drupal-mcp-connector 2.23.3 → 2.24.1

package/.agents/commands/drupal-create-node.md

@@ -17,7 +17,7 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `site` (string): Named site from connector config. Omit only on reads: multi-site configs fall back to defaultSite (often local/dev, not production). Writes require an explicit site when more than one site is configured. Every response includes `_target` { name, baseUrl, source } (`hint` when you passed site, `default` when you did not).
 - `body` (string): Body field HTML
 - `summary` (string): Body summary/teaser — writes body.summary on core text_with_summary only. Refused when the sampled body field has no summary property (text_long / text_formatted) or the schema cannot be determined. Prefer the site's dedicated deck/summary field via `fields`.
-- `format` (string): Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. When allowed_formats cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'.
+- `format` (string): Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. allowed_formats is read from field_config, then base_field_override (node body). When that list cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'.
 - `status` (boolean (true/false)): Published flag for NON-moderated types. true to publish immediately. Ignored if moderationState is set; on a moderated type it is dropped automatically.
 - `moderationState` (string): Moderation state for content_moderation types, e.g. 'draft' or 'published'. Takes precedence over status.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by Drupal machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Do NOT put entity-reference fields here — Drupal rejects them as attributes; use `relationships`.

package/.agents/commands/drupal-update-node.md

@@ -18,13 +18,13 @@ Parse the arguments supplied with this command into this tool's parameters:
 - `title` (string)
 - `body` (string)
 - `summary` (string): Body summary/teaser — writes body.summary on core text_with_summary only. Refused when the sampled body field has no summary property (text_long / text_formatted) or the schema cannot be determined. Prefer the site's dedicated deck/summary field via `fields`.
-- `format` (string): Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. When allowed_formats cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'.
+- `format` (string): Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before the preview and the write. allowed_formats is read from field_config, then base_field_override (node body). When that list cannot be resolved, an update reuses the format already stored on the field; if the node has none, the site config's `defaultTextFormat`, then 'full_html'. dryRun previews that same format, including on the published-node core PATCH guard.
 - `status` (boolean (true/false)): Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set.
 - `moderationState` (string): Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'.
 - `langcode` (string): Target language for an unpublished working translation (e.g. 'es'). Continues that translation via Sentinel; does not create a missing translation and does not PATCH canonical langcode.
 - `fields` (object (pass as JSON)): Scalar/attribute field values keyed by machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Entity-reference fields go in `relationships`, not here.
 - `relationships` (object (pass as JSON)): Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }. Paragraph / ERR items must carry meta.target_revision_id — the connector injects it when missing, and fails the write if it cannot. Image alt on a translation uses the existing file UUID plus meta.alt; replacing the file is refused.
-- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; field access and entity validation are NOT checked (`core_patch_guard`), so the real write can still fail with a field-access 403 or a 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
+- `dryRun` (boolean (true/false)): Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; Drupal does not check field access or entity validation on that probe (`core_patch_guard`). Text format is resolved before the preview returns, including on that path: a known allowed_formats list is enforced, and an unknown list reuses the format stored on the field. Other fields can still fail the real write with a field-access 403 or a validation 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun.
 - `returning` (one of: full, minimal): Response verbosity. "full" (default) returns the complete saved entity; "minimal" returns just identity + state (id, type, bundle, title, status, changed, url) — much smaller, recommended for bulk writes where the echoed body would dominate the response.
 
 If a required parameter is missing, ask before calling — do not invent values. Coerce each value to its JSON type (booleans → true/false, numbers → numeric, object/array → parse JSON), then make the single tool call and summarize the result.

package/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.24.1] - 2026-09-29
+
+### Removed
+- **Unused validate helpers and stale workflow-prompt exports.** `clampLimit` /
+  `MAX_PAGE_LIMIT` and `validateFieldName` / `FIELD_NAME_RE` had no callers.
+  `workflowIndex`, `WORKFLOW_LIMITS`, and the unused `toolNameToPromptName`
+  re-export are gone. Filter/sort field names stay unvalidated so JSON:API
+  relationship paths keep working; `URLSearchParams` remains the T3 control.
+
+## [2.24.0] - 2026-09-29
+
+### Added
+- **Paragraphs Library items on the content tiers.** `paragraphs_library_item`
+  joins the structural content set, so the `content-editor`, `config-editor`
+  and `write-plane` presets can create and edit reusable library items through
+  `drupal_entity_*`. Deletes stay blocked. A write carrying
+  `moderation_state: published` or `status: true` is refused when
+  `allowPublish` is false, as for every other type; drafts pass. On a site
+  that moderates library items, Drupal's workflow is the second gate.
+
+### Fixed
+- **A library item created by a tier that cannot publish stays unpublished.**
+  Drupal publishes Paragraphs Library items by default. On a site that does
+  not moderate them, `drupal_entity_create` or `drupal_bulk_create` without
+  `status` put the item live on every page that places it, although
+  `allowPublish` was false. When publishing is not allowed and the caller sets
+  neither `status` nor `moderation_state`, the connector now sends
+  `status: false`. Other entity types are unchanged.
+- **Node update preflight no longer accepts a body format the save rejects (#327).**
+  Node body is a base field. Its `allowed_formats` live on
+  `base_field_override`, which field lookup did not read, so an omitted format
+  fell back to `defaultTextFormat` / `full_html`. On a published moderated node
+  with no working copy, `dryRun` only probes core's working-copy guard and does
+  not send fields, so the preview succeeded and the save returned 422
+  `body.0.format is not a valid choice`. Lookup now reads
+  `base_field_override` (JSON:API, then Drush
+  `core.base_field_override.*`). When the allowed list is still unknown, an
+  update reuses the format already stored on the field. The preview and the
+  save resolve that same format, including on the core PATCH-guard path.
+
 ## [2.23.3] - 2026-09-28
 
 ### Fixed

package/README.md

@@ -55,12 +55,13 @@ Each site declares which backend(s) it exposes via the `api` key:
 - **`defaultTextFormat` sets the body text format** used by the `body` convenience
   parameter on node writes, e.g. `{ "baseUrl": "…", "defaultTextFormat": "basic_html" }`.
   Individual calls can override it with `format`. Field API `allowed_formats` wins
-  when it can be resolved: a single allowed format is the default, and a format
-  outside the list is refused. Without a resolved list, the connector falls
-  back to `full_html`, which many governed sites deliberately do not define — and which
-  is the most permissive core format, so setting this per site is the safer posture. A
-  text format is Drupal's HTML-filtering boundary, so it is worth choosing deliberately
-  rather than inheriting.
+  when it can be resolved (from `field_config` or, for body, `base_field_override`):
+  a single allowed format is the default, and a format outside the list is refused.
+  Without a resolved list, a create falls back to `full_html`, which many governed
+  sites deliberately do not define — and which is the most permissive core format,
+  so setting this per site is the safer posture. An update reuses the format already
+  stored on the field instead of that fallback. A text format is Drupal's
+  HTML-filtering boundary, so it is worth choosing deliberately rather than inheriting.
 
 See **[docs/architecture.md](docs/architecture.md)** for the backend abstraction and **[docs/graphql-local-setup.md](docs/graphql-local-setup.md)** for the GraphQL specifics.
 

package/config/config.example.json

@@ -146,7 +146,7 @@
 
   "_security_presets": {
     "development":       "All operations allowed, incl. config read/write. Loopback / break-glass only.",
-    "content-editor":    "Create/edit the full content set (node, media, taxonomy_term, paragraph, block_content, menu_link_content, redirect, path_alias, file). No deletes. Config read-only. Denies user + secrets/governance types.",
+    "content-editor":    "Create/edit the full content set (node, media, taxonomy_term, paragraph, paragraphs_library_item, block_content, menu_link_content, redirect, path_alias, file). No deletes. Config read-only. Denies user + secrets/governance types.",
     "config-editor":     "content-editor + site-building config entities (read/introspection) + governed config read/write (Developer tier). Model changes go via the config bridge, not JSON:API.",
     "auditor":           "Read-only. All entity types. User PII fields redacted. Config read-only.",
     "production-strict": "Read-only. No user entities. Broad PII redaction. No config access.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.23.3",
+  "version": "2.24.1",
   "description": "Drupal MCP Connector — multi-site MCP server for Drupal with JSON:API and GraphQL, governed writes, draft translations, content tools, audit reports, and an SSH Drush bridge.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/backends/backend-interface.js

@@ -151,10 +151,11 @@ export class Backend {
    * Resolve Field API metadata for one field (internal introspection).
    *
    * `getEntitySchema` is sampling-only and does NOT expose `allowed_formats`.
-   * The JSON:API adapter reads `field_config` via an internal fetch — not via
-   * agent entity tools (`field_config` is on the agent deny list). Returns
-   * null when the definition cannot be resolved. Callers must not invent
-   * `allowed_formats` from `defaultTextFormat` or `full_html`.
+   * The JSON:API adapter reads `field_config`, then `base_field_override`,
+   * via an internal fetch — not via agent entity tools (`field_config` is on
+   * the agent deny list). Returns null when the definition cannot be resolved.
+   * Callers must not invent `allowed_formats` from `defaultTextFormat` or
+   * `full_html`.
    *
    * Default: unknown. GraphQL is read-only for writes; write sites use JSON:API.
    *

package/src/lib/backends/jsonapi.js

@@ -729,15 +729,17 @@ export class JsonApiBackend extends Backend {
   }
 
   /**
-   * Read Field API metadata from JSON:API `field_config` (chain step 1).
+   * Read Field API metadata from JSON:API (chain step 1).
    *
+   * Configurable fields live on `field_config`. Node body is a base field:
+   * its `allowed_formats` live on `base_field_override`, not `field_config`.
    * This is an internal introspection call, not an agent entity-tool read:
    * `field_config` is on the connector deny list. Do not invent
    * `allowed_formats` from `this.site.defaultTextFormat` or `full_html`.
-   * Empty / unreadable `field_config` returns null so the caller can try
-   * Drush `config:get field.field.{entityType}.{bundle}.{field}` and, if
-   * that also fails, keep the historical default chain only while the list
-   * is unknown.
+   * Empty / unreadable rows return null so the caller can try Drush
+   * `config:get` (`field.field.*`, then `core.base_field_override.*`) and,
+   * if that also fails, keep the historical default chain only while the
+   * list is unknown. Updates reuse a stored format in that case (#327).
    *
    * @param {{entityType: string, bundle: string, fieldName: string}} ref
    * @returns {Promise<?{fieldName: string, fieldType: ?string, allowedFormats: string[]}>}
@@ -790,14 +792,19 @@ export class JsonApiBackend extends Backend {
     params.set("filter[bundle]", bundle);
     params.set("filter[field_name]", fieldName);
     params.set("page[limit]", "1");
-    let data;
-    try {
-      data = await drupalFetch(this.site, `/jsonapi/field_config/field_config?${params}`);
-    } catch {
-      return null;
-    }
-    const row = Array.isArray(data?.data) ? data.data[0] : data?.data;
-    return parseFieldConfigObject(row?.attributes, fieldName);
+    const read = async (resource) => {
+      try {
+        const data = await drupalFetch(this.site, `/jsonapi/${resource}/${resource}?${params}`);
+        const row = Array.isArray(data?.data) ? data.data[0] : data?.data;
+        return parseFieldConfigObject(row?.attributes, fieldName);
+      } catch {
+        return null;
+      }
+    };
+    // A configurable-field row is authoritative, including an empty
+    // allowed_formats list (no field-level restriction). Body is absent
+    // from field_config, so the base-field override is the next read.
+    return (await read("field_config")) ?? (await read("base_field_override"));
   }
 
   /**

package/src/lib/field-definition.js

@@ -7,14 +7,18 @@
  * `FALLBACK_TEXT_FORMAT` (`full_html`).
  *
  * Resolution chain for a field definition:
- *   1. `backend.getFieldDefinition` — JSON:API `field_config` via an internal
- *      adapter fetch (not `drupal_entity_get`; `field_config` is on the agent
- *      deny list).
- *   2. Drush `config:get field.field.{entityType}.{bundle}.{field}` when a
- *      Drush bridge is configured.
- *   3. If the definition cannot be resolved: return null. Callers keep the
- *      historical default chain only while the list is unknown. Once the list
- *      is known, never persist a format outside it.
+ *   1. `backend.getFieldDefinition` — JSON:API `field_config`, then
+ *      `base_field_override` (node body is a base field; its allowed_formats
+ *      are not on `field_config`). Internal adapter fetch, not
+ *      `drupal_entity_get` (`field_config` is on the agent deny list).
+ *   2. Drush `config:get field.field.{entityType}.{bundle}.{field}`, then
+ *      `core.base_field_override.{entityType}.{bundle}.{field}`, when a Drush
+ *      bridge is configured.
+ *   3. If the definition cannot be resolved: return null. Creates keep the
+ *      historical default chain only while the list is unknown. Updates reuse
+ *      the format already stored on that field (#327) so a dry run cannot
+ *      preview a fallback the save will reject. Once the list is known, never
+ *      persist a format outside it.
  */
 
 import { drushConfigured } from "./audit-sources.js";
@@ -36,10 +40,16 @@ const SKIP_FORMAT_FIELDS = new Set([
  * @param {*} raw settings.allowed_formats from field_config / Drush.
  * @returns {string[]}
  */
+function isEnabledFormatId(value) {
+  // Field UI checkboxes store a disabled format as 0 or "0", and an enabled
+  // format as its machine name. "0" is a non-empty string but not a format.
+  return typeof value === "string" && value !== "" && value !== "0";
+}
+
 export function asFormatList(raw) {
-  if (Array.isArray(raw)) return raw.filter((f) => typeof f === "string" && f);
+  if (Array.isArray(raw)) return raw.filter(isEnabledFormatId);
   if (raw && typeof raw === "object") {
-    return [...new Map(Object.entries(raw)).values()].filter((f) => typeof f === "string" && f);
+    return [...new Map(Object.entries(raw)).values()].filter(isEnabledFormatId);
   }
   return [];
 }
@@ -98,13 +108,20 @@ export async function fieldDefinitionFromDrush(site, entityType, bundle, fieldNa
   validateMachineName(entityType, "entityType");
   validateMachineName(bundle, "bundle");
   validateMachineName(fieldName, "fieldName");
-  const configName = `field.field.${entityType}.${bundle}.${fieldName}`;
-  try {
-    const raw = parseDrush(await sshDrush(site, ["config:get", configName, "--format=json"]));
-    return parseFieldConfigObject(unwrapDrushConfig(raw, configName), fieldName);
-  } catch {
-    return null;
+  const configNames = [
+    `field.field.${entityType}.${bundle}.${fieldName}`,
+    `core.base_field_override.${entityType}.${bundle}.${fieldName}`,
+  ];
+  for (const configName of configNames) {
+    try {
+      const raw = parseDrush(await sshDrush(site, ["config:get", configName, "--format=json"]));
+      const parsed = parseFieldConfigObject(unwrapDrushConfig(raw, configName), fieldName);
+      if (parsed) return parsed;
+    } catch {
+      // A missing `field.field.*` row is how Drush reports a base field.
+    }
   }
+  return null;
 }
 
 /**
@@ -225,6 +242,41 @@ function requestedFormatOf(value) {
   return undefined;
 }
 
+/**
+ * Format Drupal already stored for a field, if the canonical entity has one.
+ * @param {?object} entity
+ * @param {string} fieldName
+ * @returns {string|undefined}
+ */
+function storedTextFormat(entity, fieldName) {
+  const fields = entity?.fields;
+  if (!fields || typeof fields !== "object" || Array.isArray(fields)) return undefined;
+  const value = new Map(Object.entries(fields)).get(fieldName);
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const format = new Map(Object.entries(value)).get("format");
+  return typeof format === "string" && format && format !== "0" ? format : undefined;
+}
+
+/**
+ * Whether a write attribute map omits a text format the resolver may have to
+ * supply. Used to decide whether an update must read the stored entity first.
+ * @param {?object} attributes
+ * @returns {boolean}
+ */
+export function attributesOmitTextFormat(attributes) {
+  if (!attributes || typeof attributes !== "object") return false;
+  for (const [name, value] of Object.entries(attributes)) {
+    if (SKIP_FORMAT_FIELDS.has(name) || value === undefined || value === null) continue;
+    if (typeof value === "string") return true;
+    if (typeof value === "object" && !Array.isArray(value)) {
+      const hasValue = Object.prototype.hasOwnProperty.call(value, "value");
+      const hasFormat = Object.prototype.hasOwnProperty.call(value, "format") && value.format;
+      if ((name === "body" || hasValue) && !hasFormat) return true;
+    }
+  }
+  return false;
+}
+
 /**
  * @param {*} raw
  * @param {string|undefined} format
@@ -247,11 +299,15 @@ function normalizeFormattedValue(raw, format) {
  * Same checks run for dry-run and real writes so a disallowed format never
  * reaches create/update.
  *
- * @param {{backend: object, site: object, entityType: string, bundle: string, attributes: object}} input
+ * On update, pass `existingEntity`. When the allowed list is unknown and the
+ * caller omitted a format, the format already stored on that field is reused.
+ * The same choice is what dryRun previews and what the save sends (#327).
+ *
+ * @param {{backend: object, site: object, entityType: string, bundle: string, attributes: object, existingEntity?: ?object}} input
  * @returns {Promise<object>} The same attributes object, with formats resolved.
  */
 export async function applyAllowedFormatsToAttributes({
-  backend, site, entityType, bundle, attributes,
+  backend, site, entityType, bundle, attributes, existingEntity = null,
 }) {
   const names = Object.keys(attributes).filter((name) => !SKIP_FORMAT_FIELDS.has(name));
   for (const fieldName of names) {
@@ -268,10 +324,17 @@ export async function applyAllowedFormatsToAttributes({
     if (def && !formattedType && !restricted && !isBody) continue;
     if (!def && !shaped && !isBody) continue;
 
+    const allowedFormats = def ? def.allowedFormats : null;
+    const listUnknown = !Array.isArray(allowedFormats) || allowedFormats.length === 0;
+    let requested = requestedFormatOf(value);
+    if ((requested === undefined || requested === null || requested === "") && listUnknown) {
+      const stored = storedTextFormat(existingEntity, fieldName);
+      if (stored) requested = stored;
+    }
     const format = resolveTextFormat({
       fieldName,
-      requested: requestedFormatOf(value),
-      allowedFormats: def ? def.allowedFormats : null,
+      requested,
+      allowedFormats,
       site,
       defaultWhenUnknown: isBody,
     });

package/src/lib/security.js

@@ -13,7 +13,7 @@ import { parse } from "graphql";
  * ─── Quick presets ────────────────────────────────────────────────────────
  *
  *   "preset": "development"        Everything allowed. Opt-in only — set explicitly.
- *   "preset": "content-editor"     Create/edit content (nodes, media, terms, paragraphs, blocks,
+ *   "preset": "content-editor"     Create/edit content (nodes, media, terms, paragraphs, library items, blocks,
  *                                  menu links, redirects, aliases, files). No deletes. Config read-only.
  *   "preset": "config-editor"      content-editor + site-building config READ + governed config
  *                                  read/write (Developer tier). Model changes go via the config bridge.
@@ -99,6 +99,10 @@ import { parse } from "graphql";
 // JSON:API-writable, so the standard entity tools create/update them directly.
 const CONTENT_STRUCTURAL = [
   "paragraph",
+  // Paragraphs Library items: reusable paragraphs placed on many pages. On a
+  // site that moderates them, the Drupal workflow and allowPublish both gate
+  // go-live; a publish-bearing write is refused here first.
+  "paragraphs_library_item",
   "block_content",
   "menu_link_content",
   "redirect",
@@ -162,7 +166,8 @@ const PRESETS = {
     allowConfigRead: true,            // config read-only
     allowConfigWrite: false,
     // Full content building: base content types + structural content entities
-    // (paragraphs, custom blocks, menu links, redirects, aliases, files).
+    // (paragraphs, library items, custom blocks, menu links, redirects,
+    // aliases, files).
     allowedEntityTypes: ["node", "media", "taxonomy_term", ...CONTENT_STRUCTURAL],
     deniedEntityTypes: [...SENSITIVE_DENY],
     entityRules: {
@@ -703,6 +708,32 @@ export function assertPublishAllowed(secConfig, attributes = {}) {
   }
 }
 
+// Entity types whose content is shared across many pages. When the tier
+// cannot publish, a create that says nothing about publication is sent as
+// unpublished instead of taking Drupal's published-by-default.
+const UNPUBLISHED_BY_DEFAULT = new Set(["paragraphs_library_item"]);
+
+/**
+ * Attributes for a create on a tier that cannot publish.
+ *
+ * A Paragraphs Library item is published by default in Drupal. On a site that
+ * does not moderate library items, a create that omits `status` would put the
+ * item live on every page that places it, although allowPublish is false. For
+ * the shared types in UNPUBLISHED_BY_DEFAULT, add `status: false` when the
+ * caller set neither `status` nor `moderation_state`; on a moderated site the
+ * workflow's default state applies as before. Other types are unchanged.
+ *
+ * @param {object} secConfig  Resolved security config.
+ * @param {string} entityType Entity type being created.
+ * @param {object} attributes Caller attributes.
+ * @returns {object} Attributes to send.
+ */
+export function withUnpublishedDefault(secConfig, entityType, attributes = {}) {
+  if (secConfig.allowPublish || !UNPUBLISHED_BY_DEFAULT.has(entityType)) return attributes;
+  if ("status" in attributes || "moderation_state" in attributes) return attributes;
+  return { ...attributes, status: false };
+}
+
 /**
  * Detect whether a GraphQL document contains a mutation operation.
  * Uses a real parser (robust against multi-operation docs, comments, and

package/src/lib/validate.js

@@ -196,26 +196,6 @@ export function validateBaseUrl(url, siteName = "site") {
   return url.replace(/\/$/, "");
 }
 
-// ---------------------------------------------------------------------------
-// Pagination limit guard
-// Prevents accidentally requesting thousands of records in a single call.
-// ---------------------------------------------------------------------------
-
-const MAX_PAGE_LIMIT = 200;
-
-/**
- * Clamp a page limit to a safe maximum, falling back to a default for
- * non-numeric or out-of-range input.
- * @param {*} value Requested limit (any type; coerced to Number).
- * @param {number} [defaultVal] Value returned for invalid/<1 input.
- * @returns {number} A limit in the range [1, MAX_PAGE_LIMIT].
- */
-export function clampLimit(value, defaultVal = 20) {
-  const n = Number(value);
-  if (!Number.isFinite(n) || n < 1) return defaultVal;
-  return Math.min(n, MAX_PAGE_LIMIT);
-}
-
 // ---------------------------------------------------------------------------
 // Local file upload path allowlist (#137 / audit C1)
 // ---------------------------------------------------------------------------
@@ -329,27 +309,3 @@ export function assertUploadPathAllowed(filePath) {
   }
   return real;
 }
-
-// ---------------------------------------------------------------------------
-// Field name sanitization (prevent crafted field names in JSON:API filters)
-// ---------------------------------------------------------------------------
-
-const FIELD_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_.]*$/;
-
-/**
- * Validate a Drupal field machine name used in JSON:API filter parameters.
- * Allows dotted paths (e.g. "field.subfield") for nested references.
- * @param {string} value The field name to validate.
- * @param {string} [fieldName] Human-readable name for error messages.
- * @returns {string} The validated value.
- * @throws {Error} if the value is not a valid field name.
- */
-export function validateFieldName(value, fieldName = "field") {
-  if (typeof value !== "string" || !FIELD_NAME_RE.test(value)) {
-    throw new Error(
-      `${fieldName} "${value}" is not a valid field name. ` +
-      "Expected format: field_example or field.subfield"
-    );
-  }
-  return value;
-}

package/src/lib/workflow-prompts.js

@@ -6,11 +6,10 @@
  * docs/module-workflows.md.
  */
 
-import { sourceText, toolNameToPromptName } from "./tool-prompts.js";
+import { sourceText } from "./tool-prompts.js";
 
 const ID_RE = /^[a-z][a-z0-9_]{0,47}$/;
 const ARG_RE = /^[a-z][a-z0-9_]{0,47}$/;
-const MAX_DESCRIPTION = 1024;
 const MAX_INSTRUCTIONS = 8192;
 const MAX_ARG_VALUE = 200;
 const MAX_WORKFLOWS = 64;
@@ -465,26 +464,3 @@ export function replaceModuleWorkflows(workflows) {
 export function lookupWorkflow(name) {
   return INDEX.get(name);
 }
-
-/**
- * Index used by tests.
- *
- * @param {object[]} workflows
- * @returns {Map<string, {readOnly: boolean, builtin: boolean, publicTools: string[]}>}
- */
-export function workflowIndex(workflows) {
-  return new Map((workflows ?? []).map((wf) => [wf.name, {
-    readOnly: wf.readOnly,
-    builtin: wf.builtin,
-    publicTools: wf.publicTools,
-  }]));
-}
-
-export const WORKFLOW_LIMITS = {
-  MAX_DESCRIPTION,
-  MAX_INSTRUCTIONS,
-  MAX_WORKFLOWS,
-};
-
-// Re-export for callers that already import tool prompt hyphenation.
-export { toolNameToPromptName };

package/src/tools/bulk.js

@@ -13,7 +13,7 @@
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
-import { resolveSecurityConfig, assertWriteAllowed, assertPublishAllowed } from "../lib/security.js";
+import { resolveSecurityConfig, assertWriteAllowed, assertPublishAllowed, withUnpublishedDefault } from "../lib/security.js";
 import { applySafeDraftDefault, hasExplicitModerationState } from "../lib/moderation-default.js";
 import {
   resolveErrRelationships, embedParagraphRef,
@@ -56,7 +56,7 @@ async function bulkCreate({ site: siteName, entityType, bundle, items = [] }) {
       const resolvedRelationships = await resolveErrRelationships(backend, item.relationships ?? {});
       const entity = await backend.createEntity({
         entityType, bundle,
-        attributes: item.attributes ?? {},
+        attributes: withUnpublishedDefault(sec, entityType, item.attributes ?? {}),
         relationships: resolvedRelationships,
       });
       created += 1;

package/src/tools/entities.js

@@ -21,7 +21,7 @@ import { prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight
 import { dryRunChecks, PREFLIGHT_NONE } from "../lib/dry-run-checks.js";
 import {
   resolveSecurityConfig, assertReadAllowed, assertWriteAllowed, assertDeleteAllowed, assertPublishAllowed,
-  redactCanonicalEntity, getSecuritySummary,
+  redactCanonicalEntity, getSecuritySummary, withUnpublishedDefault,
 } from "../lib/security.js";
 
 /**
@@ -65,11 +65,12 @@ async function getEntity({ site: siteName, entityType, bundle, id, include = []
  * @returns {Promise<object>} The created entity descriptor.
  * @throws {SecurityError} If creating the type/bundle is not permitted.
  */
-async function createEntity({ site: siteName, entityType, bundle, attributes = {}, relationships = {}, dryRun = false, returning = "full" }) {
+async function createEntity({ site: siteName, entityType, bundle, attributes: callerAttributes = {}, relationships = {}, dryRun = false, returning = "full" }) {
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertWriteAllowed(sec, "create", entityType, bundle);
-  assertPublishAllowed(sec, attributes);
+  assertPublishAllowed(sec, callerAttributes);
+  const attributes = withUnpublishedDefault(sec, entityType, callerAttributes);
   const backend = await resolveBackend(site);
   const resolvedRelationships = await resolveErrRelationships(backend, relationships);
   if (dryRun) {

package/src/tools/nodes.js

@@ -23,7 +23,7 @@ import { assertDraftLangcode, readDraftTranslation, readTranslationInventory } f
 import { paragraphResourceVersion } from "./paragraphs.js";
 import { assertBodySummaryWritable, attachSummaryDeprecation } from "../lib/body-summary.js";
 import { buildRedirectAttributes, REDIRECT_ENTITY_TYPE } from "./redirects.js";
-import { applyAllowedFormatsToAttributes } from "../lib/field-definition.js";
+import { applyAllowedFormatsToAttributes, attributesOmitTextFormat } from "../lib/field-definition.js";
 import { normalizeAlias, PATH_ALIAS_ENTITY_TYPE } from "../lib/path-alias.js";
 
 /** Fallback language for an alias when the node exposes none. */
@@ -469,19 +469,23 @@ async function updateNode({ site: siteName, type, id, title, body, summary, form
   else if (status !== undefined) attributes.status = status;
   const bodyAttr = buildBodyAttribute(body, summary, format);
   if (bodyAttr) attributes.body = bodyAttr;
-  await applyAllowedFormatsToAttributes({
-    backend, site, entityType: "node", bundle: type, attributes,
-  });
-  // One pre-read serves the #131 draft default and the #171 unrequested-
-  // status-change flag. Skipped when the caller pinned the moderation state.
+  // One pre-read serves the #131 draft default, the #171 unrequested-
+  // status-change flag, and the stored text format (#327). Skipped when the
+  // caller pinned the moderation state and every formatted value already
+  // names its format. An omitted format still reads the entity: the published
+  // node's core PATCH guard does not validate fields, so the preview has to
+  // resolve the same format the save will send before it can report success.
   let existing = null;
-  if (!hasExplicitModerationState(attributes)) {
+  if (!hasExplicitModerationState(attributes) || attributesOmitTextFormat(attributes)) {
     try {
       existing = (await backend.getEntity({ entityType: "node", bundle: type, id })) ?? null;
     } catch {
       existing = null; // Unreadable target: server-side gates stay authoritative.
     }
   }
+  await applyAllowedFormatsToAttributes({
+    backend, site, entityType: "node", bundle: type, attributes, existingEntity: existing,
+  });
   // #131: published moderated nodes without an explicit state → draft forward revision.
   // Runs before the publish gate and on dryRun so previews match the real write.
   attributes = await applySafeDraftDefault({
@@ -632,7 +636,7 @@ export const definitions = [
         title:   { type: "string" },
         body:    { type: "string", description: "Body field HTML" },
         summary: { type: "string", description: "Body summary/teaser — writes body.summary on core text_with_summary only. Refused when the sampled body field has no summary property (text_long / text_formatted) or the schema cannot be determined. Prefer the site's dedicated deck/summary field via `fields`." },
-        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. When allowed_formats cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'." },
+        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. allowed_formats is read from field_config, then base_field_override (node body). When that list cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'." },
         status:  { type: "boolean", default: false, description: "Published flag for NON-moderated types. true to publish immediately. Ignored if moderationState is set; on a moderated type it is dropped automatically." },
         moderationState: { type: "string", description: "Moderation state for content_moderation types, e.g. 'draft' or 'published'. Takes precedence over status." },
         fields:  { type: "object", description: "Scalar/attribute field values keyed by Drupal machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Do NOT put entity-reference fields here — Drupal rejects them as attributes; use `relationships`." },
@@ -654,13 +658,13 @@ export const definitions = [
         title:   { type: "string" },
         body:    { type: "string" },
         summary: { type: "string", description: "Body summary/teaser — writes body.summary on core text_with_summary only. Refused when the sampled body field has no summary property (text_long / text_formatted) or the schema cannot be determined. Prefer the site's dedicated deck/summary field via `fields`." },
-        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before write. When allowed_formats cannot be resolved, defaults to the site config's `defaultTextFormat`, then 'full_html'." },
+        format:  { type: "string", description: "Text format machine name for the body, e.g. 'basic_html'. When the body field's allowed_formats lists exactly one format, that is the default. A caller format outside that list is refused before the preview and the write. allowed_formats is read from field_config, then base_field_override (node body). When that list cannot be resolved, an update reuses the format already stored on the field; if the node has none, the site config's `defaultTextFormat`, then 'full_html'. dryRun previews that same format, including on the published-node core PATCH guard." },
         status:  { type: "boolean", description: "Published flag for NON-moderated types: true = publish, false = unpublish. Ignored if moderationState is set." },
         moderationState: { type: "string", description: "Moderation state transition for content_moderation types, e.g. 'draft', 'published', 'archived'. Takes precedence over status. Required to keep or re-publish a live node — omitting it on a published moderated node defaults the write to 'draft'." },
         langcode: { type: "string", description: "Target language for an unpublished working translation (e.g. 'es'). Continues that translation via Sentinel; does not create a missing translation and does not PATCH canonical langcode." },
         fields:  { type: "object", description: "Scalar/attribute field values keyed by machine name. Formatted text: a string or { value, format?, summary? }. format must be in the field's allowed_formats; a single allowed format is used when omitted. Entity-reference fields go in `relationships`, not here." },
         relationships: { type: "object", description: "Entity-reference fields as JSON:API relationships, keyed by field machine name. Single-value uses { data: { type, id } }; multi-value uses { data: [{ type, id }, …] }. Paragraph / ERR items must carry meta.target_revision_id — the connector injects it when missing, and fails the write if it cannot. Image alt on a translation uses the existing file UUID plus meta.alt; replacing the file is refused." },
-        dryRun:  { type: "boolean", default: false, description: "Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; field access and entity validation are NOT checked (`core_patch_guard`), so the real write can still fail with a field-access 403 or a 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun." },
+        dryRun:  { type: "boolean", default: false, description: "Validate, resolve ERR identifiers, run the server-side preflight when one applies, and return a preview without the real write. The result's `checks` block says what was checked; `caveat` names what was not. Only an existing node draft (or a langcode translation draft) is checked with the real payload: Sentinel's non-saving draft endpoint applies the submitted fields through field access and validates the entity (`serverPreflight: sentinel_draft`). On other moderated targets an id-mismatch core PATCH with no fields checks entity update access and core's working-copy guard only; Drupal does not check field access or entity validation on that probe (`core_patch_guard`). Text format is resolved before the preview returns, including on that path: a known allowed_formats list is enforced, and an unknown list reuses the format stored on the field. Other fields can still fail the real write with a field-access 403 or a validation 422. Unmoderated targets get no server-side check at all (`none`). A published node with no distinct working copy whose changed timestamp is later than revision_timestamp (possiblyPatchBlocked) fails dryRun the same as the real write (#273). Any refusal fails the dryRun." },
         returning: RETURNING_SCHEMA,
       },
     },