@secondlayer/mcp 10.0.1 → 11.1.0

package/dist/bin-http.js

@@ -23,6 +23,63 @@ function isHostedArchiveUrl(url) {
   }
 }
 
+// src/lib/tool.ts
+var registeredToolNames = new Set;
+var serverToolNames = new WeakMap;
+var serverToolFilters = new WeakMap;
+function getRegisteredToolNames(server) {
+  return server ? [...serverToolNames.get(server) ?? []] : [...registeredToolNames];
+}
+function restrictTools(server, allow) {
+  serverToolFilters.set(server, allow);
+}
+function envelopeFields(err) {
+  if (!err || typeof err !== "object")
+    return {};
+  const e = err;
+  const body = e.body && typeof e.body === "object" ? e.body : {};
+  const code = typeof e.code === "string" ? e.code : typeof body.code === "string" ? body.code : undefined;
+  const request_id = typeof body.request_id === "string" ? body.request_id : undefined;
+  const fb = body.feedback;
+  const feedback = fb && typeof fb === "object" && typeof fb.url === "string" ? { url: fb.url } : undefined;
+  return {
+    ...code ? { code } : {},
+    ...request_id ? { request_id } : {},
+    ...feedback ? { feedback } : {}
+  };
+}
+function defineTool(server, name, description, schema, handler) {
+  const wrappedHandler = async (args) => {
+    try {
+      return await handler(args);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const status = err instanceof Error && "status" in err ? err.status : 0;
+      const type = status === 401 ? "unauthorized" : status === 404 ? "not_found" : status === 429 ? "rate_limited" : status >= 500 ? "server_error" : "error";
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              error: { type, status, message, ...envelopeFields(err) }
+            })
+          }
+        ],
+        isError: true
+      };
+    }
+  };
+  const allow = serverToolFilters.get(server);
+  if (allow && !allow(name))
+    return;
+  if (!allow)
+    registeredToolNames.add(name);
+  const names = serverToolNames.get(server) ?? new Set;
+  names.add(name);
+  serverToolNames.set(server, names);
+  server.tool(name, description, schema, wrappedHandler);
+}
+
 // src/resources.ts
 import {
   ResourceTemplate
@@ -83,37 +140,40 @@ function getArchiveOpsClient() {
 function keyHint(baseUrl = resolveBaseUrl()) {
   return isHostedApiUrl(baseUrl) ? " — set SECONDLAYER_API_KEY (an sk-sl_ key from secondlayer.tools/account/keys)" : " — set INSTANCE_TOKEN from `sl init` for writes";
 }
-async function apiRequest(method, path, body) {
-  const baseUrl = resolveBaseUrl();
-  const apiKey = readApiKey();
-  const res = await fetch(`${baseUrl}${path}`, {
-    method,
-    headers: {
-      "Content-Type": "application/json",
-      ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
-    },
-    body: body ? JSON.stringify(body) : undefined
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    const needsKey = !apiKey && (res.status === 401 || res.status === 403);
-    let parsed;
-    try {
-      parsed = text ? JSON.parse(text) : undefined;
-    } catch {
-      parsed = undefined;
-    }
-    const code = parsed && typeof parsed === "object" && typeof parsed.code === "string" ? parsed.code : undefined;
-    throw Object.assign(new Error((text || `HTTP ${res.status}`) + (needsKey ? keyHint(baseUrl) : "")), {
-      status: res.status,
-      ...parsed !== undefined ? { body: parsed } : {},
-      ...code ? { code } : {}
+function createApiRequest(config) {
+  const doFetch = config.fetchImpl ?? ((...args) => fetch(...args));
+  return async (method, path, body) => {
+    const { baseUrl, apiKey } = config;
+    const res = await doFetch(`${baseUrl}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+      },
+      body: body ? JSON.stringify(body) : undefined
     });
-  }
-  if (res.status === 204)
-    return;
-  return res.json();
+    if (!res.ok) {
+      const text = await res.text().catch(() => "");
+      const needsKey = !apiKey && (res.status === 401 || res.status === 403);
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : undefined;
+      } catch {
+        parsed = undefined;
+      }
+      const code = parsed && typeof parsed === "object" && typeof parsed.code === "string" ? parsed.code : undefined;
+      throw Object.assign(new Error((text || `HTTP ${res.status}`) + (needsKey ? keyHint(baseUrl) : "")), {
+        status: res.status,
+        ...parsed !== undefined ? { body: parsed } : {},
+        ...code ? { code } : {}
+      });
+    }
+    if (res.status === 204)
+      return;
+    return res.json();
+  };
 }
+var apiRequest = (method, path, body) => createApiRequest({ baseUrl: resolveBaseUrl(), apiKey: readApiKey() })(method, path, body);
 
 // src/lib/format.ts
 function formatSubgraphSummary(s) {
@@ -144,51 +204,6 @@ function textResponse(text, isError) {
   };
 }
 
-// src/lib/tool.ts
-var registeredToolNames = new Set;
-function getRegisteredToolNames() {
-  return [...registeredToolNames];
-}
-function envelopeFields(err) {
-  if (!err || typeof err !== "object")
-    return {};
-  const e = err;
-  const body = e.body && typeof e.body === "object" ? e.body : {};
-  const code = typeof e.code === "string" ? e.code : typeof body.code === "string" ? body.code : undefined;
-  const request_id = typeof body.request_id === "string" ? body.request_id : undefined;
-  const fb = body.feedback;
-  const feedback = fb && typeof fb === "object" && typeof fb.url === "string" ? { url: fb.url } : undefined;
-  return {
-    ...code ? { code } : {},
-    ...request_id ? { request_id } : {},
-    ...feedback ? { feedback } : {}
-  };
-}
-function defineTool(server, name, description, schema, handler) {
-  const wrappedHandler = async (args) => {
-    try {
-      return await handler(args);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const status = err instanceof Error && "status" in err ? err.status : 0;
-      const type = status === 401 ? "unauthorized" : status === 404 ? "not_found" : status === 429 ? "rate_limited" : status >= 500 ? "server_error" : "error";
-      return {
-        content: [
-          {
-            type: "text",
-            text: JSON.stringify({
-              error: { type, status, message, ...envelopeFields(err) }
-            })
-          }
-        ],
-        isError: true
-      };
-    }
-  };
-  registeredToolNames.add(name);
-  server.tool(name, description, schema, wrappedHandler);
-}
-
 // src/resources.ts
 var TRAIT_BLURBS = {
   "sip-009": "Non-fungible token (NFT) standard",
@@ -226,7 +241,6 @@ var PRODUCT_BLURBS = {
   codegen: "ORM schemas for the tables you read",
   instance: "decoder health and empty-index diagnosis",
   archive: "signed archive verify, bootstrap/repair, quote, latest pointer",
-  setup: "one-command self-host onboarding",
   credits: "archive credits balance at api.secondlayer.tools"
 };
 var PRODUCT_ORDER = [
@@ -239,12 +253,11 @@ var PRODUCT_ORDER = [
   "codegen",
   "instance",
   "archive",
-  "setup",
   "credits"
 ];
-function buildCapabilities() {
+function buildCapabilities(server) {
   const byPrefix = new Map;
-  for (const name of getRegisteredToolNames()) {
+  for (const name of getRegisteredToolNames(server)) {
     const sep = name.indexOf("_");
     const prefix = sep === -1 ? name : name.slice(0, sep);
     const tools = byPrefix.get(prefix) ?? [];
@@ -265,7 +278,11 @@ function buildCapabilities() {
     discoverFirst: "Call index_discover / contracts_find to learn what exists (and which filters each surface accepts) before querying."
   };
 }
-function readAuthTiers(credential) {
+function readAuthTiers(credential, hosted) {
+  if (hosted) {
+    const reads = `keyed: every read uses ${credential} and is metered to the account's credits (the first 1M rows each month are free)`;
+    return { index: reads, streams: reads };
+  }
   const reads = `keyless while the API is only reachable on loopback; ${credential} is required once it is published past loopback`;
   return {
     index: reads,
@@ -276,8 +293,9 @@ function readAuthTiers(credential) {
 function credentialLabel() {
   return isHostedApiUrl2(resolveBaseUrl2()) ? "SECONDLAYER_API_KEY (an sk-sl_ account key)" : "INSTANCE_TOKEN";
 }
+var HOSTED_CREDENTIAL = "the caller's OAuth sign-in (or sk-sl_ account key)";
 async function buildContext(deps = { clientProvider: getClient }) {
-  const credential = credentialLabel();
+  const credential = deps.hosted ? HOSTED_CREDENTIAL : credentialLabel();
   const unavailable = `unavailable: set ${credential}`;
   const orNull = (field) => {
     if (!field)
@@ -290,7 +308,7 @@ async function buildContext(deps = { clientProvider: getClient }) {
   const instance = snap?.instance?.value ? snap.instance.value : orNull(snap?.instance);
   return {
     authState: {
-      apiKeySet: Boolean(readApiKey())
+      apiKeySet: deps.hosted ? true : Boolean(readApiKey())
     },
     whatExists: {
       account: orNull(snap?.account),
@@ -301,12 +319,13 @@ async function buildContext(deps = { clientProvider: getClient }) {
       activeOperations: orNull(snap?.activeOperations),
       instance
     },
-    whatYouCanDo: buildCapabilities(),
-    readAuthTiers: readAuthTiers(credential),
+    whatYouCanDo: buildCapabilities(deps.server),
+    readAuthTiers: readAuthTiers(credential, Boolean(deps.hosted)),
     ...snap?.instance?.value?.state === "empty-index" ? { nextStep: BOOTSTRAP_STEP } : {}
   };
 }
-function registerResources(server) {
+function registerResources(server, deps = { clientProvider: getClient }) {
+  const contextDeps = deps.hosted ? { ...deps, server } : deps;
   server.resource("context", "secondlayer://context", {
     description: "Live agent context — what exists (your subgraphs, webhooks, account), what you can do, and read-auth tiers. Read this first."
   }, async () => ({
@@ -314,7 +333,7 @@ function registerResources(server) {
       {
         uri: "secondlayer://context",
         mimeType: "application/json",
-        text: JSON.stringify(await buildContext(), null, 2)
+        text: JSON.stringify(await buildContext(contextDeps), null, 2)
       }
     ]
   }));
@@ -352,24 +371,26 @@ function registerResources(server) {
       }
     ]
   }));
-  server.resource("chain-triggers", "secondlayer://chain-triggers", {
-    description: "Chain-webhook trigger types and the filter fields each accepts (for webhooks_create triggers)."
-  }, async () => ({
-    contents: [
-      {
-        uri: "secondlayer://chain-triggers",
-        mimeType: "application/json",
-        text: JSON.stringify(CHAIN_TRIGGER_FIELDS, null, 2)
-      }
-    ]
-  }));
+  if (!deps.hosted) {
+    server.resource("chain-triggers", "secondlayer://chain-triggers", {
+      description: "Chain-webhook trigger types and the filter fields each accepts (for webhooks_create triggers)."
+    }, async () => ({
+      contents: [
+        {
+          uri: "secondlayer://chain-triggers",
+          mimeType: "application/json",
+          text: JSON.stringify(CHAIN_TRIGGER_FIELDS, null, 2)
+        }
+      ]
+    }));
+  }
   server.resource("samples", new ResourceTemplate("secondlayer://samples/{contractId}", {
     list: undefined
   }), {
     description: "Decoded camelCase print samples for a contract (schema + up to 5 events). Use before writing a print_event handler."
   }, async (uri, variables) => {
     const contractId = String(Array.isArray(variables.contractId) ? variables.contractId[0] : variables.contractId ?? "");
-    const body = await buildSamplesResource(contractId);
+    const body = await buildSamplesResource(contractId, deps.clientProvider);
     return {
       contents: [
         {
@@ -434,239 +455,32 @@ async function buildSamplesResource(contractId, clientProvider = getClient) {
 
 // src/tools/account.ts
 import { z } from "zod";
-function registerAccountTools(server) {
+function registerAccountTools(server, request = apiRequest) {
   defineTool(server, "account_whoami", "Show the archive account email at api.secondlayer.tools, not the self-host instance.", {}, async () => {
-    const result = await apiRequest("GET", "/api/accounts/me");
+    const result = await request("GET", "/api/accounts/me");
     return jsonResponse(result);
   });
   defineTool(server, "account_create_key", "Mint an account key (sk-sl_*) for archive credits, quote, and fetch at api.secondlayer.tools. The returned `key` is shown ONCE.", {
     name: z.string().optional().describe("Optional label for the key")
-  }, async ({ name }) => jsonResponse(await apiRequest("POST", "/api/keys", { name })));
+  }, async ({ name }) => jsonResponse(await request("POST", "/api/keys", { name })));
 }
 
-// src/tools/archive.ts
+// src/tools/archive-cli.ts
 import { z as z2 } from "zod";
-var FLOW = ["bootstrap", "repair"];
-function registerArchiveTools(server, clientProvider = getClient, archiveOpsClientProvider = getArchiveOpsClient) {
-  defineTool(server, "archive_verify", "Read-only, free compare of this instance against a signed archive (POST /v1/archive/verify). unanchored means pin a key or check the URL — not that the instance is fine. After bootstrap, poll instance_status until decoders ok, then this, then codegen_index_schema. Do not download parquet.", {
-    against: z2.string().describe("Archive manifest URL"),
-    fromBlock: z2.number().int().nonnegative().optional().describe("First height (inclusive)"),
-    toBlock: z2.number().int().nonnegative().optional().describe("Last height (inclusive)"),
-    target: z2.string().optional().describe("Verify target (default raw)")
-  }, async ({ against, fromBlock, toBlock, target }) => jsonResponse(await clientProvider().archive.verify({
-    against,
-    fromBlock,
-    toBlock,
-    target
-  })));
-  defineTool(server, "archive_latest", "Signed pointer to the official archive tree (hosted). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Use the returned origin as --against for archive_bootstrap. Do not download parquet.", {
-    against: z2.string().optional().describe("Override latest.json URL (default official tree)")
-  }, async ({ against }) => jsonResponse(await archiveOpsClientProvider().archive.latest(against)));
-  defineTool(server, "archive_quote", "Price a hosted archive fetch (metered). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Quote happens here; bootstrap/repair also quote inside the CLI. Do not download parquet.", {
-    paths: z2.array(z2.string()).describe("Partition paths to price"),
-    flow: z2.enum(FLOW).describe("bootstrap or repair")
-  }, async ({ paths, flow }) => jsonResponse(await archiveOpsClientProvider().archive.quote({ paths, flow })));
-  defineTool(server, "credits_balance", "Archive credits balance at api.secondlayer.tools. Needs SECONDLAYER_API_KEY (sk-sl_*); INSTANCE_TOKEN is the instance.", {}, async () => jsonResponse(await archiveOpsClientProvider().archive.credits.balance()));
-}
-
-// src/tools/codegen.ts
-import {
-  generateIndexSchema
-} from "@secondlayer/subgraphs";
-import { z as z3 } from "zod";
-var TARGETS = ["prisma", "kysely", "drizzle", "json-schema"];
-function registerCodegenTools(server) {
-  defineTool(server, "codegen_index_schema", "Generate an ORM schema for the Index tables (blocks, transactions, decoded_events, …) — the same output as `sl codegen index`. Returns the file contents as text; write it wherever your project keeps its schema. Use `tables` to emit only what you read.", {
-    target: z3.enum(TARGETS).optional().describe("Output flavor (default kysely)"),
-    tables: z3.array(z3.string()).optional().describe("Restrict to these Index tables (default: all)"),
-    schemaName: z3.string().optional().describe("Postgres schema to qualify table names with"),
-    datasourceEnv: z3.string().optional().describe("Prisma only: datasource url env var (default DATABASE_URL)")
-  }, ({ target, tables, schemaName, datasourceEnv }) => textResponse(generateIndexSchema(target ?? "kysely", {
-    tables,
-    schemaName,
-    datasourceEnv
-  })));
-}
-
-// src/tools/contracts.ts
-import { z as z4 } from "zod";
-function registerContractTools(server, clientProvider = getClient) {
-  defineTool(server, "contracts_find", 'Discover deployed Stacks contracts conforming to a trait (e.g. "sip-010", "sip-009", "sip-013"). The discovery endpoint for "which contracts implement X". Reads are public.', {
-    trait: z4.string().describe('Required. Trait to match (e.g. "sip-010").'),
-    conformance: z4.enum(["declared", "inferred", "any"]).optional().describe("declared = parsed from source, inferred = ABI shape-match, any = either (default)"),
-    include: z4.literal("abi").optional().describe(`Set to "abi" to include each contract's full ABI`),
-    limit: z4.number().optional().describe("Page size, 1–500 (default 100)"),
-    cursor: z4.string().optional().describe("Opaque cursor from a prior response's next_cursor")
-  }, async (params) => jsonResponse(await clientProvider().contracts.list(params)));
-  defineTool(server, "contracts_get_abi", "Fetch a single deployed contract's ABI from the registry (prod-safe). Returns the contract's metadata + full ABI (functions, maps, variables, fungible/non-fungible tokens). Returns not_found if the contract isn't in the registry. Use it to inspect a contract before subgraphs_scaffold.", {
-    contractId: z4.string().describe("Fully qualified contract id (e.g. SP….amm-pool-v2-01)")
-  }, async ({ contractId }) => {
-    const contract = await clientProvider().contracts.get(contractId, {
-      includeAbi: true
-    });
-    return contract ? jsonResponse(contract) : jsonResponse({
-      error: {
-        type: "not_found",
-        status: 404,
-        message: `Contract not in registry: ${contractId}`
-      }
-    }, true);
-  });
-}
-
-// src/tools/index.ts
-import { DECODED_EVENT_TYPES } from "@secondlayer/shared";
-import { z as z5 } from "zod";
-var INDEX_EVENT_TYPES = DECODED_EVENT_TYPES;
-var rangeFilters = {
-  contractId: z5.string().optional().describe("Filter by contract id"),
-  fromHeight: z5.number().optional().describe("Start block height (inclusive)"),
-  toHeight: z5.number().optional().describe("End block height (inclusive)"),
-  cursor: z5.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
-  limit: z5.number().optional().describe("Max rows for this page")
-};
-var heightFilters = {
-  fromHeight: rangeFilters.fromHeight,
-  toHeight: rangeFilters.toHeight,
-  cursor: rangeFilters.cursor,
-  limit: rangeFilters.limit
-};
-function registerIndexTools(server, clientProvider = getClient) {
-  defineTool(server, "index_ft_transfers", "List decoded SIP-010 fungible-token transfers from Index. Reads are keyless.", {
-    ...rangeFilters,
-    sender: z5.string().optional().describe("Filter by sender principal"),
-    recipient: z5.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z5.string().optional().describe("Filter by asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token")
-  }, async (params) => jsonResponse(await clientProvider().index.ftTransfers.list(params)));
-  defineTool(server, "index_nft_transfers", "List decoded SIP-009 non-fungible-token transfers from Index. Reads are keyless.", {
-    ...rangeFilters,
-    sender: z5.string().optional().describe("Filter by sender principal"),
-    recipient: z5.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z5.string().optional().describe("Filter by asset identifier (contract::asset)")
-  }, async (params) => jsonResponse(await clientProvider().index.nftTransfers.list(params)));
-  defineTool(server, "index_events", "List decoded chain events from the Index by event type. Use this for event types without a dedicated tool (stx_*, ft_mint/burn, nft_mint/burn, print), and for trait-scoped queries: set `trait` (e.g. sip-010) to match all contracts conforming to a standard — pair with contracts_find to discover traits. For ft/nft transfers without a trait prefer index_ft_transfers / index_nft_transfers.", {
-    eventType: z5.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
-    ...rangeFilters,
-    sender: z5.string().optional().describe("Filter by sender principal"),
-    recipient: z5.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z5.string().optional().describe("Filter by asset identifier where applicable"),
-    trait: z5.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only."),
-    txContext: z5.boolean().optional().describe("Join the submitting transaction into each event (tx_sender, tx_type, tx_status, tx_contract_id, tx_function_name). For print events it's the only source of the submitting sender.")
-  }, async (params) => jsonResponse(await clientProvider().index.events.list(params)));
-  defineTool(server, "index_contract_calls", "List decoded contract calls from the Index (function name, args, result). Set `trait` (e.g. sip-010) to match calls to all contracts conforming to a standard. Note: contract-call cursors are a SEPARATE keyspace from event cursors — they are not interchangeable.", {
-    ...rangeFilters,
-    functionName: z5.string().optional().describe("Filter by called function name"),
-    sender: z5.string().optional().describe("Filter by caller principal"),
-    trait: z5.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
-  }, async (params) => jsonResponse(await clientProvider().index.contractCalls.list(params)));
-  defineTool(server, "index_blocks", "List decoded blocks from Index. Reads are keyless.", { ...heightFilters }, async (params) => jsonResponse(await clientProvider().index.blocks.list(params)));
-  defineTool(server, "index_transactions", "List decoded transactions from Index. Filter by type, sender, or contract. Reads are keyless.", {
-    ...rangeFilters,
-    type: z5.string().optional().describe("Filter by transaction type"),
-    sender: z5.string().optional().describe("Filter by sender principal")
-  }, async (params) => jsonResponse(await clientProvider().index.transactions.list(params)));
-  defineTool(server, "index_print_schema", "Empirical per-topic print payload schemas for a contract, inferred from sampled on-chain events: each topic's fields with observed Clarity types, decoded TS types, subgraph column types, and presence rates. Use before writing print_event subgraph handlers to learn what's on e.data. Anonymous read.", {
-    contractId: z5.string().describe("Contract id (SP….name) whose print events to profile")
-  }, async (params) => jsonResponse(await clientProvider().index.printSchema(params.contractId)));
-  defineTool(server, "index_discover", "Discover the Index vocabulary: every event type and its columns, allowed/equality filters, and required-non-null fields (and which types accept `trait`). Read this before building Index queries instead of guessing filters. Anonymous read.", {}, async () => jsonResponse(await clientProvider().index.discover()));
-  defineTool(server, "batch_query", "Run up to 10 public /v1 reads in one round trip (POST /v1/batch). Each item keeps its own auth/quota/pay-per-call semantics; results return in order with per-item status. Paths must start with /v1/index, /v1/subgraphs, /v1/streams, or /v1/contracts.", {
-    requests: z5.array(z5.object({
-      path: z5.string().describe("Public /v1 read path"),
-      params: z5.record(z5.string(), z5.string()).optional()
-    })).min(1).max(10).describe("Read descriptors, executed concurrently")
-  }, async (params) => jsonResponse(await clientProvider().batch(params.requests)));
-}
-
-// src/tools/instance.ts
-function registerInstanceTools(server, clientProvider = getClient) {
-  defineTool(server, "instance_status", "Decoder health and empty-index diagnosis from GET /public/status. If state is empty-index, next tool is archive_bootstrap or setup. Poll until index.decoders are ok before treating Index as ready — do not start decoders. Then archive_verify, then codegen_index_schema. Do not download parquet.", {}, async () => {
-    const client = clientProvider();
-    const status = await client.instance.status();
-    const diagnosis = await client.instance.diagnose();
-    return jsonResponse({ status, diagnosis });
-  });
-}
-
-// src/tools/scaffold.ts
-import {
-  generatePrintSchemaSubgraph,
-  generateSubgraphCode,
-  generateTokenSubgraphFromAbi
-} from "@secondlayer/scaffold";
-import { z as z6 } from "zod";
-async function fetchAbi(clientProvider, contractId) {
-  const contract = await clientProvider().contracts.get(contractId, {
-    includeAbi: true
-  });
-  if (!contract)
-    throw new Error(`Contract not found: ${contractId}`);
-  const abi = contract.abi;
-  if (!abi) {
-    throw new Error(`No ABI available for ${contractId} (abi_status: ${contract.abi_status})`);
-  }
-  return { functions: abi.functions ?? [], abi };
-}
-function registerScaffoldTools(server, clientProvider = getClient) {
-  defineTool(server, "subgraphs_scaffold", "Generate a subgraph from observed print events when available; ABI token transfers or public functions only when the contract has never printed. Review the TypeScript, run subgraphs_test until ok: true with written >= 1, read skipped, then subgraphs_deploy. dryRun is DDL only.", {
-    contractId: z6.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
-    subgraphName: z6.string().optional().describe("Override the subgraph name (defaults to contract name)")
-  }, async ({ contractId, subgraphName }) => {
-    const printSchema = await clientProvider().index.printSchema(contractId);
-    if (printSchema && printSchema.topics.length > 0) {
-      const code = generatePrintSchemaSubgraph({
-        contractId,
-        name: subgraphName,
-        topics: printSchema.topics,
-        sample: printSchema.sample
-      });
-      return { content: [{ type: "text", text: code }] };
-    }
-    const { functions, abi } = await fetchAbi(clientProvider, contractId);
-    const token = generateTokenSubgraphFromAbi({
-      contractId,
-      abi,
-      name: subgraphName
-    });
-    if (token) {
-      return { content: [{ type: "text", text: token }] };
-    }
-    const code = generateSubgraphCode(contractId, functions, subgraphName);
-    return { content: [{ type: "text", text: code }] };
-  });
-}
-
-// src/tools/setup.ts
-import { z as z7 } from "zod";
 
 // src/lib/exec-cli.ts
 import {
   spawn
 } from "node:child_process";
-var ALLOWED = ["setup", "bootstrap", "repair", "verify"];
+var ALLOWED = ["bootstrap", "repair", "verify"];
 var TIMEOUT_MS = {
-  setup: 15 * 60 * 1000,
   bootstrap: 10 * 60 * 1000,
   repair: 10 * 60 * 1000,
   verify: 2 * 60 * 1000
 };
-var VALUE_FLAGS = new Set([
-  "--against",
-  "--from-block",
-  "--to-block",
-  "--network",
-  "--node-mode",
-  "--dir"
-]);
-var BOOL_FLAGS = new Set(["--yes", "--json", "--apply", "--skip-bootstrap"]);
+var VALUE_FLAGS = new Set(["--against", "--from-block", "--to-block"]);
+var BOOL_FLAGS = new Set(["--yes", "--json", "--apply"]);
 var FLAGS_BY_CMD = {
-  setup: new Set([
-    "--yes",
-    "--network",
-    "--node-mode",
-    "--against",
-    "--dir",
-    "--skip-bootstrap"
-  ]),
   bootstrap: new Set([
     "--against",
     "--yes",
@@ -741,12 +555,8 @@ async function execSecondlayer(subcommand, args, deps = {}) {
   }
   assertSafeArgs(subcommand, args);
   const argv = [subcommand, ...args];
-  if (subcommand === "setup") {
-    if (!argv.includes("--yes"))
-      argv.push("--yes");
-  } else if (!argv.includes("--json")) {
+  if (!argv.includes("--json"))
     argv.push("--json");
-  }
   const env = deps.env ?? process.env;
   const bin = env.SECONDLAYER_BIN || "secondlayer";
   const cwd = deps.cwd ?? env.SECONDLAYER_CWD ?? process.cwd();
@@ -794,31 +604,15 @@ timeout after ${timeout}ms`.trim()
   });
 }
 
-// src/tools/setup.ts
+// src/tools/archive-cli.ts
 function cliResponse(result) {
   return jsonResponse(result, result.code !== 0);
 }
-function registerSetupTools(server, exec = execSecondlayer) {
-  defineTool(server, "setup", "Non-interactive self-host onboarding (secondlayer setup --yes). If the index is empty, this or archive_bootstrap fills it. Bootstrap is metered against the official archive. After it returns, poll instance_status until index.decoders are ok, then archive_verify, then codegen_index_schema. Do not download parquet.", {
-    network: z7.enum(["mainnet", "testnet", "devnet"]).describe("Stacks network"),
-    nodeMode: z7.enum(["external", "stacks", "full"]).describe("Node mode: external, stacks, or full"),
-    against: z7.string().optional().describe("Archive manifest URL"),
-    dir: z7.string().optional().describe("Compose project directory"),
-    skipBootstrap: z7.boolean().optional().describe("Sync from genesis instead of restoring an archive")
-  }, async ({ network, nodeMode, against, dir, skipBootstrap }) => {
-    const args = ["--yes", "--network", network, "--node-mode", nodeMode];
-    if (against !== undefined)
-      args.push("--against", against);
-    if (dir !== undefined)
-      args.push("--dir", dir);
-    if (skipBootstrap)
-      args.push("--skip-bootstrap");
-    return cliResponse(await exec("setup", args));
-  });
+function registerArchiveCliTools(server, exec = execSecondlayer) {
   defineTool(server, "archive_bootstrap", "Restore verified history into this instance (secondlayer bootstrap --against … --yes --json). Metered against the official archive; quote happens inside the CLI. After bootstrap, poll instance_status until decoders ok, then archive_verify, then codegen_index_schema. Do not download parquet.", {
-    against: z7.string().describe("Archive manifest URL"),
-    fromBlock: z7.number().int().nonnegative().optional().describe("Restore from this height instead of genesis"),
-    toBlock: z7.number().int().nonnegative().optional().describe("Stop at this height instead of the archive tip")
+    against: z2.string().describe("Archive manifest URL"),
+    fromBlock: z2.number().int().nonnegative().optional().describe("Restore from this height instead of genesis"),
+    toBlock: z2.number().int().nonnegative().optional().describe("Stop at this height instead of the archive tip")
   }, async ({ against, fromBlock, toBlock }) => {
     const args = ["--against", against, "--yes", "--json"];
     if (fromBlock !== undefined)
@@ -828,10 +622,10 @@ function registerSetupTools(server, exec = execSecondlayer) {
     return cliResponse(await exec("bootstrap", args));
   });
   defineTool(server, "archive_repair", "Plan (default) or apply a repair of local chain data against a signed archive. Metered when apply fetches from the official archive. After apply, poll instance_status until decoders ok, then archive_verify. Do not download parquet.", {
-    against: z7.string().describe("Archive manifest URL"),
-    apply: z7.boolean().optional().describe("Write the repair (default plan-only)"),
-    fromBlock: z7.number().int().nonnegative().optional().describe("First height to consider"),
-    toBlock: z7.number().int().nonnegative().optional().describe("Last height to consider")
+    against: z2.string().describe("Archive manifest URL"),
+    apply: z2.boolean().optional().describe("Write the repair (default plan-only)"),
+    fromBlock: z2.number().int().nonnegative().optional().describe("First height to consider"),
+    toBlock: z2.number().int().nonnegative().optional().describe("Last height to consider")
   }, async ({ against, apply, fromBlock, toBlock }) => {
     const args = ["--against", against, "--json"];
     if (apply)
@@ -844,6 +638,197 @@ function registerSetupTools(server, exec = execSecondlayer) {
   });
 }
 
+// src/tools/archive.ts
+import { z as z3 } from "zod";
+var FLOW = ["bootstrap", "repair"];
+function registerArchiveTools(server, clientProvider = getClient, archiveOpsClientProvider = getArchiveOpsClient) {
+  defineTool(server, "archive_verify", "Read-only, free compare of this instance against a signed archive (POST /v1/archive/verify). unanchored means pin a key or check the URL — not that the instance is fine. After bootstrap, poll instance_status until decoders ok, then this, then codegen_index_schema. Do not download parquet.", {
+    against: z3.string().describe("Archive manifest URL"),
+    fromBlock: z3.number().int().nonnegative().optional().describe("First height (inclusive)"),
+    toBlock: z3.number().int().nonnegative().optional().describe("Last height (inclusive)"),
+    target: z3.string().optional().describe("Verify target (default raw)")
+  }, async ({ against, fromBlock, toBlock, target }) => jsonResponse(await clientProvider().archive.verify({
+    against,
+    fromBlock,
+    toBlock,
+    target
+  })));
+  defineTool(server, "archive_latest", "Signed pointer to the official archive tree (hosted). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Use the returned origin as --against for archive_bootstrap. Do not download parquet.", {
+    against: z3.string().optional().describe("Override latest.json URL (default official tree)")
+  }, async ({ against }) => jsonResponse(await archiveOpsClientProvider().archive.latest(against)));
+  defineTool(server, "archive_quote", "Price a hosted archive fetch (metered). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Quote happens here; bootstrap/repair also quote inside the CLI. Do not download parquet.", {
+    paths: z3.array(z3.string()).describe("Partition paths to price"),
+    flow: z3.enum(FLOW).describe("bootstrap or repair")
+  }, async ({ paths, flow }) => jsonResponse(await archiveOpsClientProvider().archive.quote({ paths, flow })));
+  defineTool(server, "credits_balance", "Archive credits balance at api.secondlayer.tools. Needs SECONDLAYER_API_KEY (sk-sl_*); INSTANCE_TOKEN is the instance.", {}, async () => jsonResponse(await archiveOpsClientProvider().archive.credits.balance()));
+}
+
+// src/tools/codegen.ts
+import {
+  generateIndexSchema
+} from "@secondlayer/subgraphs";
+import { z as z4 } from "zod";
+var TARGETS = ["prisma", "kysely", "drizzle", "json-schema"];
+function registerCodegenTools(server) {
+  defineTool(server, "codegen_index_schema", "Generate an ORM schema for the Index tables (blocks, transactions, decoded_events, …) — the same output as `sl codegen index`. Returns the file contents as text; write it wherever your project keeps its schema. Use `tables` to emit only what you read.", {
+    target: z4.enum(TARGETS).optional().describe("Output flavor (default kysely)"),
+    tables: z4.array(z4.string()).optional().describe("Restrict to these Index tables (default: all)"),
+    schemaName: z4.string().optional().describe("Postgres schema to qualify table names with"),
+    datasourceEnv: z4.string().optional().describe("Prisma only: datasource url env var (default DATABASE_URL)")
+  }, ({ target, tables, schemaName, datasourceEnv }) => textResponse(generateIndexSchema(target ?? "kysely", {
+    tables,
+    schemaName,
+    datasourceEnv
+  })));
+}
+
+// src/tools/contracts.ts
+import { z as z5 } from "zod";
+function registerContractTools(server, clientProvider = getClient) {
+  defineTool(server, "contracts_find", 'Discover deployed Stacks contracts conforming to a trait (e.g. "sip-010", "sip-009", "sip-013"). The discovery endpoint for "which contracts implement X". Reads are public.', {
+    trait: z5.string().describe('Required. Trait to match (e.g. "sip-010").'),
+    conformance: z5.enum(["declared", "inferred", "any"]).optional().describe("declared = parsed from source, inferred = ABI shape-match, any = either (default)"),
+    include: z5.literal("abi").optional().describe(`Set to "abi" to include each contract's full ABI`),
+    limit: z5.number().optional().describe("Page size, 1–500 (default 100)"),
+    cursor: z5.string().optional().describe("Opaque cursor from a prior response's next_cursor")
+  }, async (params) => jsonResponse(await clientProvider().contracts.list(params)));
+  defineTool(server, "contracts_get_abi", "Fetch a single deployed contract's ABI from the registry (prod-safe). Returns the contract's metadata + full ABI (functions, maps, variables, fungible/non-fungible tokens). Returns not_found if the contract isn't in the registry. Use it to inspect a contract before subgraphs_scaffold.", {
+    contractId: z5.string().describe("Fully qualified contract id (e.g. SP….amm-pool-v2-01)")
+  }, async ({ contractId }) => {
+    const contract = await clientProvider().contracts.get(contractId, {
+      includeAbi: true
+    });
+    return contract ? jsonResponse(contract) : jsonResponse({
+      error: {
+        type: "not_found",
+        status: 404,
+        message: `Contract not in registry: ${contractId}`
+      }
+    }, true);
+  });
+}
+
+// src/tools/index.ts
+import { DECODED_EVENT_TYPES } from "@secondlayer/shared";
+import { z as z6 } from "zod";
+var INDEX_EVENT_TYPES = DECODED_EVENT_TYPES;
+var rangeFilters = {
+  contractId: z6.string().optional().describe("Filter by contract id"),
+  fromHeight: z6.number().optional().describe("Start block height (inclusive)"),
+  toHeight: z6.number().optional().describe("End block height (inclusive)"),
+  cursor: z6.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
+  limit: z6.number().optional().describe("Max rows for this page")
+};
+var heightFilters = {
+  fromHeight: rangeFilters.fromHeight,
+  toHeight: rangeFilters.toHeight,
+  cursor: rangeFilters.cursor,
+  limit: rangeFilters.limit
+};
+function registerIndexTools(server, clientProvider = getClient) {
+  defineTool(server, "index_ft_transfers", "List decoded SIP-010 fungible-token transfers from Index. Reads are keyless.", {
+    ...rangeFilters,
+    sender: z6.string().optional().describe("Filter by sender principal"),
+    recipient: z6.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z6.string().optional().describe("Filter by asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token")
+  }, async (params) => jsonResponse(await clientProvider().index.ftTransfers.list(params)));
+  defineTool(server, "index_nft_transfers", "List decoded SIP-009 non-fungible-token transfers from Index. Reads are keyless.", {
+    ...rangeFilters,
+    sender: z6.string().optional().describe("Filter by sender principal"),
+    recipient: z6.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z6.string().optional().describe("Filter by asset identifier (contract::asset)")
+  }, async (params) => jsonResponse(await clientProvider().index.nftTransfers.list(params)));
+  defineTool(server, "index_events", "List decoded chain events from the Index by event type. Use this for event types without a dedicated tool (stx_*, ft_mint/burn, nft_mint/burn, print), and for trait-scoped queries: set `trait` (e.g. sip-010) to match all contracts conforming to a standard — pair with contracts_find to discover traits. For ft/nft transfers without a trait prefer index_ft_transfers / index_nft_transfers.", {
+    eventType: z6.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
+    ...rangeFilters,
+    sender: z6.string().optional().describe("Filter by sender principal"),
+    recipient: z6.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z6.string().optional().describe("Filter by asset identifier where applicable"),
+    trait: z6.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only."),
+    txContext: z6.boolean().optional().describe("Join the submitting transaction into each event (tx_sender, tx_type, tx_status, tx_contract_id, tx_function_name). For print events it's the only source of the submitting sender.")
+  }, async (params) => jsonResponse(await clientProvider().index.events.list(params)));
+  defineTool(server, "index_contract_calls", "List decoded contract calls from the Index (function name, args, result). Set `trait` (e.g. sip-010) to match calls to all contracts conforming to a standard. Note: contract-call cursors are a SEPARATE keyspace from event cursors — they are not interchangeable.", {
+    ...rangeFilters,
+    functionName: z6.string().optional().describe("Filter by called function name"),
+    sender: z6.string().optional().describe("Filter by caller principal"),
+    trait: z6.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
+  }, async (params) => jsonResponse(await clientProvider().index.contractCalls.list(params)));
+  defineTool(server, "index_blocks", "List decoded blocks from Index. Reads are keyless.", { ...heightFilters }, async (params) => jsonResponse(await clientProvider().index.blocks.list(params)));
+  defineTool(server, "index_transactions", "List decoded transactions from Index. Filter by type, sender, or contract. Reads are keyless.", {
+    ...rangeFilters,
+    type: z6.string().optional().describe("Filter by transaction type"),
+    sender: z6.string().optional().describe("Filter by sender principal")
+  }, async (params) => jsonResponse(await clientProvider().index.transactions.list(params)));
+  defineTool(server, "index_print_schema", "Empirical per-topic print payload schemas for a contract, inferred from sampled on-chain events: each topic's fields with observed Clarity types, decoded TS types, subgraph column types, and presence rates. Use before writing print_event subgraph handlers to learn what's on e.data. Anonymous read.", {
+    contractId: z6.string().describe("Contract id (SP….name) whose print events to profile")
+  }, async (params) => jsonResponse(await clientProvider().index.printSchema(params.contractId)));
+  defineTool(server, "index_discover", "Discover the Index vocabulary: every event type and its columns, allowed/equality filters, and required-non-null fields (and which types accept `trait`). Read this before building Index queries instead of guessing filters. Anonymous read.", {}, async () => jsonResponse(await clientProvider().index.discover()));
+  defineTool(server, "batch_query", "Run up to 10 public /v1 reads in one round trip (POST /v1/batch). Each item keeps its own auth/quota/pay-per-call semantics; results return in order with per-item status. Paths must start with /v1/index, /v1/subgraphs, /v1/streams, or /v1/contracts.", {
+    requests: z6.array(z6.object({
+      path: z6.string().describe("Public /v1 read path"),
+      params: z6.record(z6.string(), z6.string()).optional()
+    })).min(1).max(10).describe("Read descriptors, executed concurrently")
+  }, async (params) => jsonResponse(await clientProvider().batch(params.requests)));
+}
+
+// src/tools/instance.ts
+function registerInstanceTools(server, clientProvider = getClient) {
+  defineTool(server, "instance_status", "Decoder health and empty-index diagnosis from GET /public/status. If state is empty-index, next tool is archive_bootstrap. Poll until index.decoders are ok before treating Index as ready — do not start decoders. Then archive_verify, then codegen_index_schema. Do not download parquet.", {}, async () => {
+    const client = clientProvider();
+    const status = await client.instance.status();
+    const diagnosis = await client.instance.diagnose();
+    return jsonResponse({ status, diagnosis });
+  });
+}
+
+// src/tools/scaffold.ts
+import {
+  generatePrintSchemaSubgraph,
+  generateSubgraphCode,
+  generateTokenSubgraphFromAbi
+} from "@secondlayer/scaffold";
+import { z as z7 } from "zod";
+async function fetchAbi(clientProvider, contractId) {
+  const contract = await clientProvider().contracts.get(contractId, {
+    includeAbi: true
+  });
+  if (!contract)
+    throw new Error(`Contract not found: ${contractId}`);
+  const abi = contract.abi;
+  if (!abi) {
+    throw new Error(`No ABI available for ${contractId} (abi_status: ${contract.abi_status})`);
+  }
+  return { functions: abi.functions ?? [], abi };
+}
+function registerScaffoldTools(server, clientProvider = getClient) {
+  defineTool(server, "subgraphs_scaffold", "Generate a subgraph from observed print events when available; ABI token transfers or public functions only when the contract has never printed. Review the TypeScript, run subgraphs_test until ok: true with written >= 1, read skipped, then subgraphs_deploy. dryRun is DDL only.", {
+    contractId: z7.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
+    subgraphName: z7.string().optional().describe("Override the subgraph name (defaults to contract name)")
+  }, async ({ contractId, subgraphName }) => {
+    const printSchema = await clientProvider().index.printSchema(contractId);
+    if (printSchema && printSchema.topics.length > 0) {
+      const code = generatePrintSchemaSubgraph({
+        contractId,
+        name: subgraphName,
+        topics: printSchema.topics,
+        sample: printSchema.sample
+      });
+      return { content: [{ type: "text", text: code }] };
+    }
+    const { functions, abi } = await fetchAbi(clientProvider, contractId);
+    const token = generateTokenSubgraphFromAbi({
+      contractId,
+      abi,
+      name: subgraphName
+    });
+    if (token) {
+      return { content: [{ type: "text", text: token }] };
+    }
+    const code = generateSubgraphCode(contractId, functions, subgraphName);
+    return { content: [{ type: "text", text: code }] };
+  });
+}
+
 // src/tools/streams.ts
 function registerStreamsTools(server, clientProvider = getClient) {
   defineTool(server, "streams_tip", "Current canonical chain tip as Streams sees it: block height/hash, burn height, finalized_height, lag_seconds, and the oldest seekable height/cursor for this key's retention window. Call it before a cursor walk to know where the stream ends, and after an ingest to check lag.", {}, async () => jsonResponse(await clientProvider().streams.tip()));
@@ -1182,35 +1167,103 @@ function registerWebhookTools(server, clientProvider = getClient) {
 }
 
 // src/tool-groups.ts
+var ENV_TOOL_DEPS = {
+  clientProvider: getClient,
+  archiveOpsClientProvider: getArchiveOpsClient,
+  apiRequest
+};
 var TOOL_GROUPS = [
-  { group: "scaffold", register: registerScaffoldTools },
-  { group: "subgraphs", register: registerSubgraphTools },
-  { group: "webhooks", register: registerWebhookTools },
-  { group: "index", register: registerIndexTools },
-  { group: "streams", register: registerStreamsTools },
-  { group: "contracts", register: registerContractTools },
-  { group: "codegen", register: registerCodegenTools },
-  { group: "instance", register: registerInstanceTools },
-  { group: "archive", register: registerArchiveTools },
-  { group: "setup", register: registerSetupTools },
-  { group: "account", register: registerAccountTools, hostedOnly: true }
+  {
+    group: "scaffold",
+    register: (s, d = ENV_TOOL_DEPS) => registerScaffoldTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "subgraphs",
+    register: (s, d = ENV_TOOL_DEPS) => registerSubgraphTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "webhooks",
+    register: (s, d = ENV_TOOL_DEPS) => registerWebhookTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "index",
+    register: (s, d = ENV_TOOL_DEPS) => registerIndexTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "streams",
+    register: (s, d = ENV_TOOL_DEPS) => registerStreamsTools(s, d.clientProvider),
+    hosted: true
+  },
+  {
+    group: "contracts",
+    register: (s, d = ENV_TOOL_DEPS) => registerContractTools(s, d.clientProvider),
+    hosted: true
+  },
+  { group: "codegen", register: (s) => registerCodegenTools(s), hosted: false },
+  {
+    group: "instance",
+    register: (s, d = ENV_TOOL_DEPS) => registerInstanceTools(s, d.clientProvider),
+    hosted: false
+  },
+  {
+    group: "archive",
+    register: (s, d = ENV_TOOL_DEPS) => registerArchiveTools(s, d.clientProvider, d.archiveOpsClientProvider),
+    hosted: false
+  },
+  {
+    group: "archive",
+    register: (s) => registerArchiveCliTools(s),
+    hosted: false
+  },
+  {
+    group: "account",
+    register: (s, d = ENV_TOOL_DEPS) => registerAccountTools(s, d.apiRequest),
+    hostedOnly: true,
+    hosted: ["account_whoami"]
+  }
 ];
+function isHostedTool(group, tool) {
+  return group.hosted === true || Array.isArray(group.hosted) && group.hosted.includes(tool);
+}
 
 // src/server.ts
 var __dirname2 = dirname(fileURLToPath(import.meta.url));
 var pkg = JSON.parse(readFileSync(join2(__dirname2, "../package.json"), "utf-8"));
-function createServer() {
+function createServer(options = {}) {
   const server = new McpServer({
     name: "secondlayer",
     version: pkg.version
   });
-  const hosted = isHostedArchiveUrl(resolveBaseUrl3());
+  const deps = {
+    clientProvider: options.clientProvider ?? ENV_TOOL_DEPS.clientProvider,
+    archiveOpsClientProvider: options.archiveOpsClientProvider ?? ENV_TOOL_DEPS.archiveOpsClientProvider,
+    apiRequest: options.apiRequest ?? ENV_TOOL_DEPS.apiRequest
+  };
+  if (options.hosted) {
+    for (const group of TOOL_GROUPS) {
+      if (group.hosted === false)
+        continue;
+      restrictTools(server, (name) => isHostedTool(group, name));
+      group.register(server, deps);
+    }
+    restrictTools(server, () => false);
+    registerResources(server, {
+      clientProvider: deps.clientProvider,
+      hosted: true
+    });
+    return server;
+  }
+  const hostedApi = isHostedArchiveUrl(resolveBaseUrl3());
   for (const { register, hostedOnly } of TOOL_GROUPS) {
-    if (hostedOnly && !hosted)
+    if (hostedOnly && !hostedApi)
       continue;
-    register(server);
+    register(server, deps);
   }
-  registerResources(server);
+  registerResources(server, { clientProvider: deps.clientProvider });
   return server;
 }
 
@@ -1300,5 +1353,5 @@ httpServer.listen(port, () => {
     console.error("Warning: SECONDLAYER_MCP_SECRET not set, authentication disabled");
 });
 
-//# debugId=425CE2826B067D4964756E2164756E21
+//# debugId=64D4C1ABC06CBDC864756E2164756E21
 //# sourceMappingURL=bin-http.js.map