@honua/mcp-server 0.1.2-beta.0 → 0.1.8-beta.0

package/dist/src/tools/query-features.js

@@ -1,51 +1,44 @@
 import { z } from "zod";
-import { GEOMETRY_TYPES, clampLimit, jsonText, mapSpatialRel, resolveGeometryType } from "../helpers.js";
+import { jsonText } from "../helpers.js";
+import { withCapabilityHonesty } from "../neutral/errors.js";
+import { queryFilterFields, queryShapeFields, toQuery } from "../neutral/query.js";
+import { projectDegraded, projectFeatures } from "../neutral/result.js";
+import { resolveSource, sourceRefFields } from "../neutral/source-ref.js";
+/**
+ * `honua_query_features` — protocol-neutral feature read (#1005).
+ *
+ * Addresses a source by its neutral `<protocol>:<address>` reference, filters
+ * with the typed semantic filter / GeoJSON geometry / canonical temporal
+ * predicate, and executes through the SDK's canonical `Source.query()`, so the
+ * same call means the same thing against GeoServices, OGC API Features, STAC,
+ * WFS, and OData. The deprecated `serviceId` + `layerId` pair is still accepted.
+ */
 export const schema = z.object({
-    serviceId: z.string().describe("The feature service ID"),
-    layerId: z.number().int().nonnegative().describe("The layer ID within the service"),
-    where: z.string().optional().describe('SQL WHERE clause, e.g. "population > 50000"'),
-    outFields: z.array(z.string()).optional().describe("Fields to return; defaults to all"),
-    geometry: z.record(z.unknown()).optional().describe("Esri JSON geometry for spatial filter"),
-    geometryType: z
-        .enum(GEOMETRY_TYPES)
-        .optional()
-        .describe("Esri geometry type. If omitted, inferred from geometry when possible."),
-    spatialRel: z
-        .enum(["intersects", "contains", "within"])
-        .optional()
-        .describe("Spatial relationship (default: intersects)"),
-    orderBy: z.string().optional().describe('Sort order, e.g. "name ASC"'),
-    limit: z.number().int().positive().optional().describe("Max features to return (default 100, max 2000)"),
-    offset: z.number().int().nonnegative().optional().describe("Number of features to skip (for pagination)"),
-    returnGeometry: z.boolean().optional().default(false).describe("Include geometry in results (default: false)"),
+    ...sourceRefFields,
+    ...queryFilterFields,
+    ...queryShapeFields,
 });
 export async function execute(client, input) {
-    const response = await client.queryFeatures({
-        serviceId: input.serviceId,
-        layerId: input.layerId,
-        where: input.where,
-        // An empty array is a natural "no specific fields" from an agent, but Esri
-        // FeatureServer treats an empty outFields as "OBJECTID only". Coerce both
-        // missing and empty to "*" so all fields are returned.
-        outFields: input.outFields && input.outFields.length > 0 ? input.outFields : "*",
-        geometry: input.geometry,
-        geometryType: resolveGeometryType(input.geometry, input.geometryType),
-        spatialRel: mapSpatialRel(input.spatialRel),
-        orderByFields: input.orderBy,
-        resultRecordCount: clampLimit(input.limit),
-        resultOffset: input.offset,
-        returnGeometry: input.returnGeometry,
-    });
-    const features = response.features ?? [];
-    return jsonText({
-        returnedCount: features.length,
-        features: features.map((f) => ({
-            attributes: f.attributes,
-            ...(input.returnGeometry && f.geometry ? { geometry: f.geometry } : {}),
-        })),
-        exceededTransferLimit: response.exceededTransferLimit ?? false,
-        objectIdFieldName: response.objectIdFieldName ?? null,
-        geometryType: response.geometryType ?? null,
-        spatialReference: response.spatialReference ?? null,
+    return withCapabilityHonesty(async () => {
+        const resolved = resolveSource(client, input);
+        const query = toQuery(input, { protocol: resolved.descriptor.protocol });
+        const result = await resolved.source.query(query);
+        // Legacy addressing keeps legacy output: a client that still sends
+        // serviceId/layerId also still expects Esri-JSON geometry. Neutral
+        // addressing gets the neutral encoding.
+        const geometryFormat = input.geometryFormat ?? (resolved.legacyAddressing ? "esri-json" : "geojson");
+        const returnGeometry = input.returnGeometry ?? false;
+        const degraded = projectDegraded(result.degraded);
+        return jsonText({
+            source: resolved.ref.ref,
+            protocol: resolved.descriptor.protocol,
+            returnedCount: result.features.length,
+            features: projectFeatures(result, { returnGeometry, geometryFormat }),
+            geometryFormat: returnGeometry ? geometryFormat : null,
+            exceededTransferLimit: result.exceededTransferLimit,
+            totalCount: result.totalCount ?? null,
+            fields: result.fields ?? null,
+            ...(degraded ? { degraded } : {}),
+        });
     });
 }

package/dist/src/tools/statistics.d.ts

@@ -1,26 +1,87 @@
 import type { HonuaClient } from "@honua/sdk-js";
 import { z } from "zod";
+/**
+ * `honua_statistics` — protocol-neutral aggregation (#1005).
+ *
+ * Lowers onto the canonical `AggregationSpec`, which GeoServices serves with
+ * `outStatistics` and which OGC API Features (no server-side aggregation)
+ * serves client-side over the returned page with an explicit `degraded` reason.
+ * The reason is reported in the result rather than dropped, so a page-scoped
+ * aggregate is never mistaken for an authoritative one.
+ */
 export declare const schema: z.ZodObject<{
-    serviceId: z.ZodString;
-    layerId: z.ZodNumber;
-    statisticType: z.ZodEnum<["count", "sum", "avg", "min", "max", "stddev"]>;
+    statisticType: z.ZodEnum<["count", "sum", "avg", "min", "max", "stddev", "var"]>;
     onField: z.ZodString;
-    groupBy: z.ZodOptional<z.ZodString>;
+    groupBy: z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodString]>>;
+    filter: z.ZodOptional<z.ZodType<import("../neutral/filter.js").FilterNode, z.ZodTypeDef, import("../neutral/filter.js").FilterNode>>;
     where: z.ZodOptional<z.ZodString>;
+    bbox: z.ZodOptional<z.ZodArray<z.ZodNumber, "many">>;
+    bboxSrid: z.ZodOptional<z.ZodNumber>;
+    geometry: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    geometryType: z.ZodOptional<z.ZodEnum<["esriGeometryPoint", "esriGeometryPolyline", "esriGeometryPolygon", "esriGeometryEnvelope", "esriGeometryMultipoint"]>>;
+    spatialRel: z.ZodOptional<z.ZodEnum<["intersects", "contains", "within", "crosses", "touches", "overlaps", "bbox-intersects"]>>;
+    temporal: z.ZodOptional<z.ZodObject<{
+        instant: z.ZodOptional<z.ZodString>;
+        start: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        end: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        field: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        field?: string | undefined;
+        instant?: string | undefined;
+        start?: string | null | undefined;
+        end?: string | null | undefined;
+    }, {
+        field?: string | undefined;
+        instant?: string | undefined;
+        start?: string | null | undefined;
+        end?: string | null | undefined;
+    }>>;
+    source: z.ZodOptional<z.ZodString>;
+    layout: z.ZodOptional<z.ZodEnum<["honua-facade", "ogc-api", "auto", "stac-api", "stac-static"]>>;
+    serviceId: z.ZodOptional<z.ZodString>;
+    layerId: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    serviceId: string;
-    layerId: number;
-    statisticType: "count" | "sum" | "avg" | "min" | "max" | "stddev";
+    statisticType: "count" | "sum" | "avg" | "min" | "max" | "stddev" | "var";
     onField: string;
+    filter?: import("../neutral/filter.js").FilterNode | undefined;
+    serviceId?: string | undefined;
+    geometry?: Record<string, unknown> | undefined;
+    bbox?: number[] | undefined;
+    geometryType?: "esriGeometryPoint" | "esriGeometryPolyline" | "esriGeometryPolygon" | "esriGeometryEnvelope" | "esriGeometryMultipoint" | undefined;
+    temporal?: {
+        field?: string | undefined;
+        instant?: string | undefined;
+        start?: string | null | undefined;
+        end?: string | null | undefined;
+    } | undefined;
+    layout?: "honua-facade" | "ogc-api" | "auto" | "stac-api" | "stac-static" | undefined;
+    layerId?: number | undefined;
+    source?: string | undefined;
     where?: string | undefined;
-    groupBy?: string | undefined;
+    bboxSrid?: number | undefined;
+    spatialRel?: "intersects" | "contains" | "within" | "crosses" | "touches" | "overlaps" | "bbox-intersects" | undefined;
+    groupBy?: string | string[] | undefined;
 }, {
-    serviceId: string;
-    layerId: number;
-    statisticType: "count" | "sum" | "avg" | "min" | "max" | "stddev";
+    statisticType: "count" | "sum" | "avg" | "min" | "max" | "stddev" | "var";
     onField: string;
+    filter?: import("../neutral/filter.js").FilterNode | undefined;
+    serviceId?: string | undefined;
+    geometry?: Record<string, unknown> | undefined;
+    bbox?: number[] | undefined;
+    geometryType?: "esriGeometryPoint" | "esriGeometryPolyline" | "esriGeometryPolygon" | "esriGeometryEnvelope" | "esriGeometryMultipoint" | undefined;
+    temporal?: {
+        field?: string | undefined;
+        instant?: string | undefined;
+        start?: string | null | undefined;
+        end?: string | null | undefined;
+    } | undefined;
+    layout?: "honua-facade" | "ogc-api" | "auto" | "stac-api" | "stac-static" | undefined;
+    layerId?: number | undefined;
+    source?: string | undefined;
     where?: string | undefined;
-    groupBy?: string | undefined;
+    bboxSrid?: number | undefined;
+    spatialRel?: "intersects" | "contains" | "within" | "crosses" | "touches" | "overlaps" | "bbox-intersects" | undefined;
+    groupBy?: string | string[] | undefined;
 }>;
 export type Input = z.infer<typeof schema>;
 export declare function execute(client: HonuaClient, input: Input): Promise<{
@@ -28,5 +89,12 @@ export declare function execute(client: HonuaClient, input: Input): Promise<{
         type: "text";
         text: string;
     }>;
+} | {
+    structuredContent: Record<string, unknown>;
+    isError: true;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
 }>;
 //# sourceMappingURL=statistics.d.ts.map

package/dist/src/tools/statistics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"statistics.d.ts","sourceRoot":"","sources":["../../../src/tools/statistics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;EAOjB,CAAC;AAEH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAE3C,wBAAsB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;;;;;GAuB9D"}
+{"version":3,"file":"statistics.d.ts","sourceRoot":"","sources":["../../../src/tools/statistics.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;GAQG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWjB,CAAC;AAEH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAC;AAQ3C,wBAAsB,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK;;;;;;;;;;;;GAgC9D"}

package/dist/src/tools/statistics.js

@@ -1,31 +1,64 @@
 import { z } from "zod";
 import { jsonText } from "../helpers.js";
+import { withCapabilityHonesty } from "../neutral/errors.js";
+import { queryFilterFields, toQuery } from "../neutral/query.js";
+import { projectDegraded } from "../neutral/result.js";
+import { isGeoServicesProtocol, resolveSource, sourceRefFields } from "../neutral/source-ref.js";
+/**
+ * `honua_statistics` — protocol-neutral aggregation (#1005).
+ *
+ * Lowers onto the canonical `AggregationSpec`, which GeoServices serves with
+ * `outStatistics` and which OGC API Features (no server-side aggregation)
+ * serves client-side over the returned page with an explicit `degraded` reason.
+ * The reason is reported in the result rather than dropped, so a page-scoped
+ * aggregate is never mistaken for an authoritative one.
+ */
 export const schema = z.object({
-    serviceId: z.string().describe("The feature service ID"),
-    layerId: z.number().int().nonnegative().describe("The layer ID within the service"),
-    statisticType: z.enum(["count", "sum", "avg", "min", "max", "stddev"]).describe("The aggregate function to compute"),
-    onField: z.string().describe("The field to compute the statistic on"),
-    groupBy: z.string().optional().describe("Field to group results by"),
-    where: z.string().optional().describe("SQL WHERE clause to filter features"),
+    ...sourceRefFields,
+    ...queryFilterFields,
+    statisticType: z
+        .enum(["count", "sum", "avg", "min", "max", "stddev", "var"])
+        .describe("The aggregate function to compute."),
+    onField: z.string().describe("The field to compute the statistic on."),
+    groupBy: z
+        .union([z.array(z.string()), z.string()])
+        .optional()
+        .describe("Field(s) to group results by."),
 });
+function normalizeGroupBy(groupBy) {
+    if (groupBy === undefined)
+        return undefined;
+    const fields = (Array.isArray(groupBy) ? groupBy : groupBy.split(",")).map((f) => f.trim()).filter(Boolean);
+    return fields.length > 0 ? fields : undefined;
+}
 export async function execute(client, input) {
-    const outStatisticFieldName = `${input.statisticType}_${input.onField}`;
-    const response = await client.queryFeatures({
-        serviceId: input.serviceId,
-        layerId: input.layerId,
-        where: input.where ?? "1=1",
-        outStatistics: [
-            {
-                statisticType: input.statisticType,
-                onStatisticField: input.onField,
-                outStatisticFieldName,
+    return withCapabilityHonesty(async () => {
+        const resolved = resolveSource(client, input);
+        const base = toQuery(input, { protocol: resolved.descriptor.protocol, paginate: false });
+        // GeoServices rejects an `outStatistics` query that carries no `where`;
+        // every other protocol treats "no filter" as "all records". Supplying the
+        // tautology keeps the neutral "omit the filter ⇒ aggregate everything"
+        // contract true on Esri endpoints.
+        if (isGeoServicesProtocol(resolved.descriptor.protocol) && base.filter === undefined && base.where === undefined) {
+            base.where = "1=1";
+        }
+        const groupBy = normalizeGroupBy(input.groupBy);
+        const alias = `${input.statisticType}_${input.onField}`;
+        const result = await resolved.source.queryAggregate({
+            ...base,
+            returnGeometry: false,
+            aggregation: {
+                ...(groupBy ? { groupBy } : {}),
+                metrics: [{ fn: input.statisticType, field: input.onField, alias }],
             },
-        ],
-        groupByFieldsForStatistics: input.groupBy,
-        returnGeometry: false,
-    });
-    const features = response.features ?? [];
-    return jsonText({
-        statistics: features.map((f) => ({ attributes: f.attributes })),
+        });
+        const degraded = projectDegraded(result.degraded);
+        return jsonText({
+            source: resolved.ref.ref,
+            protocol: resolved.descriptor.protocol,
+            statistic: alias,
+            statistics: (result.aggregateRows ?? []).map((attributes) => ({ attributes })),
+            ...(degraded ? { degraded } : {}),
+        });
     });
 }

package/package.json

@@ -1,11 +1,30 @@
 {
   "name": "@honua/mcp-server",
-  "version": "0.1.2-beta.0",
-  "description": "MCP server for Honua geospatial feature services",
+  "version": "0.1.8-beta.0",
+  "description": "Platform-free MCP server for geospatial services: expose discovery, query, and analysis over any public ArcGIS/Esri FeatureServer or OGC API endpoint to any MCP client, with no platform lock-in",
+  "license": "Apache-2.0",
+  "author": "Honua",
+  "homepage": "https://honua-io.github.io/honua-sdk-js/",
+  "bugs": {
+    "url": "https://github.com/honua-io/honua-sdk-js/issues"
+  },
+  "keywords": [
+    "gis",
+    "geospatial",
+    "maplibre",
+    "typescript",
+    "mcp",
+    "model-context-protocol",
+    "ai-agent",
+    "arcgis",
+    "ogc-api",
+    "feature-service"
+  ],
   "type": "module",
   "bin": {
     "honua-mcp": "dist/src/index.js",
-    "honua-mcp-proxy": "dist/src/proxy.js"
+    "honua-mcp-proxy": "dist/src/proxy.js",
+    "honua-zero-to-map-release": "dist/src/release/zero-to-map-cli.js"
   },
   "exports": {
     ".": {
@@ -23,7 +42,7 @@
     "./package.json": "./package.json"
   },
   "scripts": {
-    "clean": "rm -rf dist coverage",
+    "clean": "node scripts/clean-output.mjs",
     "build": "npm run clean --silent && tsc -p tsconfig.json",
     "prepack": "npm run build --silent",
     "typecheck": "tsc --noEmit",
@@ -32,17 +51,23 @@
     "test:coverage": "vitest run --coverage",
     "certify": "npm run build --silent && node dist/src/certification/cli.js",
     "certify:standalone": "npm run build --silent && node dist/src/certification/cli.js --target standalone",
+    "certify:standalone-ogc": "npm run build --silent && node dist/src/certification/cli.js --target standalone-ogc",
     "test:certification:nl-map-control": "vitest run test/certification/nl-map-control.test.ts",
     "test:certification": "npm run build --silent && vitest run test/certification && node dist/src/certification/cli.js",
+    "test:certification:admin": "vitest run test/proxy.test.ts test/certification/admin-parity.test.ts",
+    "certify:admin-parity": "npm run build --silent && node dist/src/certification/admin-parity.js",
     "test:certification:artifact": "npm run build --silent && node dist/src/certification/cli.js --artifact-only",
     "test:certification:standalone": "npm run build --silent && node dist/src/certification/cli.js --target standalone",
+    "test:certification:standalone-ogc": "npm run build --silent && node dist/src/certification/cli.js --target standalone-ogc",
     "eval": "npm run build --silent && node dist/src/eval/cli.js",
     "eval:offline": "npm run build --silent && node dist/src/eval/cli.js --offline",
     "eval:standalone": "npm run build --silent && node dist/src/eval/cli.js --corpus standalone --offline",
+    "eval:ogc": "npm run build --silent && node dist/src/eval/cli.js --corpus ogc --offline",
     "eval:live": "npm run build --silent && node dist/src/eval/cli.js --corpus operator --artifact-only",
     "leaderboard": "node scripts/render-leaderboard.mjs",
     "test:eval": "npm run build --silent && vitest run test/eval && node dist/src/eval/cli.js --offline",
     "test:eval:artifact": "npm run build --silent && node dist/src/eval/cli.js --artifact-only",
+    "release:zero-to-map": "npm run build --silent && node dist/src/release/zero-to-map-cli.js",
     "lint": "biome lint src/ test/",
     "lint:fix": "biome lint --write src/ test/",
     "format": "biome format src/ test/",
@@ -57,10 +82,12 @@
     "zod": "^3.24.0"
   },
   "overrides": {
-    "hono": "^4.12.21"
+    "hono": "^4.12.27",
+    "@hono/node-server": "^2.0.5",
+    "fast-uri": "^3.1.3"
   },
   "peerDependencies": {
-    "@honua/sdk-js": "^0.1.2-beta.0"
+    "@honua/sdk-js": "^0.1.8-beta.0"
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",
@@ -72,11 +99,13 @@
   },
   "files": [
     "dist/src",
+    "release/zero-to-map",
     "certification/geospatial-mcp-schemas",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.19.0"
   },
   "repository": {
     "type": "git",

package/release/zero-to-map/README.md

@@ -0,0 +1,174 @@
+# Zero-to-map 2026.1 release journey
+
+This bundle is the executable contract for `honua-release#123` D9.3: install
+Honua, configure and publish deterministic data with AI-accessible admin tools,
+run Buffer through the AI-facing Esri MCP tool, the SDK's Esri GPServer
+compatibility path, and the MCP-native analysis verb, compose distinct map,
+app, and dashboard packages in Studio, save each as an immutable version, read
+that exact version, reopen it as a new draft, record three publication intents,
+and save three new intent-bearing versions. It then stops at the human Console
+gate before verifying the three approved public URLs. Both MCP
+jobs are polled through `honua://jobs/{id}` and joined to their
+`honua://jobs/{id}/results` packages; a queued submission alone cannot pass.
+
+The driver reuses `honua admin install` and `honua-mcp-proxy`. It does not ship
+a second installer, admin client, or MCP transport. The installer is the
+canonical credential-issuance boundary: material is handed directly to its
+private environment/MCP configuration files, while its JSON receipt contains
+only the credential ID, requested/effective grants, active status, and a digest
+of the file reference.
+
+## Inspect the contract without changing anything
+
+From the `mcp` package directory:
+
+```sh
+npm run release:zero-to-map -- --output zero-to-map-contract-receipt.json
+```
+
+Contract mode never invokes Docker, CLI, MCP, GPServer, Console, or HTTP. Its
+receipt is intentionally `blocked`, with the first live action blocked and all
+later actions skipped. Static issue references remain under `dependencyRefs`;
+they are never reported as runtime blockers on a passed live receipt.
+
+## Configure an MCP client
+
+The `configs` directory contains equivalent examples for Claude Desktop,
+Claude Code, and Cursor. Each launches the existing `honua-mcp-proxy` and points
+it at the remote MCP endpoint. Set `HONUA_MCP_AUTH_TOKEN` separately when
+the deployment requires bearer authentication; do not put credentials in the
+journey plan or a release receipt.
+Credential-bearing proxy and live-journey endpoints require HTTPS, except for
+exact loopback HTTP used by the bounded local-Docker profile. User information,
+query parameters, fragments, cross-origin redirects, and any catalog that is not
+exactly the enabled-profile roster fail closed before the first mutation.
+
+## Run a live candidate
+
+Prerequisites:
+
+- Node.js 20.19 or newer and Docker with Compose
+- the 2026.1 `honua` CLI work from `honua-sdk-js#1370-#1373`
+- a server build exposing the complete default 432-tool roster (47 static plus
+  385 `honua_admin_*` tools), with all eleven secret/session Admin operations
+  absent, **and** the `analysis` and `esri-gp` server profiles enabled so the
+  three `honua_esri_gp_*` tools and `honua_buffer_features` are advertised
+  (441 tools in total), plus the Studio lifecycle tools including
+  `honua_studio_save_version`, `honua_studio_get_version`, and
+  `honua_studio_reopen_version`
+- the `geoprocessing/Buffer` GPServer task seeded by the deployment
+- these fixtures available to the server at an HTTP(S) base URL
+- a writable checkpoint path; the first pass emits the exact resolved Console
+  receipt request after all pre-approval work completes
+
+Serve the checked-in fixtures from a URL reachable by the Honua container, for
+example with an existing static-file server. Then run:
+
+```sh
+npm run release:zero-to-map -- \
+  --execute --yes \
+  --target local-docker \
+  --mcp-url http://localhost:8080/mcp \
+  --var fixtureBaseUrl=http://host.docker.internal:4173 \
+  --var dbSecretReference=env:HONUA_ZERO_TO_MAP_DB_CONNECTION \
+  --var dbSecretType=environment \
+  --var candidateId=manifest-sha256:<platform-manifest-sha256> \
+  --var releaseId=2026.1 \
+  --checkpoint ./zero-to-map.checkpoint.json \
+  --output ./zero-to-map-live-receipt.json
+```
+
+The first pass exits `2` with `external-receipt-missing`. It has already run
+stages 1-5 exactly once. Give the checkpoint's resolved
+`consoleReceiptRequest` to the Console producer, carry
+`checkpoint.integrity.digest` outside that file, and resume with the same
+command plus:
+
+```sh
+  --checkpoint-digest <checkpoint.integrity.digest> \
+  --console-receipt ./console-approval.json
+```
+
+The resume atomically claims the checkpoint before any adapter work. A second
+or concurrent claimant fails closed. The checkpoint is bound to the exact plan
+bytes, SDK source SHA (`HONUA_SOURCE_REVISION`), target, MCP endpoint,
+candidate/release, and (for AWS) provisioning receipt; it contains only
+allowlisted captures/evidence, including the non-secret deterministic
+`serviceName` identity and access-credential ID/grants/reference digest required
+by external producers, and never the database password, admin key, token, or
+authorization material. A successful resume
+marks it consumed and binds the final receipt hash.
+
+For a deployment already provisioned by the DevOps ECS producer, use
+`--target aws-ecs --provision-receipt <pre-teardown-binding.json>`. The binding
+must match `contracts/aws-ecs-provision-binding.schema.json`, the candidate and
+release variables, and `--mcp-url=<binding.endpoint>/mcp`. Stage 1 then records
+the real image/digest, Terraform, readiness, and a secret-free access receipt
+whose reference digest is verified against the producer's Secrets Manager ARN;
+it does not invoke or pretend to invoke the Docker installer.
+
+The catalog is checked in full before the first MCP call. Missing tools or
+input-schema drift block the run without sending that call.
+
+The preflight verifies each enabled server profile independently and *derives*
+the expected total from them; it never compares the catalog against a single
+hardcoded number:
+
+| Profile | Members | Verified by |
+| --- | --- | --- |
+| `base` | 47 static + 385 `honua_admin_*` = 432 | the generated Admin contract, plus the 11 audited secret/session exclusions proven absent |
+| `analysis` | 6 | `honua_buffer_features` by name; the rest by declared size (the server has not published an `analysis` roster - honua-server#3363) |
+| `esri-gp` | 3 | exactly `honua_esri_gp_list_tasks`, `honua_esri_gp_describe_task`, `honua_esri_gp_execute_task` from `contracts/esri-gp-mcp.v1.json` |
+
+The enabled candidate therefore advertises 432 + 6 + 3 = 441 tools. A missing,
+unexpected, duplicate, excluded, truncated, or schema-drifted member fails with
+its own labelled finding naming the journey stage and action that needs the
+tool; a short catalog is reported as a pagination fault rather than a roster
+decision. The pagination safety ceiling in `listAllTools` is deliberately
+separate from every roster number, so reading a larger profile-enabled catalog
+is never mistaken for a hostile server. Default-profile certification
+(`certifyAdminCatalogParity`) continues to require exactly 432.
+
+The connection is
+created with `secretReference` + `secretType`; raw database credentials never
+enter MCP arguments, checkpoints, or receipts. One-time-secret and session-bound
+operations (including API-key issuance) are deliberately absent from MCP and
+must be handled by the install/control-plane credential boundary. The journey
+then exercises only secret-safe API-key list and effective-permissions tools to
+verify the provisioned identity and its exact grants. Admin operations
+must return a completed PublishedOperation; queued or approval-required handles
+produce explicit blocked receipts. The driver reads connection/layer IDs only
+from `structuredContent.details.response`, the server's PublishedOperation
+endpoint-response seam.
+
+The Studio version tools are also preflighted before the first server mutation.
+Map, app, and dashboard each exercise layer, style, view, widget, and control
+mutations before validation; family-specific shortcuts or embedded lookalikes
+cannot satisfy the release roster.
+The journey does not treat `honua_studio_get_draft` as reopen evidence: every
+family must capture its `itemId`, immutable `versionId`, `contentHash`, and the
+new draft whose `baseVersionId` points back to that exact version. After the
+proposal increments that reopened draft's generation, the journey saves a new
+immutable publication version. Console must create and publish the request for
+that new version, never the earlier pre-intent version.
+
+The Console receipt is accepted only when it is `passed` and binds this
+journey/release contract to the exact connection, service, layers, three GP job
+identities, result packages/artifacts, map/app/dashboard draft and immutable
+version identities, all three reopened drafts and intent-bearing publication
+versions, all three Console request/publication/status/public-URL identities,
+execution operations, audit correlations, routes, candidate, and release. Each
+audit operation must equal its family's execution operation, each proposal ID
+must equal its publication request ID, and the app public URL must equal the
+top-level share URL. The Studio proposal actions reject any pre-approval
+publication ID or public URL and must report both `recorded=true` and
+`humanConfirmationRequired=true`. Agent execution never claims the human
+publication step. Stage 7 independently requires identity-preserving HTTPS
+HTTP 200 responses for map, app, and dashboard URLs.
+
+## Evidence status
+
+The fixtures, plan, contracts, and simulated end-to-end tests are deterministic.
+They are not a live release recording. Until all deployment dependencies are
+available and an operator supplies a matching Console receipt, the honest
+candidate result is `blocked`/`skipped`, not passed.

package/release/zero-to-map/configs/claude-code.mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "honua": {
+      "command": "npx",
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "env": {
+        "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
+      }
+    }
+  }
+}

package/release/zero-to-map/configs/claude-desktop.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "honua": {
+      "command": "npx",
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "env": {
+        "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
+      }
+    }
+  }
+}

package/release/zero-to-map/configs/cursor.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "honua": {
+      "command": "npx",
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "env": {
+        "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
+      }
+    }
+  }
+}