@cliwant/mcp-sam-gov 0.3.0 → 1.0.0

package/dist/datasource.js

@@ -0,0 +1,551 @@
+/**
+ * datasource.ts — the shared fetch envelope for the keyless DataSources
+ * (ADR-0005). This is the ONE audited `assemble init → fetchWithRetry → r.json()`
+ * skeleton the keyless adapters share; the per-source quirks (timeout / headers /
+ * redirect) are OPTIONS, not three bespoke fetch fns. `RequestInit` already
+ * carries `headers` and `redirect`, so getJson forwards them without adding logic
+ * — folding the fetch fns into one is lossless.
+ *
+ * R2 SCOPE (ADR-0005 v2 FIX-B): getJson ships ONLY { label, headers?, redirect?,
+ * timeoutMs? }. `redirect:"error"` STAYS: a zero-logic RequestInit passthrough,
+ * absent for Treasury, and Socrata + the queued CKAN connector need the identical
+ * SSRF hardening.
+ *
+ * THE MIN-INTERVAL GATE (ADR-0011 orchestrator, v6 cycle 15 — the R2 deferred
+ * slice, now landed): `throughGate(key, minIntervalMs, fn)` is a STANDALONE
+ * exported primitive (below), the shared home for EDGAR's former module-singleton
+ * self-throttle. It is deliberately NOT wired into getJson and `gateKey`/
+ * `minIntervalMs` are deliberately NOT added to GetJsonOptions — there is no
+ * getJson consumer that throttles, so that would be dead option-surface (FIX-B
+ * "no dead surface"). If a future source makes a throttled getJson call, wiring
+ * the gate into getJson can be revisited then.
+ *
+ * `label` is the fetchWithRetry taxonomy key AND surfaces verbatim in
+ * ToolError.upstreamEndpoint to the MCP caller — it MUST be HOST-ONLY and never
+ * contain a token (Socrata/EDGAR m7).
+ *
+ * The shape-drift CHECK stays at each call site (bespoke per-source fields); only
+ * the THROW is standardized via `driftError`. This is deliberately NOT a `guard`
+ * hook baked into getJson: a hook would collide with Socrata's count(*) companion
+ * (which must degrade to total:null and NEVER throw schema_drift) and its
+ * discoverDatasets memoize boundary — leaving the check at the call site keeps
+ * that split honest (ADR-0005 §1c / Q4).
+ */
+import { fetchWithRetry, errorFromResponse, ToolErrorCarrier, isHonorRetryAfter, } from "./errors.js";
+/**
+ * GET + parse one JSON resource through the shared envelope. Assembles `init`
+ * (a fresh `AbortSignal.timeout` always; `headers`/`redirect` set ONLY when the
+ * option is provided — byte-identical to each source's prior hand-rolled init),
+ * calls `fetchWithRetry` (retry/backoff + the 429/5xx/404/400 taxonomy), then
+ * returns the parsed body. The caller validates the shape and throws
+ * `driftError` on drift.
+ */
+export async function getJson(url, opts) {
+    const init = {
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+    };
+    if (opts.headers !== undefined)
+        init.headers = opts.headers;
+    if (opts.redirect)
+        init.redirect = opts.redirect;
+    // POST/body passthrough (ADR-0014) — set ONLY when defined, matching the
+    // `headers` idiom, so a GET caller's init stays byte-identical (no `method`/
+    // `body` key). `method`/`body` are RequestInit fields forwarded without logic.
+    if (opts.method !== undefined)
+        init.method = opts.method;
+    if (opts.body !== undefined)
+        init.body = opts.body;
+    const r = await fetchWithRetry(url, init, opts.label);
+    return (await r.json());
+}
+/**
+ * getJsonWithHeaders — the header-exposing sibling of `getJson` (ADR-0038 M1).
+ *
+ * WHY a SEPARATE primitive (and NOT a mutation of getJson): a PostgREST source
+ * (FAC / any Range-paginating REST API) carries its EXACT total in the
+ * `Content-Range` RESPONSE HEADER, but `getJson` returns ONLY `await r.json()`
+ * (the parsed body) and DISCARDS the `Response`/headers — so the header is
+ * unreachable through it. Mutating getJson's return shape would break every one
+ * of its ~9 callers (NOT byte-identical); this additive variant leaves getJson
+ * untouched. It runs the IDENTICAL init assembly + `fetchWithRetry(url, init,
+ * opts.label)` envelope as getJson (same headers / `redirect` / timeout / method
+ * / body / retry-taxonomy), and returns the parsed body PLUS ONLY the
+ * `content-range` header string — it NEVER surfaces the raw `Headers` object, so
+ * no incidental response header (Set-Cookie, a rate-limit token, etc.) can reach
+ * a consumer's `_meta`/output. A 200 non-JSON body makes `r.json()` throw a
+ * `SyntaxError`, exactly as with getJson — the caller reclassifies it (the
+ * fdic.ts / ADR-0038 S1 pattern), keeping the shared envelope free of source
+ * quirks.
+ */
+export async function getJsonWithHeaders(url, opts) {
+    const init = {
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+    };
+    if (opts.headers !== undefined)
+        init.headers = opts.headers;
+    if (opts.redirect)
+        init.redirect = opts.redirect;
+    if (opts.method !== undefined)
+        init.method = opts.method;
+    if (opts.body !== undefined)
+        init.body = opts.body;
+    const r = await fetchWithRetry(url, init, opts.label);
+    return {
+        body: (await r.json()),
+        contentRange: r.headers.get("content-range"),
+    };
+}
+/**
+ * GET one text resource through the shared envelope. Assembles `init`
+ * (byte-identical to `getJson`'s rule: a fresh `AbortSignal.timeout` always;
+ * `headers`/`redirect` set ONLY when the option is provided), then either
+ * retries via `fetchWithRetry` (default) or does a single classified `fetch`
+ * (retry:false), and returns the raw `r.text()` body.
+ */
+export async function getText(url, opts) {
+    const init = {
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+    };
+    if (opts.headers !== undefined)
+        init.headers = opts.headers;
+    if (opts.redirect)
+        init.redirect = opts.redirect;
+    // Default path (far/gao): retry transient errors up to 3× via the shared
+    // primitive, then return the body text.
+    if (opts.retry !== false) {
+        const r = await fetchWithRetry(url, init, opts.label);
+        return await r.text();
+    }
+    // Single-attempt path (fpds m-redirect): the fetch is done HERE so a
+    // redirect:"error" TypeError is classified as a NON-retryable schema_drift
+    // (never routed through fetchWithRetry, which would retry it 3× as a retryable
+    // upstream_unavailable). A 5xx/429/404/timeout is classified + THROWS (never a
+    // fake empty). Byte-for-byte the shipped fpds single-fetch body.
+    let r;
+    try {
+        r = await fetch(url, init);
+    }
+    catch (e) {
+        if (isRedirectError(e)) {
+            // Fail closed — NEVER follow the off-host redirect, NEVER read its body,
+            // and do NOT let it masquerade as a retryable outage.
+            throw driftError(opts.label, opts.redirectMessage ??
+                `Off-host redirect refused (redirect:"error") while fetching ${opts.label}.`);
+        }
+        // timeout / abort / network — retryable upstream, but THROWS (never fake-empty).
+        throw new ToolErrorCarrier({
+            kind: "upstream_unavailable",
+            message: `Network error reaching ${opts.label}: ${e instanceof Error ? e.message : String(e)}`,
+            retryable: true,
+            retryAfterSeconds: 30,
+            upstreamEndpoint: opts.label,
+        });
+    }
+    if (!r.ok) {
+        // 404/429/5xx/4xx → the errors.ts taxonomy. A DOWN service NEVER reads empty.
+        throw new ToolErrorCarrier(errorFromResponse(r, opts.label));
+    }
+    return await r.text();
+}
+/**
+ * Is a thrown error the redirect:"error" TypeError (undici: cause "unexpected
+ * redirect")? The live FPDS search.do→sam.gov 301 is the concrete case
+ * (ADR-0012 §1a). Moved here from fpds.ts (ADR-0013) as `getText`'s audited home
+ * — it is only reachable when a caller sets `redirect:"error"` (undici throws
+ * the unexpected-redirect TypeError only in `"error"` mode), so it is inert for
+ * any retry:false caller that does NOT set redirect.
+ */
+export function isRedirectError(e) {
+    if (!(e instanceof TypeError))
+        return false;
+    const causeMsg = e.cause && typeof e.cause.message === "string"
+        ? e.cause.message
+        : "";
+    return /redirect/i.test(causeMsg) || /redirect/i.test(e.message);
+}
+/**
+ * The shared `schema_drift` constructor (all sources threw the identical
+ * carrier). Each source keeps its bespoke field-CHECK inline and calls this to
+ * standardize only the THROW. `label` becomes `upstreamEndpoint` — host-only,
+ * never a token.
+ */
+export function driftError(label, message) {
+    return new ToolErrorCarrier({
+        kind: "schema_drift",
+        message,
+        retryable: false,
+        upstreamEndpoint: label,
+    });
+}
+// ─── Per-key min-interval gate (shared self-throttle primitive) ────
+/**
+ * One serialized promise chain + last-run timestamp PER KEY. Module-level so a
+ * key's chain persists across every call in the process (the whole point of a
+ * self-throttle: a tool call can fan out and many tools may run). Different keys
+ * are independent chains — they never block each other.
+ */
+const gates = new Map();
+/**
+ * Serialize every call sharing `key` through a single promise chain, spacing the
+ * START of consecutive runs by ≥ `minIntervalMs`. This is the generalization of
+ * EDGAR's former module singleton (edgar.ts `edgarGateChain`/`edgarLastFetchAt`/
+ * `throughEdgarGate`); `throughGate("edgar", 110, fn)` reproduces its behavior
+ * EXACTLY. Semantics that MUST stay byte-identical to the old EDGAR gate:
+ *   - the Map entry is fetched-or-created and MUTATED IN PLACE (never replaced),
+ *     so a key keeps one chain across the process;
+ *   - before invoking `fn()`, wait `max(0, minIntervalMs - (now - lastAt))` using
+ *     the **bare global `setTimeout`** (NOT `node:timers/promises`) — the fault
+ *     suite's timer-neutralizing patch makes this offline-instant; an import-based
+ *     timer would break that (and offline determinism);
+ *   - `lastAt` is stamped with `Date.now()` **BEFORE** `fn()` is called, so the
+ *     spacing is measured from the START of the previous run (edgar L97-98);
+ *   - the chain SWALLOWS each step's error so the queue keeps flowing, while the
+ *     real result/error still propagates on the promise returned to THAT caller.
+ */
+export function throughGate(key, minIntervalMs, fn) {
+    let gate = gates.get(key);
+    if (!gate) {
+        gate = { chain: Promise.resolve(), lastAt: 0 };
+        gates.set(key, gate);
+    }
+    const g = gate;
+    const run = g.chain.then(async () => {
+        const wait = g.lastAt + minIntervalMs - Date.now();
+        if (wait > 0)
+            await new Promise((res) => setTimeout(res, wait));
+        g.lastAt = Date.now();
+        return fn();
+    });
+    // Keep the chain alive whether this link resolves or rejects.
+    g.chain = run.then(() => undefined, () => undefined);
+    return run;
+}
+/**
+ * getJsonWithProvenance — the resilient-fetch primitive (ADR-0045 B2). Runs the
+ * IDENTICAL init-assembly + `fetchWithRetry(url, init, opts.label)` envelope as
+ * `getJson`, and returns `{ body, provenance }`. The port ALWAYS returns an
+ * explicit provenance (honesty-B2 + regression-M1 reconciled): in Phase 1 there
+ * is a SINGLE live path, so `provenance` is ALWAYS `{ dataPath:"live" }` (asOf
+ * omitted). Because the port always stamps provenance, a mirror/snapshot body can
+ * never be structurally mislabelled as live (a future adapter that forgets to
+ * thread it still cannot claim live).
+ *
+ * ★INERT: NO adapter calls this yet — it is dormant infrastructure. It is a
+ * SEPARATE primitive (getJson is untouched, byte-identical), exported for the
+ * path-chain and for direct unit tests.
+ */
+export async function getJsonWithProvenance(url, opts) {
+    const init = {
+        signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+    };
+    if (opts.headers !== undefined)
+        init.headers = opts.headers;
+    if (opts.redirect)
+        init.redirect = opts.redirect;
+    if (opts.method !== undefined)
+        init.method = opts.method;
+    if (opts.body !== undefined)
+        init.body = opts.body;
+    const r = await fetchWithRetry(url, init, opts.label);
+    return {
+        body: (await r.json()),
+        // Single live path in Phase 1 — always live, no asOf.
+        provenance: { dataPath: "live" },
+    };
+}
+// ─── Per-host circuit breaker (ADR-0045 B1) ────────────────────────────────
+/**
+ * A per-host circuit breaker (bounded, keyed by a FIXED host set — the same
+ * discipline as `gates` above, so the Map can NEVER grow unboundedly; m3-reg).
+ *
+ * Trip condition (INTENTIONALLY narrow, B1-regression): 5 CONSECUTIVE HARD
+ * failures on a host — where HARD = a 5xx or a network `TypeError` ONLY. It is
+ * EXPLICITLY not tripped by 429 (rate-limited), a 5xx bearing Retry-After
+ * (isHonorRetryAfter — B1-policy), 404, or Timeout/Abort (errors.ts:162-172's
+ * existing fast-fail). Once open, it stays open 30s, then admits a SINGLE
+ * half-open probe; a probe success closes it, a probe failure re-opens it.
+ *
+ * ★INERT in Phase 1: the breaker is only ever CONSULTED by `throughPathChain`
+ * for a ≥2-path chain. No source declares ≥2 paths this phase, so it never
+ * activates in production — but it is unit-tested directly.
+ */
+const BREAKER_TRIP_THRESHOLD = 5;
+const BREAKER_OPEN_MS = 30_000;
+export class CircuitBreaker {
+    /** Bounded: only hosts in the fixed set are ever tracked (m3-regression). */
+    hosts;
+    states = new Map();
+    /** Injectable clock for deterministic offline unit tests (defaults Date.now). */
+    now;
+    constructor(hosts, now = () => Date.now()) {
+        this.hosts = new Set(hosts);
+        this.now = now;
+    }
+    state(host) {
+        if (!this.hosts.has(host))
+            return undefined; // untracked host ⇒ pure no-op
+        let s = this.states.get(host);
+        if (!s) {
+            s = { consecutiveHardFailures: 0, openUntil: 0, probeInFlight: false };
+            this.states.set(host, s);
+        }
+        return s;
+    }
+    /**
+     * Should the live attempt to `host` be SKIPPED right now? True only while the
+     * breaker is OPEN and its 30s window has not elapsed AND a half-open probe is
+     * already in flight. When the window elapses, exactly ONE caller is admitted as
+     * the half-open probe (this returns false and marks probeInFlight) and the rest
+     * are skipped until that probe reports back. An untracked host is NEVER skipped.
+     */
+    shouldSkip(host) {
+        const s = this.state(host);
+        if (!s || s.openUntil === 0)
+            return false; // closed (or untracked) ⇒ attempt
+        if (this.now() < s.openUntil) {
+            // Fully OPEN within the 30s window ⇒ skip every live attempt.
+            return true;
+        }
+        // Window elapsed → HALF-OPEN. Admit exactly ONE probe (returns false so it
+        // attempts live); skip all others until that probe reports back.
+        if (!s.probeInFlight) {
+            s.probeInFlight = true;
+            return false;
+        }
+        return true;
+    }
+    /** Record a live success — closes the breaker and resets the failure run. */
+    onSuccess(host) {
+        const s = this.state(host);
+        if (!s)
+            return;
+        s.consecutiveHardFailures = 0;
+        s.openUntil = 0;
+        s.probeInFlight = false;
+    }
+    /**
+     * Record a live failure. A NON-hard error (429 / honor-Retry-After / 404 /
+     * timeout / abort) is IGNORED — it neither counts toward the trip threshold nor
+     * resets the run (it is orthogonal to host health). A HARD error increments the
+     * consecutive count and trips the breaker at the threshold; if it arrives during
+     * a half-open probe it immediately re-opens the window.
+     */
+    onFailure(host, err) {
+        const s = this.state(host);
+        if (!s)
+            return;
+        if (!isHardFailure(err))
+            return; // 429/honor-RA/404/timeout ⇒ not host health
+        if (s.probeInFlight) {
+            // Half-open probe failed → re-open for another full window.
+            s.openUntil = this.now() + BREAKER_OPEN_MS;
+            s.probeInFlight = false;
+            return;
+        }
+        s.consecutiveHardFailures += 1;
+        if (s.consecutiveHardFailures >= BREAKER_TRIP_THRESHOLD) {
+            s.openUntil = this.now() + BREAKER_OPEN_MS;
+        }
+    }
+    /** Test-only introspection: is the breaker currently OPEN for `host`? */
+    isOpen(host) {
+        const s = this.states.get(host);
+        return !!s && s.openUntil !== 0 && this.now() < s.openUntil;
+    }
+}
+/**
+ * Is a thrown error a HARD failure for circuit-breaker purposes (ADR-0045 B1)?
+ * HARD = a 5xx or a network `TypeError` ONLY. Everything else is excluded:
+ *   • isHonorRetryAfter (429 / 5xx+Retry-After) — B1-policy, honor the wait;
+ *   • Timeout/Abort — classified upstream_unavailable with retryable:FALSE
+ *     (errors.ts:169), so the `retryable===true` gate excludes it;
+ *   • 404 (not_found), 4xx (invalid_input), schema_drift, unknown — not outages.
+ * A 5xx-after-retries and a network TypeError both surface from `fetchWithRetry`
+ * as a `ToolErrorCarrier` upstream_unavailable with retryable:TRUE — the one
+ * signature this admits. A raw (unclassified) `TypeError` also counts, for
+ * robustness when the breaker is driven directly.
+ */
+export function isHardFailure(err) {
+    if (isHonorRetryAfter(err))
+        return false;
+    if (err instanceof ToolErrorCarrier) {
+        const te = err.toolError;
+        return te.kind === "upstream_unavailable" && te.retryable === true;
+    }
+    return err instanceof TypeError;
+}
+/**
+ * Try an ordered array of access paths, returning the first success + its
+ * provenance (ADR-0045 §"경로 체인").
+ *
+ * ★A SINGLE-entry chain is a PURE PASSTHROUGH — no breaker consult, no try/catch
+ * overhead, byte-for-byte today's behavior (B1-regression). The breaker is
+ * consulted ONLY for a ≥2-path chain, so the 27 single-path sources are never
+ * affected.
+ *
+ * For a multi-path chain: an open breaker on a path's host SKIPS that path (no
+ * live attempt); a HARD failure records against the breaker and falls through to
+ * the next path; a SUCCESS records success and returns. An isHonorRetryAfter
+ * error (429 / 5xx+Retry-After) is RE-THROWN IMMEDIATELY (B1-policy) — it never
+ * counts against the breaker and never falls through to a mirror/snapshot; we
+ * wait and fail honestly. If every path is exhausted, the last error is thrown
+ * (honest failure — never a fabricated empty).
+ */
+export async function throughPathChain(paths, breaker) {
+    if (paths.length === 0) {
+        throw new ToolErrorCarrier({
+            kind: "unknown",
+            message: "throughPathChain called with no paths.",
+            retryable: false,
+        });
+    }
+    // Single-path fast path: pure passthrough, no breaker, no overhead (=today).
+    if (paths.length === 1) {
+        const only = paths[0];
+        return { body: await only.run(), provenance: only.provenance };
+    }
+    let lastErr;
+    for (const path of paths) {
+        if (breaker && breaker.shouldSkip(path.host)) {
+            // Breaker open for this host → skip the live attempt, try the next path.
+            lastErr =
+                lastErr ??
+                    new ToolErrorCarrier({
+                        kind: "upstream_unavailable",
+                        message: `Circuit breaker open for ${path.host}; skipped.`,
+                        retryable: true,
+                        upstreamEndpoint: path.host,
+                    });
+            continue;
+        }
+        try {
+            const body = await path.run();
+            if (breaker)
+                breaker.onSuccess(path.host);
+            return { body, provenance: path.provenance };
+        }
+        catch (e) {
+            // Honor an explicit upstream wait — NEVER count it against the breaker and
+            // NEVER fall through to a fallback path (B1-policy). Wait + fail honestly.
+            if (isHonorRetryAfter(e))
+                throw e;
+            if (breaker)
+                breaker.onFailure(path.host, e);
+            lastErr = e;
+        }
+    }
+    throw lastErr;
+}
+/**
+ * getJsonConditional — a SEPARATE conditional-GET primitive (ADR-0045
+ * B2-regression). It is DELIBERATELY NOT folded into the shared getJson/getText:
+ * adding If-None-Match/If-Modified-Since to getJson would make a 304 (a bodiless
+ * response) hit `r.json()` → a SyntaxError that fdic:340 / fedreg:588 reclassify
+ * as schema_drift — a hard regression. So this primitive:
+ *   (a) sends validators ONLY when it holds a cache entry;
+ *   (b) intercepts a 304 BEFORE the r.ok gate and returns the cached body;
+ *   (c) NEVER calls `r.json()` on a 304.
+ * It keeps getJson's retry taxonomy for the non-304 case (5xx/429/network retry;
+ * timeout/abort fast-fail), via a local loop that mirrors fetchWithRetry but adds
+ * the 304 short-circuit ABOVE the r.ok gate.
+ *
+ * ★INERT: no adapter uses it yet. A cache MISS (no entry) behaves like getJson
+ * (no validators sent, 200 parsed) — so an adapter that later adopts it without a
+ * warm cache is envelope-identical.
+ */
+export async function getJsonConditional(url, opts, cache) {
+    // (a) Send validators ONLY when a cache entry is held.
+    const headers = { ...(opts.headers ?? {}) };
+    if (cache?.etag !== undefined)
+        headers["If-None-Match"] = cache.etag;
+    if (cache?.lastModified !== undefined)
+        headers["If-Modified-Since"] = cache.lastModified;
+    const buildInit = () => {
+        const init = {
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 15_000),
+        };
+        if (Object.keys(headers).length > 0)
+            init.headers = headers;
+        if (opts.redirect)
+            init.redirect = opts.redirect;
+        if (opts.method !== undefined)
+            init.method = opts.method;
+        if (opts.body !== undefined)
+            init.body = opts.body;
+        return init;
+    };
+    const maxAttempts = 3;
+    let lastErr;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            const r = await fetch(url, buildInit());
+            // (b)/(c) Intercept 304 BEFORE the r.ok gate; NEVER read its (absent) body.
+            if (r.status === 304) {
+                if (!cache) {
+                    // A 304 with no held validators is a protocol violation — fail honestly
+                    // rather than fabricate an empty body.
+                    throw new ToolErrorCarrier({
+                        kind: "schema_drift",
+                        message: `Unexpected 304 from ${opts.label} without a cache entry.`,
+                        retryable: false,
+                        upstreamEndpoint: opts.label,
+                    });
+                }
+                return {
+                    body: cache.body,
+                    notModified: true,
+                    provenance: cache.asOf
+                        ? { dataPath: "snapshot", asOf: cache.asOf }
+                        : { dataPath: "live" },
+                };
+            }
+            if (r.ok) {
+                return {
+                    body: (await r.json()),
+                    notModified: false,
+                    provenance: { dataPath: "live" },
+                };
+            }
+            const err = errorFromResponse(r, opts.label);
+            if (!err.retryable || attempt === maxAttempts) {
+                throw new ToolErrorCarrier(err);
+            }
+            lastErr = err;
+            const wait = err.retryAfterSeconds
+                ? Math.min(err.retryAfterSeconds, 60)
+                : Math.pow(2, attempt - 1);
+            await new Promise((res) => setTimeout(res, wait * 1000));
+        }
+        catch (e) {
+            if (e instanceof ToolErrorCarrier)
+                throw e;
+            // Timeout/abort ⇒ fast-fail non-retryable (mirrors fetchWithRetry:162-172).
+            if (e instanceof Error &&
+                (e.name === "TimeoutError" || e.name === "AbortError")) {
+                throw new ToolErrorCarrier({
+                    kind: "upstream_unavailable",
+                    message: `Request to ${opts.label} timed out.`,
+                    retryable: false,
+                    upstreamEndpoint: opts.label,
+                });
+            }
+            lastErr = {
+                kind: "upstream_unavailable",
+                message: `Network error reaching ${opts.label}: ${e.message}`,
+                retryable: true,
+                retryAfterSeconds: 30,
+                upstreamEndpoint: opts.label,
+            };
+            if (attempt === maxAttempts)
+                throw new ToolErrorCarrier(lastErr);
+            await new Promise((res) => setTimeout(res, Math.pow(2, attempt - 1) * 1000));
+        }
+    }
+    throw new ToolErrorCarrier(lastErr ?? {
+        kind: "unknown",
+        message: `${opts.label} failed after ${maxAttempts} attempts.`,
+        retryable: false,
+        upstreamEndpoint: opts.label,
+    });
+}
+//# sourceMappingURL=datasource.js.map

package/dist/datasource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datasource.js","sourceRoot":"","sources":["../src/datasource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AA6BrB;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAoB;IAEpB,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;KACtD,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACjD,yEAAyE;IACzE,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAM,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,IAAoB;IAEpB,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;KACtD,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAM;QAC3B,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;KAC7C,CAAC;AACJ,CAAC;AA6CD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,GAAW,EACX,IAAoB;IAEpB,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;KACtD,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAEjD,yEAAyE;IACzE,wCAAwC;IACxC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,iEAAiE;IACjE,IAAI,CAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,yEAAyE;YACzE,sDAAsD;YACtD,MAAM,UAAU,CACd,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe;gBAClB,+DAA+D,IAAI,CAAC,KAAK,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,iFAAiF;QACjF,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0BAA0B,IAAI,CAAC,KAAK,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC9F,SAAS,EAAE,IAAI;YACf,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,IAAI,CAAC,KAAK;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,8EAA8E;QAC9E,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,IAAI,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,QAAQ,GACZ,CAAC,CAAC,KAAK,IAAI,OAAQ,CAAC,CAAC,KAA+B,CAAC,OAAO,KAAK,QAAQ;QACvE,CAAC,CAAE,CAAC,CAAC,KAA6B,CAAC,OAAO;QAC1C,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,OAAe;IACvD,OAAO,IAAI,gBAAgB,CAAC;QAC1B,IAAI,EAAE,cAAc;QACpB,OAAO;QACP,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE;;;;;GAKG;AACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuD,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,aAAqB,EACrB,EAAoB;IAEpB,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IACH,8DAA8D;IAC9D,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAChB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAqCD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,IAAoB;IAEpB,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;KACtD,CAAC;IACF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAM;QAC3B,sDAAsD;QACtD,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAW/B,MAAM,OAAO,cAAc;IACzB,6EAA6E;IAC5D,KAAK,CAAsB;IAC3B,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC1D,iFAAiF;IAChE,GAAG,CAAe;IAEnC,YAAY,KAAuB,EAAE,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,IAAY;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,8BAA8B;QAC3E,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,uBAAuB,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;QAC7E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;YAC7B,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACrB,CAAC,CAAC,aAAa,GAAG,IAAI,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,SAAS,CAAC,IAAY;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;QAC9B,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,IAAY,EAAE,GAAY;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,6CAA6C;QAC9E,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACpB,4DAA4D;YAC5D,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;YAC3C,CAAC,CAAC,aAAa,GAAG,KAAK,CAAC;YACxB,OAAO;QACT,CAAC;QACD,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,uBAAuB,IAAI,sBAAsB,EAAE,CAAC;YACxD,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,IAAY;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC;QACzB,OAAO,EAAE,CAAC,IAAI,KAAK,sBAAsB,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,YAAY,SAAS,CAAC;AAClC,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAuC,EACvC,OAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,wCAAwC;YACjD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IACD,6EAA6E;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,yEAAyE;YACzE,OAAO;gBACL,OAAO;oBACP,IAAI,gBAAgB,CAAC;wBACnB,IAAI,EAAE,sBAAsB;wBAC5B,OAAO,EAAE,4BAA4B,IAAI,CAAC,IAAI,YAAY;wBAC1D,SAAS,EAAE,IAAI;wBACf,gBAAgB,EAAE,IAAI,CAAC,IAAI;qBAC5B,CAAC,CAAC;YACL,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,OAAO;gBAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2EAA2E;YAC3E,2EAA2E;YAC3E,IAAI,iBAAiB,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,OAAO,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,OAAO,CAAC;AAChB,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,IAAoB,EACpB,KAAqB;IAErB,uDAAuD;IACvD,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IACpE,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;IACrE,IAAI,KAAK,EAAE,YAAY,KAAK,SAAS;QACnC,OAAO,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAEpD,MAAM,SAAS,GAAG,GAAgB,EAAE;QAClC,MAAM,IAAI,GAAgB;YACxB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;SACtD,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAC5D,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,CAAC;IACtB,IAAI,OAA8B,CAAC;IACnC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;YACxC,4EAA4E;YAC5E,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,wEAAwE;oBACxE,uCAAuC;oBACvC,MAAM,IAAI,gBAAgB,CAAC;wBACzB,IAAI,EAAE,cAAc;wBACpB,OAAO,EAAE,uBAAuB,IAAI,CAAC,KAAK,yBAAyB;wBACnE,SAAS,EAAE,KAAK;wBAChB,gBAAgB,EAAE,IAAI,CAAC,KAAK;qBAC7B,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,UAAU,EAAE,KAAK,CAAC,IAAI;wBACpB,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;wBAC5C,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,OAAO;oBACL,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAM;oBAC3B,WAAW,EAAE,KAAK;oBAClB,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;iBACjC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;gBAC9C,MAAM,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,GAAG,GAAG,CAAC;YACd,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB;gBAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,gBAAgB;gBAAE,MAAM,CAAC,CAAC;YAC3C,4EAA4E;YAC5E,IACE,CAAC,YAAY,KAAK;gBAClB,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EACtD,CAAC;gBACD,MAAM,IAAI,gBAAgB,CAAC;oBACzB,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,cAAc,IAAI,CAAC,KAAK,aAAa;oBAC9C,SAAS,EAAE,KAAK;oBAChB,gBAAgB,EAAE,IAAI,CAAC,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,GAAG;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,0BAA0B,IAAI,CAAC,KAAK,KAAM,CAAW,CAAC,OAAO,EAAE;gBACxE,SAAS,EAAE,IAAI;gBACf,iBAAiB,EAAE,EAAE;gBACrB,gBAAgB,EAAE,IAAI,CAAC,KAAK;aAC7B,CAAC;YACF,IAAI,OAAO,KAAK,WAAW;gBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACjE,MAAM,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACxB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,OAAO,IAAI;QACT,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,iBAAiB,WAAW,YAAY;QAC9D,SAAS,EAAE,KAAK;QAChB,gBAAgB,EAAE,IAAI,CAAC,KAAK;KAC7B,CACF,CAAC;AACJ,CAAC"}

package/dist/disclosure.d.ts

@@ -0,0 +1,55 @@
+/**
+ * disclosure.ts — the single audited disclosure-note TOKENIZER shared across the
+ * keyless DataSources (ADR-0022: an honesty-layer primitive, split into its own
+ * tiny single-concern module — the sibling of coerce.ts's map-layer primitives).
+ *
+ * WHY IT EXISTS: two independent sources (NSF Awards C108 = the OR-note,
+ * ClinicalTrials.gov C109 = the AND-note) each built a mandatory multi-token
+ * disclosure note from the SAME character-for-character delimiter class, and
+ * adversarial verification caught the SAME latent gap on BOTH — a whitespace-only
+ * `.split(/\s+/)` misses the API's PUNCTUATION delimiters, so a compound that only
+ * LOOKS like one token ("coral-reef" = coral OR reef; "Sanofi-Aventis" = Sanofi
+ * AND Aventis) leaks through and the mandatory note is silently SKIPPED. Hoisting
+ * ONE audited tokenizer removes the drift risk (a class regression now fails NSF
+ * AND ClinicalTrials suites at once instead of silently in one) and gives the lint
+ * guardrail (lint-invariants.mjs) + the parity fault test a single home to point
+ * at: "the ONLY sanctioned way to tokenize a disclosure value lives here."
+ *
+ * THE CLASS (`DISCLOSURE_SPLIT_RE`) is the PRECISE ES/Essie confirmed-splitter set,
+ * live-verified byte-identically on BOTH sources 2026-07-12:
+ *   - SPLIT (→ multi-token, the note fires): whitespace + `- , / ; + & | @ # =`
+ *   - DO NOT split (→ one token, no note):   `. : _ '`  (NSF also `\` `*`)
+ * It is deliberately NOT a `[^A-Za-z0-9]+` superset — that would over-disclose a
+ * split the APIs did NOT make on `.`/`_`/`'` (a fabricated union/conjunction). `-`
+ * is placed LAST (a literal, not a range); `/` is escaped for the regex delimiter.
+ *
+ * NOTE-AGNOSTIC BY DESIGN: this returns ONLY the token array. The `.length > 1`
+ * decision, the per-source note WORDING (NSF = OR-union, ClinicalTrials = AND
+ * co-occurrence), and any downstream suppression (ClinicalTrials' sponsor
+ * broadening-note) stay in each CALLER — they are genuinely source-specific and do
+ * NOT belong to the tokenizer.
+ *
+ * THE OPTIONAL `splitRe` PARAM is the sanctioned, honest escape hatch: a FUTURE
+ * source whose analyzer genuinely splits on a DIFFERENT class routes through THIS
+ * helper with its own `splitRe` (explicit, greppable, reviewable) rather than
+ * re-inlining a raw `.split(/\s+/)`. That is exactly what lets the lint ban the
+ * bare whitespace split outright (there is one sanctioned tokenizer, not many).
+ *
+ * No new dep, no I/O, pure function — the exact shape of a coerce.ts primitive.
+ */
+/**
+ * The shared ES/Essie confirmed-splitter class (byte-identical to NSF's former
+ * `NSF_KEYWORD_SPLIT_RE` and ClinicalTrials' former `CT_TOKEN_SPLIT_RE`). Stateless
+ * (no `/g`), so a single module-level RegExp is safe to share across callers.
+ */
+export declare const DISCLOSURE_SPLIT_RE: RegExp;
+/**
+ * Tokenize a disclosure value for a multi-token honesty note: trim, split on the
+ * confirmed-splitter class (default `DISCLOSURE_SPLIT_RE`), and drop empty tokens.
+ * Returns ONLY the token array — the caller owns the `.length > 1` gate + note
+ * wording. `tokenizeForDisclosure("coral-reef")` → `["coral", "reef"]`;
+ * `tokenizeForDisclosure("web_service")` → `["web_service"]` (the class does NOT
+ * split `_`); `tokenizeForDisclosure("robotics")` → `["robotics"]`.
+ */
+export declare function tokenizeForDisclosure(value: string, splitRe?: RegExp): string[];
+//# sourceMappingURL=disclosure.d.ts.map

package/dist/disclosure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosure.d.ts","sourceRoot":"","sources":["../src/disclosure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,MAA4B,GACpC,MAAM,EAAE,CAEV"}