drupal-mcp-connector 2.24.0 → 2.24.1

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.24.1] - 2026-09-29
+
+### Removed
+- **Unused validate helpers and stale workflow-prompt exports.** `clampLimit` /
+  `MAX_PAGE_LIMIT` and `validateFieldName` / `FIELD_NAME_RE` had no callers.
+  `workflowIndex`, `WORKFLOW_LIMITS`, and the unused `toolNameToPromptName`
+  re-export are gone. Filter/sort field names stay unvalidated so JSON:API
+  relationship paths keep working; `URLSearchParams` remains the T3 control.
+
 ## [2.24.0] - 2026-09-29
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.24.0",
+  "version": "2.24.1",
   "description": "Drupal MCP Connector — multi-site MCP server for Drupal with JSON:API and GraphQL, governed writes, draft translations, content tools, audit reports, and an SSH Drush bridge.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/validate.js

@@ -196,26 +196,6 @@ export function validateBaseUrl(url, siteName = "site") {
   return url.replace(/\/$/, "");
 }
 
-// ---------------------------------------------------------------------------
-// Pagination limit guard
-// Prevents accidentally requesting thousands of records in a single call.
-// ---------------------------------------------------------------------------
-
-const MAX_PAGE_LIMIT = 200;
-
-/**
- * Clamp a page limit to a safe maximum, falling back to a default for
- * non-numeric or out-of-range input.
- * @param {*} value Requested limit (any type; coerced to Number).
- * @param {number} [defaultVal] Value returned for invalid/<1 input.
- * @returns {number} A limit in the range [1, MAX_PAGE_LIMIT].
- */
-export function clampLimit(value, defaultVal = 20) {
-  const n = Number(value);
-  if (!Number.isFinite(n) || n < 1) return defaultVal;
-  return Math.min(n, MAX_PAGE_LIMIT);
-}
-
 // ---------------------------------------------------------------------------
 // Local file upload path allowlist (#137 / audit C1)
 // ---------------------------------------------------------------------------
@@ -329,27 +309,3 @@ export function assertUploadPathAllowed(filePath) {
   }
   return real;
 }
-
-// ---------------------------------------------------------------------------
-// Field name sanitization (prevent crafted field names in JSON:API filters)
-// ---------------------------------------------------------------------------
-
-const FIELD_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_.]*$/;
-
-/**
- * Validate a Drupal field machine name used in JSON:API filter parameters.
- * Allows dotted paths (e.g. "field.subfield") for nested references.
- * @param {string} value The field name to validate.
- * @param {string} [fieldName] Human-readable name for error messages.
- * @returns {string} The validated value.
- * @throws {Error} if the value is not a valid field name.
- */
-export function validateFieldName(value, fieldName = "field") {
-  if (typeof value !== "string" || !FIELD_NAME_RE.test(value)) {
-    throw new Error(
-      `${fieldName} "${value}" is not a valid field name. ` +
-      "Expected format: field_example or field.subfield"
-    );
-  }
-  return value;
-}

package/src/lib/workflow-prompts.js

@@ -6,11 +6,10 @@
  * docs/module-workflows.md.
  */
 
-import { sourceText, toolNameToPromptName } from "./tool-prompts.js";
+import { sourceText } from "./tool-prompts.js";
 
 const ID_RE = /^[a-z][a-z0-9_]{0,47}$/;
 const ARG_RE = /^[a-z][a-z0-9_]{0,47}$/;
-const MAX_DESCRIPTION = 1024;
 const MAX_INSTRUCTIONS = 8192;
 const MAX_ARG_VALUE = 200;
 const MAX_WORKFLOWS = 64;
@@ -465,26 +464,3 @@ export function replaceModuleWorkflows(workflows) {
 export function lookupWorkflow(name) {
   return INDEX.get(name);
 }
-
-/**
- * Index used by tests.
- *
- * @param {object[]} workflows
- * @returns {Map<string, {readOnly: boolean, builtin: boolean, publicTools: string[]}>}
- */
-export function workflowIndex(workflows) {
-  return new Map((workflows ?? []).map((wf) => [wf.name, {
-    readOnly: wf.readOnly,
-    builtin: wf.builtin,
-    publicTools: wf.publicTools,
-  }]));
-}
-
-export const WORKFLOW_LIMITS = {
-  MAX_DESCRIPTION,
-  MAX_INSTRUCTIONS,
-  MAX_WORKFLOWS,
-};
-
-// Re-export for callers that already import tool prompt hyphenation.
-export { toolNameToPromptName };