@honua/mcp-server 0.1.9-beta.0 → 0.1.11-beta.0

package/dist/src/release/zero-to-map.js

@@ -8,46 +8,40 @@ import { publicHttps } from "./zero-to-map-provision.js";
  * not contain a second installer, admin client, or MCP proxy.
  */
 import { createHash } from "node:crypto";
-import { ADMIN_MCP_EXCLUDED_OPERATIONS, ADMIN_MCP_EXCLUDED_OPERATION_COUNT, ADMIN_MCP_EXCLUSION_ROSTER_SHA256, ADMIN_MCP_PUBLISHED_TOOL_NAMES, MCP_DEFAULT_STATIC_TOOL_COUNT, MCP_DEFAULT_TOTAL_TOOL_COUNT, } from "@honua/sdk-js/control-plane";
+import { inflateSync } from "node:zlib";
 export const ZERO_TO_MAP_PLAN_SCHEMA = "honua.zero-to-map.plan/v1";
 export const ZERO_TO_MAP_RECEIPT_SCHEMA = "honua.zero-to-map.receipt/v1";
 export const ZERO_TO_MAP_CONSOLE_RECEIPT_SCHEMA = "honua.zero-to-map.console-receipt/v1";
 export const ZERO_TO_MAP_CONSOLE_RECEIPT_REQUEST_SCHEMA = "honua.zero-to-map.console-receipt-request/v1";
 export const ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA = "honua.zero-to-map.catalog/v1";
-/** Identifier of the always-required default roster. */
-export const ZERO_TO_MAP_BASE_PROFILE_ID = "base";
 /**
- * Additive profiles the zero-to-map journey requires, in receipt order.
+ * Stages in the release journey: install, admin, style, geoprocessing, studio,
+ * proposal, console, artifact. `style` proves a canonical style applied to a
+ * *published* layer reaches rendered pixels. `console` fetches the share URLs
+ * the same admin publish returned; it does not import a second-principal receipt.
+ */
+export const ZERO_TO_MAP_STAGE_COUNT = 8;
+/**
+ * Receipt id for the closed operator roster: the MCP tools this journey calls,
+ * not a 432/441 catalog total and not the `analysis` or `esri-gp` profiles.
+ */
+export const ZERO_TO_MAP_CLOSED_ROSTER_ID = "operator";
+/**
+ * The reserved `tools/list` view name that opts a request back out of any
+ * server-configured or session-negotiated workflow view and returns the
+ * complete paginated catalog (honua-server#3428).
  *
- * `analysis` contributes six members; only `honua_buffer_features` - the
- * MCP-native dataset Buffer verb the journey actually executes - is confirmed
- * by an in-repo artifact. `esri-gp` contributes exactly the three tools named
- * by `release/zero-to-map/contracts/esri-gp-mcp.v1.json`.
+ * The candidate may publish a bounded workflow view and may make one the
+ * default through {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. Selecting a
+ * view can only *narrow* discovery, so a host that configures a default view
+ * would hide tools the journey calls. The preflight always selects this escape
+ * hatch explicitly rather than relying on the candidate having no default.
  */
-export const ZERO_TO_MAP_ADDITIVE_PROFILES = [
-    {
-        id: "analysis",
-        memberCount: 6,
-        confirmedMembers: ["honua_buffer_features"],
-        namePrefixes: [],
-    },
-    {
-        id: "esri-gp",
-        memberCount: 3,
-        confirmedMembers: ["honua_esri_gp_describe_task", "honua_esri_gp_execute_task", "honua_esri_gp_list_tasks"],
-        namePrefixes: ["honua_esri_gp_"],
-    },
-];
-/** Profiles the candidate must advertise before the journey is executable. */
-export const ZERO_TO_MAP_REQUIRED_PROFILES = [
-    ZERO_TO_MAP_BASE_PROFILE_ID,
-    ...ZERO_TO_MAP_ADDITIVE_PROFILES.map((profile) => profile.id),
-];
-/** Tools the base roster contributes: 47 static + 385 published Admin projections. */
-export const ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT = MCP_DEFAULT_STATIC_TOOL_COUNT + ADMIN_MCP_PUBLISHED_TOOL_NAMES.length;
-/** Derived candidate total. Never hardcode this; it follows from the enabled profiles. */
-export const ZERO_TO_MAP_EXPECTED_TOTAL_TOOL_COUNT = ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT +
-    ZERO_TO_MAP_ADDITIVE_PROFILES.reduce((total, profile) => total + profile.memberCount, 0);
+export const ZERO_TO_MAP_FULL_CATALOG_VIEW = "full";
+/** Configuration key whose value would narrow the candidate's default `tools/list`. */
+export const ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY = "Mcp:WorkflowViews:DefaultView";
+/** Environment-variable spelling of {@link ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY}. */
+export const ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY = "Mcp__WorkflowViews__DefaultView";
 const STUDIO_GENERATION_MUTATION_TOOLS = new Set([
     "honua_studio_add_control",
     "honua_studio_add_layer",
@@ -63,6 +57,286 @@ const STUDIO_PUBLICATION_GENERATION_CAPTURE_POINTERS = [
     "/structuredContent/draft/generation",
     "/structuredContent/generation",
 ];
+const PNG_SIGNATURE = Uint8Array.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+/** Channels per pixel for each PNG colour type; `undefined` marks a reserved value. */
+const PNG_CHANNELS = { 0: 1, 2: 3, 3: 1, 4: 2, 6: 4 };
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let index = 0; index < 256; index += 1) {
+        let value = index;
+        for (let bit = 0; bit < 8; bit += 1)
+            value = value & 1 ? 0xed_b8_83_20 ^ (value >>> 1) : value >>> 1;
+        table[index] = value >>> 0;
+    }
+    return table;
+})();
+/** PNG chunk CRC-32 over the type bytes followed by the chunk data. */
+function crc32(bytes, start, end) {
+    let crc = 0xff_ff_ff_ff;
+    for (let index = start; index < end; index += 1)
+        crc = CRC_TABLE[(crc ^ bytes[index]) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xff_ff_ff_ff) >>> 0;
+}
+/**
+ * Reverse the PNG per-scanline filters so the raster can be inspected as pixels
+ * rather than as filtered bytes. Filter types are PNG spec 9.2; an unknown type
+ * is a corrupt raster, not something to skip past.
+ */
+function unfilterRaster(raster, height, bytesPerPixel, bytesPerRow, where) {
+    const out = new Uint8Array(height * bytesPerRow);
+    const step = Math.max(1, bytesPerPixel);
+    for (let row = 0; row < height; row += 1) {
+        const filter = raster[row * (bytesPerRow + 1)];
+        const from = row * (bytesPerRow + 1) + 1;
+        const to = row * bytesPerRow;
+        const above = (row - 1) * bytesPerRow;
+        for (let index = 0; index < bytesPerRow; index += 1) {
+            const raw = raster[from + index];
+            const left = index >= step ? out[to + index - step] : 0;
+            const up = row > 0 ? out[above + index] : 0;
+            const upLeft = row > 0 && index >= step ? out[above + index - step] : 0;
+            let value;
+            switch (filter) {
+                case 0:
+                    value = raw;
+                    break;
+                case 1:
+                    value = raw + left;
+                    break;
+                case 2:
+                    value = raw + up;
+                    break;
+                case 3:
+                    value = raw + ((left + up) >> 1);
+                    break;
+                case 4: {
+                    const estimate = left + up - upLeft;
+                    const dLeft = Math.abs(estimate - left);
+                    const dUp = Math.abs(estimate - up);
+                    const dUpLeft = Math.abs(estimate - upLeft);
+                    value = raw + (dLeft <= dUp && dLeft <= dUpLeft ? left : dUp <= dUpLeft ? up : upLeft);
+                    break;
+                }
+                default:
+                    throw new Error(`${where} uses unknown PNG filter type ${filter} on row ${row}; the raster is corrupt`);
+            }
+            out[to + index] = value & 0xff;
+        }
+    }
+    return out;
+}
+/**
+ * Validate that fetched bytes are a PNG of the declared size that actually
+ * decodes to a drawn map.
+ *
+ * A style/render no-op is not a transport failure: the tool answers, the
+ * resource resolves, and the bytes may even be a syntactically plausible PNG.
+ * Structural checks alone are not enough to tell those apart - a blob whose
+ * chunks are merely *labelled* IDAT passes any counter that only sums chunk
+ * lengths, and a correctly-sized PNG of uniform background is a valid image
+ * that proves nothing about the style under test. So this decodes: every chunk
+ * CRC is verified, the stream must terminate in IEND, the concatenated IDAT
+ * payload must inflate, the inflated raster must be exactly the size the IHDR
+ * geometry implies, and the unfiltered pixels must not be a single flat colour.
+ * Each failure names the artifact and the property that was not met.
+ */
+export function assertRenderedPng(bytes, mediaType, expected) {
+    const where = `rendered artifact ${expected.uri}`;
+    if (mediaType !== expected.mediaType) {
+        throw new Error(`${where} declared media type ${mediaType}; expected ${expected.mediaType}`);
+    }
+    if (bytes.length < PNG_SIGNATURE.length || !PNG_SIGNATURE.every((byte, index) => bytes[index] === byte)) {
+        throw new Error(`${where} is not a PNG: the 8-byte PNG signature is absent`);
+    }
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    let offset = PNG_SIGNATURE.length;
+    let header;
+    const idatParts = [];
+    let sawEnd = false;
+    let palette;
+    let transparency;
+    while (offset + 8 <= bytes.length) {
+        const length = view.getUint32(offset);
+        const type = String.fromCharCode(bytes[offset + 4], bytes[offset + 5], bytes[offset + 6], bytes[offset + 7]);
+        const dataStart = offset + 8;
+        if (dataStart + length + 4 > bytes.length) {
+            throw new Error(`${where} is truncated: chunk ${type} declares ${length} bytes past the end of the artifact`);
+        }
+        const declaredCrc = view.getUint32(dataStart + length);
+        const actualCrc = crc32(bytes, offset + 4, dataStart + length);
+        if (declaredCrc !== actualCrc) {
+            throw new Error(`${where} fails its ${type} chunk CRC (declared ${declaredCrc.toString(16)}, computed ${actualCrc.toString(16)}); the artifact is corrupt and no decoder would accept it`);
+        }
+        if (type === "IHDR") {
+            if (length !== 13)
+                throw new Error(`${where} has a malformed IHDR chunk: ${length} bytes, expected 13`);
+            header = {
+                width: view.getUint32(dataStart),
+                height: view.getUint32(dataStart + 4),
+                bitDepth: bytes[dataStart + 8],
+                colorType: bytes[dataStart + 9],
+                interlace: bytes[dataStart + 12],
+            };
+        }
+        else if (type === "PLTE") {
+            palette = bytes.subarray(dataStart, dataStart + length);
+        }
+        else if (type === "tRNS") {
+            transparency = bytes.subarray(dataStart, dataStart + length);
+        }
+        else if (type === "IDAT") {
+            idatParts.push(bytes.subarray(dataStart, dataStart + length));
+        }
+        else if (type === "IEND") {
+            sawEnd = true;
+            break;
+        }
+        offset = dataStart + length + 4;
+    }
+    if (!header)
+        throw new Error(`${where} carries no IHDR chunk, so it declares no image dimensions`);
+    if (!sawEnd)
+        throw new Error(`${where} never terminates in an IEND chunk; the artifact is incomplete`);
+    if (header.width !== expected.width || header.height !== expected.height) {
+        throw new Error(`${where} is ${header.width}x${header.height}; the renderer reported ${expected.width}x${expected.height}`);
+    }
+    const channels = PNG_CHANNELS[header.colorType];
+    if (channels === undefined)
+        throw new Error(`${where} declares reserved PNG colour type ${header.colorType}`);
+    const idatBytes = idatParts.reduce((total, part) => total + part.length, 0);
+    if (idatBytes === 0) {
+        throw new Error(`${where} carries no IDAT pixel data: the artifact declares a canvas but nothing was drawn on it`);
+    }
+    const legalDepths = {
+        0: [1, 2, 4, 8, 16],
+        2: [8, 16],
+        3: [1, 2, 4, 8],
+        4: [8, 16],
+        6: [8, 16],
+    };
+    if (!legalDepths[header.colorType]?.includes(header.bitDepth) || ![0, 1].includes(header.interlace)) {
+        throw new Error(`${where} declares an invalid PNG bit depth or interlace method`);
+    }
+    if (header.width < 1 || header.height < 1)
+        throw new Error(`${where} has empty PNG dimensions`);
+    if (header.colorType === 3 && (!palette || palette.length === 0 || palette.length % 3 !== 0)) {
+        throw new Error(`${where} has no valid PNG palette`);
+    }
+    // Each Adam7 pass is its own filtered image. Decode all passes; interlacing
+    // must never exempt a render from the raster-shape or visible-content proof.
+    const layout = header.interlace === 1
+        ? [
+            [0, 0, 8, 8],
+            [4, 0, 8, 8],
+            [0, 4, 4, 8],
+            [2, 0, 4, 4],
+            [0, 2, 2, 4],
+            [1, 0, 2, 2],
+            [0, 1, 1, 2],
+        ]
+        : [[0, 0, 1, 1]];
+    const passes = layout.map(([x, y, dx, dy]) => {
+        const width = Math.max(0, Math.ceil((header.width - x) / dx));
+        const height = Math.max(0, Math.ceil((header.height - y) / dy));
+        const rowBytes = Math.ceil((width * channels * header.bitDepth) / 8);
+        return {
+            x: x,
+            y: y,
+            dx: dx,
+            dy: dy,
+            width,
+            height,
+            rowBytes,
+            length: width && height ? height * (rowBytes + 1) : 0,
+        };
+    });
+    const expectedRaster = passes.reduce((total, pass) => total + pass.length, 0);
+    const compressed = Buffer.concat(idatParts.map((part) => Buffer.from(part.buffer, part.byteOffset, part.length)));
+    let raster;
+    try {
+        raster = inflateSync(compressed, { maxOutputLength: expectedRaster + 1 });
+    }
+    catch (error) {
+        throw new Error(`${where} has an IDAT stream that does not inflate within its declared raster size (${error instanceof Error ? error.message : String(error)}); no PNG decoder could render this artifact`);
+    }
+    if (raster.length !== expectedRaster) {
+        throw new Error(`${where} inflates to ${raster.length} raster bytes; the declared PNG needs exactly ${expectedRaster}`);
+    }
+    const maxSample = (1 << header.bitDepth) - 1;
+    const seen = new Set();
+    const decoded = Buffer.alloc(header.width * header.height * 8);
+    let visiblePixelCount = 0;
+    let passOffset = 0;
+    for (const pass of passes) {
+        if (!pass.length)
+            continue;
+        const pixels = unfilterRaster(raster.subarray(passOffset, passOffset + pass.length), pass.height, Math.ceil((channels * header.bitDepth) / 8), pass.rowBytes, where);
+        passOffset += pass.length;
+        for (let row = 0; row < pass.height; row += 1) {
+            for (let column = 0; column < pass.width; column += 1) {
+                const samples = Array.from({ length: channels }, (_, channel) => {
+                    const bit = (column * channels + channel) * header.bitDepth;
+                    const at = row * pass.rowBytes + Math.floor(bit / 8);
+                    return header.bitDepth === 16
+                        ? pixels[at] * 256 + pixels[at + 1]
+                        : (pixels[at] >> (8 - header.bitDepth - (bit % 8))) & maxSample;
+                });
+                let alpha = maxSample;
+                let color = samples;
+                if (header.colorType === 3) {
+                    const index = samples[0];
+                    if (!palette || index * 3 + 2 >= palette.length)
+                        throw new Error(`${where} references a missing PNG palette entry`);
+                    color = Array.from(palette.subarray(index * 3, index * 3 + 3));
+                    alpha = transparency?.[index] ?? 255;
+                }
+                else if (header.colorType === 4 || header.colorType === 6) {
+                    alpha = samples[samples.length - 1];
+                    color = samples.slice(0, -1);
+                }
+                else if (transparency &&
+                    samples.every((sample, index) => transparency[index * 2] !== undefined &&
+                        sample === transparency[index * 2] * 256 + transparency[index * 2 + 1])) {
+                    alpha = 0;
+                }
+                const maximum = header.colorType === 3 ? 255 : maxSample;
+                const rgb = color.length === 1 ? [color[0], color[0], color[0]] : color;
+                const at = ((pass.y + row * pass.dy) * header.width + pass.x + column * pass.dx) * 8;
+                for (const [index, sample] of [...rgb, alpha].entries()) {
+                    decoded.writeUInt16BE(Math.round((sample * 65535) / maximum), at + index * 2);
+                }
+                if (alpha > 0)
+                    visiblePixelCount += 1;
+                // RGB hidden behind zero alpha has no visible content, however many
+                // different byte values the encoder leaves in those channels.
+                if (seen.size < 2)
+                    seen.add(alpha === 0 ? "transparent" : `${color.join(",")}/${alpha}`);
+            }
+        }
+    }
+    if (visiblePixelCount === 0)
+        throw new Error(`${where} decodes to no visible pixels; the render is fully transparent`);
+    if (seen.size < 2) {
+        throw new Error(`${where} decodes to a single flat colour across all ${header.width}x${header.height} pixels: the canvas was painted but no feature was drawn on it, which is what a style/render no-op produces`);
+    }
+    // Checked last, so a structurally explicable artifact is diagnosed by its
+    // structure and only a well-formed but implausibly small render falls through
+    // to the size floor.
+    if (bytes.length < expected.minByteLength) {
+        throw new Error(`${where} is ${bytes.length} bytes; a drawn ${expected.width}x${expected.height} map is at least ` +
+            `${expected.minByteLength}. An empty raster of the right dimensions is what a style/render no-op returns.`);
+    }
+    return {
+        uri: expected.uri,
+        mediaType: expected.mediaType,
+        width: header.width,
+        height: header.height,
+        byteLength: bytes.length,
+        imageSha256: createHash("sha256").update(bytes).digest("hex"),
+        visiblePixelCount,
+        decodedPixelSha256: createHash("sha256").update(decoded).digest("hex"),
+    };
+}
 export class JourneyBlockedError extends Error {
     code;
     constructor(message, code = "dependency-unavailable") {
@@ -81,8 +355,8 @@ export function parseZeroToMapPlan(value) {
     const releaseContract = nonEmptyString(plan.releaseContract, "plan.releaseContract");
     const fixtures = stringArray(plan.fixtures, "plan.fixtures");
     const dependencyRefs = stringArray(plan.dependencyRefs, "plan.dependencyRefs");
-    if (!Array.isArray(plan.stages) || plan.stages.length !== 7) {
-        throw new Error("plan.stages must contain the seven D9.3 stages");
+    if (!Array.isArray(plan.stages) || plan.stages.length !== ZERO_TO_MAP_STAGE_COUNT) {
+        throw new Error(`plan.stages must contain the ${ZERO_TO_MAP_STAGE_COUNT} D9.3 stages`);
     }
     const actionIds = new Set();
     const stages = plan.stages.map((candidate, index) => {
@@ -186,7 +460,20 @@ export async function runZeroToMapJourney(plan, adapter, options) {
                             throw new Error(`${action.id} disclosed forbidden pre-approval evidence at ${pointer}`);
                         }
                     }
-                    const captures = captureValues(action.captures, result.value, variables);
+                    // Capture contracts are where a silent no-op surfaces: the tool
+                    // answers without error but the value it was supposed to change did
+                    // not change. Name the stage, the action and the tool so the operator
+                    // is told which step of the journey did nothing, not merely that some
+                    // pointer disagreed.
+                    let captures;
+                    try {
+                        captures = captureValues(action.captures, result.value, variables);
+                    }
+                    catch (captureError) {
+                        const message = captureError instanceof Error ? captureError.message : String(captureError);
+                        throw new Error(`stage ${stage.number} ${stage.id}, action ${action.id}` +
+                            `${action.kind === "mcp" ? ` (${action.tool})` : ""}: ${message}`);
+                    }
                     Object.assign(variables, captures);
                     Object.assign(capturedVariables, captures);
                     actions.push({
@@ -490,6 +777,23 @@ function requiredMcpToolUses(plan) {
 function describeToolUse(use) {
     return `${use.tool} (stage ${use.stageNumber} ${use.stageId}, action ${use.actionId})`;
 }
+function dimensionTemplate(value, path) {
+    if (typeof value === "string") {
+        if (value.trim().length === 0)
+            throw new Error(`${path} must not be empty`);
+        return value;
+    }
+    if (Number.isInteger(value) && value > 0)
+        return value;
+    throw new Error(`${path} must be a positive integer or a template resolving to one`);
+}
+function resolveDimension(value, variables, path) {
+    const resolved = typeof value === "string" ? resolveTemplateValue(value, variables) : value;
+    if (!Number.isInteger(resolved) || resolved < 1) {
+        throw new Error(`${path} resolved to ${JSON.stringify(resolved)}, which is not a positive integer`);
+    }
+    return resolved;
+}
 function rosterDigest(names) {
     return createHash("sha256")
         .update(`${[...names].sort().join("\n")}\n`)
@@ -503,144 +807,92 @@ function summarizeNames(names, limit = 10) {
         ? `${sorted.slice(0, limit).join(", ")}, ... (+${sorted.length - limit})`
         : sorted.join(", ");
 }
+/**
+ * Distinct MCP tools the plan calls, sorted. This is the closed operator roster.
+ * A server may advertise more; the preflight does not require a catalog total.
+ */
+export function zeroToMapClosedRoster(plan) {
+    return [...new Set(requiredMcpToolUses(plan).map((use) => use.tool))].sort();
+}
+/**
+ * Turn a share URL into an absolute request URL.
+ *
+ * Admin publication returns `StudioPublishedRoutes.BuildActiveUrl`, a
+ * root-relative `/api/v1/studio/published/...` path. Live mode resolves that
+ * path against the MCP endpoint origin. Absolute HTTPS is accepted as-is.
+ * HTTP is accepted only for a loopback origin, which is the local-install proof.
+ */
+export function resolvePublishedShareUrl(url, mcpUrl) {
+    if (url.includes("${"))
+        throw new Error("published share URL was not resolved");
+    const absolute = url.startsWith("/") ? joinSharePath(url, mcpUrl) : url;
+    let requested;
+    try {
+        requested = new URL(absolute);
+    }
+    catch {
+        throw new Error("published share URL must be HTTPS, or HTTP on a loopback origin");
+    }
+    if (requested.username || requested.password || requested.search || requested.hash) {
+        throw new Error("published share URL must not embed credentials, query, or fragment");
+    }
+    const loopback = requested.hostname === "localhost" || requested.hostname === "127.0.0.1" || requested.hostname === "::1";
+    if (requested.protocol === "https:" || (requested.protocol === "http:" && loopback))
+        return requested.toString();
+    throw new Error("published share URL must be HTTPS, or HTTP on a loopback origin");
+}
+function joinSharePath(path, mcpUrl) {
+    if (!mcpUrl)
+        throw new Error("a root-relative share URL requires the MCP endpoint origin");
+    let endpoint;
+    try {
+        endpoint = new URL(mcpUrl);
+    }
+    catch {
+        throw new Error("a root-relative share URL requires the MCP endpoint origin");
+    }
+    return `${endpoint.origin}${path}`;
+}
 /**
  * Preflight the advertised MCP catalog before the first live mutation.
  *
- * The base roster, the audited exclusions and each enabled server profile are
- * verified independently, and the expected total is *derived* from those
- * rosters rather than written down. A previous revision required the catalog
- * to equal the 432-tool default roster while the journey simultaneously
- * required analysis and Esri GP tools, so no candidate configuration could
- * pass. Findings are reported per cause (missing / unexpected / duplicate /
- * excluded / truncated / drifted) and name the journey stage and action that
- * needs the tool.
+ * The closed roster is the set of tools this journey calls. The preflight does
+ * not require a 432- or 441-tool catalog, and it does not require the
+ * `analysis` or `esri-gp` profiles. A missing member names the stage and
+ * action that needs it. Extra advertised tools are not a failure: the server
+ * may publish more than this journey uses. Input-schema drift on a planned
+ * call still blocks before that call is sent.
  */
 async function assertMcpCatalog(plan, adapter) {
     const requiredUses = requiredMcpToolUses(plan);
-    const catalog = await adapter.listTools();
+    const closedRoster = zeroToMapClosedRoster(plan);
+    // Opt out of any server-configured or session-negotiated workflow view. A
+    // candidate with `Mcp:WorkflowViews:DefaultView` set would otherwise hide
+    // tools this journey calls, and the finding would look like a missing tool
+    // rather than a discovery setting.
+    const catalog = await adapter.listTools({ view: ZERO_TO_MAP_FULL_CATALOG_VIEW });
     const names = catalog.map((tool) => tool.name);
     const findings = [];
     const duplicateNames = duplicateValues(names);
     if (duplicateNames.length > 0) {
         findings.push(`duplicate: the catalog advertises ${summarizeNames(duplicateNames)} more than once`);
     }
-    // --- base profile: the 385 published Admin projections ---------------------
-    const advertisedAdmin = names.filter((name) => name.startsWith("honua_admin_"));
-    const advertisedAdminSet = new Set(advertisedAdmin);
-    const expectedAdmin = new Set(ADMIN_MCP_PUBLISHED_TOOL_NAMES);
-    const missingAdmin = [...expectedAdmin].filter((name) => !advertisedAdminSet.has(name)).sort();
-    const unexpectedAdmin = [...advertisedAdminSet].filter((name) => !expectedAdmin.has(name)).sort();
-    if (missingAdmin.length > 0) {
-        findings.push(`missing: ${missingAdmin.length} of the ${expectedAdmin.size} published Admin projections are absent ` +
-            `(${summarizeNames(missingAdmin)})`);
-    }
-    if (unexpectedAdmin.length > 0) {
-        findings.push(`unexpected: the catalog advertises unpublished Admin tools ${summarizeNames(unexpectedAdmin)}`);
-    }
-    // --- base profile: the 11 audited secret/session exclusions ----------------
-    const excludedToolNames = ADMIN_MCP_EXCLUDED_OPERATIONS.map((operation) => operation.toolName);
-    if (excludedToolNames.length !== ADMIN_MCP_EXCLUDED_OPERATION_COUNT) {
-        findings.push(`excluded: the generated exclusion roster carries ${excludedToolNames.length} operations; the audited ` +
-            `contract requires ${ADMIN_MCP_EXCLUDED_OPERATION_COUNT}`);
-    }
-    const advertisedExclusions = excludedToolNames.filter((name) => advertisedAdminSet.has(name)).sort();
-    if (advertisedExclusions.length > 0) {
-        findings.push(`excluded: the catalog advertises audited secret/session operations ${summarizeNames(advertisedExclusions)}`);
-    }
-    // --- additive profiles, verified independently -----------------------------
-    const nonAdminNames = names.filter((name) => !name.startsWith("honua_admin_"));
-    const namedProfiles = ZERO_TO_MAP_ADDITIVE_PROFILES.filter((profile) => profile.namePrefixes.length > 0);
-    const fallbackProfile = ZERO_TO_MAP_ADDITIVE_PROFILES.find((profile) => profile.namePrefixes.length === 0);
-    const claimed = new Set();
-    const profileReceipts = [];
-    for (const profile of namedProfiles) {
-        const members = nonAdminNames.filter((name) => profile.namePrefixes.some((prefix) => name.startsWith(prefix)));
-        for (const member of members)
-            claimed.add(member);
-        const memberSet = new Set(members);
-        const missingMembers = profile.confirmedMembers.filter((name) => !memberSet.has(name)).sort();
-        const unexpectedMembers = [...memberSet].filter((name) => !profile.confirmedMembers.includes(name)).sort();
-        if (missingMembers.length > 0) {
-            findings.push(`missing: the ${profile.id} profile is not advertised - ${missingMembers
-                .map((tool) => {
-                const use = requiredUses.find((candidate) => candidate.tool === tool);
-                return use ? describeToolUse(use) : tool;
-            })
-                .join(", ")}. Enable the ${profile.id} server profile on the candidate and rerun.`);
-        }
-        if (unexpectedMembers.length > 0) {
-            findings.push(`unexpected: the ${profile.id} profile advertises ${summarizeNames(unexpectedMembers)}, which the checked-in profile contract does not declare`);
-        }
-        if (members.length !== profile.memberCount) {
-            findings.push(`${members.length < profile.memberCount ? "missing" : "unexpected"}: the ${profile.id} profile advertises ` +
-                `${members.length} members; the profile contract declares ${profile.memberCount}`);
-        }
-        profileReceipts.push({
-            id: profile.id,
-            expectedMembers: profile.memberCount,
-            advertisedMembers: members.length,
-            confirmedMembers: [...profile.confirmedMembers].sort(),
-            nameResolvedMembers: [...members].sort(),
-            rosterSha256: rosterDigest(members),
-        });
-    }
-    // The fallback profile's members are not separable from the base static
-    // surface by name (the server has not published an `analysis` roster yet:
-    // honua-server#3363). It is therefore verified by its confirmed members plus
-    // its declared size, and the base static count is derived from the residue.
-    const residue = nonAdminNames.filter((name) => !claimed.has(name));
-    const fallbackMembers = fallbackProfile ? residue.length - MCP_DEFAULT_STATIC_TOOL_COUNT : 0;
-    const baseStaticTools = residue.length - fallbackMembers;
-    if (fallbackProfile) {
-        const residueSet = new Set(residue);
-        const missingMembers = fallbackProfile.confirmedMembers.filter((name) => !residueSet.has(name)).sort();
-        if (missingMembers.length > 0) {
-            findings.push(`missing: the ${fallbackProfile.id} profile is not advertised - ${missingMembers
-                .map((tool) => {
-                const use = requiredUses.find((candidate) => candidate.tool === tool);
-                return use ? describeToolUse(use) : tool;
-            })
-                .join(", ")}. Enable the ${fallbackProfile.id} server profile on the candidate and rerun.`);
-        }
-        if (fallbackMembers !== fallbackProfile.memberCount) {
-            findings.push(`${fallbackMembers < fallbackProfile.memberCount ? "missing" : "unexpected"}: the non-Admin surface ` +
-                `advertises ${residue.length} tools; the base static roster (${MCP_DEFAULT_STATIC_TOOL_COUNT}) plus the ` +
-                `${fallbackProfile.id} profile (${fallbackProfile.memberCount}) derive ` +
-                `${MCP_DEFAULT_STATIC_TOOL_COUNT + fallbackProfile.memberCount}`);
-        }
-        profileReceipts.push({
-            id: fallbackProfile.id,
-            expectedMembers: fallbackProfile.memberCount,
-            advertisedMembers: Math.max(fallbackMembers, 0),
-            confirmedMembers: [...fallbackProfile.confirmedMembers].sort(),
-            nameResolvedMembers: [...fallbackProfile.confirmedMembers].filter((name) => residueSet.has(name)).sort(),
-            rosterSha256: rosterDigest(residue),
-        });
-    }
-    // --- derived totals --------------------------------------------------------
-    if (ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT !== MCP_DEFAULT_TOTAL_TOOL_COUNT) {
-        findings.push(`unexpected: the generated base roster derives ${MCP_DEFAULT_STATIC_TOOL_COUNT} static + ${expectedAdmin.size} ` +
-            `Admin = ${ZERO_TO_MAP_BASE_PROFILE_TOOL_COUNT} tools, but the default roster constant is ` +
-            `${MCP_DEFAULT_TOTAL_TOOL_COUNT}`);
-    }
-    const expectedTotal = ZERO_TO_MAP_EXPECTED_TOTAL_TOOL_COUNT;
-    if (names.length !== expectedTotal) {
-        const shortfall = expectedTotal - names.length;
-        findings.push(shortfall > 0 && duplicateNames.length === 0 && unexpectedAdmin.length === 0
-            ? `truncated: the catalog returned ${names.length} of ${expectedTotal} tools (${shortfall} short). Every tools/list page must be drained before the roster is judged; a short read is a pagination fault, not a roster decision.`
-            : `unexpected: the catalog advertises ${names.length} tools; the enabled profiles ` +
-                `(${ZERO_TO_MAP_REQUIRED_PROFILES.join(" + ")}) derive ${expectedTotal}`);
+    const advertised = new Map(catalog.map((tool) => [tool.name, tool]));
+    const missing = closedRoster.filter((tool) => !advertised.has(tool));
+    if (missing.length > 0) {
+        const described = missing
+            .map((tool) => requiredUses
+            .filter((use) => use.tool === tool)
+            .map(describeToolUse)
+            .join(", "))
+            .join("; ");
+        findings.push(`missing: the ${ZERO_TO_MAP_CLOSED_ROSTER_ID} roster is not advertised - ${described}. ` +
+            `This preflight already selects view="${ZERO_TO_MAP_FULL_CATALOG_VIEW}", so a candidate workflow view ` +
+            `configured through ${ZERO_TO_MAP_WORKFLOW_VIEW_CONFIG_KEY} (${ZERO_TO_MAP_WORKFLOW_VIEW_ENV_KEY}) is not the cause.`);
     }
     if (findings.length > 0) {
-        throw new JourneyBlockedError(`MCP catalog preflight failed for profiles ${ZERO_TO_MAP_REQUIRED_PROFILES.join(" + ")}: ${findings.join("; ")}`, "mcp-catalog-incomplete");
-    }
-    // --- every tool the plan actually calls ------------------------------------
-    const advertised = new Map(catalog.map((tool) => [tool.name, tool]));
-    const missingRequired = [...new Set(requiredUses.map((use) => use.tool))].filter((tool) => !advertised.has(tool));
-    if (missingRequired.length > 0) {
-        throw new JourneyBlockedError(`MCP catalog is missing required tools: ${missingRequired.join(", ")}`, "mcp-catalog-incomplete");
+        throw new JourneyBlockedError(`MCP catalog preflight failed for the ${ZERO_TO_MAP_CLOSED_ROSTER_ID} roster: ${findings.join("; ")}`, "mcp-catalog-incomplete");
     }
-    // --- input-schema drift on every planned call ------------------------------
     for (const stage of plan.stages) {
         for (const action of stage.actions) {
             if (action.kind !== "mcp")
@@ -662,19 +914,33 @@ async function assertMcpCatalog(plan, adapter) {
             }
         }
     }
+    const adminNames = names.filter((name) => name.startsWith("honua_admin_"));
+    const staticNames = names.filter((name) => !name.startsWith("honua_admin_"));
+    const closedAdmin = closedRoster.filter((name) => name.startsWith("honua_admin_"));
+    const closedStatic = closedRoster.filter((name) => !name.startsWith("honua_admin_"));
     return {
         schemaVersion: ZERO_TO_MAP_CATALOG_RECEIPT_SCHEMA,
-        activeProfiles: [...ZERO_TO_MAP_REQUIRED_PROFILES],
-        expectedTotalTools: expectedTotal,
+        activeProfiles: [ZERO_TO_MAP_CLOSED_ROSTER_ID],
+        requestedView: ZERO_TO_MAP_FULL_CATALOG_VIEW,
+        expectedTotalTools: closedRoster.length,
         advertisedTotalTools: names.length,
-        baseStaticTools,
-        baseAdminTools: advertisedAdmin.length,
-        auditedExclusions: excludedToolNames.length,
-        profiles: profileReceipts,
+        baseStaticTools: closedStatic.length,
+        baseAdminTools: closedAdmin.length,
+        auditedExclusions: 0,
+        profiles: [
+            {
+                id: ZERO_TO_MAP_CLOSED_ROSTER_ID,
+                expectedMembers: closedRoster.length,
+                advertisedMembers: closedRoster.length,
+                confirmedMembers: closedRoster,
+                nameResolvedMembers: closedRoster,
+                rosterSha256: rosterDigest(closedRoster),
+            },
+        ],
         catalogSha256: rosterDigest(names),
-        adminRosterSha256: rosterDigest(advertisedAdmin),
-        staticRosterSha256: rosterDigest(residue),
-        exclusionRosterSha256: ADMIN_MCP_EXCLUSION_ROSTER_SHA256,
+        adminRosterSha256: rosterDigest(adminNames),
+        staticRosterSha256: rosterDigest(staticNames),
+        exclusionRosterSha256: rosterDigest([]),
     };
 }
 function duplicateValues(values) {
@@ -761,6 +1027,17 @@ async function executeAction(action, adapter, variables) {
                 ...action,
                 uri: resolveTemplateString(action.uri, variables),
             });
+        case "mcp-image": {
+            const uri = resolveTemplateString(action.uri, variables);
+            const resolved = { ...action, uri };
+            return adapter.readImageResource(resolved, {
+                uri,
+                mediaType: action.expectedMediaType,
+                width: resolveDimension(action.expectedWidth, variables, `${action.id}.expectedWidth`),
+                height: resolveDimension(action.expectedHeight, variables, `${action.id}.expectedHeight`),
+                minByteLength: action.minByteLength,
+            });
+        }
         case "gpserver":
             return adapter.runGpServer({
                 ...action,
@@ -814,6 +1091,7 @@ function parseAction(value, path, ids) {
     if (kind !== "cli" &&
         kind !== "mcp" &&
         kind !== "mcp-resource" &&
+        kind !== "mcp-image" &&
         kind !== "gpserver" &&
         kind !== "receipt" &&
         kind !== "http") {
@@ -847,6 +1125,20 @@ function parseAction(value, path, ids) {
                 uri: nonEmptyString(action.uri, `${path}.uri`),
                 ...(action.waitFor === undefined ? {} : { waitFor: parseResourceWait(action.waitFor, `${path}.waitFor`) }),
             };
+        case "mcp-image": {
+            if (!Number.isInteger(action.minByteLength) || action.minByteLength < 1) {
+                throw new Error(`${path}.minByteLength must be a positive integer`);
+            }
+            return {
+                ...common,
+                kind,
+                uri: nonEmptyString(action.uri, `${path}.uri`),
+                expectedMediaType: nonEmptyString(action.expectedMediaType, `${path}.expectedMediaType`),
+                expectedWidth: dimensionTemplate(action.expectedWidth, `${path}.expectedWidth`),
+                expectedHeight: dimensionTemplate(action.expectedHeight, `${path}.expectedHeight`),
+                minByteLength: action.minByteLength,
+            };
+        }
         case "gpserver":
             return {
                 ...common,