unpublish

Instructions

Implementation Reference

• src/index.ts:155-178 (handler)

  The main 'unpublish' tool handler that runs 'npm unpublish' with the provided package name, optional --force, and --otp flags via the run() helper.

  // ── npm unpublish ──
  server.tool(
    "unpublish",
    "Remove a package version from the registry",
    {
      package: z.string().describe("Package name with optional version (e.g. pkg@1.0.0)"),
      force: z.boolean().optional().describe("Force unpublish (required for entire package)"),
      otp: z.string().optional().describe("One-time password for 2FA"),
    },
    async ({ package: pkg, force, otp }) => {
      const args = ["unpublish", pkg];
      if (force) args.push("--force");
      if (otp) args.push("--otp", otp);
      try {
        const { stdout, stderr } = await run(args);
        return { content: [{ type: "text", text: stdout + stderr }] };
      } catch (e: any) {
        return {
          content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
          isError: true,
        };
      }
    },
  );

• src/index.ts:159-163 (schema)

  Zod schema for the 'unpublish' tool input: package (string), force (optional boolean), otp (optional string).

  {
    package: z.string().describe("Package name with optional version (e.g. pkg@1.0.0)"),
    force: z.boolean().optional().describe("Force unpublish (required for entire package)"),
    otp: z.string().optional().describe("One-time password for 2FA"),
  },

• src/index.ts:156-178 (registration)

  Registration of the 'unpublish' tool via server.tool() with name, description, schema, and handler.

  server.tool(
    "unpublish",
    "Remove a package version from the registry",
    {
      package: z.string().describe("Package name with optional version (e.g. pkg@1.0.0)"),
      force: z.boolean().optional().describe("Force unpublish (required for entire package)"),
      otp: z.string().optional().describe("One-time password for 2FA"),
    },
    async ({ package: pkg, force, otp }) => {
      const args = ["unpublish", pkg];
      if (force) args.push("--force");
      if (otp) args.push("--otp", otp);
      try {
        const { stdout, stderr } = await run(args);
        return { content: [{ type: "text", text: stdout + stderr }] };
      } catch (e: any) {
        return {
          content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
          isError: true,
        };
      }
    },
  );

• src/index.ts:1227-1231 (registration)

  Sandbox (Smithery) registration of the 'unpublish' tool with noop handler.

  sandbox.tool("unpublish", "Remove a package version from the registry", {
    package: z.string().describe("Package name with optional version"),
    force: z.boolean().optional().describe("Force unpublish"),
    otp: z.string().optional().describe("One-time password for 2FA"),
  }, noop);

• src/index.ts:26-38 (helper)

  The run() helper function used by the unpublish handler to execute npm commands via execFile.

  async function run(
    args: string[],
    cwd?: string,
  ): Promise<{ stdout: string; stderr: string }> {
    const fullArgs = [...args, ...npmrcArgs];
    const opts: { cwd?: string; timeout: number; env: NodeJS.ProcessEnv; maxBuffer: number } = {
      timeout: 120_000,
      maxBuffer: 10 * 1024 * 1024, // 10MB buffer for large outputs
      env: { ...process.env, NO_COLOR: "1" },
    };
    if (cwd) opts.cwd = cwd;
    return exec(NPM, fullArgs, opts);
  }