drupal-mcp-connector 2.17.0 → 2.19.0

package/src/lib/server-tools.js

@@ -23,10 +23,19 @@
  */
 
 import fetch from "node-fetch";
+import { createHmac, randomBytes } from "node:crypto";
 import { authHeadersAsync, clientHeaders, CLIENT_NAME, CLIENT_VERSION } from "./config.js";
-import { consumeBudgetIfEnforced, northboundHeaders, sourceBudgetDenial } from "./data-flow.js";
+import { consumeBudgetIfEnforced, northboundHeaders, sourceBudgetDenial, getDataFlowContext } from "./data-flow.js";
 import { clearToken } from "./oauth.js";
 
+/** Calls a configured module binding through the registry, without fallback. */
+export async function callBoundModuleTool(site, binding, args, required) {
+  // Load at invocation: built-in tool definitions are also consumed by the
+  // registry's dispatch middleware, so a static import would create a cycle.
+  const { createModuleToolRegistry } = await import("./module-tools.js");
+  return createModuleToolRegistry().callBinding(site, binding, args, required);
+}
+
 /**
  * Canonical server-side tool names for governed config operations.
  *
@@ -50,11 +59,14 @@ const MCP_PROTOCOL_VERSION = "2025-06-18";
 let rpcId = 0;
 
 /**
- * Per-site MCP session cache, keyed by site._name. Holds the `Mcp-Session-Id`
+ * MCP session cache, keyed by site, endpoint, credentials and principal. Holds the `Mcp-Session-Id`
  * issued by the server's `initialize` response; cleared and re-acquired when the
  * server reports the session is gone (expiry).
  */
 const sessions = new Map();
+// Ephemeral cache identity only, never a persisted password verifier. A keyed
+// digest also prevents offline guessing if a diagnostic exposes a cache key.
+const sessionIdentityKey = randomBytes(32);
 
 /**
  * Resolve a site's server-tools endpoint, or throw a clear, actionable error
@@ -156,7 +168,7 @@ function parseSse(text) {
  * @returns {Promise<string>} The issued MCP session id.
  * @throws {Error} on transport failure, a JSON-RPC error, or a missing session id.
  */
-async function initializeSession(site, endpoint) {
+async function initializeSession(site, endpoint, key) {
   const payload = {
     jsonrpc: "2.0",
     id: ++rpcId,
@@ -173,6 +185,8 @@ async function initializeSession(site, endpoint) {
       method: "POST",
       headers: await baseHeaders(site, null),
       body: JSON.stringify(payload),
+      size: 262144,
+      signal: AbortSignal.timeout(15000),
     });
 
   let res = await post();
@@ -205,12 +219,15 @@ async function initializeSession(site, endpoint) {
       method: "POST",
       headers: await baseHeaders(site, sessionId),
       body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }),
+      size: 262144,
+      signal: AbortSignal.timeout(15000),
     });
   } catch {
     // Notification is advisory; proceed with the established session.
   }
 
-  sessions.set(site._name, sessionId);
+  if (sessions.size >= 128) sessions.delete(sessions.keys().next().value);
+  sessions.set(key, sessionId);
   return sessionId;
 }
 
@@ -220,9 +237,9 @@ async function initializeSession(site, endpoint) {
  * @param {string} endpoint Fully-qualified endpoint URL.
  * @returns {Promise<string>} The active MCP session id.
  */
-async function ensureSession(site, endpoint) {
-  const cached = sessions.get(site._name);
-  return cached || initializeSession(site, endpoint);
+async function ensureSession(site, endpoint, key) {
+  const cached = sessions.get(key);
+  return cached || initializeSession(site, endpoint, key);
 }
 
 /**
@@ -253,16 +270,32 @@ function isSessionError(res, body) {
  * @returns {Promise<*>} The tool's structured result.
  * @throws {Error} on transport failure, JSON-RPC error, or tool error.
  */
-export async function callServerTool(site, toolName, args = {}) {
+export async function callServerTool(site, toolName, args = {}, options = {}) {
+  return requestServerTool(site, "tools/call", { name: toolName, arguments: args }, options);
+}
+
+/** Fetch one page of the authenticated module tool catalog. */
+export async function listServerTools(site, cursor) {
+  return requestServerTool(site, "tools/list", cursor === undefined ? {} : { cursor }, {
+    maxBytes: 262144, preserveErrors: true,
+  });
+}
+
+/** Shared bounded MCP request transport; retries only explicit auth/session rejection. */
+async function requestServerTool(site, method, params, options) {
+  const toolName = params.name ?? method;
   const endpoint = resolveEndpoint(site);
   const payload = {
     jsonrpc: "2.0",
     id: ++rpcId,
-    method: "tools/call",
-    params: { name: toolName, arguments: args },
+    method,
+    params,
   };
 
-  let sessionId = await ensureSession(site, endpoint);
+  const sessionKey = createHmac("sha256", sessionIdentityKey).update(JSON.stringify([
+    site._name, endpoint, await authHeadersAsync(site), getDataFlowContext()?.principalKey ?? null,
+  ])).digest("hex");
+  let sessionId = await ensureSession(site, endpoint, sessionKey);
   let refreshedAuth = false;
   let reinitedSession = false;
   let paid = false;
@@ -275,21 +308,22 @@ export async function callServerTool(site, toolName, args = {}) {
       method: "POST",
       headers: await baseHeaders(site, sessionId),
       body: JSON.stringify(payload),
+      ...(options.maxBytes ? { size: options.maxBytes, signal: AbortSignal.timeout(15000) } : {}),
     });
     const { body, rawText } = await readBody(res);
 
     // OAuth sites: a 401 may mean the token expired server-side. Refresh once.
-    if (res.status === 401 && site.oauth && !refreshedAuth) {
+    if (res.status === 401 && site.oauth && !refreshedAuth && options.retryRejected !== false) {
       refreshedAuth = true;
       clearToken(site);
       continue;
     }
 
     // Session expired/unknown: re-initialise once and replay.
-    if (isSessionError(res, body) && !reinitedSession) {
+    if (isSessionError(res, body) && !reinitedSession && options.retryRejected !== false) {
       reinitedSession = true;
-      sessions.delete(site._name);
-      sessionId = await ensureSession(site, endpoint);
+      sessions.delete(sessionKey);
+      sessionId = await ensureSession(site, endpoint, sessionKey);
       continue;
     }
 
@@ -308,7 +342,7 @@ export async function callServerTool(site, toolName, args = {}) {
 
     // MCP tools/call result: { content: [...], isError?: boolean }.
     const result = body?.result;
-    if (result?.isError) {
+    if (result?.isError && !options.preserveErrors) {
       const detail = extractTextContent(result) || "tool reported an error";
       const mapped = sourceBudgetDenial(detail);
       if (mapped) throw mapped;

package/src/lib/verify.js

@@ -738,7 +738,13 @@ export async function verifyLive(site, { transport, callTool = null, contentTarg
    */
   const attemptConfigWrite = async () => {
     try {
-      await callTool(site, CONFIG_SET_TOOL, { name: "system.site", data: { name: "verification probe" } });
+      // The negative probe must reach source authorization, not merely prove
+      // that the connector hides out-of-tier tools from discovery.
+      const tool = site.serverTools?.bindings === undefined ? CONFIG_SET_TOOL
+        : (await import("./module-tools.js")).resolveModuleBinding(site, "configSet", {
+          operation: "write", scope: "mcp_config", capabilities: ["configWrite"],
+        }).policy.name;
+      await callTool(site, tool, { name: "system.site", data: { name: "verification probe" } });
       return { served: true, outcome: "served", detail: "accepted" };
     } catch (err) {
       // Not every throw is a refusal — see classifyBridgeError.

package/src/tools/codegen.js

@@ -1,7 +1,8 @@
 /**
  * Tool group: GraphQL Compose Codegen (TypeScript / Next.js scaffolds).
  *
- * Thin Drush wrappers around `drupal/graphql_compose_codegen`. The generator
+ * Compatibility adapters through configured module bindings, or legacy Drush.
+ * Thin wrappers around `drupal/graphql_compose_codegen`. The generator
  * lives on the Drupal site; this connector does not reimplement it and does
  * not run GraphQL Code Generator against the SDL.
  *
@@ -16,6 +17,7 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { sshDrush } from "./drush.js";
+import { callBoundModuleTool, toolResultData } from "../lib/server-tools.js";
 import { SecurityError } from "../lib/security.js";
 import { validateMachineName } from "../lib/validate.js";
 
@@ -75,6 +77,18 @@ async function runGqcc(
   const site = getSiteConfig(siteName);
   const names = parseMachineNameList(bundles, "bundles");
   const skip = parseMachineNameList(skipFields, "skipFields");
+  if (site.serverTools?.bindings !== undefined) {
+    const binding = new Map([
+      [INSPECT, "codegenInspect"], [DIFF, "codegenDiff"], [GENERATE, "codegenPreview"],
+    ]).get(subcommand);
+    const result = toolResultData(await callBoundModuleTool(site, binding, {
+      bundles: names, skip_fields: skip,
+    }, { operation: "read", scope: "mcp_config", capabilities: ["configRead"] }));
+    if (result?.success !== true || !result.data || typeof result.data !== "object" || Array.isArray(result.data)) {
+      throw new SecurityError("Codegen module returned an invalid result. No SSH fallback was attempted.");
+    }
+    return { output: JSON.stringify(result.data), command: `module:${binding}`, wroteFiles: false };
+  }
   const args = [subcommand];
   if (names.length) args.push(`--bundles=${names.join(",")}`);
   if (skip.length) args.push(`--skip-fields=${skip.join(",")}`);
@@ -126,19 +140,19 @@ export const definitions = [
   {
     name: "drupal_codegen_inspect",
     description:
-      "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.",
+      "List node and paragraph bundles and extra fields from graphql_compose_codegen (`drush graphql-compose-codegen:inspect`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:inspect. Does not write files.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
   {
     name: "drupal_codegen_diff",
     description:
-      "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.",
+      "Compare the live graphql_compose schema to the last gqcc:generate snapshot (`drush graphql-compose-codegen:diff`). Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:diff.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
   {
     name: "drupal_codegen_generate",
     description:
-      "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Requires the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.",
+      "Return TypeScript/GraphQL scaffold artefacts from graphql_compose_codegen as text (`drush graphql-compose-codegen:generate --dry-run`). Never writes on the Drupal host (no --output-dir). Copy artefacts locally. Uses the configured module binding; unbound sites require the module and drushSsh. Missing command fails loud. If allowedCommands is set, include graphql-compose-codegen:generate.",
     inputSchema: { type: "object", properties: LIST_PROPS },
   },
 ];

package/src/tools/config.js

@@ -22,7 +22,17 @@ import {
   assertConfigScope,
   hasScope,
 } from "../lib/security.js";
-import { callServerTool, SERVER_TOOLS } from "../lib/server-tools.js";
+import { callServerTool, callBoundModuleTool, SERVER_TOOLS } from "../lib/server-tools.js";
+
+/** Compatibility names use an approved module binding when configured. */
+async function configTool(site, binding, args, operation, capability) {
+  if (site.serverTools?.bindings !== undefined) {
+    return callBoundModuleTool(site, binding, args, {
+      operation, scope: "mcp_config", capabilities: [capability],
+    });
+  }
+  return callServerTool(site, new Map(Object.entries(SERVER_TOOLS)).get(binding), args);
+}
 
 // ---------------------------------------------------------------------------
 // Config tools (governed via the server-tool bridge)
@@ -38,7 +48,7 @@ async function configGet({ site: siteName, name }) {
   const site = getSiteConfig(siteName);
   assertConfigScope(site, `config:get ${name}`);
   assertConfigReadAllowed(resolveSecurityConfig(site));
-  return callServerTool(site, SERVER_TOOLS.configGet, { name });
+  return configTool(site, "configGet", { name }, "read", "configRead");
 }
 
 /**
@@ -52,7 +62,7 @@ async function configList({ site: siteName, prefix }) {
   assertConfigScope(site, "config:list");
   assertConfigReadAllowed(resolveSecurityConfig(site));
   const args = prefix ? { prefix } : {};
-  return callServerTool(site, SERVER_TOOLS.configList, args);
+  return configTool(site, "configList", args, "read", "configRead");
 }
 
 /**
@@ -73,7 +83,7 @@ async function configSet({ site: siteName, name, value }) {
   assertConfigScope(site, `config:set ${name}`);
   assertNotReadOnly(sec, `config:set ${name}`);
   assertConfigWriteAllowed(sec);
-  return callServerTool(site, SERVER_TOOLS.configSet, { name, data: value });
+  return configTool(site, "configSet", { name, data: value }, "write", "configWrite");
 }
 
 // ---------------------------------------------------------------------------

package/src/tools/drush.js

@@ -20,6 +20,7 @@
  * Requires per-site "drushSsh" config block — tools fail gracefully if absent.
  */
 
+import { callBoundModuleTool, toolResultData } from "../lib/server-tools.js";
 import { Client }        from "ssh2";
 import { readFileSync }  from "fs";
 import { homedir }       from "os";
@@ -456,6 +457,15 @@ async function sqlQuery({ site: siteName, query }) {
   assertGovernedRawSql(sshCfg, site._name);
   // Fast local reject only; mcp_sentinel's guard is the authority.
   validateSqlQuery(query);
+  if (site.serverTools?.bindings !== undefined) {
+    const result = toolResultData(await callBoundModuleTool(site, "sqlQuery", { query }, {
+      operation: "read", scope: "mcp_admin", capabilities: ["rawSql"],
+    }));
+    if (result?.success !== true || !result.data || !Array.isArray(result.data.rows)) {
+      throw new SecurityError("SQL module returned an invalid governed result. No SSH fallback was attempted.");
+    }
+    return result.data;
+  }
   const out = await sshDrush(site, ["mcp-sentinel:sql-query", query]);
   // The command emits a JSON object; a non-JSON reply means the command was
   // not found (mcp_sentinel absent or too old), which must not be reported as
@@ -534,7 +544,7 @@ export const definitions = [
   },
   {
     name: "drupal_drush_sql_query",
-    description: "Run a single read-only SELECT through mcp_sentinel's governed command (`drush mcp-sentinel:sql-query`). Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.",
+    description: "Run a single read-only SELECT through the configured sqlQuery module binding, or the legacy governed Drush command on unbound sites. Requires the site to set drushSsh.rawSql=\"governed\" AND the site's policy profile to set allow_raw_sql; both are off by default. The server refuses statements touching a denied entity type, a non-entity table, or a redacted field, and records every attempt in the tamper-evident audit log. Use the site-context or entity-schema tools for schema introspection.",
     inputSchema: { type: "object", required: ["query"], properties: { site: { type: "string" }, query: { type: "string" } } },
   },
   {

package/src/tools/media.js

@@ -15,9 +15,9 @@ import {
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
 } from "../lib/security.js";
 import {
-  assertDraftLangcode, readDraftTranslation, readTranslationInventory, writeDraft,
-} from "../lib/draft-write.js";
-import { assertInventoryDraftLanguage } from "../lib/node-draft-inventory.js";
+  assertDraftLangcode, readDraftTranslation, readTranslationInventory,
+} from "../lib/sentinel-draft.js";
+import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
 import { entityRevisionId } from "../lib/write-revision.js";
 
 /**
@@ -138,26 +138,22 @@ async function updateMedia({ site: siteName, type, id, name, status, fields = {}
   const backend = await resolveBackend(site);
   if (langcode) {
     const targetLang = assertDraftLangcode(langcode);
-    const inventory = await readTranslationInventory(backend, { entityType: "media", bundle: type, id });
-    assertInventoryDraftLanguage(inventory, targetLang);
-    const liveVid = inventory.live?.vid;
-    const workingVid = inventory.working?.vid;
-    if (!liveVid || !workingVid || String(workingVid) === String(liveVid)) {
-      throw new Error(
-        "No unpublished working translation for this language. " +
-        "Create it with drupal_create_translation first; a canonical langcode PATCH is not attempted.",
-      );
-    }
-    const result = await writeDraft(backend, {
-      entityType: "media", bundle: type, id, attributes, langcode: targetLang,
+    const patchTarget = await prepareGuardedPatch(backend, {
+      entityType: "media", bundle: type, id, attributes,
+      ...(relationships ? { relationships } : {}),
+      langcode: targetLang,
+    });
+    const result = await updateEntityGuarded(backend, {
+      entityType: "media", bundle: type, id, attributes,
       ...(relationships ? { relationships } : {}),
-      draftRevision: { liveVid, workingVid },
+      langcode: targetLang,
+      ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
     });
     const redacted = redactCanonicalEntity(result, sec, "media");
-    const working = entityRevisionId(result) ?? workingVid;
+    const working = entityRevisionId(result) ?? patchTarget.workingVid;
     return {
       ...redacted,
-      _revisions: { live: liveVid, working },
+      _revisions: { live: patchTarget.liveVid, working },
     };
   }
   // #171: pre-read so an unrequested published-state flip is reported, not silent.

package/src/tools/moderation.js

@@ -22,7 +22,9 @@ import {
 } from "../lib/security.js";
 import { collectEntities } from "../lib/reports-support.js";
 import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
-import { assertDraftLangcode, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, isMissingTranslationEndpoint, readTranslationInventory, supportsSentinelDraft,
+} from "../lib/sentinel-draft.js";
 import { inventoryRowMatching } from "../lib/translation-rows.js";
 
 /** Cap for the client-side scan when JSON:API cannot filter the field. */
@@ -65,25 +67,23 @@ async function setModerationState({ site: siteName, type, id, state, langcode })
   const attributes = { moderation_state: state };
   assertPublishAllowed(sec, attributes);
   const backend = await resolveBackend(site);
-  if (langcode) {
-    const targetLang = assertDraftLangcode(langcode);
-    let existing = null;
-    try {
-      existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
-    } catch {
-      existing = null;
-    }
-    const patchTarget = await prepareGuardedPatch(backend, {
-      entityType: "node", bundle: type, id, existing, attributes, langcode: targetLang,
-    });
-    const patched = await updateEntityGuarded(backend, {
-      entityType: "node", bundle: type, id, attributes, langcode: targetLang,
-      ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
-    });
-    return redactCanonicalEntity(patched, sec, "node");
+  const targetLang = langcode ? assertDraftLangcode(langcode) : undefined;
+  let existing = null;
+  try {
+    existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
+  } catch {
+    existing = null;
   }
-  const entity = await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
-  return redactCanonicalEntity(entity, sec, "node");
+  const patchTarget = await prepareGuardedPatch(backend, {
+    entityType: "node", bundle: type, id, existing, attributes,
+    ...(targetLang ? { langcode: targetLang } : {}),
+  });
+  const patched = await updateEntityGuarded(backend, {
+    entityType: "node", bundle: type, id, attributes,
+    ...(targetLang ? { langcode: targetLang } : {}),
+    ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
+  });
+  return redactCanonicalEntity(patched, sec, "node");
 }
 
 /**
@@ -104,7 +104,7 @@ async function contentByModerationState({ site: siteName, type, state, limit = 2
   const sort = [{ field: "changed", dir: "desc" }];
   const targetLang = langcode ? assertDraftLangcode(langcode) : null;
   if (targetLang) {
-    if (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function") {
+    if (!supportsSentinelDraft(backend)) {
       return {
         type, state, langcode: targetLang, unavailable: true,
         reason: "A langcode filter requires Sentinel's translation inventory.",
@@ -130,7 +130,7 @@ async function contentByModerationState({ site: siteName, type, state, limit = 2
           });
         }
       } catch (error) {
-        if (/does not provide Sentinel's governed draft-translation endpoint/.test(String(error?.message))) {
+        if (isMissingTranslationEndpoint(error)) {
           return {
             type, state, langcode: targetLang, unavailable: true,
             reason: "A langcode filter requires Sentinel's translation inventory.",

package/src/tools/nodes.js

@@ -18,7 +18,7 @@ import { shapeWriteResponse, flagUnrequestedStatusChange, RETURNING_SCHEMA, omit
 import { resolveErrRelationships, relationshipsWereSent, paragraphPinsFromEntity } from "../lib/err-relationships.js";
 import { attachWrittenRevisionPair, readWrittenRevision } from "../lib/write-revision.js";
 import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
-import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/draft-write.js";
+import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/sentinel-draft.js";
 import { paragraphResourceVersion } from "./paragraphs.js";
 import { assertBodySummaryWritable, attachSummaryDeprecation } from "../lib/body-summary.js";
 import { buildRedirectAttributes, REDIRECT_ENTITY_TYPE } from "./redirects.js";

package/src/tools/paragraphs.js

@@ -46,7 +46,7 @@ import {
   assertDraftLangcode,
   readDraftTranslation,
   writeDraft,
-} from "../lib/draft-write.js";
+} from "../lib/sentinel-draft.js";
 
 /**
  * Build the resource-identifier ref used to embed a paragraph in a host ERR /

package/src/tools/reports-config.js

@@ -20,7 +20,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveSecurityConfig, assertConfigReadAllowed } from "../lib/security.js";
 import { gatedReport } from "../lib/reports-support.js";
-import { callServerTool, SERVER_TOOLS, toolResultData } from "../lib/server-tools.js";
+import { callServerTool, callBoundModuleTool, SERVER_TOOLS, toolResultData } from "../lib/server-tools.js";
 import { runPrivileged, serverToolsConfigured, drushConfigured } from "../lib/audit-sources.js";
 import { sshDrush, parseDrush } from "./drush.js";
 
@@ -65,6 +65,11 @@ function configSourceAvailable(site) {
  * @returns {Promise<*>} Parsed config object (or null/text).
  */
 async function readConfig(site, name) {
+  if (site.serverTools?.bindings !== undefined) {
+    return toolResultData(await callBoundModuleTool(site, "configGet", { name }, {
+      operation: "read", scope: "mcp_config", capabilities: ["configRead"],
+    }));
+  }
   if (serverToolsConfigured(site)) {
     try { return toolResultData(await callServerTool(site, SERVER_TOOLS.configGet, { name })); }
     catch (err) { if (!drushConfigured(site)) throw err; }
@@ -82,6 +87,11 @@ async function readConfig(site, name) {
  * @returns {Promise<string[]>} Config object names.
  */
 async function listConfigNames(site, prefix) {
+  if (site.serverTools?.bindings !== undefined) {
+    return pickConfigNames(toolResultData(await callBoundModuleTool(site, "configList", { prefix }, {
+      operation: "read", scope: "mcp_config", capabilities: ["configRead"],
+    })));
+  }
   if (serverToolsConfigured(site)) {
     try { return pickConfigNames(toolResultData(await callServerTool(site, SERVER_TOOLS.configList, { prefix }))); }
     catch (err) { if (!drushConfigured(site)) throw err; }

package/src/tools/reports-content.js

@@ -17,7 +17,9 @@ import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertReadAllowed } from "../lib/security.js";
 import { collectEntities, fieldValue, daysSince } from "../lib/reports-support.js";
 import { bodyHtml, extractAnchors, classifyLink, normalizePath } from "../lib/audit-support.js";
-import { assertDraftLangcode, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, isMissingTranslationEndpoint, readTranslationInventory, supportsSentinelDraft,
+} from "../lib/sentinel-draft.js";
 import { inventoryRowMatching, inventoryTranslationRows, mapTranslationRow } from "../lib/translation-rows.js";
 
 // ---------------------------------------------------------------------------
@@ -116,7 +118,7 @@ async function workflowBottlenecks({ site: siteName, type, days = 30, states, sa
     sampleSize
   );
 
-  if (targetLang && (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function")) {
+  if (targetLang && !supportsSentinelDraft(backend)) {
     return {
       contentType,
       unavailable: true,
@@ -139,7 +141,7 @@ async function workflowBottlenecks({ site: siteName, type, days = 30, states, sa
         if (!row) continue;
         state = row.moderation_state;
       } catch (error) {
-        if (/does not provide Sentinel's governed draft-translation endpoint/.test(String(error?.message))) {
+        if (isMissingTranslationEndpoint(error)) {
           return {
             contentType,
             unavailable: true,
@@ -207,8 +209,7 @@ async function translationCoverage({ site: siteName, type, sampleSize = 100 }) {
     sampleSize
   );
 
-  const missingEndpoint = /does not provide Sentinel's governed draft-translation endpoint/;
-  if (typeof backend.rawQuery !== "function" || typeof backend.resourcePath !== "function") {
+  if (!supportsSentinelDraft(backend)) {
     return {
       contentType,
       scanned: nodes.length,
@@ -239,7 +240,7 @@ async function translationCoverage({ site: siteName, type, sampleSize = 100 }) {
         outdated: rows.some((row) => row.outdated === true),
       });
     } catch (error) {
-      if (!missingEndpoint.test(String(error?.message))) throw error;
+      if (!isMissingTranslationEndpoint(error)) throw error;
     }
   }
 

package/src/tools/revisions.js

@@ -11,8 +11,8 @@
  *     full chronological history enumeration requires the Drush bridge.
  *   - drupal_get_revision fetches one specific version (by vid or alias).
  *   - drupal_revert_revision is a GOVERNED WRITE: it reads the target revision
- *     and replays its editable attributes through updateEntity to make them the
- *     new current revision (assertWriteAllowed gates it; internal/immutable
+ *     and replays its editable attributes through prepareGuardedPatch /
+ *     updateEntityGuarded (assertWriteAllowed gates it; internal/immutable
  *     bookkeeping fields are never written back).
  *
  * Reads are redacted per the site's security policy.
@@ -23,9 +23,11 @@ import { resolveBackend } from "../lib/backends/index.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity,
 } from "../lib/security.js";
-import { readNodeDraftInventory } from "../lib/node-draft-inventory.js";
-import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } from "../lib/draft-write.js";
+import {
+  assertDraftLangcode, readDraftTranslation, readNodeDraftInventory, readTranslationInventory,
+} from "../lib/sentinel-draft.js";
 import { omitLiveComputedMetatag } from "../lib/entity-response.js";
+import { changedAheadOfRevision, prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
 
 // Attributes that describe the entity's identity / revision bookkeeping / paths.
 // These are read-only or server-managed and must NOT be replayed on a revert.
@@ -123,20 +125,6 @@ function summarizeRevision(resource) {
   };
 }
 
-/**
- * Whether the default revision's `changed` is later than its own
- * `revision_timestamp` — the readable fingerprint of a #201 node.
- * @param {?object} summary
- * @returns {boolean}
- */
-function changedAheadOfRevision(summary) {
-  if (!summary?.changed || !summary?.revisionTimestamp) return false;
-  const changed = Date.parse(summary.changed);
-  const rev = Date.parse(summary.revisionTimestamp);
-  if (!Number.isFinite(changed) || !Number.isFinite(rev)) return false;
-  return changed > rev;
-}
-
 const LIST_REVISIONS_BASE_NOTE =
   "JSON:API only addresses revisions by id (id:<vid>) or the rel:latest-version / " +
   "rel:working-copy aliases; it cannot enumerate the full chronological history. " +
@@ -286,10 +274,11 @@ async function getRevision({ site: siteName, type, id, version, langcode }) {
 
 /**
  * Revert an entity to a prior revision (GOVERNED WRITE). Reads the target
- * revision, then replays its editable attributes through updateEntity so they
- * become the new current revision. Internal/immutable bookkeeping fields
- * (drupal_internal__*, revision metadata, computed path, timestamps) are
- * stripped before the write so only restorable content is sent.
+ * revision, then replays its editable attributes through prepareGuardedPatch
+ * / updateEntityGuarded so they become the new current revision. Internal /
+ * immutable bookkeeping fields (drupal_internal__*, revision metadata,
+ * computed path, timestamps) are stripped before the write so only
+ * restorable content is sent.
  *
  * This does not delete any history — the revert produces a NEW revision whose
  * content matches the target, preserving the audit trail.
@@ -328,7 +317,19 @@ async function revertRevision({ site: siteName, type, id, version }) {
     )
   );
 
-  await backend.updateEntity({ entityType: "node", bundle: type, id, attributes });
+  let existing = null;
+  try {
+    existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
+  } catch {
+    existing = null;
+  }
+  const patchTarget = await prepareGuardedPatch(backend, {
+    entityType: "node", bundle: type, id, existing, attributes,
+  });
+  await updateEntityGuarded(backend, {
+    entityType: "node", bundle: type, id, attributes,
+    ...(patchTarget.draftRevision ? { draftRevision: patchTarget.draftRevision } : {}),
+  });
 
   return {
     success: true,

package/src/tools/structure.js

@@ -19,7 +19,7 @@ import { resolveBackend } from "../lib/backends/index.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, redactCanonicalEntity,
 } from "../lib/security.js";
-import { assertDraftLangcode } from "../lib/draft-write.js";
+import { assertDraftLangcode } from "../lib/sentinel-draft.js";
 
 const MENU_LINK_TYPE = "menu_link_content";
 const BLOCK_TYPE = "block_content";

package/src/tools/taxonomy.js

@@ -12,7 +12,7 @@ import {
   resolveSecurityConfig, redactCanonicalEntity,
   assertReadAllowed, assertWriteAllowed, assertDeleteAllowed,
 } from "../lib/security.js";
-import { assertDraftLangcode } from "../lib/draft-write.js";
+import { assertDraftLangcode } from "../lib/sentinel-draft.js";
 
 // ---------------------------------------------------------------------------
 // Implementations