Publish rejects correct mcpName as stale/mismatched — npm registry confirms it's correct

GitHub username: lelu-auth
Organization: Lelu-ai
Namespace: io.github.Lelu-ai/lelu-mcp
Repository: https://github.com/Lelu-ai/lelu
NPM package: lelu-mcp

Environment: mcp-publisher 1.8.1

What happened

mcp-publisher publish consistently rejects the server with a 400, claiming the published npm package's mcpName doesn't match server.json's name — but it does, verified directly against the npm registry API multiple times over several hours (including across a full session restart).

Error: publish failed: server returned status 400: {"title":"Bad Request","status":400,"detail":"Failed to publish server","errors":[{"message":"registry validation failed for package 0 (lelu-mcp): NPM package ownership validation failed. Expected mcpName 'io.github.Lelu-ai/lelu-mcp', got 'io.github.lelu-ai/lelu-mcp'"}]}

Note the casing: expected io.github.Lelu-ai (capital L, the real org name), but the registry reports it "got" io.github.lelu-ai (lowercase) — even though the npm package has never had the lowercase value published.

Verification that npm's own data is correct

$ curl -s https://registry.npmjs.org/lelu-mcp/0.0.34 | jq .mcpName
"io.github.Lelu-ai/lelu-mcp"

$ curl -s https://registry.npmjs.org/lelu-mcp | jq '.["dist-tags"].latest, .versions[.["dist-tags"].latest].mcpName'
"0.0.34"
"io.github.Lelu-ai/lelu-mcp"

0.0.34 was published with the correct capital-L mcpName from the start (we caught and fixed a casing mismatch between our org name Lelu-ai and an earlier lowercase lelu-ai namespace before ever publishing this version). There is no version of lelu-mcp on npm that has ever published the lowercase io.github.lelu-ai value as mcpName — grepping the full version history confirms this.

Reproduction timeline

• Published lelu-mcp@0.0.34 with mcpName: "io.github.Lelu-ai/lelu-mcp"
• mcp-publisher publish → 400, "got 'io.github.lelu-ai/lelu-mcp'" (lowercase)
• Waited ~20 minutes, retried → same 400, byte-identical error
• Session restarted (unrelated), more time passed (at least an hour total)
• Retried again → same 400, byte-identical error

This strongly suggests the registry caches npm package metadata (specifically mcpName) somewhere in its publish-validation path, keyed in a way that doesn't invalidate on new publishes and doesn't expire within at least an hour.

Ask

Could someone check whether there's a stale cache entry for lelu-mcp on the registry side, and if so, clear it? Happy to provide more detail (org permission checks, PAT scopes, etc.) if useful — we already worked through the org-namespace permission requirements documented in #1468 / #1383 / #1435, this is a separate issue after permissions were confirmed correctly granted (the 403 became a 400 once the token carried io.github.Lelu-ai/* correctly).

Start with the mcp-publisher publish flow and the registry's npm ownership-validation path, using the supplied npm registry API responses and repeated 400 reproduction. Trace where the mcpName value is read or cached; done means the correctly cased value is accepted without weakening ownership validation.