@honua/mcp-server 0.1.9-beta.0 → 0.1.10-beta.0

package/dist/src/release/zero-to-map.js

@@ -8,12 +8,20 @@ import { publicHttps } from "./zero-to-map-provision.js";
  * not contain a second installer, admin client, or MCP proxy.
  */
 import { createHash } from "node:crypto";
+import { inflateSync } from "node:zlib";
 import { ADMIN_MCP_EXCLUDED_OPERATIONS, ADMIN_MCP_EXCLUDED_OPERATION_COUNT, ADMIN_MCP_EXCLUSION_ROSTER_SHA256, ADMIN_MCP_PUBLISHED_TOOL_NAMES, MCP_DEFAULT_STATIC_TOOL_COUNT, MCP_DEFAULT_TOTAL_TOOL_COUNT, } from "@honua/sdk-js/control-plane";
 export const ZERO_TO_MAP_PLAN_SCHEMA = "honua.zero-to-map.plan/v1";
 export const ZERO_TO_MAP_RECEIPT_SCHEMA = "honua.zero-to-map.receipt/v1";
 export const ZERO_TO_MAP_CONSOLE_RECEIPT_SCHEMA = "honua.zero-to-map.console-receipt/v1";
 export const ZERO_TO_MAP_CONSOLE_RECEIPT_REQUEST_SCHEMA = "honua.zero-to-map.console-receipt-request/v1";
 export const ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA = "honua.zero-to-map.catalog/v1";
+/**
+ * Stages in the release journey: install, admin, style, geoprocessing, studio,
+ * proposal, console, artifact. `style` proves a canonical style applied to a
+ * *published* layer reaches rendered pixels - the Studio-draft styling in the
+ * `studio` stage never leaves a draft and so never proved that.
+ */
+export const ZERO_TO_MAP_STAGE_COUNT = 8;
 /** Identifier of the always-required default roster. */
 export const ZERO_TO_MAP_BASE_PROFILE_ID = "base";
 /**
@@ -38,6 +46,25 @@ export const ZERO_TO_MAP_ADDITIVE_PROFILES = [
         namePrefixes: ["honua_esri_gp_"],
     },
 ];
+/**
+ * The reserved `tools/list` view name that opts a request back out of any
+ * server-configured or session-negotiated workflow view and returns the
+ * complete paginated catalog (honua-server#3428).
+ *
+ * The candidate server may publish a bounded workflow view - today `setup` - and
+ * may make one the profile default through the configuration key named by
+ * {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. Selecting a view can only
+ * *narrow* discovery, so a host that configures a default view would serve the
+ * roster preflight a short catalog and the preflight would blame a missing
+ * server profile for what is actually a discovery setting. The preflight
+ * therefore always selects this escape hatch explicitly rather than relying on
+ * the candidate having no default configured.
+ */
+export const ZERO_TO_MAP_FULL_CATALOG_VIEW = "full";
+/** Configuration key whose value would narrow the candidate's default `tools/list`. */
+export const ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY = "Mcp:WorkflowViews:DefaultView";
+/** Environment-variable spelling of {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. */
+export const ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY = "Mcp__WorkflowViews__DefaultView";
 /** Profiles the candidate must advertise before the journey is executable. */
 export const ZERO_TO_MAP_REQUIRED_PROFILES = [
     ZERO_TO_MAP_BASE_PROFILE_ID,
@@ -63,6 +90,286 @@ const STUDIO_PUBLICATION_GENERATION_CAPTURE_POINTERS = [
     "/structuredContent/draft/generation",
     "/structuredContent/generation",
 ];
+const PNG_SIGNATURE = Uint8Array.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/** Channels per pixel for each PNG colour type; `undefined` marks a reserved value. */
+const PNG_CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let index = 0; index < 256; index += 1) {
+        let value = index;
+        for (let bit = 0; bit < 8; bit += 1)
+            value = value & 1 ? 0xed_b8_83_20 ^ (value >>> 1) : value >>> 1;
+        table[index] = value >>> 0;
+    }
+    return table;
+})();
+/** PNG chunk CRC-32 over the type bytes followed by the chunk data. */
+function crc32(bytes, start, end) {
+    let crc = 0xff_ff_ff_ff;
+    for (let index = start; index < end; index += 1)
+        crc = CRC_TABLE[(crc ^ bytes[index]) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xff_ff_ff_ff) >>> 0;
+}
+/**
+ * Reverse the PNG per-scanline filters so the raster can be inspected as pixels
+ * rather than as filtered bytes. Filter types are PNG spec 9.2; an unknown type
+ * is a corrupt raster, not something to skip past.
+ */
+function unfilterRaster(raster, height, bytesPerPixel, bytesPerRow, where) {
+    const out = new Uint8Array(height * bytesPerRow);
+    const step = Math.max(1, bytesPerPixel);
+    for (let row = 0; row < height; row += 1) {
+        const filter = raster[row * (bytesPerRow + 1)];
+        const from = row * (bytesPerRow + 1) + 1;
+        const to = row * bytesPerRow;
+        const above = (row - 1) * bytesPerRow;
+        for (let index = 0; index < bytesPerRow; index += 1) {
+            const raw = raster[from + index];
+            const left = index >= step ? out[to + index - step] : 0;
+            const up = row > 0 ? out[above + index] : 0;
+            const upLeft = row > 0 && index >= step ? out[above + index - step] : 0;
+            let value;
+            switch (filter) {
+                case 0:
+                    value = raw;
+                    break;
+                case 1:
+                    value = raw + left;
+                    break;
+                case 2:
+                    value = raw + up;
+                    break;
+                case 3:
+                    value = raw + ((left + up) >> 1);
+                    break;
+                case 4: {
+                    const estimate = left + up - upLeft;
+                    const dLeft = Math.abs(estimate - left);
+                    const dUp = Math.abs(estimate - up);
+                    const dUpLeft = Math.abs(estimate - upLeft);
+                    value = raw + (dLeft <= dUp && dLeft <= dUpLeft ? left : dUp <= dUpLeft ? up : upLeft);
+                    break;
+                }
+                default:
+                    throw new Error(`${where} uses unknown PNG filter type ${filter} on row ${row}; the raster is corrupt`);
+            }
+            out[to + index] = value & 0xff;
+        }
+    }
+    return out;
+}
+/**
+ * Validate that fetched bytes are a PNG of the declared size that actually
+ * decodes to a drawn map.
+ *
+ * A style/render no-op is not a transport failure: the tool answers, the
+ * resource resolves, and the bytes may even be a syntactically plausible PNG.
+ * Structural checks alone are not enough to tell those apart - a blob whose
+ * chunks are merely *labelled* IDAT passes any counter that only sums chunk
+ * lengths, and a correctly-sized PNG of uniform background is a valid image
+ * that proves nothing about the style under test. So this decodes: every chunk
+ * CRC is verified, the stream must terminate in IEND, the concatenated IDAT
+ * payload must inflate, the inflated raster must be exactly the size the IHDR
+ * geometry implies, and the unfiltered pixels must not be a single flat colour.
+ * Each failure names the artifact and the property that was not met.
+ */
+export function assertRenderedPng(bytes, mediaType, expected) {
+    const where = `rendered artifact ${expected.uri}`;
+    if (mediaType !== expected.mediaType) {
+        throw new Error(`${where} declared media type ${mediaType}; expected ${expected.mediaType}`);
+    }
+    if (bytes.length < PNG_SIGNATURE.length || !PNG_SIGNATURE.every((byte, index) => bytes[index] === byte)) {
+        throw new Error(`${where} is not a PNG: the 8-byte PNG signature is absent`);
+    }
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    let offset = PNG_SIGNATURE.length;
+    let header;
+    const idatParts = [];
+    let sawEnd = false;
+    let palette;
+    let transparency;
+    while (offset + 8 <= bytes.length) {
+        const length = view.getUint32(offset);
+        const type = String.fromCharCode(bytes[offset + 4], bytes[offset + 5], bytes[offset + 6], bytes[offset + 7]);
+        const dataStart = offset + 8;
+        if (dataStart + length + 4 > bytes.length) {
+            throw new Error(`${where} is truncated: chunk ${type} declares ${length} bytes past the end of the artifact`);
+        }
+        const declaredCrc = view.getUint32(dataStart + length);
+        const actualCrc = crc32(bytes, offset + 4, dataStart + length);
+        if (declaredCrc !== actualCrc) {
+            throw new Error(`${where} fails its ${type} chunk CRC (declared ${declaredCrc.toString(16)}, computed ${actualCrc.toString(16)}); the artifact is corrupt and no decoder would accept it`);
+        }
+        if (type === "IHDR") {
+            if (length !== 13)
+                throw new Error(`${where} has a malformed IHDR chunk: ${length} bytes, expected 13`);
+            header = {
+                width: view.getUint32(dataStart),
+                height: view.getUint32(dataStart + 4),
+                bitDepth: bytes[dataStart + 8],
+                colorType: bytes[dataStart + 9],
+                interlace: bytes[dataStart + 12],
+            };
+        }
+        else if (type === "PLTE") {
+            palette = bytes.subarray(dataStart, dataStart + length);
+        }
+        else if (type === "tRNS") {
+            transparency = bytes.subarray(dataStart, dataStart + length);
+        }
+        else if (type === "IDAT") {
+            idatParts.push(bytes.subarray(dataStart, dataStart + length));
+        }
+        else if (type === "IEND") {
+            sawEnd = true;
+            break;
+        }
+        offset = dataStart + length + 4;
+    }
+    if (!header)
+        throw new Error(`${where} carries no IHDR chunk, so it declares no image dimensions`);
+    if (!sawEnd)
+        throw new Error(`${where} never terminates in an IEND chunk; the artifact is incomplete`);
+    if (header.width !== expected.width || header.height !== expected.height) {
+        throw new Error(`${where} is ${header.width}x${header.height}; the renderer reported ${expected.width}x${expected.height}`);
+    }
+    const channels = PNG_CHANNELS[header.colorType];
+    if (channels === undefined)
+        throw new Error(`${where} declares reserved PNG colour type ${header.colorType}`);
+    const idatBytes = idatParts.reduce((total, part) => total + part.length, 0);
+    if (idatBytes === 0) {
+        throw new Error(`${where} carries no IDAT pixel data: the artifact declares a canvas but nothing was drawn on it`);
+    }
+    const legalDepths = {
+        0: [1, 2, 4, 8, 16],
+        2: [8, 16],
+        3: [1, 2, 4, 8],
+        4: [8, 16],
+        6: [8, 16],
+    };
+    if (!legalDepths[header.colorType]?.includes(header.bitDepth) || ![0, 1].includes(header.interlace)) {
+        throw new Error(`${where} declares an invalid PNG bit depth or interlace method`);
+    }
+    if (header.width < 1 || header.height < 1)
+        throw new Error(`${where} has empty PNG dimensions`);
+    if (header.colorType === 3 && (!palette || palette.length === 0 || palette.length % 3 !== 0)) {
+        throw new Error(`${where} has no valid PNG palette`);
+    }
+    // Each Adam7 pass is its own filtered image. Decode all passes; interlacing
+    // must never exempt a render from the raster-shape or visible-content proof.
+    const layout = header.interlace === 1
+        ? [
+            [0, 0, 8, 8],
+            [4, 0, 8, 8],
+            [0, 4, 4, 8],
+            [2, 0, 4, 4],
+            [0, 2, 2, 4],
+            [1, 0, 2, 2],
+            [0, 1, 1, 2],
+        ]
+        : [[0, 0, 1, 1]];
+    const passes = layout.map(([x, y, dx, dy]) => {
+        const width = Math.max(0, Math.ceil((header.width - x) / dx));
+        const height = Math.max(0, Math.ceil((header.height - y) / dy));
+        const rowBytes = Math.ceil((width * channels * header.bitDepth) / 8);
+        return {
+            x: x,
+            y: y,
+            dx: dx,
+            dy: dy,
+            width,
+            height,
+            rowBytes,
+            length: width && height ? height * (rowBytes + 1) : 0,
+        };
+    });
+    const expectedRaster = passes.reduce((total, pass) => total + pass.length, 0);
+    const compressed = Buffer.concat(idatParts.map((part) => Buffer.from(part.buffer, part.byteOffset, part.length)));
+    let raster;
+    try {
+        raster = inflateSync(compressed, { maxOutputLength: expectedRaster + 1 });
+    }
+    catch (error) {
+        throw new Error(`${where} has an IDAT stream that does not inflate within its declared raster size (${error instanceof Error ? error.message : String(error)}); no PNG decoder could render this artifact`);
+    }
+    if (raster.length !== expectedRaster) {
+        throw new Error(`${where} inflates to ${raster.length} raster bytes; the declared PNG needs exactly ${expectedRaster}`);
+    }
+    const maxSample = (1 << header.bitDepth) - 1;
+    const seen = new Set();
+    const decoded = Buffer.alloc(header.width * header.height * 8);
+    let visiblePixelCount = 0;
+    let passOffset = 0;
+    for (const pass of passes) {
+        if (!pass.length)
+            continue;
+        const pixels = unfilterRaster(raster.subarray(passOffset, passOffset + pass.length), pass.height, Math.ceil((channels * header.bitDepth) / 8), pass.rowBytes, where);
+        passOffset += pass.length;
+        for (let row = 0; row < pass.height; row += 1) {
+            for (let column = 0; column < pass.width; column += 1) {
+                const samples = Array.from({ length: channels }, (_, channel) => {
+                    const bit = (column * channels + channel) * header.bitDepth;
+                    const at = row * pass.rowBytes + Math.floor(bit / 8);
+                    return header.bitDepth === 16
+                        ? pixels[at] * 256 + pixels[at + 1]
+                        : (pixels[at] >> (8 - header.bitDepth - (bit % 8))) & maxSample;
+                });
+                let alpha = maxSample;
+                let color = samples;
+                if (header.colorType === 3) {
+                    const index = samples[0];
+                    if (!palette || index * 3 + 2 >= palette.length)
+                        throw new Error(`${where} references a missing PNG palette entry`);
+                    color = Array.from(palette.subarray(index * 3, index * 3 + 3));
+                    alpha = transparency?.[index] ?? 255;
+                }
+                else if (header.colorType === 4 || header.colorType === 6) {
+                    alpha = samples[samples.length - 1];
+                    color = samples.slice(0, -1);
+                }
+                else if (transparency &&
+                    samples.every((sample, index) => transparency[index * 2] !== undefined &&
+                        sample === transparency[index * 2] * 256 + transparency[index * 2 + 1])) {
+                    alpha = 0;
+                }
+                const maximum = header.colorType === 3 ? 255 : maxSample;
+                const rgb = color.length === 1 ? [color[0], color[0], color[0]] : color;
+                const at = ((pass.y + row * pass.dy) * header.width + pass.x + column * pass.dx) * 8;
+                for (const [index, sample] of [...rgb, alpha].entries()) {
+                    decoded.writeUInt16BE(Math.round((sample * 65535) / maximum), at + index * 2);
+                }
+                if (alpha > 0)
+                    visiblePixelCount += 1;
+                // RGB hidden behind zero alpha has no visible content, however many
+                // different byte values the encoder leaves in those channels.
+                if (seen.size < 2)
+                    seen.add(alpha === 0 ? "transparent" : `${color.join(",")}/${alpha}`);
+            }
+        }
+    }
+    if (visiblePixelCount === 0)
+        throw new Error(`${where} decodes to no visible pixels; the render is fully transparent`);
+    if (seen.size < 2) {
+        throw new Error(`${where} decodes to a single flat colour across all ${header.width}x${header.height} pixels: the canvas was painted but no feature was drawn on it, which is what a style/render no-op produces`);
+    }
+    // Checked last, so a structurally explicable artifact is diagnosed by its
+    // structure and only a well-formed but implausibly small render falls through
+    // to the size floor.
+    if (bytes.length < expected.minByteLength) {
+        throw new Error(`${where} is ${bytes.length} bytes; a drawn ${expected.width}x${expected.height} map is at least ` +
+            `${expected.minByteLength}. An empty raster of the right dimensions is what a style/render no-op returns.`);
+    }
+    return {
+        uri: expected.uri,
+        mediaType: expected.mediaType,
+        width: header.width,
+        height: header.height,
+        byteLength: bytes.length,
+        imageSha256: createHash("sha256").update(bytes).digest("hex"),
+        visiblePixelCount,
+        decodedPixelSha256: createHash("sha256").update(decoded).digest("hex"),
+    };
+}
 export class JourneyBlockedError extends Error {
     code;
     constructor(message, code = "dependency-unavailable") {
@@ -81,8 +388,8 @@ export function parseZeroToMapPlan(value) {
     const releaseContract = nonEmptyString(plan.releaseContract, "plan.releaseContract");
     const fixtures = stringArray(plan.fixtures, "plan.fixtures");
     const dependencyRefs = stringArray(plan.dependencyRefs, "plan.dependencyRefs");
-    if (!Array.isArray(plan.stages) || plan.stages.length !== 7) {
-        throw new Error("plan.stages must contain the seven D9.3 stages");
+    if (!Array.isArray(plan.stages) || plan.stages.length !== ZERO_TO_MAP_STAGE_COUNT) {
+        throw new Error(`plan.stages must contain the ${ZERO_TO_MAP_STAGE_COUNT} D9.3 stages`);
     }
     const actionIds = new Set();
     const stages = plan.stages.map((candidate, index) => {
@@ -186,7 +493,20 @@ export async function runZeroToMapJourney(plan, adapter, options) {
                             throw new Error(`${action.id} disclosed forbidden pre-approval evidence at ${pointer}`);
                         }
                     }
-                    const captures = captureValues(action.captures, result.value, variables);
+                    // Capture contracts are where a silent no-op surfaces: the tool
+                    // answers without error but the value it was supposed to change did
+                    // not change. Name the stage, the action and the tool so the operator
+                    // is told which step of the journey did nothing, not merely that some
+                    // pointer disagreed.
+                    let captures;
+                    try {
+                        captures = captureValues(action.captures, result.value, variables);
+                    }
+                    catch (captureError) {
+                        const message = captureError instanceof Error ? captureError.message : String(captureError);
+                        throw new Error(`stage ${stage.number} ${stage.id}, action ${action.id}` +
+                            `${action.kind === "mcp" ? ` (${action.tool})` : ""}: ${message}`);
+                    }
                     Object.assign(variables, captures);
                     Object.assign(capturedVariables, captures);
                     actions.push({
@@ -490,6 +810,23 @@ function requiredMcpToolUses(plan) {
 function describeToolUse(use) {
     return `${use.tool} (stage ${use.stageNumber} ${use.stageId}, action ${use.actionId})`;
 }
+function dimensionTemplate(value, path) {
+    if (typeof value === "string") {
+        if (value.trim().length === 0)
+            throw new Error(`${path} must not be empty`);
+        return value;
+    }
+    if (Number.isInteger(value) && value > 0)
+        return value;
+    throw new Error(`${path} must be a positive integer or a template resolving to one`);
+}
+function resolveDimension(value, variables, path) {
+    const resolved = typeof value === "string" ? resolveTemplateValue(value, variables) : value;
+    if (!Number.isInteger(resolved) || resolved < 1) {
+        throw new Error(`${path} resolved to ${JSON.stringify(resolved)}, which is not a positive integer`);
+    }
+    return resolved;
+}
 function rosterDigest(names) {
     return createHash("sha256")
         .update(`${[...names].sort().join("\n")}\n`)
@@ -517,7 +854,11 @@ function summarizeNames(names, limit = 10) {
  */
 async function assertMcpCatalog(plan, adapter) {
     const requiredUses = requiredMcpToolUses(plan);
-    const catalog = await adapter.listTools();
+    // Explicitly opt out of any server-configured or session-negotiated workflow
+    // view. A candidate with `Mcp:WorkflowViews:DefaultView` set would otherwise
+    // serve a deliberately narrowed catalog and every roster finding below would
+    // name a missing server profile for what is really a discovery setting.
+    const catalog = await adapter.listTools({ view: ZERO_TO_MAP_FULL_CATALOG_VIEW });
     const names = catalog.map((tool) => tool.name);
     const findings = [];
     const duplicateNames = duplicateValues(names);
@@ -627,7 +968,7 @@ async function assertMcpCatalog(plan, adapter) {
     if (names.length !== expectedTotal) {
         const shortfall = expectedTotal - names.length;
         findings.push(shortfall > 0 && duplicateNames.length === 0 && unexpectedAdmin.length === 0
-            ? `truncated: the catalog returned ${names.length} of ${expectedTotal} tools (${shortfall} short). Every tools/list page must be drained before the roster is judged; a short read is a pagination fault, not a roster decision.`
+            ? `truncated: the catalog returned ${names.length} of ${expectedTotal} tools (${shortfall} short). Every tools/list page must be drained before the roster is judged; a short read is a pagination fault, not a roster decision. This preflight already selects view="${ZERO_TO_MAP_FULL_CATALOG_VIEW}", so a candidate workflow view configured through ${ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY} (${ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY}) is not the cause.`
             : `unexpected: the catalog advertises ${names.length} tools; the enabled profiles ` +
                 `(${ZERO_TO_MAP_REQUIRED_PROFILES.join(" + ")}) derive ${expectedTotal}`);
     }
@@ -665,6 +1006,7 @@ async function assertMcpCatalog(plan, adapter) {
     return {
         schemaVersion: ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA,
         activeProfiles: [...ZERO_TO_MAP_REQUIRED_PROFILES],
+        requestedView: ZERO_TO_MAP_FULL_CATALOG_VIEW,
         expectedTotalTools: expectedTotal,
         advertisedTotalTools: names.length,
         baseStaticTools,
@@ -761,6 +1103,17 @@ async function executeAction(action, adapter, variables) {
                 ...action,
                 uri: resolveTemplateString(action.uri, variables),
             });
+        case "mcp-image": {
+            const uri = resolveTemplateString(action.uri, variables);
+            const resolved = { ...action, uri };
+            return adapter.readImageResource(resolved, {
+                uri,
+                mediaType: action.expectedMediaType,
+                width: resolveDimension(action.expectedWidth, variables, `${action.id}.expectedWidth`),
+                height: resolveDimension(action.expectedHeight, variables, `${action.id}.expectedHeight`),
+                minByteLength: action.minByteLength,
+            });
+        }
         case "gpserver":
             return adapter.runGpServer({
                 ...action,
@@ -814,6 +1167,7 @@ function parseAction(value, path, ids) {
     if (kind !== "cli" &&
         kind !== "mcp" &&
         kind !== "mcp-resource" &&
+        kind !== "mcp-image" &&
         kind !== "gpserver" &&
         kind !== "receipt" &&
         kind !== "http") {
@@ -847,6 +1201,20 @@ function parseAction(value, path, ids) {
                 uri: nonEmptyString(action.uri, `${path}.uri`),
                 ...(action.waitFor === undefined ? {} : { waitFor: parseResourceWait(action.waitFor, `${path}.waitFor`) }),
             };
+        case "mcp-image": {
+            if (!Number.isInteger(action.minByteLength) || action.minByteLength < 1) {
+                throw new Error(`${path}.minByteLength must be a positive integer`);
+            }
+            return {
+                ...common,
+                kind,
+                uri: nonEmptyString(action.uri, `${path}.uri`),
+                expectedMediaType: nonEmptyString(action.expectedMediaType, `${path}.expectedMediaType`),
+                expectedWidth: dimensionTemplate(action.expectedWidth, `${path}.expectedWidth`),
+                expectedHeight: dimensionTemplate(action.expectedHeight, `${path}.expectedHeight`),
+                minByteLength: action.minByteLength,
+            };
+        }
         case "gpserver":
             return {
                 ...common,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@honua/mcp-server",
-  "version": "0.1.9-beta.0",
+  "version": "0.1.10-beta.0",
   "description": "Platform-free MCP server for geospatial services: expose discovery, query, and analysis over any public ArcGIS/Esri FeatureServer or OGC API endpoint to any MCP client, with no platform lock-in",
   "license": "Apache-2.0",
   "author": "Honua",
@@ -82,12 +82,13 @@
     "zod": "^3.24.0"
   },
   "overrides": {
-    "hono": "^4.12.27",
+    "hono": "^4.13.7",
     "@hono/node-server": "^2.0.5",
-    "fast-uri": "^3.1.3"
+    "fast-uri": "^3.1.6",
+    "qs": "^6.16.0"
   },
   "peerDependencies": {
-    "@honua/sdk-js": "^0.1.9-beta.0"
+    "@honua/sdk-js": "^0.1.10-beta.0"
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",

package/release/zero-to-map/README.md

@@ -78,6 +78,25 @@ npm run release:zero-to-map -- \
   --output ./zero-to-map-live-receipt.json
 ```
 
+`dbSecretReference` is a request-supplied secret reference: the journey sends
+it to the server, and the server resolves it from its own environment. The
+server the journey runs against must therefore both define that variable (the
+fixture database connection string) and permit it in its allowlist for
+request-supplied secret references (honua-server #5055), which is
+deny-by-default. Permit exactly this one name rather than a prefix, in the
+server's environment:
+
+```sh
+Security__RequestSecretReferences__AllowedEnvironmentVariables__0=HONUA_ZERO_TO_MAP_DB_CONNECTION
+```
+
+Without that entry the `create-connection` action in stage 2 is refused before
+any connection is stored. Server images that predate the setting ignore the
+variable. `honua admin install local` does not write either variable into the
+compose file it generates, so add both to the `honua` service's environment (or
+start an equivalent server yourself) before running with `--execute`. If you
+pass a different `--var dbSecretReference=env:<NAME>`, permit `<NAME>` instead.
+
 The first pass exits `2` with `external-receipt-missing`. It has already run
 stages 1-5 exactly once. Give the checkpoint's resolved
 `consoleReceiptRequest` to the Console producer, carry

package/release/zero-to-map/configs/claude-code.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/claude-desktop.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/cursor.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.9-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }