@honua/mcp-server 0.0.20-alpha.0 → 0.1.0-beta.0

package/dist/src/certification/fixtures.js

@@ -26,6 +26,19 @@ export function resolveRoundTripEnv(env = process.env) {
 export function buildRoundTripInputs(env) {
     const { serviceId, layerId, address } = env;
     return {
+        // ── Platform-free standalone surface tools (issue #369). Round-tripped by the
+        // `standalone` cert target against a plain public FeatureServer fixture. The
+        // Honua-only style tools resolve to a structured "not available on this
+        // target" result (non-error) — certifying graceful degradation, not a crash.
+        honua_list_services: {},
+        honua_describe_layer: { serviceId, layerId },
+        honua_count_features: { serviceId, layerId },
+        honua_get_extent: { serviceId, layerId },
+        honua_statistics: { serviceId, layerId, statisticType: "count", onField: "OBJECTID" },
+        honua_explain_capability_gap: { capability: "query", protocol: "wmts" },
+        honua_get_style: {},
+        honua_apply_style_preset: { styleId: "topographic" },
+        // ── Honua-enhanced operator catalog tools (offline/remote/stdio-proxy targets).
         honua_list_layers: {},
         honua_list_capabilities: {},
         honua_query_features: { serviceId, layerId, limit: 1 },
@@ -49,6 +62,21 @@ export function buildRoundTripInputs(env) {
         honua_resolve_entity: { text: "parks" },
     };
 }
+/**
+ * Resolve the editable/pageable target for the deep contracts. Defaults to the
+ * offline mock's seeded `svc-parks` layer 0; override with
+ * `HONUA_MCP_EDIT_SERVICE_ID` / `HONUA_MCP_EDIT_LAYER_ID` (or the shared
+ * `HONUA_MCP_SERVICE_ID` / `HONUA_MCP_LAYER_ID`) to point a live mutating cert at
+ * a dedicated scratch service.
+ */
+export function resolveEditTarget(env = process.env) {
+    const base = resolveRoundTripEnv(env);
+    const serviceId = env.HONUA_MCP_EDIT_SERVICE_ID ?? base.serviceId;
+    const layerRaw = env.HONUA_MCP_EDIT_LAYER_ID;
+    const parsedLayer = layerRaw !== undefined ? Number.parseInt(layerRaw, 10) : Number.NaN;
+    const layerId = Number.isFinite(parsedLayer) && parsedLayer >= 0 ? parsedLayer : base.layerId;
+    return { serviceId, layerId };
+}
 /**
  * A deliberately invalid argument set for the error-shape contract. Certification
  * picks the first advertised tool that has an entry here and calls it with these

package/dist/src/certification/json-schema.d.ts

@@ -27,6 +27,28 @@ export interface ConformanceResult {
     /** Non-fatal observations (e.g. advertised extra properties, type widenings). */
     notes: string[];
 }
+export interface ConformanceOptions {
+    /**
+     * Required standard properties this surface is permitted to omit because it is
+     * a documented, platform-gated degradation of the tool (see the SDK-local
+     * `PLATFORM_FREE_DEGRADATIONS` registry in `schema-index.ts`).
+     *
+     * A property listed here is a platform *binding* — an identifier that only has
+     * meaning against a Honua publishing/authoring surface (e.g. `apply_style_preset`
+     * requires `serviceId`+`layerId` to bind a preset onto a *published* layer via
+     * the server OGC API – Styles authoring surface, ADR-0048). A platform-free
+     * target has no such surface, so it degrades the tool to a non-error, client-side
+     * projection keyed on the taxonomy essence alone (e.g. `styleId`) and legitimately
+     * omits the binding identifiers.
+     *
+     * When a required standard property is absent AND listed here, it is recorded as
+     * a degradation note rather than a conformance violation. Everything else stays
+     * strict: unlisted required properties still fail, and type incompatibilities on
+     * properties the surface DOES advertise remain violations — degradation relaxes
+     * platform binding, never correctness on what is accepted.
+     */
+    shedRequired?: readonly string[];
+}
 /**
  * Deterministically compare an advertised tool inputSchema against a standard
  * geospatial-mcp tool schema.
@@ -45,5 +67,5 @@ export interface ConformanceResult {
  * notes, not violations: a richer reference shape is allowed to extend the
  * bare standard.
  */
-export declare function checkConformance(advertised: JsonSchema, standard: JsonSchema): ConformanceResult;
+export declare function checkConformance(advertised: JsonSchema, standard: JsonSchema, options?: ConformanceOptions): ConformanceResult;
 //# sourceMappingURL=json-schema.d.ts.map

package/dist/src/certification/json-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-schema.d.ts","sourceRoot":"","sources":["../../../src/certification/json-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA2C,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAwBpD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAcjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AASD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAGrE;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAQ1F;AAmCD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iFAAiF;IACjF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,iBAAiB,CAwDhG"}
+{"version":3,"file":"json-schema.d.ts","sourceRoot":"","sources":["../../../src/certification/json-schema.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA2C,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAwBpD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAcjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AASD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAGrE;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAQ1F;AAmCD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iFAAiF;IACjF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,UAAU,EACpB,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,CAkEnB"}

package/dist/src/certification/json-schema.js

@@ -112,10 +112,13 @@ function schemaTypes(schema) {
  * notes, not violations: a richer reference shape is allowed to extend the
  * bare standard.
  */
-export function checkConformance(advertised, standard) {
+export function checkConformance(advertised, standard, options = {}) {
     const violations = [];
     const notes = [];
     const matchedRequired = [];
+    // Required standard properties this surface may legitimately shed as a
+    // documented platform-gated degradation. See {@link ConformanceOptions.shedRequired}.
+    const shedRequired = new Set(options.shedRequired ?? []);
     const standardRequired = requiredPropertyNames(standard);
     const standardProps = (standard.properties ?? {});
     const advertisedProps = (advertised.properties ?? {});
@@ -123,7 +126,12 @@ export function checkConformance(advertised, standard) {
     for (const name of standardRequired) {
         const present = advertisedNames ? advertisedNames.has(name) : name in advertisedProps;
         if (!present) {
-            violations.push(`missing required standard property "${name}"`);
+            if (shedRequired.has(name)) {
+                notes.push(`degrades platform binding: omits required "${name}" (platform-free target has no publishing surface)`);
+            }
+            else {
+                violations.push(`missing required standard property "${name}"`);
+            }
             continue;
         }
         const standardTypes = schemaTypes(standardProps[name]);

package/dist/src/certification/lifecycle.d.ts

@@ -0,0 +1,14 @@
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { ContractCheck } from "./certifier.js";
+export interface DeepContractOptions {
+    client: Client;
+    advertisedToolNames: Set<string>;
+    /** Whether the backend is the disposable offline mock (auto-allows mutation). */
+    isDisposableBackend: boolean;
+    /** Open a fresh unauthenticated client (for the permission-denied case). */
+    connectUnauthenticated?: (() => Promise<Client>) | undefined;
+    env?: NodeJS.ProcessEnv;
+}
+/** Run all deep contracts, returning one ContractCheck per contract (never throws). */
+export declare function runDeepContracts(options: DeepContractOptions): Promise<ContractCheck[]>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/src/certification/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/certification/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAoCpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,iFAAiF;IACjF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAcD,uFAAuF;AACvF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAW7F"}

package/dist/src/certification/lifecycle.js

@@ -0,0 +1,326 @@
+import { randomUUID } from "node:crypto";
+import { checkAuthContract, checkFeatureRoundTrip, checkJobLifecycle, checkPaginationContract, } from "./contracts.js";
+import { resolveEditTarget } from "./fixtures.js";
+/**
+ * Deep, stateful certification contracts (A5 provability): the mutating-tool
+ * round-trip, the async job lifecycle, and query pagination. These extend the
+ * read-side contracts in {@link certifier} into the parts of a real deployment
+ * that were "never certified" — writes and asynchronous execution.
+ *
+ * Safety: mutating contracts only auto-run against the offline mock (a disposable
+ * fixture). Against a live/remote target they are gated behind
+ * `HONUA_MCP_CERT_ALLOW_MUTATION=1` + a caller-supplied scratch service, so a
+ * scheduled cert against a shared demo never mutates real data. When a target
+ * lacks the tool, the contract SKIPS with a loud reason rather than failing — so
+ * the suite stays runnable against any revision. Note: the reference honua-server
+ * `/mcp` surface does NOT advertise `EDIT_TOOL` — Honua does not support AI
+ * operational data editing (honua-server ADR-0028) — so against it these mutating
+ * contracts skip. `EDIT_TOOL` here represents the standard's OPTIONAL `mutation`
+ * profile, exercised via a mutation-profile-adopter fixture.
+ */
+const MUTATION_ALLOW_ENV = "HONUA_MCP_CERT_ALLOW_MUTATION";
+const EDIT_TOOL = "honua_edit_features";
+const QUERY_TOOL = "honua_query_features";
+const EXECUTE_TOOL = "honua_execute_plan";
+const MAX_JOB_POLLS = 12;
+const PAGE_LIMIT = 2;
+const MAX_FEATURE_PAGES = 20;
+function isTruthy(value) {
+    if (typeof value !== "string") {
+        return false;
+    }
+    const v = value.trim().toLowerCase();
+    return v.length > 0 && v !== "0" && v !== "false" && v !== "no" && v !== "off";
+}
+function skip(contract, target, detail) {
+    return { contract, target, status: "skipped", detail };
+}
+/** Run all deep contracts, returning one ContractCheck per contract (never throws). */
+export async function runDeepContracts(options) {
+    const env = options.env ?? process.env;
+    const target = resolveEditTarget(env);
+    const mutationAllowed = options.isDisposableBackend || isTruthy(env[MUTATION_ALLOW_ENV]);
+    return [
+        await runMutatingRoundTrip(options, target, mutationAllowed),
+        await runMutatingPermissionDenied(options),
+        await runJobLifecycle(options, mutationAllowed),
+        await runQueryPagination(options, target),
+    ];
+}
+async function callTool(client, name, args) {
+    const result = (await client.callTool({ name, arguments: args }));
+    return result;
+}
+async function readJsonResource(client, uri) {
+    const res = (await client.readResource({ uri }));
+    const text = res.contents?.[0]?.text;
+    return typeof text === "string" ? JSON.parse(text) : {};
+}
+function featureAttributes(result) {
+    const features = (result.structuredContent?.features ?? []);
+    return features.map((f) => f.attributes ?? {});
+}
+// ── Contract 1: mutating-tool insert→verify→update→verify→delete→verify ──────
+async function runMutatingRoundTrip(options, target, mutationAllowed) {
+    const contract = "mutating-round-trip";
+    if (!options.advertisedToolNames.has(EDIT_TOOL) || !options.advertisedToolNames.has(QUERY_TOOL)) {
+        return skip(contract, EDIT_TOOL, `${EDIT_TOOL}/${QUERY_TOOL} not advertised by this surface (pre-P1 or read-only)`);
+    }
+    if (!mutationAllowed) {
+        return skip(contract, EDIT_TOOL, `mutating contract disabled for this target — set ${MUTATION_ALLOW_ENV}=1 with a scratch service to certify writes`);
+    }
+    const { client } = options;
+    const marker = `cert-${randomUUID().slice(0, 8)}`;
+    const updatedMarker = `${marker}-updated`;
+    let objectId;
+    try {
+        const inserted = await callTool(client, EDIT_TOOL, {
+            serviceId: target.serviceId,
+            layerId: target.layerId,
+            adds: [{ attributes: { NAME: marker } }],
+        });
+        const addResults = (inserted.structuredContent?.addResults ?? []);
+        objectId = typeof addResults[0]?.objectId === "number" ? addResults[0].objectId : undefined;
+        const presentAfterInsert = objectId !== undefined &&
+            featureAttributes(await callTool(client, QUERY_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                objectIds: [objectId],
+            })).some((a) => Number(a.OBJECTID) === objectId);
+        if (objectId !== undefined) {
+            await callTool(client, EDIT_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                updates: [{ objectId, attributes: { NAME: updatedMarker } }],
+            });
+        }
+        const attributeAfterUpdate = objectId === undefined
+            ? undefined
+            : featureAttributes(await callTool(client, QUERY_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                objectIds: [objectId],
+            }))[0]?.NAME;
+        if (objectId !== undefined) {
+            await callTool(client, EDIT_TOOL, { serviceId: target.serviceId, layerId: target.layerId, deletes: [objectId] });
+        }
+        const absentAfterDelete = objectId !== undefined &&
+            featureAttributes(await callTool(client, QUERY_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                objectIds: [objectId],
+            })).every((a) => Number(a.OBJECTID) !== objectId);
+        const outcome = checkFeatureRoundTrip({
+            insertedObjectId: objectId,
+            presentAfterInsert,
+            attributeAfterUpdate,
+            expectedAttribute: updatedMarker,
+            absentAfterDelete,
+        });
+        return {
+            contract,
+            target: EDIT_TOOL,
+            status: outcome.ok ? "passed" : "failed",
+            detail: outcome.ok
+                ? `insert→verify→update→verify→delete→verify round-trip succeeded (objectId ${objectId})`
+                : outcome.errors.join("; "),
+        };
+    }
+    catch (err) {
+        return {
+            contract,
+            target: EDIT_TOOL,
+            status: "failed",
+            detail: `mutating round-trip raised: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    finally {
+        // Guaranteed cleanup: remove the scratch feature even if an assertion threw.
+        if (objectId !== undefined) {
+            await callTool(client, EDIT_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                deletes: [objectId],
+            }).catch(() => { });
+        }
+    }
+}
+// ── Contract 1b: mutating call without credentials → structured auth error ───
+async function runMutatingPermissionDenied(options) {
+    const contract = "mutating-permission-denied";
+    if (!options.advertisedToolNames.has(EDIT_TOOL)) {
+        return skip(contract, EDIT_TOOL, `${EDIT_TOOL} not advertised by this surface (pre-P1)`);
+    }
+    if (!options.connectUnauthenticated) {
+        return skip(contract, EDIT_TOOL, "target does not support an unauthenticated pass");
+    }
+    const target = resolveEditTarget(options.env ?? process.env);
+    let unauth;
+    try {
+        unauth = await options.connectUnauthenticated();
+        // An unauthenticated write MUST be refused with a structured auth signal. If
+        // the boundary holds, nothing is mutated.
+        let result;
+        try {
+            result = await callTool(unauth, EDIT_TOOL, {
+                serviceId: target.serviceId,
+                layerId: target.layerId,
+                adds: [{ attributes: { NAME: "cert-should-be-denied" } }],
+            });
+        }
+        catch (err) {
+            const outcome = checkAuthContract(err);
+            return {
+                contract,
+                target: EDIT_TOOL,
+                status: outcome.ok ? "passed" : "failed",
+                detail: outcome.ok ? "unauthenticated write refused with a structured auth error" : outcome.errors.join("; "),
+            };
+        }
+        if (result.isError !== true) {
+            return {
+                contract,
+                target: EDIT_TOOL,
+                status: "failed",
+                detail: "unauthenticated write returned a non-error result — the write auth boundary is not enforced",
+            };
+        }
+        const outcome = checkAuthContract(result);
+        return {
+            contract,
+            target: EDIT_TOOL,
+            status: outcome.ok ? "passed" : "failed",
+            detail: outcome.ok ? "unauthenticated write refused with a structured auth error" : outcome.errors.join("; "),
+        };
+    }
+    catch (err) {
+        return {
+            contract,
+            target: EDIT_TOOL,
+            status: "failed",
+            detail: `permission-denied pass could not be established: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    finally {
+        if (unauth) {
+            await unauth.close().catch(() => { });
+        }
+    }
+}
+// ── Contract 2: async job lifecycle execute → poll → result ──────────────────
+async function runJobLifecycle(options, mutationAllowed) {
+    const contract = "async-job-lifecycle";
+    if (!options.advertisedToolNames.has(EXECUTE_TOOL)) {
+        return skip(contract, EXECUTE_TOOL, `${EXECUTE_TOOL} not advertised by this surface (pre-P1)`);
+    }
+    if (!mutationAllowed) {
+        return skip(contract, EXECUTE_TOOL, `job lifecycle disabled for this target — set ${MUTATION_ALLOW_ENV}=1 to certify execution against a scratch target`);
+    }
+    const { client } = options;
+    try {
+        const submitted = await callTool(client, EXECUTE_TOOL, {
+            plan: { planId: "cert-plan", steps: [{ stepId: "s1", kind: "QueryFeatures" }] },
+        });
+        const jobId = submitted.structuredContent?.jobId;
+        const initialStatus = String(submitted.structuredContent?.status ?? "Unknown");
+        if (typeof jobId !== "string") {
+            return { contract, target: EXECUTE_TOOL, status: "failed", detail: "execute did not return a jobId" };
+        }
+        const jobUri = `honua://jobs/${jobId}`;
+        const polledStatuses = [];
+        const progressFractions = [];
+        let finalStatus = initialStatus;
+        let resultUri;
+        for (let i = 0; i < MAX_JOB_POLLS; i++) {
+            const state = await readJsonResource(client, jobUri);
+            const status = String(state.status ?? "Unknown");
+            polledStatuses.push(status);
+            const fraction = state.progress?.fraction;
+            if (typeof fraction === "number") {
+                progressFractions.push(fraction);
+            }
+            finalStatus = status;
+            if (typeof state.resultUri === "string") {
+                resultUri = state.resultUri;
+            }
+            if (["Succeeded", "Failed", "Cancelled"].includes(status)) {
+                break;
+            }
+        }
+        let resultReady = false;
+        if (resultUri) {
+            const pkg = await readJsonResource(client, resultUri);
+            resultReady = String(pkg.status ?? "") === "Ready";
+        }
+        const outcome = checkJobLifecycle({
+            initialStatus,
+            polledStatuses,
+            progressFractions,
+            finalStatus,
+            resultReady,
+        });
+        return {
+            contract,
+            target: EXECUTE_TOOL,
+            status: outcome.ok ? "passed" : "failed",
+            detail: outcome.ok
+                ? `execute→poll→result honored the state machine (${[initialStatus, ...polledStatuses].join("→")}; result ready)`
+                : outcome.errors.join("; "),
+        };
+    }
+    catch (err) {
+        return {
+            contract,
+            target: EXECUTE_TOOL,
+            status: "failed",
+            detail: `job lifecycle raised: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+// ── Contract 3: query_features pagination (read-only, safe against any target) ─
+async function runQueryPagination(options, target) {
+    const contract = "query-pagination";
+    if (!options.advertisedToolNames.has(QUERY_TOOL)) {
+        return skip(contract, QUERY_TOOL, `${QUERY_TOOL} not advertised by this surface`);
+    }
+    const { client } = options;
+    try {
+        const pages = [];
+        let cursor;
+        for (let i = 0; i < MAX_FEATURE_PAGES; i++) {
+            const args = { serviceId: target.serviceId, layerId: target.layerId, limit: PAGE_LIMIT };
+            if (cursor) {
+                args.cursor = cursor;
+            }
+            const result = await callTool(client, QUERY_TOOL, args);
+            const keys = featureAttributes(result).map((a) => String(a.OBJECTID));
+            const nextCursor = result.structuredContent?.nextCursor;
+            pages.push({ keys, nextCursor: typeof nextCursor === "string" ? nextCursor : undefined });
+            if (typeof nextCursor !== "string") {
+                break;
+            }
+            cursor = nextCursor;
+        }
+        const paginated = pages.length > 1 || pages[0]?.nextCursor !== undefined;
+        if (!paginated) {
+            return skip(contract, QUERY_TOOL, `surface returned a single page with no nextCursor (pagination not exercised — pre-P1 surface or fewer than ${PAGE_LIMIT} features)`);
+        }
+        const outcome = checkPaginationContract(pages);
+        return {
+            contract,
+            target: QUERY_TOOL,
+            status: outcome.ok ? "passed" : "failed",
+            detail: outcome.ok
+                ? `query_features paginated across ${pages.length} pages; nextCursor honored and terminated`
+                : outcome.errors.join("; "),
+        };
+    }
+    catch (err) {
+        return {
+            contract,
+            target: QUERY_TOOL,
+            status: "failed",
+            detail: `query pagination raised: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}

package/dist/src/certification/operator-catalog.d.ts

@@ -15,6 +15,14 @@ import { type JsonSchema } from "./schema-index.js";
  * conformance check exercises the real standard shape rather than a hand-rolled
  * approximation.
  *
+ * NOTE ON `honua_edit_features`: the real honua-server `/mcp` surface exposes NO
+ * feature-mutation tool — Honua does not support AI operational data editing
+ * (honua-server ADR-0028). This fixture nonetheless advertises `honua_edit_features`
+ * so the certifier keeps exercising the standard's OPTIONAL `mutation`-profile
+ * certification path (insert→update→delete round-trip, auth-boundary contract)
+ * for *other* adopters that choose to offer governed editing. It is a
+ * mutation-profile-adopter fixture, NOT a mirror of honua-server's product surface.
+ *
  * Nothing here is a product server. It is a labeled test fixture whose only job
  * is to give the certifier a faithful `/mcp`-shaped surface to certify offline.
  */

package/dist/src/certification/operator-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-catalog.d.ts","sourceRoot":"","sources":["../../../src/certification/operator-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,EAAE,KAAK,UAAU,EAA6D,MAAM,mBAAmB,CAAC;AAE/G;;;;;;;;;;;;;;;;;GAiBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtG,+FAA+F;IAC/F,KAAK,EAAE;QACL,IAAI,EACA,kBAAkB,GAClB,qBAAqB,GACrB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,SAAS,GACT,WAAW,GACX,qBAAqB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACtE,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA0BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,EAAE,CAwSnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,EAAE,CA2B3D;AAED,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAoCpC,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CA+ExF"}
+{"version":3,"file":"operator-catalog.d.ts","sourceRoot":"","sources":["../../../src/certification/operator-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAUnE,OAAO,EAAE,KAAK,UAAU,EAA6D,MAAM,mBAAmB,CAAC;AAE/G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtG,+FAA+F;IAC/F,KAAK,EAAE;QACL,IAAI,EACA,kBAAkB,GAClB,qBAAqB,GACrB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,GACjB,SAAS,GACT,WAAW,GACX,qBAAqB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACtE,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AA0BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,EAAE,CA6UnD;AAOD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,EAAE,CA2B3D;AAED,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAoCpC,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAuHD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAsGxF"}