@honua/mcp-server 0.1.9-beta.0 → 0.1.11-beta.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@honua/mcp-server",
-  "version": "0.1.9-beta.0",
+  "version": "0.1.11-beta.0",
   "description": "Platform-free MCP server for geospatial services: expose discovery, query, and analysis over any public ArcGIS/Esri FeatureServer or OGC API endpoint to any MCP client, with no platform lock-in",
   "license": "Apache-2.0",
   "author": "Honua",
@@ -56,6 +56,7 @@
     "test:certification": "npm run build --silent && vitest run test/certification && node dist/src/certification/cli.js",
     "test:certification:admin": "vitest run test/proxy.test.ts test/certification/admin-parity.test.ts",
     "certify:admin-parity": "npm run build --silent && node dist/src/certification/admin-parity.js",
+    "certify:setup-parity": "npm run build --silent && node dist/src/certification/setup-parity.js",
     "test:certification:artifact": "npm run build --silent && node dist/src/certification/cli.js --artifact-only",
     "test:certification:standalone": "npm run build --silent && node dist/src/certification/cli.js --target standalone",
     "test:certification:standalone-ogc": "npm run build --silent && node dist/src/certification/cli.js --target standalone-ogc",
@@ -82,12 +83,13 @@
     "zod": "^3.24.0"
   },
   "overrides": {
-    "hono": "^4.12.27",
+    "hono": "^4.13.7",
     "@hono/node-server": "^2.0.5",
-    "fast-uri": "^3.1.3"
+    "fast-uri": "^3.1.6",
+    "qs": "^6.16.0"
   },
   "peerDependencies": {
-    "@honua/sdk-js": "^0.1.9-beta.0"
+    "@honua/sdk-js": "^0.1.11-beta.0"
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",
@@ -101,6 +103,7 @@
     "dist/src",
     "release/zero-to-map",
     "certification/geospatial-mcp-schemas",
+    "certification/setup-parity.md",
     "README.md",
     "LICENSE"
   ],

package/release/zero-to-map/README.md

@@ -1,15 +1,25 @@
 # Zero-to-map 2026.1 release journey
 
+The September 9 release decision on #1401 narrows first-cut qualification.
+This older journey still exercises the broader Admin/analysis and multi-family
+Studio integration. Its roster is not the bounded 2026.1 setup gate. Use the
+[pinned setup catalog check](../../certification/setup-parity.md) for that
+gate's HTTP/stdio discovery evidence; retain separate install and style/render
+execution receipts. Full Admin MCP and broader analysis qualification remain
+outside the bounded first-cut dependency chain.
+
 This bundle is the executable contract for `honua-release#123` D9.3: install
-Honua, configure and publish deterministic data with AI-accessible admin tools,
-run Buffer through the AI-facing Esri MCP tool, the SDK's Esri GPServer
-compatibility path, and the MCP-native analysis verb, compose distinct map,
-app, and dashboard packages in Studio, save each as an immutable version, read
-that exact version, reopen it as a new draft, record three publication intents,
-and save three new intent-bearing versions. It then stops at the human Console
-gate before verifying the three approved public URLs. Both MCP
-jobs are polled through `honua://jobs/{id}` and joined to their
-`honua://jobs/{id}/results` packages; a queued submission alone cannot pass.
+Honua, configure and publish deterministic data with the closed admin roster,
+buffer the published parcels with `honua_validate_plan` then
+`honua_execute_plan` (`analytics.buffer-aggregate`), prove `geometry.buffer`
+through the SDK GPServer runner, compose distinct map, app, and dashboard
+packages in Studio, save each as an immutable version, and publish that saved
+version. An admin `honua_studio_propose_publication` returns `shareUrl` with
+`humanConfirmationRequired: false`. The same session fetches each share URL and
+requires HTTP 200. It does not import a Console receipt and it does not require
+a second principal. The buffer job is polled through `honua://jobs/{jobId}` to
+terminal success, and `artifacts[].artifactId` is read from
+`honua://jobs/{jobId}/results`; a queued submission alone cannot pass.
 
 The driver reuses `honua admin install` and `honua-mcp-proxy`. It does not ship
 a second installer, admin client, or MCP transport. The installer is the
@@ -49,17 +59,21 @@ Prerequisites:
 
 - Node.js 20.19 or newer and Docker with Compose
 - the 2026.1 `honua` CLI work from `honua-sdk-js#1370-#1373`
-- a server build exposing the complete default 432-tool roster (47 static plus
-  385 `honua_admin_*` tools), with all eleven secret/session Admin operations
-  absent, **and** the `analysis` and `esri-gp` server profiles enabled so the
-  three `honua_esri_gp_*` tools and `honua_buffer_features` are advertised
-  (441 tools in total), plus the Studio lifecycle tools including
-  `honua_studio_save_version`, `honua_studio_get_version`, and
-  `honua_studio_reopen_version`
-- the `geoprocessing/Buffer` GPServer task seeded by the deployment
+- one admin credential. The journey does not require a second principal
+- a server build that advertises the closed operator roster this journey calls:
+  `honua_admin_connections_create`, `honua_admin_connections_test`,
+  `honua_admin_import_upload_url`, `honua_admin_layer_publish`,
+  `honua_admin_services_access_policy_set`, `honua_admin_server_status`,
+  `honua_admin_api_key_list`, `honua_admin_api_key_effective_permissions`,
+  `honua_validate_plan`, `honua_execute_plan`, and the Studio lifecycle tools
+  including `honua_studio_save_version`, `honua_studio_get_version`,
+  `honua_studio_reopen_version`, and `honua_studio_propose_publication`.
+  It does not require a 432- or 441-tool catalog, and it does not require the
+  `analysis` or `esri-gp` profiles. `honua_esri_gp_*` and `honua_buffer_features`
+  are not called
+- the `geoprocessing/Buffer` GPServer task seeded for the separate
+  `geometry.buffer` proof. That task takes WKB and has no `layerId`
 - these fixtures available to the server at an HTTP(S) base URL
-- a writable checkpoint path; the first pass emits the exact resolved Console
-  receipt request after all pre-approval work completes
 
 Serve the checked-in fixtures from a URL reachable by the Honua container, for
 example with an existing static-file server. Then run:
@@ -78,26 +92,32 @@ npm run release:zero-to-map -- \
   --output ./zero-to-map-live-receipt.json
 ```
 
-The first pass exits `2` with `external-receipt-missing`. It has already run
-stages 1-5 exactly once. Give the checkpoint's resolved
-`consoleReceiptRequest` to the Console producer, carry
-`checkpoint.integrity.digest` outside that file, and resume with the same
-command plus:
+`dbSecretReference` is a request-supplied secret reference: the journey sends
+it to the server, and the server resolves it from its own environment. The
+server the journey runs against must therefore both define that variable (the
+fixture database connection string) and permit it in its allowlist for
+request-supplied secret references (honua-server #5055), which is
+deny-by-default. Permit exactly this one name rather than a prefix, in the
+server's environment:
 
 ```sh
-  --checkpoint-digest <checkpoint.integrity.digest> \
-  --console-receipt ./console-approval.json
+Security__RequestSecretReferences__AllowedEnvironmentVariables__0=HONUA_ZERO_TO_MAP_DB_CONNECTION
 ```
 
-The resume atomically claims the checkpoint before any adapter work. A second
-or concurrent claimant fails closed. The checkpoint is bound to the exact plan
-bytes, SDK source SHA (`HONUA_SOURCE_REVISION`), target, MCP endpoint,
-candidate/release, and (for AWS) provisioning receipt; it contains only
-allowlisted captures/evidence, including the non-secret deterministic
-`serviceName` identity and access-credential ID/grants/reference digest required
-by external producers, and never the database password, admin key, token, or
-authorization material. A successful resume
-marks it consumed and binds the final receipt hash.
+Without that entry the `create-connection` action in stage 2 is refused before
+any connection is stored. Server images that predate the setting ignore the
+variable. `honua admin install local` does not write either variable into the
+compose file it generates, so add both to the `honua` service's environment (or
+start an equivalent server yourself) before running with `--execute`. If you
+pass a different `--var dbSecretReference=env:<NAME>`, permit `<NAME>` instead.
+
+The live run does not pause for a Console receipt. An admin publish returns
+`shareUrl` (`/api/v1/studio/published` plus the route) with
+`humanConfirmationRequired: false`, and the journey fetches that URL. A
+root-relative share path is resolved against the MCP endpoint origin. HTTP is
+accepted only for a loopback origin; any other share URL must be HTTPS and must
+not embed credentials. One admin credential performs configuration, publication,
+and the fetch.
 
 For a deployment already provisioned by the DevOps ECS producer, use
 `--target aws-ecs --provision-receipt <pre-teardown-binding.json>`. The binding
@@ -107,27 +127,14 @@ the real image/digest, Terraform, readiness, and a secret-free access receipt
 whose reference digest is verified against the producer's Secrets Manager ARN;
 it does not invoke or pretend to invoke the Docker installer.
 
-The catalog is checked in full before the first MCP call. Missing tools or
-input-schema drift block the run without sending that call.
-
-The preflight verifies each enabled server profile independently and *derives*
-the expected total from them; it never compares the catalog against a single
-hardcoded number:
-
-| Profile | Members | Verified by |
-| --- | --- | --- |
-| `base` | 47 static + 385 `honua_admin_*` = 432 | the generated Admin contract, plus the 11 audited secret/session exclusions proven absent |
-| `analysis` | 6 | `honua_buffer_features` by name; the rest by declared size (the server has not published an `analysis` roster - honua-server#3363) |
-| `esri-gp` | 3 | exactly `honua_esri_gp_list_tasks`, `honua_esri_gp_describe_task`, `honua_esri_gp_execute_task` from `contracts/esri-gp-mcp.v1.json` |
-
-The enabled candidate therefore advertises 432 + 6 + 3 = 441 tools. A missing,
-unexpected, duplicate, excluded, truncated, or schema-drifted member fails with
-its own labelled finding naming the journey stage and action that needs the
-tool; a short catalog is reported as a pagination fault rather than a roster
-decision. The pagination safety ceiling in `listAllTools` is deliberately
-separate from every roster number, so reading a larger profile-enabled catalog
-is never mistaken for a hostile server. Default-profile certification
-(`certifyAdminCatalogParity`) continues to require exactly 432.
+The catalog is checked before the first MCP call. The preflight selects
+`tools/list` view `full` and asserts the closed roster: every tool this journey
+calls, by name, with the stage and action that needs it. It does not require
+432 or 441 tools and it does not require the `analysis` or `esri-gp` profiles.
+Extra advertised tools are not a failure. A duplicate name or an input schema
+that rejects a planned argument blocks the run without sending that call.
+Default-profile certification (`certifyAdminCatalogParity`) is a separate gate
+and is not this journey's roster.
 
 The connection is
 created with `secretReference` + `secretType`; raw database credentials never
@@ -145,30 +152,20 @@ The Studio version tools are also preflighted before the first server mutation.
 Map, app, and dashboard each exercise layer, style, view, widget, and control
 mutations before validation; family-specific shortcuts or embedded lookalikes
 cannot satisfy the release roster.
-The journey does not treat `honua_studio_get_draft` as reopen evidence: every
-family must capture its `itemId`, immutable `versionId`, `contentHash`, and the
-new draft whose `baseVersionId` points back to that exact version. After the
-proposal increments that reopened draft's generation, the journey saves a new
-immutable publication version. Console must create and publish the request for
-that new version, never the earlier pre-intent version.
-
-The Console receipt is accepted only when it is `passed` and binds this
-journey/release contract to the exact connection, service, layers, three GP job
-identities, result packages/artifacts, map/app/dashboard draft and immutable
-version identities, all three reopened drafts and intent-bearing publication
-versions, all three Console request/publication/status/public-URL identities,
-execution operations, audit correlations, routes, candidate, and release. Each
-audit operation must equal its family's execution operation, each proposal ID
-must equal its publication request ID, and the app public URL must equal the
-top-level share URL. The Studio proposal actions reject any pre-approval
-publication ID or public URL and must report both `recorded=true` and
-`humanConfirmationRequired=true`. Agent execution never claims the human
-publication step. Stage 7 independently requires identity-preserving HTTPS
-HTTP 200 responses for map, app, and dashboard URLs.
+The journey does not treat `honua_studio_get_draft` as reopen evidence. Save
+captures read `/structuredContent/version/versionId`,
+`/structuredContent/version/contentHash`, and `versionNumber` under `version`.
+`honua_studio_get_version` still returns top-level `versionId` and `contentHash`.
+Publication runs after that save. `honua_studio_propose_publication` takes
+`itemId`, `versionId`, `contentHash`, `route`, `visibility`, and `note`. It does
+not take `draftId`, `generation`, or `embed`. For this admin journey the result
+has `humanConfirmationRequired: false` and a `shareUrl`. The journey fetches
+each share URL and requires HTTP 200. It does not forbid `shareUrl` and it does
+not wait for a second principal.
 
 ## Evidence status
 
 The fixtures, plan, contracts, and simulated end-to-end tests are deterministic.
-They are not a live release recording. Until all deployment dependencies are
-available and an operator supplies a matching Console receipt, the honest
-candidate result is `blocked`/`skipped`, not passed.
+They are not a live release recording. Contract mode stays `blocked` and does
+not start Docker. A live pass is the same admin session reaching HTTP 200 on
+the three share URLs.

package/release/zero-to-map/configs/claude-code.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/claude-desktop.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }

package/release/zero-to-map/configs/cursor.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "honua": {
       "command": "npx",
-      "args": ["-y", "--package", "@honua/mcp-server@0.1.7-beta.0", "honua-mcp-proxy"],
+      "args": ["-y", "--package", "@honua/mcp-server@0.1.10-beta.0", "honua-mcp-proxy"],
       "env": {
         "HONUA_MCP_REMOTE_URL": "http://localhost:8080/mcp"
       }