@cyanheads/congressgov-mcp-server 0.7.3 → 0.8.0

package/AGENTS.md

@@ -1,10 +1,10 @@
 # Agent Protocol
 
 **Server:** congressgov-mcp-server
-**Version:** 0.7.3
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.9`
+**Version:** 0.8.0
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/server` ^2.1.0
+**MCP SDK:** `@modelcontextprotocol/server` ^2.3.1
 **Zod:** ^4.6.5
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -40,7 +40,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 
 | Env Var | Required | Description |
 |:--------|:---------|:------------|
-| `CONGRESS_API_KEY` | No | Optional. Defaults to `DEMO_KEY` (30 req/hr). Own key from [api.data.gov](https://api.data.gov/signup/): 5,000 req/hr. |
+| `CONGRESS_API_KEY` | No | Optional. Fallbacks: `DEMO_KEY` 30/hour and 50/day per IP; registered key from [api.data.gov](https://api.data.gov/signup/) 5,000/hour. Valid upstream hourly quota headers take precedence. |
 | `CONGRESS_API_BASE_URL` | No | Defaults to `https://api.congress.gov/v3` |
 | `CONGRESS_MIRROR_ENABLED` | No | Enable the local bill search mirror and `congressgov_search_bills`. Defaults to `false`. |
 | `CONGRESS_MIRROR_PATH` | No | Filesystem path to the SQLite mirror index. Defaults to `.mirror/bills.sqlite3`. |
@@ -56,6 +56,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly. Values round-trip as JSON; a `Date` reads back as an ISO string.
 - **Need input the caller didn't supply?** `return ctx.requestInput(...)` and read `ctx.inputs` when the handler is re-entered. Never `await` for user input mid-handler.
 - **Secrets in env vars only** — never hardcoded.
+- **Cut noise.** Add only what earns its place: no speculative generality, no guards for states the framework already prevents (Zod-validated params, classified errors), no abstraction until a third caller proves it, no option nothing sets.
 - **All tools are read-only.** Every tool gets `annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true }`.
 - **API key stays out of logs.** The service sends it in the `X-Api-Key` header — never log credentials.
 - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
@@ -168,7 +169,7 @@ Four services. `CongressApiService` backs nine tools and the House branch of `co
 **`CongressApiService`** — wraps the Congress.gov REST API v3:
 - API key via `X-Api-Key` header (never logged; kept out of the URL so it can't leak in upstream error messages)
 - Pagination: `offset` + `limit` query params, max 250 per request
-- Rate limiting: 5,000 requests/hour per key
+- Rate limiting: rolling process-local attempt budgets, reserved before every dispatch (failures, retries, concurrent calls included). Credential fallbacks are demo 30/hour + 50/day and registered 5,000/hour; valid upstream hourly headers override the fallback. Observed remaining is a conservative shared-quota bound, expires one local hour after observation, and never claims an upstream reset time. Other clients are outside local accounting
 - Response normalization: request `format=json`, return typed data
 - Native `fetch` — no SDK dependency
 
@@ -207,20 +208,25 @@ async handler(input, ctx) {
 
 ## Error Patterns
 
+`identityErrorContracts` declares `incompatible_identity` (`ValidationError`, -32007) only on bill lookup, roll votes, nominations, CRS reports, committee reports, and daily record. Their `list` handlers reject meaningful entity identifiers before any service call, preserving the explicit operation and harmless pagination/defaulted selectors. Optional blank string identities remain unset. Bill `type`/`number` and CRS `id`/`reportId`/`report_id` aliases normalize before that check; collisions retain the framework's rejection policy. Bill types and `relatedbills` values normalize through schema-preserving preprocessors.
+
 All tools share these patterns. The service layer handles them uniformly:
 
 | Condition | Error |
 |:----------|:------|
-| Rate limit hit | `rateLimited('Congress.gov API rate limit reached (5,000 requests/hour).')` |
+| Rate limit hit | `rateLimited(...)` with `rate_limited`, credential/shared-quota guidance and upstream `Retry-After` when supplied |
+| Deadline or HTTP timeout | `Timeout` (-32004), `upstream_timeout`; HTTP responses retain status |
 | API unavailable (5xx) | `serviceUnavailable('Congress.gov API returned HTTP {status}.')` |
 | Entity not found (404) | `notFound('{entity} not found', { ...identifiers })` |
 | Invalid params | `validationError('...', { field })` |
 | Network error | `serviceUnavailable('Unable to reach the Congress.gov API.')` |
 
-The `content` operation adds `documentErrorContracts` (tool-helpers) on top: `document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, and `offset_past_end` — the last of which `congressgov_bill_lookup` also raises from its `summaries` branch when `characterOffset` is past the end of every returned row's text. `CongressDocumentsService` raises each with a matching `data.reason` and resolves the hint via `ctx.recoveryFor` — note that `ctx.fail` does **not** auto-populate `recovery`, so handler-side `ctx.fail` calls must spread `ctx.recoveryFor(reason)` into their data or the hint never reaches the wire.
+The `content` operation adds `documentErrorContracts` (tool-helpers) on top: `document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, and `offset_past_end` — the last of which `congressgov_bill_lookup` also raises from its `summaries` branch when `characterOffset` is past the end of every returned row's text. `CongressDocumentsService` raises each with a matching `data.reason`; the framework fills the declared `recovery` hint when the throw carries none, service throws included. Explicit recovery overrides win. A direct `definition.handler(...)` test sees the throw unchanged; retain `ctx.recoveryFor` where such a test asserts the hint, or assert the filled hint through `runToolContract`.
 
 Service-only contract reasons carry `thrownBy: 'service'`; handler-local reasons remain checked by `error-contract-unthrown`. `RequestCancelled` is a baseline code and needs no contract entry. Retry predicates compose `defaultIsTransient` with the existing exclusion of `RateLimited` codes and preserve upstream `retryable: false`.
 
+Framework-handled tool, resource, and prompt errors carry `data.requestId`, matching that call's server log records; a tool's `content[]` closes with `request <id>`. Protocol-level rejections and resource-parameter errors containing only `{ uri }` are excluded. `runToolContract` fills declared recovery hints but adds no request ID.
+
 ---
 
 ## Naming
@@ -250,7 +256,7 @@ import { getServerConfig } from '@/config/server-config.js';
 
 ## Skills
 
-Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. Plugin hosts auto-load a root `skills/`, so development guidance belongs in `framework-skills/`.
+Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry. The directory is deliberately not `skills/`: Claude Code and Codex auto-load a plugin's root `skills/`, so a server that ships `.claude-plugin/` or `.codex-plugin/` would hand these development skills to every agent that installs it. Keep `skills/` free for skills meant for those agents.
 
 **Agent skill directory:** Copy skills into the directory your agent discovers (Claude Code: `.claude/skills/`, others: equivalent). This makes skills available as context without needing to reference `framework-skills/` paths manually. After framework updates, run the `maintenance` skill — it re-syncs the agent directory automatically (Phase B).
 
@@ -271,18 +277,18 @@ Available skills:
 | `security-pass` | Audit server for MCP-flavored security gaps: output injection, scope blast radius, input sinks, tenant isolation |
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
-| `git-wrapup` | Land the commit stack, version bump, and changelog on a release branch; open the release PR |
+| `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
 | `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixes as ordinary commits on top of the stack, PR body kept in sync. Release PR mode only |
-| `release-and-publish` | Fast-forward main, tag, push, and publish to npm, MCP Registry, GitHub Releases, and Docker |
+| `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
-| `report-issue-framework` | File bugs/features against `@cyanheads/mcp-ts-core` |
-| `report-issue-local` | File bugs/features against this server's repo |
+| `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
+| `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
 | `api-auth` | Auth modes, scopes, JWT/OAuth |
 | `api-config` | AppConfig, parseConfig, env vars |
 | `api-context` | Context interface, RequestContext, logger, state, multi-round-trip input |
 | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
 | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
-| `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper — Tier 3 opt-in |
+| `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
 | `api-mirror` | MirrorService: persistent self-refreshing local mirror (embedded SQLite + FTS5) of a bulk upstream dataset — Tier 3 opt-in |
 | `api-services` | LLM, Speech, Graph services |
 | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
@@ -374,7 +380,7 @@ docker buildx build --platform linux/amd64,linux/arm64 \
   --push .
 ```
 
-Remind the user to run these after completing a release flow.
+The `release-and-publish` run handles npm, MCP Registry, bundle, GitHub Release, and GHCR publishing.
 
 ---
 

package/CLAUDE.md

@@ -1,10 +1,10 @@
 # Agent Protocol
 
 **Server:** congressgov-mcp-server
-**Version:** 0.7.3
-**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.9`
+**Version:** 0.8.0
+**Framework:** [@cyanheads/mcp-ts-core](https://www.npmjs.com/package/@cyanheads/mcp-ts-core) `^0.13.15`
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
-**MCP SDK:** `@modelcontextprotocol/server` ^2.1.0
+**MCP SDK:** `@modelcontextprotocol/server` ^2.3.1
 **Zod:** ^4.6.5
 
 > **Read the framework docs first:** `node_modules/@cyanheads/mcp-ts-core/CLAUDE.md` contains the full API reference — builders, Context, error codes, exports, patterns. This file covers server-specific conventions only.
@@ -40,7 +40,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 
 | Env Var | Required | Description |
 |:--------|:---------|:------------|
-| `CONGRESS_API_KEY` | No | Optional. Defaults to `DEMO_KEY` (30 req/hr). Own key from [api.data.gov](https://api.data.gov/signup/): 5,000 req/hr. |
+| `CONGRESS_API_KEY` | No | Optional. Fallbacks: `DEMO_KEY` 30/hour and 50/day per IP; registered key from [api.data.gov](https://api.data.gov/signup/) 5,000/hour. Valid upstream hourly quota headers take precedence. |
 | `CONGRESS_API_BASE_URL` | No | Defaults to `https://api.congress.gov/v3` |
 | `CONGRESS_MIRROR_ENABLED` | No | Enable the local bill search mirror and `congressgov_search_bills`. Defaults to `false`. |
 | `CONGRESS_MIRROR_PATH` | No | Filesystem path to the SQLite mirror index. Defaults to `.mirror/bills.sqlite3`. |
@@ -56,6 +56,7 @@ Tailor suggestions to what's actually missing or stale — don't recite the full
 - **Use `ctx.state`** for tenant-scoped storage. Never access persistence directly. Values round-trip as JSON; a `Date` reads back as an ISO string.
 - **Need input the caller didn't supply?** `return ctx.requestInput(...)` and read `ctx.inputs` when the handler is re-entered. Never `await` for user input mid-handler.
 - **Secrets in env vars only** — never hardcoded.
+- **Cut noise.** Add only what earns its place: no speculative generality, no guards for states the framework already prevents (Zod-validated params, classified errors), no abstraction until a third caller proves it, no option nothing sets.
 - **All tools are read-only.** Every tool gets `annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: true }`.
 - **API key stays out of logs.** The service sends it in the `X-Api-Key` header — never log credentials.
 - **Close the loop on issues.** When implementing work tracked by a GitHub issue, comment on the issue with what landed and close it. Do both — a comment without a close leaves stale issues open; a close without a comment leaves no record of what shipped. The comment is for future readers — state the concrete changes, not the conversation that produced them.
@@ -168,7 +169,7 @@ Four services. `CongressApiService` backs nine tools and the House branch of `co
 **`CongressApiService`** — wraps the Congress.gov REST API v3:
 - API key via `X-Api-Key` header (never logged; kept out of the URL so it can't leak in upstream error messages)
 - Pagination: `offset` + `limit` query params, max 250 per request
-- Rate limiting: 5,000 requests/hour per key
+- Rate limiting: rolling process-local attempt budgets, reserved before every dispatch (failures, retries, concurrent calls included). Credential fallbacks are demo 30/hour + 50/day and registered 5,000/hour; valid upstream hourly headers override the fallback. Observed remaining is a conservative shared-quota bound, expires one local hour after observation, and never claims an upstream reset time. Other clients are outside local accounting
 - Response normalization: request `format=json`, return typed data
 - Native `fetch` — no SDK dependency
 
@@ -207,20 +208,25 @@ async handler(input, ctx) {
 
 ## Error Patterns
 
+`identityErrorContracts` declares `incompatible_identity` (`ValidationError`, -32007) only on bill lookup, roll votes, nominations, CRS reports, committee reports, and daily record. Their `list` handlers reject meaningful entity identifiers before any service call, preserving the explicit operation and harmless pagination/defaulted selectors. Optional blank string identities remain unset. Bill `type`/`number` and CRS `id`/`reportId`/`report_id` aliases normalize before that check; collisions retain the framework's rejection policy. Bill types and `relatedbills` values normalize through schema-preserving preprocessors.
+
 All tools share these patterns. The service layer handles them uniformly:
 
 | Condition | Error |
 |:----------|:------|
-| Rate limit hit | `rateLimited('Congress.gov API rate limit reached (5,000 requests/hour).')` |
+| Rate limit hit | `rateLimited(...)` with `rate_limited`, credential/shared-quota guidance and upstream `Retry-After` when supplied |
+| Deadline or HTTP timeout | `Timeout` (-32004), `upstream_timeout`; HTTP responses retain status |
 | API unavailable (5xx) | `serviceUnavailable('Congress.gov API returned HTTP {status}.')` |
 | Entity not found (404) | `notFound('{entity} not found', { ...identifiers })` |
 | Invalid params | `validationError('...', { field })` |
 | Network error | `serviceUnavailable('Unable to reach the Congress.gov API.')` |
 
-The `content` operation adds `documentErrorContracts` (tool-helpers) on top: `document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, and `offset_past_end` — the last of which `congressgov_bill_lookup` also raises from its `summaries` branch when `characterOffset` is past the end of every returned row's text. `CongressDocumentsService` raises each with a matching `data.reason` and resolves the hint via `ctx.recoveryFor` — note that `ctx.fail` does **not** auto-populate `recovery`, so handler-side `ctx.fail` calls must spread `ctx.recoveryFor(reason)` into their data or the hint never reaches the wire.
+The `content` operation adds `documentErrorContracts` (tool-helpers) on top: `document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, and `offset_past_end` — the last of which `congressgov_bill_lookup` also raises from its `summaries` branch when `characterOffset` is past the end of every returned row's text. `CongressDocumentsService` raises each with a matching `data.reason`; the framework fills the declared `recovery` hint when the throw carries none, service throws included. Explicit recovery overrides win. A direct `definition.handler(...)` test sees the throw unchanged; retain `ctx.recoveryFor` where such a test asserts the hint, or assert the filled hint through `runToolContract`.
 
 Service-only contract reasons carry `thrownBy: 'service'`; handler-local reasons remain checked by `error-contract-unthrown`. `RequestCancelled` is a baseline code and needs no contract entry. Retry predicates compose `defaultIsTransient` with the existing exclusion of `RateLimited` codes and preserve upstream `retryable: false`.
 
+Framework-handled tool, resource, and prompt errors carry `data.requestId`, matching that call's server log records; a tool's `content[]` closes with `request <id>`. Protocol-level rejections and resource-parameter errors containing only `{ uri }` are excluded. `runToolContract` fills declared recovery hints but adds no request ID.
+
 ---
 
 ## Naming
@@ -250,7 +256,7 @@ import { getServerConfig } from '@/config/server-config.js';
 
 ## Skills
 
-Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. Plugin hosts auto-load a root `skills/`, so development guidance belongs in `framework-skills/`.
+Skills are modular instructions in `framework-skills/` at the project root. Read them directly when a task matches — e.g., `framework-skills/add-tool/SKILL.md` when adding a tool. `bun run list-skills` prints the full registry. The directory is deliberately not `skills/`: Claude Code and Codex auto-load a plugin's root `skills/`, so a server that ships `.claude-plugin/` or `.codex-plugin/` would hand these development skills to every agent that installs it. Keep `skills/` free for skills meant for those agents.
 
 **Agent skill directory:** Copy skills into the directory your agent discovers (Claude Code: `.claude/skills/`, others: equivalent). This makes skills available as context without needing to reference `framework-skills/` paths manually. After framework updates, run the `maintenance` skill — it re-syncs the agent directory automatically (Phase B).
 
@@ -271,18 +277,18 @@ Available skills:
 | `security-pass` | Audit server for MCP-flavored security gaps: output injection, scope blast radius, input sinks, tenant isolation |
 | `code-simplifier` | Post-session cleanup against `git diff` — modernize syntax, consolidate duplication, align with the codebase |
 | `polish-docs-meta` | Finalize docs, README, metadata, and agent protocol for shipping |
-| `git-wrapup` | Land the commit stack, version bump, and changelog on a release branch; open the release PR |
+| `git-wrapup` | Land working-tree changes as a commit stack — version bump, changelog, verify, commit by concern, release commit on top. No tag, no push to main; opens the release PR when the project declares release PR mode |
 | `release-pr-review` | Review pass on an open release PR — simplifier + correctness review, fixes as ordinary commits on top of the stack, PR body kept in sync. Release PR mode only |
-| `release-and-publish` | Fast-forward main, tag, push, and publish to npm, MCP Registry, GitHub Releases, and Docker |
+| `release-and-publish` | Fast-forward merge (release PR mode) + tag + push + npm + MCP Registry + GH Release + Docker. Picks up from `git-wrapup` |
 | `maintenance` | Investigate changelogs, adopt upstream changes, sync skills to agent dirs |
-| `report-issue-framework` | File bugs/features against `@cyanheads/mcp-ts-core` |
-| `report-issue-local` | File bugs/features against this server's repo |
+| `report-issue-framework` | File a bug or feature request against `@cyanheads/mcp-ts-core` via `gh` CLI |
+| `report-issue-local` | File a bug or feature request against this server's own repo via `gh` CLI |
 | `api-auth` | Auth modes, scopes, JWT/OAuth |
 | `api-config` | AppConfig, parseConfig, env vars |
 | `api-context` | Context interface, RequestContext, logger, state, multi-round-trip input |
 | `api-errors` | McpError, JsonRpcErrorCode, error patterns |
 | `api-linter` | Definition linter rule catalog — invoked by `bun run lint:mcp` and `devcheck` |
-| `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper — Tier 3 opt-in |
+| `api-canvas` | DataCanvas: register tabular data, run SQL, export, plus the `spillover()` helper for big result sets — Tier 3 opt-in |
 | `api-mirror` | MirrorService: persistent self-refreshing local mirror (embedded SQLite + FTS5) of a bulk upstream dataset — Tier 3 opt-in |
 | `api-services` | LLM, Speech, Graph services |
 | `api-telemetry` | OTel catalog: spans, metrics, completion logs, env config, cardinality rules |
@@ -374,7 +380,7 @@ docker buildx build --platform linux/amd64,linux/arm64 \
   --push .
 ```
 
-Remind the user to run these after completing a release flow.
+The `release-and-publish` run handles npm, MCP Registry, bundle, GitHub Release, and GHCR publishing.
 
 ---
 

package/Dockerfile

@@ -7,9 +7,9 @@
 # Pinned to $BUILDPLATFORM: bun >= 1.4 aborts under QEMU user-mode emulation, so
 # leaving the build stage on the target platform kills the linux/amd64 leg of a
 # multi-arch buildx run on an arm64 host. This stage only runs tsc and emits
-# architecture-independent JavaScript, and the production stage installs its own
-# dependencies natively, so building it on the host architecture is safe.
-FROM --platform=$BUILDPLATFORM oven/bun:1.4.2 AS build
+# architecture-independent JavaScript; the native deps stage cross-installs the
+# production tree, so both build-time Bun stages run on the host architecture.
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.3 AS build
 
 WORKDIR /usr/src/app
 
@@ -33,73 +33,105 @@ RUN bun run build
 
 
 # ==============================================================================
-# Production Stage
+# Production Dependencies Stage
 #
-# This stage creates a minimal, optimized, and secure image for running the
-# application. It uses a slim base image and only includes production
-# dependencies and build artifacts.
+# Installs the production dependency tree for the target platform. Every step
+# here can run JavaScript — bunfig.toml's security scanner runs as a Bun
+# program, and so do the OTel and musl-prune scripts — so the stage runs on
+# $BUILDPLATFORM and cross-installs with `--os`/`--cpu`, which pick each
+# platform-specific optional dependency (native bindings such as DuckDB's) for
+# the target. Only `node_modules` leaves this stage.
+#
+# A clean image rather than `FROM build`: the build stage's node_modules holds
+# devDependencies.
 # ==============================================================================
-FROM oven/bun:1.4.2-slim AS production
+FROM --platform=$BUILDPLATFORM oven/bun:1.4.3 AS deps
 
 WORKDIR /usr/src/app
 
-# Set the environment to production for performance and to ensure only
-# production dependencies are installed.
-ENV NODE_ENV=production
-
-# OCI image metadata (https://github.com/opencontainers/image-spec/blob/main/annotations.md)
-ARG APP_VERSION
-LABEL org.opencontainers.image.title="congressgov-mcp-server"
-LABEL org.opencontainers.image.description="Access U.S. congressional data - bills, votes, members, committees - through MCP. STDIO & Streamable HTTP."
-LABEL org.opencontainers.image.source="https://github.com/cyanheads/congressgov-mcp-server"
-LABEL org.opencontainers.image.licenses="Apache-2.0"
-LABEL org.opencontainers.image.version="${APP_VERSION}"
-
-# Copy dependency manifests and preserve the release-age gate and scanner.
+# Copy dependency manifests. `bunfig.toml` rides along so every install below
+# passes its release-age gate and security scanner, as a local install does.
 COPY package.json bun.lock bunfig.toml ./
 
-# Seed the scanner because the production install omits this devDependency.
+# The scanner bunfig.toml names is a devDependency, and Bun installs a missing
+# scanner through the same production-filtered install, which omits it and
+# aborts. Seed it from the build stage's full install instead. Remove this line,
+# and the `rm` at the end of this stage, if bunfig.toml stops naming a scanner.
 COPY --from=build /usr/src/app/node_modules/@socketsecurity/bun-security-scanner ./node_modules/@socketsecurity/bun-security-scanner
 
+# Docker names the target architecture `amd64`/`arm64`; Bun's `--cpu` takes
+# `x64`/`arm64`. Mapped once here, read by both installs below. `oven/bun`
+# publishes only these two architectures, so any other target fails here.
+ARG TARGETOS
+ARG TARGETARCH
+RUN case "$TARGETARCH" in \
+      amd64) echo x64 ;; \
+      arm64) echo arm64 ;; \
+      *) echo "Unsupported TARGETARCH '$TARGETARCH': expected amd64 or arm64" >&2; exit 1 ;; \
+    esac > .bun-cpu
+
 # Install only production dependencies, ignoring any lifecycle scripts (like 'prepare')
 # that are not needed in the final production image.
 # `--omit=peer` drops the framework's optional peer tiers (test runner, service
 # SDKs, parsers) that Bun would otherwise auto-install. Anything this server
 # actually imports belongs in its own `dependencies`, so nothing needed at
-# runtime is lost. The OTEL step below carries the same flag — without it, that
-# install re-resolves the graph and pulls every optional peer back in.
+# runtime is lost.
 RUN --mount=type=cache,target=/root/.bun/install/cache \
-    bun install --production --omit=peer --frozen-lockfile --ignore-scripts
+    bun install --production --omit=peer --frozen-lockfile --ignore-scripts \
+      --os="$TARGETOS" --cpu="$(cat .bun-cpu)"
 
 # Conditionally install OpenTelemetry optional peer dependencies (Tier 3).
-# Installed by default; omit with --build-arg OTEL_ENABLED=false.
-# Resolve each package inside the installed framework's tested peer range.
+# Installed by default. Omit them for a leaner image at build time
+# with: docker build --build-arg OTEL_ENABLED=false
+# The script reads the list and each range from the installed framework's
+# `peerDependencies` and passes the target flags on to its `bun install`.
+COPY scripts/install-otel.ts ./scripts/
 ARG OTEL_ENABLED=true
 RUN --mount=type=cache,target=/root/.bun/install/cache \
     if [ "$OTEL_ENABLED" = "true" ]; then \
-      specs=$(bun -e ' \
-        const { peerDependencies: peers } = await Bun.file("node_modules/@cyanheads/mcp-ts-core/package.json").json(); \
-        const names = process.argv.slice(1); \
-        const missing = names.filter((name) => !peers?.[name]); \
-        if (missing.length > 0) throw new Error(`no peerDependencies range for ${missing.join(", ")}`); \
-        console.log(names.map((name) => `${name}@${peers[name]}`).join(" ")); \
-      ' \
-        @hono/otel \
-        @opentelemetry/api-logs \
-        @opentelemetry/exporter-logs-otlp-http \
-        @opentelemetry/exporter-metrics-otlp-http \
-        @opentelemetry/exporter-trace-otlp-http \
-        @opentelemetry/instrumentation-http \
-        @opentelemetry/instrumentation-pino \
-        @opentelemetry/resources \
-        @opentelemetry/sdk-logs \
-        @opentelemetry/sdk-metrics \
-        @opentelemetry/sdk-node \
-        @opentelemetry/sdk-trace-node \
-        @opentelemetry/semantic-conventions) \
-      && bun add --omit=dev --omit=peer --ignore-scripts $specs; \
+      bun scripts/install-otel.ts --os="$TARGETOS" --cpu="$(cat .bun-cpu)"; \
     fi
 
+# `--os`/`--cpu` have no libc counterpart, so a native dependency published in
+# glibc and musl variants (DuckDB's bindings, for one) installs both. The
+# runtime image is Debian (glibc) and never loads the musl copy; the script
+# deletes every package whose own `libc` admits only musl. It follows every
+# install, since a later `bun install` restores what it removes. A server on a
+# musl (Alpine) runtime image drops these two lines.
+COPY scripts/prune-musl-packages.ts ./scripts/
+RUN bun scripts/prune-musl-packages.ts
+
+# The seeded scanner served only the installs above; keep it out of the image.
+RUN rm -rf node_modules/@socketsecurity/bun-security-scanner
+
+
+# ==============================================================================
+# Production Stage
+#
+# This stage creates a minimal, optimized, and secure image for running the
+# application. It uses a slim base image and only includes production
+# dependencies and build artifacts.
+# ==============================================================================
+FROM oven/bun:1.4.3-slim AS production
+
+WORKDIR /usr/src/app
+
+# Set the environment to production for performance and to ensure only
+# production dependencies are installed.
+ENV NODE_ENV=production
+
+# OCI image metadata (https://github.com/opencontainers/image-spec/blob/main/annotations.md)
+ARG APP_VERSION
+LABEL org.opencontainers.image.title="congressgov-mcp-server"
+LABEL org.opencontainers.image.description="Access U.S. congressional data (bills, votes, members, committees) via MCP. STDIO or Streamable HTTP."
+LABEL org.opencontainers.image.source="https://github.com/cyanheads/congressgov-mcp-server"
+LABEL org.opencontainers.image.licenses="Apache-2.0"
+LABEL org.opencontainers.image.version="${APP_VERSION}"
+
+# The deps manifest is rewritten by the OTel install; retain the server manifest.
+COPY package.json ./
+COPY --from=deps /usr/src/app/node_modules ./node_modules
+
 # Copy the compiled application code from the build stage
 COPY --from=build /usr/src/app/dist ./dist
 

package/README.md

@@ -1,13 +1,13 @@
 <div align="center">
   <h1>@cyanheads/congressgov-mcp-server</h1>
-  <p><b>Access U.S. congressional data - bills, votes, members, committees - through MCP. STDIO & Streamable HTTP.</b>
+  <p><b>Access U.S. congressional data (bills, votes, members, committees) via MCP. STDIO or Streamable HTTP.</b>
   <div>11 Tools • 5 Resources • 2 Prompts</div>
   </p>
 </div>
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.7.3-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/congressgov-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.1.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/congressgov-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/congressgov-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.2-blueviolet.svg?style=flat-square)](https://bun.sh/)
+[![Version](https://img.shields.io/badge/Version-0.8.0-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?style=flat-square&logo=docker&logoColor=white)](https://github.com/users/cyanheads/packages/container/package/congressgov-mcp-server) [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.3.1-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![npm](https://img.shields.io/npm/v/@cyanheads/congressgov-mcp-server?style=flat-square&logo=npm&logoColor=white)](https://www.npmjs.com/package/@cyanheads/congressgov-mcp-server) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.3-blueviolet.svg?style=flat-square)](https://bun.sh/)
 
 </div>
 
@@ -71,6 +71,7 @@ Bill, member, and committee data is also reachable through `congressgov_bill_loo
 ### `congressgov_bill_lookup` <sub>tool</sub>
 
 - `list` browses one `congress`, narrowed by `billType` and a `fromDateTime`/`toDateTime` range on the record's update date, newest first unless `order: 'oldest'`; `get`, `actions`, `amendments`, `cosponsors`, `committees`, `subjects`, `summaries`, `text`, `titles`, `related`, and `content` need `congress` + `billType` + `billNumber`
+- Copied bill-row keys `type` and `number` are accepted as `billType` and `billNumber`; bill type codes are case-insensitive, and `relatedbills` (any case) selects `related`. Send one name per field: canonical and alias keys together are rejected.
 - `content` reads the text version at `textVersionIndex` (0-based in `text` order, 0 is the most recent) and returns one character window in `content.text` with `totalCharacters`, `truncated`, and `nextOffset`
 - `summaries` takes an optional `versionCode` (`00` introduced, `49` public law) and applies the same page budget and row window as `congressgov_bill_summaries`, steered by `characterOffset`/`characterLimit`; a cut row carries `textTotalCharacters`, `textTruncated`, and `textNextOffset`
 
@@ -94,6 +95,7 @@ Bill, member, and committee data is also reachable through `congressgov_bill_loo
 
 - `committeeCode` is a chamber prefix (`h`/`s`/`j`), letters, and a 2-digit suffix (e.g. `hsju00`); `get`, `bills`, `reports`, and the Senate-only `nominations` infer `chamber` from the prefix
 - A committee name in `committeeCode` resolves when exactly one committee matches, and otherwise returns the candidate rows with a notice; `list` with `filter` name-matches every committee in scope, past the 250-row page cap, and fuzzy hits carry `approximate: true`
+- Exact matches require every query token; typo matches require each token to match a name token at the similarity floor. Blank filters browse normally; unrelated tokens return no matches.
 - `bills` is newest first by default (`order`), and its rows carry no titles, so chain `congressgov_bill_lookup` `get` per row
 
 ---
@@ -124,6 +126,7 @@ Bill, member, and committee data is also reachable through `congressgov_bill_loo
 ### `congressgov_crs_reports` <sub>tool</sub>
 
 - `list` browses the catalog; `get` takes a `reportNumber` such as `R40097`, `RL33612`, or `IF12345`
+- `id`, `reportId`, and `report_id` are accepted as `reportNumber`. Send only one identifier key; canonical and alias keys together, or multiple aliases, are rejected.
 - `get` returns authors, topics, summary, and download formats
 
 ---
@@ -206,14 +209,15 @@ Congress.gov-specific:
 - Type-safe client for the Congress.gov REST API v3, plus a client for the Senate's LIS XML feed that backs Senate roll votes
 - The Congress.gov API has no keyword search, so tools browse by congress, type, date range, chamber, state, and district, and address bills by `congress` + `billType` + `billNumber`, members by `bioguideId`, and committees by system code; list operations page with `limit` 1–250 (default 20) and `offset`
 - `content` on bill text, committee reports, and Record articles reads `format` `text` (default) or `xml` through a `characterOffset`/`characterLimit` window (1–100,000 characters, default 25,000), fetched only from `www.congress.gov` under a 25 MB ceiling and a 30s deadline
-- Optional API key from [api.data.gov](https://api.data.gov/signup/): `DEMO_KEY` allows 30 req/hr, your own key 5,000 req/hr
+- Optional API key from [api.data.gov](https://api.data.gov/signup/): documented fallbacks are `DEMO_KEY` 30 requests/hour and 50/day per IP, registered keys 5,000/hour. Valid upstream hourly quota headers override the fallback; actual quotas vary
 - Opt-in local SQLite FTS5 mirror (`CONGRESS_MIRROR_ENABLED`) adds keyword search over bill titles and CRS summaries
 
 Agent-friendly output:
 
 - Every list response carries `effectiveQuery` and `totalCount`; a `notice` fires when nothing matched, and a page past the end says so in the rendered output
+- `list` rejects entity identities it would discard: bill `billNumber`, vote `voteNumber`, nomination `nominationNumber`, CRS/committee `reportNumber`, and Record `volumeNumber`. The `incompatible_identity` domain error names the detail operation to select or the field to remove; pagination and defaulted selectors remain accepted.
 - Exact character windows: `content` returns `offset`, `truncated`, and `nextOffset`, so walking a multi-megabyte bill never skips or repeats a character
-- Typed `content` failures (`document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, `offset_past_end`) alongside the shared `not_found`, `rate_limited`, `invalid_request`, and `upstream_error` reasons, each with a recovery hint
+- Typed `content` failures (`document_unavailable`, `format_unavailable`, `document_fetch_failed`, `document_too_large`, `offset_past_end`) alongside the shared `not_found`, `rate_limited`, `invalid_request`, `upstream_error`, and `upstream_timeout` reasons, each with a recovery hint. Document byte ceilings and exhausted document/summary offsets use domain validation (-32007); malformed arguments remain protocol invalid parameters (-32602)
 
 ## Getting started
 
@@ -301,7 +305,7 @@ MCP_TRANSPORT_TYPE=http MCP_HTTP_PORT=3010 CONGRESS_API_KEY=your-api-key bun run
 ### Prerequisites
 
 - [Bun v1.4.0](https://bun.sh/) or higher (or Node.js v24+).
-- Optional: a free [api.data.gov key](https://api.data.gov/signup/) raises the limit from 30 to 5,000 requests per hour.
+- Optional: a free [api.data.gov key](https://api.data.gov/signup/) uses a documented fallback of 5,000 requests/hour instead of the demo fallback of 30/hour and 50/day per IP. Upstream hourly headers may advertise a different quota.
 
 ### Installation
 
@@ -334,7 +338,7 @@ cp .env.example .env
 
 | Variable | Description | Default |
 |:---|:---|:---|
-| `CONGRESS_API_KEY` | API key from [api.data.gov](https://api.data.gov/signup/). `DEMO_KEY` allows 30 req/hr; your own key 5,000 req/hr. | `DEMO_KEY` |
+| `CONGRESS_API_KEY` | API key from [api.data.gov](https://api.data.gov/signup/). Fallbacks: `DEMO_KEY` 30/hour and 50/day per IP; registered key 5,000/hour. Upstream hourly quota headers take precedence. | `DEMO_KEY` |
 | `CONGRESS_API_BASE_URL` | Congress.gov API base URL. | `https://api.congress.gov/v3` |
 | `CONGRESS_MIRROR_ENABLED` | Enable the local bill search mirror and the `congressgov_search_bills` tool. | `false` |
 | `CONGRESS_MIRROR_PATH` | Filesystem path to the SQLite mirror index. | `.mirror/bills.sqlite3` |
@@ -365,7 +369,7 @@ See [`.env.example`](./.env.example) for the full list of optional overrides.
   bun run start:http   # or start:stdio
   ```
 
-- **Build the bill search mirror** (with `CONGRESS_MIRROR_ENABLED=true`):
+- **Build the bill search mirror from this checkout** (with `CONGRESS_MIRROR_ENABLED=true`):
 
   ```sh
   bun run mirror:init      # full build
@@ -373,6 +377,8 @@ See [`.env.example`](./.env.example) for the full list of optional overrides.
   bun run mirror:verify    # readiness and integrity check
   ```
 
+  The mirror CLI requires this checkout or the Docker image's path mapping; an npm installation cannot run these scripts.
+
 - **Run checks and tests:**
 
   ```sh

package/changelog/0.7.x/0.7.4.md

@@ -0,0 +1,31 @@
+---
+summary: "Tool argument repair and native Docker dependency installs."
+breaking: false
+security: false
+---
+
+# 0.7.4 — 2026-10-10
+
+## Changed
+
+- **Tool argument repair** accepts numeric `congress`/`limit`/`offset` strings in committee-report listings, boolean `currentMember` strings in member listings, and `null` as an omitted optional `reportType` filter. Numeric-string repair applies to directly declared number fields, not values behind preprocessing.
+- **Error correlation** adds a generated `data.requestId` matching the call's log records to framework-handled tool, resource, and prompt errors; rendered tool errors include the same ID. Protocol-level rejections and resource-parameter errors containing only `{ uri }` are excluded.
+- **Document recovery** relies on declared hints instead of redundant forwards in the document service and selected report/Record handlers, preserving error codes, reasons, and recovery text on both client surfaces.
+- **Development guidance** and checks sync with the framework; mirror CLI documentation specifies the checkout or Docker path mapping requirement, and logging examples include `LOG_LLM_INTERACTIONS`.
+
+## Fixed
+
+- **Docker builds** install target-platform production dependencies in a native build-platform stage, derive OTel installs from framework peer ranges, and remove musl-only packages from the glibc image.
+- **Registry launches** use `npx` without npm-script arguments and fix `MCP_TRANSPORT_TYPE=http` for the HTTP package entry.
+
+## Dependencies
+
+- `@cyanheads/mcp-ts-core` ^0.13.9 → ^0.13.14.
+- `fast-xml-parser` ^5.11.1 → ^5.11.2.
+- `pino-pretty` ^13.1.3 → ^13.2.0.
+- Dev: `@biomejs/biome` ^2.5.14 → ^2.5.15.
+- Dev: `@types/node` ^26.6.2 → ^26.6.4.
+- Dev: `ignore` ^7.0.10 → ^7.0.12.
+- Dev: `tsc-alias` ^1.9.5 → ^1.9.7.
+- Dev: `vitest` ^5.0.1 → ^5.0.3.
+- Lockfile only: `@modelcontextprotocol/core` and `@modelcontextprotocol/server` 2.1.0 → 2.3.1; `source-map-js` 1.2.1 → 1.2.2.

package/changelog/0.8.x/0.8.0.md

@@ -0,0 +1,25 @@
+---
+summary: "Congress.gov identifier aliases, meaningful committee matches, and quota-aware errors."
+breaking: true
+security: false
+---
+
+# 0.8.0 — 2026-10-13
+
+## Changed
+
+- **Document and summary bounds** now return `ValidationError` (-32007) for `document_too_large` and `offset_past_end`, replacing `InvalidParams` (-32602). Consumers matching numeric codes must migrate; malformed arguments still use -32602. ([#74](https://github.com/cyanheads/congressgov-mcp-server/issues/74))
+- **List operations** reject entity identities they formerly ignored with `incompatible_identity` and compatible-operation guidance; remove the identity to browse or select the detail operation. ([#68](https://github.com/cyanheads/congressgov-mcp-server/issues/68))
+- **Bill inputs** accept `type`/`number`, case-insensitive bill types, and any-case `relatedbills`; **CRS inputs** accept `id`, `reportId`, and `report_id`. Alias collisions reject; advertised canonical input schemas stay unchanged. ([#79](https://github.com/cyanheads/congressgov-mcp-server/issues/79), [#81](https://github.com/cyanheads/congressgov-mcp-server/issues/81))
+- **Development tooling** pins Bun 1.4.2 → 1.4.3 in package-manager and Docker surfaces, synchronizes framework skills, and corrects the MCP SDK documentation baseline to the already-installed 2.3.1.
+
+## Fixed
+
+- **Committee typo matching** requires every query token to qualify and ranks ties deterministically before pagination; unrelated candidates disappear, and capped suggestions may contain different tied rows. ([#69](https://github.com/cyanheads/congressgov-mcp-server/issues/69))
+- **Quota protection** reserves failed, retried, and concurrent attempts before dispatch, honors upstream hourly bounds, and applies demo 30/hour plus 50/day and registered 5,000/hour fallbacks. Recovery retains `Retry-After` and distinguishes local accounting from shared quotas. ([#71](https://github.com/cyanheads/congressgov-mcp-server/issues/71))
+- **Request deadlines and HTTP timeouts** return `upstream_timeout` with recovery and retry metadata; HTTP timeout responses retain their status, and cancellation remains cancellation. ([#78](https://github.com/cyanheads/congressgov-mcp-server/issues/78))
+
+## Dependencies
+
+- **@cyanheads/mcp-ts-core** ^0.13.14 → ^0.13.15.
+- **@types/node** ^26.6.4 → ^26.6.5.

package/dist/config/server-config.js

@@ -36,7 +36,7 @@ const ServerConfigSchema = z.object({
     apiKey: z
         .string()
         .default('DEMO_KEY')
-        .describe('Congress.gov API key from api.data.gov — optional (DEMO_KEY: 30 req/hr, own key: 5000 req/hr)'),
+        .describe('Congress.gov API key from api.data.gov — optional (fallbacks: DEMO_KEY 30/hour and 50/day per IP, registered key 5000/hour; upstream hourly quota headers take precedence)'),
     baseUrl: z
         .string()
         .url()

package/dist/config/server-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAI,GAAS,IAAI,IAAI,EAAE;IAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CACP,+FAA+F,CAChG;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,6BAA6B,CAAC;SACtC,QAAQ,CAAC,2BAA2B,CAAC;IAExC;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,UAAU,EAAE;SACZ,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,4EAA4E,CAAC;IACzF,8FAA8F;IAC9F,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,mBAAmB,CAAC;SAC5B,QAAQ,CAAC,kDAAkD,CAAC;IAC/D;;;OAGG;IACH,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,oFAAoF,CAAC;IACjG;;;;OAIG;IACH,UAAU,EAAE,CAAC;SACV,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxE,QAAQ,CAAC,uEAAuE,CAAC;CACrF,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,cAAc,CAAC,kBAAkB,EAAE;QAC7C,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,aAAa,EAAE,yBAAyB;QACxC,UAAU,EAAE,sBAAsB;QAClC,iBAAiB,EAAE,8BAA8B;QACjD,UAAU,EAAE,4BAA4B;KACzC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC"}
+{"version":3,"file":"server-config.js","sourceRoot":"","sources":["../../src/config/server-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,wBAAwB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAI,GAAS,IAAI,IAAI,EAAE;IAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;IACxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,OAAO,CAAC,UAAU,CAAC;SACnB,QAAQ,CACP,4KAA4K,CAC7K;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,EAAE;SACL,OAAO,CAAC,6BAA6B,CAAC;SACtC,QAAQ,CAAC,2BAA2B,CAAC;IAExC;;;;OAIG;IACH,aAAa,EAAE,CAAC;SACb,UAAU,EAAE;SACZ,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,4EAA4E,CAAC;IACzF,8FAA8F;IAC9F,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,OAAO,CAAC,mBAAmB,CAAC;SAC5B,QAAQ,CAAC,kDAAkD,CAAC;IAC/D;;;OAGG;IACH,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,oFAAoF,CAAC;IACjG;;;;OAIG;IACH,UAAU,EAAE,CAAC;SACV,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxE,QAAQ,CAAC,uEAAuE,CAAC;CACrF,CAAC,CAAC;AAIH,IAAI,OAAiC,CAAC;AAEtC,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,cAAc,CAAC,kBAAkB,EAAE;QAC7C,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE,uBAAuB;QAChC,aAAa,EAAE,yBAAyB;QACxC,UAAU,EAAE,sBAAsB;QAClC,iBAAiB,EAAE,8BAA8B;QACjD,UAAU,EAAE,4BAA4B;KACzC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,SAAS,CAAC;AACtB,CAAC"}

package/dist/index.js

@@ -92,7 +92,7 @@ await createApp({
     instructions: `Use the congressgov_* tools to access U.S. legislative data via the Congress.gov API v3: bills, enacted laws, members, committees, roll call votes, presidential nominations, CRS reports, and the daily Congressional Record. The Congress.gov API itself has no keyword search — browse by congress number, bill/report type, date range, chamber, state, and district. An optional local FTS mirror adds congressgov_search_bills (keyword search over bill titles and summaries) when CONGRESS_MIRROR_ENABLED is set; it is off by default, and the tool is not offered at all unless that flag is set. Bills are addressed by congress + billType + billNumber (e.g. 118/hr/1234), members by bioguideId, committees by chamber-prefix codes. congressgov_roll_votes serves both chambers via its 'chamber' parameter — House votes come from the Congress.gov API, Senate votes from the Senate's official LIS feed.`,
     landing: {
         repoRoot: REPO_ROOT,
-        tagline: 'U.S. legislative data — bills, votes, members, committees — via MCP.',
+        tagline: 'U.S. legislative data (bills, votes, members, committees) via MCP.',
         requireAuth: false,
     },
     async setup(core) {