drupal-mcp-connector 2.25.0 → 3.0.0

package/src/tools/reports.js

@@ -11,7 +11,7 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertReadAllowed } from "../lib/security.js";
-import { collectEntities, gatedReport, fieldValue, fieldPresence, isEmptyFieldValue, requestedFieldNames, FIELDS_NOT_VISIBLE_NOTE, daysSince } from "../lib/reports-support.js";
+import { collectEntities, gatedReport, fieldValue, fieldPresence, isEmptyFieldValue, requestedFieldNames, FIELDS_NOT_VISIBLE_NOTE, daysSince, requireContentType, readableNodeBundles } from "../lib/reports-support.js";
 import { fetchRenderedMetaDescriptions } from "../lib/metatag-audit.js";
 
 // ---------------------------------------------------------------------------
@@ -68,11 +68,11 @@ async function contentSummary({ site: siteName }) {
  * @throws {SecurityError} If reading the content type is not permitted.
  */
 async function staleContent({ site: siteName, type, days = 180, status, limit = 50 }) {
+  const contentType = requireContentType(type, "drupal_report_stale_content");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  assertReadAllowed(sec, "node", type);
+  assertReadAllowed(sec, "node", contentType);
   const backend = await resolveBackend(site);
-  const contentType = type || "article";
   // `changed` is an integer Unix timestamp (seconds). Filter with epoch seconds,
   // not an ISO string — PostgreSQL rejects the string against an integer column.
   const cutoffMs = Date.now() - days * 86400000;
@@ -112,11 +112,11 @@ async function staleContent({ site: siteName, type, days = 180, status, limit =
  * @throws {SecurityError} If reading the content type is not permitted.
  */
 async function contentByAuthor({ site: siteName, type, limit = 100 }) {
+  const contentType = requireContentType(type, "drupal_report_content_by_author");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  assertReadAllowed(sec, "node", type);
+  assertReadAllowed(sec, "node", contentType);
   const backend = await resolveBackend(site);
-  const contentType = type || "article";
   const entities = await collectEntities(
     backend,
     { entityType: "node", bundle: contentType, include: ["uid"] },
@@ -141,7 +141,10 @@ async function contentByAuthor({ site: siteName, type, limit = 100 }) {
 }
 
 /**
- * Recently published content of a given type, newest first.
+ * Recently published content, newest first. With `type`, reads that bundle.
+ * Without it, reads every node bundle the connector may read, merges by
+ * `created`, and keeps the newest `limit`; a bundle that fails to load is
+ * listed in `bundleErrors` (#403).
  *
  * @param {object} args - { site?, type?, limit? }.
  * @returns {Promise<object>} The most recently created published nodes.
@@ -152,22 +155,42 @@ async function recentlyPublished({ site: siteName, type, limit = 20 }) {
   const sec = resolveSecurityConfig(site);
   assertReadAllowed(sec, "node", type);
   const backend = await resolveBackend(site);
-  const res = await backend.listEntities({
-    entityType: "node", bundle: type || "article",
-    filters: [{ field: "status", op: "eq", value: true }],
-    sort: [{ field: "created", dir: "desc" }],
-    page: { limit },
-  });
+  const bundles = type ? [type] : await readableNodeBundles(backend, sec);
+  const nodes = [];
+  const bundleErrors = [];
+  let approximate = false;
+  for (const bundle of bundles) {
+    let res;
+    try {
+      res = await backend.listEntities({
+        entityType: "node", bundle,
+        filters: [{ field: "status", op: "eq", value: true }],
+        sort: [{ field: "created", dir: "desc" }],
+        page: { limit },
+      });
+    } catch (err) {
+      if (type) throw err;
+      bundleErrors.push({ contentType: bundle, error: err?.message || String(err) });
+      continue;
+    }
+    approximate = approximate || (res.approximate ?? false);
+    for (const n of res.entities) {
+      nodes.push({
+        id: n.id,
+        title: n.title,
+        created: n.created,
+        changed: n.changed,
+        path: n.url,
+        ...(type ? {} : { contentType: bundle }),
+      });
+    }
+  }
+  if (!type) nodes.sort((x, y) => String(y.created ?? "").localeCompare(String(x.created ?? "")));
   return {
-    contentType: type || "article",
-    approximate: res.approximate ?? false,
-    nodes: res.entities.map((n) => ({
-      id: n.id,
-      title: n.title,
-      created: n.created,
-      changed: n.changed,
-      path: n.url,
-    })),
+    contentType: type || null,
+    approximate,
+    nodes: nodes.slice(0, limit),
+    ...(bundleErrors.length ? { bundleErrors } : {}),
   };
 }
 
@@ -255,12 +278,13 @@ async function fieldCompleteness({ site: siteName, type, fields, sampleSize = 10
  * Per-term counts that error out are reported as null nodeCount.
  *
  * @param {object} args - { site?, vocabulary, contentType?, referenceField?, limit? }.
- *   `referenceField` defaults to `field_{vocabulary}`; `contentType` to "article".
+ *   `referenceField` defaults to `field_{vocabulary}`; `contentType` is required.
  * @returns {Promise<object>} Terms sorted by usage, plus an unused-term count.
  * @throws {Error} If no vocabulary is supplied.
  * @throws {SecurityError} If reading the vocabulary is not permitted.
  */
 async function taxonomyUsage({ site: siteName, vocabulary, contentType, referenceField, limit = 100 }) {
+  const ctype = requireContentType(contentType, "drupal_report_taxonomy_usage", "contentType");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertReadAllowed(sec, "taxonomy_term", vocabulary);
@@ -272,7 +296,6 @@ async function taxonomyUsage({ site: siteName, vocabulary, contentType, referenc
     limit
   );
   const field = referenceField || `field_${vocabulary}`;
-  const ctype = contentType || "article";
   let approximate = false;
   const results = await Promise.all(terms.map(async (term) => {
     try {
@@ -306,9 +329,10 @@ async function taxonomyUsage({ site: siteName, vocabulary, contentType, referenc
  * @throws {SecurityError} If reading the content type is not permitted.
  */
 async function revisionHotspots({ site: siteName, type, limit = 20 }) {
+  const contentType = requireContentType(type, "drupal_report_revision_hotspots");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  assertReadAllowed(sec, "node", type);
+  assertReadAllowed(sec, "node", contentType);
   const backend = await resolveBackend(site);
   if (!backend.capabilities().revisions) {
     return gatedReport(
@@ -317,7 +341,6 @@ async function revisionHotspots({ site: siteName, type, limit = 20 }) {
       "This backend does not expose entity revisions. Use a JSON:API site."
     );
   }
-  const contentType = type || "article";
   const recent = await backend.listEntities({
     entityType: "node", bundle: contentType,
     sort: [{ field: "changed", dir: "desc" }],
@@ -431,11 +454,11 @@ async function userActivity({ site: siteName, inactiveDays = 90, limit = 50 }) {
  * @throws {SecurityError} If reading the content type is not permitted.
  */
 async function seoAudit({ site: siteName, type, sampleSize = 100 }) {
+  const contentType = requireContentType(type, "drupal_report_seo_audit");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  assertReadAllowed(sec, "node", type);
+  assertReadAllowed(sec, "node", contentType);
   const backend = await resolveBackend(site);
-  const contentType = type || "article";
   const issueKeys = ["missingMetaDescription", "titleTooLong", "titleTooShort", "thinContent"];
   const issues = new Map(issueKeys.map((k) => [k, []]));
   const entities = await collectEntities(
@@ -524,11 +547,11 @@ function resolveJsonapiMetaSource(entities) {
  * @throws {SecurityError} If reading the content type is not permitted.
  */
 async function accessibilityAudit({ site: siteName, type, sampleSize = 100 }) {
+  const contentType = requireContentType(type, "drupal_report_accessibility_audit");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
-  assertReadAllowed(sec, "node", type);
+  assertReadAllowed(sec, "node", contentType);
   const backend = await resolveBackend(site);
-  const contentType = type || "article";
   const issueKeys = ["imagesWithoutAlt", "inlineH1", "nonDescriptiveLinkText", "tablesWithoutCaption"];
   const issues = new Map(issueKeys.map((k) => [k, []]));
   const badLinkText = />\s*(click here|read more|learn more|here|more|link)\s*</i;
@@ -572,10 +595,10 @@ export const definitions = [
     name: "drupal_report_stale_content",
     description: "Find content that hasn't been updated in N days. Returns a sorted list with titles, status, and days-since-update.",
     inputSchema: {
-      type: "object",
+      type: "object", required: ["type"],
       properties: {
         site:   { type: "string" },
-        type:   { type: "string", description: "Content type (default: article)" },
+        type:   { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         days:   { type: "number", default: 180, description: "Stale threshold in days" },
         status: { type: "boolean", description: "Filter by publish status" },
         limit:  { type: "number", default: 50 },
@@ -586,10 +609,10 @@ export const definitions = [
     name: "drupal_report_content_by_author",
     description: "Count nodes per author for a given content type. Returns author UUIDs and counts sorted by most prolific.",
     inputSchema: {
-      type: "object",
+      type: "object", required: ["type"],
       properties: {
         site:  { type: "string" },
-        type:  { type: "string", description: "Content type (default: article)" },
+        type:  { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         limit: { type: "number", default: 100, description: "Max nodes to scan" },
       },
     },
@@ -601,7 +624,7 @@ export const definitions = [
       type: "object",
       properties: {
         site:  { type: "string" },
-        type:  { type: "string", description: "Content type (default: article)" },
+        type:  { type: "string", description: "Content type machine name. Omit to read every node bundle (results merged, newest first; unreadable bundles listed in bundleErrors)." },
         limit: { type: "number", default: 20 },
       },
     },
@@ -623,11 +646,11 @@ export const definitions = [
     name: "drupal_report_taxonomy_usage",
     description: "Count how many nodes use each term in a vocabulary. Identifies over-used, under-used, and orphaned terms.",
     inputSchema: {
-      type: "object", required: ["vocabulary"],
+      type: "object", required: ["vocabulary", "contentType"],
       properties: {
         site:           { type: "string" },
         vocabulary:     { type: "string", description: "Vocabulary machine name, e.g. 'tags', 'category'" },
-        contentType:    { type: "string", description: "Content type to count references from (default: article)" },
+        contentType:    { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         referenceField: { type: "string", description: "Field referencing the vocabulary (default: field_{vocabulary})" },
         limit:          { type: "number", default: 100 },
       },
@@ -637,10 +660,10 @@ export const definitions = [
     name: "drupal_report_revision_hotspots",
     description: "Find nodes with the most revision activity — useful for spotting churn or content that needs editorial process review. Requires Drupal 9.3+ JSON:API revisions.",
     inputSchema: {
-      type: "object",
+      type: "object", required: ["type"],
       properties: {
         site:  { type: "string" },
-        type:  { type: "string", description: "Content type (default: article)" },
+        type:  { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         limit: { type: "number", default: 20 },
       },
     },
@@ -661,10 +684,10 @@ export const definitions = [
     name: "drupal_report_seo_audit",
     description: "SEO audit for a content type: missing meta descriptions, title length issues, and thin content (under 300 words). Returns node lists for each issue category. Meta descriptions use the rendered Metatag output via GraphQL when available (reported as `metaSource`); when no description source is readable it reports the meta check as unavailable rather than a false zero.",
     inputSchema: {
-      type: "object",
+      type: "object", required: ["type"],
       properties: {
         site:       { type: "string" },
-        type:       { type: "string", description: "Content type (default: article)" },
+        type:       { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         sampleSize: { type: "number", default: 100 },
       },
     },
@@ -673,10 +696,10 @@ export const definitions = [
     name: "drupal_report_accessibility_audit",
     description: "Accessibility audit for body content: images without alt text, inline H1 tags, non-descriptive link text ('click here', 'read more'), and tables without captions.",
     inputSchema: {
-      type: "object",
+      type: "object", required: ["type"],
       properties: {
         site:       { type: "string" },
-        type:       { type: "string", description: "Content type (default: article)" },
+        type:       { type: "string", description: "Content type machine name (required; see drupal_list_content_types)" },
         sampleSize: { type: "number", default: 100 },
       },
     },

package/src/tools/revisions.js

@@ -25,6 +25,7 @@ import {
 } from "../lib/security.js";
 import {
   assertDraftLangcode, readDraftTranslation, readNodeDraftInventory, readTranslationInventory,
+  isUnpublishedWorkingDraft,
 } from "../lib/sentinel-draft.js";
 import { omitLiveComputedMetatag } from "../lib/entity-response.js";
 import { changedAheadOfRevision, prepareGuardedPatch, updateEntityGuarded } from "../lib/patch-preflight.js";
@@ -221,7 +222,7 @@ async function getRevision({ site: siteName, type, id, version, langcode }) {
     const targetLang = assertDraftLangcode(langcode);
     const inventory = await readTranslationInventory(backend, { entityType: "node", bundle: type, id });
     const workingRow = (inventory.working?.translations ?? []).find((row) => row.langcode === targetLang);
-    if (!inventory.live?.vid || !inventory.working?.vid || !workingRow || workingRow.status !== false) {
+    if (!inventory.live?.vid || !inventory.working?.vid || !workingRow || !isUnpublishedWorkingDraft(workingRow)) {
       throw new Error("No unpublished working translation is addressable for this revision.");
     }
     const entity = await readDraftTranslation(backend, {

package/src/tools/scheduler.js

@@ -6,32 +6,81 @@
  * the schedule on two entity fields — `publish_on` and `unpublish_on` — which the
  * module adds to a content type when scheduling is enabled for that bundle.
  *
+ * On a bundle under Content Moderation, Scheduler Content Moderation
+ * Integration also needs `publish_state` / `unpublish_state`. Dates without
+ * those states are accepted by Drupal and then fail at cron (#402).
+ *
  * This is a thin write over the canonical backend's updateEntity: the supplied
- * timestamps are passed straight through as those two attributes. Scheduler
+ * timestamps are passed straight through as those attributes. Scheduler
  * accepts an ISO 8601 datetime string or a Unix epoch; we accept either form and
  * forward it unchanged (the JSON:API backend coerces datetime fields as needed).
  *
  * Capability degradation: if the Scheduler module is not installed, or the bundle
- * does not have the publish_on / unpublish_on fields, the backend write fails with
- * an "unknown field" error. We catch that and re-throw a clear, actionable message
- * (while still surfacing the underlying backend error) rather than a raw stack.
+ * does not have the publish_on / unpublish_on fields, JSON:API rejects the write
+ * because the attribute does not exist. We catch that and re-throw a clear,
+ * actionable message (while still surfacing the underlying backend error).
+ *
+ * The connector does not decide who may schedule which transition. Drupal's
+ * validation (SchedulerModerationTransitionAccess) and the site's MCP Sentinel
+ * policy are the gate; their refusals are surfaced verbatim. The only local
+ * refusal is a date with no matching state on a bundle that exposes the state
+ * field, because Drupal accepts that write and the schedule then never runs.
  */
 
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertWriteAllowed, redactCanonicalEntity } from "../lib/security.js";
+import { entityLooksModerated } from "../lib/moderation-default.js";
+import { fieldPresence } from "../lib/reports-support.js";
+import { httpStatusOf } from "../lib/error-status.js";
 
 /**
- * Heuristic: does this backend error look like a missing/unknown field? Scheduler
- * fields are absent unless the module is installed and enabled for the bundle, so
- * an unknown-field error almost always means a missing Scheduler capability.
+ * Does this backend error say a Scheduler attribute does not exist on the
+ * bundle? Only Drupal JSON:API's explicit form counts ("The attribute
+ * publish_on does not exist on the node--page resource type."). A 422
+ * validation detail names the field too (`publish_state: …`) and may say
+ * "invalid" or "unknown"; that is a refusal by the site, surfaced verbatim,
+ * not a missing capability (#402).
  *
  * @param {Error} err - The error thrown by the backend write.
  * @returns {boolean}
  */
 export function looksLikeUnknownField(err) {
-  const msg = String(err?.message || err || "");
-  return /unknown|not exist|no field|invalid field|unrecognized|publish_on|unpublish_on/i.test(msg);
+  const msg = String(err?.message || err || "").slice(0, 2000);
+  return /\battribute [\w.-]{1,128} does not exist on the [\w.-]{1,128} resource type\b/i.test(msg);
+}
+
+/**
+ * Wrap a site refusal so the reason is the first thing the caller reads. The
+ * original message (with Drupal's or Sentinel's reason) is kept verbatim and
+ * the HTTP status is carried over.
+ *
+ * @param {Error} err - The error thrown by the backend write.
+ * @param {string} type - Bundle machine name.
+ * @returns {Error}
+ */
+function siteRefusal(err, type) {
+  const status = httpStatusOf(err);
+  const reason = err?.message || String(err);
+  const out = new Error(
+    `The site refused the schedule on '${type}'${status ? ` (HTTP ${status})` : ""}. ` +
+    `Drupal validation or the site's MCP Sentinel policy decides scheduled transitions; the connector does not. Reason: ${reason}`,
+  );
+  if (status) out.status = status;
+  out.cause = err;
+  return out;
+}
+
+/**
+ * Whether a schema or entity exposes a Scheduler attribute.
+ * @param {?object} entity Canonical entity.
+ * @param {?object} schema Bundle schema from getEntitySchema.
+ * @param {string} field Field machine name.
+ * @returns {boolean}
+ */
+function schedulerFieldPresent(entity, schema, field) {
+  if (entity && fieldPresence(entity, field).present) return true;
+  return Boolean(schema?.attributes && Object.prototype.hasOwnProperty.call(schema.attributes, field));
 }
 
 /**
@@ -41,12 +90,21 @@ export function looksLikeUnknownField(err) {
  * canonical updateEntity. At least one of publishOn / unpublishOn must be given.
  * Each value is forwarded unchanged (ISO 8601 string or epoch integer).
  *
- * @param {object} args - { site?, type, id, publishOn?, unpublishOn? }.
- * @returns {Promise<object>} The redacted, updated node descriptor.
- * @throws {Error} If neither timestamp is supplied, if the policy forbids the
- *   write, or — degraded — if the Scheduler fields are unknown on the bundle.
+ * `publishState` / `unpublishState` are written as `publish_state` /
+ * `unpublish_state`. When the bundle exposes the matching state field, a date
+ * without its state is refused locally (#402); every other decision is Drupal's.
+ *
+ * @param {object} args - { site?, type, id, publishOn?, unpublishOn?, publishState?, unpublishState? }.
+ * @returns {Promise<object>} The redacted, updated node descriptor, with
+ *   `warnings` when a moderated bundle has no state field to pair a date with.
+ * @throws {Error} If neither timestamp is supplied, if connector policy forbids
+ *   the write, if a date is missing its state on a bundle with the state field,
+ *   if the site refuses the write (reason kept verbatim), or — degraded — if the
+ *   Scheduler fields are unknown on the bundle.
  */
-async function schedulePublish({ site: siteName, type, id, publishOn, unpublishOn }) {
+async function schedulePublish({
+  site: siteName, type, id, publishOn, unpublishOn, publishState, unpublishState,
+}) {
   if (publishOn === undefined && unpublishOn === undefined) {
     throw new Error("Provide at least one of publishOn or unpublishOn to schedule the node.");
   }
@@ -55,9 +113,53 @@ async function schedulePublish({ site: siteName, type, id, publishOn, unpublishO
   assertWriteAllowed(sec, "update", "node", type);
   const backend = await resolveBackend(site);
 
+  let existing = null;
+  if (typeof backend.getEntity === "function") {
+    try {
+      existing = await backend.getEntity({ entityType: "node", bundle: type, id }) ?? null;
+    } catch {
+      existing = null;
+    }
+  }
+  let schema = null;
+  if (existing && typeof backend.getEntitySchema === "function") {
+    try {
+      schema = await backend.getEntitySchema("node", type);
+    } catch {
+      schema = null;
+    }
+  }
+
+  // A state field on the bundle means Scheduler Content Moderation Integration
+  // is active there. Drupal accepts a date with no state, and the schedule then
+  // fails at every cron run, so that one case is refused here (#402).
+  const pairs = [
+    ["publishOn", publishOn, "publishState", publishState, "publish_state", "published"],
+    ["unpublishOn", unpublishOn, "unpublishState", unpublishState, "unpublish_state", "archived"],
+  ];
+  const warnings = [];
+  for (const [dateArg, date, stateArg, state, stateField, example] of pairs) {
+    if (date === undefined || state !== undefined) continue;
+    if (schedulerFieldPresent(existing, schema, stateField)) {
+      throw new Error(
+        `'${type}' is a moderated bundle with Scheduler Content Moderation Integration: pass ${stateArg} ` +
+        `(the moderation state to enter at ${dateArg}, e.g. '${example}'). A schedule without a state never runs: ` +
+        "Drupal accepts it, then cron logs 'Publishing failed' on every run.",
+      );
+    }
+    if (entityLooksModerated(existing)) {
+      warnings.push(
+        `'${type}' is moderated but exposes no ${stateField} field. Scheduler cannot change a moderated node ` +
+        `without the Scheduler Content Moderation Integration module and a ${stateArg}, so this ${dateArg} may never take effect.`,
+      );
+    }
+  }
+
   const attributes = {};
   if (publishOn !== undefined) attributes.publish_on = publishOn;
   if (unpublishOn !== undefined) attributes.unpublish_on = unpublishOn;
+  if (publishState !== undefined) attributes.publish_state = publishState;
+  if (unpublishState !== undefined) attributes.unpublish_state = unpublishState;
 
   let updated;
   try {
@@ -65,14 +167,20 @@ async function schedulePublish({ site: siteName, type, id, publishOn, unpublishO
   } catch (err) {
     if (looksLikeUnknownField(err)) {
       throw new Error(
-        `Could not set Scheduler dates on '${type}': the publish_on / unpublish_on fields are not available. ` +
-        "This tool requires the Drupal Scheduler module to be installed and enabled for this content type. " +
+        `Could not set Scheduler dates on '${type}': a Scheduler field is not available on this bundle. ` +
+        "publish_on / unpublish_on need the Drupal Scheduler module enabled for this content type; " +
+        "publish_state / unpublish_state also need Scheduler Content Moderation Integration. " +
         `Backend error: ${err?.message || err}`,
       );
     }
+    // 403 (access or Sentinel policy) and 422 (validation) are the site's
+    // decision on this write. Other failures pass through unchanged.
+    const status = httpStatusOf(err);
+    if (status === 403 || status === 422) throw siteRefusal(err, type);
     throw err;
   }
-  return updated ? redactCanonicalEntity(updated, sec, "node") : updated;
+  const out = updated ? redactCanonicalEntity(updated, sec, "node") : updated;
+  return out && warnings.length ? { ...out, warnings } : out;
 }
 
 // ---------------------------------------------------------------------------
@@ -84,19 +192,26 @@ export const definitions = [
     name: "drupal_schedule_publish",
     description:
       "Schedule a content node to publish and/or unpublish at a future time using the Drupal Scheduler module. " +
-      "Sets the publish_on and unpublish_on fields on the node. " +
-      "Requires the Scheduler module to be installed and enabled for the content type, with the publish_on / " +
-      "unpublish_on fields present on the bundle — otherwise the call fails with a clear capability error. " +
-      "Timestamps accept ISO 8601 (e.g. '2026-07-01T12:00:00Z') or a Unix epoch and are passed through unchanged. " +
-      "Provide at least one of publishOn or unpublishOn.",
+      "Sets the publish_on and unpublish_on fields on the node. Provide at least one of publishOn or unpublishOn. " +
+      "Moderated bundles (Content Moderation) also need a target state: pass publishState / unpublishState " +
+      "(moderation state machine names, e.g. 'published', 'archived'), written as publish_state / unpublish_state. " +
+      "These fields exist only when the Scheduler Content Moderation Integration module is enabled. When the bundle " +
+      "exposes a state field and its date is set without the state, the call fails, because Drupal would accept a " +
+      "schedule that never runs. When a moderated bundle has no state field, the dates are written and the result " +
+      "carries a warning. Whether this account may schedule a given transition is decided by the site (Drupal " +
+      "validation and MCP Sentinel policy), not the connector; a refusal returns the site's reason verbatim. " +
+      "Without the Scheduler module on the content type, the call fails with a capability error. " +
+      "Timestamps accept ISO 8601 (e.g. '2026-07-01T12:00:00Z') or a Unix epoch and are passed through unchanged.",
     inputSchema: {
       type: "object", required: ["type", "id"],
       properties: {
-        site:        { type: "string", description: "Named site (omit for default)" },
-        type:        { type: "string", description: "Content type machine name, e.g. 'article'" },
-        id:          { type: "string", description: "Node UUID" },
-        publishOn:   { type: ["string", "number"], description: "When to publish — ISO 8601 datetime or Unix epoch. Sets the Scheduler publish_on field." },
-        unpublishOn: { type: ["string", "number"], description: "When to unpublish — ISO 8601 datetime or Unix epoch. Sets the Scheduler unpublish_on field." },
+        site:           { type: "string", description: "Named site (omit for default)" },
+        type:           { type: "string", description: "Content type machine name, e.g. 'article'" },
+        id:             { type: "string", description: "Node UUID" },
+        publishOn:      { type: ["string", "number"], description: "When to publish — ISO 8601 datetime or Unix epoch. Sets the Scheduler publish_on field." },
+        unpublishOn:    { type: ["string", "number"], description: "When to unpublish — ISO 8601 datetime or Unix epoch. Sets the Scheduler unpublish_on field." },
+        publishState:   { type: "string", description: "Moderation state machine name to enter at publishOn (e.g. 'published'). Written as publish_state. Required when publishOn is set and the bundle has a publish_state field." },
+        unpublishState: { type: "string", description: "Moderation state machine name to enter at unpublishOn (e.g. 'archived'). Written as unpublish_state. Required when unpublishOn is set and the bundle has an unpublish_state field." },
       },
     },
   },

package/src/tools/search.js

@@ -2,8 +2,8 @@
  * Tool group: content search.
  *
  * Search API / Solr does not expose a JSON:API surface by default, so this tool
- * provides a best-effort search: a JSON:API title/body CONTAINS match over a
- * content type. Results are flagged mode:"fallback" and the response notes that
+ * provides a best-effort search: a JSON:API title CONTAINS match over one
+ * content type, or over every node bundle when `type` is omitted (#403). Results are flagged mode:"fallback" and the response notes that
  * true relevance ranking requires a Search API endpoint (or the Drush bridge).
  * Read-only and redacted per the site policy.
  */
@@ -11,28 +11,32 @@
 import { getSiteConfig } from "../lib/config.js";
 import { resolveBackend } from "../lib/backends/index.js";
 import { resolveSecurityConfig, assertReadAllowed, redactCanonicalEntity } from "../lib/security.js";
+import { readableNodeBundles, listNodesAcrossBundles } from "../lib/reports-support.js";
 
 /**
- * Search nodes of a type by a query string (title CONTAINS, best-effort).
+ * Search nodes by a query string (title CONTAINS, best-effort). With `type`,
+ * searches that bundle; without it, every node bundle the connector may read,
+ * merged newest first. A bundle that fails to load fails the search.
  * @param {object} args - { site?, query, type?, limit? }.
- * @returns {Promise<{query, mode, note, results}>}
+ * @returns {Promise<{query, type, mode, note, results}>}
  */
-async function search({ site: siteName, query, type = "article", limit = 10 }) {
+async function search({ site: siteName, query, type, limit = 10 }) {
   if (!query || !String(query).trim()) throw new Error("A non-empty 'query' is required.");
   const site = getSiteConfig(siteName);
   const sec = resolveSecurityConfig(site);
   assertReadAllowed(sec, "node", type);
   const backend = await resolveBackend(site);
-  const res = await backend.listEntities({
-    entityType: "node", bundle: type,
+  const descriptor = {
     filters: [{ field: "title", op: "contains", value: query }],
     sort: [{ field: "changed", dir: "desc" }],
-    page: { limit },
-  });
-  const results = res.entities.map((e) => redactCanonicalEntity(e, sec, "node"));
+  };
+  const entities = type
+    ? (await backend.listEntities({ ...descriptor, entityType: "node", bundle: type, page: { limit } })).entities
+    : await listNodesAcrossBundles(backend, await readableNodeBundles(backend, sec), descriptor, limit);
+  const results = entities.map((e) => redactCanonicalEntity(e, sec, "node"));
   return {
     query,
-    type,
+    type: type || null,
     mode: "fallback",
     note: "JSON:API title CONTAINS match. Relevance-ranked full-text search requires a Search API/Solr endpoint or the Drush bridge.",
     results,
@@ -48,7 +52,7 @@ export const definitions = [
       properties: {
         site:  { type: "string" },
         query: { type: "string", description: "Search term" },
-        type:  { type: "string", description: "Content type machine name (default: article)" },
+        type:  { type: "string", description: "Content type machine name. Omit to search every node bundle (merged, newest first); if any bundle cannot be read the search fails and names it." },
         limit: { type: "number", default: 10 },
       },
     },

package/src/tools/translations.js

@@ -45,6 +45,9 @@ import {
   supportsRevisePublishedTranslation,
   supportsReviseOverWorkingCopy,
   supportsSentinelDraft,
+  isUnpublishedWorkingDraft,
+  isCarriedPublishedLanguage,
+  carriedPublishedLanguageError,
 } from "../lib/sentinel-draft.js";
 import { mapTranslationRow } from "../lib/translation-rows.js";
 import { dryRunChecks, PREFLIGHT_SENTINEL_DRAFT } from "../lib/dry-run-checks.js";
@@ -179,13 +182,16 @@ async function createTranslation({
       if (hasWorking) {
         const workingRow = (draftRevision.inventory?.working?.translations ?? [])
           .find((row) => row?.langcode === targetLang);
-        if (workingRow && workingRow.status === false) {
+        if (workingRow && isUnpublishedWorkingDraft(workingRow)) {
           const continuer = entityType === "media" ? "drupal_update_media" : "drupal_update_node";
           throw new Error(
             "This language is already an unpublished draft on the working copy. " +
             `Continue it with ${continuer} and langcode. Revise was not attempted.`,
           );
         }
+        if (workingRow && isCarriedPublishedLanguage(workingRow)) {
+          throw carriedPublishedLanguageError(targetLang);
+        }
         // Sentinel 2.25.0+ builds the draft on the named working copy; the
         // pair is sent as If-Match "live:working" by createTranslationDraft.
         if (!supportsReviseOverWorkingCopy(draftRevision)) {