputSchema, (n) => registryClient.users.batch(n.ids), { toolName: 'batch_users' }));
+    server.tool('batch_users', 'Batch lookup of public user profiles by IDs (max 100). Optional format=envelope returns data, foundIds and missingIds with lowercase UUIDs deduplicated in request order; default is a map.', BatchUsersInputSchema.shape, createToolHandler(BatchUsersInputSchema, (n) => n.format === 'envelope'
+        ? registryClient.users.batch(n.ids, { format: 'envelope' })
+        : registryClient.users.batch(n.ids), { toolName: 'batch_users' }));
 }
 //# sourceMappingURL=batch-users.js.map

package/dist/tools/batch-users.js.map

@@ -1 +1 @@
-{"version":3,"file":"batch-users.js","sourceRoot":"","sources":["../../src/tools/batch-users.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAChD,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CACpC,MAAiC,EACjC,cAA8B;IAE9B,MAAM,CAAC,IAAI,CACT,aAAa,EACb,wDAAwD,EACxD,qBAAqB,CAAC,KAAK,EAC3B,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAChH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"batch-users.js","sourceRoot":"","sources":["../../src/tools/batch-users.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CACpC,MAAiC,EACjC,cAA8B;IAE9B,MAAM,CAAC,IAAI,CACT,aAAa,EACb,6LAA6L,EAC7L,qBAAqB,CAAC,KAAK,EAC3B,iBAAiB,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU;QACrE,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3D,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CACpE,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uluops/registry-mcp",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "MCP server for the UluOps Registry API — definition management, versioning, and analytics",
   "type": "module",
   "main": "dist/index.js",
@@ -62,7 +62,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@uluops/registry-sdk": "0.59.0",
+    "@uluops/registry-sdk": "0.60.0",
     "@uluops/sdk-core": "0.18.1",
     "mcp-secure-server": "0.0.25-security",
     "zod": "3.25.76"
@@ -81,7 +81,7 @@
     "vitest": "4.1.8"
   },
   "overrides": {
-    "hono": "4.13.5",
+    "hono": "4.13.7",
     "@hono/node-server": "2.0.12"
   }
 }