@seamward/setup-mcp 0.1.0-alpha.9

package/dist/server.js

@@ -0,0 +1,1959 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { McpServer } from "@modelcontextprotocol/server";
+import { activatePlanContractVersion, applyLocalSetupBatch, checkFirstSetupObservation, createLocalSetupEngine, discoverIntegrationGroups, isAutomaticIntegrationGroup, inspectSetupIntegrationBinding, LocalSetupEngineError, previewPlanContract, previewPlanContractActivation, readContractStatus, readMatchingActivePlanContract, readSetupPlan, readSetupPlans, recordSetupIntegrationBinding, reconcileActivePlanContract, registeredContractVersionIdForFile, registerPlanContracts, SeamwardRemoteApiError, } from "@seamward/cli";
+import * as z from "zod/v4";
+import { setupMcpInputSchemas, setupMcpErrorOutputSchema, setupMcpErrorRecovery, setupMcpSchemaVersion, setupMcpOutputSchemas, setupMcpToolDefinitions, legacySetupMcpToolDefinitions, toolAnnotations, } from "./contracts.js";
+import { setupMcpVersion } from "./version.js";
+const integrationEffectSchema = z
+    .object({
+    action: z.enum(["create", "reuse"]),
+    direction: z.enum(["inbound", "outbound"]),
+    integrationId: z.string().startsWith("int_"),
+    name: z.string().min(1).max(120),
+    protocol: z.enum(["http-api", "http-webhook", "queue", "scheduled-feed"]),
+    provider: z.string().min(1).max(120),
+    setupId: z.string().min(1).max(128),
+})
+    .strict();
+const integrationPreviewResponseSchema = z
+    .object({
+    effects: z.array(integrationEffectSchema).min(1).max(20),
+    expiresAt: z.string().datetime(),
+    fingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    operationId: z.string().startsWith("setupop_"),
+})
+    .strict();
+const provisionedIntegrationSchema = z
+    .object({
+    connectionKey: z.string().min(1),
+    direction: z.enum(["inbound", "outbound"]),
+    environmentId: z.string().min(1),
+    id: z.string().startsWith("int_"),
+    integrationKey: z.string().startsWith("sw_int_"),
+    name: z.string().min(1),
+    protocol: z.enum(["http-api", "http-webhook", "queue", "scheduled-feed"]),
+    provider: z.string().min(1),
+    setupId: z.string().min(1),
+    sourceKey: z.string().startsWith("sw_src_"),
+})
+    .strict();
+const integrationApplyResponseSchema = z
+    .object({
+    integrations: z.array(provisionedIntegrationSchema).min(1).max(20),
+    operationId: z.string().startsWith("setupop_"),
+    status: z.literal("completed"),
+})
+    .strict();
+function result(name, data) {
+    const parsed = setupMcpOutputSchemas[name].safeParse(JSON.parse(JSON.stringify({ schemaVersion: setupMcpSchemaVersion, data })));
+    if (!parsed.success)
+        throw new Error("Invalid local setup tool output");
+    const structuredContent = parsed.data;
+    return {
+        content: [
+            { type: "text", text: JSON.stringify(structuredContent) },
+        ],
+        structuredContent,
+    };
+}
+class SetupMcpOperationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "SetupMcpOperationError";
+    }
+}
+function errorCode(error) {
+    if (error instanceof SetupMcpOperationError)
+        return error.code;
+    if (error instanceof LocalSetupEngineError)
+        return error.code;
+    if (error instanceof SeamwardRemoteApiError)
+        return error.code;
+    if (error instanceof z.ZodError)
+        return "invalid_input";
+    const message = error instanceof Error ? error.message : "";
+    if (/stale setup lock requires manual recovery/i.test(message))
+        return "stale_setup_lock";
+    if (/generated setup files are being updated/i.test(message))
+        return "setup_state_conflict";
+    if (/scan .*limit exceeded/i.test(message))
+        return "scan_limit_exceeded";
+    if (/state (?:fingerprint does not match|is being updated)/i.test(message))
+        return "setup_state_conflict";
+    if (/state changed after contract activation preview/i.test(message))
+        return "setup_state_conflict";
+    if (/source verification required/i.test(message))
+        return "source_verification_required";
+    if (/contract document changed after the setup plan was reviewed/i.test(message))
+        return "plan_conflict";
+    if (/contract target|activation plan fingerprint/i.test(message))
+        return "plan_conflict";
+    if (/refusing to overwrite|generated file changed/i.test(message))
+        return "generated_file_conflict";
+    if (/activation failed.*(?:409|active_contract_conflict)/i.test(message))
+        return "contract_activation_conflict";
+    if (/registration failed|activation failed|status failed/i.test(message))
+        return "remote_request_failed";
+    if (/returned an invalid response/i.test(message))
+        return "remote_response_invalid";
+    return "internal_error";
+}
+function errorResult(error) {
+    const code = errorCode(error);
+    const messages = {
+        plan_not_found: "The requested setup plan is unavailable. Analyze and plan again.",
+        legacy_plan_requires_replan: "This setup plan predates source-backed evidence. Analyze and plan again.",
+        confirmation_required: "The exact confirmation value is required.",
+        no_matching_actions: "No planned instrumentation matches those files.",
+        invalid_input: "The tool input does not match the published schema.",
+        scan_limit_exceeded: "Repository analysis exceeded a configured safety limit.",
+        generated_file_conflict: "A generated file changed and will not be overwritten.",
+        apply_in_progress: "Another local setup apply is already in progress. Retry after it finishes.",
+        setup_preview_stale: "The reviewed Integration preview is stale. Review the current setup again.",
+        idempotency_conflict: "That idempotency key was already used for a different setup request.",
+        verification_failed: "The reviewed local setup did not pass deterministic project verification.",
+        setup_state_conflict: "Setup evidence changed. Verify again before recording evidence.",
+        stale_setup_lock: "A setup lock remains after its owner stopped. Confirm the recorded process is absent, then remove only the named lock file.",
+        configuration_required: "The application environment setup authorization is not configured.",
+        contract_preview_expired: "The approval preview is unavailable. Preview the operation again.",
+        contract_activation_conflict: "The active contract changed after preview. Read status and preview again.",
+        authentication_required: "The Seamward setup authorization is invalid, expired, or revoked.",
+        insufficient_scope: "The Seamward setup authorization does not grant this operation.",
+        integration_scope_mismatch: "The contract operations do not match this Integration scope.",
+        integration_mapping_required: "The discovered boundary cannot be matched to exactly one existing Integration in the selected application environment.",
+        contract_version_conflict: "That contract version conflicts with an existing immutable version.",
+        source_verification_required: "Verify and record the planned source changes before contract activation.",
+        not_found: "The requested Seamward resource was not found in this workspace.",
+        remote_conflict: "The remote operation conflicts with current Seamward state.",
+        rate_limited: "The Seamward API rate limit was reached. Retry after a delay.",
+        service_unavailable: "The Seamward API is temporarily unavailable. Retry later.",
+        remote_request_failed: "The Seamward API request failed. Verify access and retry.",
+        remote_response_invalid: "The Seamward API returned an invalid response.",
+        plan_conflict: "The saved plan no longer matches the requested action.",
+        internal_error: "The local setup operation failed.",
+    };
+    const structuredContent = setupMcpErrorOutputSchema.parse({
+        schemaVersion: setupMcpSchemaVersion,
+        error: {
+            code,
+            retryable: setupMcpErrorRecovery[code].retryable,
+            message: messages[code] ?? messages.internal_error,
+            recovery: setupMcpErrorRecovery[code].recovery,
+        },
+    });
+    return {
+        isError: true,
+        content: [
+            { type: "text", text: JSON.stringify(structuredContent) },
+        ],
+        structuredContent,
+    };
+}
+export function setupApiErrorCode(status, body) {
+    const remoteCode = body && typeof body === "object" && !Array.isArray(body)
+        ? body.error
+        : undefined;
+    if (status === 401)
+        return "authentication_required";
+    if (status === 403)
+        return "insufficient_scope";
+    if (status === 404)
+        return "not_found";
+    if (status === 409) {
+        if (remoteCode === "setup_preview_stale" ||
+            remoteCode === "idempotency_conflict" ||
+            remoteCode === "apply_in_progress" ||
+            remoteCode === "integration_mapping_required" ||
+            remoteCode === "integration_scope_mismatch") {
+            return remoteCode;
+        }
+        return "remote_conflict";
+    }
+    if (status === 429)
+        return "rate_limited";
+    if (status >= 500)
+        return "service_unavailable";
+    return "remote_request_failed";
+}
+function definition(name) {
+    const found = [
+        ...setupMcpToolDefinitions,
+        ...legacySetupMcpToolDefinitions,
+    ].find((tool) => tool.name === name);
+    if (!found)
+        throw new Error("Unknown local setup MCP tool");
+    return found;
+}
+function config(name, inputSchema) {
+    const tool = definition(name);
+    return {
+        title: tool.title,
+        description: tool.description,
+        inputSchema,
+        outputSchema: tool.outputSchema,
+        annotations: toolAnnotations(tool.readOnly, tool.destructive, tool.idempotent, tool.openWorld),
+    };
+}
+function approvalFingerprint(value) {
+    return `sha256:${createHash("sha256").update(JSON.stringify(value)).digest("hex")}`;
+}
+const approvalPreviewTtlMs = 5 * 60 * 1000;
+const maximumApprovalPreviews = 100;
+function storeApprovalPreview(previews, fingerprint, value) {
+    const now = Date.now();
+    for (const [key, preview] of previews) {
+        if (preview.expiresAt <= now)
+            previews.delete(key);
+    }
+    while (previews.size >= maximumApprovalPreviews) {
+        const oldest = previews.keys().next().value;
+        if (!oldest)
+            break;
+        previews.delete(oldest);
+    }
+    previews.set(fingerprint, { value, expiresAt: now + approvalPreviewTtlMs });
+}
+function readApprovalPreview(previews, fingerprint) {
+    const preview = previews.get(fingerprint);
+    if (!preview)
+        return undefined;
+    if (preview.expiresAt <= Date.now()) {
+        previews.delete(fingerprint);
+        return undefined;
+    }
+    return preview.value;
+}
+export async function createSeamwardSetupMcpServer({ root, engine: suppliedEngine, credentialProvider, env = (name) => process.env[name], fetchFn = fetch, legacyTools = false, }) {
+    const engine = suppliedEngine ?? (await createLocalSetupEngine({ root }));
+    const server = new McpServer({ name: "seamward-setup", version: setupMcpVersion }, {
+        instructions: "When the user asks to set up Seamward, analyze the configured backend service and infer its supported HTTP API, webhook, queue, and scheduled-feed boundaries and contract candidates. Do not assume a provider, protocol, operation, or contract. If one setup is unambiguous, prepare it automatically. If several are valid, present concise plain-language choices. Preview all local effects before one local change approval, run repository verification as part of the approved apply, preview any remote contract effect before one remote connection approval, then check status read-only. Keep file selection mechanics and protocol identifiers internal unless explaining a genuine ambiguity. Never ask the user to copy internal values. Never read or edit environment files.",
+    });
+    const contractPreviews = new Map();
+    const activationPreviews = new Map();
+    let activePlan = null;
+    let activeSetups = [];
+    let retiredSetups = [];
+    let localRemovalOnlyComplete = false;
+    let reviewedIntegrationMappings = new Map();
+    let pendingRemote = null;
+    let pendingRemoteSet = [];
+    let pendingProvisioning = null;
+    const currentPlan = async () => activePlan ?? readSetupPlan(root);
+    const setupIdForPlan = (plan) => plan.setupId ??
+        `default-${createHash("sha256")
+            .update(plan.fingerprint)
+            .digest("hex")
+            .slice(0, 16)}`;
+    const requestSetupApi = async ({ apiKey, body, endpoint, idempotencyKey, pathname, schema, }) => {
+        const base = (endpoint ?? "https://api.seamward.com").replace(/\/$/, "");
+        const response = await fetchFn(`${base}${pathname}`, {
+            body: JSON.stringify(body),
+            headers: {
+                authorization: `Bearer ${apiKey}`,
+                "content-type": "application/json",
+                ...(idempotencyKey ? { "idempotency-key": idempotencyKey } : {}),
+            },
+            method: "POST",
+        });
+        const responseBody = await response.json().catch(() => null);
+        if (!response.ok) {
+            throw new SetupMcpOperationError(setupApiErrorCode(response.status, responseBody));
+        }
+        const parsed = schema.safeParse(responseBody);
+        if (!parsed.success)
+            throw new SetupMcpOperationError("remote_response_invalid");
+        return parsed.data;
+    };
+    const credentialsForPlan = async (plan, setupName) => {
+        if (credentialProvider) {
+            const credential = await credentialProvider();
+            if (!credential.integrations || credential.integrations.length === 0) {
+                if (!credential.connectionKey) {
+                    throw new SetupMcpOperationError("integration_mapping_required");
+                }
+                return { ...credential, connectionKey: credential.connectionKey };
+            }
+            const scopeMatches = credential.integrations.filter(({ direction, protocol }) => direction === plan.integrationScope?.direction &&
+                protocol === plan.integrationScope.protocol);
+            const reviewedIntegrationId = plan.setupId
+                ? (reviewedIntegrationMappings.get(plan.setupId) ??
+                    (await inspectSetupIntegrationBinding(plan, root)) ??
+                    undefined)
+                : undefined;
+            if (reviewedIntegrationId) {
+                const reviewed = scopeMatches.find(({ id }) => id === reviewedIntegrationId);
+                if (!reviewed) {
+                    throw new SetupMcpOperationError("integration_mapping_required");
+                }
+                return {
+                    ...credential,
+                    connectionKey: reviewed.connectionKey,
+                    integrationId: reviewed.id,
+                };
+            }
+            const tokens = (setupName ?? plan.setupId ?? "")
+                .toLowerCase()
+                .split(/[^a-z0-9]+/)
+                .filter((token) => token.length > 2 &&
+                !["api", "http", "webhook", "webhooks", "integration"].includes(token));
+            const ranked = scopeMatches
+                .map((integration) => ({
+                integration,
+                score: tokens.filter((token) => `${integration.name} ${integration.provider}`
+                    .toLowerCase()
+                    .includes(token)).length,
+            }))
+                .sort((left, right) => right.score - left.score);
+            const best = ranked[0];
+            const tied = ranked[1]?.score === best?.score;
+            if (!best || tied) {
+                throw new SetupMcpOperationError("integration_mapping_required");
+            }
+            return {
+                ...credential,
+                connectionKey: best.integration.connectionKey,
+                integrationId: best.integration.id,
+            };
+        }
+        const connectionKey = env(plan.connectionKeyEnvironment);
+        const apiKey = env("SEAMWARD_API_KEY");
+        if (!connectionKey || !apiKey) {
+            throw new SetupMcpOperationError("configuration_required");
+        }
+        return {
+            connectionKey,
+            apiKey,
+            endpoint: env("SEAMWARD_MANAGEMENT_API_URL"),
+        };
+    };
+    const integrationCandidatesForPlan = async (plan) => {
+        if (!credentialProvider)
+            return [];
+        const credential = await credentialProvider();
+        return (credential.integrations ?? [])
+            .filter(({ direction, protocol }) => direction === plan.integrationScope?.direction &&
+            protocol === plan.integrationScope.protocol)
+            .map(({ id, name, provider, direction, protocol }) => ({
+            integrationId: id,
+            name,
+            provider,
+            direction,
+            protocol,
+        }));
+    };
+    const deriveDeclaredVersion = async (file) => {
+        const content = await readFile(path.join(root, file), "utf8");
+        try {
+            const document = JSON.parse(content);
+            if (typeof document.info?.version === "string" &&
+                document.info.version.trim()) {
+                return document.info.version.trim();
+            }
+            if (typeof document.$id === "string" && document.$id.trim()) {
+                return document.$id.trim().slice(0, 128);
+            }
+        }
+        catch {
+            const yamlVersion = content.match(/^\s*version:\s*["']?([^\s"']+)/m)?.[1];
+            if (yamlVersion)
+                return yamlVersion.slice(0, 128);
+        }
+        const packageDocument = JSON.parse(await readFile(path.join(root, "package.json"), "utf8"));
+        return typeof packageDocument.version === "string" &&
+            packageDocument.version.trim()
+            ? packageDocument.version.trim().slice(0, 128)
+            : "1.0.0";
+    };
+    const suggestedSetupIdentity = async ({ name, plan, }) => {
+        const contractFile = plan.actions.find(({ type, file }) => type === "register_contract" && file)?.file;
+        let suggestedName = name;
+        if (contractFile) {
+            try {
+                const document = JSON.parse(await readFile(path.join(root, contractFile), "utf8"));
+                if (typeof document.info?.title === "string" &&
+                    document.info.title.trim()) {
+                    suggestedName = document.info.title
+                        .trim()
+                        .replace(/\s+(?:api|provider|webhooks?)$/i, "");
+                }
+            }
+            catch {
+                // Invalid contract content is reported by the contract preview later.
+            }
+        }
+        let provider = suggestedName;
+        const outboundTarget = plan.actions.find(({ direction, targetHint }) => direction === "outbound" && targetHint)?.targetHint;
+        if (outboundTarget) {
+            try {
+                const hostname = new URL(outboundTarget).hostname
+                    .replace(/^www\./, "")
+                    .split(".")[0];
+                if (hostname) {
+                    provider = hostname
+                        .split(/[-_]+/)
+                        .filter(Boolean)
+                        .map((part) => `${part[0]?.toUpperCase()}${part.slice(1)}`)
+                        .join(" ");
+                }
+            }
+            catch {
+                // Non-URL target hints keep the contract-derived provider name.
+            }
+        }
+        return { name: suggestedName, provider };
+    };
+    const connectReviewedSetup = async (pending) => {
+        const setupEngine = activeSetups.find(({ plan }) => plan.setupId === pending.plan.setupId)
+            ?.engine ?? engine;
+        const verification = await setupEngine.verify({
+            planFingerprint: pending.plan.fingerprint,
+        });
+        if (!verification.sourceBackedComplete) {
+            throw new SetupMcpOperationError("source_verification_required");
+        }
+        if (verification.stateFingerprint !== pending.reviewedStateFingerprint) {
+            const reconciledContractVersionId = await registeredContractVersionIdForFile(pending.plan, root, pending.file);
+            const reconciledActivation = verification.remoteLifecycle.activation?.contractVersionId;
+            if (!reconciledContractVersionId ||
+                (reconciledActivation !== undefined &&
+                    reconciledActivation !== reconciledContractVersionId)) {
+                throw new SetupMcpOperationError("setup_state_conflict");
+            }
+            pending.reviewedStateFingerprint = verification.stateFingerprint;
+        }
+        const credentials = await credentialsForPlan(pending.plan, pending.name);
+        if ("integrationId" in credentials &&
+            credentials.integrationId &&
+            credentials.integrationId !== pending.integrationId) {
+            throw new SetupMcpOperationError("setup_state_conflict");
+        }
+        if (pending.existingActiveContractVersionId) {
+            await reconcileActivePlanContract(pending.plan, root, {
+                apiKey: credentials.apiKey,
+                connectionKey: credentials.connectionKey,
+                contractVersionId: pending.existingActiveContractVersionId,
+                declaredVersion: pending.declaredVersion,
+                endpoint: credentials.endpoint,
+                file: pending.file,
+                fetchFn,
+            });
+            return {
+                status: "already_connected",
+                contractStatus: "active",
+            };
+        }
+        let contractVersionId = await registeredContractVersionIdForFile(pending.plan, root, pending.file);
+        if (!contractVersionId) {
+            const registered = await registerPlanContracts(pending.plan, root, {
+                apiKey: credentials.apiKey,
+                connectionKey: credentials.connectionKey,
+                declaredVersion: pending.declaredVersion,
+                file: pending.file,
+                endpoint: credentials.endpoint,
+                fetchFn,
+                writeCompletion: true,
+            });
+            contractVersionId = registered.registered[0]?.contractVersionId ?? null;
+        }
+        if (!contractVersionId) {
+            return {
+                status: "partially_connected",
+                contractStatus: "draft",
+            };
+        }
+        const status = await readContractStatus({
+            apiKey: credentials.apiKey,
+            connectionKey: credentials.connectionKey,
+            endpoint: credentials.endpoint,
+            fetchFn,
+        });
+        const activation = await previewPlanContractActivation(pending.plan, root, status, { contractVersionId, reason: "promote" });
+        await activatePlanContractVersion(pending.plan, root, activation, {
+            apiKey: credentials.apiKey,
+            connectionKey: credentials.connectionKey,
+            endpoint: credentials.endpoint,
+            fetchFn,
+        });
+        return {
+            status: activation.reconcile
+                ? "already_connected"
+                : "connected",
+            contractStatus: "active",
+        };
+    };
+    if (!legacyTools) {
+        const prepareInput = setupMcpInputSchemas.prepare_setup;
+        server.registerTool("prepare_setup", config("prepare_setup", prepareInput), async (input) => {
+            try {
+                const parsed = prepareInput.parse(input);
+                const analysis = await engine.analyze();
+                const groups = discoverIntegrationGroups(analysis.discovery);
+                const automaticGroups = groups.filter(isAutomaticIntegrationGroup);
+                const savedPlans = suppliedEngine ? [] : await readSetupPlans(root);
+                const automaticSetupIds = new Set(automaticGroups.map(({ id }) => id));
+                retiredSetups = savedPlans.filter(({ setupId }) => setupId && !automaticSetupIds.has(setupId));
+                localRemovalOnlyComplete = false;
+                const requestedSetupIds = new Set([
+                    ...parsed.includeSetupIds,
+                    ...parsed.excludeSetupIds,
+                ]);
+                if ([...requestedSetupIds].some((setupId) => !automaticGroups.some((group) => group.id === setupId))) {
+                    throw new SetupMcpOperationError("invalid_input");
+                }
+                const selectedAutomaticGroups = automaticGroups.filter(({ id }) => (parsed.includeSetupIds.length === 0 ||
+                    parsed.includeSetupIds.includes(id)) &&
+                    !parsed.excludeSetupIds.includes(id));
+                if (automaticGroups.length > 0 &&
+                    selectedAutomaticGroups.length === 0) {
+                    throw new SetupMcpOperationError("no_matching_actions");
+                }
+                if (!suppliedEngine &&
+                    !parsed.direction &&
+                    (groups.length > 1 || savedPlans.length > 0) &&
+                    (selectedAutomaticGroups.length > 0 || retiredSetups.length > 0)) {
+                    const plannedSetups = await Promise.all(selectedAutomaticGroups.map(async (group) => {
+                        const groupEngine = await createLocalSetupEngine({
+                            root,
+                            setupId: group.id,
+                        });
+                        const planned = await groupEngine.plan({
+                            ...group.scope,
+                            findingIds: group.findingIds,
+                            contractFiles: group.contractFiles,
+                        });
+                        return {
+                            engine: groupEngine,
+                            name: group.name,
+                            plan: planned.plan,
+                        };
+                    }));
+                    const manual = plannedSetups.flatMap(({ name, plan }) => plan.actions.some(({ type, mode }) => type === "instrument_operation" && mode === "manual")
+                        ? [`${name} requires a manual collector adapter.`]
+                        : []);
+                    if (manual.length > 0) {
+                        return result("prepare_setup", {
+                            status: "manual_required",
+                            summary: "Seamward cannot safely automate every discovered integration boundary.",
+                            reasons: manual,
+                        });
+                    }
+                    activeSetups = plannedSetups;
+                    activePlan = null;
+                    pendingRemote = null;
+                    pendingRemoteSet = [];
+                    const removedGroups = retiredSetups.map((plan) => ({
+                        setupId: plan.setupId,
+                        files: [
+                            ...plan.generatedFiles.map(({ path: file }) => file),
+                            `.seamward/integrations/${plan.setupId}`,
+                        ],
+                        remoteAction: "left_active",
+                    }));
+                    return result("prepare_setup", {
+                        status: "ready",
+                        summary: `Seamward prepared ${selectedAutomaticGroups.length} current Integration binding${selectedAutomaticGroups.length === 1 ? "" : "s"} and ${retiredSetups.length} removed binding${retiredSetups.length === 1 ? "" : "s"} for review. Removed bindings are cleaned up locally; their remote Integrations remain active.`,
+                        ...(selectedAutomaticGroups.length > 0
+                            ? {
+                                groups: selectedAutomaticGroups.map((group) => ({
+                                    setupId: group.id,
+                                    name: group.name,
+                                    scope: group.scope,
+                                    operationCount: group.findingIds.length,
+                                    contractFiles: group.contractFiles,
+                                    confidence: group.confidence,
+                                    requiredEnvironment: plannedSetups.find(({ plan }) => plan.setupId === group.id)?.plan.requiredEnvironment,
+                                })),
+                            }
+                            : {}),
+                        ...(removedGroups.length > 0 ? { removedGroups } : {}),
+                        proposedChanges: [
+                            ...plannedSetups.flatMap(({ name, plan }) => [
+                                ...plan.generatedFiles.map(({ path: file }) => ({
+                                    file,
+                                    kind: "generated",
+                                    description: `Create the collector binding for ${name}.`,
+                                })),
+                                ...plan.actions.flatMap((action) => action.type === "instrument_operation" &&
+                                    action.file &&
+                                    action.line &&
+                                    action.direction &&
+                                    action.operationKind
+                                    ? [
+                                        {
+                                            file: action.file,
+                                            kind: "source",
+                                            operationLabel: `${name}: ${action.operationKind.replaceAll("_", " ")} at line ${action.line}`,
+                                            line: action.line,
+                                            direction: action.direction,
+                                            operationKind: action.operationKind,
+                                            adapter: action.adapter,
+                                            description: `Instrument this boundary for ${name} with ${action.adapter}.`,
+                                        },
+                                    ]
+                                    : []),
+                                ...plan.actions.flatMap((action) => action.type === "register_contract" && action.file
+                                    ? [
+                                        {
+                                            file: action.file,
+                                            kind: "contract",
+                                            description: `Connect this contract to ${name}.`,
+                                        },
+                                    ]
+                                    : []),
+                            ]),
+                            ...removedGroups.flatMap(({ setupId, files }) => files.map((file) => ({
+                                file,
+                                kind: "removal",
+                                description: `Remove local setup state for the deleted ${setupId} boundary. The remote Integration remains active.`,
+                            }))),
+                        ],
+                    });
+                }
+                const scopes = analysis.integrationScopes;
+                if (scopes.length === 0) {
+                    return result("prepare_setup", {
+                        status: "manual_required",
+                        summary: "No supported integration boundary was found in this service.",
+                        reasons: [
+                            "Add or identify a supported HTTP, webhook, queue, or scheduled-feed boundary.",
+                        ],
+                    });
+                }
+                if (!parsed.direction && scopes.length > 1) {
+                    return result("prepare_setup", {
+                        status: "needs_input",
+                        summary: "Choose the integration boundary Seamward should configure.",
+                        choices: scopes,
+                        contractChoices: analysis.discovery.contracts.map(({ file }) => file),
+                    });
+                }
+                const selectedScope = parsed.direction
+                    ? { direction: parsed.direction, protocol: parsed.protocol }
+                    : scopes[0];
+                const automaticScopeSupported = (selectedScope.direction === "outbound" &&
+                    selectedScope.protocol === "http-api") ||
+                    (selectedScope.direction === "inbound" &&
+                        selectedScope.protocol === "http-webhook");
+                if (!automaticScopeSupported) {
+                    return result("prepare_setup", {
+                        status: "manual_required",
+                        summary: "This integration boundary was discovered, but automatic local setup is not available for it.",
+                        reasons: [
+                            `${selectedScope.direction} ${selectedScope.protocol} automatic instrumentation is not shipped. Use the manual integration guide for this boundary.`,
+                        ],
+                    });
+                }
+                const discoveredContracts = analysis.discovery.contracts.map(({ file }) => file);
+                if (parsed.contractFiles.length > 1) {
+                    return result("prepare_setup", {
+                        status: "needs_input",
+                        summary: "Choose one contract for this setup lifecycle. Connect additional contracts through separate reviewed setup runs.",
+                        choices: [selectedScope],
+                        contractChoices: parsed.contractFiles,
+                    });
+                }
+                if (parsed.contractFiles.length === 0 &&
+                    discoveredContracts.length > 1) {
+                    return result("prepare_setup", {
+                        status: "needs_input",
+                        summary: "Choose the contract that belongs to this integration.",
+                        choices: [selectedScope],
+                        contractChoices: discoveredContracts,
+                    });
+                }
+                const contractFiles = parsed.contractFiles.length > 0
+                    ? parsed.contractFiles
+                    : discoveredContracts.length === 1
+                        ? discoveredContracts
+                        : [];
+                const selectedContracts = analysis.discovery.contracts.filter(({ file }) => contractFiles.includes(file));
+                if (selectedContracts.some(({ format }) => format === "json_schema")) {
+                    return result("prepare_setup", {
+                        status: "manual_required",
+                        summary: "The integration boundary is supported, but its JSON Schema contract needs a reviewed operation binding.",
+                        reasons: [
+                            "JSON Schema operation binding is not available in automatic setup. Use the manual contract setup guide.",
+                        ],
+                    });
+                }
+                const planned = await engine.plan({
+                    ...selectedScope,
+                    contractFiles,
+                });
+                const manualActions = planned.plan.actions.filter(({ type, mode }) => type === "instrument_operation" && mode === "manual");
+                const unsupportedAutomaticActions = planned.plan.actions.filter((action) => action.type === "instrument_operation" &&
+                    action.mode !== "manual" &&
+                    action.operationKind !== "http_client" &&
+                    action.operationKind !== "webhook_handler");
+                if (planned.plan.install === null ||
+                    manualActions.length > 0 ||
+                    unsupportedAutomaticActions.length > 0) {
+                    return result("prepare_setup", {
+                        status: "manual_required",
+                        summary: "This service shape is not supported for automatic local setup.",
+                        reasons: unsupportedAutomaticActions.length
+                            ? [
+                                `${selectedScope.direction} ${selectedScope.protocol} automatic instrumentation is not shipped. Use the manual integration guide for this boundary.`,
+                            ]
+                            : manualActions.length
+                                ? [
+                                    "One or more operations require a manually implemented collector adapter.",
+                                ]
+                                : [
+                                    "Automatic setup currently supports Node.js TypeScript and JavaScript services.",
+                                ],
+                    });
+                }
+                const proposedSourceActions = planned.plan.actions.filter((action) => action.type === "instrument_operation" &&
+                    typeof action.file === "string" &&
+                    typeof action.line === "number" &&
+                    typeof action.direction === "string" &&
+                    typeof action.operationKind === "string");
+                activePlan = planned.plan;
+                activeSetups = [];
+                pendingRemote = null;
+                pendingRemoteSet = [];
+                return result("prepare_setup", {
+                    status: "ready",
+                    summary: `Seamward found ${planned.plan.discovery.findings.length} operation${planned.plan.discovery.findings.length === 1 ? "" : "s"} for one ${selectedScope.direction} ${selectedScope.protocol} integration.`,
+                    scope: selectedScope,
+                    proposedChanges: [
+                        ...planned.plan.generatedFiles.map(({ path: file }) => ({
+                            file,
+                            kind: "generated",
+                            description: "Create the collector bootstrap.",
+                        })),
+                        ...proposedSourceActions.map((action) => {
+                            const operationNumber = proposedSourceActions
+                                .filter((candidate) => candidate.file === action.file)
+                                .findIndex((candidate) => candidate.id === action.id) + 1;
+                            const readableKind = action.operationKind.replaceAll("_", " ");
+                            const operationLabel = `Operation ${operationNumber}: ${action.direction} ${readableKind} at line ${action.line}`;
+                            return {
+                                file: action.file,
+                                kind: "source",
+                                operationLabel,
+                                line: action.line,
+                                direction: action.direction,
+                                operationKind: action.operationKind,
+                                adapter: action.adapter,
+                                description: `${operationLabel}. Wrap this boundary with ${action.adapter}.`,
+                            };
+                        }),
+                        ...(planned.plan.install
+                            ? [
+                                {
+                                    file: "package.json",
+                                    kind: "dependency",
+                                    description: `Use ${planned.plan.install.package}.`,
+                                },
+                            ]
+                            : []),
+                        ...contractFiles.map((file) => ({
+                            file,
+                            kind: "contract",
+                            description: "Register this reviewed contract during remote connection.",
+                        })),
+                    ],
+                });
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        const applyLocalInput = setupMcpInputSchemas.apply_local_setup;
+        server.registerTool("apply_local_setup", config("apply_local_setup", applyLocalInput), async (input) => {
+            try {
+                applyLocalInput.parse(input);
+                if (activeSetups.length > 0 || retiredSetups.length > 0) {
+                    const applied = await applyLocalSetupBatch(root, activeSetups, retiredSetups);
+                    const groups = applied.applied.map(({ setupId, result: appliedResult }) => ({
+                        setupId: setupId,
+                        status: "verified",
+                        files: appliedResult.files,
+                    }));
+                    const retiredGroups = applied.retired;
+                    localRemovalOnlyComplete =
+                        groups.length === 0 && retiredGroups.length > 0;
+                    retiredSetups = [];
+                    return result("apply_local_setup", {
+                        status: "verified",
+                        summary: `Verified ${groups.length} current Integration binding${groups.length === 1 ? "" : "s"} and retired ${retiredGroups.length} removed local binding${retiredGroups.length === 1 ? "" : "s"}. Remote Integrations were left active.`,
+                        files: [
+                            ...new Set([
+                                ...groups.flatMap(({ files }) => files),
+                                ...retiredGroups.flatMap(({ files }) => files),
+                            ]),
+                        ],
+                        ...(groups.length > 0 ? { groups } : {}),
+                        ...(retiredGroups.length > 0 ? { retiredGroups } : {}),
+                        localSetupComplete: true,
+                    });
+                }
+                const plan = await currentPlan();
+                activePlan = plan;
+                const applied = await engine.applyLocal({
+                    planFingerprint: plan.fingerprint,
+                });
+                if (applied.status === "source_changes_required") {
+                    return result("apply_local_setup", {
+                        status: "manual_required",
+                        summary: "Automatic setup could not safely transform every reviewed operation. No local changes were kept. Use the manual integration guide or adjust the unsupported code shape before preparing setup again.",
+                        reasons: applied.sourceChanges.map((change) => `${change.file}:${change.line} cannot be transformed automatically with ${change.adapter}.`),
+                        localSetupComplete: false,
+                    });
+                }
+                return result("apply_local_setup", {
+                    status: "verified",
+                    summary: "Local Seamward setup is source-verified and ready for remote connection review.",
+                    files: applied.files,
+                    localSetupComplete: true,
+                });
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        const reviewRemoteInput = setupMcpInputSchemas.review_remote_setup;
+        server.registerTool("review_remote_setup", config("review_remote_setup", reviewRemoteInput), async (input) => {
+            try {
+                const parsed = reviewRemoteInput.parse(input);
+                if (localRemovalOnlyComplete) {
+                    return result("review_remote_setup", {
+                        status: "not_applicable",
+                        summary: "Removed local bindings are retired. Their remote Seamward Integrations remain active and no remote write is required.",
+                    });
+                }
+                const provisioningCredential = credentialProvider
+                    ? await credentialProvider()
+                    : null;
+                if (provisioningCredential?.collectorSourceId) {
+                    if (parsed.contractFile || parsed.declaredVersion) {
+                        throw new SetupMcpOperationError("invalid_input");
+                    }
+                    const sourceSetups = activeSetups.length > 0
+                        ? activeSetups.map((setup) => ({
+                            ...setup,
+                            setupId: setupIdForPlan(setup.plan),
+                        }))
+                        : [
+                            await (async () => {
+                                const plan = await currentPlan();
+                                return {
+                                    engine,
+                                    name: plan.projectName,
+                                    plan,
+                                    setupId: setupIdForPlan(plan),
+                                };
+                            })(),
+                        ];
+                    const sourceSetupIds = new Set(sourceSetups.map(({ setupId }) => setupId));
+                    if (parsed.integrationProposals.some(({ setupId }, index) => !sourceSetupIds.has(setupId) ||
+                        parsed.integrationProposals.findIndex((candidate) => candidate.setupId === setupId) !== index)) {
+                        throw new SetupMcpOperationError("invalid_input");
+                    }
+                    const proposalOverrides = new Map(parsed.integrationProposals.map((proposal) => [
+                        proposal.setupId,
+                        proposal,
+                    ]));
+                    const reviewedStateFingerprints = new Map();
+                    for (const setup of sourceSetups) {
+                        const verification = await setup.engine.verify({
+                            planFingerprint: setup.plan.fingerprint,
+                        });
+                        if (!verification.sourceBackedComplete) {
+                            return result("review_remote_setup", {
+                                status: "blocked",
+                                summary: "Finish and verify every local integration before connecting remotely.",
+                                blockers: verification.blockers.map(({ code }) => code),
+                            });
+                        }
+                        reviewedStateFingerprints.set(setup.setupId, verification.stateFingerprint);
+                    }
+                    const proposals = await Promise.all(sourceSetups.map(async (setup) => {
+                        const override = proposalOverrides.get(setup.setupId);
+                        const scope = setup.plan.integrationScope;
+                        if (!scope)
+                            throw new SetupMcpOperationError("integration_scope_mismatch");
+                        const suggestion = await suggestedSetupIdentity(setup);
+                        const proposedName = override?.name ?? suggestion.name;
+                        const matchingExisting = (provisioningCredential.integrations ?? []).filter((integration) => integration.direction === scope.direction &&
+                            integration.protocol === scope.protocol &&
+                            integration.name.trim().toLocaleLowerCase("en-US") ===
+                                proposedName.trim().toLocaleLowerCase("en-US"));
+                        const preferredIntegrationId = override?.preferredIntegrationId ??
+                            (matchingExisting.length === 1
+                                ? matchingExisting[0].id
+                                : undefined);
+                        const matchedProvider = preferredIntegrationId
+                            ? matchingExisting.find(({ id }) => id === preferredIntegrationId)?.provider
+                            : undefined;
+                        return {
+                            direction: scope.direction,
+                            name: proposedName,
+                            ...(preferredIntegrationId ? { preferredIntegrationId } : {}),
+                            protocol: scope.protocol,
+                            provider: override?.provider ??
+                                matchedProvider ??
+                                suggestion.provider,
+                            setupId: setup.setupId,
+                        };
+                    }));
+                    const preview = await requestSetupApi({
+                        apiKey: provisioningCredential.apiKey,
+                        body: { proposals },
+                        endpoint: provisioningCredential.endpoint,
+                        pathname: "/v1/setup/integrations/preview",
+                        schema: integrationPreviewResponseSchema,
+                    });
+                    pendingProvisioning = {
+                        collectorSourceId: provisioningCredential.collectorSourceId,
+                        effects: preview.effects,
+                        fingerprint: preview.fingerprint,
+                        operationId: preview.operationId,
+                        setups: sourceSetups.map((setup) => ({
+                            ...setup,
+                            reviewedStateFingerprint: reviewedStateFingerprints.get(setup.setupId),
+                        })),
+                    };
+                    pendingRemote = null;
+                    pendingRemoteSet = [];
+                    const effectsBySetupId = new Map(preview.effects.map((effect) => [effect.setupId, effect]));
+                    return result("review_remote_setup", {
+                        status: "ready",
+                        summary: `Review the detected Seamward Integration effects for all ${sourceSetups.length} boundaries. You can edit the proposed name, provider, or preferred existing Integration before reviewing again.`,
+                        effects: preview.effects.flatMap((effect) => [
+                            `${effect.action === "create" ? "Create" : "Reuse"} ${effect.name} for ${effect.direction} ${effect.protocol}`,
+                            ...(sourceSetups
+                                .find(({ setupId }) => setupId === effect.setupId)
+                                ?.plan.actions.some(({ type }) => type === "register_contract")
+                                ? [
+                                    `${effect.name}: register and activate the reviewed contract after the Integration is available`,
+                                ]
+                                : []),
+                        ]),
+                        groups: sourceSetups.map((setup) => {
+                            const effect = effectsBySetupId.get(setup.setupId);
+                            if (!effect)
+                                throw new SetupMcpOperationError("remote_response_invalid");
+                            const contractFile = setup.plan.actions.find(({ type, file }) => type === "register_contract" && file)?.file;
+                            return {
+                                action: effect.action,
+                                direction: effect.direction,
+                                effects: [
+                                    effect.action === "create"
+                                        ? "Create this Integration in the selected application environment"
+                                        : "Reuse this existing Integration",
+                                    ...(contractFile
+                                        ? [
+                                            "Register and activate the reviewed contract after the Integration is available",
+                                        ]
+                                        : []),
+                                ],
+                                integrationId: effect.integrationId,
+                                name: effect.name,
+                                protocol: effect.protocol,
+                                provider: effect.provider,
+                                setupId: effect.setupId,
+                                ...(contractFile ? { contractFile } : {}),
+                            };
+                        }),
+                    });
+                }
+                if (activeSetups.length > 0) {
+                    if (parsed.contractFile || parsed.declaredVersion) {
+                        throw new SetupMcpOperationError("invalid_input");
+                    }
+                    const setupIds = new Set(activeSetups.map(({ plan }) => plan.setupId));
+                    if (parsed.integrationMappings.some(({ setupId }, index) => !setupIds.has(setupId) ||
+                        parsed.integrationMappings.findIndex((candidate) => candidate.setupId === setupId) !== index)) {
+                        throw new SetupMcpOperationError("invalid_input");
+                    }
+                    reviewedIntegrationMappings = new Map(parsed.integrationMappings.map(({ setupId, integrationId }) => [
+                        setupId,
+                        integrationId,
+                    ]));
+                    const integrationChoices = [];
+                    for (const setup of activeSetups) {
+                        try {
+                            await credentialsForPlan(setup.plan, setup.name);
+                        }
+                        catch (error) {
+                            if (error instanceof SetupMcpOperationError &&
+                                error.code === "integration_mapping_required") {
+                                integrationChoices.push({
+                                    setupId: setup.plan.setupId,
+                                    name: setup.name,
+                                    candidates: await integrationCandidatesForPlan(setup.plan),
+                                });
+                                continue;
+                            }
+                            throw error;
+                        }
+                    }
+                    if (integrationChoices.length > 0) {
+                        return result("review_remote_setup", {
+                            status: "needs_input",
+                            summary: "Review which existing Seamward Integration belongs to each discovered boundary.",
+                            integrationChoices,
+                        });
+                    }
+                    const reviewed = [];
+                    const pending = [];
+                    for (const setup of activeSetups) {
+                        const verification = await setup.engine.verify({
+                            planFingerprint: setup.plan.fingerprint,
+                        });
+                        if (!verification.sourceBackedComplete) {
+                            return result("review_remote_setup", {
+                                status: "blocked",
+                                summary: "Finish and verify every local integration before connecting remotely.",
+                                blockers: verification.blockers.map(({ code }) => code),
+                            });
+                        }
+                        const contractFiles = setup.plan.actions.flatMap((action) => action.type === "register_contract" && action.file
+                            ? [action.file]
+                            : []);
+                        const credentials = await credentialsForPlan(setup.plan, setup.name);
+                        if (contractFiles.length === 0) {
+                            reviewed.push({
+                                setupId: setup.plan.setupId,
+                                integrationId: "integrationId" in credentials && credentials.integrationId
+                                    ? credentials.integrationId
+                                    : setup.plan.setupId,
+                                name: setup.name,
+                                effects: [
+                                    "Use this verified collector binding without registering a contract",
+                                ],
+                            });
+                            continue;
+                        }
+                        if (contractFiles.length !== 1) {
+                            return result("review_remote_setup", {
+                                status: "needs_input",
+                                summary: `Choose one contract for ${setup.name}.`,
+                                contractChoices: contractFiles,
+                            });
+                        }
+                        const file = contractFiles[0];
+                        const declaredVersion = await deriveDeclaredVersion(file);
+                        const preview = await previewPlanContract(setup.plan, root, credentials.connectionKey, { file });
+                        const { match: activeMatch } = await readMatchingActivePlanContract(setup.plan, root, {
+                            apiKey: credentials.apiKey,
+                            connectionKey: credentials.connectionKey,
+                            declaredVersion,
+                            endpoint: credentials.endpoint,
+                            file,
+                            fetchFn,
+                        });
+                        const effects = activeMatch
+                            ? [
+                                "Link this exact already-active contract to the reviewed local binding",
+                            ]
+                            : [
+                                "Register one immutable contract draft",
+                                "Activate that reviewed contract for analysis",
+                            ];
+                        reviewed.push({
+                            setupId: setup.plan.setupId,
+                            integrationId: preview.integrationId,
+                            name: setup.name,
+                            contractFile: file,
+                            declaredVersion,
+                            effects,
+                        });
+                        pending.push({
+                            name: setup.name,
+                            integrationId: preview.integrationId,
+                            plan: setup.plan,
+                            file,
+                            declaredVersion,
+                            reviewedStateFingerprint: verification.stateFingerprint,
+                            ...(activeMatch
+                                ? { existingActiveContractVersionId: activeMatch.id }
+                                : {}),
+                        });
+                    }
+                    pendingRemoteSet = pending;
+                    pendingRemote = null;
+                    return result("review_remote_setup", {
+                        status: "ready",
+                        summary: `Review the remote effects for all ${reviewed.length} integrations.`,
+                        effects: reviewed.flatMap(({ name, effects }) => effects.map((effect) => `${name}: ${effect}`)),
+                        groups: reviewed,
+                    });
+                }
+                const plan = await currentPlan();
+                const verification = await engine.verify({
+                    planFingerprint: plan.fingerprint,
+                });
+                if (!verification.sourceBackedComplete) {
+                    return result("review_remote_setup", {
+                        status: "blocked",
+                        summary: "Finish and verify the local source changes before connecting remotely.",
+                        blockers: verification.blockers.map(({ code }) => code),
+                    });
+                }
+                const contractFiles = plan.actions.flatMap((action) => action.type === "register_contract" && action.file
+                    ? [action.file]
+                    : []);
+                if (contractFiles.length === 0) {
+                    return result("review_remote_setup", {
+                        status: "not_applicable",
+                        summary: "This setup has no contract to register. The collector can begin sending observations after its runtime credentials are configured.",
+                    });
+                }
+                if (!parsed.contractFile && contractFiles.length > 1) {
+                    return result("review_remote_setup", {
+                        status: "needs_input",
+                        summary: "Choose the reviewed contract to connect.",
+                        contractChoices: contractFiles,
+                    });
+                }
+                const file = parsed.contractFile ?? contractFiles[0];
+                if (!contractFiles.includes(file)) {
+                    throw new SetupMcpOperationError("invalid_input");
+                }
+                const declaredVersion = parsed.declaredVersion ?? (await deriveDeclaredVersion(file));
+                const { connectionKey, apiKey, endpoint } = await credentialsForPlan(plan);
+                await previewPlanContract(plan, root, connectionKey, { file });
+                const { match: activeMatch } = await readMatchingActivePlanContract(plan, root, {
+                    apiKey,
+                    connectionKey,
+                    declaredVersion,
+                    endpoint,
+                    file,
+                    fetchFn,
+                });
+                pendingRemote = {
+                    plan,
+                    file,
+                    declaredVersion,
+                    reviewedStateFingerprint: verification.stateFingerprint,
+                    ...(activeMatch
+                        ? { existingActiveContractVersionId: activeMatch.id }
+                        : {}),
+                };
+                return result("review_remote_setup", {
+                    status: "ready",
+                    summary: activeMatch
+                        ? `${file} version ${declaredVersion} is already active. Link it to this reviewed local setup without changing the remote contract.`
+                        : `Connect ${file} version ${declaredVersion} to this Seamward integration.`,
+                    contractFile: file,
+                    declaredVersion,
+                    effects: activeMatch
+                        ? [
+                            "Link this exact already-active contract to the reviewed local setup",
+                            "Make no remote contract or activation change",
+                        ]
+                        : [
+                            "Register one immutable contract draft",
+                            "Activate that reviewed contract for analysis",
+                        ],
+                });
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        const connectRemoteInput = setupMcpInputSchemas.connect_remote_setup;
+        server.registerTool("connect_remote_setup", config("connect_remote_setup", connectRemoteInput), async (input) => {
+            try {
+                connectRemoteInput.parse(input);
+                if (pendingProvisioning) {
+                    if (!credentialProvider)
+                        throw new SetupMcpOperationError("configuration_required");
+                    const credential = await credentialProvider();
+                    if (credential.collectorSourceId !==
+                        pendingProvisioning.collectorSourceId) {
+                        throw new SetupMcpOperationError("setup_state_conflict");
+                    }
+                    for (const setup of pendingProvisioning.setups) {
+                        const verification = await setup.engine.verify({
+                            planFingerprint: setup.plan.fingerprint,
+                        });
+                        if (!verification.sourceBackedComplete ||
+                            verification.stateFingerprint !== setup.reviewedStateFingerprint) {
+                            throw new SetupMcpOperationError("setup_state_conflict");
+                        }
+                    }
+                    const applied = await requestSetupApi({
+                        apiKey: credential.apiKey,
+                        body: {
+                            fingerprint: pendingProvisioning.fingerprint,
+                            operationId: pendingProvisioning.operationId,
+                        },
+                        endpoint: credential.endpoint,
+                        idempotencyKey: `${pendingProvisioning.operationId}:${pendingProvisioning.fingerprint.slice(7, 23)}`,
+                        pathname: "/v1/setup/integrations/apply",
+                        schema: integrationApplyResponseSchema,
+                    });
+                    if (applied.operationId !== pendingProvisioning.operationId) {
+                        throw new SetupMcpOperationError("remote_response_invalid");
+                    }
+                    const integrationsBySetupId = new Map(applied.integrations.map((integration) => [
+                        integration.setupId,
+                        integration,
+                    ]));
+                    if (integrationsBySetupId.size !==
+                        pendingProvisioning.setups.length ||
+                        pendingProvisioning.setups.some(({ setupId }) => !integrationsBySetupId.has(setupId))) {
+                        throw new SetupMcpOperationError("remote_response_invalid");
+                    }
+                    reviewedIntegrationMappings = new Map(applied.integrations.map(({ id, setupId }) => [setupId, id]));
+                    const connected = [];
+                    for (const [index, setup] of pendingProvisioning.setups.entries()) {
+                        const integration = integrationsBySetupId.get(setup.setupId);
+                        try {
+                            const contractFiles = setup.plan.actions.flatMap((action) => action.type === "register_contract" && action.file
+                                ? [action.file]
+                                : []);
+                            if (contractFiles.length > 1) {
+                                throw new SetupMcpOperationError("invalid_input");
+                            }
+                            let outcome;
+                            if (contractFiles.length === 0) {
+                                outcome = {
+                                    status: "connected",
+                                    contractStatus: "not_applicable",
+                                };
+                            }
+                            else {
+                                const file = contractFiles[0];
+                                const declaredVersion = await deriveDeclaredVersion(file);
+                                await previewPlanContract(setup.plan, root, integration.connectionKey, { file });
+                                const { match: activeMatch } = await readMatchingActivePlanContract(setup.plan, root, {
+                                    apiKey: credential.apiKey,
+                                    connectionKey: integration.connectionKey,
+                                    declaredVersion,
+                                    endpoint: credential.endpoint,
+                                    file,
+                                    fetchFn,
+                                });
+                                outcome = await connectReviewedSetup({
+                                    declaredVersion,
+                                    ...(activeMatch
+                                        ? { existingActiveContractVersionId: activeMatch.id }
+                                        : {}),
+                                    file,
+                                    integrationId: integration.id,
+                                    name: setup.name,
+                                    plan: setup.plan,
+                                    reviewedStateFingerprint: setup.reviewedStateFingerprint,
+                                });
+                            }
+                            await recordSetupIntegrationBinding(setup.plan, root, integration.id);
+                            connected.push({
+                                contractStatus: outcome.contractStatus,
+                                integrationId: integration.id,
+                                setupId: setup.setupId,
+                                status: outcome.status,
+                            });
+                        }
+                        catch (error) {
+                            const failed = {
+                                contractStatus: "unknown",
+                                errorCode: errorCode(error),
+                                integrationId: integration.id,
+                                setupId: setup.setupId,
+                                status: "failed",
+                            };
+                            const unattempted = pendingProvisioning.setups
+                                .slice(index + 1)
+                                .map((next) => ({
+                                contractStatus: "unknown",
+                                integrationId: integrationsBySetupId.get(next.setupId).id,
+                                setupId: next.setupId,
+                                status: "not_attempted",
+                            }));
+                            return result("connect_remote_setup", {
+                                status: "partially_connected",
+                                summary: "Integration provisioning completed, but one reviewed contract connection failed. Retry this approved operation to reconcile without creating duplicate Integrations.",
+                                contractStatus: "unknown",
+                                groups: [...connected, failed, ...unattempted],
+                            });
+                        }
+                    }
+                    pendingProvisioning = null;
+                    const partiallyConnected = connected.some(({ status }) => status === "partially_connected");
+                    return result("connect_remote_setup", {
+                        status: partiallyConnected ? "partially_connected" : "connected",
+                        summary: partiallyConnected
+                            ? "All Integrations are available, but at least one contract remains a draft."
+                            : `Connected all ${connected.length} detected Integrations.`,
+                        contractStatus: connected.every(({ contractStatus }) => contractStatus === "not_applicable")
+                            ? "not_applicable"
+                            : connected.every(({ contractStatus }) => contractStatus === "active")
+                                ? "active"
+                                : "draft",
+                        groups: connected,
+                    });
+                }
+                if (activeSetups.length > 0) {
+                    const noContract = activeSetups.filter(({ plan }) => !plan.actions.some(({ type }) => type === "register_contract"));
+                    if (pendingRemoteSet.length === 0 &&
+                        noContract.length !== activeSetups.length) {
+                        throw new SetupMcpOperationError("contract_preview_expired");
+                    }
+                    const pendingBySetupId = new Map(pendingRemoteSet.map((pending) => [
+                        pending.plan.setupId,
+                        pending,
+                    ]));
+                    const workItems = [];
+                    for (const setup of activeSetups) {
+                        const pending = pendingBySetupId.get(setup.plan.setupId);
+                        if (pending) {
+                            workItems.push({
+                                kind: "contract",
+                                setup,
+                                pending,
+                                integrationId: pending.integrationId,
+                            });
+                            continue;
+                        }
+                        const credentials = await credentialsForPlan(setup.plan, setup.name);
+                        workItems.push({
+                            kind: "collector",
+                            setup,
+                            integrationId: "integrationId" in credentials && credentials.integrationId
+                                ? credentials.integrationId
+                                : setup.plan.setupId,
+                        });
+                    }
+                    const connected = [];
+                    for (const [index, item] of workItems.entries()) {
+                        try {
+                            const outcome = item.kind === "contract"
+                                ? await connectReviewedSetup(item.pending)
+                                : {
+                                    status: "already_connected",
+                                    contractStatus: "not_applicable",
+                                };
+                            await recordSetupIntegrationBinding(item.setup.plan, root, item.integrationId);
+                            connected.push({
+                                setupId: item.setup.plan.setupId,
+                                integrationId: item.integrationId,
+                                ...outcome,
+                            });
+                        }
+                        catch (error) {
+                            const failed = {
+                                setupId: item.setup.plan.setupId,
+                                integrationId: item.integrationId,
+                                status: "failed",
+                                contractStatus: "unknown",
+                                errorCode: errorCode(error),
+                            };
+                            const unattempted = workItems.slice(index + 1).map((next) => ({
+                                setupId: next.setup.plan.setupId,
+                                integrationId: next.integrationId,
+                                status: "not_attempted",
+                                contractStatus: next.kind === "contract"
+                                    ? "unknown"
+                                    : "not_applicable",
+                            }));
+                            return result("connect_remote_setup", {
+                                status: "partially_connected",
+                                summary: "Remote connection stopped after one Integration failed. Completed Integrations remain recorded; retrying this reviewed batch reconciles them without creating duplicate contract versions.",
+                                contractStatus: "unknown",
+                                groups: [...connected, failed, ...unattempted],
+                            });
+                        }
+                    }
+                    pendingRemoteSet = [];
+                    const partial = connected.some(({ status }) => status === "partially_connected");
+                    return result("connect_remote_setup", {
+                        status: partial ? "partially_connected" : "connected",
+                        summary: partial
+                            ? "Some integrations connected, but at least one contract remains a draft. Review remote setup again before retrying."
+                            : `Connected all ${connected.length} integrations.`,
+                        contractStatus: connected.every(({ contractStatus }) => contractStatus === "not_applicable")
+                            ? "not_applicable"
+                            : connected.every(({ contractStatus }) => contractStatus === "active")
+                                ? "active"
+                                : "draft",
+                        groups: connected,
+                    });
+                }
+                if (!pendingRemote) {
+                    throw new SetupMcpOperationError("contract_preview_expired");
+                }
+                const { plan, file, declaredVersion, reviewedStateFingerprint, existingActiveContractVersionId, } = pendingRemote;
+                const verification = await engine.verify({
+                    planFingerprint: plan.fingerprint,
+                });
+                if (!verification.sourceBackedComplete) {
+                    throw new SetupMcpOperationError("source_verification_required");
+                }
+                if (verification.stateFingerprint !== reviewedStateFingerprint) {
+                    const reconciledContractVersionId = existingActiveContractVersionId
+                        ? await registeredContractVersionIdForFile(plan, root, file)
+                        : null;
+                    const reconciledActivation = verification.remoteLifecycle.activation?.contractVersionId;
+                    const recoverableReconciliation = existingActiveContractVersionId !== undefined &&
+                        reconciledContractVersionId === existingActiveContractVersionId &&
+                        (reconciledActivation === undefined ||
+                            reconciledActivation === existingActiveContractVersionId);
+                    if (!recoverableReconciliation) {
+                        throw new SetupMcpOperationError("setup_state_conflict");
+                    }
+                    pendingRemote.reviewedStateFingerprint =
+                        verification.stateFingerprint;
+                }
+                const { connectionKey, apiKey, endpoint } = await credentialsForPlan(plan);
+                if (existingActiveContractVersionId) {
+                    await reconcileActivePlanContract(plan, root, {
+                        apiKey,
+                        connectionKey,
+                        contractVersionId: existingActiveContractVersionId,
+                        declaredVersion,
+                        endpoint,
+                        file,
+                        fetchFn,
+                    });
+                    pendingRemote = null;
+                    return result("connect_remote_setup", {
+                        status: "already_connected",
+                        summary: "The exact reviewed contract was already active and is now linked to this local setup.",
+                        contractStatus: "active",
+                    });
+                }
+                let contractVersionId = await registeredContractVersionIdForFile(plan, root, file);
+                if (!contractVersionId) {
+                    const registered = await registerPlanContracts(plan, root, {
+                        apiKey,
+                        connectionKey,
+                        declaredVersion,
+                        file,
+                        endpoint,
+                        fetchFn,
+                        writeCompletion: true,
+                    });
+                    contractVersionId =
+                        registered.registered[0]?.contractVersionId ?? null;
+                    if (contractVersionId) {
+                        pendingRemote.reviewedStateFingerprint = (await engine.verify({ planFingerprint: plan.fingerprint })).stateFingerprint;
+                    }
+                }
+                if (!contractVersionId) {
+                    return result("connect_remote_setup", {
+                        status: "partially_connected",
+                        summary: "The contract draft could not be confirmed. Review the remote setup again before retrying.",
+                        contractStatus: "draft",
+                    });
+                }
+                const status = await readContractStatus({
+                    apiKey,
+                    connectionKey,
+                    endpoint,
+                    fetchFn,
+                });
+                const activation = await previewPlanContractActivation(plan, root, status, { contractVersionId, reason: "promote" });
+                const alreadyActive = activation.reconcile;
+                await activatePlanContractVersion(plan, root, activation, {
+                    apiKey,
+                    connectionKey,
+                    endpoint,
+                    fetchFn,
+                });
+                pendingRemote = null;
+                return result("connect_remote_setup", {
+                    status: alreadyActive ? "already_connected" : "connected",
+                    summary: alreadyActive
+                        ? "The reviewed contract was already active and is now reconciled with this local setup."
+                        : "The reviewed contract is registered and active.",
+                    contractStatus: "active",
+                });
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        const statusInput = setupMcpInputSchemas.check_setup_status;
+        server.registerTool("check_setup_status", config("check_setup_status", statusInput), async (input) => {
+            try {
+                statusInput.parse(input);
+                if (activeSetups.length === 0 && activePlan === null) {
+                    const savedPlans = await readSetupPlans(root);
+                    if (savedPlans.length > 0) {
+                        activeSetups = await Promise.all(savedPlans.map(async (plan) => ({
+                            engine: await createLocalSetupEngine({
+                                root,
+                                setupId: plan.setupId,
+                            }),
+                            name: plan.setupId ?? "Integration",
+                            plan,
+                        })));
+                    }
+                }
+                if (activeSetups.length > 0) {
+                    const groups = [];
+                    for (const setup of activeSetups) {
+                        const verification = await setup.engine.verify({
+                            planFingerprint: setup.plan.fingerprint,
+                        });
+                        if (!verification.sourceBackedComplete) {
+                            groups.push({
+                                setupId: setup.plan.setupId,
+                                status: verification.instrumentationActions.some(({ status }) => status === "stale" || status === "missing")
+                                    ? "stale"
+                                    : "local_changes_required",
+                                contractStatus: "missing",
+                                firstObservation: "not_checked",
+                            });
+                            continue;
+                        }
+                        const credentials = await credentialsForPlan(setup.plan, setup.name);
+                        const hasContract = setup.plan.actions.some(({ type }) => type === "register_contract");
+                        let contractStatus = "not_applicable";
+                        if (hasContract) {
+                            const remote = await readContractStatus({
+                                apiKey: credentials.apiKey,
+                                connectionKey: credentials.connectionKey,
+                                endpoint: credentials.endpoint,
+                                fetchFn,
+                            });
+                            contractStatus = remote.activeContractVersionId
+                                ? "active"
+                                : remote.contracts.some(({ lifecycleStatus }) => lifecycleStatus === "draft")
+                                    ? "draft"
+                                    : "missing";
+                            if (contractStatus !== "active" ||
+                                !verification.remoteLifecycle.activation) {
+                                groups.push({
+                                    setupId: setup.plan.setupId,
+                                    status: "ready_to_connect",
+                                    contractStatus,
+                                    firstObservation: "not_checked",
+                                });
+                                continue;
+                            }
+                        }
+                        const observation = await checkFirstSetupObservation(setup.plan, root, {
+                            apiKey: credentials.apiKey,
+                            connectionKey: credentials.connectionKey,
+                            endpoint: credentials.endpoint,
+                            fetchFn,
+                            write: false,
+                        });
+                        const observed = observation.status === "observed";
+                        groups.push({
+                            setupId: setup.plan.setupId,
+                            status: observed
+                                ? "connected"
+                                : "waiting_for_traffic",
+                            contractStatus,
+                            firstObservation: observed
+                                ? "observed"
+                                : "waiting",
+                        });
+                    }
+                    const connected = groups.filter(({ status }) => status === "connected").length;
+                    const overallStatus = connected === groups.length
+                        ? "connected"
+                        : connected > 0
+                            ? "partially_connected"
+                            : groups.some(({ status }) => status === "local_changes_required")
+                                ? "local_changes_required"
+                                : groups.some(({ status }) => status === "stale")
+                                    ? "stale"
+                                    : groups.some(({ status }) => status === "ready_to_connect")
+                                        ? "ready_to_connect"
+                                        : "waiting_for_traffic";
+                    return result("check_setup_status", {
+                        status: overallStatus,
+                        summary: overallStatus === "connected"
+                            ? `All ${groups.length} integrations have accepted traffic.`
+                            : `${connected} of ${groups.length} integrations have accepted traffic.`,
+                        localSetupComplete: groups.every(({ status }) => status !== "local_changes_required" && status !== "stale"),
+                        contractStatus: groups.every(({ contractStatus }) => contractStatus === "not_applicable")
+                            ? "not_applicable"
+                            : groups.every(({ contractStatus }) => contractStatus === "active")
+                                ? "active"
+                                : groups.some(({ contractStatus }) => contractStatus === "draft")
+                                    ? "draft"
+                                    : "missing",
+                        firstObservation: connected === groups.length
+                            ? "observed"
+                            : connected > 0
+                                ? "waiting"
+                                : "not_checked",
+                        groups,
+                    });
+                }
+                let plan;
+                try {
+                    plan = await currentPlan();
+                }
+                catch (error) {
+                    if (error instanceof LocalSetupEngineError &&
+                        error.code === "plan_not_found") {
+                        return result("check_setup_status", {
+                            status: "not_prepared",
+                            summary: "Run the Seamward setup preparation first.",
+                            localSetupComplete: false,
+                            contractStatus: "missing",
+                            firstObservation: "not_checked",
+                        });
+                    }
+                    throw error;
+                }
+                const verification = await engine.verify({
+                    planFingerprint: plan.fingerprint,
+                });
+                if (!verification.sourceBackedComplete) {
+                    const stale = verification.instrumentationActions.some(({ status }) => status === "stale" || status === "missing");
+                    return result("check_setup_status", {
+                        status: stale ? "stale" : "local_changes_required",
+                        summary: stale
+                            ? "Verified source changed after setup. Review and apply the local setup again."
+                            : "Local source instrumentation is not yet verified.",
+                        localSetupComplete: false,
+                        contractStatus: "missing",
+                        firstObservation: "not_checked",
+                    });
+                }
+                const { connectionKey, apiKey, endpoint } = await credentialsForPlan(plan);
+                const contractActions = plan.actions.filter(({ type }) => type === "register_contract");
+                let contractStatus = contractActions.length === 0 ? "not_applicable" : "missing";
+                if (contractActions.length > 0) {
+                    const remote = await readContractStatus({
+                        apiKey,
+                        connectionKey,
+                        endpoint,
+                        fetchFn,
+                    });
+                    contractStatus = remote.activeContractVersionId
+                        ? "active"
+                        : remote.contracts.some(({ lifecycleStatus }) => lifecycleStatus === "draft")
+                            ? "draft"
+                            : "missing";
+                    const recordedActivation = verification.remoteLifecycle.activation?.contractVersionId;
+                    if (recordedActivation &&
+                        recordedActivation !== remote.activeContractVersionId) {
+                        return result("check_setup_status", {
+                            status: "conflict",
+                            summary: "The active remote contract changed after this local setup was connected. Review the remote connection again.",
+                            localSetupComplete: true,
+                            contractStatus,
+                            firstObservation: "not_checked",
+                        });
+                    }
+                    if (contractStatus !== "active") {
+                        return result("check_setup_status", {
+                            status: "ready_to_connect",
+                            summary: "Local setup is verified. Review the remote connection next.",
+                            localSetupComplete: true,
+                            contractStatus,
+                            firstObservation: "not_checked",
+                        });
+                    }
+                    if (!recordedActivation) {
+                        return result("check_setup_status", {
+                            status: "ready_to_connect",
+                            summary: "The active contract is not yet linked to this reviewed local setup. Review the remote connection next.",
+                            localSetupComplete: true,
+                            contractStatus,
+                            firstObservation: "not_checked",
+                        });
+                    }
+                }
+                const observation = await checkFirstSetupObservation(plan, root, {
+                    apiKey,
+                    connectionKey,
+                    endpoint,
+                    fetchFn,
+                    write: false,
+                });
+                if (observation.status === "contract_activation_required") {
+                    return result("check_setup_status", {
+                        status: "ready_to_connect",
+                        summary: "The active contract is not yet linked to this reviewed local setup. Review the remote connection next.",
+                        localSetupComplete: true,
+                        contractStatus,
+                        firstObservation: "not_checked",
+                    });
+                }
+                if (observation.status === "source_verification_required") {
+                    return result("check_setup_status", {
+                        status: "stale",
+                        summary: "Verified source changed after setup. Review and apply the local setup again.",
+                        localSetupComplete: false,
+                        contractStatus,
+                        firstObservation: "not_checked",
+                    });
+                }
+                const observed = observation.status === "observed";
+                return result("check_setup_status", {
+                    status: observed ? "connected" : "waiting_for_traffic",
+                    summary: observed
+                        ? "Seamward has accepted traffic from this reviewed setup."
+                        : "Setup is connected and waiting for the first accepted observation.",
+                    localSetupComplete: true,
+                    contractStatus,
+                    firstObservation: observed ? "observed" : "waiting",
+                });
+            }
+            catch (error) {
+                return errorResult(error);
+            }
+        });
+        server.registerPrompt("setup_seamward_integration", {
+            title: "Set up Seamward in this project",
+            description: "Prepare, apply, connect, and verify one service through two clear trust boundaries.",
+        }, async () => ({
+            messages: [
+                {
+                    role: "user",
+                    content: {
+                        type: "text",
+                        text: "Set up Seamward in this project.",
+                    },
+                },
+            ],
+        }));
+        return server;
+    }
+    const analyzeInput = setupMcpInputSchemas.analyze_repository;
+    server.registerTool("analyze_repository", config("analyze_repository", analyzeInput), async () => {
+        try {
+            return result("analyze_repository", await engine.analyze());
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const previewContractInput = setupMcpInputSchemas.preview_contract_registration;
+    server.registerTool("preview_contract_registration", config("preview_contract_registration", previewContractInput), async (input) => {
+        try {
+            const parsed = previewContractInput.parse(input);
+            const plan = await readSetupPlan(root, parsed.planFingerprint);
+            const connectionKey = env(plan.connectionKeyEnvironment);
+            if (!connectionKey)
+                throw new SetupMcpOperationError("configuration_required");
+            const preview = await previewPlanContract(plan, root, connectionKey, {
+                ...(parsed.file ? { file: parsed.file } : {}),
+                includeExamples: parsed.includeExamples,
+                ...(parsed.jsonSchemaBinding
+                    ? { jsonSchemaBinding: parsed.jsonSchemaBinding }
+                    : {}),
+            });
+            const request = {
+                planFingerprint: parsed.planFingerprint,
+                ...(parsed.file ? { file: parsed.file } : {}),
+                declaredVersion: parsed.declaredVersion,
+                includeExamples: parsed.includeExamples,
+                ...(parsed.jsonSchemaBinding
+                    ? { jsonSchemaBinding: parsed.jsonSchemaBinding }
+                    : {}),
+            };
+            const fingerprint = approvalFingerprint({ request, preview });
+            storeApprovalPreview(contractPreviews, fingerprint, request);
+            return result("preview_contract_registration", {
+                ...preview,
+                approvalFingerprint: fingerprint,
+            });
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const registerContractInput = setupMcpInputSchemas.register_contract;
+    server.registerTool("register_contract", config("register_contract", registerContractInput), async (input) => {
+        try {
+            const parsed = registerContractInput.parse(input);
+            const approved = readApprovalPreview(contractPreviews, parsed.approvalFingerprint);
+            if (!approved)
+                throw new SetupMcpOperationError("contract_preview_expired");
+            contractPreviews.delete(parsed.approvalFingerprint);
+            const plan = await readSetupPlan(root, approved.planFingerprint);
+            const connectionKey = env(plan.connectionKeyEnvironment);
+            const apiKey = env("SEAMWARD_API_KEY");
+            if (!connectionKey || !apiKey) {
+                throw new SetupMcpOperationError("configuration_required");
+            }
+            const registered = await registerPlanContracts(plan, root, {
+                apiKey,
+                connectionKey,
+                declaredVersion: approved.declaredVersion,
+                endpoint: env("SEAMWARD_MANAGEMENT_API_URL"),
+                fetchFn,
+                ...(approved.file ? { file: approved.file } : {}),
+                includeExamples: approved.includeExamples,
+                writeCompletion: true,
+                ...(approved.jsonSchemaBinding
+                    ? { jsonSchemaBinding: approved.jsonSchemaBinding }
+                    : {}),
+            });
+            return result("register_contract", registered);
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const contractStatusForPlan = async (planFingerprint) => {
+        const plan = await readSetupPlan(root, planFingerprint);
+        const connectionKey = env(plan.connectionKeyEnvironment);
+        const apiKey = env("SEAMWARD_API_KEY");
+        if (!connectionKey || !apiKey) {
+            throw new SetupMcpOperationError("configuration_required");
+        }
+        return {
+            plan,
+            connectionKey,
+            status: await readContractStatus({
+                apiKey,
+                connectionKey,
+                endpoint: env("SEAMWARD_MANAGEMENT_API_URL"),
+                fetchFn,
+            }),
+        };
+    };
+    const contractStatusInput = setupMcpInputSchemas.read_contract_status;
+    server.registerTool("read_contract_status", config("read_contract_status", contractStatusInput), async (input) => {
+        try {
+            const parsed = contractStatusInput.parse(input);
+            return result("read_contract_status", (await contractStatusForPlan(parsed.planFingerprint)).status);
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const previewActivationInput = setupMcpInputSchemas.preview_contract_activation;
+    server.registerTool("preview_contract_activation", config("preview_contract_activation", previewActivationInput), async (input) => {
+        try {
+            const parsed = previewActivationInput.parse(input);
+            const { plan, status } = await contractStatusForPlan(parsed.planFingerprint);
+            const request = await previewPlanContractActivation(plan, root, status, {
+                contractVersionId: parsed.contractVersionId,
+                reason: parsed.reason,
+            });
+            const activationFingerprint = approvalFingerprint(request);
+            storeApprovalPreview(activationPreviews, activationFingerprint, request);
+            return result("preview_contract_activation", {
+                ...request,
+                approvalFingerprint: activationFingerprint,
+            });
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const activateInput = setupMcpInputSchemas.activate_contract;
+    server.registerTool("activate_contract", config("activate_contract", activateInput), async (input) => {
+        try {
+            const parsed = activateInput.parse(input);
+            const approved = readApprovalPreview(activationPreviews, parsed.approvalFingerprint);
+            if (!approved)
+                throw new SetupMcpOperationError("contract_preview_expired");
+            activationPreviews.delete(parsed.approvalFingerprint);
+            const plan = await readSetupPlan(root, approved.planFingerprint);
+            const connectionKey = env(plan.connectionKeyEnvironment);
+            const apiKey = env("SEAMWARD_API_KEY");
+            if (!connectionKey || !apiKey) {
+                throw new SetupMcpOperationError("configuration_required");
+            }
+            const activated = await activatePlanContractVersion(plan, root, approved, {
+                apiKey,
+                connectionKey,
+                endpoint: env("SEAMWARD_MANAGEMENT_API_URL"),
+                fetchFn,
+            });
+            return result("activate_contract", activated);
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const observationInput = setupMcpInputSchemas.check_first_observation;
+    server.registerTool("check_first_observation", config("check_first_observation", observationInput), async (input) => {
+        try {
+            const parsed = observationInput.parse(input);
+            const plan = await readSetupPlan(root, parsed.planFingerprint);
+            const connectionKey = env(plan.connectionKeyEnvironment);
+            const apiKey = env("SEAMWARD_API_KEY");
+            if (!connectionKey || !apiKey) {
+                throw new SetupMcpOperationError("configuration_required");
+            }
+            const checked = await checkFirstSetupObservation(plan, root, {
+                apiKey,
+                connectionKey,
+                endpoint: env("SEAMWARD_MANAGEMENT_API_URL"),
+                fetchFn,
+                write: true,
+            });
+            if (checked.status !== "observed")
+                return result("check_first_observation", checked);
+            const { recorded: _recorded, ...publicResult } = checked;
+            return result("check_first_observation", publicResult);
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const planInput = setupMcpInputSchemas.plan_setup;
+    server.registerTool("plan_setup", config("plan_setup", planInput), async (input) => {
+        try {
+            return result("plan_setup", await engine.plan(planInput.parse(input)));
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const applyInput = setupMcpInputSchemas.apply_generated_setup;
+    server.registerTool("apply_generated_setup", config("apply_generated_setup", applyInput), async (input) => {
+        try {
+            return result("apply_generated_setup", await engine.applyGenerated(applyInput.parse(input)));
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const replaceInput = setupMcpInputSchemas.replace_generated_setup;
+    server.registerTool("replace_generated_setup", config("replace_generated_setup", replaceInput), async (input) => {
+        try {
+            return result("replace_generated_setup", await engine.replaceGenerated(replaceInput.parse(input)));
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const evidenceInput = setupMcpInputSchemas.record_setup_evidence;
+    server.registerTool("record_setup_evidence", config("record_setup_evidence", evidenceInput), async (input) => {
+        try {
+            return result("record_setup_evidence", await engine.recordEvidence(evidenceInput.parse(input)));
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    const verifyInput = setupMcpInputSchemas.verify_setup;
+    server.registerTool("verify_setup", config("verify_setup", verifyInput), async (input) => {
+        try {
+            return result("verify_setup", await engine.verify(verifyInput.parse(input)));
+        }
+        catch (error) {
+            return errorResult(error);
+        }
+    });
+    server.registerPrompt("setup_seamward_integration", {
+        title: "Set up Seamward in this service",
+        description: "Safe agent workflow for analyzing, editing, reviewing, and verifying one service.",
+    }, async () => ({
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text: "Analyze this configured service root. Present the proposed integration scope and source edits before changing application files. Use your native workspace editing tools only after approval. Run the project tests with your normal tools. Then record source-backed evidence and verify setup. Do not read or edit environment files. Preview and register contracts only after separate approval, activate a contract only after explicit approval, then check for the first accepted observation.",
+                },
+            },
+        ],
+    }));
+    return server;
+}
+//# sourceMappingURL=server.js.map