drupal-mcp-connector 3.2.1 → 3.2.3

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.2.3] - 2026-10-11
+
+### Added
+- **HTTP transport eval harness skeleton (DEV-866, increment 1).**
+  `npm run eval:http` runs a test-only pack over the hosted HTTP request
+  handler with a stub token issuer (not Paladin), a fake loopback upstream, and
+  synthetic keys. T1 checks that a missing identity gets 401 before dispatch,
+  T7 is its allow twin, and T1n records the unauthenticated non-loopback start
+  (DEV-845) as an expected failure that fails the pack if it ever passes.
+  Nothing under `src/` changes.
+
+## [3.2.2] - 2026-10-07
+
+### Fixed
+- **Library draft paragraph revisions (#420).** Entity Reference Revisions
+  saves a new paragraph revision when an existing host saves a new revision.
+  A library or custom-block draft matches when it pins that same paragraph,
+  in order, at the submitted revision or a newer one. An older revision, a
+  different paragraph, or a different order still fails. The published
+  revision's pins must still match exactly.
+
 ## [3.2.1] - 2026-10-07
 
 ### Fixed

package/README.md

@@ -278,8 +278,8 @@ the allowlist or Sentinel profile excludes the type — run `doctor` and
 ### From npm (recommended for operators)
 
 ```bash
-npm install -g drupal-mcp-connector@3.2.1
-# or: npx -y drupal-mcp-connector@3.2.1
+npm install -g drupal-mcp-connector@3.2.3
+# or: npx -y drupal-mcp-connector@3.2.3
 ```
 
 Point your MCP client at the installed binary (path from `which drupal-mcp-connector`
@@ -294,16 +294,16 @@ unbounded range.
 
 1. Pin an exact version in the lockfile (`package-lock.json` or
    `npm-shrinkwrap.json`), or in `package.json` as
-   `"drupal-mcp-connector": "3.2.1"` (use the version you intend to run).
+   `"drupal-mcp-connector": "3.2.3"` (use the version you intend to run).
 2. Confirm the registry checksum before you install.
-   `npm view drupal-mcp-connector@3.2.1 dist.integrity` prints the integrity
+   `npm view drupal-mcp-connector@3.2.3 dist.integrity` prints the integrity
    npm checks. A lockfile install fails when the tarball does not match.
 3. Read [CHANGELOG.md](CHANGELOG.md) for that version.
 4. Run `npm audit --omit=dev` against the lockfile and read any advisory
    before you upgrade. There is no separate scanner to install.
 
 Restart the MCP client after the upgrade. Run `drupal-mcp-doctor` when the
-package is on your PATH, or `npx -y drupal-mcp-connector@3.2.1 doctor` when
+package is on your PATH, or `npx -y drupal-mcp-connector@3.2.3 doctor` when
 you launch it with npx.
 
 ### From a git clone (development)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "description": "Multi-site MCP server for Drupal over JSON:API and GraphQL, with governed writes and an SSH Drush bridge. init writes a stdio or Tailscale client config from a transport preset. doctor checks reachability, auth, and readiness, and reports version skew. A timestamp gap on a published revision no longer blocks the next draft.",
   "type": "module",
   "main": "src/index.js",
@@ -61,6 +61,7 @@
     "lint:fix": "eslint src/ --fix",
     "test": "vitest run",
     "test:watch": "vitest",
+    "eval:http": "node tests/evals/http/run-pack.js",
     "audit": "npm audit --audit-level=high",
     "check": "npm run lint && npm run audit && npm run syntax-check && npm test",
     "syntax-check": "find src -name '*.js' -exec sh -c 'node --input-type=module --check < \"$1\" && echo \"$1 ✓\"' _ {} \\;",

package/src/lib/canonical-draft.js

@@ -23,10 +23,14 @@
  * timeout, or a missing revision id fails closed. A draft-inventory 404 or
  * 405 is absence. Any other inventory failure fails closed. After the write
  * the published revision, rel:working-copy, and the published paragraph pins
- * (including order) are re-read. A completed 4xx is returned when that
- * re-read matches the pre-write state. A lost response, or a 4xx whose
- * re-read shows a change, is reported from the re-read and is not called a
- * rollback. An unmoderated entity keeps the ordinary update.
+ * (including order) are re-read. Entity Reference Revisions saves a new
+ * paragraph revision when an existing host saves a new revision, so the draft
+ * may pin a later revision of the submitted paragraph. That later revision
+ * matches. An older revision, a different paragraph, or a different order
+ * does not. A completed 4xx is returned when that re-read matches the
+ * pre-write state. A lost response, or a 4xx whose re-read shows a change,
+ * is reported from the re-read and is not called a rollback. An unmoderated
+ * entity keeps the ordinary update.
  */
 
 import { entityRevisionId } from "./write-revision.js";
@@ -613,7 +617,7 @@ function assertPublishedPreserved(entityType, before, after, relationships) {
   const baseline = continuing ? normalizedPins(before.working) : before.pins;
   if (submitted) {
     const landed = forwardPins.filter((pin) => submitted.fields.has(pin.field));
-    if (pinKey(landed) !== pinKey(submitted.pins)) {
+    if (!submittedPinsLanded(submitted.pins, landed)) {
       problems.push("the forward revision does not pin the submitted paragraphs");
     }
   } else if (pinKey(forwardPins) !== pinKey(baseline)) {
@@ -633,7 +637,7 @@ function assertSubmittedPins(entityType, latest, relationships) {
   const submitted = submittedParagraphPins(relationships);
   if (!submitted) return;
   const landed = normalizedPins(latest).filter((pin) => submitted.fields.has(pin.field));
-  if (pinKey(landed) !== pinKey(submitted.pins)) {
+  if (!submittedPinsLanded(submitted.pins, landed)) {
     throw uncertainWriteError(entityType, "the written revision does not pin the submitted paragraphs");
   }
 }
@@ -793,3 +797,65 @@ function pinKey(pins) {
     return `${field}\0${rows.join("\n")}`;
   }).join("\n\n");
 }
+
+/**
+ * Group pins by field, preserving submission and re-read order inside a field.
+ * @param {object[]} pins
+ * @returns {Map<string, object[]>}
+ */
+function pinsByField(pins) {
+  const groups = new Map();
+  for (const pin of pins) {
+    if (!groups.has(pin.field)) groups.set(pin.field, []);
+    groups.get(pin.field).push(pin);
+  }
+  return groups;
+}
+
+/**
+ * Entity Reference Revisions creates a new paragraph revision when an existing
+ * host saves a new revision, then points the host at that revision. The
+ * submitted id is the earlier one. A missing revision on either side matches
+ * only another missing revision.
+ * @param {?string} submittedId
+ * @param {?string} landedId
+ * @returns {boolean}
+ */
+function sameRevisionOrNewer(submittedId, landedId) {
+  const submittedMissing = submittedId === null || submittedId === undefined || submittedId === "";
+  const landedMissing = landedId === null || landedId === undefined || landedId === "";
+  if (submittedMissing || landedMissing) return submittedMissing && landedMissing;
+  const submitted = Number(submittedId);
+  const landed = Number(landedId);
+  if (!Number.isSafeInteger(submitted) || !Number.isSafeInteger(landed)) {
+    return String(submittedId) === String(landedId);
+  }
+  return landed >= submitted;
+}
+
+/**
+ * Whether the re-read pins the submitted paragraphs, in order. A later
+ * revision of the same paragraph counts. An older revision does not.
+ * @param {object[]} submittedPins
+ * @param {object[]} landedPins
+ * @returns {boolean}
+ */
+function submittedPinsLanded(submittedPins, landedPins) {
+  const submitted = pinsByField(submittedPins);
+  const landed = pinsByField(landedPins);
+  const submittedFields = [...submitted.keys()].sort();
+  const landedFields = [...landed.keys()].sort();
+  if (submittedFields.length !== landedFields.length
+    || submittedFields.some((field, index) => field !== landedFields[index])) {
+    return false;
+  }
+  return submittedFields.every((field) => {
+    const left = submitted.get(field) ?? [];
+    const right = landed.get(field) ?? [];
+    if (left.length !== right.length) return false;
+    return left.every((pin, index) => {
+      const got = right[index];
+      return got.id === pin.id && sameRevisionOrNewer(pin.revisionId, got.revisionId);
+    });
+  });
+}