drupal-mcp-connector 3.2.2 → 3.2.3

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.2.3] - 2026-10-11
+
+### Added
+- **HTTP transport eval harness skeleton (DEV-866, increment 1).**
+  `npm run eval:http` runs a test-only pack over the hosted HTTP request
+  handler with a stub token issuer (not Paladin), a fake loopback upstream, and
+  synthetic keys. T1 checks that a missing identity gets 401 before dispatch,
+  T7 is its allow twin, and T1n records the unauthenticated non-loopback start
+  (DEV-845) as an expected failure that fails the pack if it ever passes.
+  Nothing under `src/` changes.
+
 ## [3.2.2] - 2026-10-07
 
 ### Fixed

package/README.md

@@ -278,8 +278,8 @@ the allowlist or Sentinel profile excludes the type — run `doctor` and
 ### From npm (recommended for operators)
 
 ```bash
-npm install -g drupal-mcp-connector@3.2.2
-# or: npx -y drupal-mcp-connector@3.2.2
+npm install -g drupal-mcp-connector@3.2.3
+# or: npx -y drupal-mcp-connector@3.2.3
 ```
 
 Point your MCP client at the installed binary (path from `which drupal-mcp-connector`
@@ -294,16 +294,16 @@ unbounded range.
 
 1. Pin an exact version in the lockfile (`package-lock.json` or
    `npm-shrinkwrap.json`), or in `package.json` as
-   `"drupal-mcp-connector": "3.2.2"` (use the version you intend to run).
+   `"drupal-mcp-connector": "3.2.3"` (use the version you intend to run).
 2. Confirm the registry checksum before you install.
-   `npm view drupal-mcp-connector@3.2.2 dist.integrity` prints the integrity
+   `npm view drupal-mcp-connector@3.2.3 dist.integrity` prints the integrity
    npm checks. A lockfile install fails when the tarball does not match.
 3. Read [CHANGELOG.md](CHANGELOG.md) for that version.
 4. Run `npm audit --omit=dev` against the lockfile and read any advisory
    before you upgrade. There is no separate scanner to install.
 
 Restart the MCP client after the upgrade. Run `drupal-mcp-doctor` when the
-package is on your PATH, or `npx -y drupal-mcp-connector@3.2.2 doctor` when
+package is on your PATH, or `npx -y drupal-mcp-connector@3.2.3 doctor` when
 you launch it with npx.
 
 ### From a git clone (development)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "3.2.2",
+  "version": "3.2.3",
   "description": "Multi-site MCP server for Drupal over JSON:API and GraphQL, with governed writes and an SSH Drush bridge. init writes a stdio or Tailscale client config from a transport preset. doctor checks reachability, auth, and readiness, and reports version skew. A timestamp gap on a published revision no longer blocks the next draft.",
   "type": "module",
   "main": "src/index.js",
@@ -61,6 +61,7 @@
     "lint:fix": "eslint src/ --fix",
     "test": "vitest run",
     "test:watch": "vitest",
+    "eval:http": "node tests/evals/http/run-pack.js",
     "audit": "npm audit --audit-level=high",
     "check": "npm run lint && npm run audit && npm run syntax-check && npm test",
     "syntax-check": "find src -name '*.js' -exec sh -c 'node --input-type=module --check < \"$1\" && echo \"$1 ✓\"' _ {} \\;",