@cliwant/mcp-sam-gov 1.9.0 → 1.10.0

package/dist/opengov.js

@@ -0,0 +1,244 @@
+/**
+ * opengov.ts — OpenGov Procurement (formerly ProcureNow) public solicitations,
+ * a keyless-first SLED bid source (loop cycle — SLED bid campaign, 2026-07-19).
+ *
+ * WHAT IT ADDS: OpenGov Procurement hosts the live open-solicitation portals of
+ * **525+ US state/local governments** (cities, counties, school & special
+ * districts across 42 states + DC). The public portal SPA
+ * (`procurement.opengov.com/portal/{code}`) is served by an UNAUTHENTICATED
+ * backend REST API — the official key-gated `api-key` API is NOT used; this
+ * consumes ONLY the anonymous endpoints the public portal itself calls, so it is
+ * genuinely keyless (live-verified 2026-07-19: bare anonymous request, no api-key /
+ * auth header / cookie). It is the OpenGov sibling of the Socrata/CKAN/ArcGIS
+ * discovery tools and one of the two highest-reach keyless SLED bid feeds (with
+ * Bonfire RSS).
+ *
+ * The module writes ZERO fetch/coercion/error/meta code — it REUSES `getJson`
+ * (GET + POST/JSON via ADR-0014, redirect:"error") / `driftError` / `num`·`str`
+ * (coerce.ts, null-never-0 / null-never-empty) / `withMeta`·`buildMeta`,
+ * mirroring datagov-catalog.ts. KEYLESS: no key seam.
+ *
+ * ★ SSRF: the host is a compile-time literal (`OPENGOV_HOST`). All inputs ride in
+ *   a MODULE-BUILT JSON body / URLSearchParams from validated typed args — NO
+ *   raw-host/raw-path passthrough (this is a FIXED-host API). A post-construction
+ *   hostname/protocol assertion + `redirect:"error"` lock every call.
+ *
+ * ★ TWO endpoints (both anonymous, live-verified):
+ *   - `GET /api/v1/government` → a flat JSON array of ~560 org records (the whole
+ *     directory in one call; `government.code` = the portal slug). We keep the
+ *     ACTIVE, non-internal ones (~525 real public portals).
+ *   - `POST /api/v1/project/list` body `{governmentCode, publicView:true, page,
+ *     limit}` → `{projects:[…], count}`. `publicView:true` is REQUIRED (the public
+ *     gate). `count` is the TRUE total of public projects for that org.
+ *
+ * ★ HONESTY PILLARS (captured live 2026-07-19):
+ *   P1: totalAvailable = the real total — the filtered directory length (govt
+ *     list) or the API's `count` (solicitations) — NEVER the page length.
+ *   P2: getJson→fetchWithRetry THROWS on 429 / 5xx / timeout — NEVER a fake empty.
+ *     A genuine no-match (projects:[], count:0) ⇒ honest empty.
+ *   P3: every scalar via `str` (null-never-empty) / `num` (null-never-0). The
+ *     `status` enum is surfaced VERBATIM (open = currently accepting; the response
+ *     also carries pending/evaluation/closed — the CONSUMER filters; we do not
+ *     hide non-open rows or fabricate an "open count").
+ *   P4: `/government` non-array or `/project/list` `.projects` non-array ⇒
+ *     driftError; a 200 non-JSON body ⇒ schema_drift via the catch-ladder
+ *     (ToolErrorCarrier rethrow FIRST so a 429/5xx keeps its taxonomy).
+ */
+import { ToolErrorCarrier } from "./errors.js";
+import { getJson, driftError } from "./datasource.js";
+import { num, str } from "./coerce.js";
+import { withMeta } from "./meta.js";
+// Re-export the shared honesty coercion (num-parity guard).
+export { num };
+// ─── Fixed endpoint (SSRF core — compile-time CONSTANTS) ──────────
+export const OPENGOV_HOST = "api.procurement.opengov.com";
+const OPENGOV_GOVERNMENT_PATH = "/api/v1/government";
+const OPENGOV_PROJECT_LIST_PATH = "/api/v1/project/list";
+const OPENGOV_GOV_LABEL = "opengov:/api/v1/government";
+const OPENGOV_PROJ_LABEL = "opengov:/api/v1/project/list";
+const OPENGOV_SOURCE = "procurement.opengov.com via OpenGov Procurement public API (keyless)";
+const OPENGOV_PORTAL = "https://procurement.opengov.com/portal";
+// The org slug grammar (SSRF + injection guard). Real slugs are lowercase
+// alnum + hyphen (e.g. "santacruzca", "u-46", "twc-texas-gov"). Validated
+// BEFORE it rides the JSON body — a "../"/space/uppercase ⇒ invalid_input, 0 fetch.
+export const OPENGOV_CODE_RE = /^[a-z0-9-]{1,64}$/;
+const OPENGOV_STATUS_NOTE = "`status` is surfaced verbatim: open = currently ACCEPTING responses; pending/evaluation/closed are also returned (publicView shows all public projects). Filter status==='open' for live bids. totalAvailable is the org's TOTAL public-project count (all statuses), not an open-only count.";
+/** null-preserving boolean (a real true/false survives; else null). */
+function boolOrNull(x) {
+    return typeof x === "boolean" ? x : null;
+}
+// ─── SSRF-guarded fetch (fixed host + hostname assertion + redirect) ──
+async function getOpengov(path, label, init = {}) {
+    const url = `https://${OPENGOV_HOST}${path}`;
+    const built = new URL(url);
+    if (built.hostname !== OPENGOV_HOST || built.protocol !== "https:") {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            message: `Constructed OpenGov URL host ${JSON.stringify(built.hostname)} (${built.protocol}) does not match the fixed host ${JSON.stringify(OPENGOV_HOST)} over https — refusing to fetch (SSRF safety).`,
+            retryable: false,
+            upstreamEndpoint: label,
+        });
+    }
+    const headers = init.method === "POST" ? { "Content-Type": "application/json" } : {};
+    return getJson(url, { label, headers, redirect: "error", ...init });
+}
+/**
+ * List the OpenGov Procurement government portals (the whole directory arrives in
+ * ONE keyless GET). Client-side filters: `state` (2-letter), `query` (name
+ * substring). Only ACTIVE, non-internal portals are kept. Feeds `code` to
+ * opengov_search_solicitations. totalAvailable = the filtered directory size (P1).
+ */
+export async function listGovernments(args) {
+    const limit = args.limit ?? 50;
+    const offset = args.offset ?? 0;
+    let body;
+    try {
+        body = await getOpengov(OPENGOV_GOVERNMENT_PATH, OPENGOV_GOV_LABEL);
+    }
+    catch (e) {
+        if (e instanceof ToolErrorCarrier)
+            throw e;
+        if (e instanceof SyntaxError)
+            throw driftError(OPENGOV_GOV_LABEL, "OpenGov /government returned a non-JSON body at HTTP 200 — schema drift.");
+        throw e;
+    }
+    // P4: the response MUST be an array (a missing/object body is drift).
+    if (!Array.isArray(body)) {
+        throw driftError(OPENGOV_GOV_LABEL, "OpenGov /government shape drift — response must be a JSON array of governments.");
+    }
+    const stateFilter = args.state ? args.state.trim().toUpperCase() : null;
+    const queryFilter = args.query ? args.query.trim().toLowerCase() : null;
+    const filtersApplied = [];
+    if (stateFilter)
+        filtersApplied.push("state");
+    if (queryFilter)
+        filtersApplied.push("query");
+    const all = [];
+    for (const row of body) {
+        const r = (row ?? {});
+        // Keep only active, non-internal, non-vendor real public portals.
+        if (boolOrNull(r.isActive) === false)
+            continue;
+        if (boolOrNull(r.isInternal) === true)
+            continue;
+        const gov = (r.government ?? {});
+        const g = {
+            code: str(gov.code),
+            name: str(r.name),
+            city: str(r.city),
+            state: str(r.state),
+            website: str(r.website),
+        };
+        if (g.code === null)
+            continue; // no portal slug ⇒ not queryable
+        if (stateFilter && (g.state ?? "").toUpperCase() !== stateFilter)
+            continue;
+        if (queryFilter && !(g.name ?? "").toLowerCase().includes(queryFilter))
+            continue;
+        all.push(g);
+    }
+    const totalAvailable = all.length;
+    const page = all.slice(offset, offset + limit);
+    const returned = page.length;
+    const hasMore = offset + returned < totalAvailable;
+    const nextOffset = hasMore ? offset + returned : null;
+    const notes = [
+        "The full OpenGov Procurement directory is returned in one keyless call and filtered client-side; totalAvailable is the exact filtered portal count. Feed a result's `code` to opengov_search_solicitations.",
+    ];
+    if (filtersApplied.length === 0) {
+        notes.push("No filters applied — this lists ALL active OpenGov portals. Add `state` and/or `query` to scope.");
+    }
+    return withMeta({ governments: page }, {
+        source: OPENGOV_SOURCE,
+        keylessMode: true,
+        returned,
+        totalAvailable,
+        filtersApplied,
+        filtersDropped: [],
+        fieldsUnavailable: [],
+        pagination: { offset, limit, hasMore, nextOffset },
+        notes,
+    });
+}
+/**
+ * List an OpenGov government's public solicitations (POST /project/list with the
+ * REQUIRED publicView gate). Returns all public projects with `status` surfaced
+ * (filter status==='open' for live bids). totalAvailable = the API's `count` (the
+ * org's total public-project count — P1, never the page length).
+ */
+export async function searchSolicitations(args) {
+    const limit = args.limit ?? 50;
+    const offset = args.offset ?? 0;
+    const code = args.governmentCode ?? "";
+    // Belt-and-suspenders slug grammar (behind the server's Zod). A bad slug would
+    // ride the JSON body and either error or mis-scope — reject pre-fetch (0 fetch).
+    if (!OPENGOV_CODE_RE.test(code)) {
+        throw new ToolErrorCarrier({
+            kind: "invalid_input",
+            message: `Invalid OpenGov governmentCode ${JSON.stringify(code)} — expected a lowercase-alnum/hyphen portal slug (≤64 chars) from opengov_list_governments (e.g. 'santacruzca', 'u-46').`,
+            retryable: false,
+            upstreamEndpoint: OPENGOV_PROJ_LABEL,
+        });
+    }
+    // The API paginates by 0-based `page` + `limit`. Map our offset → page.
+    const page = Math.floor(offset / limit);
+    const servedOffset = page * limit;
+    const payload = JSON.stringify({ governmentCode: code, publicView: true, page, limit });
+    let body;
+    try {
+        body = await getOpengov(OPENGOV_PROJECT_LIST_PATH, OPENGOV_PROJ_LABEL, { method: "POST", body: payload });
+    }
+    catch (e) {
+        if (e instanceof ToolErrorCarrier)
+            throw e;
+        if (e instanceof SyntaxError)
+            throw driftError(OPENGOV_PROJ_LABEL, "OpenGov /project/list returned a non-JSON body at HTTP 200 — schema drift.");
+        throw e;
+    }
+    const b = (body ?? {});
+    // P4: `projects` MUST be an array (a missing/object projects is drift).
+    if (!Array.isArray(b.projects)) {
+        throw driftError(OPENGOV_PROJ_LABEL, "OpenGov /project/list shape drift — response.projects must be an array.");
+    }
+    const solicitations = b.projects.map((row) => {
+        const r = (row ?? {});
+        const id = num(r.id);
+        const codeForLink = code;
+        return {
+            id,
+            title: str(r.title),
+            solicitationNumber: str(r.financialId),
+            status: str(r.status),
+            type: str(r.type),
+            department: str(r.departmentName),
+            releaseDate: str(r.releaseProjectDate ?? r.postedAt),
+            proposalDeadline: str(r.proposalDeadline),
+            contactName: [str(r.contactFirstName), str(r.contactLastName)].filter((v) => v !== null).join(" ") || null,
+            link: id !== null ? `${OPENGOV_PORTAL}/${codeForLink}/projects/${id}` : null,
+        };
+    });
+    const returned = solicitations.length;
+    // P1: totalAvailable = the API `count` (total public projects), NEVER page length.
+    const totalAvailable = num(b.count);
+    const hasMore = totalAvailable !== null ? servedOffset + returned < totalAvailable : returned >= limit;
+    const nextOffset = hasMore ? servedOffset + returned : null;
+    const notes = [OPENGOV_STATUS_NOTE];
+    if (servedOffset !== offset) {
+        notes.push(`offset was snapped to the page boundary ${servedOffset} (OpenGov paginates by fixed pages of ${limit}).`);
+    }
+    if (totalAvailable === null) {
+        notes.push("totalAvailable is unknown (the API omitted `count`); completeness inferred from page fullness.");
+    }
+    return withMeta({ governmentCode: code, solicitations }, {
+        source: OPENGOV_SOURCE,
+        keylessMode: true,
+        returned,
+        totalAvailable,
+        filtersApplied: ["governmentCode", "publicView"],
+        filtersDropped: [],
+        fieldsUnavailable: [],
+        pagination: { offset: servedOffset, limit, hasMore, nextOffset },
+        notes,
+    });
+}
+//# sourceMappingURL=opengov.js.map

package/dist/opengov.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opengov.js","sourceRoot":"","sources":["../src/opengov.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAsC,MAAM,WAAW,CAAC;AAEzE,4DAA4D;AAC5D,OAAO,EAAE,GAAG,EAAE,CAAC;AAEf,qEAAqE;AACrE,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAC;AAC1D,MAAM,uBAAuB,GAAG,oBAAoB,CAAC;AACrD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AACzD,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAC1D,MAAM,cAAc,GAAG,sEAAsE,CAAC;AAC9F,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAEhE,0EAA0E;AAC1E,0EAA0E;AAC1E,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAEnD,MAAM,mBAAmB,GACvB,+RAA+R,CAAC;AAwBlS,uEAAuE;AACvE,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,KAAa,EACb,OAA2C,EAAE;IAE7C,MAAM,GAAG,GAAG,WAAW,YAAY,GAAG,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,mCAAmC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,gDAAgD;YACzM,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACtE,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAEhC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,iBAAiB,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,gBAAgB;YAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,WAAW;YAC1B,MAAM,UAAU,CAAC,iBAAiB,EAAE,0EAA0E,CAAC,CAAC;QAClH,MAAM,CAAC,CAAC;IACV,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,CAAC,iBAAiB,EAAE,iFAAiF,CAAC,CAAC;IACzH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,WAAW;QAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,WAAW;QAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAiB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,kEAAkE;QAClE,IAAI,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;YAAE,SAAS;QAC/C,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;QAC5D,MAAM,CAAC,GAAsB;YAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;SACxB,CAAC;QACF,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS,CAAC,iCAAiC;QAChE,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW;YAAE,SAAS;QAC3E,IAAI,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACjF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtD,MAAM,KAAK,GAAa;QACtB,6MAA6M;KAC9M,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,QAAQ,CACb,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB;QACE,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,IAAI;QACjB,QAAQ;QACR,cAAc;QACd,cAAc;QACd,cAAc,EAAE,EAAE;QAClB,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE;QAClD,KAAK;KAC0B,CAClC,CAAC;AACJ,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAoC;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAEvC,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC;YACzB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,0HAA0H;YACzL,SAAS,EAAE,KAAK;YAChB,gBAAgB,EAAE,kBAAkB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,UAAU,CAAC,yBAAyB,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,gBAAgB;YAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,WAAW;YAC1B,MAAM,UAAU,CAAC,kBAAkB,EAAE,4EAA4E,CAAC,CAAC;QACrH,MAAM,CAAC,CAAC;IACV,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4C,CAAC;IAClE,wEAAwE;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,kBAAkB,EAAE,yEAAyE,CAAC,CAAC;IAClH,CAAC;IAED,MAAM,aAAa,GAA2B,CAAC,CAAC,QAAsB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACjF,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC;QACzB,OAAO;YACL,EAAE;YACF,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YACnB,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;YACjC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,QAAQ,CAAC;YACpD,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACzC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI;YAC1G,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,WAAW,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;SAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC;IAEtC,mFAAmF;IACnF,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GACX,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAE5D,MAAM,KAAK,GAAa,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,2CAA2C,YAAY,yCAAyC,KAAK,IAAI,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IAC/G,CAAC;IAED,OAAO,QAAQ,CACb,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,EACvC;QACE,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,IAAI;QACjB,QAAQ;QACR,cAAc;QACd,cAAc,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;QAChD,cAAc,EAAE,EAAE;QAClB,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE;QAChE,KAAK;KAC0B,CAClC,CAAC;AACJ,CAAC"}

package/dist/pricing.d.ts

@@ -73,7 +73,7 @@ export declare function benchmarkLaborRates(args: {
     maxSamplePages?: number;
 }): Promise<import("./meta.js").MetaBundle<{
     laborCategory: string;
-    matcher: "search" | "q";
+    matcher: "q" | "search";
     fuzzy: boolean;
     matchCount: number;
     matchCountSaturated: boolean;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EAKb,MAAM,oBAAoB,CAAC;AA67I5B,KAAK,OAAO,GAAG;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC;IAO1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;QAAE,GAAG,EAAE,YAAY,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE,CAAC;AAoBF,eAAO,MAAM,KAAK,EAAE,OAAO,EAowD1B,CAAC;AAkLF,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,OAAO,CAAC,CAkClB"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,YAAY,EAKb,MAAM,oBAAoB,CAAC;AA4iJ5B,KAAK,OAAO,GAAG;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC;IAO1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE;QAAE,GAAG,EAAE,YAAY,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE,CAAC;AAoBF,eAAO,MAAM,KAAK,EAAE,OAAO,EAs0D1B,CAAC;AAkLF,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,OAAO,CAAC,CAkClB"}

package/dist/server.js

@@ -38,6 +38,10 @@ import * as ckan from "./ckan.js";
 import * as echo from "./echo.js";
 import * as datagov from "./datagov.js";
 import * as datagovCatalog from "./datagov-catalog.js";
+import * as arcgisHub from "./arcgis-hub.js";
+import * as opengov from "./opengov.js";
+import * as bonfire from "./bonfire.js";
+import * as arcgisFeature from "./arcgis-feature.js";
 import * as govinfo from "./govinfo.js";
 import * as fpds from "./fpds.js";
 import * as nih from "./nih.js";
@@ -86,7 +90,7 @@ import { realpathSync } from "node:fs";
 const SERVER_NAME = "mcp-sam-gov";
 // Kept in lockstep with package.json / manifest.json / server.json.
 // Keep in sync with package.json "version" (asserted at release; see CHANGELOG).
-const SERVER_VERSION = "1.9.0";
+const SERVER_VERSION = "1.10.0";
 // ─── Tool input schemas (Zod) ────────────────────────────────────
 const SamSearchInput = z.object({
     query: z.string().optional().describe("Free-text title query"),
@@ -2508,6 +2512,107 @@ const DatagovSearchDatasetsInput = z.object({
         .optional()
         .describe("Opaque continuation cursor (→ after) — pass back the _meta.nextCursor from the previous page. Pagination is a cursor, NOT a numeric offset (offset/nextOffset are null); nextCursor:null means the last page. A bad token (spaces/'../'/'%') ⇒ invalid_input pre-fetch."),
 });
+// ─── ArcGIS Hub (hub.arcgis.com — keyless SLED dataset discovery) ─
+// Loop cycle 9. A GLOBAL, OPEN publishing platform (non-US / non-gov publishers
+// included) — DISCOVERY ONLY, provenance surfaced per-row + disclosed every
+// response. Fixed-host SSRF (no per-jurisdiction host vector). q ≥ 2 chars.
+const ArcgisHubDiscoverInput = z.object({
+    query: z
+        .string()
+        .min(2)
+        .max(500)
+        .describe("Keyword search over ArcGIS Hub datasets (→ q), e.g. 'procurement contract', 'zoning permits'. REQUIRED, ≥2 non-whitespace chars (a broad scan of the whole global Hub is refused)."),
+    openDataOnly: z
+        .boolean()
+        .default(true)
+        .describe("When true (default), filter to items the publisher designated as open data (→ filter[openData]=true) — the B2G-relevant subset. Set false to broaden to ALL shared items (vet the publisher even more)."),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(100)
+        .default(20)
+        .describe("Datasets per page (→ page[size]), 1..100, default 20."),
+    offset: z
+        .number()
+        .int()
+        .min(0)
+        .default(0)
+        .describe("0-based record offset (→ page[start]=offset+1). Page with _meta.pagination.nextOffset; totalAvailable is the exact Hub match count."),
+});
+// ─── OpenGov Procurement (api.procurement.opengov.com — keyless SLED bids) ─
+// SLED bid campaign. 525+ US state/local portals' live solicitations via the
+// public portal's own anonymous backend API (the key-gated api-key API is NOT
+// used). Fixed-host SSRF. governmentCode = the portal slug from list_governments.
+const OpengovListGovernmentsInput = z.object({
+    state: z
+        .string()
+        .length(2)
+        .optional()
+        .describe("2-letter US state filter (client-side), e.g. 'CA', 'FL'. Optional."),
+    query: z
+        .string()
+        .min(1)
+        .max(120)
+        .optional()
+        .describe("Case-insensitive name substring filter (client-side), e.g. 'county', 'school'. Optional."),
+    limit: z.number().int().min(1).max(200).default(50).describe("Portals per page, 1..200, default 50."),
+    offset: z.number().int().min(0).default(0).describe("0-based offset; page with _meta.pagination.nextOffset. totalAvailable = exact filtered portal count."),
+});
+const OpengovSearchSolicitationsInput = z.object({
+    governmentCode: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(opengov.OPENGOV_CODE_RE)
+        .describe("The OpenGov portal slug (from opengov_list_governments `code`), e.g. 'santacruzca', 'orlando', 'u-46'. REQUIRED. Lowercase alnum/hyphen; a bad slug ⇒ invalid_input pre-fetch."),
+    limit: z.number().int().min(1).max(100).default(50).describe("Solicitations per page, 1..100, default 50 (→ API page size)."),
+    offset: z.number().int().min(0).default(0).describe("0-based offset (snapped to the API's fixed page boundary). Page with _meta.pagination.nextOffset."),
+});
+// ─── Bonfire (Euna) — keyless per-org open-opportunity RSS (SLED bids) ─
+// SLED bid campaign. Thousands of US state/local govs on Bonfire expose a keyless
+// RSS of open opportunities at {org}.bonfirehub.com/opportunities/rss. Ships a
+// curated 187-org seed directory. Fixed-suffix SSRF. org = charclass slug.
+const BonfireListOrganizationsInput = z.object({
+    state: z.string().length(2).optional().describe("2-letter US state filter (client-side), e.g. 'TX', 'CA'. Optional."),
+    query: z.string().min(1).max(120).optional().describe("Case-insensitive name substring filter (client-side), e.g. 'county', 'ISD'. Optional."),
+    limit: z.number().int().min(1).max(200).default(50).describe("Orgs per page, 1..200, default 50."),
+    offset: z.number().int().min(0).default(0).describe("0-based offset; page with _meta.pagination.nextOffset."),
+});
+const BonfireSearchOpportunitiesInput = z.object({
+    org: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(bonfire.BONFIRE_ORG_RE)
+        .describe("The Bonfire org subdomain slug (from bonfire_list_organizations `org`), e.g. 'harriscountytx', 'broward', 'u-46'. REQUIRED. Lowercase alnum/hyphen; a bad slug ⇒ invalid_input pre-fetch."),
+    limit: z.number().int().min(1).max(200).default(50).describe("Opportunities per page, 1..200, default 50. The RSS is the complete open set; this pages over it."),
+    offset: z.number().int().min(0).default(0).describe("0-based offset; page with _meta.pagination.nextOffset. totalAvailable = the exact open-opportunity count."),
+});
+// ─── ArcGIS REST feature query (curated service allowlist — SLED bids/GIS) ─
+// Generic ArcGIS FeatureServer/MapServer layer query over a curated allowlist.
+// First payload: DC OCP PASS procurement layers (live solicitations/contracts/PO/
+// payments). `service` is an enum (SSRF core); where/outFields filter the layer.
+const ArcgisFeatureQueryInput = z.object({
+    service: z
+        .enum(arcgisFeature.ARCGIS_SERVICES.map((s) => s.key))
+        .describe("The curated ArcGIS layer (SSRF allowlist enum). DC OCP PASS: 'dc_pass_solicitations' (live solicitations ~25k), 'dc_pass_contracts', 'dc_pass_purchase_orders', 'dc_pass_payments'. Other US local govs: 'asheville_purchase_orders'/'asheville_po_summary' (Asheville NC), 'bellevue_vendor_payments'/'bellevue_awarded_contracts' (Bellevue WA), 'miamidade_purchase_orders_2025'/'miamidade_purchase_orders_2017' (Miami-Dade FL, current/2017), 'suffolk_county_ny_contracts_2018' (Suffolk County NY), 'matsu_borough_ak_checkbook' (Matanuska-Susitna Borough AK), 'lasvegas_checkbook' (Las Vegas NV ~373k), 'baltimore_checkbook' (Baltimore City MD ~367k), 'naperville_vendor_payments' (Naperville IL ~127k), 'worcester_ma_checkbook_fy25' (Worcester MA FY25), 'lasvegas_purchasing_contracts' (Las Vegas NV contract register), 'txdot_construction_projects' (Texas DOT, awarded construction company ~85k), 'akdot_construction_awards'/'akdot_aashtoware_proposals' (Alaska DOT&PF bid awards/proposals), 'iowadot_public_bid_awards' (Iowa DOT public bid), 'okdot_cirb_contract_status' (Oklahoma DOT CIRB contract status), 'topeka_checkbook_aggregate' (Topeka KS checkbook FY2015–2023 ~332k). 23 curated services (state DOT bid/award registers: TX/AK/IA/OK + municipal checkbooks/contracts)."),
+    where: z
+        .string()
+        .min(1)
+        .max(500)
+        .optional()
+        .describe("ArcGIS SQL-ish filter (default '1=1'), e.g. \"SOLICITATIONTITLE LIKE '%security%'\" or \"DUE_DATE > 1750000000000\". Filters the read-only layer; a malformed clause ⇒ invalid_input (surfaced)."),
+    outFields: z
+        .string()
+        .min(1)
+        .max(500)
+        .optional()
+        .describe("Comma-separated fields to return (default '*' = all). e.g. 'SOLICITATIONNUMBER,SOLICITATIONTITLE,DUE_DATE,NIGPCODE'."),
+    orderByFields: z.string().min(1).max(200).optional().describe("ArcGIS orderByFields, e.g. 'DUE_DATE DESC'. Optional."),
+    limit: z.number().int().min(1).max(1000).default(50).describe("Records per page (→ resultRecordCount), 1..1000, default 50."),
+    offset: z.number().int().min(0).default(0).describe("0-based offset (→ resultOffset). Page with _meta.pagination.nextOffset; totalAvailable = the layer's exact match count."),
+});
 // ─── GovInfo (api.govinfo.gov — the api.data.gov keyed trio's 3rd API) ─
 // ADR-0010. Same DATA_GOV_API_KEY/DEMO_KEY/X-Api-Key discipline as the datagov
 // trio (shared datagovKey.ts seam). `collection` is grammar-checked here AND
@@ -5078,6 +5183,66 @@ export const TOOLS = [
         inputSchema: DatagovSearchDatasetsInput,
         handler: (input) => datagovCatalog.searchDatasets(input),
     }),
+    // ━━━ ArcGIS Hub (hub.arcgis.com) — keyless SLED dataset DISCOVERY (loop cycle 9) ━━━
+    // A NEW discovery platform: much US state/local/regional/tribal (SLED) open data
+    // — GIS/infrastructure/permits/boundaries/procurement — lives on ArcGIS Hub, NOT
+    // Socrata/CKAN. Fixed-host SSRF (no per-jurisdiction host vector). ★PROVENANCE: the
+    // Hub is GLOBAL + OPEN (non-US/non-gov publishers), so this is a DISCOVERY aid, not
+    // a curated official-source allowlist — per-row owner/orgName/source/region are
+    // surfaced for vetting + the disclosure rides every response. P1: totalAvailable =
+    // meta.total (exact Hub count). DISCOVERY ONLY (row-query on arbitrary ArcGIS hosts
+    // is a planned, separately-guarded addition).
+    defineTool({
+        name: "arcgis_hub_discover_datasets",
+        description: "Discover ArcGIS Hub datasets by keyword — the SLED/GIS open-data layer that Socrata and CKAN do NOT cover (keyless; hub.arcgis.com/api/v3/datasets). Much US state/local/regional/tribal open data (GIS, infrastructure, permits, zoning, boundaries, procurement) is published on ArcGIS Hub. Input `query` (→q, REQUIRED, ≥2 non-whitespace chars — a broad whole-Hub scan is refused), `openDataOnly` (default TRUE → filter[openData]=true, the B2G-relevant designated-open-data subset; false broadens to all shared items), `limit` (1..100, def 20 → page[size]), `offset` (0-based → page[start]=offset+1). Returns { query, openDataOnly, datasets:[{ id, name, description, owner, orgName, source, region, type, sector, keywords, downloadable, hasApi, created, modified, landingPage, itemId }] } + honest _meta. ★PROVENANCE (the crux — a DIFFERENT trust posture from our other sources): ArcGIS Hub is a GLOBAL, OPEN publishing platform — results include NON-US and NON-GOVERNMENTAL publishers. This is a DISCOVERY aid, NOT a curated official-source allowlist (unlike socrata_query): the per-row owner/orgName/source/region are surfaced VERBATIM so you can VET the publisher before relying on the data, and the global-platform caveat rides EVERY response. DISCOVERY ONLY — metadata + links; to read rows follow the dataset on its own ArcGIS endpoint (a guarded row-query tool is a planned addition). HONESTY: totalAvailable = the EXACT Hub match count (meta.total, NEVER data.length — P1); pagination is a 0-based offset (nextOffset when more remain); every scalar null-never-empty, booleans null-preserving, counts null-never-0; a genuine no-match ⇒ complete:true/returned:0; a 429 ⇒ rate_limited / 5xx/timeout ⇒ upstream_unavailable THROWS (never a fake empty); a 200 non-JSON / non-array data ⇒ schema_drift.",
+        inputSchema: ArcgisHubDiscoverInput,
+        handler: (input) => arcgisHub.discoverDatasets(input),
+    }),
+    // ━━━ OpenGov Procurement (api.procurement.opengov.com) — keyless SLED bids ━━━
+    // SLED bid campaign (from the exhaustive US state+local bid-site research). 525+
+    // state/local government portals' LIVE solicitations, via the public portal's OWN
+    // anonymous backend REST API — the key-gated official api-key API is NOT touched
+    // (genuinely keyless, live-verified). Fixed-host SSRF. Two tools: a directory
+    // (one keyless GET returns all ~560 orgs) + per-org solicitations.
+    defineTool({
+        name: "opengov_list_governments",
+        description: "List the government portals on OpenGov Procurement (formerly ProcureNow) — the directory for opengov_search_solicitations (keyless; api.procurement.opengov.com). OpenGov Procurement hosts the live open-solicitation portals of 525+ US state/local governments (cities, counties, school & special districts across 42 states + DC). The WHOLE directory arrives in ONE keyless GET and is filtered client-side: `state` (2-letter), `query` (case-insensitive name substring); `limit`(1..200)/`offset`. Only ACTIVE, non-internal portals are returned. Output: { governments:[{ code, name, city, state, website }] } + honest _meta. Feed a result's `code` to opengov_search_solicitations. HONESTY: this consumes ONLY the anonymous endpoints the public portal itself calls (the official key-gated api-key API is NOT used) — genuinely keyless; totalAvailable is the EXACT filtered portal count (never the page length); a 429/5xx/timeout THROWS (never a fake empty); a non-array body ⇒ schema_drift.",
+        inputSchema: OpengovListGovernmentsInput,
+        handler: (input) => opengov.listGovernments(input),
+    }),
+    defineTool({
+        name: "opengov_search_solicitations",
+        description: "List a government's public solicitations on OpenGov Procurement (keyless; api.procurement.opengov.com, POST /project/list with the required publicView gate). Input `governmentCode` (the portal slug from opengov_list_governments, e.g. 'santacruzca', 'orlando', 'u-46'; REQUIRED), `limit`(1..100)/`offset`. Returns { governmentCode, solicitations:[{ id, title, solicitationNumber, status, type, department, releaseDate, proposalDeadline, contactName, link }] } + honest _meta. ★STATUS: `status` is surfaced VERBATIM — **open = currently ACCEPTING responses**; pending/evaluation/closed are ALSO returned (publicView shows all public projects), so filter status==='open' for live bids. `link` is the public portal page. HONESTY: totalAvailable = the API's `count` = the org's TOTAL public-project count (all statuses), NEVER the page length and NOT an open-only count (a note discloses this); pagination is the API's fixed page (offset is snapped to the page boundary, disclosed); a genuine no-match ⇒ complete:true/returned:0; a 429/5xx/timeout THROWS (never a fake empty); a non-array `projects` ⇒ schema_drift; a bad `governmentCode` ⇒ invalid_input pre-fetch. Genuinely keyless (the key-gated official API is NOT used).",
+        inputSchema: OpengovSearchSolicitationsInput,
+        handler: (input) => opengov.searchSolicitations(input),
+    }),
+    // ━━━ Bonfire (Euna) — keyless per-org open-opportunity RSS (SLED bids) ━━━
+    // SLED bid campaign. Thousands of US state/local govs on Bonfire expose a keyless
+    // RSS of open opportunities. Ships a curated 187-org live-verified seed directory
+    // (Bonfire's authoritative org API is auth-gated → out of bounds). Fixed-suffix
+    // SSRF (.bonfirehub.com). RSS = the complete open set (totalAvailable honest).
+    defineTool({
+        name: "bonfire_list_organizations",
+        description: "List US governments on the Bonfire (Euna) eProcurement platform — the directory for bonfire_search_opportunities (keyless). Bonfire hosts thousands of US state/local governments' open-bid portals, each with a keyless RSS feed. Filter the curated seed by `state` (2-letter) / `query` (case-insensitive name substring); `limit`(1..200)/`offset`. Output: { organizations:[{ org, name, state }] }. Feed a result's `org` to bonfire_search_opportunities. ★HONESTY: this is a CURATED, live-verified SEED of 187 US orgs — Bonfire has NO keyless org-list API (its authoritative directory is auth-gated, out of bounds), and Euna markets up to ~900 US orgs, so the seed is PARTIAL (disclosed in _meta); probe `{slug}.bonfirehub.com/opportunities/rss` to extend. totalAvailable = the exact filtered seed count.",
+        inputSchema: BonfireListOrganizationsInput,
+        handler: (input) => bonfire.listOrganizations(input),
+    }),
+    defineTool({
+        name: "bonfire_search_opportunities",
+        description: "List a government's currently-OPEN solicitations on Bonfire (keyless; {org}.bonfirehub.com/opportunities/rss, RSS 2.0). Input `org` (the subdomain slug from bonfire_list_organizations, e.g. 'harriscountytx', 'broward', 'u-46'; REQUIRED), `limit`(1..200)/`offset`. Returns { org, opportunities:[{ referenceNumber, name, description, closeDate, link, pubDate }] } + honest _meta. HONESTY: the RSS is the COMPLETE set of the org's currently-open opportunities (no server pagination), so totalAvailable = the exact open-opportunity count (never a page length) and this tool pages over it client-side; an empty feed (returned 0) means no open opportunities right now (honest empty, complete:true); `closeDate` is parsed best-effort from the description; a 429/5xx/404/timeout THROWS (never a fake empty); a 200 non-RSS body ⇒ schema_drift; a bad `org` ⇒ invalid_input pre-fetch. Fixed-suffix SSRF (.bonfirehub.com) + redirect:error. Keyless (Bonfire's auth-gated directory API is NOT used).",
+        inputSchema: BonfireSearchOpportunitiesInput,
+        handler: (input) => bonfire.searchOpportunities(input),
+    }),
+    // ━━━ ArcGIS REST feature query (curated allowlist) — SLED bids/GIS ━━━
+    // Generic query companion to arcgis_hub_discover_datasets. First payload: the DC
+    // OCP PASS procurement layers (live solicitations + contracts/PO/payments), a
+    // keyless live-solicitation feed via ArcGIS REST. `service` enum = SSRF core.
+    defineTool({
+        name: "arcgis_feature_query",
+        description: "Query rows from a curated US-government ArcGIS REST feature layer (keyless) — the QUERY companion to arcgis_hub_discover_datasets (which discovers Hub datasets). A large amount of SLED procurement/GIS data lives on ArcGIS. First payload: the **DC Office of Contracting & Procurement 'PASS'** layers — `dc_pass_solicitations` (DC's LIVE open solicitations, ~25k: SOLICITATIONNUMBER, SOLICITATIONTITLE, DUE_DATE, OPENDATE, CLOSEDATE, NIGPCODE, CONTRACTINGOFFICER, AWARD_TO, 46 fields), `dc_pass_contracts` (~50k), `dc_pass_purchase_orders` (~275k), `dc_pass_payments` (~1.55M). Inputs: `service` (the allowlist ENUM — the SSRF core, never a free host), `where` (ArcGIS SQL-ish filter, default '1=1', e.g. \"SOLICITATIONTITLE LIKE '%security%'\"), `outFields` (default '*'), `orderByFields`, `limit`(1..1000)/`offset`. Returns { service, records:[{…attributes verbatim…}] } + honest _meta. HONESTY: totalAvailable = the layer's EXACT match count (a returnCountOnly companion query, never the page length; a count failure ⇒ null + note, rows still returned); ★ArcGIS date fields are epoch MILLISECONDS and a negative/sentinel (≈1900) is a placeholder — surfaced verbatim, never coerced; a genuine no-match ⇒ complete:true/returned:0; a 429/5xx/timeout THROWS; an ArcGIS {error} body (e.g. a bad where) ⇒ invalid_input/upstream (surfaced, never a fake empty); a non-array features ⇒ schema_drift. SSRF: fixed allowlist base + hostname assertion + redirect:error (where/outFields cannot alter the host).",
+        inputSchema: ArcgisFeatureQueryInput,
+        handler: (input) => arcgisFeature.featureQuery(input),
+    }),
     // ━━━ GovInfo (api.govinfo.gov) — the api.data.gov keyed trio's 3rd API (3) ━━━ ADR-0010
     // GPO-authoritative bulk publications (BILLS/PLAW/USCODE/CREC/CFR-FR editions/
     // BUDGET/GAOREPORTS) with PDF/XML/MODS downloads + provenance. 2nd consumer of the