@yawlabs/npmjs-mcp 0.7.0 → 0.8.0

package/dist/index.js

@@ -21015,8 +21015,21 @@ var REGISTRY_URL = "https://registry.npmjs.org";
 var DOWNLOADS_URL = "https://api.npmjs.org";
 var REPLICATE_URL = "https://replicate.npmjs.com";
 var REQUEST_TIMEOUT_MS = 3e4;
+var PACKAGE_NAME_MAX_LENGTH = 214;
+var PACKAGE_NAME_PATTERN = /^(?:@[a-zA-Z0-9][a-zA-Z0-9\-_.]*\/)?[a-zA-Z0-9][a-zA-Z0-9\-_.]*$/;
+function validatePackageName(name) {
+  if (typeof name !== "string" || name.length === 0) return "Package name is empty";
+  if (name.length > PACKAGE_NAME_MAX_LENGTH) {
+    return `Package name exceeds ${PACKAGE_NAME_MAX_LENGTH} characters (got ${name.length}).`;
+  }
+  if (!PACKAGE_NAME_PATTERN.test(name)) {
+    return `Invalid package name '${name}'. Names must start with an alphanumeric character and contain only [a-zA-Z0-9-_.], optionally prefixed with '@scope/' for scoped packages.`;
+  }
+  return null;
+}
 function encPkg(name) {
-  if (!name || name === "@") throw new Error("Invalid package name");
+  const err = validatePackageName(name);
+  if (err) throw new Error(err);
   return name.startsWith("@") ? `@${encodeURIComponent(name.slice(1))}` : encodeURIComponent(name);
 }
 function isAuthenticated() {
@@ -21232,6 +21245,61 @@ function maxSatisfying(versions, range) {
   return best;
 }
 
+// src/errors.ts
+function translateError(res, context) {
+  if (res.ok) return res;
+  const pkgPart = context.pkg ? ` for ${context.pkg}` : "";
+  const opPart = context.op ? ` during ${context.op}` : "";
+  switch (res.status) {
+    case 401:
+      return {
+        ...res,
+        error: `Authentication failed${pkgPart}${opPart}. Your NPM_TOKEN may be invalid, expired, or lack write scope. Create a Granular Access Token with 'Read and write' permission at https://www.npmjs.com/settings/~/tokens, or use a classic Automation token (which bypasses 2FA). Raw: ${res.error}`
+      };
+    case 403:
+      return {
+        ...res,
+        error: `Not authorized${pkgPart}${opPart}. You may not be a maintainer of this package, or the token's scope doesn't include it. Check current maintainers with npm_collaborators or npm_package_access. Raw: ${res.error}`
+      };
+    case 404:
+      return {
+        ...res,
+        error: `Not found${pkgPart}${opPart}. Check the exact package name (scoped packages require the @scope/ prefix). If the version is specified, verify it exists with npm_package. Raw: ${res.error}`
+      };
+    case 422:
+      return {
+        ...res,
+        error: `Registry rejected the request payload${pkgPart}${opPart} (422 Unprocessable Entity). Most common causes: (1) invalid semver range \u2014 validate with npm_package versions first; (2) deprecation message format \u2014 em-dash form works, period-capital form sometimes 422s; (3) account-level 2FA policy requires interactive CLI session. If #3, CLI fallback: \`npm login --auth-type=web\` followed by the npm CLI command. Raw: ${res.error}`
+      };
+    case 429:
+      return {
+        ...res,
+        error: `Rate limited${opPart}. Wait 60 seconds and retry. Raw: ${res.error}`
+      };
+    case 0:
+      return {
+        ...res,
+        error: `Network error${opPart}. Could not reach the registry. Raw: ${res.error}`
+      };
+    default:
+      return res;
+  }
+}
+function validateDeprecationMessage(msg) {
+  if (msg.length > 1024) {
+    return "Deprecation message exceeds 1024 characters (registry limit).";
+  }
+  if (msg.length === 0) return null;
+  if (/\.\s+[A-Z]/.test(msg)) {
+    return `Deprecation message contains the "period + space + capital letter" pattern that has triggered 422 Unprocessable Entity on at least one scoped package. The working form uses em-dash and lowercase continuation: e.g. "Renamed to @yawlabs/spend \u2014 install that instead". Pass force: true to bypass this validation.`;
+  }
+  return null;
+}
+function versionsMatchingRange(versions, range, maxSatisfying2) {
+  if (range === "*" || range === "") return [...versions];
+  return versions.filter((v) => maxSatisfying2([v], range) === v);
+}
+
 // src/tools/access.ts
 var accessTools = [
   {
@@ -21251,7 +21319,7 @@ var accessTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth(`/-/package/${encPkg(input.name)}/collaborators`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "collaborators" });
       const collaborators = Object.entries(res.data).map(([username, permissions]) => ({
         username,
         permissions
@@ -21287,7 +21355,7 @@ var accessTools = [
         registryGetAuth(`/-/package/${encPkg(input.name)}/access`),
         registryGetAuth(`/-/package/${encPkg(input.name)}/collaborators`)
       ]);
-      if (!accessRes.ok && !collabRes.ok) return collabRes;
+      if (!accessRes.ok && !collabRes.ok) return translateError(collabRes, { pkg: input.name, op: "package_access" });
       const result = {
         package: input.name,
         isScoped: input.name.startsWith("@")
@@ -21388,7 +21456,7 @@ var analysisTools = [
         downloadsGet(`/downloads/point/last-week/${encPkg(input.name)}`),
         downloadsGet(`/downloads/point/last-month/${encPkg(input.name)}`)
       ]);
-      if (!pkgRes.ok) return pkgRes;
+      if (!pkgRes.ok) return translateError(pkgRes, { pkg: input.name, op: "health" });
       const pkg = pkgRes.data;
       const latest = pkg["dist-tags"]?.latest;
       const latestVersion = latest ? pkg.versions[latest] : void 0;
@@ -21462,7 +21530,7 @@ var analysisTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(`/${encPkg(input.name)}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "maintainers" });
       const pkg = res.data;
       const publishCounts = {};
       for (const ver of Object.values(pkg.versions)) {
@@ -21498,7 +21566,7 @@ var analysisTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(`/${encPkg(input.name)}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "release_frequency" });
       const pkg = res.data;
       const limit = input.limit ?? 20;
       const releases = Object.keys(pkg.versions).map((v) => ({ version: v, date: pkg.time[v] })).filter((r) => r.date).sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime()).slice(0, limit);
@@ -21545,7 +21613,8 @@ var authTools = [
     handler: async () => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      return registryGetAuth("/-/whoami");
+      const res = await registryGetAuth("/-/whoami");
+      return res.ok ? res : translateError(res, { op: "whoami" });
     }
   },
   {
@@ -21563,7 +21632,7 @@ var authTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth("/-/npm/v1/user");
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: "profile" });
       const p = res.data;
       return {
         ok: true,
@@ -21607,7 +21676,7 @@ var authTools = [
       const qs = params.toString();
       const path = `/-/npm/v1/tokens${qs ? `?${qs}` : ""}`;
       const res = await registryGetAuth(path);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: "tokens" });
       const data = res.data;
       return {
         ok: true,
@@ -21681,7 +21750,7 @@ var authTools = [
       const res = await registryGetAuth(
         `/-/user/org.couchdb.user:${encodeURIComponent(input.username)}/package`
       );
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `user_packages ${input.username}` });
       const packages = Object.entries(res.data).map(([name, access]) => ({ name, access }));
       return {
         ok: true,
@@ -21715,7 +21784,7 @@ var dependencyTools = [
     handler: async (input) => {
       const ver = input.version ?? "latest";
       const res = await registryGet(`/${encPkg(input.name)}/${ver}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: `dependencies ${ver}` });
       const v = res.data;
       return {
         ok: true,
@@ -21830,7 +21899,7 @@ var dependencyTools = [
     handler: async (input) => {
       const ver = input.version ?? "latest";
       const res = await registryGet(`/${encPkg(input.name)}/${ver}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: `license_check ${ver}` });
       const pkg = res.data;
       const depEntries = Object.entries(pkg.dependencies ?? {});
       const runLimited = createLimiter(10);
@@ -21888,7 +21957,8 @@ var downloadTools = [
     }),
     handler: async (input) => {
       const period = input.period ?? "last-week";
-      return downloadsGet(`/downloads/point/${period}/${encPkg(input.name)}`);
+      const res = await downloadsGet(`/downloads/point/${period}/${encPkg(input.name)}`);
+      return res.ok ? res : translateError(res, { pkg: input.name, op: `downloads ${period}` });
     }
   },
   {
@@ -21907,7 +21977,8 @@ var downloadTools = [
     }),
     handler: async (input) => {
       const period = input.period ?? "last-month";
-      return downloadsGet(`/downloads/range/${period}/${encPkg(input.name)}`);
+      const res = await downloadsGet(`/downloads/range/${period}/${encPkg(input.name)}`);
+      return res.ok ? res : translateError(res, { pkg: input.name, op: `downloads_range ${period}` });
     }
   },
   {
@@ -21927,7 +21998,8 @@ var downloadTools = [
     handler: async (input) => {
       const period = input.period ?? "last-week";
       const names = input.packages.map((p) => encPkg(p)).join(",");
-      return downloadsGet(`/downloads/point/${period}/${names}`);
+      const res = await downloadsGet(`/downloads/point/${period}/${names}`);
+      return res.ok ? res : translateError(res, { op: `downloads_bulk ${period}` });
     }
   },
   {
@@ -21946,66 +22018,12 @@ var downloadTools = [
     }),
     handler: async (input) => {
       const period = input.period ?? "last-week";
-      return downloadsGet(`/versions/${encPkg(input.name)}/${period}`);
+      const res = await downloadsGet(`/versions/${encPkg(input.name)}/${period}`);
+      return res.ok ? res : translateError(res, { pkg: input.name, op: `version_downloads ${period}` });
     }
   }
 ];
 
-// src/errors.ts
-function translateError(res, context) {
-  if (res.ok) return res;
-  const pkgPart = context.pkg ? ` for ${context.pkg}` : "";
-  const opPart = context.op ? ` during ${context.op}` : "";
-  switch (res.status) {
-    case 401:
-      return {
-        ...res,
-        error: `Authentication failed${pkgPart}${opPart}. Your NPM_TOKEN may be invalid, expired, or lack write scope. Create a Granular Access Token with 'Read and write' permission at https://www.npmjs.com/settings/~/tokens, or use a classic Automation token (which bypasses 2FA). Raw: ${res.error}`
-      };
-    case 403:
-      return {
-        ...res,
-        error: `Not authorized${pkgPart}${opPart}. You may not be a maintainer of this package, or the token's scope doesn't include it. Check current maintainers with npm_collaborators or npm_package_access. Raw: ${res.error}`
-      };
-    case 404:
-      return {
-        ...res,
-        error: `Not found${pkgPart}${opPart}. Check the exact package name (scoped packages require the @scope/ prefix). If the version is specified, verify it exists with npm_package. Raw: ${res.error}`
-      };
-    case 422:
-      return {
-        ...res,
-        error: `Registry rejected the request payload${pkgPart}${opPart} (422 Unprocessable Entity). Most common causes: (1) invalid semver range \u2014 validate with npm_package versions first; (2) deprecation message format \u2014 em-dash form works, period-capital form sometimes 422s; (3) account-level 2FA policy requires interactive CLI session. If #3, CLI fallback: \`npm login --auth-type=web\` followed by the npm CLI command. Raw: ${res.error}`
-      };
-    case 429:
-      return {
-        ...res,
-        error: `Rate limited${opPart}. Wait 60 seconds and retry. Raw: ${res.error}`
-      };
-    case 0:
-      return {
-        ...res,
-        error: `Network error${opPart}. Could not reach the registry. Raw: ${res.error}`
-      };
-    default:
-      return res;
-  }
-}
-function validateDeprecationMessage(msg) {
-  if (msg.length > 1024) {
-    return "Deprecation message exceeds 1024 characters (registry limit).";
-  }
-  if (msg.length === 0) return null;
-  if (/\.\s+[A-Z]/.test(msg)) {
-    return `Deprecation message contains the "period + space + capital letter" pattern that has triggered 422 Unprocessable Entity on at least one scoped package. The working form uses em-dash and lowercase continuation: e.g. "Renamed to @yawlabs/spend \u2014 install that instead". Pass force: true to bypass this validation.`;
-  }
-  return null;
-}
-function versionsMatchingRange(versions, range, maxSatisfying2) {
-  if (range === "*" || range === "") return [...versions];
-  return versions.filter((v) => maxSatisfying2([v], range) === v);
-}
-
 // src/tools/hooks.ts
 function classifyHookTarget(target) {
   if (target.startsWith("~")) return { type: "owner", name: target.slice(1) };
@@ -22159,7 +22177,7 @@ var orgTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/user`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `org_members ${input.org}` });
       const members = Object.entries(res.data).map(([username, role]) => ({ username, role }));
       return {
         ok: true,
@@ -22189,7 +22207,7 @@ var orgTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/package`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `org_packages ${input.org}` });
       const packages = Object.entries(res.data).map(([name, access]) => ({ name, access }));
       return {
         ok: true,
@@ -22219,7 +22237,7 @@ var orgTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth(`/-/org/${encodeURIComponent(input.org)}/team`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `org_teams ${input.org}` });
       return {
         ok: true,
         status: 200,
@@ -22251,7 +22269,7 @@ var orgTools = [
       const res = await registryGetAuth(
         `/-/team/${encodeURIComponent(input.org)}/${encodeURIComponent(input.team)}/package`
       );
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `team_packages ${input.org}:${input.team}` });
       const packages = Object.entries(res.data).map(([name, permissions]) => ({ name, permissions }));
       return {
         ok: true,
@@ -22284,7 +22302,7 @@ var packageTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(`/${encPkg(input.name)}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "package" });
       const pkg = res.data;
       const latest = pkg["dist-tags"]?.latest;
       const latestVersion = latest ? pkg.versions[latest] : void 0;
@@ -22328,7 +22346,7 @@ var packageTools = [
     handler: async (input) => {
       const ver = input.version ?? "latest";
       const res = await registryGet(`/${encPkg(input.name)}/${ver}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: `version ${ver}` });
       const v = res.data;
       return {
         ok: true,
@@ -22378,7 +22396,7 @@ var packageTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(`/${encPkg(input.name)}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "versions" });
       const pkg = res.data;
       const limit = input.limit ?? 50;
       const allVersions = Object.keys(pkg.versions).map((v) => ({
@@ -22416,7 +22434,7 @@ var packageTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(`/${encPkg(input.name)}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "readme" });
       const readme = res.data.readme;
       if (!readme) {
         return { ok: true, status: 200, data: { name: input.name, readme: "(no readme available)" } };
@@ -22438,7 +22456,8 @@ var packageTools = [
       name: external_exports.string().describe("Package name")
     }),
     handler: async (input) => {
-      return registryGet(`/-/package/${encPkg(input.name)}/dist-tags`);
+      const res = await registryGet(`/-/package/${encPkg(input.name)}/dist-tags`);
+      return res.ok ? res : translateError(res, { pkg: input.name, op: "dist_tags" });
     }
   },
   {
@@ -22468,7 +22487,7 @@ var packageTools = [
         registryGet(`/${encPkg(input.name)}/${ver}`),
         registryGet(`/${encPkg(typesPackage)}`)
       ]);
-      if (!versionRes.ok) return versionRes;
+      if (!versionRes.ok) return translateError(versionRes, { pkg: input.name, op: `types ${ver}` });
       const v = versionRes.data;
       const hasBuiltinTypes = !!(v.types || v.typings);
       const typesEntry = hasBuiltinTypes ? v.types ?? v.typings : void 0;
@@ -22516,9 +22535,9 @@ var provenanceTools = [
     }),
     handler: async (input) => {
       const res = await registryGet(
-        `/-/npm/v1/attestations/${encPkg(input.name)}@${input.version}`
+        `/-/npm/v1/attestations/${encPkg(input.name)}@${encodeURIComponent(input.version)}`
       );
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: `provenance ${input.version}` });
       const attestations = (res.data.attestations ?? []).map((a) => ({
         predicateType: a.predicateType,
         bundle: a.bundle
@@ -22556,7 +22575,8 @@ var registryTools = [
     }),
     handler: async (input) => {
       const period = input.period ?? "last-week";
-      return downloadsGet(`/downloads/point/${period}`);
+      const res = await downloadsGet(`/downloads/point/${period}`);
+      return res.ok ? res : translateError(res, { op: `registry_stats ${period}` });
     }
   },
   {
@@ -22578,7 +22598,7 @@ var registryTools = [
         replicateGet("/"),
         replicateGet(`/_changes?limit=${limit}&descending=true`)
       ]);
-      if (!changesRes.ok) return changesRes;
+      if (!changesRes.ok) return translateError(changesRes, { op: "recent_changes" });
       const changes = changesRes.data.results.map((r) => ({
         package: r.id,
         rev: r.changes[0]?.rev
@@ -22689,7 +22709,7 @@ var searchTools = [
       if (input.popularity !== void 0) params.set("popularity", String(input.popularity));
       if (input.maintenance !== void 0) params.set("maintenance", String(input.maintenance));
       const res = await registryGet(`/-/v1/search?${params}`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { op: `search "${input.query}"` });
       const results = res.data.objects.map((obj) => ({
         name: obj.package.name,
         version: obj.package.version,
@@ -22722,7 +22742,34 @@ var securityTools = [
       packages: external_exports.record(external_exports.array(external_exports.string())).describe('Object mapping package names to arrays of version strings, e.g. {"lodash": ["4.17.20"]}')
     }),
     handler: async (input) => {
-      return registryPost("/-/npm/v1/security/advisories/bulk", input.packages);
+      const res = await registryPost("/-/npm/v1/security/advisories/bulk", input.packages);
+      if (!res.ok) return translateError(res, { op: "audit" });
+      const advisoriesByPackage = res.data ?? {};
+      const summary = Object.entries(advisoriesByPackage).map(([name, advisories]) => {
+        const list = Array.isArray(advisories) ? advisories : [];
+        const severityCounts = {};
+        for (const adv of list) {
+          const severity = adv?.severity ?? "unknown";
+          severityCounts[severity] = (severityCounts[severity] ?? 0) + 1;
+        }
+        return { name, advisoryCount: list.length, severityCounts };
+      });
+      const queried = Object.keys(input.packages);
+      const vulnerable = summary.filter((s) => s.advisoryCount > 0).map((s) => s.name);
+      const clean = queried.filter((n) => !vulnerable.includes(n));
+      return {
+        ok: true,
+        status: 200,
+        data: {
+          queriedCount: queried.length,
+          vulnerableCount: vulnerable.length,
+          cleanCount: clean.length,
+          vulnerable,
+          clean,
+          summary,
+          advisories: advisoriesByPackage
+        }
+      };
     }
   },
   {
@@ -22749,7 +22796,8 @@ var securityTools = [
           Object.entries(input.dependencies).map(([pkg, ver]) => [pkg, { version: ver }])
         )
       };
-      return registryPost("/-/npm/v1/security/audits", body);
+      const res = await registryPost("/-/npm/v1/security/audits", body);
+      return res.ok ? res : translateError(res, { pkg: input.name, op: "audit_deep" });
     }
   },
   {
@@ -22764,7 +22812,8 @@ var securityTools = [
     },
     inputSchema: external_exports.object({}),
     handler: async () => {
-      return registryGet("/-/npm/v1/keys");
+      const res = await registryGet("/-/npm/v1/keys");
+      return res.ok ? res : translateError(res, { op: "signing_keys" });
     }
   }
 ];
@@ -22788,7 +22837,7 @@ var trustTools = [
       const authErr = requireAuth();
       if (authErr) return authErr;
       const res = await registryGetAuth(`/-/package/${encPkg(input.name)}/trust`);
-      if (!res.ok) return res;
+      if (!res.ok) return translateError(res, { pkg: input.name, op: "trusted_publishers" });
       const configs = (res.data ?? []).map((c) => {
         const result = {
           id: c.id,
@@ -23100,6 +23149,10 @@ var workflowTools = [
 async function fetchPackument(pkg) {
   return registryGetAuth(`/${encPkg(pkg)}?write=true`);
 }
+function parseTeamTarget(target) {
+  const m = target.match(/^@?([^:]+):(.+)$/);
+  return m ? { scope: m[1], team: m[2] } : null;
+}
 function highestVersion(versions) {
   const parsed = [];
   for (const v of versions) {
@@ -23116,7 +23169,7 @@ var writeTools = [
   // ───────────────────────────────────────────────────────
   {
     name: "npm_deprecate",
-    description: "Deprecate a package or specific versions. Shows a warning message on install. Uses the HTTP API with NPM_TOKEN, bypassing the CLI auth friction that causes 422 errors on accounts with 2FA. Message format: prefer em-dash form ('Renamed to @scope/pkg \u2014 install that instead'); period-capital form sometimes triggers 422.",
+    description: "Deprecate a package or specific versions. Shows a warning message on install. Uses the HTTP API with NPM_TOKEN, bypassing the CLI auth friction that causes 422 errors on accounts with 2FA. Message format tip: the period-then-capital pattern ('... install that instead. Thanks.') has 422'd on at least one scoped package; em-dash form is the known-good workaround. Pass force: true to skip the preflight check if you want the exact message as-is.",
     annotations: {
       title: "Deprecate package",
       readOnlyHint: false,
@@ -23661,15 +23714,15 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return {
           ok: false,
           status: 400,
           error: `Team must be in the form '@scope:team' (got '${input.team}').`
         };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryPutAuth(`/-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/package`, {
         package: input.package,
         permissions: input.permissions
@@ -23702,15 +23755,15 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return {
           ok: false,
           status: 400,
           error: `Team must be in the form '@scope:team' (got '${input.team}').`
         };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryDeleteAuth(`/-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/package`, {
         package: input.package
       });
@@ -23742,11 +23795,11 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return { ok: false, status: 400, error: `Team must be in the form '@scope:team' (got '${input.team}').` };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryPutAuth(`/-/org/${encodeURIComponent(scope)}/team`, {
         name: team,
         description: input.description
@@ -23774,11 +23827,11 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return { ok: false, status: 400, error: `Team must be in the form '@scope:team' (got '${input.team}').` };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryDeleteAuth(`/-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}`);
       if (!res.ok) return translateError(res, { op: `team_delete ${input.team}` });
       return { ok: true, status: 200, data: { team: `@${scope}:${team}`, deleted: true } };
@@ -23804,11 +23857,11 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return { ok: false, status: 400, error: `Team must be in the form '@scope:team' (got '${input.team}').` };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryPutAuth(`/-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/user`, {
         user: input.user
       });
@@ -23836,11 +23889,11 @@ var writeTools = [
     handler: async (input) => {
       const authErr = requireAuth();
       if (authErr) return authErr;
-      const m = input.team.match(/^@?([^:]+):(.+)$/);
-      if (!m) {
+      const parsed = parseTeamTarget(input.team);
+      if (!parsed) {
         return { ok: false, status: 400, error: `Team must be in the form '@scope:team' (got '${input.team}').` };
       }
-      const [, scope, team] = m;
+      const { scope, team } = parsed;
       const res = await registryDeleteAuth(`/-/team/${encodeURIComponent(scope)}/${encodeURIComponent(team)}/user`, {
         user: input.user
       });
@@ -23934,7 +23987,7 @@ var writeTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.7.0" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.8.0" : (await null).createRequire(import.meta.url)("../package.json").version;
 var subcommand = process.argv[2];
 if (subcommand === "version" || subcommand === "--version") {
   console.log(version2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/npmjs-mcp",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "npm registry MCP server — package intelligence, security audits, and dependency analysis for AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",