@honua/mcp-server 0.1.2-beta.0 → 0.1.8-beta.0

package/dist/src/certification/admin-parity.js

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+import { writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { ADMIN_MCP_CONTRACT_SERVER_SHA, ADMIN_MCP_COVERAGE_SHA256, ADMIN_MCP_EXCLUDED_OPERATIONS, ADMIN_MCP_EXCLUSION_ROSTER_SHA256, ADMIN_MCP_PUBLISHED_TOOL_NAMES, ADMIN_PUBLISHED_OPERATION_COUNT, MCP_DEFAULT_STATIC_TOOL_COUNT, MCP_DEFAULT_TOTAL_TOOL_COUNT, } from "@honua/sdk-js/control-plane";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import { connectUpstream, createProxyServer, resolveProxyOptions } from "../proxy.js";
+const DEFAULT_EXPECTATION = {
+    publishedToolNames: ADMIN_MCP_PUBLISHED_TOOL_NAMES,
+    excludedToolNames: ADMIN_MCP_EXCLUDED_OPERATIONS.map((operation) => operation.toolName),
+    expectedStaticTools: MCP_DEFAULT_STATIC_TOOL_COUNT,
+    expectedTotalTools: MCP_DEFAULT_TOTAL_TOOL_COUNT,
+};
+export function certifyAdminCatalogParity(directCatalog, proxiedCatalog, expectation = DEFAULT_EXPECTATION) {
+    const direct = normalizeAdminTools(directCatalog);
+    const proxied = normalizeAdminTools(proxiedCatalog);
+    const expectedTools = expectation.publishedToolNames.length;
+    const directStaticTools = directCatalog.length - direct.length;
+    const proxiedStaticTools = proxiedCatalog.length - proxied.length;
+    const differences = [];
+    if (expectedTools !== ADMIN_PUBLISHED_OPERATION_COUNT) {
+        differences.push(`certification expectation contains ${expectedTools} admin tools; generated contract requires ${ADMIN_PUBLISHED_OPERATION_COUNT}`);
+    }
+    if (direct.length !== expectedTools) {
+        differences.push(`direct catalog exposes ${direct.length} admin tools; expected ${expectedTools}`);
+    }
+    if (proxied.length !== expectedTools) {
+        differences.push(`proxied catalog exposes ${proxied.length} admin tools; expected ${expectedTools}`);
+    }
+    if (directStaticTools !== expectation.expectedStaticTools) {
+        differences.push(`direct catalog exposes ${directStaticTools} static tools; expected ${expectation.expectedStaticTools}`);
+    }
+    if (proxiedStaticTools !== expectation.expectedStaticTools) {
+        differences.push(`proxied catalog exposes ${proxiedStaticTools} static tools; expected ${expectation.expectedStaticTools}`);
+    }
+    if (directCatalog.length !== expectation.expectedTotalTools) {
+        differences.push(`direct catalog exposes ${directCatalog.length} total tools; expected ${expectation.expectedTotalTools}`);
+    }
+    if (proxiedCatalog.length !== expectation.expectedTotalTools) {
+        differences.push(`proxied catalog exposes ${proxiedCatalog.length} total tools; expected ${expectation.expectedTotalTools}`);
+    }
+    if (expectation.expectedStaticTools + expectedTools !== expectation.expectedTotalTools) {
+        differences.push(`certification equation failed: ${expectation.expectedStaticTools} static + ${expectedTools} admin ` +
+            `!= ${expectation.expectedTotalTools} total tools`);
+    }
+    for (const duplicate of findDuplicateNames(direct)) {
+        differences.push(`direct catalog repeats admin tool ${duplicate}`);
+    }
+    for (const duplicate of findDuplicateNames(proxied)) {
+        differences.push(`proxied catalog repeats admin tool ${duplicate}`);
+    }
+    for (const duplicate of findDuplicateNames(directCatalog)) {
+        if (!duplicate.startsWith("honua_admin_"))
+            differences.push(`direct catalog repeats static tool ${duplicate}`);
+    }
+    for (const duplicate of findDuplicateNames(proxiedCatalog)) {
+        if (!duplicate.startsWith("honua_admin_"))
+            differences.push(`proxied catalog repeats static tool ${duplicate}`);
+    }
+    compareExpectedRoster("direct", direct, expectation, differences);
+    compareExpectedRoster("proxied", proxied, expectation, differences);
+    const directByName = new Map(direct.map((tool) => [tool.name, tool]));
+    const proxiedByName = new Map(proxied.map((tool) => [tool.name, tool]));
+    for (const name of [...new Set([...directByName.keys(), ...proxiedByName.keys()])].sort()) {
+        const directTool = directByName.get(name);
+        const proxiedTool = proxiedByName.get(name);
+        if (!directTool)
+            differences.push(`${name} is missing from the direct HTTP catalog`);
+        else if (!proxiedTool)
+            differences.push(`${name} is missing from the proxied catalog`);
+        else if (stableJson(directTool) !== stableJson(proxiedTool))
+            differences.push(`${name} descriptor differs`);
+    }
+    return {
+        schemaVersion: "honua.admin-mcp-parity.v1",
+        family: "honua_admin_*",
+        expectedTools,
+        expectedStaticTools: expectation.expectedStaticTools,
+        expectedTotalTools: expectation.expectedTotalTools,
+        directTools: direct.length,
+        proxiedTools: proxied.length,
+        directStaticTools,
+        proxiedStaticTools,
+        directTotalTools: directCatalog.length,
+        proxiedTotalTools: proxiedCatalog.length,
+        coverageSha256: ADMIN_MCP_COVERAGE_SHA256,
+        exclusionRosterSha256: ADMIN_MCP_EXCLUSION_ROSTER_SHA256,
+        contractServerSha: ADMIN_MCP_CONTRACT_SERVER_SHA,
+        pass: differences.length === 0,
+        differences,
+    };
+}
+function compareExpectedRoster(transport, tools, expectation, differences) {
+    const actual = new Set(tools.map((tool) => tool.name));
+    const expected = new Set(expectation.publishedToolNames);
+    for (const name of [...expected].sort()) {
+        if (!actual.has(name))
+            differences.push(`${name} is missing from the ${transport} catalog contract`);
+    }
+    for (const name of [...actual].sort()) {
+        if (!expected.has(name))
+            differences.push(`${name} is not classified as published in the ${transport} catalog contract`);
+    }
+    for (const name of [...expectation.excludedToolNames].sort()) {
+        if (actual.has(name))
+            differences.push(`${transport} catalog advertises explicitly excluded admin tool ${name}`);
+    }
+}
+function findDuplicateNames(tools) {
+    const seen = new Set();
+    const duplicates = new Set();
+    for (const tool of tools) {
+        if (seen.has(tool.name))
+            duplicates.add(tool.name);
+        else
+            seen.add(tool.name);
+    }
+    return [...duplicates].sort();
+}
+export function normalizeAdminTools(tools) {
+    return tools
+        .filter((tool) => tool.name.startsWith("honua_admin_"))
+        .map((tool) => ({
+        name: tool.name,
+        title: tool.title,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        outputSchema: tool.outputSchema,
+        annotations: tool.annotations,
+    }))
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+/**
+ * Hostile-server safety ceiling on the number of `tools/list` pages a single
+ * catalog read may consume.
+ *
+ * This is deliberately NOT the expected roster size. A roster assertion says
+ * "this catalog is wrong"; this ceiling says "this server never stopped
+ * paging". Conflating the two produced a single unactionable diagnostic and,
+ * worse, made an opt-in profile catalog (base + analysis + Esri GP) impossible
+ * to read at all because the *transport* refused any catalog larger than the
+ * default roster.
+ */
+export const MCP_TOOLS_LIST_MAX_PAGES = 1_024;
+/**
+ * Hostile-server safety ceiling on the number of tools a single catalog read
+ * may accumulate. Independent of {@link MCP_DEFAULT_TOTAL_TOOL_COUNT} so that
+ * enabling additive server profiles is a roster question, not a transport
+ * failure.
+ */
+export const MCP_TOOLS_LIST_MAX_TOOLS = 8_192;
+/** Maximum accepted `tools/list` continuation cursor length, in characters. */
+export const MCP_TOOLS_LIST_MAX_CURSOR_LENGTH = 1_024;
+/**
+ * Read the complete MCP tool catalog. The server deliberately pages large
+ * catalogs, so a single tools/list response is not certification evidence for
+ * the 432-tool default roster (47 static plus 385 Admin MCP tools).
+ *
+ * Roster size is *not* enforced here. This function is responsible only for
+ * retrieving a complete, non-hostile catalog; deciding whether that catalog is
+ * the 432-tool default roster or a profile-enabled superset belongs to the
+ * certification and preflight callers.
+ */
+export async function listAllTools(client) {
+    const tools = [];
+    let cursor;
+    const seenCursors = new Set();
+    let pageCount = 0;
+    do {
+        pageCount += 1;
+        if (pageCount > MCP_TOOLS_LIST_MAX_PAGES) {
+            throw new Error(`MCP tools/list exceeded the ${MCP_TOOLS_LIST_MAX_PAGES}-page pagination safety ceiling after ${tools.length} tools; the server did not terminate its cursor chain. This is a pagination fault, not a roster assertion.`);
+        }
+        const page = await client.listTools(cursor ? { cursor } : undefined);
+        if (tools.length + page.tools.length > MCP_TOOLS_LIST_MAX_TOOLS) {
+            throw new Error(`MCP tools/list exceeded the ${MCP_TOOLS_LIST_MAX_TOOLS}-tool pagination safety ceiling on page ${pageCount}; the server returned an implausible catalog. This is a pagination fault, not a roster assertion.`);
+        }
+        tools.push(...page.tools);
+        cursor = page.nextCursor;
+        if (cursor !== undefined && (cursor.length === 0 || cursor.length > MCP_TOOLS_LIST_MAX_CURSOR_LENGTH)) {
+            throw new Error("MCP tools/list returned an invalid bounded cursor");
+        }
+        if (cursor && seenCursors.has(cursor)) {
+            throw new Error(`MCP tools/list repeated cursor ${cursor}`);
+        }
+        if (cursor && page.tools.length === 0) {
+            throw new Error("MCP tools/list returned an empty page with a continuation cursor");
+        }
+        if (cursor)
+            seenCursors.add(cursor);
+    } while (cursor);
+    return tools;
+}
+export async function runAdminParityCertification(env = process.env, outputPath = "admin-mcp-parity.json") {
+    if (ADMIN_MCP_CONTRACT_SERVER_SHA === null) {
+        throw new Error("Admin MCP live certification is blocked until config/admin-client.v1.json pins the final server head.");
+    }
+    const upstream = await connectUpstream(resolveProxyOptions(env));
+    const proxy = createProxyServer(upstream);
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const proxied = new Client({ name: "honua-admin-parity", version: "1.0.0" });
+    try {
+        await proxy.connect(serverTransport);
+        await proxied.connect(clientTransport);
+        const directTools = await listAllTools(upstream);
+        const proxiedTools = await listAllTools(proxied);
+        const receipt = certifyAdminCatalogParity(directTools, proxiedTools);
+        await writeFile(outputPath, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
+        if (!receipt.pass)
+            throw new Error(`Admin MCP parity failed: ${receipt.differences.join("; ")}`);
+        return receipt;
+    }
+    finally {
+        await proxied.close().catch(() => { });
+        await proxy.close().catch(() => { });
+        await upstream.close().catch(() => { });
+    }
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "undefined";
+}
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    runAdminParityCertification(process.env, process.argv[2]).catch((error) => {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/src/certification/census-fixture-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"census-fixture-client.d.ts","sourceRoot":"","sources":["../../../src/certification/census-fixture-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAOjD,OAAO,EAML,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AA4F1B,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,EAAE,CAOjE;AAyFD,qFAAqF;AACrF,wBAAgB,6BAA6B,IAAI,WAAW,CAiE3D"}
+{"version":3,"file":"census-fixture-client.d.ts","sourceRoot":"","sources":["../../../src/certification/census-fixture-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAOjD,OAAO,EAML,KAAK,SAAS,EACf,MAAM,kBAAkB,CAAC;AA4F1B,gEAAgE;AAChE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,EAAE,CAOjE;AA8FD,qFAAqF;AACrF,wBAAgB,6BAA6B,IAAI,WAAW,CAiE3D"}

package/dist/src/certification/census-fixture-client.js

@@ -154,6 +154,11 @@ function projectAttributes(row, outFields) {
         return { ...row };
     }
     const requested = Array.isArray(outFields) ? outFields : outFields.split(",").map((f) => f.trim());
+    // A FeatureServer serializes `outFields` as a comma list, so `["*"]` reaches
+    // the wire as `outFields=*` and selects every field. Mirror that here.
+    if (requested.some((field) => field.trim() === "*")) {
+        return { ...row };
+    }
     const attributes = {};
     for (const field of requested) {
         const value = fieldValue(row, field);

package/dist/src/certification/certifier.d.ts

@@ -1,7 +1,7 @@
 import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { type AuthMode, type SuiteProvenance } from "../provenance.js";
 import { AUTH_ERROR_CODES } from "./contracts.js";
-import type { CertTargetMode } from "./target.js";
+import { type CertTargetMode } from "./target.js";
 /** Per-tool certification record (machine-readable). */
 export interface ToolCertification {
     name: string;

package/dist/src/certification/certifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certifier.d.ts","sourceRoot":"","sources":["../../../src/certification/certifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EAGrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,0GAA0G;IAC1G,yBAAyB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EACJ,eAAe,GACf,aAAa,GACb,sBAAsB,GACtB,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,4BAA4B,GAC5B,qBAAqB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC;QAClC,UAAU,EAAE,cAAc,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,iFAAiF;IACjF,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE;QACP,IAAI,EAAE,OAAO,CAAC;QACd,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,uBAAuB,EAAE,MAAM,CAAC;QAChC,eAAe,EAAE,MAAM,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9C,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,UAAU,EAAE,cAAc,CAAC;IAC3B,mEAAmE;IACnE,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7D,iFAAiF;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAID,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,CAMxG;AASD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0EnF;AAubD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"certifier.d.ts","sourceRoot":"","sources":["../../../src/certification/certifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACxE,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,eAAe,EAGrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AAaxB,OAAO,EAAE,KAAK,cAAc,EAA0B,MAAM,aAAa,CAAC;AAE1E,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gFAAgF;IAChF,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,kFAAkF;IAClF,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC3C,0GAA0G;IAC1G,yBAAyB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,EACJ,eAAe,GACf,aAAa,GACb,sBAAsB,GACtB,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,4BAA4B,GAC5B,qBAAqB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,EAAE;QACR,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC;QAClC,UAAU,EAAE,cAAc,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,iFAAiF;IACjF,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE;QACP,IAAI,EAAE,OAAO,CAAC;QACd,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,uBAAuB,EAAE,MAAM,CAAC;QAChC,eAAe,EAAE,MAAM,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,IAAI,CAAA;KAAE,EAAE,CAAC;IAC9C,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,UAAU,EAAE,cAAc,CAAC;IAC3B,mEAAmE;IACnE,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6EAA6E;IAC7E,sBAAsB,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAC7D,iFAAiF;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAID,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,OAAO,CAMxG;AAwBD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA0EnF;AAyaD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/src/certification/certifier.js

@@ -3,7 +3,9 @@ import { AUTH_ERROR_CODES, checkAuthContract, checkInvalidArgsContract, checkPag
 import { buildInvalidArgsInputs, buildRoundTripInputs, resolveRoundTripEnv } from "./fixtures.js";
 import { checkConformance, checkWellFormed, validateAgainstSchema } from "./json-schema.js";
 import { runDeepContracts } from "./lifecycle.js";
+import { OGC_COLLECTION_IDS } from "./ogc-data.js";
 import { PLATFORM_FREE_DEGRADATIONS, buildReferenceToolLookup, loadSchemaFile, loadSchemaIndex, } from "./schema-index.js";
+import { isStandaloneTargetMode } from "./target.js";
 const STANDARD_SOURCE = "geospatial-mcp@54cbd49 (spec/schemas)";
 /** Determine whether a discovered tool is safe to round-trip (read-only). */
 export function isReadOnlyTool(tool) {
@@ -13,6 +15,20 @@ export function isReadOnlyTool(tool) {
     const mutating = /(create|update|delete|publish|apply_.*write|execute|edit|deploy|cancel|propose)/i;
     return !mutating.test(tool.name);
 }
+/**
+ * Bind the round-trip inputs to what the target actually serves.
+ *
+ * The non-GeoServices lane has no `serviceId`/`layerId` at all, so the
+ * source-addressed tools round-trip through the protocol-neutral reference for
+ * a recorded OGC collection instead (#1005). An explicit `HONUA_MCP_SOURCE`
+ * always wins.
+ */
+function withTargetRoundTripDefaults(env, targetMode) {
+    if (targetMode !== "standalone-ogc" || env.sourceRef) {
+        return env;
+    }
+    return { ...env, sourceRef: `ogc-features:${OGC_COLLECTION_IDS[0]}`, statisticField: env.statisticField ?? "value" };
+}
 /**
  * Connect an MCP client to the certified surface and produce a deterministic
  * certification report. The client is already connected (offline mock upstream,
@@ -20,7 +36,7 @@ export function isReadOnlyTool(tool) {
  */
 export async function certify(options) {
     const { client } = options;
-    const roundTripEnv = resolveRoundTripEnv(options.env);
+    const roundTripEnv = withTargetRoundTripDefaults(resolveRoundTripEnv(options.env), options.targetMode);
     const roundTripInputs = buildRoundTripInputs(roundTripEnv);
     const index = loadSchemaIndex();
     const referenceLookup = buildReferenceToolLookup(index);
@@ -31,7 +47,7 @@ export async function certify(options) {
     // The platform-free standalone target has no Honua publishing surface, so
     // reference-shape tools (e.g. apply_style_preset) intentionally degrade their
     // platform-bound required properties. Conformance is evaluated accordingly.
-    const platformFree = options.targetMode === "standalone";
+    const platformFree = isStandaloneTargetMode(options.targetMode);
     const tools = [];
     const advertisedNames = new Set();
     for (const tool of advertisedTools) {
@@ -47,7 +63,7 @@ export async function certify(options) {
     contracts.push(paginationCheck("tools", toolPages));
     contracts.push(paginationCheck("resources", resourcePages));
     collectOutputSchemaContracts(tools, contracts);
-    contracts.push(await runErrorShapeContract(client, advertisedTools, options.targetMode));
+    contracts.push(await runErrorShapeContract(client, advertisedTools));
     await runAuthContracts(options, advertisedTools, advertisedResources, contracts);
     // Deep contracts: mutating round-trip, unauthenticated-write refusal, async job
     // lifecycle, and query pagination. Safe by construction — mutations only run
@@ -155,7 +171,7 @@ async function certifyTool(client, tool, referenceLookup, roundTripInputs, platf
     let structuredOutputValidated = null;
     const fixtureInput = roundTripInputs[tool.name];
     if (readOnly && fixtureInput !== undefined) {
-        const outcome = await roundTripTool(client, tool, fixtureInput, errors, notes);
+        const outcome = await roundTripTool(client, tool, fixtureInput, errors);
         roundTrip = outcome.roundTrip;
         structuredOutputValidated = outcome.structuredOutputValidated;
     }
@@ -179,7 +195,7 @@ async function certifyTool(client, tool, referenceLookup, roundTripInputs, platf
         notes,
     };
 }
-async function roundTripTool(client, tool, input, errors, notes) {
+async function roundTripTool(client, tool, input, errors) {
     try {
         const result = (await client.callTool({ name: tool.name, arguments: input }));
         if (result.isError) {
@@ -240,21 +256,13 @@ function collectOutputSchemaContracts(tools, contracts) {
         });
     }
 }
-async function runErrorShapeContract(client, advertised, targetMode) {
-    // The platform-free standalone surface is built on the high-level MCP server,
-    // which rejects invalid arguments with a JSON-RPC -32602 (InvalidParams) error
-    // BEFORE the tool body runs — a valid MCP-native structured error, but not the
-    // Honua GeoprocessingError envelope this contract asserts. That envelope is a
-    // Honua-operator richness a plain FeatureServer does not (and need not) provide,
-    // so we skip-with-reason rather than fail. Other targets are unaffected.
-    if (targetMode === "standalone") {
-        return {
-            contract: "error-shape",
-            target: "(standalone)",
-            status: "skipped",
-            detail: "standalone surface uses MCP-native input validation (JSON-RPC -32602 InvalidParams); the GeoprocessingError envelope is a Honua-operator surface feature",
-        };
-    }
+async function runErrorShapeContract(client, advertised) {
+    // The platform-free surface used to skip this contract: its tools relied on
+    // MCP-native input validation (JSON-RPC -32602 InvalidParams), which is a
+    // valid structured error but not the GeoprocessingError envelope asserted
+    // here. Since #1005 the source-addressed tools validate the request
+    // themselves and emit that envelope, so the contract is exercised on every
+    // target.
     const invalidInputs = buildInvalidArgsInputs();
     const advertisedNames = new Set(advertised.map((t) => t.name));
     const target = Object.keys(invalidInputs).find((name) => advertisedNames.has(name));

package/dist/src/certification/cli.js

@@ -23,7 +23,7 @@ function parseArgs(argv) {
         else if (arg === "--target") {
             const value = argv[++i];
             if (!value) {
-                throw new Error("--target requires a target mode (offline | remote | stdio-proxy | standalone)");
+                throw new Error("--target requires a target mode (offline | remote | stdio-proxy | standalone | standalone-ogc)");
             }
             target = value;
         }

package/dist/src/certification/cql2.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Minimal CQL2-text evaluator for the offline OGC API Features fixture (#1005).
+ *
+ * The neutral tool contract lowers `Query.filter` onto CQL2 text for the OGC
+ * family, so an offline fixture that ignored `filter=` would certify a filter
+ * path that never actually filtered. This evaluator parses the exact subset the
+ * SDK's CQL2 compiler emits — comparisons, `IN`, `BETWEEN`, `IS [NOT] NULL`,
+ * `LIKE`/`CASEI`, `AND`/`OR`/`NOT`, parentheses, and `DATE()`/`TIMESTAMP()`
+ * literals — and REFUSES anything else rather than silently matching every row,
+ * which would turn a filter regression into a passing test.
+ *
+ * It is a fixture, not a CQL2 implementation: spatial predicates are out of
+ * scope here (the fixture serves spatial constraints through the `bbox`
+ * parameter, exactly as OGC API Features Part 1 defines).
+ */
+export declare class Cql2UnsupportedError extends Error {
+    constructor(message: string);
+}
+type Row = Record<string, unknown>;
+type Predicate = (row: Row) => boolean;
+/** Compile a CQL2-text expression into a row predicate. */
+export declare function compileCql2(filter: string): Predicate;
+export {};
+//# sourceMappingURL=cql2.d.ts.map

package/dist/src/certification/cql2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cql2.d.ts","sourceRoot":"","sources":["../../../src/certification/cql2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AA2FD,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,KAAK,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC;AAqQvC,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAErD"}