drupal-mcp-connector 2.17.0 → 2.18.0

package/src/lib/verify.js

@@ -738,7 +738,13 @@ export async function verifyLive(site, { transport, callTool = null, contentTarg
    */
   const attemptConfigWrite = async () => {
     try {
-      await callTool(site, CONFIG_SET_TOOL, { name: "system.site", data: { name: "verification probe" } });
+      // The negative probe must reach source authorization, not merely prove
+      // that the connector hides out-of-tier tools from discovery.
+      const tool = site.serverTools?.bindings === undefined ? CONFIG_SET_TOOL
+        : (await import("./module-tools.js")).resolveModuleBinding(site, "configSet", {
+          operation: "write", scope: "mcp_config", capabilities: ["configWrite"],
+        }).policy.name;
+      await callTool(site, tool, { name: "system.site", data: { name: "verification probe" } });
       return { served: true, outcome: "served", detail: "accepted" };
     } catch (err) {
       // Not every throw is a refusal — see classifyBridgeError.

package/src/tools/config.js

@@ -22,7 +22,17 @@ import {
   assertConfigScope,
   hasScope,
 } from "../lib/security.js";
-import { callServerTool, SERVER_TOOLS } from "../lib/server-tools.js";
+import { callServerTool, callBoundModuleTool, SERVER_TOOLS } from "../lib/server-tools.js";
+
+/** Compatibility names use an approved module binding when configured. */
+async function configTool(site, binding, args, operation, capability) {
+  if (site.serverTools?.bindings !== undefined) {
+    return callBoundModuleTool(site, binding, args, {
+      operation, scope: "mcp_config", capabilities: [capability],
+    });
+  }
+  return callServerTool(site, new Map(Object.entries(SERVER_TOOLS)).get(binding), args);
+}
 
 // ---------------------------------------------------------------------------
 // Config tools (governed via the server-tool bridge)
@@ -38,7 +48,7 @@ async function configGet({ site: siteName, name }) {
   const site = getSiteConfig(siteName);
   assertConfigScope(site, `config:get ${name}`);
   assertConfigReadAllowed(resolveSecurityConfig(site));
-  return callServerTool(site, SERVER_TOOLS.configGet, { name });
+  return configTool(site, "configGet", { name }, "read", "configRead");
 }
 
 /**
@@ -52,7 +62,7 @@ async function configList({ site: siteName, prefix }) {
   assertConfigScope(site, "config:list");
   assertConfigReadAllowed(resolveSecurityConfig(site));
   const args = prefix ? { prefix } : {};
-  return callServerTool(site, SERVER_TOOLS.configList, args);
+  return configTool(site, "configList", args, "read", "configRead");
 }
 
 /**
@@ -73,7 +83,7 @@ async function configSet({ site: siteName, name, value }) {
   assertConfigScope(site, `config:set ${name}`);
   assertNotReadOnly(sec, `config:set ${name}`);
   assertConfigWriteAllowed(sec);
-  return callServerTool(site, SERVER_TOOLS.configSet, { name, data: value });
+  return configTool(site, "configSet", { name, data: value }, "write", "configWrite");
 }
 
 // ---------------------------------------------------------------------------

package/src/tools/media.js

@@ -15,9 +15,9 @@ import {
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
 } from "../lib/security.js";
 import {
-  assertDraftLangcode, readDraftTranslation, readTranslationInventory, writeDraft,
-} from "../lib/draft-write.js";
-import { assertInventoryDraftLanguage } from "../lib/node-draft-inventory.js";
+  assertDraftLangcode, readDraftTranslation, readTranslationInventory,
+} from "../lib/sentinel-draft.js";
+import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
 import { entityRevisionId } from "../lib/write-revision.js";
 
 /**
@@ -138,26 +138,22 @@ async function updateMedia({ site: siteName, type, id, name, status, fields = {}
   const backend = await resolveBackend(site);
   if (langcode) {
     const targetLang = assertDraftLangcode(langcode);
-    const inventory = await readTranslationInventory(backend, { entityType: "media", bundle: type, id });
-    assertInventoryDraftLanguage(inventory, targetLang);
-    const liveVid = inventory.live?.vid;
-    const workingVid = inventory.working?.vid;
-    if (!liveVid || !workingVid || String(workingVid) === String(liveVid)) {
-      throw new Error(
-        "No unpublished working translation for this language. " +
-        "Create it with drupal_create_translation first; a canonical langcode PATCH is not attempted.",
-      );
-    }
-    const result = await writeDraft(backend, {
-      entityType: "media", bundle: type, id, attributes, langcode: targetLang,
+    const patchTarget = await prepareGuardedPatch(backend, {
+      entityType: "media", bundle: type, id, attributes,
+      ...(relationships ? { relationships } : {}),
+      langcode: targetLang,
+    });
+    const result = await updateEntityGuarded(backend, {
+      entityType: "media", bundle: type, id, attributes,
       ...(relationships ? { relationships } : {}),
-      draftRevision: { liveVid, workingVid },
+      langcode: targetLang,
+      ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
     });
     const redacted = redactCanonicalEntity(result, sec, "media");
-    const working = entityRevisionId(result) ?? workingVid;
+    const working = entityRevisionId(result) ?? patchTarget.workingVid;
     return {
       ...redacted,
-      _revisions: { live: liveVid, working },
+      _revisions: { live: patchTarget.liveVid, working },
     };
   }
   // #171: pre-read so an unrequested published-state flip is reported, not silent.

package/src/tools/moderation.js

@@ -22,7 +22,9 @@ import {
 } from "../lib/security.js";
 import { collectEntities } from "../lib/reports-support.js";
 import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
-import { assertDraftLangcode, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, isMissingTranslationEndpoint, readTranslationInventory, supportsSentinelDraft,
+} from "../lib/sentinel-draft.js";
 import { inventoryRowMatching } from "../lib/translation-rows.js";
 
 /** Cap for the client-side scan when JSON:API cannot filter the field. */
@@ -65,25 +67,23 @@ async function setModerationState({ site: siteName, type, id, state, langcode })
   const attributes = { moderation_state: state };
   assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  if (langcode) {
-    const targetLang = assertDraftLangcode(langcode);
-    let existing = null;
-    try {
-      existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
-    } catch {
-      existing = null;
-    }
-    const patchTarget = await prepareGuardedPatch(backend, {
-      entityType: "node", bundle: type, id, existing, attributes, langcode: targetLang,
-    });
-    const patched = await updateEntityGuarded(backend, {
-      entityType: "node", bundle: type, id, attributes, langcode: targetLang,
-      ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
-    });
-    return redactCanonicalEntity(patched, sec, "node");
+  const targetLang = langcode ? assertDraftLangcode(langcode) : undefined;
+  let existing = null;
+  try {
+    existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
+  } catch {
+    existing = null;
   }
-  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
-  return redactCanonicalEntity(entity, sec, "node");
+  const patchTarget = await prepareGuardedPatch(backend, {
+    entityType: "node", bundle: type, id, existing, attributes,
+    ...(targetLang ? { langcode: targetLang } : {}),
+  });
+  const patched = await updateEntityGuarded(backend, {
+    entityType: "node", bundle: type, id, attributes,
+    ...(targetLang ? { langcode: targetLang } : {}),
+    ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
+  });
+  return redactCanonicalEntity(patched, sec, "node");
 }
 
 /**
@@ -104,7 +104,7 @@ async function contentByModerationState({ site: siteName, type, state, limit = 2
   const sort = [{ field: "changed", dir: "desc" }];
   const targetLang = langcode ? assertDraftLangcode(langcode) : null;
   if (targetLang) {
-    if (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function") {
+    if (!supportsSentinelDraft(backend)) {
       return {
         type, state, langcode: targetLang, unavailable: true,
         reason: "A langcode filter requires Sentinel's translation inventory.",
@@ -130,7 +130,7 @@ async function contentByModerationState({ site: siteName, type, state, limit = 2
           });
         }
       } catch (error) {
-        if (/does not provide Sentinel's governed draft-translation endpoint/.test(String(error?.message))) {
+        if (isMissingTranslationEndpoint(error)) {
           return {
             type, state, langcode: targetLang, unavailable: true,
             reason: "A langcode filter requires Sentinel's translation inventory.",

package/src/tools/nodes.js

@@ -18,7 +18,7 @@ import { shapeWriteResponse, flagUnrequestedStatusChange, RETURNING_SCHEMA, omit
 import { resolveErrRelationships, relationshipsWereSent, paragraphPinsFromEntity } from "../lib/err-relationships.js";
 import { attachWrittenRevisionPair, readWrittenRevision } from "../lib/write-revision.js";
 import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
-import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/draft-write.js";
+import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/sentinel-draft.js";
 import { paragraphResourceVersion } from "./paragraphs.js";
 import { assertBodySummaryWritable, attachSummaryDeprecation } from "../lib/body-summary.js";
 import { buildRedirectAttributes, REDIRECT_ENTITY_TYPE } from "./redirects.js";

package/src/tools/paragraphs.js

@@ -46,7 +46,7 @@ import {
   assertDraftLangcode,
   readDraftTranslation,
   writeDraft,
-} from "../lib/draft-write.js";
+} from "../lib/sentinel-draft.js";
 
 /**
  * Build the resource-identifier ref used to embed a paragraph in a host ERR /

package/src/tools/reports-config.js

@@ -20,7 +20,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveSecurityConfig, assertConfigReadAllowed } from "../lib/security.js";
 import { gatedReport } from "../lib/reports-support.js";
-import { callServerTool, SERVER_TOOLS, toolResultData } from "../lib/server-tools.js";
+import { callServerTool, callBoundModuleTool, SERVER_TOOLS, toolResultData } from "../lib/server-tools.js";
 import { runPrivileged, serverToolsConfigured, drushConfigured } from "../lib/audit-sources.js";
 import { sshDrush, parseDrush } from "./drush.js";
 
@@ -65,6 +65,11 @@ function configSourceAvailable(site) {
  * @returns {Promise<*>} Parsed config object (or null/text).
  */
 async function readConfig(site, name) {
+  if (site.serverTools?.bindings !== undefined) {
+    return toolResultData(await callBoundModuleTool(site, "configGet", { name }, {
+      operation: "read", scope: "mcp_config", capabilities: ["configRead"],
+    }));
+  }
   if (serverToolsConfigured(site)) {
     try { return toolResultData(await callServerTool(site, SERVER_TOOLS.configGet, { name })); }
     catch (err) { if (!drushConfigured(site)) throw err; }
@@ -82,6 +87,11 @@ async function readConfig(site, name) {
  * @returns {Promise<string[]>} Config object names.
  */
 async function listConfigNames(site, prefix) {
+  if (site.serverTools?.bindings !== undefined) {
+    return pickConfigNames(toolResultData(await callBoundModuleTool(site, "configList", { prefix }, {
+      operation: "read", scope: "mcp_config", capabilities: ["configRead"],
+    })));
+  }
   if (serverToolsConfigured(site)) {
     try { return pickConfigNames(toolResultData(await callServerTool(site, SERVER_TOOLS.configList, { prefix }))); }
     catch (err) { if (!drushConfigured(site)) throw err; }

package/src/tools/reports-content.js

@@ -17,7 +17,9 @@ import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertReadAllowed } from "../lib/security.js";
 import { collectEntities, fieldValue, daysSince } from "../lib/reports-support.js";
 import { bodyHtml, extractAnchors, classifyLink, normalizePath } from "../lib/audit-support.js";
-import { assertDraftLangcode, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, isMissingTranslationEndpoint, readTranslationInventory, supportsSentinelDraft,
+} from "../lib/sentinel-draft.js";
 import { inventoryRowMatching, inventoryTranslationRows, mapTranslationRow } from "../lib/translation-rows.js";
 
 // ---------------------------------------------------------------------------
@@ -116,7 +118,7 @@ async function workflowBottlenecks({ site: siteName, type, days = 30, states, sa
     sampleSize
   );
 
-  if (targetLang && (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function")) {
+  if (targetLang && !supportsSentinelDraft(backend)) {
     return {
       contentType,
       unavailable: true,
@@ -139,7 +141,7 @@ async function workflowBottlenecks({ site: siteName, type, days = 30, states, sa
         if (!row) continue;
         state = row.moderation_state;
       } catch (error) {
-        if (/does not provide Sentinel's governed draft-translation endpoint/.test(String(error?.message))) {
+        if (isMissingTranslationEndpoint(error)) {
           return {
             contentType,
             unavailable: true,
@@ -207,8 +209,7 @@ async function translationCoverage({ site: siteName, type, sampleSize = 100 }) {
     sampleSize
   );
 
-  const missingEndpoint = /does not provide Sentinel's governed draft-translation endpoint/;
-  if (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function") {
+  if (!supportsSentinelDraft(backend)) {
     return {
       contentType,
       scanned: nodes.length,
@@ -239,7 +240,7 @@ async function translationCoverage({ site: siteName, type, sampleSize = 100 }) {
         outdated: rows.some((row) => row.outdated === true),
       });
     } catch (error) {
-      if (!missingEndpoint.test(String(error?.message))) throw error;
+      if (!isMissingTranslationEndpoint(error)) throw error;
     }
   }
 

package/src/tools/revisions.js

@@ -11,8 +11,8 @@
  *     full chronological history enumeration requires the Drush bridge.
  *   - drupal_get_revision fetches one specific version (by vid or alias).
  *   - drupal_revert_revision is a GOVERNED WRITE: it reads the target revision
- *     and replays its editable attributes through updateEntity to make them the
- *     new current revision (assertWriteAllowed gates it; internal/immutable
+ *     and replays its editable attributes through prepareGuardedPatch /
+ *     updateEntityGuarded (assertWriteAllowed gates it; internal/immutable
  *     bookkeeping fields are never written back).
  *
  * Reads are redacted per the site's security policy.
@@ -23,9 +23,11 @@ import { resolveBackend } from "../lib/backends/index.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity,
 } from "../lib/security.js";
-import { readNodeDraftInventory } from "../lib/node-draft-inventory.js";
-import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, readDraftTranslation, readNodeDraftInventory, readTranslationInventory,
+} from "../lib/sentinel-draft.js";
 import { omitLiveComputedMetatag } from "../lib/entity-response.js";
+import { changedAheadOfRevision, prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
 
 // Attributes that describe the entity's identity / revision bookkeeping / paths.
 // These are read-only or server-managed and must NOT be replayed on a revert.
@@ -123,20 +125,6 @@ function summarizeRevision(resource) {
   };
 }
 
-/**
- * Whether the default revision's `changed` is later than its own
- * `revision_timestamp` — the readable fingerprint of a #201 node.
- * @param {?object} summary
- * @returns {boolean}
- */
-function changedAheadOfRevision(summary) {
-  if (!summary?.changed || !summary?.revisionTimestamp) return false;
-  const changed = Date.parse(summary.changed);
-  const rev = Date.parse(summary.revisionTimestamp);
-  if (!Number.isFinite(changed) || !Number.isFinite(rev)) return false;
-  return changed > rev;
-}
-
 const LIST_REVISIONS_BASE_NOTE =
   "JSON:API only addresses revisions by id (id:<vid>) or the rel:latest-version / " +
   "rel:working-copy aliases; it cannot enumerate the full chronological history. " +
@@ -286,10 +274,11 @@ async function getRevision({ site: siteName, type, id, version, langcode }) {
 
 /**
  * Revert an entity to a prior revision (GOVERNED WRITE). Reads the target
- * revision, then replays its editable attributes through updateEntity so they
- * become the new current revision. Internal/immutable bookkeeping fields
- * (drupal_internal__*, revision metadata, computed path, timestamps) are
- * stripped before the write so only restorable content is sent.
+ * revision, then replays its editable attributes through prepareGuardedPatch
+ * / updateEntityGuarded so they become the new current revision. Internal /
+ * immutable bookkeeping fields (drupal_internal__*, revision metadata,
+ * computed path, timestamps) are stripped before the write so only
+ * restorable content is sent.
  *
  * This does not delete any history — the revert produces a NEW revision whose
  * content matches the target, preserving the audit trail.
@@ -328,7 +317,19 @@ async function revertRevision({ site: siteName, type, id, version }) {
     )
   );
 
-  await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
+  let existing = null;
+  try {
+    existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
+  } catch {
+    existing = null;
+  }
+  const patchTarget = await prepareGuardedPatch(backend, {
+    entityType: "node", bundle: type, id, existing, attributes,
+  });
+  await updateEntityGuarded(backend, {
+    entityType: "node", bundle: type, id, attributes,
+    ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
+  });
 
   return {
     success: true,

package/src/tools/structure.js

@@ -19,7 +19,7 @@ import { resolveBackend } from "../lib/backends/index.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity,
 } from "../lib/security.js";
-import { assertDraftLangcode } from "../lib/draft-write.js";
+import { assertDraftLangcode } from "../lib/sentinel-draft.js";
 
 const MENU_LINK_TYPE = "menu_link_content";
 const BLOCK_TYPE = "block_content";

package/src/tools/taxonomy.js

@@ -12,7 +12,7 @@ import {
   resolveSecurityConfig, redactCanonicalEntity,
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed,
 } from "../lib/security.js";
-import { assertDraftLangcode } from "../lib/draft-write.js";
+import { assertDraftLangcode } from "../lib/sentinel-draft.js";
 
 // ---------------------------------------------------------------------------
 // Implementations

package/src/tools/translations.js

@@ -34,9 +34,11 @@ import { paragraphRevisionId } from "../lib/err-relationships.js";
 import {
   assertDraftLangcode,
   createTranslationDraft,
+  isMissingTranslationEndpoint,
   readTranslationInventory,
   resolveNodeTranslationPair,
-} from "../lib/draft-write.js";
+  supportsSentinelDraft,
+} from "../lib/sentinel-draft.js";
 import { mapTranslationRow } from "../lib/translation-rows.js";
 
 const LIST_NOTE =
@@ -66,7 +68,7 @@ async function listTranslations({ site: siteName, entityType = "node", type, id
 
   const backend = await resolveBackend(site);
   if ((entityType === "node" || entityType === "paragraph" || entityType === "media")
-    && typeof backend.rawQuery === "function") {
+    && supportsSentinelDraft(backend)) {
     try {
       const meta = await readTranslationInventory(backend, { entityType, bundle: type, id });
       const liveLangs = (meta.live?.translations ?? []).map((row) => row.langcode);
@@ -84,7 +86,7 @@ async function listTranslations({ site: siteName, entityType = "node", type, id
         note: LIST_NOTE,
       };
     } catch (error) {
-      if (!/does not provide Sentinel's governed draft-translation endpoint/.test(String(error?.message))) {
+      if (!isMissingTranslationEndpoint(error)) {
         throw error;
       }
     }