@centia-io/mcp-server 1.0.17 → 1.0.19

package/AGENTS.md

@@ -61,6 +61,8 @@ Use the minimal matching skill(s) below for each task:
 - Feature CRUD as GeoJSON by primary key: `skills/centia-feature/SKILL.md`
 - Realtime WebSocket events: `skills/centia-realtime/SKILL.md`
 - File import workflow: `skills/centia-file-import/SKILL.md`
+- OGC web services (WMS/WFS/WFS-T/MapCache): `skills/centia-ows/SKILL.md`
+- OGC API Features and Maps (GeoJSON items, map images): `skills/centia-ogc/SKILL.md`
 - OpenAPI and docs fallback: `skills/centia-openapi-docs/SKILL.md`
 - Delivery checklist and MCP reference: `skills/centia-delivery/SKILL.md`
 - Danish address/matrikel search component: `skills/danish-search/SKILL.md`

package/README.md

@@ -135,6 +135,8 @@ To ensure your AI agent follows these rules while developing your application:
 - `centia-auth-model` — Auth across browser, backend, CLI, and provisioning
 - `centia-types-formats` — PostgreSQL types, casts, type hints, output formats
 - `centia-file-import` — File import workflow
+- `centia-ows` — WMS/WFS/WFS-T and MapCache proxy endpoints and their access model
+- `centia-ogc` — OGC API Features and Maps (GeoJSON items, map images)
 - `centia-openapi-docs` — OpenAPI and docs fallback policy
 - `centia-delivery` — Delivery checklist and quality gate
 

package/centia-api.json

@@ -3013,6 +3013,611 @@
                 }
             }
         },
+        "/api/v4/oauth/guest": {
+            "post": {
+                "tags": [
+                    "OAuth"
+                ],
+                "description": "Get a guest token.",
+                "operationId": "postGuest",
+                "requestBody": {
+                    "description": "Get a guest token. A default user must be present.",
+                    "required": true,
+                    "content": {
+                        "application/json": {
+                            "schema": {
+                                "$ref": "#/components/schemas/OAuthGuest"
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "$ref": "#/components/schemas/OAuthResponse"
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "description": "Bad request"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "OGC API landing page for a database (Bearer, HTTP Basic or anonymous).",
+                "operationId": "getOgcLandingPage",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Landing page with links to conformance, collections and the OpenAPI document"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/conformance": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "Conformance classes implemented by this OGC API.",
+                "operationId": "getOgcConformance",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "conformsTo list"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/collections": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "OWS-enabled layers as OGC API collections (id = schema.table), filtered by the caller's access.",
+                "operationId": "getOgcCollections",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "limit",
+                        "in": "query",
+                        "description": "Page size (default 100, max 1000)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 100
+                        }
+                    },
+                    {
+                        "name": "offset",
+                        "in": "query",
+                        "description": "Collections to skip",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 0
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Collections with extent, crs list and links"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/collections/{collectionId}": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "One collection.",
+                "operationId": "getOgcCollection",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "collectionId",
+                        "in": "path",
+                        "description": "Collection id (schema.table)",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_schema.my_table"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Collection"
+                    },
+                    "401": {
+                        "description": "Read/write collection: credentials required"
+                    },
+                    "403": {
+                        "description": "Read/write collection: insufficient privileges"
+                    },
+                    "404": {
+                        "description": "Unknown collection"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/map": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "Map of several collections (same schema) rendered through the WMS backend with geofence rules and versioning applied.",
+                "operationId": "getOgcDatasetMap",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "collections",
+                        "in": "query",
+                        "description": "Comma-separated collection ids",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_schema.roads,my_schema.buildings"
+                    },
+                    {
+                        "name": "bbox",
+                        "in": "query",
+                        "description": "minx,miny,maxx,maxy in bbox-crs",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "bbox-crs",
+                        "in": "query",
+                        "description": "CRS URI of bbox (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "crs",
+                        "in": "query",
+                        "description": "Output CRS URI (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "width",
+                        "in": "query",
+                        "description": "Image width in pixels (max 16384)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "height",
+                        "in": "query",
+                        "description": "Image height in pixels (max 16384)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "f",
+                        "in": "query",
+                        "description": "png (default) or jpeg",
+                        "required": false,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "png",
+                                "jpeg"
+                            ]
+                        }
+                    },
+                    {
+                        "name": "transparent",
+                        "in": "query",
+                        "description": "Transparent background (default true for png)",
+                        "required": false,
+                        "schema": {
+                            "type": "boolean"
+                        }
+                    },
+                    {
+                        "name": "bgcolor",
+                        "in": "query",
+                        "description": "Background colour 0xRRGGBB",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "datetime",
+                        "in": "query",
+                        "description": "ISO 8601 instant: render the version valid at that time (versioned layers)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "image/png or image/jpeg"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/collections/{collectionId}/items": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "Features of a collection as a GeoJSON FeatureCollection. Geofence rules, versioning and workflow are applied by the WFS engine.",
+                "operationId": "getOgcItems",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "collectionId",
+                        "in": "path",
+                        "description": "Collection id (schema.table)",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_schema.my_table"
+                    },
+                    {
+                        "name": "limit",
+                        "in": "query",
+                        "description": "Page size (default 10, max 10000)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 10
+                        }
+                    },
+                    {
+                        "name": "offset",
+                        "in": "query",
+                        "description": "Features to skip",
+                        "required": false,
+                        "schema": {
+                            "type": "integer",
+                            "default": 0
+                        }
+                    },
+                    {
+                        "name": "bbox",
+                        "in": "query",
+                        "description": "minx,miny,maxx,maxy in bbox-crs",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "9,55,10,56"
+                    },
+                    {
+                        "name": "bbox-crs",
+                        "in": "query",
+                        "description": "CRS URI of bbox (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "crs",
+                        "in": "query",
+                        "description": "Output CRS URI from the collection crs list (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "datetime",
+                        "in": "query",
+                        "description": "ISO 8601 instant: the version valid at that time (versioned layers only)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "GeoJSON FeatureCollection (application/geo+json) with Content-Crs header"
+                    },
+                    "400": {
+                        "description": "Invalid or unknown parameter"
+                    },
+                    "401": {
+                        "description": "Credentials required for a Read/write layer"
+                    },
+                    "403": {
+                        "description": "Insufficient privileges, or denied by a geofence rule"
+                    },
+                    "404": {
+                        "description": "Unknown collection"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/collections/{collectionId}/items/{featureId}": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "One feature by primary key as a GeoJSON Feature.",
+                "operationId": "getOgcItem",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "collectionId",
+                        "in": "path",
+                        "description": "Collection id (schema.table)",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_schema.my_table"
+                    },
+                    {
+                        "name": "featureId",
+                        "in": "path",
+                        "description": "Primary key value",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "1"
+                    },
+                    {
+                        "name": "crs",
+                        "in": "query",
+                        "description": "Output CRS URI (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "datetime",
+                        "in": "query",
+                        "description": "ISO 8601 instant (versioned layers only)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "GeoJSON Feature (application/geo+json)"
+                    },
+                    "404": {
+                        "description": "Unknown feature or collection"
+                    }
+                }
+            }
+        },
+        "/api/v4/ogc/database/{database}/collections/{collectionId}/map": {
+            "get": {
+                "tags": [
+                    "Ogc"
+                ],
+                "description": "Map of one collection rendered by the WMS backend; geofence rules and versioning (datetime) are applied.",
+                "operationId": "getOgcCollectionMap",
+                "parameters": [
+                    {
+                        "name": "database",
+                        "in": "path",
+                        "description": "Database name",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_database"
+                    },
+                    {
+                        "name": "collectionId",
+                        "in": "path",
+                        "description": "Collection id (schema.table)",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "my_schema.my_table"
+                    },
+                    {
+                        "name": "bbox",
+                        "in": "query",
+                        "description": "minx,miny,maxx,maxy in bbox-crs (default: the collection extent)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        },
+                        "example": "9,55,10,56"
+                    },
+                    {
+                        "name": "bbox-crs",
+                        "in": "query",
+                        "description": "CRS URI of bbox (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "crs",
+                        "in": "query",
+                        "description": "Output CRS URI from the collection crs list (default CRS84)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "width",
+                        "in": "query",
+                        "description": "Image width in pixels (max 16384; default 1024 or from the aspect ratio)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "height",
+                        "in": "query",
+                        "description": "Image height in pixels (max 16384; default from the aspect ratio)",
+                        "required": false,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    },
+                    {
+                        "name": "f",
+                        "in": "query",
+                        "description": "png (default) or jpeg",
+                        "required": false,
+                        "schema": {
+                            "type": "string",
+                            "enum": [
+                                "png",
+                                "jpeg"
+                            ]
+                        }
+                    },
+                    {
+                        "name": "transparent",
+                        "in": "query",
+                        "description": "Transparent background (default true for png, false for jpeg)",
+                        "required": false,
+                        "schema": {
+                            "type": "boolean"
+                        }
+                    },
+                    {
+                        "name": "bgcolor",
+                        "in": "query",
+                        "description": "Background colour 0xRRGGBB",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "datetime",
+                        "in": "query",
+                        "description": "ISO 8601 instant: render the version valid at that time (versioned layers only)",
+                        "required": false,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "image/png or image/jpeg"
+                    },
+                    "400": {
+                        "description": "Invalid or unknown parameter"
+                    },
+                    "401": {
+                        "description": "Credentials required for a Read/write layer"
+                    },
+                    "403": {
+                        "description": "Insufficient privileges, or denied by a geofence rule"
+                    },
+                    "404": {
+                        "description": "Unknown collection"
+                    }
+                }
+            }
+        },
         "/api/v4/ows/schema/{schema}/database/{database}": {
             "get": {
                 "tags": [
@@ -3402,6 +4007,82 @@
                 }
             }
         },
+        "/api/v4/schemas/{schema}/tables/{table}/search": {
+            "get": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "Search the table's OpenSearch index. Query string or body is passed to OpenSearch _search unaltered.",
+                "operationId": "search",
+                "responses": {
+                    "200": {
+                        "description": "OpenSearch response"
+                    }
+                }
+            },
+            "put": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "(Re)build the OpenSearch index from the table/view. Owner/superuser only.",
+                "operationId": "buildSearchIndex",
+                "responses": {
+                    "200": {
+                        "description": "Index built"
+                    }
+                }
+            },
+            "post": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "Search with an OpenSearch query DSL body.",
+                "operationId": "searchPost",
+                "responses": {
+                    "200": {
+                        "description": "OpenSearch response"
+                    }
+                }
+            },
+            "delete": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "Drop the OpenSearch index. Owner/superuser only.",
+                "operationId": "dropSearchIndex",
+                "responses": {
+                    "200": {
+                        "description": "Index dropped"
+                    }
+                }
+            }
+        },
+        "/api/v4/search/settings": {
+            "get": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "Get the per-database OpenSearch analysis block (the default when none is set).",
+                "operationId": "getSearchSettings",
+                "responses": {
+                    "200": {
+                        "description": "The analysis block"
+                    }
+                }
+            },
+            "put": {
+                "tags": [
+                    "Search"
+                ],
+                "description": "Set the per-database OpenSearch analysis block. Applies to indexes built after this call.",
+                "operationId": "putSearchSettings",
+                "responses": {
+                    "200": {
+                        "description": "Saved"
+                    }
+                }
+            }
+        },
         "/api/v4/schemas/{schema}/sequences/{sequence}": {
             "get": {
                 "tags": [
@@ -6010,6 +6691,10 @@
                                         },
                                         "type": "object"
                                     }
+                                },
+                                "elasticsearch": {
+                                    "description": "Per-column Elasticsearch/OpenSearch mapping config (elasticsearchtype/analyzer/search_analyzer per column). Consumed when the Search API (re)builds the index.",
+                                    "type": "object"
                                 }
                             },
                             "type": "object"
@@ -6244,6 +6929,34 @@
                 },
                 "type": "object"
             },
+            "OAuthGuest": {
+                "description": "Guest token request payload.",
+                "required": [
+                    "client_id",
+                    "database"
+                ],
+                "properties": {
+                    "database": {
+                        "title": "Database",
+                        "description": "Database name the guest token will be created for.",
+                        "type": "string",
+                        "example": "my_database"
+                    },
+                    "client_id": {
+                        "title": "Client id",
+                        "description": "OAuth client id.",
+                        "type": "string",
+                        "example": "MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3"
+                    },
+                    "client_secret": {
+                        "title": "Client secret",
+                        "description": "OAuth client secret.",
+                        "type": "string",
+                        "example": "xxx"
+                    }
+                },
+                "type": "object"
+            },
             "Outbox": {
                 "description": "",
                 "required": [],
@@ -7065,6 +7778,10 @@
             "name": "OAuth",
             "description": "OAuth"
         },
+        {
+            "name": "Ogc",
+            "description": "Ogc"
+        },
         {
             "name": "Ows",
             "description": "Ows"
@@ -7073,6 +7790,10 @@
             "name": "Privileges",
             "description": "Privileges"
         },
+        {
+            "name": "Search",
+            "description": "Search"
+        },
         {
             "name": "Sql",
             "description": "Sql"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@centia-io/mcp-server",
-  "version": "1.0.17",
+  "version": "1.0.19",
   "publishConfig": {
     "access": "public"
   },
@@ -24,7 +24,7 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@centia-io/sdk": "^0.2.11",
+    "@centia-io/sdk": "^0.2.13",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "axios": "^1.13.5",
     "zod": "^4.3.6"

package/skills/README.md

@@ -20,6 +20,8 @@ Use the smallest matching skill set for the task.
 | `centia-keyvalue` | Storing/reading JSON state (settings, flags, preferences) in the key/value store |
 | `centia-feature` | Reading/creating/updating/deleting single features as GeoJSON by primary key |
 | `centia-realtime` | Realtime WebSocket events, subscriptions with shapes, enabling table change events |
+| `centia-ows` | Serving/querying layers via WMS, WFS, WFS-T and the MapCache (WMTS/TMS/XYZ) proxy; Basic/Bearer/anonymous access, FILTERS, srs/time-slice |
+| `centia-ogc` | OGC API Features/Maps: collections, GeoJSON items with bbox/limit/offset/crs/datetime, map images by URL |
 | `centia-delivery` | Final delivery checklist, MCP coverage check, and handoff quality gate |
 | `danish-search` | Danish address/matrikel typeahead search component (`@centia-io/danish-search`) |
 

package/skills/centia-auth-model/SKILL.md

@@ -31,6 +31,25 @@ Forbidden:
 - manual OAuth implementation
 - provisioning API calls from browser runtime
 
+## Public (anonymous) access without sign-in
+
+When an app must call the API before any user has signed in, use the **guest token flow**: SDK class `GuestFlow` (`POST /api/v4/oauth/guest`; MCP tool `postGuest`).
+
+```ts
+import { GuestFlow } from '@centia-io/sdk'
+const flow = new GuestFlow({ host, clientId, database, clientSecret? })
+await flow.signIn()  // stores access/refresh tokens; Sql/Rpc/Gql now run as the default user
+flow.signOut()       // clears tokens
+```
+
+- Body: `database`, `client_id`, and `client_secret` only when the OAuth client is confidential (public clients omit it).
+- No `Authorization` header. Returns the normal OAuth response (`access_token`, `refresh_token`, `token_type: bearer`, `expires_in`), refreshable with the standard refresh flow.
+- The token is issued for the database's **default user** (`default_user=true`, see `centia-privileges`) and carries exactly that user's privileges — the same identity anonymous OGC/OWS requests get.
+- Prerequisites: a default user must exist on the database (otherwise 404 `NO_DEFAULT_USER_FOUND`) and an OAuth client must be registered (`postClient`); unknown client → 401 `invalid_grant`, wrong secret → 401 `invalid_client`.
+- Use it for read-only/public UIs and for token-only endpoints (Feature, SQL, GraphQL, RPC) that need a bearer even for public data. Never grant the default user write or admin privileges to make a guest app "work".
+- In browsers use a **public** client so no secret ships in the bundle; switch to `CodeFlow` once the user signs in.
+- Errors are thrown as plain `Error` with status and response body, like the other auth flows — not `CentiaApiError`. `GuestFlow` ships in `@centia-io/sdk` >= 0.2.14 (unreleased as of 2026-09-11; latest is 0.2.13).
+
 ## Server and CLI
 
 Allowed methods:
@@ -63,6 +82,7 @@ Forbidden:
 
 - Browser app: `CodeFlow`
 - Browser signup: `SignUp`
+- Browser/public access before sign-in: `GuestFlow`
 - Backend app: `PasswordFlow`
 - Provisioning: `PasswordFlow` or access token
 - CLI: `PasswordFlow`

package/skills/centia-delivery/SKILL.md

@@ -39,7 +39,7 @@ Query and API:
 
 Auth and access:
 
-- `postOauth`, `postDevice`
+- `postOauth`, `postDevice`, `postGuest`
 - `getUser`, `postUser`, `patchUser`, `deleteUsers`
 - `getRule`, `postRule`, `patchRule`, `deleteRule`
 - `getPrivileges`, `patchPrivileges`
@@ -49,6 +49,11 @@ Metadata:
 
 - `getMetaData`, `patchMetaData`
 
+OGC services:
+
+- `getOws`, `postOws`, `getWfs`, `postWfs`, `getMapcache`, `deleteMapcacheTileset`
+- `getOgcLandingPage`, `getOgcConformance`, `getOgcCollections`, `getOgcCollection`, `getOgcItems`, `getOgcItem`, `getOgcCollectionMap`, `getOgcDatasetMap`
+
 Import and misc:
 
 - `postFileUpload`, `postFileProcess`

package/skills/centia-ogc/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: centia-ogc
+description: Use when reading features or rendering maps through the OGC API (OGC API Features Part 1/2, OGC API Maps Part 1) in Centia BaaS — /api/v4/ogc/database/{database}/... routes, collections, items as GeoJSON with bbox/limit/offset/crs/datetime, map images, the getOgc* tools, CRS URIs and axis order, or the 401/403/404 semantics of collections.
+---
+
+# OGC API (Features + Maps)
+
+Use this skill for the v4 OGC API under `/api/v4/ogc/database/{database}`: a standards-based, read-only view of OWS-enabled layers. Features are served by the in-process WFS engine (geofence rules with service `wfst`, versioning, workflow all apply), maps by the WMS backend through the OWS proxy (rules with service `ows`, versioning). For single-feature CRUD use `centia-feature`; for classic WMS/WFS/WMTS use `centia-ows`.
+
+## Availability
+
+Lives on the GeoCloud2 branch `feature/v4-ogc-api` (2026-09-10/11). **Not** on production `api.centia.io` yet — assume dev-only. SDK: `@centia-io/sdk` >= 0.2.13 ships the `Ogc` class (explicit-client pattern, `new Ogc(client)`) with `getLandingPage`, `getConformance`, `getCollections`, `getCollection`, `getItems<P>`, `getItem<P>`, and the URL builders `mapUrl`/`datasetMapUrl` for images, plus `OGC_CRS84` and `ogcEpsgCrs(code)` for CRS URIs. Otherwise use the MCP tools or plain HTTP. `f=jpeg` maps need the WMS mapfiles regenerated once after upgrade (save any layer via `postLayer`, or the legacy `/controllers/mapfile` endpoint).
+
+## Routes and MCP tools
+
+All routes are `GET`, public (`Scope::PUBLIC`): Bearer token, HTTP Basic or anonymous. A Bearer token must match `{database}` (401 otherwise). Collection id is always `schema.table`.
+
+| Route (relative to `/api/v4/ogc/database/{database}`) | Tool | Returns |
+|---|---|---|
+| `/` | `getOgcLandingPage` | links: `conformance`, `data` (collections), `service-desc` (OpenAPI), `service-doc` |
+| `/conformance` | `getOgcConformance` | `conformsTo` — Features Core/GeoJSON/OAS30/CRS, Maps Core/bbox/crs/datetime/png/jpeg |
+| `/collections?limit&offset` | `getOgcCollections` | `collections[]`, `numberMatched`, `numberReturned`, `next`/`prev` links (limit default 100, max 1000) |
+| `/collections/{id}` | `getOgcCollection` | `id`, `title`, `description`, `extent.spatial.bbox` (CRS84), `extent.temporal` (versioned layers), `crs[]`, `storageCrs`, links `items` (vector only) and `map` |
+| `/collections/{id}/items?limit&offset&bbox&bbox-crs&crs&datetime` | `getOgcItems` / `Ogc.getItems(db, id, {limit, offset, bbox, bboxCrs, crs, datetime})` | streamed `application/geo+json` FeatureCollection + `Content-Crs` header |
+| `/collections/{id}/items/{fid}?crs&datetime` | `getOgcItem` / `Ogc.getItem` | bare GeoJSON `Feature` with `links` |
+| `/collections/{id}/map?bbox&bbox-crs&crs&width&height&f&transparent&bgcolor&datetime` | `getOgcCollectionMap` / `Ogc.mapUrl` | `image/png` (default) or `image/jpeg` |
+| `/map?collections=a,b&...` | `getOgcDatasetMap` / `Ogc.datasetMapUrl` | image with several collections **of the same schema** (400 otherwise) |
+
+Only layers with WFS/OWS enabled (`enableows`) are collections. Raster layers appear as collections without `itemType`/`items` (map only). The MCP tools return the response as text: fine for JSON, useless for map images — fetch maps over HTTP.
+
+## Items: parameters and defaults
+
+- `limit` default **10**, max 10000 (values above are clamped); `offset` default 0. The response always carries `numberMatched` (exact count, saturating at 1,000,000) and `numberReturned`; follow the `next` link to page.
+- `bbox` = `minx,miny,maxx,maxy` (6 values allowed, the vertical pair is dropped) in the axis order of `bbox-crs`; a lower corner above the upper corner is 400 (no antimeridian boxes).
+- `crs` / `bbox-crs` must be a URI from the collection's `crs` list: `http://www.opengis.net/def/crs/OGC/1.3/CRS84` (default, lon/lat), `http://www.opengis.net/def/crs/EPSG/0/4326` (**lat/lon** axis order, both in bbox input and GeoJSON output), `http://www.opengis.net/def/crs/EPSG/0/<n>` for projected CRSs (x/y). Anything else is 400 `INVALID_CRS`.
+- `datetime` = one ISO 8601 instant (`2024-01-01T00:00:00Z`); intervals are 400 `DATETIME_INTERVAL_UNSUPPORTED`. On a versioned layer it selects the version valid at that instant; on other layers it is ignored. Without it, versioned layers return the current version.
+- `f=json` only; any unknown query parameter is 400 `UNKNOWN_PARAMETER` (OGC API Common). The single-item route accepts only `crs`, `datetime`, `f`.
+- Properties keep the primary key as well as exposing it as the feature `id` (int when the key column is an integer type). Geometry is `null` for rows without geometry; `bytea` columns are omitted.
+
+## Maps: parameters
+
+`bbox` defaults to the collection extent; `width`/`height` 1..16384 — give one and the other follows the bbox aspect ratio, give none and width is 1024; `f` = `png` (default, transparent) or `jpeg` (opaque); `bgcolor` = `0xRRGGBB`; `datetime` as for items. Rendering goes through the same WMS backend as `centia-ows`, so styling comes from the layer classes (`centia-map-styling`).
+
+## Access model and status codes
+
+Same per-layer model as WMS/WFS (`centia-privileges`): anonymous callers read layers with `authentication` `None`/`Write`; `Read/write` layers need credentials and, for sub-users, a privilege ≠ `none` (group inheritance applies). Geofence rules (`getRule`/`postRule`) apply: service `wfst` for items, `ows` for maps; `deny` → 403 `FORBIDDEN`, `limit` filters the rows/pixels. Anonymous requests are geofenced as `*`, never as the database owner.
+
+| Situation | Status |
+|---|---|
+| Unknown collection or feature | 404 `COLLECTION_NOT_FOUND` / `FEATURE_NOT_FOUND` |
+| Existing `Read/write` collection, no credentials | 401 `UNAUTHORIZED` + `WWW-Authenticate: Basic` |
+| Existing `Read/write` collection, identity without privilege | 403 `INSUFFICIENT_PRIVILEGES` |
+| Geofence deny | 403 `FORBIDDEN` |
+| Bad/unknown parameter, bad CRS, interval datetime, items on a raster | 400 |
+| Map backend (MapServer) failure, e.g. missing mapfile | 502 `MAP_BACKEND_ERROR` (JSON, never an HTML page with 200) |
+
+`/collections` simply omits what the caller may not read. Errors use the v4 JSON shape `{"success":false,"message":…,"code":…,"errorCode":…}`.
+
+## Common mistakes
+
+| Mistake | Reality |
+|---|---|
+| Expecting every feature from `/items` | default `limit` is 10 — pass `limit` or follow `next` |
+| Passing `bbox` as lat/lon with the default CRS | CRS84 is lon/lat; only the EPSG:4326 URI is lat/lon |
+| Passing `crs=EPSG:25832` | CRS must be the URI `http://www.opengis.net/def/crs/EPSG/0/25832` |
+| Expecting 404 on a protected collection | it exists → 401 (anonymous) or 403 (no privilege); 404 means unknown |
+| Adding custom query parameters | 400 `UNKNOWN_PARAMETER` |
+| Reading a map image through the MCP tool | tools return text; use `Ogc.mapUrl()` and fetch the image over HTTP |
+| Mixing schemas in `/map?collections=` | one WMS mapfile per schema → 400 |
+| Using it for editing | read-only; write with `centia-feature` (WFS-T) or the SQL API |

package/skills/centia-ows/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: centia-ows
+description: Use when serving or querying layers through the classic OGC web services in Centia BaaS — WMS/UTFGRID/MVT via /api/v4/ows, WFS and WFS-T via /api/v4/wfs, the authorizing MapCache (WMTS/TMS/XYZ) proxy via /api/v4/mapcache, the getOws/postOws/getWfs/postWfs/getMapcache/deleteMapcacheTileset tools, the FILTERS/labels parameters, srs and time-slice path segments, or Basic/Bearer/anonymous access to protected layers.
+---
+
+# OWS: WMS, WFS, WFS-T and MapCache
+
+Use this skill for the v4 OGC web service endpoints. They are the map/feature backends that GIS clients (QGIS, MapLibre/Leaflet WMS layers, OpenLayers WFS) consume directly. For the RESTful OGC API (GeoJSON items, map images by URL) use `centia-ogc`; for single-feature CRUD use `centia-feature`.
+
+## Availability
+
+Production-ready on GeoCloud2 `master` (2026-08). SDK: `@centia-io/sdk` >= 0.2.12 ships `Ows`, `Wfs` and `Mapcache` (explicit-client pattern: `new Wfs(client)`); they return text/JSON, and `Mapcache.mapcacheUrl()` builds tile URL templates for map libraries. The MCP tools wrap the same routes and return text (XML/JSON), so they suit GetCapabilities/DescribeFeatureType/GetFeature checks, not images or tiles.
+
+## Endpoints, MCP tools and SDK
+
+| Service | Route | Tools / SDK | Notes |
+|---|---|---|---|
+| WMS 1.1.1/1.3.0, UTFGRID, MVT | `GET /api/v4/ows/schema/{schema}/database/{database}?SERVICE=WMS&REQUEST=GetMap&LAYERS=schema.table&...` | `getOws` / `Ows.getOws` | MapServer (or QGIS Server / external WMS source per layer). Layer names are `schema.table`. `FORMAT=json` → UTFGRID, `FORMAT=mvt` → vector tiles |
+| WFS proxy (MapServer) | `POST /api/v4/ows/...` with WFS XML | `postOws` / `Ows.postOws` | legacy path; prefer `/api/v4/wfs` |
+| WFS 1.0.0/1.1.0 | `GET /api/v4/wfs/schema/{schema}/database/{database}/srs/{srs}/ts/{timeSlice}?SERVICE=WFS&REQUEST=GetFeature&TYPENAME=table&...` | `getWfs` / `Wfs.getWfs(schema, db, params, {srs, timeSlice})` | in-process engine; `srs` = output SRID, `timeSlice` = ISO date for versioned layers — both optional path segments (omit the whole `/srs/...` tail) |
+| WFS-T | `POST /api/v4/wfs/...` with `<wfs:Transaction>` (Insert/Update/Delete) | `postWfs` / `Wfs.postWfs` | versioning, workflow, geofence rules, tile-cache busting, pre/post processors |
+| MapCache (WMTS, TMS, XYZ, Google) | `GET /api/v4/mapcache/database/{database}/{path}` e.g. `wmts/1.0.0/WMTSCapabilities.xml`, `tms/1.0.0/schema.table@g/10/512/340.png` | `getMapcache` / `Mapcache.getMapcache`, `Mapcache.mapcacheUrl` | authorizing proxy in front of MapCache; a tile whose tileset cannot be resolved fails closed (403) |
+| Tile cache wipe | `DELETE /api/v4/mapcache/database/{database}/tileset/{tileset}?bbox&zoom` | `deleteMapcacheTileset` / `Mapcache.deleteMapcacheTileset` | full wipe is synchronous (200), scoped delete is a background job (202) |
+
+WMS GetMap parameters follow the standard (`BBOX`, `WIDTH`, `HEIGHT`, `CRS`/`SRS`, `FORMAT=image/png`, `STYLES=`, `TRANSPARENT`). Extra vendor parameters on `/ows`: `FILTERS` = base64url JSON `{ "schema.table": ["sql where", ...] }` applied as extra WHERE clauses; `LABELS=false` disables labels. Rules and `FILTERS` do not work together with several QGIS-backed layers in one request.
+
+WFS `GetFeature` supports `TYPENAME`, `PROPERTYNAME`, `FEATUREID` (`table.key`), `BBOX`, `FILTER` (OGC Filter Encoding XML), `MAXFEATURES`, `SRSNAME`, `OUTPUTFORMAT` (`GML2`/`GML3`), `RESULTTYPE=hits`. There is no start index/offset — page with the OGC API instead.
+
+## Access model
+
+Every route is public (`Scope::PUBLIC`) and decides auth per request, per layer:
+
+- **Bearer token**: validated, must be issued for `{database}` (401 otherwise, never a silent anonymous downgrade); sub-user privileges via `Authorization::check` with full group inheritance.
+- **HTTP Basic**: user = database owner or a sub-user; the password is the login password, with fallback to the per-database "viewer" password. Credentials are verified even on layer-less requests (GetCapabilities), so a fabricated header is rejected.
+- **Anonymous**: allowed for layers with `authentication` `None`/`Write`; `Read/write` layers answer `401` with a Basic challenge. WFS-T on a `Write` layer also needs credentials with `write` privilege.
+- Allow decisions for token/Basic identities are cached 60 s (tiles); anonymous decisions never are.
+
+Layer visibility in GetCapabilities follows the same rule (anonymous clients see `None`/`Write` layers). Geofence rules (`centia-privileges`, `getRule`/`postRule`): service `ows` for WMS/UTFGRID/MVT, `wfst` for WFS/WFS-T; `deny` renders an OWS `ServiceException` (HTTP 200 once streaming started), `limit` injects the rule filter. Anonymous traffic is geofenced as `*`, not as the database owner.
+
+## Versioning and workflow
+
+Versioned layers (`gc2_version_*` columns): WFS/WMS show the current version by default; `/srs/{srs}/ts/{timeSlice}` on WFS returns the version valid at that time. WFS-T updates close the old version and insert a new one. Workflow layers (`gc2_status`/`gc2_workflow`): a sub-user without a role only reads published rows (`gc2_status = 3`) and cannot transact.
+
+## Common mistakes
+
+| Mistake | Reality |
+|---|---|
+| Using unqualified layer names in WMS | `LAYERS=schema.table`; WFS `TYPENAME` may be unqualified because the schema is in the path |
+| Sending a token for another database | 401 — the token must carry `database == {database}` |
+| Expecting anonymous access to a `Read/write` layer | 401 + `WWW-Authenticate: Basic`; use Basic (viewer/login password) or a token |
+| Reading tiles straight from `/mapcache/` | bypasses authorization; use `/api/v4/mapcache/database/{db}/...` |
+| Paging WFS with `STARTINDEX` | unsupported; use OGC API `/items?limit&offset` |
+| Fetching images through MCP tools or `Ows.getOws` | tools and wrappers return text; images/tiles must be fetched over HTTP (`Mapcache.mapcacheUrl()` for tile templates) |
+| Expecting HTTP 4xx from a WMS/WFS error mid-stream | OGC `ServiceException`/`ExceptionReport` XML with HTTP 200 once headers are sent |

package/skills/centia-runtime-sdk/SKILL.md

@@ -32,7 +32,7 @@ Prefer exports:
 - `Gql`
 - `createApi`
 - `createSqlBuilder`
-- `CodeFlow`, `PasswordFlow`, `SignUp` (by runtime context)
+- `CodeFlow`, `PasswordFlow`, `GuestFlow`, `SignUp` (by runtime context, see `centia-auth-model`)
 
 ## GraphQL notes