@yawlabs/npmjs-mcp 0.11.0 → 0.11.2

package/dist/index.js

@@ -30174,6 +30174,9 @@ function validateUsername(username) {
 function validateTeam(team) {
   return validateIdent(team, "Team name");
 }
+function validateTag(tag) {
+  return validateIdent(tag, "Tag name");
+}
 function encPkg(name) {
   const err = validatePackageName(name);
   if (err) throw new Error(err);
@@ -30194,6 +30197,11 @@ function encTeam(team) {
   if (err) throw new Error(err);
   return encodeURIComponent(team);
 }
+function encTag(tag) {
+  const err = validateTag(tag);
+  if (err) throw new Error(err);
+  return encodeURIComponent(tag);
+}
 function isAuthenticated() {
   return !!process.env.NPM_TOKEN;
 }
@@ -30429,10 +30437,15 @@ function maxSatisfying(versions, range) {
   for (const sub of subRanges) {
     const parsed = parseRange(sub);
     if (!parsed) continue;
+    const anchorMatch = sub.match(/(\d+)\.(\d+)\.(\d+)-/);
+    const prereleaseAnchor = anchorMatch ? [Number(anchorMatch[1]), Number(anchorMatch[2]), Number(anchorMatch[3])] : null;
     for (const v of versions) {
-      if (v.includes("-") && !sub.includes("-")) continue;
       const vp = parseSemver(v);
       if (!vp) continue;
+      if (v.includes("-")) {
+        if (!prereleaseAnchor) continue;
+        if (vp[0] !== prereleaseAnchor[0] || vp[1] !== prereleaseAnchor[1] || vp[2] !== prereleaseAnchor[2]) continue;
+      }
       if (parsed.min && cmpSemver(vp, parsed.min) < 0) continue;
       if (parsed.max && cmpSemver(vp, parsed.max) >= 0) continue;
       if (!bestParsed || cmpSemver(vp, bestParsed) > 0) {
@@ -31178,7 +31191,7 @@ var downloadTools = [
   },
   {
     name: "npm_downloads_bulk",
-    description: "Compare download counts for multiple packages over a period. Up to 128 packages.",
+    description: "Compare download counts for multiple packages over a period. Up to 128 packages. Scoped packages (@scope/name) are NOT supported by the bulk endpoint \u2014 call npm_downloads separately for each scoped package.",
     annotations: {
       title: "Bulk download comparison",
       readOnlyHint: true,
@@ -31187,11 +31200,19 @@ var downloadTools = [
       openWorldHint: true
     },
     inputSchema: external_exports3.object({
-      packages: external_exports3.array(external_exports3.string()).min(1).max(128).describe("Array of package names to compare"),
+      packages: external_exports3.array(external_exports3.string()).min(1).max(128).describe("Array of package names to compare (unscoped only)"),
       period: external_exports3.string().optional().describe("Period (default: 'last-week')")
     }),
     handler: async (input) => {
       const period = input.period ?? "last-week";
+      const scoped = input.packages.filter((p) => p.startsWith("@"));
+      if (scoped.length > 0) {
+        return {
+          ok: false,
+          status: 400,
+          error: `npm_downloads_bulk does not support scoped packages (received: ${scoped.join(", ")}). Call npm_downloads separately for each scoped package.`
+        };
+      }
       const names = input.packages.map((p) => encPkg(p)).join(",");
       const res = await downloadsGet(`/downloads/point/${period}/${names}`);
       return res.ok ? res : translateError(res, { op: `downloads_bulk ${period}` });
@@ -31225,6 +31246,7 @@ function classifyHookTarget(target) {
   if (/^@[^/]+$/.test(target)) return { type: "scope", name: target };
   return { type: "package", name: target };
 }
+var httpsEndpoint = external_exports3.string().url().refine((u) => u.startsWith("https://"), { message: "Endpoint must use https://" });
 function stripSecrets(data) {
   if (Array.isArray(data)) {
     return data.map((item) => stripSecrets(item));
@@ -31252,7 +31274,7 @@ var hookTools = [
     },
     inputSchema: external_exports3.object({
       target: external_exports3.string().describe("Hook target: 'pkg', '@scope/pkg', '@scope', or '~user'"),
-      endpoint: external_exports3.string().url().describe("HTTPS URL that will receive POST events"),
+      endpoint: httpsEndpoint.describe("HTTPS URL that will receive POST events"),
       secret: external_exports3.string().describe("Secret used to HMAC-sign webhook payloads")
     }),
     handler: async (input) => {
@@ -31330,7 +31352,7 @@ var hookTools = [
     },
     inputSchema: external_exports3.object({
       id: external_exports3.string().describe("Hook ID"),
-      endpoint: external_exports3.string().url().describe("New HTTPS URL"),
+      endpoint: httpsEndpoint.describe("New HTTPS URL"),
       secret: external_exports3.string().describe("New signing secret")
     }),
     handler: async (input) => {
@@ -31385,7 +31407,9 @@ var orgTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/user`);
+      const scopeErr = validateScope(input.org);
+      if (scopeErr) return { ok: false, status: 400, error: scopeErr };
+      const res = await registryGetAuth(`/-/org/${encScope(input.org)}/user`);
       if (!res.ok) return translateError(res, { op: `org_members ${input.org}` });
       const members = Object.entries(res.data).map(([username, role]) => ({ username, role }));
       return {
@@ -31415,7 +31439,9 @@ var orgTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/package`);
+      const scopeErr = validateScope(input.org);
+      if (scopeErr) return { ok: false, status: 400, error: scopeErr };
+      const res = await registryGetAuth(`/-/org/${encScope(input.org)}/package`);
       if (!res.ok) return translateError(res, { op: `org_packages ${input.org}` });
       const packages = Object.entries(res.data).map(([name, access]) => ({ name, access }));
       return {
@@ -31445,7 +31471,9 @@ var orgTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/team`);
+      const scopeErr = validateScope(input.org);
+      if (scopeErr) return { ok: false, status: 400, error: scopeErr };
+      const res = await registryGetAuth(`/-/org/${encScope(input.org)}/team`);
       if (!res.ok) return translateError(res, { op: `org_teams ${input.org}` });
       return {
         ok: true,
@@ -31475,8 +31503,12 @@ var orgTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
+      const scopeErr = validateScope(input.org);
+      if (scopeErr) return { ok: false, status: 400, error: scopeErr };
+      const teamErr = validateTeam(input.team);
+      if (teamErr) return { ok: false, status: 400, error: teamErr };
       const res = await registryGetAuth(
-        `/-/team/${encodeURIComponent(input.org)}/${encodeURIComponent(input.team)}/package`
+        `/-/team/${encScope(input.org)}/${encTeam(input.team)}/package`
       );
       if (!res.ok) return translateError(res, { op: `team_packages ${input.org}:${input.team}` });
       const packages = Object.entries(res.data).map(([name, permissions]) => ({ name, permissions }));
@@ -31491,6 +31523,44 @@ var orgTools = [
         }
       };
     }
+  },
+  {
+    name: "npm_team_members",
+    description: "List all members of a team with their roles (e.g. 'developer'). Complements npm_team_member_add and npm_team_member_remove \u2014 use this to audit who is currently on the team before adding or removing members.",
+    annotations: {
+      title: "List team members",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: external_exports3.object({
+      org: external_exports3.string().describe("Organization name (without @ prefix)"),
+      team: external_exports3.string().describe("Team name")
+    }),
+    handler: async (input) => {
+      const authErr = requireAuth();
+      if (authErr) return authErr;
+      const scopeErr = validateScope(input.org);
+      if (scopeErr) return { ok: false, status: 400, error: scopeErr };
+      const teamErr = validateTeam(input.team);
+      if (teamErr) return { ok: false, status: 400, error: teamErr };
+      const res = await registryGetAuth(
+        `/-/team/${encScope(input.org)}/${encTeam(input.team)}/user`
+      );
+      if (!res.ok) return translateError(res, { op: `team_members ${input.org}:${input.team}` });
+      const members = Object.entries(res.data).map(([username, role]) => ({ username, role }));
+      return {
+        ok: true,
+        status: 200,
+        data: {
+          org: input.org,
+          team: input.team,
+          memberCount: members.length,
+          members
+        }
+      };
+    }
   }
 ];
 
@@ -31608,20 +31678,21 @@ var packageTools = [
       if (!res.ok) return translateError(res, { pkg: input.name, op: "versions" });
       const pkg = res.data;
       const limit = input.limit ?? 50;
-      const allVersions = Object.keys(pkg.versions).map((v) => ({
+      const totalPublished = Object.keys(pkg.versions).length;
+      const dated = Object.keys(pkg.versions).map((v) => ({
         version: v,
         date: pkg.time[v],
         deprecated: pkg.versions[v].deprecated,
         npmUser: pkg.versions[v]._npmUser?.name
-      })).sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime());
-      const versions = limit > 0 ? allVersions.slice(0, limit) : allVersions;
+      })).filter((r) => r.date).sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime());
+      const versions = limit > 0 ? dated.slice(0, limit) : dated;
       return {
         ok: true,
         status: 200,
         data: {
           name: pkg.name,
           distTags: pkg["dist-tags"],
-          total: allVersions.length,
+          total: totalPublished,
           showing: versions.length,
           versions
         }
@@ -32307,6 +32378,12 @@ var workflowTools = [
             detail: `"${input.name}" exists. Maintainers: ${maintainers.join(", ") || "unknown"}. Authenticate to check your access.`
           });
         }
+      } else {
+        checks.push({
+          check: "Package name availability",
+          status: "warn",
+          detail: `Could not verify whether "${input.name}" is available or whether you have access (registry returned HTTP ${pkgRes.status}). Re-run npm_publish_preflight before publishing.`
+        });
       }
       if (twoFactorAuth && twoFactorAuth !== "disabled" && canPublishHeadless !== true) {
         actions.push({
@@ -32374,6 +32451,7 @@ function parseTeamTarget(target) {
 function highestVersion(versions) {
   const parsed = [];
   for (const v of versions) {
+    if (v.includes("-")) continue;
     const m = v.match(/^(\d+)\.(\d+)\.(\d+)/);
     if (m) parsed.push([Number(m[1]), Number(m[2]), Number(m[3]), v]);
   }
@@ -32575,6 +32653,7 @@ var writeTools = [
           tarballError = "could not re-fetch packument for tarball DELETE rev";
         }
       }
+      const complete = !tarballUrl || tarballDeleted;
       return {
         ok: true,
         status: 200,
@@ -32582,6 +32661,7 @@ var writeTools = [
           package: input.name,
           unpublishedVersion: input.version,
           remainingVersions: Object.keys(packument.versions),
+          complete,
           tarballDeleted,
           ...tarballError ? { tarballWarning: tarballError } : {}
         }
@@ -32655,8 +32735,10 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
+      const tagErr = validateTag(input.tag);
+      if (tagErr) return { ok: false, status: 400, error: tagErr };
       const putRes = await registryPutAuth(
-        `/-/package/${encPkg(input.name)}/dist-tags/${encodeURIComponent(input.tag)}`,
+        `/-/package/${encPkg(input.name)}/dist-tags/${encTag(input.tag)}`,
         input.version
       );
       if (!putRes.ok) return translateError(putRes, { pkg: input.name, op: `dist-tag set ${input.tag}` });
@@ -32691,6 +32773,8 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
+      const tagErr = validateTag(input.tag);
+      if (tagErr) return { ok: false, status: 400, error: tagErr };
       if (input.tag === "latest") {
         return {
           ok: false,
@@ -32698,9 +32782,7 @@ var writeTools = [
           error: "The 'latest' tag cannot be removed. Use npm_dist_tag_set to reassign it to a different version."
         };
       }
-      const delRes = await registryDeleteAuth(
-        `/-/package/${encPkg(input.name)}/dist-tags/${encodeURIComponent(input.tag)}`
-      );
+      const delRes = await registryDeleteAuth(`/-/package/${encPkg(input.name)}/dist-tags/${encTag(input.tag)}`);
       if (!delRes.ok) return translateError(delRes, { pkg: input.name, op: `dist-tag remove ${input.tag}` });
       return {
         ok: true,
@@ -33155,7 +33237,9 @@ var writeTools = [
       if (input.role) body.role = input.role;
       const res = await registryPutAuth(`/-/org/${encScope(org)}/user`, body);
       if (!res.ok) return translateError(res, { op: `org_member_set ${org}/${user}` });
-      return { ok: true, status: 200, data: { org, user, role: input.role } };
+      const data = { org, user };
+      if (input.role) data.role = input.role;
+      return { ok: true, status: 200, data };
     }
   },
   // ───────────────────────────────────────────────────────
@@ -33234,7 +33318,7 @@ var writeTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.11.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.11.2" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/npmjs-mcp",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "npm registry MCP server — package intelligence, security audits, and dependency analysis for AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",