@cliwant/mcp-sam-gov 1.0.0 → 1.1.0

package/README.ja.md

@@ -188,8 +188,9 @@ npm install --omit=dev
 本サーバーの原則は一つ: **もっともらしい捏造より誠実な失敗。** 以下はすべて公開データの*可用性*に関するものであり、いかなるアクセス制御も回避しません。
 
 - **キーレス優先、ダウンしたソースは例外を*投げる*。** すべてのソースが API キーなしで動作します。ソースが rate-limit・ブロック・ダウンした場合、ツールは**型付きエラー**(`rate_limited` / `upstream_unavailable` / `schema_drift` …)を返し、行を捏造したりダウンしたサービスを「結果 0」/「見つからない」と報告しません。本物の空結果と障害は常に区別できます。
-- **任意のオフラインスナップショット (既定 off)。** ゆっくり変わる参照データ(toptier 機関一覧、上位 NAICS ツリー、USAspending 用語集、SBA 規模基準、最新 Treasury「Debt to the Penny」)に限り、**スナップショットミラー**を自前でホストできます。ライブソースが自身の egress から到達不能なときだけ読む静的な公開データキャッシュです。スナップショットが提供されるとき**決してライブとして表示しません** — 応答に `_meta.dataPath: "snapshot"` + `asOf` タイムスタンプが付き、`complete` は強制的に off。未設定なら純ライブ(今日と byte-identical)。
-- **有効化:** `SAMGOV_SNAPSHOT_BASE_URL` をスナップショットのホスティング base URL に設定。未設定(既定) = ライブ専用。
+- **オフラインスナップショット (既定 on)。** ゆっくり変わる参照データ(toptier 機関一覧、上位 NAICS ツリー、USAspending 用語集、SBA 規模基準、最新 Treasury「Debt to the Penny」)は、ライブの連邦ソースが egress から一時的に到達不能なとき、サーバーが既定で `raw.githubusercontent.com/cliwant/mcp-sam-gov/snapshots` にホストされた**公開・週次更新スナップショット**へフォールバックします。ライブの**ハード障害**(障害 / IP 評判ブロック)時のみ取得し、通常運用中は決して取得しません — 公開データ、テレメトリなし。スナップショットが提供されるとき**決してライブとして表示しません** — 応答に `_meta.dataPath: "snapshot"` + `asOf` タイムスタンプが付き、`complete` は強制的に off。rate limit(429)は常に**尊重**し、ミラーへ回避しません。
+- **無効化(純ライブ専用):** `SAMGOV_SNAPSHOT_BASE_URL=off` を設定するとスナップショット経路は追加されず、ライブ専用クライアントと byte-identical。
+- **自前ミラーを指定:** `SAMGOV_SNAPSHOT_BASE_URL` を自分の base URL に設定すれば、公開既定値の代わりに自前ホスティング。
 - **スナップショットのビルド:** ブロックされていないクリーンな egress(ノート PC / 自宅 / クリーンな CI)から `node scripts/build-snapshots.mjs` を実行。**ソース別到達性を自己診断**し、reachability 表 + `manifest.json` を出力します。部分カバレッジでは到達できるソースのみ更新し、残りは **last-good ファイルをそのまま残します**(古くても誠実、決して空にしない)。*すべての*ソースが到達不能なときのみ非ゼロ終了(egress 全面ブロックの合図 — よりクリーンな egress で再実行)。
 - **誠実な境界。** これは**公開データの可用性のみ**を扱います。ビルダーは公開・再配布可能(public-domain / CC0)なデータのみ取り込み、リーダーは `accessLevel: "public"` でない封筒の提供を拒否します。**rate limit を尊重**(429 を回避しない)し、**プロキシ・IP ローテーション・認証/ペイウォール/CAPTCHA 回避なし**、off-host リダイレクトも拒否します。ブロックされた場合の誠実な解決策は、よりクリーンな egress からビルドすることであり、ブロックの回避ではありません。
 

package/README.ko.md

@@ -188,8 +188,9 @@ npm install --omit=dev
 이 서버의 원칙은 하나입니다: **그럴듯한 조작보다 정직한 실패.** 아래는 모두 공개 데이터의 *가용성*에 관한 것이며, 어떤 접근 통제도 우회하지 않습니다.
 
 - **Keyless 우선, 다운된 소스는 예외를 *던진다*.** 모든 소스가 API 키 없이 동작합니다. 소스가 rate-limit·차단·다운되면 도구는 **타입이 지정된 에러**(`rate_limited` / `upstream_unavailable` / `schema_drift` …)를 반환하며, 행을 지어내거나 다운된 서비스를 "결과 0" / "없음"으로 보고하지 않습니다. 진짜 빈 결과와 장애는 항상 구별됩니다.
-- **선택적 오프라인 스냅샷 (기본 off).** 느리게 바뀌는 참조 데이터(toptier 기관 목록, 상위 NAICS 트리, USAspending 용어집, SBA 규모 기준, 최신 Treasury "Debt to the Penny")에 한해, **스냅샷 미러**를 직접 호스팅할 수 있습니다. 라이브 소스가 자신의 egress 에서 도달 불가일 때만 읽는 정적 공개-데이터 캐시입니다. 스냅샷이 서빙되면 **절대 라이브처럼 표시하지 않습니다** — 응답에 `_meta.dataPath: "snapshot"` + `asOf` 타임스탬프가 붙고 `complete` 는 강제로 꺼집니다. 미설정 시 순수 라이브(오늘과 byte-identical).
-- **켜기:** `SAMGOV_SNAPSHOT_BASE_URL` 을 스냅샷 호스팅 base URL 로 설정. 미설정(기본) = 라이브 전용.
+- **오프라인 스냅샷 (기본 on).** 느리게 바뀌는 참조 데이터(toptier 기관 목록, 상위 NAICS 트리, USAspending 용어집, SBA 규모 기준, 최신 Treasury "Debt to the Penny")는, 라이브 연방 소스가 egress 에서 잠시 도달 불가일 때 서버가 기본적으로 `raw.githubusercontent.com/cliwant/mcp-sam-gov/snapshots` 에 호스팅된 **공개·주간 갱신 스냅샷**으로 폴백합니다. 라이브 **하드 실패**(장애 / IP 평판 차단) 시에만 가져오며 평상시엔 절대 아닙니다 — 공개 데이터, 텔레메트리 없음. 스냅샷이 서빙되면 **절대 라이브처럼 표시하지 않습니다** — 응답에 `_meta.dataPath: "snapshot"` + `asOf` 타임스탬프가 붙고 `complete` 는 강제로 꺼집니다. rate limit(429)은 항상 **준수**하며 미러로 우회하지 않습니다.
+- **끄기(순수 라이브 전용):** `SAMGOV_SNAPSHOT_BASE_URL=off` 설정 시 스냅샷 경로가 추가되지 않고 라이브 전용 클라이언트와 byte-identical.
+- **자체 미러 지정:** `SAMGOV_SNAPSHOT_BASE_URL` 을 자신의 base URL 로 설정하면 공개 기본값 대신 직접 호스팅.
 - **스냅샷 빌드:** 차단되지 않은 깨끗한 egress(노트북 / 집 / 깨끗한 CI)에서 `node scripts/build-snapshots.mjs` 실행. **소스별 도달성을 자가 진단**하고 reachability 표 + `manifest.json` 을 출력합니다. 부분 커버리지에서는 도달 가능한 소스만 갱신하고 나머지는 **last-good 파일을 그대로 둡니다**(오래됐어도 정직, 절대 비우지 않음). *모든* 소스가 도달 불가일 때만 non-zero 종료(egress 전면 차단 신호 — 더 깨끗한 egress 에서 재실행).
 - **정직한 경계.** 이것은 **공개-데이터 가용성만** 다룹니다. 빌더는 공개·재배포 가능(public-domain / CC0) 데이터만 수집하고, 리더는 `accessLevel: "public"` 이 아닌 봉투는 서빙을 거부합니다. **rate limit 을 준수**(429 를 우회하지 않음)하고 **프록시·IP 로테이션·인증/페이월/CAPTCHA 우회 없음**, off-host 리다이렉트도 거부합니다. 차단되면 정직한 해법은 더 깨끗한 egress 에서 빌드하는 것이지 차단을 회피하는 것이 아닙니다.
 

package/README.md

@@ -340,6 +340,34 @@ A handful of sources ride the shared **api.data.gov** gateway — Congress.gov,
 
 Get one free (instant, no wait) at [api.data.gov/signup](https://api.data.gov/signup). The same key is accepted across all api.data.gov / api.gsa.gov sources. Like the SAM key, it is sent only on the wire (never logged); unset simply means `DEMO_KEY`. BLS sources similarly accept an optional free `BLS_API_KEY` to lift their daily quota.
 
+### Keys & higher limits — the full inventory
+
+**Most tools are keyless.** Only **Census** (`census_business_patterns`) and **FRED** (`fred_search_series`, `fred_series_observations`) *require* a key — those sources have no keyless tier, so the tool throws without one. The other five keys are *optional*: they only raise a rate limit or unlock a single filter. **Every key below is free.**
+
+| Env var | Required? | What it unlocks | Free signup |
+|---|---|---|---|
+| `CENSUS_API_KEY` | **Required** | `census_business_patterns` (no keyless tier — throws without it) | [api.census.gov/data/key_signup.html](https://api.census.gov/data/key_signup.html) |
+| `FRED_API_KEY` | **Required** | the 2 FRED tools (no keyless tier — throw without it) | [fred.stlouisfed.org/docs/api/api_key.html](https://fred.stlouisfed.org/docs/api/api_key.html) |
+| `DATA_GOV_API_KEY` | Optional | higher limits on all api.data.gov sources (Regulations.gov, FAC, NPPES, CMS, data.gov catalog, GSA per-diem) — lifts the shared `DEMO_KEY` cap | [api.data.gov/signup](https://api.data.gov/signup/) |
+| `SAM_GOV_API_KEY` | Optional | authenticated SAM.gov v2 search + the organization-name filter | [open.gsa.gov/api/get-opportunities-public-api](https://open.gsa.gov/api/get-opportunities-public-api/) |
+| `BLS_API_KEY` | Optional | the BLS v2 tier (~500 queries/day vs keyless ~25/day) | [data.bls.gov/registrationEngine](https://data.bls.gov/registrationEngine/) |
+| `NVD_API_KEY` | Optional | a higher NVD rate limit (`cve_lookup`) | [nvd.nist.gov/developers/request-an-api-key](https://nvd.nist.gov/developers/request-an-api-key) |
+| `SOCRATA_APP_TOKEN` | Optional | higher Socrata throttling limits | [evergreen.data.socrata.com/signup](https://evergreen.data.socrata.com/signup) |
+
+**Two ways to set any key** — pick one:
+
+1. **Host env block** — the `"env": { … }` object shown in the examples above.
+2. **A `.env` file** in the server's working directory — configure your keys **once**:
+   ```
+   CENSUS_API_KEY=your-key-here
+   FRED_API_KEY=your-key-here
+   # optional — raise limits / unlock filters
+   SAM_GOV_API_KEY=your-key-here
+   ```
+   The server auto-loads `.env` at startup. A real environment variable always wins over `.env` (standard precedence), and `.env` is git-ignored so your keys never get committed.
+
+**Ask the server which keys it needs.** The keyless **`api_key_status`** tool lists every key, whether it's required or optional, the free signup URL + what it unlocks, and whether each is **currently configured** (a boolean — the key value is never shown). Creating the account at the signup URL is your one manual step; the server automates *discovery* (`api_key_status`) and *configuration* (`.env`). To confirm a key actually works, call that source's own tool.
+
 ---
 
 ## Tool catalog (111 tools)
@@ -525,13 +553,14 @@ This server is built around one rule: **honest failure over confident fabricatio
 
 **Keyless-first, and a down source *throws*.** Every source works with no API key. When a source is rate-limited, blocked, or down, the tool returns a **typed error** (`rate_limited` / `upstream_unavailable` / `schema_drift` / …) — it never invents rows and never reports a DOWN service as "0 results" or "not found". A genuine empty result and an outage are always distinguishable.
 
-**Optional offline snapshots (off by default).** Some reference data changes slowly — the toptier-agency list, the top-level NAICS tree, the USAspending glossary, SBA size standards, the latest Treasury "Debt to the Penny." For those, you can optionally host a **snapshot mirror**: a static, public-data cache the server reads *only* when the live source is unreachable from your egress. A served snapshot is **never presented as live** — the response carries `_meta.dataPath: "snapshot"` plus an `asOf` timestamp, and `complete` is forced off, so an AI agent (and you) always see the staleness. Unset ⇒ pure live, byte-for-byte identical to today's behavior.
+**Offline snapshots (on by default).** Some reference data changes slowly — the toptier-agency list, the top-level NAICS tree, the USAspending glossary, SBA size standards, the latest Treasury "Debt to the Penny." By default, when a live federal source is briefly unreachable from your egress, the server falls back to a **public, weekly-refreshed snapshot** of that slow-changing reference data, hosted at `raw.githubusercontent.com/cliwant/mcp-sam-gov/snapshots`. It only fetches on a **live hard-failure** (an outage / IP-reputation block), never during normal operation — public data, no telemetry. A served snapshot is **never presented as live** — the response carries `_meta.dataPath: "snapshot"` plus an `asOf` timestamp, and `complete` is forced off, so an AI agent (and you) always see the staleness. A rate limit (429) is always **honored**, never routed around onto the mirror.
 
-- **Enable it:** set `SAMGOV_SNAPSHOT_BASE_URL` to the base URL where you host the snapshots. Unset (the default) = live-only, no snapshot path is ever added.
+- **Disable it (pure live-only):** set `SAMGOV_SNAPSHOT_BASE_URL=off`. Then no snapshot path is ever added and behavior is byte-for-byte identical to a live-only client.
+- **Point at your own mirror:** set `SAMGOV_SNAPSHOT_BASE_URL` to your base URL to host the snapshots yourself instead of using the public default.
 
   ```json
   { "mcpServers": { "sam-gov": { "command": "mcp-sam-gov",
-      "env": { "SAMGOV_SNAPSHOT_BASE_URL": "https://your-cdn.example.com/snapshots" } } } }
+      "env": { "SAMGOV_SNAPSHOT_BASE_URL": "off" } } } }
   ```
 
 - **Build the snapshots:** run `node scripts/build-snapshots.mjs` from any clean, non-blocked egress (a laptop / home / clean CI runner). It **self-diagnoses per-source reachability**, prints a reachability table, and writes a `manifest.json`. On partial coverage it refreshes only the sources it can reach and **leaves the last-good file in place** for the rest (stale-but-honest, never blanked). It exits non-zero only when *zero* sources were reachable (a fully blocked egress — the signal to re-run from a cleaner one).

package/dist/census-economic.d.ts

@@ -0,0 +1,93 @@
+/**
+ * US Census — County Business Patterns (CBP) — the MARKET-SIZING lane
+ * (ADR-0047, Wave-4 source #1). NAICS × geography establishments / employment /
+ * annual payroll — the demand-side complement to BLS-QCEW + USAspending in the
+ * B2G market-sizing set.
+ *
+ * ★ THIS IS THE SERVER'S FIRST KEY-REQUIRED SOURCE. The Census Data API removed
+ *   its keyless tier — a request WITHOUT a key is 302-redirected to a "Missing
+ *   Key" HTML page. So, honestly: with NO `CENSUS_API_KEY` this tool THROWS an
+ *   `invalid_input` config error BEFORE any fetch (never a fake-empty, never a
+ *   keyless-pretend). The other 111 tools stay keyless — this key is scoped to
+ *   this one source. (Contrast the OPTIONAL keys of datagov/bls/nvd, which lift a
+ *   tier but are not required.)
+ *
+ * DIFFERENT HOST than census.ts (the geocoder, geocoding.geo.census.gov): the
+ * DATA API is `api.census.gov/data/{year}/cbp`. This module COPIES (does NOT
+ * import) the census.ts fixed-host SSRF idiom (a single host const + a
+ * post-construction `new URL().hostname` assertion + `redirect:"error"`) and does
+ * NOT touch census_geocode.
+ *
+ * Coercion/meta code is REUSED (`driftError`, `errorFromResponse`, `num`
+ * coerce.ts null-never-0, `withMeta`/`buildMeta`). The ONE bespoke bit is the
+ * fetch: a single `fetch(redirect:"manual")` (NOT the shared getJson) so a
+ * missing/invalid-key 302 surfaces as an INSPECTABLE opaque-redirect → honest
+ * invalid_input, instead of undici's redirect:"error" TypeError that
+ * fetchWithRetry would mask as a retryable outage (see the fetch block). The
+ * optional-key leak discipline is MIRRORED from datagovKey.ts/bls.ts — but here
+ * the key is REQUIRED and rides ONLY in the `&key=` query param, NOWHERE else
+ * (never the label, `_meta.source`, notes, or a log — the K-test).
+ *
+ *   GET https://api.census.gov/data/{year}/cbp
+ *       ?get=NAME,NAICS2017_LABEL,ESTAB,EMP,PAYANN,GEO_ID
+ *       &for=<geoClause>            (us:* | state:* | state:NN | county:*)
+ *       &in=state:NN                (county queries only)
+ *       &NAICS2017=<naics>          (optional NAICS filter)
+ *       &key=<CENSUS_API_KEY>       (REQUIRED)
+ *   → a 2D JSON ARRAY: row 0 = column headers, rows 1..N = data. e.g.
+ *     [["NAME","ESTAB","EMP","PAYANN","NAICS2017","NAICS2017_LABEL","state"],
+ *      ["California","39755","...","...","5415","...","06"], ...]
+ *
+ * ★ HONESTY (ADR-0047 P1–P5):
+ *   [KEY]  no key ⇒ invalid_input THROW pre-fetch (0 fetch); the message names
+ *          CENSUS_API_KEY + the free-signup URL. A wire 302 (a key that IS set but is
+ *          invalid → the Missing-Key page) is caught via redirect:"manual" as an
+ *          opaque-redirect ⇒ invalid_input "check CENSUS_API_KEY" (never a
+ *          fake-empty, never a masked outage).
+ *   [P1]   CBP returns the COMPLETE geography set for the filter (no server
+ *          pagination) ⇒ totalAvailable = the row count, complete:true. NEVER
+ *          fabricated (RED if totalAvailable = header-length or invented).
+ *   [P3]   ★the sentinel→null crux: Census suppresses/withholds cells with large
+ *          NEGATIVE sentinels (-999999999 / -888888888 / -666666666 …). `censusNum`
+ *          maps any value ≤ -100000000 to **null** (withheld) — NEVER a negative
+ *          number, NEVER 0. A genuine 0 stays 0. `annualPayrollUsd = PAYANN×1000`
+ *          (PAYANN is in $1,000 units), null-preserving.
+ *   [P2]   a 302 ⇒ invalid_input (key); a header-only body ⇒ honest empty
+ *          (returned:0, complete:true); a 5xx ⇒ upstream_unavailable THROW; a 200
+ *          non-JSON ⇒ schema_drift.
+ *   [P4]   a body that is not an array, or whose row 0 is not a string[] header
+ *          row ⇒ driftError (never a fabricated empty).
+ *   [SSRF] fixed host; `year` re-guarded ^\d{4}$ (it rides in the PATH); `naics`
+ *          ^\d{2,6}$; `state` ^\d{2}$; geography enum {us,state,county}. All
+ *          predicate VALUES ride in URLSearchParams. The key rides `&key=` ONLY.
+ */
+import { num } from "./coerce.js";
+import { type MetaBundle } from "./meta.js";
+export { num };
+/** Read CENSUS_API_KEY from env; trim; return the value or undefined (unset/blank). */
+export declare function censusApiKey(): string | undefined;
+export type CbpRow = {
+    name: string | null;
+    geoId: string | null;
+    naicsCode: string | null;
+    naicsLabel: string | null;
+    establishments: number | null;
+    employees: number | null;
+    annualPayrollUsd: number | null;
+    state: string | null;
+};
+export type CensusBusinessPatternsArgs = {
+    naics?: string;
+    geography?: string;
+    state?: string;
+    year?: string;
+    limit?: number;
+};
+/**
+ * Fetch County Business Patterns rows for a NAICS × geography filter → normalized
+ * establishment / employment / annual-payroll rows + honest `_meta`. REQUIRES
+ * CENSUS_API_KEY (throws invalid_input pre-fetch when unset). The 2D-array body is
+ * parsed by HEADER NAME (order-independent); suppressed cells map to null.
+ */
+export declare function businessPatterns(args: CensusBusinessPatternsArgs): Promise<MetaBundle>;
+//# sourceMappingURL=census-economic.d.ts.map

package/dist/census-economic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"census-economic.d.ts","sourceRoot":"","sources":["../src/census-economic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAIH,OAAO,EAAE,GAAG,EAAO,MAAM,aAAa,CAAC;AACvC,OAAO,EAAY,KAAK,UAAU,EAAqB,MAAM,WAAW,CAAC;AAKzE,OAAO,EAAE,GAAG,EAAE,CAAC;AA+Bf,uFAAuF;AACvF,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAIjD;AAGD,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,CAAC;AAiBF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,UAAU,CAAC,CA+QrB"}

package/dist/census-economic.js

@@ -0,0 +1,355 @@
+/**
+ * US Census — County Business Patterns (CBP) — the MARKET-SIZING lane
+ * (ADR-0047, Wave-4 source #1). NAICS × geography establishments / employment /
+ * annual payroll — the demand-side complement to BLS-QCEW + USAspending in the
+ * B2G market-sizing set.
+ *
+ * ★ THIS IS THE SERVER'S FIRST KEY-REQUIRED SOURCE. The Census Data API removed
+ *   its keyless tier — a request WITHOUT a key is 302-redirected to a "Missing
+ *   Key" HTML page. So, honestly: with NO `CENSUS_API_KEY` this tool THROWS an
+ *   `invalid_input` config error BEFORE any fetch (never a fake-empty, never a
+ *   keyless-pretend). The other 111 tools stay keyless — this key is scoped to
+ *   this one source. (Contrast the OPTIONAL keys of datagov/bls/nvd, which lift a
+ *   tier but are not required.)
+ *
+ * DIFFERENT HOST than census.ts (the geocoder, geocoding.geo.census.gov): the
+ * DATA API is `api.census.gov/data/{year}/cbp`. This module COPIES (does NOT
+ * import) the census.ts fixed-host SSRF idiom (a single host const + a
+ * post-construction `new URL().hostname` assertion + `redirect:"error"`) and does
+ * NOT touch census_geocode.
+ *
+ * Coercion/meta code is REUSED (`driftError`, `errorFromResponse`, `num`
+ * coerce.ts null-never-0, `withMeta`/`buildMeta`). The ONE bespoke bit is the
+ * fetch: a single `fetch(redirect:"manual")` (NOT the shared getJson) so a
+ * missing/invalid-key 302 surfaces as an INSPECTABLE opaque-redirect → honest
+ * invalid_input, instead of undici's redirect:"error" TypeError that
+ * fetchWithRetry would mask as a retryable outage (see the fetch block). The
+ * optional-key leak discipline is MIRRORED from datagovKey.ts/bls.ts — but here
+ * the key is REQUIRED and rides ONLY in the `&key=` query param, NOWHERE else
+ * (never the label, `_meta.source`, notes, or a log — the K-test).
+ *
+ *   GET https://api.census.gov/data/{year}/cbp
+ *       ?get=NAME,NAICS2017_LABEL,ESTAB,EMP,PAYANN,GEO_ID
+ *       &for=<geoClause>            (us:* | state:* | state:NN | county:*)
+ *       &in=state:NN                (county queries only)
+ *       &NAICS2017=<naics>          (optional NAICS filter)
+ *       &key=<CENSUS_API_KEY>       (REQUIRED)
+ *   → a 2D JSON ARRAY: row 0 = column headers, rows 1..N = data. e.g.
+ *     [["NAME","ESTAB","EMP","PAYANN","NAICS2017","NAICS2017_LABEL","state"],
+ *      ["California","39755","...","...","5415","...","06"], ...]
+ *
+ * ★ HONESTY (ADR-0047 P1–P5):
+ *   [KEY]  no key ⇒ invalid_input THROW pre-fetch (0 fetch); the message names
+ *          CENSUS_API_KEY + the free-signup URL. A wire 302 (a key that IS set but is
+ *          invalid → the Missing-Key page) is caught via redirect:"manual" as an
+ *          opaque-redirect ⇒ invalid_input "check CENSUS_API_KEY" (never a
+ *          fake-empty, never a masked outage).
+ *   [P1]   CBP returns the COMPLETE geography set for the filter (no server
+ *          pagination) ⇒ totalAvailable = the row count, complete:true. NEVER
+ *          fabricated (RED if totalAvailable = header-length or invented).
+ *   [P3]   ★the sentinel→null crux: Census suppresses/withholds cells with large
+ *          NEGATIVE sentinels (-999999999 / -888888888 / -666666666 …). `censusNum`
+ *          maps any value ≤ -100000000 to **null** (withheld) — NEVER a negative
+ *          number, NEVER 0. A genuine 0 stays 0. `annualPayrollUsd = PAYANN×1000`
+ *          (PAYANN is in $1,000 units), null-preserving.
+ *   [P2]   a 302 ⇒ invalid_input (key); a header-only body ⇒ honest empty
+ *          (returned:0, complete:true); a 5xx ⇒ upstream_unavailable THROW; a 200
+ *          non-JSON ⇒ schema_drift.
+ *   [P4]   a body that is not an array, or whose row 0 is not a string[] header
+ *          row ⇒ driftError (never a fabricated empty).
+ *   [SSRF] fixed host; `year` re-guarded ^\d{4}$ (it rides in the PATH); `naics`
+ *          ^\d{2,6}$; `state` ^\d{2}$; geography enum {us,state,county}. All
+ *          predicate VALUES ride in URLSearchParams. The key rides `&key=` ONLY.
+ */
+import { ToolErrorCarrier, errorFromResponse } from "./errors.js";
+import { driftError } from "./datasource.js";
+import { num, str } from "./coerce.js";
+import { withMeta } from "./meta.js";
+// Re-export the shared honesty coercion (single audited copy in ./coerce.js —
+// ADR-0005 v2 FIX-C) so a num regression fails together across sources. NO local
+// num/str.
+export { num };
+// ─── SSRF core: the single fixed host (DIFFERENT from census.ts) ──
+const CENSUS_DATA_HOST = "api.census.gov";
+const CENSUS_DATA_LABEL = "census:/data/cbp"; // host-only ToolError surface; NO token, NO key
+// ─── Validation charclasses (SSRF + "verify the input" honesty) ───
+const YEAR_RE = /^\d{4}$/; // rides in the PATH — strict 4-digit (no path injection)
+const NAICS_RE = /^\d{2,6}$/; // 2–6 digit NAICS-2017 sector/code
+const STATE_FIPS_RE = /^\d{2}$/; // 2-digit state FIPS
+const GEOGRAPHIES = new Set(["us", "state", "county"]);
+// The Census suppression/withhold sentinel floor. Census encodes a suppressed or
+// unavailable cell as a large NEGATIVE value (-999999999 / -888888888 /
+// -666666666 …). Establishment/employment/payroll counts are non-negative, so any
+// value at/below this floor is a sentinel, NOT data.
+const CENSUS_SENTINEL_FLOOR = -100000000;
+const DEFAULT_YEAR = "2022"; // the latest confirmed CBP vintage (ADR-0047)
+// ─── Honesty notes (ADR-0047 required set) ────────────────────────
+const KEY_REQUIRED_NOTE = "This source REQUIRES a free CENSUS_API_KEY (the Census Data API has no keyless tier). The key is sent ONLY as the &key= query parameter to api.census.gov and is NEVER logged, echoed, or placed in this response.";
+const PAYROLL_UNITS_NOTE = "annualPayrollUsd is ANNUAL payroll in US dollars, converted from the Census PAYANN field's $1,000 units (×1000). establishments and employees are integer counts (as-of the reference year).";
+const SUPPRESSED_NOTE = "Census suppresses cells for confidentiality/reliability using large negative sentinels (e.g. -999999999); such values are mapped to null (withheld) — NEVER a negative number and NEVER 0. A genuine 0 is preserved as 0.";
+const NO_PAGINATION_NOTE = "CBP returns the COMPLETE set of geographies matching the filter (no server-side pagination); totalAvailable equals the number of rows returned. Narrow with naics / geography to reduce the row count.";
+// ─── The key seam (REQUIRED; value NEVER leaked past the &key= param) ──
+/** Read CENSUS_API_KEY from env; trim; return the value or undefined (unset/blank). */
+export function censusApiKey() {
+    const raw = process.env.CENSUS_API_KEY;
+    const trimmed = typeof raw === "string" ? raw.trim() : "";
+    return trimmed ? trimmed : undefined;
+}
+/** num(), but map the Census negative suppression sentinel family → null (withheld). */
+function censusNum(v) {
+    const n = num(v);
+    if (n === null)
+        return null;
+    // A large-negative sentinel is a WITHHELD/suppressed cell, never data. A genuine
+    // 0 (n > floor) passes through as 0.
+    if (n <= CENSUS_SENTINEL_FLOOR)
+        return null;
+    return n;
+}
+/** Annual payroll: PAYANN is in $1,000 units → ×1000; null-preserving. */
+function mul1000(n) {
+    return n === null ? null : n * 1000;
+}
+/**
+ * Fetch County Business Patterns rows for a NAICS × geography filter → normalized
+ * establishment / employment / annual-payroll rows + honest `_meta`. REQUIRES
+ * CENSUS_API_KEY (throws invalid_input pre-fetch when unset). The 2D-array body is
+ * parsed by HEADER NAME (order-independent); suppressed cells map to null.
+ */
+export async function businessPatterns(args) {
+    // ── [KEY] REQUIRED key — throw an honest config error BEFORE any fetch. ──
+    const key = censusApiKey();
+    if (key === undefined) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: "Census Data API requires a free key. Get one at https://api.census.gov/data/key_signup.html and set CENSUS_API_KEY.",
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    // ── Validate + default the inputs (belt-and-suspenders behind the server Zod;
+    //    a DIRECT handler call bypasses Zod). ──
+    const year = args.year ?? DEFAULT_YEAR;
+    if (!YEAR_RE.test(year)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: `Invalid year ${JSON.stringify(year)} — expected a 4-digit year (^\\d{4}$), e.g. "2022". (year rides in the request PATH; it is strictly validated.)`,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    const geography = args.geography ?? "us";
+    if (!GEOGRAPHIES.has(geography)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: `Invalid geography ${JSON.stringify(geography)} — expected one of us, state, county.`,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    if (args.state !== undefined && !STATE_FIPS_RE.test(args.state)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: `Invalid state ${JSON.stringify(args.state)} — expected a 2-digit state FIPS code (^\\d{2}$), e.g. "06" (California).`,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    if (args.naics !== undefined && !NAICS_RE.test(args.naics)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: `Invalid naics ${JSON.stringify(args.naics)} — expected a 2–6 digit NAICS-2017 code (^\\d{2,6}$), e.g. "5415" (Computer Systems Design).`,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    // ── Resolve the geography clause (for=… [+ in=state:…]). ──
+    let forClause;
+    let inClause;
+    let geoFilter;
+    if (geography === "us") {
+        forClause = "us:*";
+        geoFilter = "geography:us";
+    }
+    else if (geography === "state") {
+        forClause = args.state !== undefined ? `state:${args.state}` : "state:*";
+        geoFilter = `geography:state:${args.state ?? "*"}`;
+    }
+    else {
+        // county — requires a state (the CBP `in=state:` predicate is mandatory).
+        if (args.state === undefined) {
+            throw new ToolErrorCarrier({
+                kind: "invalid_input",
+                retryable: false,
+                message: "geography 'county' requires `state` (a 2-digit FIPS) — CBP county queries need an `in=state:NN` predicate. Pass state, e.g. state:'06'.",
+                upstreamEndpoint: CENSUS_DATA_LABEL,
+            });
+        }
+        forClause = "county:*";
+        inClause = `state:${args.state}`;
+        geoFilter = `geography:county:* in state:${args.state}`;
+    }
+    // ── Build the query (all VALUES via URLSearchParams — no host/path steer; the
+    //    REQUIRED key rides ONLY here in &key=). ──
+    const params = new URLSearchParams();
+    params.set("get", "NAME,NAICS2017_LABEL,ESTAB,EMP,PAYANN,GEO_ID");
+    params.set("for", forClause);
+    if (inClause !== undefined)
+        params.set("in", inClause);
+    if (args.naics !== undefined)
+        params.set("NAICS2017", args.naics);
+    params.set("key", key);
+    const url = `https://${CENSUS_DATA_HOST}/data/${year}/cbp?${params.toString()}`;
+    // Belt-and-suspenders: the fixed host + strictly-validated path leave nothing to
+    // steer the authority; assert the built URL cannot have been moved off-host.
+    const built = new URL(url);
+    if (built.hostname !== CENSUS_DATA_HOST || built.protocol !== "https:") {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: `Constructed Census Data URL host ${JSON.stringify(built.hostname)} (${built.protocol}) is not ${CENSUS_DATA_HOST} over https — refusing to fetch (SSRF safety).`,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    // ── Fetch with redirect:"manual" — the KEY-ERROR DETECTION crux. A missing or
+    //    invalid key makes the Census Data API 302-redirect to its "Missing Key" page
+    //    (live-verified: `HTTP 302` + `Location: /data/missing_key.html` +
+    //    `X-DataWebAPI-KeyError: 1`). We must NOT use redirect:"error" via getJson
+    //    here: undici rejects an "error"-mode redirect with a TypeError that the
+    //    shared fetchWithRetry catch reclassifies to a *retryable upstream_unavailable*
+    //    — masking a key-config error as a transient outage. redirect:"manual" instead
+    //    yields an INSPECTABLE opaque-redirect (type "opaqueredirect", status 0), so
+    //    the missing/invalid key surfaces as an honest invalid_input. This is a
+    //    SINGLE classified attempt (no auto-retry): a transient 5xx THROWS
+    //    upstream_unavailable — re-invoke the tool to retry. The 5xx/404/400 taxonomy
+    //    is delegated to the shared errors.ts `errorFromResponse`; a 200 non-JSON body
+    //    ⇒ r.json() SyntaxError ⇒ schema_drift. The redirect is NEVER followed, so no
+    //    off-host hop can occur (a stronger SSRF posture than redirect:"error"). ──
+    let res;
+    try {
+        res = await fetch(built.toString(), {
+            redirect: "manual",
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch (e) {
+        // Timeout/abort ⇒ non-retryable (the same aborted signal would re-reject);
+        // a genuine network TypeError ⇒ retryable upstream_unavailable. NEVER empty.
+        if (e instanceof Error &&
+            (e.name === "TimeoutError" || e.name === "AbortError")) {
+            throw new ToolErrorCarrier({
+                kind: "upstream_unavailable",
+                message: `Request to ${CENSUS_DATA_LABEL} timed out.`,
+                retryable: false,
+                upstreamEndpoint: CENSUS_DATA_LABEL,
+            });
+        }
+        throw new ToolErrorCarrier({
+            kind: "upstream_unavailable",
+            message: `Network error reaching ${CENSUS_DATA_LABEL}: ${e instanceof Error ? e.message : String(e)}`,
+            retryable: true,
+            retryAfterSeconds: 30,
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    // [KEY] A redirect (opaque-redirect via redirect:"manual", or a raw 3xx status) ⇒
+    // the missing/invalid-key "Missing Key" page ⇒ an honest key-config error, NEVER
+    // a fake-empty (swallowing this as empty ⇒ RED in the fault suite).
+    if (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            retryable: false,
+            message: "Census Data API redirected the request to its 'Missing Key' page — CENSUS_API_KEY is missing or invalid. Get or check a free key at https://api.census.gov/data/key_signup.html.",
+            upstreamEndpoint: CENSUS_DATA_LABEL,
+        });
+    }
+    // [P2] 404/429/5xx/4xx ⇒ the shared errors.ts taxonomy (a DOWN service is NEVER
+    // an empty result; 400 → invalid_input, 5xx → upstream_unavailable, …).
+    if (!res.ok) {
+        throw new ToolErrorCarrier(errorFromResponse(res, CENSUS_DATA_LABEL));
+    }
+    // [P4] 200 ⇒ parse JSON; a non-JSON body (an HTML error page at 200) makes
+    // r.json() throw a SyntaxError ⇒ schema_drift (never read as an empty result).
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch (e) {
+        if (e instanceof SyntaxError) {
+            throw driftError(CENSUS_DATA_LABEL, "Census CBP returned a non-JSON body at HTTP 200 (likely an HTML 'Missing Key' / error page) — treating as schema drift (never read as an empty result).");
+        }
+        throw e;
+    }
+    // ── [P4] Parse the 2D array: row 0 = string[] header, rows 1..N = data. ──
+    if (!Array.isArray(body) || body.length === 0) {
+        throw driftError(CENSUS_DATA_LABEL, "Census CBP returned a body that is not a non-empty 2D array — treating as schema drift (never a fabricated empty).");
+    }
+    const header = body[0];
+    if (!Array.isArray(header) ||
+        header.length === 0 ||
+        !header.every((h) => typeof h === "string")) {
+        throw driftError(CENSUS_DATA_LABEL, "Census CBP row 0 is not a string[] header row — treating as schema drift (the 2D-array contract changed; never a fabricated empty).");
+    }
+    // Header-name → column index (order-independent; a missing column ⇒ index -1 ⇒
+    // the field maps to null, never a positional mis-read).
+    const idx = new Map();
+    header.forEach((h, i) => idx.set(h, i));
+    const col = (row, name) => {
+        const i = idx.get(name);
+        return i === undefined || i < 0 ? undefined : row[i];
+    };
+    const allRows = [];
+    for (let i = 1; i < body.length; i++) {
+        const raw = body[i];
+        if (!Array.isArray(raw)) {
+            throw driftError(CENSUS_DATA_LABEL, `Census CBP data row ${i} is not an array — treating as schema drift (never a fabricated empty).`);
+        }
+        const row = raw;
+        allRows.push({
+            name: str(col(row, "NAME")),
+            geoId: str(col(row, "GEO_ID")),
+            naicsCode: str(col(row, "NAICS2017")),
+            naicsLabel: str(col(row, "NAICS2017_LABEL")),
+            establishments: censusNum(col(row, "ESTAB")),
+            employees: censusNum(col(row, "EMP")),
+            annualPayrollUsd: mul1000(censusNum(col(row, "PAYANN"))),
+            state: str(col(row, "state")),
+        });
+    }
+    // ── [P1] The COMPLETE set for the filter (no server pagination). An OPTIONAL
+    //    client-side top-N slice is disclosed (totalAvailable stays the full count,
+    //    so buildMeta derives truncated/complete honestly). ──
+    const totalAvailable = allRows.length;
+    const notes = [
+        KEY_REQUIRED_NOTE,
+        PAYROLL_UNITS_NOTE,
+        SUPPRESSED_NOTE,
+        NO_PAGINATION_NOTE,
+    ];
+    let rows = allRows;
+    if (typeof args.limit === "number" &&
+        Number.isFinite(args.limit) &&
+        args.limit >= 0 &&
+        args.limit < allRows.length) {
+        rows = allRows.slice(0, args.limit);
+        notes.push(`Returned the first ${rows.length} of ${totalAvailable} rows (client-side limit=${args.limit}); CBP has NO server-side pagination, so the remaining ${totalAvailable - rows.length} are not fetched separately — raise limit or narrow the filter to see them.`);
+    }
+    const filtersApplied = [
+        args.naics !== undefined ? `naics:${args.naics}` : "naics:(all)",
+        geoFilter,
+        `year:${year}`,
+    ];
+    const meta = {
+        // MODE only — never the key value (K-test).
+        source: `api.census.gov /data/${year}/cbp (County Business Patterns; CENSUS_API_KEY)`,
+        keylessMode: false, // ★KEYED — the first key-required source
+        returned: rows.length,
+        totalAvailable,
+        filtersApplied,
+        filtersDropped: [],
+        fieldsUnavailable: [],
+        notes,
+    };
+    return withMeta({ rows }, meta);
+}
+//# sourceMappingURL=census-economic.js.map

package/dist/census-economic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"census-economic.js","sourceRoot":"","sources":["../src/census-economic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAsC,MAAM,WAAW,CAAC;AAEzE,8EAA8E;AAC9E,iFAAiF;AACjF,WAAW;AACX,OAAO,EAAE,GAAG,EAAE,CAAC;AAEf,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,CAAC,gDAAgD;AAE9F,qEAAqE;AACrE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,yDAAyD;AACpF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,mCAAmC;AACjE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,qBAAqB;AACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvD,iFAAiF;AACjF,wEAAwE;AACxE,kFAAkF;AAClF,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,CAAC,SAAS,CAAC;AAEzC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,8CAA8C;AAE3E,qEAAqE;AACrE,MAAM,iBAAiB,GACrB,oNAAoN,CAAC;AACvN,MAAM,kBAAkB,GACtB,8LAA8L,CAAC;AACjM,MAAM,eAAe,GACnB,2NAA2N,CAAC;AAC9N,MAAM,kBAAkB,GACtB,wMAAwM,CAAC;AAE3M,0EAA0E;AAC1E,uFAAuF;AACvF,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAcD,wFAAwF;AACxF,SAAS,SAAS,CAAC,CAAU;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,iFAAiF;IACjF,qCAAqC;IACrC,IAAI,CAAC,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0EAA0E;AAC1E,SAAS,OAAO,CAAC,CAAgB;IAC/B,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AACtC,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAgC;IAEhC,4EAA4E;IAC5E,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EACL,qHAAqH;YACvH,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iHAAiH;YAC9J,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,uCAAuC;YAC9F,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,2EAA2E;YAC/H,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8FAA8F;YAClJ,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAiB,CAAC;IACtB,IAAI,QAA4B,CAAC;IACjC,IAAI,SAAiB,CAAC;IACtB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,SAAS,GAAG,MAAM,CAAC;QACnB,SAAS,GAAG,cAAc,CAAC;IAC7B,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,SAAS,GAAG,mBAAmB,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,0EAA0E;QAC1E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CAAC;gBACzB,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,KAAK;gBAChB,OAAO,EACL,yIAAyI;gBAC3I,gBAAgB,EAAE,iBAAiB;aACpC,CAAC,CAAC;QACL,CAAC;QACD,SAAS,GAAG,UAAU,CAAC;QACvB,QAAQ,GAAG,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,SAAS,GAAG,+BAA+B,IAAI,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAED,+EAA+E;IAC/E,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEvB,MAAM,GAAG,GAAG,WAAW,gBAAgB,SAAS,IAAI,QAAQ,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAChF,iFAAiF;IACjF,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,YAAY,gBAAgB,gDAAgD;YAC1K,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,kFAAkF;IAClF,uEAAuE;IACvE,+EAA+E;IAC/E,6EAA6E;IAC7E,oFAAoF;IACpF,mFAAmF;IACnF,iFAAiF;IACjF,4EAA4E;IAC5E,uEAAuE;IACvE,kFAAkF;IAClF,mFAAmF;IACnF,kFAAkF;IAClF,gFAAgF;IAChF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE;YAClC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,2EAA2E;QAC3E,6EAA6E;QAC7E,IACE,CAAC,YAAY,KAAK;YAClB,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EACtD,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC;gBACzB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,cAAc,iBAAiB,aAAa;gBACrD,SAAS,EAAE,KAAK;gBAChB,gBAAgB,EAAE,iBAAiB;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0BAA0B,iBAAiB,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACrG,SAAS,EAAE,IAAI;YACf,iBAAiB,EAAE,EAAE;YACrB,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,iFAAiF;IACjF,oEAAoE;IACpE,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,SAAS,EAAE,KAAK;YAChB,OAAO,EACL,kLAAkL;YACpL,gBAAgB,EAAE,iBAAiB;SACpC,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;YAC7B,MAAM,UAAU,CACd,iBAAiB,EACjB,yJAAyJ,CAC1J,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IAED,4EAA4E;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,UAAU,CACd,iBAAiB,EACjB,oHAAoH,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3C,CAAC;QACD,MAAM,UAAU,CACd,iBAAiB,EACjB,qIAAqI,CACtI,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,wDAAwD;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,MAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,CAAC,GAAc,EAAE,IAAY,EAAW,EAAE;QACpD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC;IAEF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,UAAU,CACd,iBAAiB,EACjB,uBAAuB,CAAC,yEAAyE,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,GAAgB,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC3B,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC9B,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACrC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;YAC5C,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC5C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,2DAA2D;IAC3D,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,KAAK,GAAa;QACtB,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,kBAAkB;KACnB,CAAC;IAEF,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IACE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,MAAM,EAC3B,CAAC;QACD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,sBAAsB,IAAI,CAAC,MAAM,OAAO,cAAc,4BAA4B,IAAI,CAAC,KAAK,0DAA0D,cAAc,GAAG,IAAI,CAAC,MAAM,6EAA6E,CAChQ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG;QACrB,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa;QAChE,SAAS;QACT,QAAQ,IAAI,EAAE;KACf,CAAC;IAEF,MAAM,IAAI,GAA0B;QAClC,4CAA4C;QAC5C,MAAM,EAAE,wBAAwB,IAAI,iDAAiD;QACrF,WAAW,EAAE,KAAK,EAAE,yCAAyC;QAC7D,QAAQ,EAAE,IAAI,CAAC,MAAM;QACrB,cAAc;QACd,cAAc;QACd,cAAc,EAAE,EAAE;QAClB,iBAAiB,EAAE,EAAE;QACrB,KAAK;KACN,CAAC;IAEF,OAAO,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}