@secondlayer/mcp 7.2.1 → 7.4.0

package/dist/bin.js

@@ -21,13 +21,20 @@ function isHostedArchiveUrl(url) {
 
 // src/resources.ts
 import { CHAIN_TRIGGER_FIELDS } from "@secondlayer/shared";
+import { BOOTSTRAP_STEP } from "@secondlayer/shared/archive/instance-diagnosis";
 import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
 import { filterFieldsByType } from "@secondlayer/subgraphs";
 import { TYPE_MAP } from "@secondlayer/subgraphs/schema";
 
 // src/lib/client.ts
-import { SecondLayer, resolveApiKey } from "@secondlayer/sdk";
+import {
+  SecondLayer,
+  resolveAccountKey,
+  resolveApiKey
+} from "@secondlayer/sdk";
 var instance = null;
+var HOSTED_KEY_HINT = "set SECONDLAYER_API_KEY (sk-sl_*) for credits; INSTANCE_TOKEN is the instance";
+var DEFAULT_ARCHIVE_OPS_URL = "https://api.secondlayer.tools";
 function readApiKey() {
   return resolveApiKey();
 }
@@ -45,10 +52,31 @@ function getClient() {
   }
   return instance;
 }
-var keyHint = " — set INSTANCE_TOKEN from `sl init` for writes (SL_API_KEY is a legacy alias)";
+function readArchiveApiKey() {
+  return resolveAccountKey();
+}
+function getArchiveOpsClient() {
+  const accountKey = readArchiveApiKey();
+  if (!accountKey) {
+    throw new Error(HOSTED_KEY_HINT);
+  }
+  const archiveOpsUrl = process.env.SL_CREDITS_API_URL || process.env.ARCHIVE_OPS_API_URL || DEFAULT_ARCHIVE_OPS_URL;
+  return new SecondLayer({
+    accountKey,
+    origin: "mcp",
+    archiveOpsUrl
+  });
+}
+var keyHint = " — set INSTANCE_TOKEN from `sl init` for writes";
 async function apiRequest(method, path, body) {
-  const apiKey = readApiKey();
   const baseUrl = process.env.SECONDLAYER_API_URL || process.env.SL_API_URL || "http://127.0.0.1:3800";
+  let host = "";
+  try {
+    host = new URL(baseUrl).hostname;
+  } catch {
+    host = "";
+  }
+  const apiKey = host === "api.secondlayer.tools" ? resolveAccountKey() : readApiKey();
   const res = await fetch(`${baseUrl}${path}`, {
     method,
     headers: {
@@ -158,7 +186,11 @@ var PRODUCT_BLURBS = {
   subgraphs: "author/scaffold/deploy/query custom indexes",
   subscriptions: "webhook delivery on subgraph rows or raw chain events",
   account: "identity and self-provisioned API keys",
-  codegen: "ORM schemas for the tables you read"
+  codegen: "ORM schemas for the tables you read",
+  instance: "decoder health and empty-index diagnosis",
+  archive: "signed archive verify, bootstrap/repair, quote, latest pointer",
+  setup: "one-command self-host onboarding",
+  credits: "archive credits balance at api.secondlayer.tools"
 };
 var PRODUCT_ORDER = [
   "index",
@@ -167,12 +199,17 @@ var PRODUCT_ORDER = [
   "subgraphs",
   "subscriptions",
   "account",
-  "codegen"
+  "codegen",
+  "instance",
+  "archive",
+  "setup",
+  "credits"
 ];
 function buildCapabilities() {
   const byPrefix = new Map;
   for (const name of getRegisteredToolNames()) {
-    const prefix = name.slice(0, name.indexOf("_"));
+    const sep = name.indexOf("_");
+    const prefix = sep === -1 ? name : name.slice(0, sep);
     const tools = byPrefix.get(prefix) ?? [];
     tools.push(name);
     byPrefix.set(prefix, tools);
@@ -206,6 +243,7 @@ async function buildContext(deps = { clientProvider: getClient }) {
     return field.error ? `unavailable: ${field.error.message}` : unavailable;
   };
   const snap = await deps.clientProvider().context().catch(() => null);
+  const instance2 = snap?.instance?.value ? snap.instance.value : orNull(snap?.instance);
   return {
     authState: {
       apiKeySet: Boolean(readApiKey())
@@ -216,10 +254,12 @@ async function buildContext(deps = { clientProvider: getClient }) {
       indexTip: orNull(snap?.indexTip),
       subgraphs: snap?.subgraphs.value ? snap.subgraphs.value.map(formatSubgraphSummary) : orNull(snap?.subgraphs),
       subscriptions: orNull(snap?.subscriptions),
-      activeOperations: orNull(snap?.activeOperations)
+      activeOperations: orNull(snap?.activeOperations),
+      instance: instance2
     },
     whatYouCanDo: buildCapabilities(),
-    readAuthTiers: READ_AUTH_TIERS
+    readAuthTiers: READ_AUTH_TIERS,
+    ...snap?.instance?.value?.state === "empty-index" ? { nextStep: BOOTSTRAP_STEP } : {}
   };
 }
 function registerResources(server) {
@@ -293,18 +333,43 @@ function registerAccountTools(server) {
   }, async ({ name }) => jsonResponse(await apiRequest("POST", "/api/keys", { name })));
 }
 
+// src/tools/archive.ts
+import { z as z2 } from "zod";
+var FLOW = ["bootstrap", "repair"];
+function registerArchiveTools(server, clientProvider = getClient, archiveOpsClientProvider = getArchiveOpsClient) {
+  defineTool(server, "archive_verify", "Read-only, free compare of this instance against a signed archive (POST /v1/archive/verify). unanchored means pin a key or check the URL — not that the instance is fine. After bootstrap, poll instance_status until decoders ok, then this, then codegen_index_schema. Do not download parquet.", {
+    against: z2.string().describe("Archive manifest URL"),
+    fromBlock: z2.number().int().nonnegative().optional().describe("First height (inclusive)"),
+    toBlock: z2.number().int().nonnegative().optional().describe("Last height (inclusive)"),
+    target: z2.string().optional().describe("Verify target (default raw)")
+  }, async ({ against, fromBlock, toBlock, target }) => jsonResponse(await clientProvider().archive.verify({
+    against,
+    fromBlock,
+    toBlock,
+    target
+  })));
+  defineTool(server, "archive_latest", "Signed pointer to the official archive tree (hosted). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Use the returned origin as --against for archive_bootstrap. Do not download parquet.", {
+    against: z2.string().optional().describe("Override latest.json URL (default official tree)")
+  }, async ({ against }) => jsonResponse(await archiveOpsClientProvider().archive.latest(against)));
+  defineTool(server, "archive_quote", "Price a hosted archive fetch (metered). Needs SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN. Quote happens here; bootstrap/repair also quote inside the CLI. Do not download parquet.", {
+    paths: z2.array(z2.string()).describe("Partition paths to price"),
+    flow: z2.enum(FLOW).describe("bootstrap or repair")
+  }, async ({ paths, flow }) => jsonResponse(await archiveOpsClientProvider().archive.quote({ paths, flow })));
+  defineTool(server, "credits_balance", "Archive credits balance at api.secondlayer.tools. Needs SECONDLAYER_API_KEY (sk-sl_*); INSTANCE_TOKEN is the instance.", {}, async () => jsonResponse(await archiveOpsClientProvider().archive.credits.balance()));
+}
+
 // src/tools/codegen.ts
 import {
   generateIndexSchema
 } from "@secondlayer/subgraphs";
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var TARGETS = ["prisma", "kysely", "drizzle", "json-schema"];
 function registerCodegenTools(server) {
   defineTool(server, "codegen_index_schema", "Generate an ORM schema for the Index tables (blocks, transactions, decoded_events, …) — the same output as `sl codegen index`. Returns the file contents as text; write it wherever your project keeps its schema. Use `tables` to emit only what you read.", {
-    target: z2.enum(TARGETS).optional().describe("Output flavor (default kysely)"),
-    tables: z2.array(z2.string()).optional().describe("Restrict to these Index tables (default: all)"),
-    schemaName: z2.string().optional().describe("Postgres schema to qualify table names with"),
-    datasourceEnv: z2.string().optional().describe("Prisma only: datasource url env var (default DATABASE_URL)")
+    target: z3.enum(TARGETS).optional().describe("Output flavor (default kysely)"),
+    tables: z3.array(z3.string()).optional().describe("Restrict to these Index tables (default: all)"),
+    schemaName: z3.string().optional().describe("Postgres schema to qualify table names with"),
+    datasourceEnv: z3.string().optional().describe("Prisma only: datasource url env var (default DATABASE_URL)")
   }, ({ target, tables, schemaName, datasourceEnv }) => textResponse(generateIndexSchema(target ?? "kysely", {
     tables,
     schemaName,
@@ -313,17 +378,17 @@ function registerCodegenTools(server) {
 }
 
 // src/tools/contracts.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function registerContractTools(server, clientProvider = getClient) {
   defineTool(server, "contracts_find", 'Discover deployed Stacks contracts conforming to a trait (e.g. "sip-010", "sip-009", "sip-013"). The discovery endpoint for "which contracts implement X". Reads are public.', {
-    trait: z3.string().describe('Required. Trait to match (e.g. "sip-010").'),
-    conformance: z3.enum(["declared", "inferred", "any"]).optional().describe("declared = parsed from source, inferred = ABI shape-match, any = either (default)"),
-    include: z3.literal("abi").optional().describe(`Set to "abi" to include each contract's full ABI`),
-    limit: z3.number().optional().describe("Page size, 1–500 (default 100)"),
-    cursor: z3.string().optional().describe("Opaque cursor from a prior response's next_cursor")
+    trait: z4.string().describe('Required. Trait to match (e.g. "sip-010").'),
+    conformance: z4.enum(["declared", "inferred", "any"]).optional().describe("declared = parsed from source, inferred = ABI shape-match, any = either (default)"),
+    include: z4.literal("abi").optional().describe(`Set to "abi" to include each contract's full ABI`),
+    limit: z4.number().optional().describe("Page size, 1–500 (default 100)"),
+    cursor: z4.string().optional().describe("Opaque cursor from a prior response's next_cursor")
   }, async (params) => jsonResponse(await clientProvider().contracts.list(params)));
   defineTool(server, "contracts_get_abi", "Fetch a single deployed contract's ABI from the registry (prod-safe). Returns the contract's metadata + full ABI (functions, maps, variables, fungible/non-fungible tokens). Returns not_found if the contract isn't in the registry. Use it to inspect a contract before subgraphs_scaffold.", {
-    contractId: z3.string().describe("Fully qualified contract id (e.g. SP….amm-pool-v2-01)")
+    contractId: z4.string().describe("Fully qualified contract id (e.g. SP….amm-pool-v2-01)")
   }, async ({ contractId }) => {
     const contract = await clientProvider().contracts.get(contractId, {
       includeAbi: true
@@ -340,14 +405,14 @@ function registerContractTools(server, clientProvider = getClient) {
 
 // src/tools/index.ts
 import { DECODED_EVENT_TYPES } from "@secondlayer/shared";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var INDEX_EVENT_TYPES = DECODED_EVENT_TYPES;
 var rangeFilters = {
-  contractId: z4.string().optional().describe("Filter by contract id"),
-  fromHeight: z4.number().optional().describe("Start block height (inclusive)"),
-  toHeight: z4.number().optional().describe("End block height (inclusive)"),
-  cursor: z4.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
-  limit: z4.number().optional().describe("Max rows for this page")
+  contractId: z5.string().optional().describe("Filter by contract id"),
+  fromHeight: z5.number().optional().describe("Start block height (inclusive)"),
+  toHeight: z5.number().optional().describe("End block height (inclusive)"),
+  cursor: z5.string().optional().describe("Opaque cursor from a prior response's next_cursor"),
+  limit: z5.number().optional().describe("Max rows for this page")
 };
 var heightFilters = {
   fromHeight: rangeFilters.fromHeight,
@@ -358,52 +423,62 @@ var heightFilters = {
 function registerIndexTools(server, clientProvider = getClient) {
   defineTool(server, "index_ft_transfers", "List decoded SIP-010 fungible-token transfers from Index. Reads are keyless.", {
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z4.string().optional().describe("Filter by asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token")
+    sender: z5.string().optional().describe("Filter by sender principal"),
+    recipient: z5.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z5.string().optional().describe("Filter by asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token")
   }, async (params) => jsonResponse(await clientProvider().index.ftTransfers.list(params)));
   defineTool(server, "index_nft_transfers", "List decoded SIP-009 non-fungible-token transfers from Index. Reads are keyless.", {
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z4.string().optional().describe("Filter by asset identifier (contract::asset)")
+    sender: z5.string().optional().describe("Filter by sender principal"),
+    recipient: z5.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z5.string().optional().describe("Filter by asset identifier (contract::asset)")
   }, async (params) => jsonResponse(await clientProvider().index.nftTransfers.list(params)));
   defineTool(server, "index_events", "List decoded chain events from the Index by event type. Use this for event types without a dedicated tool (stx_*, ft_mint/burn, nft_mint/burn, print), and for trait-scoped queries: set `trait` (e.g. sip-010) to match all contracts conforming to a standard — pair with contracts_find to discover traits. For ft/nft transfers without a trait prefer index_ft_transfers / index_nft_transfers.", {
-    eventType: z4.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
+    eventType: z5.enum(INDEX_EVENT_TYPES).describe("Required. Decoded event type to list."),
     ...rangeFilters,
-    sender: z4.string().optional().describe("Filter by sender principal"),
-    recipient: z4.string().optional().describe("Filter by recipient principal"),
-    assetIdentifier: z4.string().optional().describe("Filter by asset identifier where applicable"),
-    trait: z4.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only."),
-    txContext: z4.boolean().optional().describe("Join the submitting transaction into each event (tx_sender, tx_type, tx_status, tx_contract_id, tx_function_name). For print events it's the only source of the submitting sender.")
+    sender: z5.string().optional().describe("Filter by sender principal"),
+    recipient: z5.string().optional().describe("Filter by recipient principal"),
+    assetIdentifier: z5.string().optional().describe("Filter by asset identifier where applicable"),
+    trait: z5.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId; contract-keyed event types only."),
+    txContext: z5.boolean().optional().describe("Join the submitting transaction into each event (tx_sender, tx_type, tx_status, tx_contract_id, tx_function_name). For print events it's the only source of the submitting sender.")
   }, async (params) => jsonResponse(await clientProvider().index.events.list(params)));
   defineTool(server, "index_contract_calls", "List decoded contract calls from the Index (function name, args, result). Set `trait` (e.g. sip-010) to match calls to all contracts conforming to a standard. Note: contract-call cursors are a SEPARATE keyspace from event cursors — they are not interchangeable.", {
     ...rangeFilters,
-    functionName: z4.string().optional().describe("Filter by called function name"),
-    sender: z4.string().optional().describe("Filter by caller principal"),
-    trait: z4.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
+    functionName: z5.string().optional().describe("Filter by called function name"),
+    sender: z5.string().optional().describe("Filter by caller principal"),
+    trait: z5.string().optional().describe("Match contracts conforming to a trait/standard (e.g. sip-010). Mutually exclusive with contractId.")
   }, async (params) => jsonResponse(await clientProvider().index.contractCalls.list(params)));
   defineTool(server, "index_blocks", "List decoded blocks from Index. Reads are keyless.", { ...heightFilters }, async (params) => jsonResponse(await clientProvider().index.blocks.list(params)));
   defineTool(server, "index_transactions", "List decoded transactions from Index. Filter by type, sender, or contract. Reads are keyless.", {
     ...rangeFilters,
-    type: z4.string().optional().describe("Filter by transaction type"),
-    sender: z4.string().optional().describe("Filter by sender principal")
+    type: z5.string().optional().describe("Filter by transaction type"),
+    sender: z5.string().optional().describe("Filter by sender principal")
   }, async (params) => jsonResponse(await clientProvider().index.transactions.list(params)));
   defineTool(server, "index_print_schema", "Empirical per-topic print payload schemas for a contract, inferred from sampled on-chain events: each topic's fields with observed Clarity types, decoded TS types, subgraph column types, and presence rates. Use before writing print_event subgraph handlers to learn what's on e.data. Anonymous read.", {
-    contractId: z4.string().describe("Contract id (SP….name) whose print events to profile")
+    contractId: z5.string().describe("Contract id (SP….name) whose print events to profile")
   }, async (params) => jsonResponse(await clientProvider().index.printSchema(params.contractId)));
   defineTool(server, "index_discover", "Discover the Index vocabulary: every event type and its columns, allowed/equality filters, and required-non-null fields (and which types accept `trait`). Read this before building Index queries instead of guessing filters. Anonymous read.", {}, async () => jsonResponse(await clientProvider().index.discover()));
   defineTool(server, "batch_query", "Run up to 10 public /v1 reads in one round trip (POST /v1/batch). Each item keeps its own auth/quota/pay-per-call semantics; results return in order with per-item status. Paths must start with /v1/index, /v1/subgraphs, /v1/streams, or /v1/contracts.", {
-    requests: z4.array(z4.object({
-      path: z4.string().describe("Public /v1 read path"),
-      params: z4.record(z4.string(), z4.string()).optional()
+    requests: z5.array(z5.object({
+      path: z5.string().describe("Public /v1 read path"),
+      params: z5.record(z5.string(), z5.string()).optional()
     })).min(1).max(10).describe("Read descriptors, executed concurrently")
   }, async (params) => jsonResponse(await clientProvider().batch(params.requests)));
 }
 
+// src/tools/instance.ts
+function registerInstanceTools(server, clientProvider = getClient) {
+  defineTool(server, "instance_status", "Decoder health and empty-index diagnosis from GET /public/status. If state is empty-index, next tool is archive_bootstrap or setup. Poll until index.decoders are ok before treating Index as ready — do not start decoders. Then archive_verify, then codegen_index_schema. Do not download parquet.", {}, async () => {
+    const client = clientProvider();
+    const status = await client.instance.status();
+    const diagnosis = await client.instance.diagnose();
+    return jsonResponse({ status, diagnosis });
+  });
+}
+
 // src/tools/scaffold.ts
 import { generateSubgraphCode } from "@secondlayer/scaffold";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 async function fetchAbi(clientProvider, contractId) {
   const contract = await clientProvider().contracts.get(contractId, {
     includeAbi: true
@@ -418,8 +493,8 @@ async function fetchAbi(clientProvider, contractId) {
 }
 function registerScaffoldTools(server, clientProvider = getClient) {
   defineTool(server, "subgraphs_scaffold", "Generate a subgraph scaffold from a deployed Stacks contract. Fetches the ABI automatically. Returns TypeScript source — review it, then pass it to subgraphs_deploy.", {
-    contractId: z5.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
-    subgraphName: z5.string().optional().describe("Override the subgraph name (defaults to contract name)")
+    contractId: z6.string().describe("Fully qualified contract ID (e.g. SP102V8P0F7JX67ARQ77WEA3D3CFB5XW39REDT0AM.amm-pool-v2-01)"),
+    subgraphName: z6.string().optional().describe("Override the subgraph name (defaults to contract name)")
   }, async ({ contractId, subgraphName }) => {
     const { functions } = await fetchAbi(clientProvider, contractId);
     const code = generateSubgraphCode(contractId, functions, subgraphName);
@@ -427,36 +502,245 @@ function registerScaffoldTools(server, clientProvider = getClient) {
   });
 }
 
+// src/tools/setup.ts
+import { z as z7 } from "zod";
+
+// src/lib/exec-cli.ts
+import {
+  spawn
+} from "node:child_process";
+var ALLOWED = ["setup", "bootstrap", "repair", "verify"];
+var TIMEOUT_MS = {
+  setup: 15 * 60 * 1000,
+  bootstrap: 10 * 60 * 1000,
+  repair: 10 * 60 * 1000,
+  verify: 2 * 60 * 1000
+};
+var VALUE_FLAGS = new Set([
+  "--against",
+  "--from-block",
+  "--to-block",
+  "--network",
+  "--node-mode",
+  "--dir"
+]);
+var BOOL_FLAGS = new Set(["--yes", "--json", "--apply", "--skip-bootstrap"]);
+var FLAGS_BY_CMD = {
+  setup: new Set([
+    "--yes",
+    "--network",
+    "--node-mode",
+    "--against",
+    "--dir",
+    "--skip-bootstrap"
+  ]),
+  bootstrap: new Set([
+    "--against",
+    "--yes",
+    "--json",
+    "--from-block",
+    "--to-block"
+  ]),
+  repair: new Set([
+    "--against",
+    "--json",
+    "--apply",
+    "--from-block",
+    "--to-block",
+    "--yes"
+  ]),
+  verify: new Set(["--against", "--json", "--from-block", "--to-block"])
+};
+
+class ExecCliError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ExecCliError";
+  }
+}
+function isUnsafeArg(arg) {
+  if (arg.includes("\x00"))
+    return true;
+  if (/[\n\r]/.test(arg))
+    return true;
+  return /^[;|&]/.test(arg.trim());
+}
+function assertSafeArgs(subcommand, args) {
+  const allowed = FLAGS_BY_CMD[subcommand];
+  let expectingValue = null;
+  for (const arg of args) {
+    if (isUnsafeArg(arg)) {
+      throw new ExecCliError(`rejected argument: ${JSON.stringify(arg)}`);
+    }
+    if (expectingValue) {
+      if (arg.startsWith("-")) {
+        throw new ExecCliError(`${expectingValue} requires a value`);
+      }
+      expectingValue = null;
+      continue;
+    }
+    if (!arg.startsWith("--") || !allowed.has(arg)) {
+      throw new ExecCliError(`flag not allowed for ${subcommand}: ${JSON.stringify(arg)}`);
+    }
+    if (VALUE_FLAGS.has(arg)) {
+      expectingValue = arg;
+    } else if (!BOOL_FLAGS.has(arg)) {
+      throw new ExecCliError(`flag not allowed for ${subcommand}: ${JSON.stringify(arg)}`);
+    }
+  }
+  if (expectingValue) {
+    throw new ExecCliError(`${expectingValue} requires a value`);
+  }
+}
+function killProcessGroup(child) {
+  const pid = child.pid;
+  if (pid && process.platform !== "win32") {
+    try {
+      process.kill(-pid, "SIGKILL");
+      return;
+    } catch {}
+  }
+  child.kill("SIGKILL");
+}
+async function execSecondlayer(subcommand, args, deps = {}) {
+  if (!ALLOWED.includes(subcommand)) {
+    throw new ExecCliError(`subcommand not allowed: ${subcommand}`);
+  }
+  assertSafeArgs(subcommand, args);
+  const argv = [subcommand, ...args];
+  if (subcommand === "setup") {
+    if (!argv.includes("--yes"))
+      argv.push("--yes");
+  } else if (!argv.includes("--json")) {
+    argv.push("--json");
+  }
+  const env = deps.env ?? process.env;
+  const bin = env.SECONDLAYER_BIN || "secondlayer";
+  const cwd = deps.cwd ?? env.SECONDLAYER_CWD ?? process.cwd();
+  const spawnFn = deps.spawn ?? spawn;
+  const timeout = deps.timeoutMs ?? TIMEOUT_MS[subcommand];
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const child = spawnFn(bin, argv, {
+      cwd,
+      env,
+      stdio: ["ignore", "pipe", "pipe"],
+      detached: process.platform !== "win32",
+      shell: false
+    });
+    const timer = setTimeout(() => {
+      killProcessGroup(child);
+      finish({
+        code: 124,
+        stdout,
+        stderr: `${stderr}
+timeout after ${timeout}ms`.trim()
+      });
+    }, timeout);
+    function finish(result) {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    }
+    child.stdout?.on("data", (chunk) => {
+      stdout += String(chunk);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += String(chunk);
+    });
+    child.on("error", (err) => {
+      finish({ code: 127, stdout, stderr: err.message });
+    });
+    child.on("close", (code) => {
+      finish({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+
+// src/tools/setup.ts
+function cliResponse(result) {
+  return jsonResponse(result, result.code !== 0);
+}
+function registerSetupTools(server, exec = execSecondlayer) {
+  defineTool(server, "setup", "Non-interactive self-host onboarding (secondlayer setup --yes). If the index is empty, this or archive_bootstrap fills it. Bootstrap is metered against the official archive. After it returns, poll instance_status until index.decoders are ok, then archive_verify, then codegen_index_schema. Do not download parquet.", {
+    network: z7.enum(["mainnet", "testnet", "devnet"]).describe("Stacks network"),
+    nodeMode: z7.enum(["external", "stacks", "full"]).describe("Node mode: external, stacks, or full"),
+    against: z7.string().optional().describe("Archive manifest URL"),
+    dir: z7.string().optional().describe("Compose project directory"),
+    skipBootstrap: z7.boolean().optional().describe("Sync from genesis instead of restoring an archive")
+  }, async ({ network, nodeMode, against, dir, skipBootstrap }) => {
+    const args = ["--yes", "--network", network, "--node-mode", nodeMode];
+    if (against !== undefined)
+      args.push("--against", against);
+    if (dir !== undefined)
+      args.push("--dir", dir);
+    if (skipBootstrap)
+      args.push("--skip-bootstrap");
+    return cliResponse(await exec("setup", args));
+  });
+  defineTool(server, "archive_bootstrap", "Restore verified history into this instance (secondlayer bootstrap --against … --yes --json). Metered against the official archive; quote happens inside the CLI. After bootstrap, poll instance_status until decoders ok, then archive_verify, then codegen_index_schema. Do not download parquet.", {
+    against: z7.string().describe("Archive manifest URL"),
+    fromBlock: z7.number().int().nonnegative().optional().describe("Restore from this height instead of genesis"),
+    toBlock: z7.number().int().nonnegative().optional().describe("Stop at this height instead of the archive tip")
+  }, async ({ against, fromBlock, toBlock }) => {
+    const args = ["--against", against, "--yes", "--json"];
+    if (fromBlock !== undefined)
+      args.push("--from-block", String(fromBlock));
+    if (toBlock !== undefined)
+      args.push("--to-block", String(toBlock));
+    return cliResponse(await exec("bootstrap", args));
+  });
+  defineTool(server, "archive_repair", "Plan (default) or apply a repair of local chain data against a signed archive. Metered when apply fetches from the official archive. After apply, poll instance_status until decoders ok, then archive_verify. Do not download parquet.", {
+    against: z7.string().describe("Archive manifest URL"),
+    apply: z7.boolean().optional().describe("Write the repair (default plan-only)"),
+    fromBlock: z7.number().int().nonnegative().optional().describe("First height to consider"),
+    toBlock: z7.number().int().nonnegative().optional().describe("Last height to consider")
+  }, async ({ against, apply, fromBlock, toBlock }) => {
+    const args = ["--against", against, "--json"];
+    if (apply)
+      args.push("--apply", "--yes");
+    if (fromBlock !== undefined)
+      args.push("--from-block", String(fromBlock));
+    if (toBlock !== undefined)
+      args.push("--to-block", String(toBlock));
+    return cliResponse(await exec("repair", args));
+  });
+}
+
 // src/tools/streams.ts
 import { STREAMS_EVENT_TYPES } from "@secondlayer/shared";
-import { z as z6 } from "zod";
-var filterValue = z6.union([z6.string(), z6.array(z6.string())]);
+import { z as z8 } from "zod";
+var filterValue = z8.union([z8.string(), z8.array(z8.string())]);
 function registerStreamsTools(server, clientProvider = getClient) {
   defineTool(server, "streams_tip", "Current canonical chain tip as Streams sees it: block height/hash, burn height, finalized_height, lag_seconds, and the oldest seekable height/cursor for this key's retention window. Call it before a cursor walk to know where the stream ends, and after an ingest to check lag.", {}, async () => jsonResponse(await clientProvider().streams.tip()));
   defineTool(server, "streams_events", "List raw chain events from Streams — ONE page per call, newest filters applied server-side. Returns { events, next_cursor, tip, reorgs }. To follow the chain live, poll this tool with `cursor` set to the previous response's `next_cursor` (input is exclusive, so no duplicates); there is no open-stream tool because a tool call cannot hold a connection. ALWAYS narrow with types/contractId/sender/recipient — an unfiltered page is the full firehose.", {
-    cursor: z6.string().optional().describe("Resume strictly after this cursor (`<block_height>:<event_index>`, e.g. 951475:3) — pass a prior response's next_cursor"),
-    fromHeight: z6.number().int().nonnegative().optional().describe("Start block height (inclusive)"),
-    toHeight: z6.number().int().nonnegative().optional().describe("End block height (inclusive)"),
-    types: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
-    notTypes: z6.array(z6.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude (applied after types)"),
+    cursor: z8.string().optional().describe("Resume strictly after this cursor (`<block_height>:<event_index>`, e.g. 951475:3) — pass a prior response's next_cursor"),
+    fromHeight: z8.number().int().nonnegative().optional().describe("Start block height (inclusive)"),
+    toHeight: z8.number().int().nonnegative().optional().describe("End block height (inclusive)"),
+    types: z8.array(z8.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to include"),
+    notTypes: z8.array(z8.enum(STREAMS_EVENT_TYPES)).optional().describe("Event types to exclude (applied after types)"),
     contractId: filterValue.optional().describe("Contract id, or a list of contract ids to OR together"),
     sender: filterValue.optional().describe("Sender principal, or a list to OR together"),
     recipient: filterValue.optional().describe("Recipient principal, or a list to OR together"),
-    assetIdentifier: z6.string().optional().describe("Asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token"),
-    limit: z6.number().int().min(1).max(1000).optional().describe("Page size, 1–1000 (default 100)")
+    assetIdentifier: z8.string().optional().describe("Asset identifier (contract::asset), e.g. SP…sbtc-token::sbtc-token"),
+    limit: z8.number().int().min(1).max(1000).optional().describe("Page size, 1–1000 (default 100)")
   }, async (params) => jsonResponse(await clientProvider().streams.events.list(params)));
   defineTool(server, "streams_events_by_tx", "List every event emitted by a single transaction, in emission order. Use it to explain one transaction end to end after finding it in streams_events or the Index.", {
-    txId: z6.string().describe("Transaction id (0x-prefixed)")
+    txId: z8.string().describe("Transaction id (0x-prefixed)")
   }, async ({ txId }) => jsonResponse(await clientProvider().streams.events.byTxId(txId)));
   defineTool(server, "streams_block_events", "List every event in one block, addressed by block height or block hash. Use it to audit a block a consumer flagged, or to diff what a reorg replaced.", {
-    heightOrHash: z6.union([z6.number().int().nonnegative(), z6.string()]).describe("Block height (number) or block hash (0x-prefixed string)")
+    heightOrHash: z8.union([z8.number().int().nonnegative(), z8.string()]).describe("Block height (number) or block hash (0x-prefixed string)")
   }, async ({ heightOrHash }) => jsonResponse(await clientProvider().streams.blocks.events(heightOrHash)));
   defineTool(server, "streams_canonical", "Get the canonical block at a height: hash, burn block hash, parent, and whether the height is still canonical. Use it to confirm a height you already consumed was not reorged away before you trust derived state.", {
-    height: z6.number().int().nonnegative().describe("Block height")
+    height: z8.number().int().nonnegative().describe("Block height")
   }, async ({ height }) => jsonResponse(await clientProvider().streams.canonical(height)));
   defineTool(server, "streams_reorgs", "List reorgs detected since a point in time, newest last, with the new canonical tip for each. Returns { reorgs, next_since } — resume with next_since. Call it when a consumer's derived state disagrees with streams_canonical, or on a schedule to know which heights to reprocess.", {
-    since: z6.string().describe("Required. ISO 8601 timestamp, or a `next_since` resume token from a prior response"),
-    limit: z6.number().int().positive().optional().describe("Max reorgs to return")
+    since: z8.string().describe("Required. ISO 8601 timestamp, or a `next_since` resume token from a prior response"),
+    limit: z8.number().int().positive().optional().describe("Max reorgs to return")
   }, async ({ since, limit }) => jsonResponse(await clientProvider().streams.reorgs.list({
     since,
     ...limit !== undefined ? { limit } : {}
@@ -466,19 +750,19 @@ function registerStreamsTools(server, clientProvider = getClient) {
 
 // src/tools/subgraphs.ts
 import { bundleSubgraphCode } from "@secondlayer/bundler";
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 function registerSubgraphTools(server, clientProvider = getClient) {
   defineTool(server, "subgraphs_list", "List all deployed subgraphs. Returns summary fields only; read rows with subgraphs_query.", {}, async () => {
     const { data } = await clientProvider().subgraphs.list();
     return jsonResponse(data.map(formatSubgraphSummary));
   });
-  defineTool(server, "subgraphs_status", "Get full details of a subgraph including schema, health, and table columns.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_status", "Get full details of a subgraph including schema, health, and table columns.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
     const detail = await clientProvider().subgraphs.status(name);
     return jsonResponse(detail);
   });
   defineTool(server, "subgraphs_spec", "Fetch a subgraph's self-describing spec — the tables, columns, filters, and read URLs a consumer needs, without guessing. `agent` (default) returns the compact JSON schema built for tool use, `openapi` the OpenAPI document for the subgraph's read routes, `markdown` human-readable docs. Read it before writing queries against an unfamiliar subgraph.", {
-    name: z7.string().describe("Subgraph name"),
-    format: z7.enum(["agent", "openapi", "markdown"]).optional().describe("agent = JSON schema for tool use (default), openapi = OpenAPI JSON, markdown = docs.md")
+    name: z9.string().describe("Subgraph name"),
+    format: z9.enum(["agent", "openapi", "markdown"]).optional().describe("agent = JSON schema for tool use (default), openapi = OpenAPI JSON, markdown = docs.md")
   }, async ({ name, format }) => {
     const client = clientProvider();
     if (format === "openapi")
@@ -488,15 +772,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(await client.subgraphs.schema(name));
   });
   defineTool(server, "subgraphs_query", 'Query rows from a subgraph table (max 200 rows). Filters support operators: "amount.gte": "1000", "sender.neq": "SP...", "name.like": "%token%". Available operators: eq, neq, gt, gte, lt, lte, like. To TAIL new rows (no streaming over MCP): sort=_id, order=desc for the latest, then poll forward with the filter {"_id.gt": "<last _id seen>"}, order=asc — when tailing with a `fields` list, include "_id" in it or the next poll filter cannot be formed. Fetch one row by id with {"_id": "<id>"}. The same rows are readable over HTTP at GET /v1/subgraphs/<name>/<table> — { rows, next_cursor, tip } envelope, resume with ?cursor=<next_cursor> + _order=asc|desc (no _offset/_sort on /v1); hand that URL to third parties.', {
-    name: z7.string().describe("Subgraph name"),
-    table: z7.string().describe("Table name"),
-    filters: z7.record(z7.string(), z7.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
-    sort: z7.string().optional().describe("Column to sort by"),
-    order: z7.enum(["asc", "desc"]).optional().describe("Sort order"),
-    limit: z7.number().max(200).optional().describe("Max rows (default 50, max 200)"),
-    offset: z7.number().optional().describe("Offset for pagination"),
-    fields: z7.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
-    count: z7.boolean().optional().describe("If true, return row count instead of rows")
+    name: z9.string().describe("Subgraph name"),
+    table: z9.string().describe("Table name"),
+    filters: z9.record(z9.string(), z9.string()).optional().describe('Column filters — plain values or with operators (e.g. {"amount.gte": "1000", "sender": "SP..."})'),
+    sort: z9.string().optional().describe("Column to sort by"),
+    order: z9.enum(["asc", "desc"]).optional().describe("Sort order"),
+    limit: z9.number().max(200).optional().describe("Max rows (default 50, max 200)"),
+    offset: z9.number().optional().describe("Offset for pagination"),
+    fields: z9.string().optional().describe('Comma-separated column list to return (e.g. "sender,amount")'),
+    count: z9.boolean().optional().describe("If true, return row count instead of rows")
   }, async ({
     name,
     table,
@@ -524,15 +808,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_reindex", "Reindex a subgraph: drops and rebuilds the whole subgraph from its start block to chain tip. Takes no block range — use subgraphs_backfill to process a specific range. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress to completion.", {
-    name: z7.string().describe("Subgraph name")
+    name: z9.string().describe("Subgraph name")
   }, async ({ name }) => {
     const result = await clientProvider().subgraphs.reindex(name);
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_backfill", "Backfill a subgraph over a block range. Non-destructive forward fill (does not drop existing data) — unlike subgraphs_reindex, and the only data-fill path for BYO subgraphs (reindex is blocked there). Both blocks required. Returns an operationId — check subgraphs_status (health) or the REST operations endpoint to track progress.", {
-    name: z7.string().describe("Subgraph name"),
-    fromBlock: z7.number().int().nonnegative().describe("Start block (inclusive)"),
-    toBlock: z7.number().int().nonnegative().describe("End block (inclusive)")
+    name: z9.string().describe("Subgraph name"),
+    fromBlock: z9.number().int().nonnegative().describe("Start block (inclusive)"),
+    toBlock: z9.number().int().nonnegative().describe("End block (inclusive)")
   }, async ({ name, fromBlock, toBlock }) => {
     const result = await clientProvider().subgraphs.backfill(name, {
       fromBlock,
@@ -540,15 +824,15 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     });
     return jsonResponse(result);
   });
-  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; check subgraphs_status (health) or the REST operations endpoint to confirm it reaches a terminal state.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_stop", "Cancel an in-flight reindex or backfill operation for a subgraph. Returns the stop request status; check subgraphs_status (health) or the REST operations endpoint to confirm it reaches a terminal state.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
     const result = await clientProvider().subgraphs.stop(name);
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_gaps", "List indexing gaps (missing block ranges) for a subgraph. Each gap reports start/end/size, reason, and detected/resolved timestamps. Feed an unresolved gap's range into subgraphs_backfill to fill it. Defaults to unresolved gaps.", {
-    name: z7.string().describe("Subgraph name"),
-    limit: z7.number().int().positive().optional().describe("Max gaps to return"),
-    offset: z7.number().int().nonnegative().optional().describe("Pagination offset"),
-    resolved: z7.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
+    name: z9.string().describe("Subgraph name"),
+    limit: z9.number().int().positive().optional().describe("Max gaps to return"),
+    offset: z9.number().int().nonnegative().optional().describe("Pagination offset"),
+    resolved: z9.boolean().optional().describe("Filter by resolved state (omit for unresolved only)")
   }, async ({ name, limit, offset, resolved }) => {
     const result = await clientProvider().subgraphs.gaps(name, {
       limit,
@@ -558,20 +842,20 @@ function registerSubgraphTools(server, clientProvider = getClient) {
     return jsonResponse(result);
   });
   defineTool(server, "subgraphs_operations", "Operation history for a subgraph (deploy/reindex/backfill/stop), newest first — status, block range, progress, and error. THIS IS THE VERIFY CALL: after subgraphs_deploy, subgraphs_reindex, subgraphs_backfill, or subgraphs_stop, poll it with the returned operationId until `status` is terminal (completed/failed/cancelled) before reporting success. Omit operationId for the recent history.", {
-    name: z7.string().describe("Subgraph name"),
-    operationId: z7.string().optional().describe("Fetch one operation by id (the operationId returned by reindex/backfill/stop); omit for recent history")
+    name: z9.string().describe("Subgraph name"),
+    operationId: z9.string().optional().describe("Fetch one operation by id (the operationId returned by reindex/backfill/stop); omit for recent history")
   }, async ({ name, operationId }) => {
     const client = clientProvider();
     return jsonResponse(operationId ? await client.subgraphs.getOperation(name, operationId) : await client.subgraphs.operations(name));
   });
-  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: z7.string().describe("Subgraph name") }, async ({ name }) => {
+  defineTool(server, "subgraphs_delete", "Delete a subgraph permanently.", { name: z9.string().describe("Subgraph name") }, async ({ name }) => {
     const result = await clientProvider().subgraphs.delete(name);
     return textResponse(result.message);
   });
   defineTool(server, "subgraphs_deploy", "Deploy a subgraph from TypeScript code. Pass the full defineSubgraph() source — it will be bundled, validated, and deployed. Optional startBlock overrides the source definition for this deploy. Set dryRun to validate and preview the schema/DDL without writing anything. Call `subgraphs_reindex` separately if you need a forced reindex.", {
-    code: z7.string().describe("TypeScript source code containing a defineSubgraph() call"),
-    startBlock: z7.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
-    dryRun: z7.boolean().optional().describe("Validate and preview the deploy (schema/DDL) without writing changes")
+    code: z9.string().describe("TypeScript source code containing a defineSubgraph() call"),
+    startBlock: z9.number().int().nonnegative().optional().describe("Override the definition startBlock for this deploy"),
+    dryRun: z9.boolean().optional().describe("Validate and preview the deploy (schema/DDL) without writing changes")
   }, async ({ code, startBlock, dryRun }) => {
     const bundled = await bundleSubgraphCode(code);
     const result = await clientProvider().subgraphs.deploy({
@@ -591,38 +875,38 @@ function registerSubgraphTools(server, clientProvider = getClient) {
 
 // src/tools/subscriptions.ts
 import { CHAIN_TRIGGER_TYPES } from "@secondlayer/shared";
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 function registerSubscriptionTools(server, clientProvider = getClient) {
   defineTool(server, "subscriptions_list", "List all subscriptions for the current account. Returns summary fields (no secrets).", {}, async () => {
     const { data } = await clientProvider().subscriptions.list();
     return jsonResponse(data);
   });
-  defineTool(server, "subscriptions_get", "Get full detail for a subscription (filter, auth, retry config, circuit state).", { id: z8.string().describe("Subscription id") }, async ({ id }) => {
+  defineTool(server, "subscriptions_get", "Get full detail for a subscription (filter, auth, retry config, circuit state).", { id: z10.string().describe("Subscription id") }, async ({ id }) => {
     const detail = await clientProvider().subscriptions.get(id);
     return jsonResponse(detail);
   });
   defineTool(server, "subscriptions_create", "Create a subscription. Two kinds (mutually exclusive): a SUBGRAPH subscription fires on a subgraph table's rows (set subgraphName + tableName + optional filter); a CHAIN subscription fires on raw chain events with no subgraph (set triggers). Returns `signingSecret` ONCE — forward it to the user so they can wire it into their receiver.", {
-    name: z8.string().describe("Human-readable name, unique per account"),
-    subgraphName: z8.string().optional().describe("Subgraph to subscribe to (subgraph subscription)"),
-    tableName: z8.string().optional().describe("Table within the subgraph (subgraph subscription)"),
-    triggers: z8.array(z8.object({
-      type: z8.enum(CHAIN_TRIGGER_TYPES),
-      contractId: z8.string().optional(),
-      functionName: z8.string().optional(),
-      caller: z8.string().optional(),
-      sender: z8.string().optional(),
-      recipient: z8.string().optional(),
-      assetIdentifier: z8.string().optional(),
-      deployer: z8.string().optional(),
-      contractName: z8.string().optional(),
-      topic: z8.string().optional(),
-      lockedAddress: z8.string().optional(),
-      trait: z8.string().optional(),
-      minAmount: z8.union([z8.string(), z8.number()]).optional(),
-      maxAmount: z8.union([z8.string(), z8.number()]).optional()
+    name: z10.string().describe("Human-readable name, unique per account"),
+    subgraphName: z10.string().optional().describe("Subgraph to subscribe to (subgraph subscription)"),
+    tableName: z10.string().optional().describe("Table within the subgraph (subgraph subscription)"),
+    triggers: z10.array(z10.object({
+      type: z10.enum(CHAIN_TRIGGER_TYPES),
+      contractId: z10.string().optional(),
+      functionName: z10.string().optional(),
+      caller: z10.string().optional(),
+      sender: z10.string().optional(),
+      recipient: z10.string().optional(),
+      assetIdentifier: z10.string().optional(),
+      deployer: z10.string().optional(),
+      contractName: z10.string().optional(),
+      topic: z10.string().optional(),
+      lockedAddress: z10.string().optional(),
+      trait: z10.string().optional(),
+      minAmount: z10.union([z10.string(), z10.number()]).optional(),
+      maxAmount: z10.union([z10.string(), z10.number()]).optional()
     })).optional().describe("Chain triggers (chain subscription) — provide INSTEAD of subgraphName/tableName. Each targets a raw chain event/tx; string fields accept `*` wildcards, `trait` scopes to a SIP/trait. Per-type accepted fields: see the secondlayer://chain-triggers resource. Forward-looking: starts at chain tip, no backfill."),
-    url: z8.string().describe("Webhook URL"),
-    format: z8.enum([
+    url: z10.string().describe("Webhook URL"),
+    format: z10.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -630,20 +914,20 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional().describe("Wire format (default standard-webhooks)"),
-    runtime: z8.enum(["inngest", "trigger", "cloudflare", "node"]).optional().describe("Receiver runtime label (display only)"),
-    filter: z8.record(z8.string(), z8.unknown()).optional().describe('Scalar filter DSL, e.g. {"amount": {"gte": 100}, "sender": "SP..."}'),
-    authConfig: z8.record(z8.string(), z8.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
+    runtime: z10.enum(["inngest", "trigger", "cloudflare", "node"]).optional().describe("Receiver runtime label (display only)"),
+    filter: z10.record(z10.string(), z10.unknown()).optional().describe('Scalar filter DSL, e.g. {"amount": {"gte": 100}, "sender": "SP..."}'),
+    authConfig: z10.record(z10.string(), z10.unknown()).optional().describe('Receiver auth sent with each delivery, e.g. {"type": "bearer", "token": "..."}')
   }, async (input) => {
     const res = await clientProvider().subscriptions.create(input);
     return jsonResponse(res);
   });
   defineTool(server, "subscriptions_update", "Patch a subscription (name, url, filter, authConfig, format, runtime, retry, timeout, concurrency).", {
-    id: z8.string(),
-    name: z8.string().optional().describe("Rename the subscription"),
-    url: z8.string().optional(),
-    filter: z8.record(z8.string(), z8.unknown()).optional(),
-    authConfig: z8.record(z8.string(), z8.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
-    format: z8.enum([
+    id: z10.string(),
+    name: z10.string().optional().describe("Rename the subscription"),
+    url: z10.string().optional(),
+    filter: z10.record(z10.string(), z10.unknown()).optional(),
+    authConfig: z10.record(z10.string(), z10.unknown()).optional().describe("Receiver auth sent with each delivery (bearer/etc.)"),
+    format: z10.enum([
       "standard-webhooks",
       "inngest",
       "trigger",
@@ -651,36 +935,36 @@ function registerSubscriptionTools(server, clientProvider = getClient) {
       "cloudevents",
       "raw"
     ]).optional(),
-    runtime: z8.enum(["inngest", "trigger", "cloudflare", "node"]).nullable().optional(),
-    maxRetries: z8.number().int().min(0).optional(),
-    timeoutMs: z8.number().int().min(100).optional(),
-    concurrency: z8.number().int().min(1).optional()
+    runtime: z10.enum(["inngest", "trigger", "cloudflare", "node"]).nullable().optional(),
+    maxRetries: z10.number().int().min(0).optional(),
+    timeoutMs: z10.number().int().min(100).optional(),
+    concurrency: z10.number().int().min(1).optional()
   }, async ({ id, ...patch }) => {
     const res = await clientProvider().subscriptions.update(id, patch);
     return jsonResponse(res);
   });
-  defineTool(server, "subscriptions_delete", "Delete a subscription. Pending outbox rows are cascade-deleted.", { id: z8.string() }, async ({ id }) => {
+  defineTool(server, "subscriptions_delete", "Delete a subscription. Pending outbox rows are cascade-deleted.", { id: z10.string() }, async ({ id }) => {
     const res = await clientProvider().subscriptions.delete(id);
     return jsonResponse(res);
   });
-  defineTool(server, "subscriptions_test", "Send a one-off test webhook to a subscription's URL (built for its format, SSRF-guarded). Logged as a delivery row. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: z8.string().describe("Subscription id") }, async ({ id }) => {
+  defineTool(server, "subscriptions_test", "Send a one-off test webhook to a subscription's URL (built for its format, SSRF-guarded). Logged as a delivery row. Returns {ok, statusCode, error, durationMs, deliveryId}.", { id: z10.string().describe("Subscription id") }, async ({ id }) => {
     const res = await clientProvider().subscriptions.test(id);
     return jsonResponse(res);
   });
-  defineTool(server, "subscriptions_pause", "Pause a subscription: stops delivery attempts and stops queueing new ones. Nothing is deleted — resume picks the subscription back up from the tip. Verify with subscriptions_get (status).", { id: z8.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.pause(id)));
-  defineTool(server, "subscriptions_resume", "Resume a paused subscription (also clears a tripped circuit breaker). Deliveries restart from the current tip — use subscriptions_replay for the blocks missed while paused. Verify with subscriptions_get (status).", { id: z8.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.resume(id)));
-  defineTool(server, "subscriptions_rotate_secret", "Rotate a subscription's webhook signing secret. Returns the NEW `signingSecret` ONCE — forward it to the user; deliveries signed with the old secret stop verifying as soon as this returns, so the receiver must be updated.", { id: z8.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.rotateSecret(id)));
-  defineTool(server, "subscriptions_deliveries", "List recent delivery attempts for a subscription — status code, attempt count, error, duration, timestamps. THIS IS THE VERIFY CALL: after subscriptions_create, subscriptions_test, or subscriptions_replay, read it to confirm the webhook actually landed (and to see the receiver's response when it didn't) instead of trusting the enqueue result.", { id: z8.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.deliveries(id)));
-  defineTool(server, "subscriptions_dead", "List a subscription's dead-letter queue — deliveries that exhausted their retries, with the outbox id, payload, and last error. Diagnose the receiver first (subscriptions_get for the URL/auth, subscriptions_test for a live probe), then requeue rows with subscriptions_requeue.", { id: z8.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.dead(id)));
+  defineTool(server, "subscriptions_pause", "Pause a subscription: stops delivery attempts and stops queueing new ones. Nothing is deleted — resume picks the subscription back up from the tip. Verify with subscriptions_get (status).", { id: z10.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.pause(id)));
+  defineTool(server, "subscriptions_resume", "Resume a paused subscription (also clears a tripped circuit breaker). Deliveries restart from the current tip — use subscriptions_replay for the blocks missed while paused. Verify with subscriptions_get (status).", { id: z10.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.resume(id)));
+  defineTool(server, "subscriptions_rotate_secret", "Rotate a subscription's webhook signing secret. Returns the NEW `signingSecret` ONCE — forward it to the user; deliveries signed with the old secret stop verifying as soon as this returns, so the receiver must be updated.", { id: z10.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.rotateSecret(id)));
+  defineTool(server, "subscriptions_deliveries", "List recent delivery attempts for a subscription — status code, attempt count, error, duration, timestamps. THIS IS THE VERIFY CALL: after subscriptions_create, subscriptions_test, or subscriptions_replay, read it to confirm the webhook actually landed (and to see the receiver's response when it didn't) instead of trusting the enqueue result.", { id: z10.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.deliveries(id)));
+  defineTool(server, "subscriptions_dead", "List a subscription's dead-letter queue — deliveries that exhausted their retries, with the outbox id, payload, and last error. Diagnose the receiver first (subscriptions_get for the URL/auth, subscriptions_test for a live probe), then requeue rows with subscriptions_requeue.", { id: z10.string().describe("Subscription id") }, async ({ id }) => jsonResponse(await clientProvider().subscriptions.dead(id)));
   defineTool(server, "subscriptions_requeue", "Requeue ONE dead-lettered delivery for another attempt, by its outbox id from subscriptions_dead. Fix the receiver first — a requeue against a still-broken endpoint just dies again. Verify with subscriptions_deliveries.", {
-    id: z8.string().describe("Subscription id"),
-    outboxId: z8.string().describe("Outbox id of the dead delivery (from subscriptions_dead)")
+    id: z10.string().describe("Subscription id"),
+    outboxId: z10.string().describe("Outbox id of the dead delivery (from subscriptions_dead)")
   }, async ({ id, outboxId }) => jsonResponse(await clientProvider().subscriptions.requeue(id, outboxId)));
   defineTool(server, "subscriptions_replay", "Replay a block range for a subscription. Replays run at 10% of batch capacity — use sparingly. Pass `force` (a short idempotency suffix) to re-run a range that was already replayed.", {
-    id: z8.string(),
-    fromBlock: z8.number().int().nonnegative(),
-    toBlock: z8.number().int().nonnegative(),
-    force: z8.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
+    id: z10.string(),
+    fromBlock: z10.number().int().nonnegative(),
+    toBlock: z10.number().int().nonnegative(),
+    force: z10.string().optional().describe("Idempotency suffix to force a duplicate replay of the range")
   }, async ({ id, fromBlock, toBlock, force }) => {
     const res = await clientProvider().subscriptions.replay(id, {
       fromBlock,
@@ -706,6 +990,9 @@ function createServer() {
   registerStreamsTools(server);
   registerContractTools(server);
   registerCodegenTools(server);
+  registerInstanceTools(server);
+  registerArchiveTools(server);
+  registerSetupTools(server);
   const baseUrl = process.env.SECONDLAYER_API_URL || process.env.SL_API_URL || "http://127.0.0.1:3800";
   if (isHostedArchiveUrl(baseUrl)) {
     registerAccountTools(server);
@@ -719,5 +1006,5 @@ var server = createServer();
 var transport = new StdioServerTransport;
 await server.connect(transport);
 
-//# debugId=A32A9DB8FD9D2A0F64756E2164756E21
+//# debugId=1DDB49B11F03E33264756E2164756E21
 //# sourceMappingURL=bin.js.map