f17de4044a* Add npm/PyPI package publishing access management (config + drift detection) Declare expected npm org membership, per-package maintainers and trusted publishers, and PyPI project rosters in src/config/packageAccess.ts, with npm/pypi identity fields on members in users.ts. Deliberately outside the Pulumi resource graph: npm governance writes require an interactive 2FA challenge since August 2026 (read endpoints still work with a granular access token), and PyPI has no management API at all. Drift against the live npm registry is detected read-only by scripts/check-package-drift.ts (weekly via package-drift.yml, no-op when the NPM_READ_TOKEN secret is absent), which emits a remediation plan of npm CLI commands for a maintainer to run in one 2FA-approved session. PyPI procedures are documented as a manual runbook in the README. * Encode all slashes when escaping package names in registry URLs Fixes the CodeQL finding: String.replace with a string pattern only replaces the first occurrence. Use a shared helper with a global regex, following the npm CLI convention (keep '@' literal, encode every '/'). --------- Co-authored-by: Claude <noreply@anthropic.com>
28 lines
858 B
JSON
28 lines
858 B
JSON
{
|
|
"name": "@mcp/access",
|
|
"version": "1.0.0",
|
|
"description": "Infrastructure as Code for MCP access management",
|
|
"main": "src/index.ts",
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"validate": "npx ts-node scripts/validate-config.ts",
|
|
"test": "npx ts-node scripts/test-config.ts",
|
|
"check-package-drift": "npx ts-node scripts/check-package-drift.ts",
|
|
"check": "npm run format:check && npm run validate && npm run test",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check ."
|
|
},
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@pulumi/github": "^6.11.0",
|
|
"@pulumi/googleworkspace": "file:sdks/googleworkspace",
|
|
"@pulumi/pulumi": "^3.218.0",
|
|
"@pulumi/random": "^4.14.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.18.6",
|
|
"prettier": "^3.7.2",
|
|
"ts-node": "^10.9.2",
|
|
"typescript": "^5.9.2"
|
|
}
|
|
}
|