@secondlayer/mcp 11.6.0 → 11.6.2

package/dist/bin-http.js

@@ -6,6 +6,53 @@ import {
 } from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
+// src/lib/http-sessions.ts
+var SESSION_IDLE_TTL_MS = 30 * 60 * 1000;
+var SESSION_SWEEP_INTERVAL_MS = 60 * 1000;
+
+class SessionRegistry {
+  ttlMs;
+  now;
+  entries = new Map;
+  constructor(ttlMs = SESSION_IDLE_TTL_MS, now = Date.now) {
+    this.ttlMs = ttlMs;
+    this.now = now;
+  }
+  add(id, transport) {
+    this.entries.set(id, { transport, lastSeen: this.now() });
+  }
+  get(id) {
+    if (!id)
+      return;
+    const entry = this.entries.get(id);
+    if (!entry)
+      return;
+    entry.lastSeen = this.now();
+    return entry.transport;
+  }
+  delete(id) {
+    this.entries.delete(id);
+  }
+  get size() {
+    return this.entries.size;
+  }
+  async sweep() {
+    const cutoff = this.now() - this.ttlMs;
+    const expired = [...this.entries].filter(([, entry]) => entry.lastSeen <= cutoff);
+    for (const [id] of expired)
+      this.entries.delete(id);
+    await Promise.allSettled(expired.map(([, entry]) => entry.transport.close()));
+    return expired.map(([id]) => id);
+  }
+  startSweeping(intervalMs = SESSION_SWEEP_INTERVAL_MS) {
+    const timer = setInterval(() => {
+      this.sweep();
+    }, intervalMs);
+    timer.unref?.();
+    return () => clearInterval(timer);
+  }
+}
+
 // src/server.ts
 import { readFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
@@ -107,11 +154,11 @@ import {
   isHostedApiUrl,
   resolveAccountKey,
   resolveApiKey,
-  resolveBaseUrl
+  resolveBaseUrl,
+  resolveIdentity
 } from "@secondlayer/sdk";
 var instance = null;
 var HOSTED_KEY_HINT = "set SECONDLAYER_API_KEY (sk-sl_*) for credits; INSTANCE_TOKEN is the instance";
-var DEFAULT_ARCHIVE_OPS_URL = "https://api.secondlayer.tools";
 function readApiKey() {
   return resolveApiKey(undefined, resolveBaseUrl());
 }
@@ -129,19 +176,15 @@ function getClient() {
   }
   return instance;
 }
-function readArchiveApiKey() {
-  return resolveAccountKey();
-}
 function getArchiveOpsClient() {
-  const accountKey = readArchiveApiKey();
-  if (!accountKey) {
+  const { token, url } = resolveIdentity("account");
+  if (!token) {
     throw new Error(HOSTED_KEY_HINT);
   }
-  const archiveOpsUrl = process.env.SL_CREDITS_API_URL || process.env.ARCHIVE_OPS_API_URL || DEFAULT_ARCHIVE_OPS_URL;
   return new SecondLayer({
-    accountKey,
+    accountKey: token,
     origin: "mcp",
-    archiveOpsUrl
+    archiveOpsUrl: url
   });
 }
 function keyHint(baseUrl = resolveBaseUrl()) {
@@ -876,7 +919,16 @@ import { DECODED_EVENT_TYPES as DECODED_EVENT_TYPES2 } from "@secondlayer/shared
 import {
   runSubgraphTest
 } from "@secondlayer/subgraphs/testing";
+import { z as z10 } from "zod";
+
+// src/lib/ids.ts
 import { z as z9 } from "zod";
+var uuidSchema = z9.string().uuid();
+var webhookIdSchema = uuidSchema.describe("Webhook id");
+var subgraphNameSchema = z9.string().min(1).max(63).regex(/^[a-z0-9-]+$/, "lowercase alphanumeric + hyphens only").describe("Subgraph name");
+var tableNameSchema = z9.string().min(1).max(63).regex(/^[a-z_][a-z0-9_]*$/i, "letters, digits and underscores only").describe("Table name");
+
+// src/tools/subgraphs.ts
 function eventTypeFor(filter) {
   if (filter.type === "contract_deploy")
     return null;
@@ -902,13 +954,13 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     const { data } = await clientProvider().subgraphs.list();
     return jsonResponse(data.map(formatSubgraphSummary));
   });
-  defineTool(server, "subgraphs_status", "Get full details of a subgraph including schema, health (incl. health.emptyMapping when processed events wrote 0 rows), and table columns.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_status", "Get full details of a subgraph including schema, health (incl. health.emptyMapping when processed events wrote 0 rows), and table columns.", { name: subgraphNameSchema }, async ({ name }) => {
     const detail = await clientProvider().subgraphs.status(name);
     return jsonResponse(detail);
   });
   defineTool(server, "subgraphs_spec", "Fetch a subgraph's self-describing spec — the tables, columns, filters, and read URLs a consumer needs, without guessing. `agent` (default) returns the compact JSON schema built for tool use, `openapi` the OpenAPI document for the subgraph's read routes, `markdown` human-readable docs. Read it before writing queries against an unfamiliar subgraph.", {
-    name: z9.string().describe("Subgraph name"),
-    format: z9.enum(["agent", "openapi", "markdown"]).optional().describe("agent = JSON schema for tool use (default), openapi = OpenAPI JSON, markdown = docs.md")
+    name: subgraphNameSchema,
+    format: z10.enum(["agent", "openapi", "markdown"]).optional().describe("agent = JSON schema for tool use (default), openapi = OpenAPI JSON, markdown = docs.md")
   }, async ({ name, format }) => {
     const client = clientProvider();
     if (format === "openapi")
@@ -918,15 +970,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(await client.subgraphs.schema(name));
   });
   defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows), reading the open /v1 surface — { rows, next_cursor, tip } envelope, cursor-paginated (no offset). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. Every page with rows returns next_cursor (null only when empty): pass it back as `cursor` to read the next page. To TAIL new rows (no streaming over MCP), poll with cursor = next_cursor ?? the cursor you sent. Fetch one row by id with {"_id": "<id>"}. The same rows are readable over HTTP at GET /v1/subgraphs/<name>/<table>; hand that URL to third parties.', {
-    name: z9.string().describe("Subgraph name"),
-    table: z9.string().describe("Table name"),
-    filters: z9.record(z9.string(), z9.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
-    sort: z9.string().optional().describe("Column to sort by"),
-    order: z9.enum(["asc", "desc"]).optional().describe("Sort order"),
-    limit: z9.number().max(200).optional().describe("Max rows (default 50, max 200)"),
-    cursor: z9.string().optional().describe("Resume from a previous response's nextCursor"),
-    fields: z9.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
-    count: z9.boolean().optional().describe("If true, return row count instead of rows")
+    name: subgraphNameSchema,
+    table: tableNameSchema,
+    filters: z10.record(z10.string(), z10.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
+    sort: z10.string().optional().describe("Column to sort by"),
+    order: z10.enum(["asc", "desc"]).optional().describe("Sort order"),
+    limit: z10.number().max(200).optional().describe("Max rows (default 50, max 200)"),
+    cursor: z10.string().optional().describe("Resume from a previous response's nextCursor"),
+    fields: z10.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
+    count: z10.boolean().optional().describe("If true, return row count instead of rows")
   }, async ({
     name,
     table,
@@ -956,15 +1008,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse({ ...capped, nextCursor: next_cursor, tip });
   });
   defineTool(server, "subgraphs_reindex", "Reindex a subgraph: drops and rebuilds the whole subgraph from its start block to chain tip. Takes no block range — use subgraphs_backfill to process a specific range. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress to completion.", {
-    name: z9.string().describe("Subgraph name")
+    name: subgraphNameSchema
   }, async ({ name }) => {
     const result = await clientProvider().subgraphs.reindex(name);
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_backfill", "Backfill a subgraph over a block range. Non-destructive forward fill (does not drop existing data) — unlike subgraphs_reindex, and the only data-fill path for BYO subgraphs (reindex is blocked there). Both blocks required. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress.", {
-    name: z9.string().describe("Subgraph name"),
-    fromBlock: z9.number().int().nonnegative().describe("Start block (inclusive)"),
-    toBlock: z9.number().int().nonnegative().describe("End block (inclusive)")
+    name: subgraphNameSchema,
+    fromBlock: z10.number().int().nonnegative().describe("Start block (inclusive)"),
+    toBlock: z10.number().int().nonnegative().describe("End block (inclusive)")
   }, async ({ name, fromBlock, toBlock }) => {
     const result = await clientProvider().subgraphs.backfill(name, {
       fromBlock,
@@ -972,15 +1024,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     });
     return jsonResponse(result);
   });
-  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; check subgraphs_status (health) or the REST operations endpoint to confirm it reaches a terminal state.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; check subgraphs_status (health) or the REST operations endpoint to confirm it reaches a terminal state.", { name: subgraphNameSchema }, async ({ name }) => {
     const result = await clientProvider().subgraphs.stop(name);
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_gaps", "List indexing gaps (missing block ranges) for a subgraph. Each gap reports start/end/size, reason, and detected/resolved timestamps. Feed an unresolved gap's range into subgraphs_backfill to fill it. Defaults to unresolved gaps.", {
-    name: z9.string().describe("Subgraph name"),
-    limit: z9.number().int().positive().optional().describe("Max gaps to return"),
-    offset: z9.number().int().nonnegative().optional().describe("Pagination offset"),
-    resolved: z9.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
+    name: subgraphNameSchema,
+    limit: z10.number().int().positive().optional().describe("Max gaps to return"),
+    offset: z10.number().int().nonnegative().optional().describe("Pagination offset"),
+    resolved: z10.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
   }, async ({ name, limit, offset, resolved }) => {
     const result = await clientProvider().subgraphs.gaps(name, {
       limit,
@@ -990,20 +1042,20 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_operations", "Operation history for a subgraph (deploy/reindex/backfill/stop), newest first — status, block range, progress, and error. THIS IS THE VERIFY CALL: after subgraphs_deploy, subgraphs_reindex, subgraphs_backfill, or subgraphs_stop, poll it with the returned operationId until `status` is terminal (completed/failed/cancelled) before reporting success. Omit operationId for the recent history.", {
-    name: z9.string().describe("Subgraph name"),
-    operationId: z9.string().optional().describe("Fetch one operation by id (the operationId returned by reindex/backfill/stop); omit for recent history")
+    name: subgraphNameSchema,
+    operationId: z10.string().optional().describe("Fetch one operation by id (the operationId returned by reindex/backfill/stop); omit for recent history")
   }, async ({ name, operationId }) => {
     const client = clientProvider();
     return jsonResponse(operationId ? await client.subgraphs.getOperation(name, operationId) : await client.subgraphs.operations(name));
   });
-  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: subgraphNameSchema }, async ({ name }) => {
     const result = await clientProvider().subgraphs.delete(name);
     return textResponse(result.message);
   });
   defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. dryRun validates schema/DDL only and does not run handlers — call subgraphs_test first and deploy only when it returns ok: true with written >= 1. Call subgraphs_reindex separately if you need a forced reindex.", {
-    code: z9.string().describe("TypeScript source code containing a defineSubgraph() call"),
-    startBlock: z9.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
-    dryRun: z9.boolean().optional().describe("Validate schema/DDL only — does not run handlers. Use subgraphs_test to prove a mapping writes rows.")
+    code: z10.string().describe("TypeScript source code containing a defineSubgraph() call"),
+    startBlock: z10.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
+    dryRun: z10.boolean().optional().describe("Validate schema/DDL only — does not run handlers. Use subgraphs_test to prove a mapping writes rows.")
   }, async ({ code, startBlock, dryRun }) => {
     const bundled = await bundleSubgraphCode(code);
     const result = await clientProvider().subgraphs.deploy({
@@ -1019,10 +1071,10 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_test", "Prove a subgraph mapping writes rows against Index data before deploy. Pass full defineSubgraph() source plus a height range. Returns ok/written/tables; EMPTY_MAPPING means events matched but 0 rows were written — read hint for observed event.data keys and do not invent fields. subgraphs_deploy dryRun is DDL only; do not deploy until ok: true with written >= 1.", {
-    code: z9.string().describe("TypeScript source containing a defineSubgraph() call"),
-    fromHeight: z9.number().int().nonnegative().describe("Start block height (inclusive)"),
-    toHeight: z9.number().int().nonnegative().optional().describe("End block height (inclusive); default fromHeight+100"),
-    limit: z9.number().int().positive().max(200).optional().describe("Max Index rows per source (default 50, max 200)")
+    code: z10.string().describe("TypeScript source containing a defineSubgraph() call"),
+    fromHeight: z10.number().int().nonnegative().describe("Start block height (inclusive)"),
+    toHeight: z10.number().int().nonnegative().optional().describe("End block height (inclusive); default fromHeight+100"),
+    limit: z10.number().int().positive().max(200).optional().describe("Max Index rows per source (default 50, max 200)")
   }, async ({ code, fromHeight, toHeight, limit }) => {
     const bundled = await bundleSubgraphCode(code);
     const def = await loadBundledDefinition(bundled.handlerCode);
@@ -1103,36 +1155,36 @@ function registerSubgraphTools(server, clientProvider = getClient) {
 
 // src/tools/webhooks.ts
 import { CHAIN_TRIGGER_TYPES } from "@secondlayer/shared";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerWebhookTools(server, clientProvider = getClient) {
   defineTool(server, "webhooks_list", "List all webhooks for the current account. Returns summary fields (no secrets).", {}, async () => {
     const { data } = await clientProvider().webhooks.list();
     return jsonResponse(data);
   });
-  defineTool(server, "webhooks_get", "Get full detail for a webhook (triggers, auth, retry config, circuit state).", { id: z10.string().describe("Webhook id") }, async ({ id }) => {
+  defineTool(server, "webhooks_get", "Get full detail for a webhook (triggers, auth, retry config, circuit state).", { id: webhookIdSchema }, async ({ id }) => {
     const detail = await clientProvider().webhooks.get(id);
     return jsonResponse(detail);
   });
   defineTool(server, "webhooks_create", "Create a webhook that fires on raw chain events (set triggers). Returns `signingSecret` ONCE — forward it to the user so they can wire it into their receiver.", {
-    name: z10.string().describe("Human-readable name, unique per account"),
-    triggers: z10.array(z10.object({
-      type: z10.enum(CHAIN_TRIGGER_TYPES),
-      contractId: z10.string().optional(),
-      functionName: z10.string().optional(),
-      caller: z10.string().optional(),
-      sender: z10.string().optional(),
-      recipient: z10.string().optional(),
-      assetIdentifier: z10.string().optional(),
-      deployer: z10.string().optional(),
-      contractName: z10.string().optional(),
-      topic: z10.string().optional(),
-      lockedAddress: z10.string().optional(),
-      trait: z10.string().optional(),
-      minAmount: z10.union([z10.string(), z10.number()]).optional(),
-      maxAmount: z10.union([z10.string(), z10.number()]).optional()
+    name: z11.string().describe("Human-readable name, unique per account"),
+    triggers: z11.array(z11.object({
+      type: z11.enum(CHAIN_TRIGGER_TYPES),
+      contractId: z11.string().optional(),
+      functionName: z11.string().optional(),
+      caller: z11.string().optional(),
+      sender: z11.string().optional(),
+      recipient: z11.string().optional(),
+      assetIdentifier: z11.string().optional(),
+      deployer: z11.string().optional(),
+      contractName: z11.string().optional(),
+      topic: z11.string().optional(),
+      lockedAddress: z11.string().optional(),
+      trait: z11.string().optional(),
+      minAmount: z11.union([z11.string(), z11.number()]).optional(),
+      maxAmount: z11.union([z11.string(), z11.number()]).optional()
     })).describe("Chain triggers. Each targets a raw chain event/tx; string fields accept `*` wildcards, `trait` scopes to a SIP/trait. Per-type accepted fields: see the secondlayer://chain-triggers resource. Forward-looking: starts at chain tip, no backfill."),
-    url: z10.string().describe("Webhook URL"),
-    format: z10.enum([
+    url: z11.string().describe("Webhook URL"),
+    format: z11.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -1140,17 +1192,17 @@ function registerWebhookTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional().describe("Wire format (default standard-webhooks)"),
-    authConfig: z10.record(z10.string(), z10.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
+    authConfig: z11.record(z11.string(), z11.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
   }, async (input) => {
     const res = await clientProvider().webhooks.create(input);
     return jsonResponse(res);
   });
   defineTool(server, "webhooks_update", "Patch a webhook (name, url, authConfig, format, retry, timeout, concurrency).", {
-    id: z10.string(),
-    name: z10.string().optional().describe("Rename the webhook"),
-    url: z10.string().optional(),
-    authConfig: z10.record(z10.string(), z10.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
-    format: z10.enum([
+    id: webhookIdSchema,
+    name: z11.string().optional().describe("Rename the webhook"),
+    url: z11.string().optional(),
+    authConfig: z11.record(z11.string(), z11.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
+    format: z11.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -1158,35 +1210,35 @@ function registerWebhookTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional(),
-    maxRetries: z10.number().int().min(0).optional(),
-    timeoutMs: z10.number().int().min(100).optional(),
-    concurrency: z10.number().int().min(1).optional()
+    maxRetries: z11.number().int().min(0).optional(),
+    timeoutMs: z11.number().int().min(100).optional(),
+    concurrency: z11.number().int().min(1).optional()
   }, async ({ id, ...patch }) => {
     const res = await clientProvider().webhooks.update(id, patch);
     return jsonResponse(res);
   });
-  defineTool(server, "webhooks_delete", "Delete a webhook. Pending outbox rows are cascade-deleted.", { id: z10.string() }, async ({ id }) => {
+  defineTool(server, "webhooks_delete", "Delete a webhook. Pending outbox rows are cascade-deleted.", { id: webhookIdSchema }, async ({ id }) => {
     const res = await clientProvider().webhooks.delete(id);
     return jsonResponse(res);
   });
-  defineTool(server, "webhooks_test", "Send a one-off test webhook to a webhook's URL (built for its format, SSRF-guarded). Logged as a delivery row. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: z10.string().describe("Webhook id") }, async ({ id }) => {
+  defineTool(server, "webhooks_test", "Send a one-off test webhook to a webhook's URL (built for its format, SSRF-guarded). Logged as a delivery row. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: webhookIdSchema }, async ({ id }) => {
     const res = await clientProvider().webhooks.test(id);
     return jsonResponse(res);
   });
-  defineTool(server, "webhooks_pause", "Pause a webhook: stops delivery attempts and stops queueing new ones. Nothing is deleted — resume picks the webhook back up from the tip. Verify with webhooks_get (status).", { id: z10.string().describe("Webhook id") }, async ({ id }) => jsonResponse(await clientProvider().webhooks.pause(id)));
-  defineTool(server, "webhooks_resume", "Resume a paused webhook (also clears a tripped circuit breaker). Deliveries restart from the current tip — use webhooks_replay for the blocks missed while paused. Verify with webhooks_get (status).", { id: z10.string().describe("Webhook id") }, async ({ id }) => jsonResponse(await clientProvider().webhooks.resume(id)));
-  defineTool(server, "webhooks_rotate_secret", "Rotate a webhook's signing secret. Returns the NEW `signingSecret` ONCE — forward it to the user; deliveries signed with the old secret stop verifying as soon as this returns, so the receiver must be updated.", { id: z10.string().describe("Webhook id") }, async ({ id }) => jsonResponse(await clientProvider().webhooks.rotateSecret(id)));
-  defineTool(server, "webhooks_deliveries", "List recent delivery attempts for a webhook — status code, attempt count, error, duration, timestamps. THIS IS THE VERIFY CALL: after webhooks_create, webhooks_test, or webhooks_replay, read it to confirm the webhook actually landed (and to see the receiver's response when it didn't) instead of trusting the enqueue result.", { id: z10.string().describe("Webhook id") }, async ({ id }) => jsonResponse(await clientProvider().webhooks.deliveries(id)));
-  defineTool(server, "webhooks_dead", "List a webhook's dead-letter queue — deliveries that exhausted their retries, with the outbox id, payload, and last error. Diagnose the receiver first (webhooks_get for the URL/auth, webhooks_test for a live probe), then requeue rows with webhooks_requeue.", { id: z10.string().describe("Webhook id") }, async ({ id }) => jsonResponse(await clientProvider().webhooks.dead(id)));
+  defineTool(server, "webhooks_pause", "Pause a webhook: stops delivery attempts and stops queueing new ones. Nothing is deleted — resume picks the webhook back up from the tip. Verify with webhooks_get (status).", { id: webhookIdSchema }, async ({ id }) => jsonResponse(await clientProvider().webhooks.pause(id)));
+  defineTool(server, "webhooks_resume", "Resume a paused webhook (also clears a tripped circuit breaker). Deliveries restart from the current tip — use webhooks_replay for the blocks missed while paused. Verify with webhooks_get (status).", { id: webhookIdSchema }, async ({ id }) => jsonResponse(await clientProvider().webhooks.resume(id)));
+  defineTool(server, "webhooks_rotate_secret", "Rotate a webhook's signing secret. Returns the NEW `signingSecret` ONCE — forward it to the user; deliveries signed with the old secret stop verifying as soon as this returns, so the receiver must be updated.", { id: webhookIdSchema }, async ({ id }) => jsonResponse(await clientProvider().webhooks.rotateSecret(id)));
+  defineTool(server, "webhooks_deliveries", "List recent delivery attempts for a webhook — status code, attempt count, error, duration, timestamps. THIS IS THE VERIFY CALL: after webhooks_create, webhooks_test, or webhooks_replay, read it to confirm the webhook actually landed (and to see the receiver's response when it didn't) instead of trusting the enqueue result.", { id: webhookIdSchema }, async ({ id }) => jsonResponse(await clientProvider().webhooks.deliveries(id)));
+  defineTool(server, "webhooks_dead", "List a webhook's dead-letter queue — deliveries that exhausted their retries, with the outbox id, payload, and last error. Diagnose the receiver first (webhooks_get for the URL/auth, webhooks_test for a live probe), then requeue rows with webhooks_requeue.", { id: webhookIdSchema }, async ({ id }) => jsonResponse(await clientProvider().webhooks.dead(id)));
   defineTool(server, "webhooks_requeue", "Requeue ONE dead-lettered delivery for another attempt, by its outbox id from webhooks_dead. Fix the receiver first — a requeue against a still-broken endpoint just dies again. Verify with webhooks_deliveries.", {
-    id: z10.string().describe("Webhook id"),
-    outboxId: z10.string().describe("Outbox id of the dead delivery (from webhooks_dead)")
+    id: webhookIdSchema,
+    outboxId: uuidSchema.describe("Outbox id of the dead delivery (from webhooks_dead)")
   }, async ({ id, outboxId }) => jsonResponse(await clientProvider().webhooks.requeue(id, outboxId)));
   defineTool(server, "webhooks_replay", "Replay a block range for a webhook. Replays run at 10% of batch capacity — use sparingly. Pass `force` (a short idempotency suffix) to re-run a range that was already replayed.", {
-    id: z10.string(),
-    fromBlock: z10.number().int().nonnegative(),
-    toBlock: z10.number().int().nonnegative(),
-    force: z10.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
+    id: webhookIdSchema,
+    fromBlock: z11.number().int().nonnegative(),
+    toBlock: z11.number().int().nonnegative(),
+    force: z11.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
   }, async ({ id, fromBlock, toBlock, force }) => {
     const res = await clientProvider().webhooks.replay(id, {
       fromBlock,
@@ -1314,7 +1366,8 @@ function createServer(options = {}) {
 // src/bin-http.ts
 var port = Number.parseInt(process.env.SECONDLAYER_MCP_PORT || "3100");
 var secret = process.env.SECONDLAYER_MCP_SECRET;
-var sessions = new Map;
+var sessions = new SessionRegistry;
+sessions.startSweeping();
 function authenticate(req) {
   if (!secret)
     return true;
@@ -1355,32 +1408,45 @@ var httpServer = createHttpServer(async (req, res) => {
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: () => crypto.randomUUID()
       });
+      transport.onclose = () => {
+        if (transport.sessionId)
+          sessions.delete(transport.sessionId);
+      };
       const server = createServer();
-      await server.connect(transport);
-      await transport.handleRequest(req, res, body);
+      try {
+        await server.connect(transport);
+        await transport.handleRequest(req, res, body);
+      } catch (err) {
+        await transport.close().catch(() => {});
+        if (!res.headersSent) {
+          res.writeHead(500).end(JSON.stringify({ error: "Session initialization failed" }));
+        }
+        console.error("MCP session init failed:", err);
+        return;
+      }
       if (transport.sessionId) {
-        sessions.set(transport.sessionId, transport);
-        transport.onclose = () => {
-          if (transport.sessionId)
-            sessions.delete(transport.sessionId);
-        };
+        sessions.add(transport.sessionId, transport);
+      } else {
+        await transport.close().catch(() => {});
       }
       return;
     }
-    if (!sessionId || !sessions.has(sessionId)) {
+    const existing = sessions.get(sessionId);
+    if (!existing) {
       res.writeHead(400).end(JSON.stringify({ error: "Invalid or missing session ID" }));
       return;
     }
-    await sessions.get(sessionId)?.handleRequest(req, res, body);
+    await existing.handleRequest(req, res, body);
   } else if (req.method === "GET") {
-    if (!sessionId || !sessions.has(sessionId)) {
+    const existing = sessions.get(sessionId);
+    if (!existing) {
       res.writeHead(400).end(JSON.stringify({ error: "Invalid or missing session ID" }));
       return;
     }
-    await sessions.get(sessionId)?.handleRequest(req, res);
+    await existing.handleRequest(req, res);
   } else if (req.method === "DELETE") {
-    if (sessionId && sessions.has(sessionId)) {
-      const transport = sessions.get(sessionId);
+    const transport = sessions.get(sessionId);
+    if (sessionId && transport) {
       await transport.handleRequest(req, res);
       await transport.close();
       sessions.delete(sessionId);
@@ -1397,5 +1463,5 @@ httpServer.listen(port, () => {
     console.error("Warning: SECONDLAYER_MCP_SECRET not set, authentication disabled");
 });
 
-//# debugId=653BD5FE7E7CAFBD64756E2164756E21
+//# debugId=A0F3507D56CDA04E64756E2164756E21
 //# sourceMappingURL=bin-http.js.map