@1mcp/agent 0.36.0 → 0.37.0

package/build/domains/admin/adminConfiguredServerService.js

@@ -1,10 +1,13 @@
 import { createHash } from 'node:crypto';
 import { mergeGlobalAndServerConfig } from '../../config/mcpConfigMerge.js';
 import { normalizeDisabledToolsForServer } from '../../core/server/disabledTools.js';
+import { templateRuntimeHash } from '../../core/server/templateIdentity.js';
 import { GLOBAL_TRANSPORT_CONFIG_KEYS, transportConfigSchema, } from '../../core/types/index.js';
 import { fingerprintConfiguredServerConfigDocument, fingerprintConfiguredServerDefaults, fingerprintConfiguredServerSecretValue, fingerprintConfiguredServerTarget, isConfiguredServerTargetDisabled, } from '../../domains/config-change/configChange.js';
 import { createServerInstallationWorkflow, } from '../../domains/installation/serverInstallationWorkflow.js';
+import Handlebars from 'handlebars';
 import { z } from 'zod';
+import { analyzeTemplateServerDefinition, } from './templateServerDefinitionAnalyzer.js';
 const configuredServerCreateSecretSchema = z
     .object({
     fieldPath: z.array(z.string()).min(2),
@@ -17,6 +20,7 @@ const configuredServerCreateSecretSchema = z
     .strict();
 const configuredServerCreateDraftSchema = z
     .object({
+    source: z.enum(['mcpServers', 'mcpTemplates']).optional().default('mcpServers'),
     name: z.string(),
     enabled: z.boolean().optional(),
     tags: z.array(z.string()).optional(),
@@ -35,6 +39,33 @@ const configuredServerCreateDraftSchema = z
         restartOnExit: z.boolean().optional(),
         maxRestarts: z.number().optional(),
         restartDelay: z.number().optional(),
+        disabled: z.union([z.boolean(), z.string()]).optional(),
+        stderr: z.union([z.enum(['inherit', 'ignore', 'overlapped', 'pipe']), z.number().int().min(0)]).optional(),
+        inheritParentEnv: z.boolean().optional(),
+        envFilter: z.array(z.string()).optional(),
+        oauth: z
+            .object({
+            clientId: z.string().optional(),
+            clientSecret: z.string().optional(),
+            scopes: z.array(z.string()).optional(),
+            autoRegister: z.boolean().optional(),
+            redirectUrl: z.string().optional(),
+        })
+            .optional(),
+        template: z
+            .object({
+            shareable: z.boolean().optional(),
+            maxInstances: z.number().min(0).optional(),
+            idleTimeout: z.number().min(0).optional(),
+            perClient: z.boolean().optional(),
+            extractionOptions: z
+                .object({
+                includeOptional: z.boolean().optional(),
+                includeEnvironment: z.boolean().optional(),
+            })
+                .optional(),
+        })
+            .optional(),
     })
         .strict(),
     secrets: z.array(configuredServerCreateSecretSchema).optional(),
@@ -54,6 +85,12 @@ const CONFIGURED_SERVER_CREATE_TRANSPORT_FIELD_KEYS = new Set([
     'restartOnExit',
     'maxRestarts',
     'restartDelay',
+    'disabled',
+    'stderr',
+    'inheritParentEnv',
+    'envFilter',
+    'oauth',
+    'template',
 ]);
 function normalizeConfiguredServerCreateDraft(value) {
     const parsed = configuredServerCreateDraftSchema.safeParse(value);
@@ -70,6 +107,7 @@ function normalizeConfiguredServerCreateDraft(value) {
                 localName: typeof record.name === 'string' ? record.name : '',
                 transport: transportType,
             },
+            targetSource: record.source === 'mcpTemplates' ? 'mcpTemplates' : 'mcpServers',
             validation: {
                 status: 'invalid',
                 errors: parsed.error.issues.map((issue) => ({
@@ -82,6 +120,7 @@ function normalizeConfiguredServerCreateDraft(value) {
     }
     const { transport } = parsed.data;
     const draft = {
+        source: parsed.data.source,
         name: parsed.data.name,
         enabled: parsed.data.enabled,
         tags: parsed.data.tags,
@@ -109,7 +148,7 @@ function normalizeConfiguredServerCreateDraft(value) {
         maxRestarts: transport.maxRestarts,
         restartDelay: transport.restartDelay,
     };
-    return { draft, source, validation: { status: 'valid', errors: [] } };
+    return { draft, source, targetSource: parsed.data.source, validation: { status: 'valid', errors: [] } };
 }
 function configuredServerCreateSecretValues(draft, container) {
     const values = {};
@@ -127,7 +166,7 @@ function mergeConfiguredServerCreateRecord(base, additions) {
     const merged = { ...base, ...additions };
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
-function createWorkflowValidation(workflow, config) {
+function createWorkflowValidation(workflow, config, source = 'mcpServers') {
     const errors = [];
     for (const [field, messages] of Object.entries(workflow.fieldErrors ?? {})) {
         for (const message of messages) {
@@ -149,6 +188,12 @@ function createWorkflowValidation(workflow, config) {
         const parsed = transportConfigSchema.safeParse(config);
         if (!parsed.success) {
             for (const issue of parsed.error.issues) {
+                if (source === 'mcpTemplates' &&
+                    issue.path[0] === 'url' &&
+                    typeof config.url === 'string' &&
+                    config.url.includes('{{')) {
+                    continue;
+                }
                 errors.push({
                     fieldPath: ['transport', ...issue.path.map(String)],
                     code: 'invalid_transport_config',
@@ -199,7 +244,7 @@ function validateConfiguredServerCreateSecrets(draft) {
     return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
 }
 function createConfiguredServerCreateContract() {
-    const transportFields = TRANSPORT_FIELD_DEFINITIONS.filter((definition) => CONFIGURED_SERVER_CREATE_TRANSPORT_FIELD_KEYS.has(definition.key)).map((definition) => ({
+    const transportFields = TRANSPORT_FIELD_DEFINITIONS.filter((definition) => definition.key !== 'template' && CONFIGURED_SERVER_CREATE_TRANSPORT_FIELD_KEYS.has(definition.key)).map((definition) => ({
         fieldPath: ['transport', definition.key],
         label: definition.label,
         control: definition.control,
@@ -234,12 +279,28 @@ function createConfiguredServerCreateContract() {
                 id: 'identity',
                 label: 'Identity',
                 fields: [
+                    {
+                        fieldPath: ['source'],
+                        label: 'Definition Type',
+                        control: 'select',
+                        value: 'mcpServers',
+                        options: ['mcpServers', 'mcpTemplates'],
+                        editable: true,
+                    },
                     { fieldPath: ['name'], label: 'Server Name', control: 'text', editable: true },
-                    { fieldPath: ['enabled'], label: 'Enabled', control: 'switch', value: true, editable: true },
+                    {
+                        fieldPath: ['enabled'],
+                        label: 'Enabled',
+                        control: 'switch',
+                        value: true,
+                        editable: true,
+                        applicableSources: ['mcpServers'],
+                    },
                     { fieldPath: ['tags'], label: 'Tags', control: 'tag-list', value: [], editable: true },
                 ],
             },
             { id: 'transport', label: 'Transport', fields: transportFields },
+            { id: 'template', label: 'Template instances', fields: templateLifecycleFields() },
         ],
     };
 }
@@ -307,7 +368,7 @@ function connectivityFingerprintFacts(connectivityCheck) {
         return connectivityCheck;
     return { status: connectivityCheck.status, mode: connectivityCheck.mode };
 }
-function previewCreateConfigChange(targetName, workflowStatus, changed) {
+function previewCreateConfigChange(targetName, workflowStatus, changed, source = 'mcpServers') {
     const status = workflowStatus === 'template_conflict'
         ? 'template_conflict'
         : workflowStatus === 'exists'
@@ -317,15 +378,17 @@ function previewCreateConfigChange(targetName, workflowStatus, changed) {
                 : 'failed';
     return {
         status,
-        operation: 'create_static',
+        operation: source === 'mcpTemplates' ? 'create_template' : 'create_static',
         configPath: '[redacted]',
         target: {
             name: targetName,
-            ...(workflowStatus === 'template_conflict'
-                ? { source: 'mcpTemplates' }
-                : workflowStatus === 'exists'
-                    ? { source: 'mcpServers' }
-                    : {}),
+            ...(changed
+                ? { source }
+                : workflowStatus === 'template_conflict'
+                    ? { source: 'mcpTemplates' }
+                    : workflowStatus === 'exists'
+                        ? { source: 'mcpServers' }
+                        : {}),
         },
         changed,
         backup: { created: false },
@@ -340,6 +403,11 @@ function createDraftCandidateName(value) {
     const name = value.name;
     return typeof name === 'string' ? name : '';
 }
+function createDraftCandidateSource(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return 'mcpServers';
+    return value.source === 'mcpTemplates' ? 'mcpTemplates' : 'mcpServers';
+}
 function sanitizeCreateConfirmationFacts(facts) {
     if (!facts)
         return undefined;
@@ -396,7 +464,7 @@ export class AdminConfiguredServerService {
         const candidateName = createDraftCandidateName(input.draft);
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: candidateName },
+            target: { type: 'configured_server', id: `${createDraftCandidateSource(input.draft)}/${candidateName}` },
             confirmationFacts: sanitizeCreateConfirmationFacts(input.context.confirmationFacts),
         };
         return this.options.operationService.executeMutation({
@@ -415,7 +483,8 @@ export class AdminConfiguredServerService {
                 if (!prepared.config) {
                     throw new AdminConfiguredServerApplyError('configured_server_create_invalid');
                 }
-                if (prepared.enabled &&
+                if (prepared.targetSource === 'mcpServers' &&
+                    prepared.enabled &&
                     !wouldUseLocalStdioTransport(prepared.config) &&
                     preview.connectivityCheck.status !== 'passed' &&
                     !(preview.connectivityCheck.status === 'skipped' && preview.connectivityCheck.reason === 'checker_unavailable') &&
@@ -438,13 +507,21 @@ export class AdminConfiguredServerService {
                     run: async () => {
                         let configChange;
                         try {
-                            configChange = await this.options.configChangeService.createStaticConfiguredServerTarget({
-                                targetName: prepared.targetName,
-                                serverConfig: prepared.config,
-                                operation: 'install',
-                                backup: 'skip',
-                                expectedConfigFingerprint: configFingerprint,
-                            });
+                            configChange =
+                                prepared.targetSource === 'mcpTemplates'
+                                    ? await this.options.configChangeService.createTemplateConfiguredServerTarget({
+                                        targetName: prepared.targetName,
+                                        serverConfig: prepared.config,
+                                        backup: 'skip',
+                                        expectedConfigFingerprint: configFingerprint,
+                                    })
+                                    : await this.options.configChangeService.createStaticConfiguredServerTarget({
+                                        targetName: prepared.targetName,
+                                        serverConfig: prepared.config,
+                                        operation: 'install',
+                                        backup: 'skip',
+                                        expectedConfigFingerprint: configFingerprint,
+                                    });
                         }
                         catch {
                             throw new AdminConfiguredServerApplyError('configured_server_create_failed');
@@ -452,8 +529,12 @@ export class AdminConfiguredServerService {
                         assertSuccessfulConfiguredServerCreate(configChange);
                         return {
                             targetName: prepared.targetName,
+                            targetSource: prepared.targetSource,
                             previewFingerprint: preview.previewFingerprint,
                             configChange,
+                            ...(prepared.targetSource === 'mcpTemplates'
+                                ? { runtimeImpact: { activeInstanceCount: 0, createdInstance: false } }
+                                : {}),
                         };
                     },
                 };
@@ -472,14 +553,14 @@ export class AdminConfiguredServerService {
         const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
+            target: { type: 'configured_server', id: `${source}/${input.targetName}` },
         };
         return this.options.operationService.executeReadOnly({
             context,
             operationName: 'getConfiguredServerDetail',
             run: async () => {
-                const { currentConfig, serverDefaults } = configuredState;
-                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source, fingerprintConfiguredServerTarget(currentConfig), Object.hasOwn(currentConfig, 'instructionOverride') ? currentConfig.instructionOverride : undefined, Object.hasOwn(currentConfig, 'instructionOverride'));
+                const { currentConfig, serverDefaults, collision } = configuredState;
+                const server = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source, fingerprintConfiguredServerTarget(currentConfig), Object.hasOwn(currentConfig, 'instructionOverride') ? currentConfig.instructionOverride : undefined, Object.hasOwn(currentConfig, 'instructionOverride'), collision, source === 'mcpTemplates' ? (this.options.getTemplateActiveInstanceCount?.(input.targetName) ?? 0) : 0, this.options.mutationAvailability?.available ?? true);
                 return {
                     server,
                     editContract: createConfiguredServerEditContract(server, currentConfig, serverDefaults),
@@ -501,7 +582,7 @@ export class AdminConfiguredServerService {
         const configuredState = this.readConfiguredServerState(input.targetName, input.targetSource);
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: `${configuredState.source}:${input.targetName}` },
+            target: { type: 'configured_server', id: `${configuredState.source}/${input.targetName}` },
         };
         return this.options.operationService.executeReadOnly({
             context,
@@ -533,7 +614,7 @@ export class AdminConfiguredServerService {
         const source = configuredState.source;
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
+            target: { type: 'configured_server', id: `${source}/${input.targetName}` },
         };
         const { currentConfig, serverDefaults } = configuredState;
         return this.options.operationService.executeDryRun({
@@ -546,7 +627,7 @@ export class AdminConfiguredServerService {
         const source = this.resolveConfiguredServerSource(input.targetName, input.targetSource);
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
+            target: { type: 'configured_server', id: `${source}/${input.targetName}` },
             confirmationFacts: sanitizeApplyConfirmationFacts(input.context.confirmationFacts),
         };
         return this.options.operationService.executeMutation({
@@ -571,7 +652,8 @@ export class AdminConfiguredServerService {
                 if (preview.previewFingerprint !== input.previewFingerprint) {
                     throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
                 }
-                if (connectionCritical &&
+                if (source === 'mcpServers' &&
+                    connectionCritical &&
                     !wouldUseLocalStdioTransport(proposedConfig) &&
                     proposedReadModel.enabled &&
                     preview.connectivityCheck.status !== 'passed' &&
@@ -595,6 +677,14 @@ export class AdminConfiguredServerService {
                             : []),
                     ],
                     run: async () => {
+                        const instanceIdentities = source === 'mcpTemplates'
+                            ? (this.options.getTemplateActiveInstanceIdentities?.(input.targetName) ?? [])
+                            : [];
+                        const activeInstancesBefore = instanceIdentities.length > 0
+                            ? instanceIdentities.length
+                            : source === 'mcpTemplates'
+                                ? (this.options.getTemplateActiveInstanceCount?.(input.targetName) ?? 0)
+                                : 0;
                         const configChange = await this.options.configChangeService.editConfiguredServerTarget({
                             sourceName: input.targetName,
                             targetSource: source,
@@ -604,11 +694,142 @@ export class AdminConfiguredServerService {
                             expectedGlobalConfigFingerprint: fingerprintConfiguredServerDefaults(serverDefaults),
                         });
                         assertSuccessfulConfiguredServerEdit(configChange);
+                        const runtimeImpact = source === 'mcpTemplates'
+                            ? await this.observeTemplateRetirement(input.targetName, configChange, preview.runtimeImpact?.retirementRequired === true, activeInstancesBefore, instanceIdentities)
+                            : undefined;
                         return {
                             originalTargetName: input.targetName,
                             targetName: preview.proposedTargetName,
                             previewFingerprint: preview.previewFingerprint,
                             configChange,
+                            ...(runtimeImpact ? { runtimeImpact } : {}),
+                        };
+                    },
+                };
+            },
+        });
+    }
+    async previewConfiguredServerDelete(input) {
+        const context = {
+            ...input.context,
+            target: { type: 'configured_server', id: `${input.targetSource}/${input.targetName}` },
+        };
+        return this.options.operationService.executeDryRun({
+            context,
+            operationName: 'previewConfiguredServerDelete',
+            run: async () => this.previewConfiguredServerDeleteResult(input),
+        });
+    }
+    async deleteConfiguredServer(input) {
+        const qualifiedId = `${input.targetSource}/${input.targetName}`;
+        const context = {
+            ...input.context,
+            target: { type: 'configured_server', id: qualifiedId },
+            confirmationFacts: sanitizeConfiguredServerIdentityConfirmationFacts(input.context.confirmationFacts),
+        };
+        return this.options.operationService.executeMutation({
+            context,
+            operationName: 'deleteConfiguredServer',
+            prepare: async () => {
+                let preview;
+                try {
+                    preview = this.previewConfiguredServerDeleteResult(input);
+                }
+                catch (error) {
+                    if (error instanceof AdminConfiguredServerNotFoundError) {
+                        throw new AdminConfiguredServerApplyError('configured_server_already_removed');
+                    }
+                    throw error;
+                }
+                if (preview.previewFingerprint !== input.previewFingerprint) {
+                    throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+                }
+                return {
+                    confirmationRequirements: [
+                        { code: 'previewConfirmed', expected: input.previewFingerprint },
+                        { code: 'targetIdentityConfirmed', expected: qualifiedId },
+                    ],
+                    run: async () => {
+                        const instanceIdentities = input.targetSource === 'mcpTemplates'
+                            ? (this.options.getTemplateActiveInstanceIdentities?.(input.targetName) ?? [])
+                            : [];
+                        const activeInstancesBefore = instanceIdentities.length > 0
+                            ? instanceIdentities.length
+                            : preview.runtimeImpact.kind === 'template'
+                                ? preview.runtimeImpact.activeInstanceCount
+                                : 0;
+                        const configChange = await this.options.configChangeService.deleteConfiguredServerTarget({
+                            targetName: input.targetName,
+                            targetSource: input.targetSource,
+                            expectedTargetFingerprint: preview.targetFingerprint,
+                        });
+                        assertSuccessfulConfiguredServerDelete(configChange);
+                        const runtimeImpact = input.targetSource === 'mcpTemplates'
+                            ? await this.observeTemplateRetirement(input.targetName, configChange, true, activeInstancesBefore, instanceIdentities)
+                            : undefined;
+                        return {
+                            target: preview.target,
+                            qualifiedId,
+                            previewFingerprint: preview.previewFingerprint,
+                            configChange: sanitizeConfiguredServerDeleteResult(configChange),
+                            ...(runtimeImpact ? { runtimeImpact } : {}),
+                        };
+                    },
+                };
+            },
+        });
+    }
+    async previewConfiguredServerLifecycle(input) {
+        const context = {
+            ...input.context,
+            target: { type: 'configured_server', id: `${input.targetSource}/${input.targetName}` },
+        };
+        return this.options.operationService.executeDryRun({
+            context,
+            operationName: 'previewConfiguredServerLifecycle',
+            run: async () => this.previewConfiguredServerLifecycleResult(input),
+        });
+    }
+    async applyConfiguredServerLifecycle(input) {
+        const qualifiedId = `${input.targetSource}/${input.targetName}`;
+        const context = {
+            ...input.context,
+            target: { type: 'configured_server', id: qualifiedId },
+            confirmationFacts: sanitizeConfiguredServerIdentityConfirmationFacts(input.context.confirmationFacts),
+        };
+        return this.options.operationService.executeMutation({
+            context,
+            operationName: 'applyConfiguredServerLifecycle',
+            prepare: async () => {
+                const preview = await this.previewConfiguredServerLifecycleResult(input);
+                if (preview.previewFingerprint !== input.previewFingerprint) {
+                    throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+                }
+                return {
+                    confirmationRequirements: [
+                        { code: 'previewConfirmed', expected: input.previewFingerprint },
+                        { code: 'targetIdentityConfirmed', expected: qualifiedId },
+                    ],
+                    run: async () => {
+                        const instanceIdentities = this.options.getTemplateActiveInstanceIdentities?.(input.targetName) ?? [];
+                        const activeInstancesBefore = instanceIdentities.length || this.options.getTemplateActiveInstanceCount?.(input.targetName) || 0;
+                        const configChange = await this.options.configChangeService.setConfiguredServerTargetEnabledState({
+                            targetName: input.targetName,
+                            targetSource: input.targetSource,
+                            enabled: input.enabled,
+                            backup: 'required',
+                            expectedTargetFingerprint: preview.targetFingerprint,
+                        });
+                        assertSuccessfulConfiguredServerLifecycle(configChange);
+                        const runtimeImpact = await this.observeTemplateRetirement(input.targetName, configChange, !input.enabled && configChange.changed, activeInstancesBefore, instanceIdentities);
+                        return {
+                            target: preview.target,
+                            qualifiedId,
+                            previewFingerprint: preview.previewFingerprint,
+                            enabled: input.enabled,
+                            outcome: mutationOutcome(input.enabled, configChange.changed),
+                            configChange: sanitizeConfiguredServerLifecycleResult(configChange),
+                            runtimeImpact,
                         };
                     },
                 };
@@ -629,7 +850,7 @@ export class AdminConfiguredServerService {
         const source = input.targetSource ?? 'mcpServers';
         const context = {
             ...input.context,
-            target: { type: 'configured_server', id: `${source}:${input.targetName}` },
+            target: { type: 'configured_server', id: `${source}/${input.targetName}` },
         };
         if (input.dryRun) {
             return this.options.operationService.executeDryRun({
@@ -687,17 +908,160 @@ export class AdminConfiguredServerService {
         }
         return {
             configFingerprint: fingerprintConfiguredServerConfigDocument(parsed),
-            servers: ['mcpServers', 'mcpTemplates'].flatMap((source) => Object.entries(parsed[source] ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig), source, fingerprintConfiguredServerTarget(serverConfig), Object.hasOwn(serverConfig, 'instructionOverride') ? serverConfig.instructionOverride : undefined, Object.hasOwn(serverConfig, 'instructionOverride')))),
+            servers: ['mcpServers', 'mcpTemplates'].flatMap((source) => Object.entries(parsed[source] ?? {}).map(([name, serverConfig]) => createConfiguredServerReadModel(name, mergeGlobalAndServerConfig(parsed.serverDefaults, serverConfig), source, fingerprintConfiguredServerTarget(serverConfig), Object.hasOwn(serverConfig, 'instructionOverride') ? serverConfig.instructionOverride : undefined, Object.hasOwn(serverConfig, 'instructionOverride'), Boolean((source === 'mcpTemplates' ? parsed.mcpServers : parsed.mcpTemplates)?.[name]), source === 'mcpTemplates' ? (this.options.getTemplateActiveInstanceCount?.(name) ?? 0) : 0, this.options.mutationAvailability?.available ?? true))),
         };
     }
-    readConfiguredServerState(targetName, targetSource) {
-        const parsed = this.options.readConfigDocument();
+    previewConfiguredServerDeleteResult(input) {
+        const document = this.options.readConfigDocument();
+        const otherSource = input.targetSource === 'mcpServers' ? 'mcpTemplates' : 'mcpServers';
+        if (!document?.[input.targetSource]?.[input.targetName] && document?.[otherSource]?.[input.targetName]) {
+            throw new AdminConfiguredServerApplyError('configured_server_source_changed');
+        }
+        const { currentConfig, serverDefaults, collision } = this.readConfiguredServerState(input.targetName, input.targetSource, document);
+        const targetFingerprint = fingerprintConfiguredServerTarget(currentConfig);
+        const activeInstanceCount = input.targetSource === 'mcpTemplates'
+            ? (this.options.getTemplateActiveInstanceCount?.(input.targetName) ?? 0)
+            : 0;
+        const definition = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), input.targetSource, targetFingerprint, Object.hasOwn(currentConfig, 'instructionOverride') ? currentConfig.instructionOverride : undefined, Object.hasOwn(currentConfig, 'instructionOverride'), collision, activeInstanceCount, this.options.mutationAvailability?.available ?? true);
+        const qualifiedId = definition.definition?.qualifiedId ?? `${input.targetSource}/${input.targetName}`;
+        const authority = definition.definition?.authority ?? 'sole';
+        const runtimeImpact = input.targetSource === 'mcpTemplates'
+            ? { kind: 'template', activeInstanceCount, retirement: 'reload_scheduled' }
+            : { kind: 'static', configuredBackendRemoval: 'after_reload' };
+        const warnings = [
+            'Deletion removes only this source-qualified definition and does not cascade to presets, filters, credentials, registry state, or individually selected live instances.',
+            ...(collision
+                ? [`The same name in ${input.targetSource === 'mcpServers' ? 'mcpTemplates' : 'mcpServers'} is preserved.`]
+                : []),
+            ...(input.targetSource === 'mcpTemplates' && activeInstanceCount > 0
+                ? [
+                    `Reload schedules retirement of ${activeInstanceCount} active Template Server instance${activeInstanceCount === 1 ? '' : 's'}.`,
+                ]
+                : []),
+        ];
+        const previewFingerprint = `delete_preview_${createHash('sha256')
+            .update(stableStringify({
+            schemaVersion: 1,
+            qualifiedId,
+            targetFingerprint,
+            authority,
+            collision,
+            runtimeImpact,
+            warnings,
+        }))
+            .digest('hex')}`;
+        return {
+            target: definition.target,
+            qualifiedId,
+            targetFingerprint,
+            previewFingerprint,
+            authority,
+            removal: { definition, preservesSameNamedOtherSource: collision, cascades: false },
+            configChange: previewDeleteConfigChange(input.targetName, input.targetSource),
+            expectedBackup: { policy: 'required', recoveryCopy: true },
+            expectedReload: {
+                policy: 'observe_after_write',
+                possibleStatuses: ['observed', 'runtime_not_running', 'reload_disabled', 'failed'],
+            },
+            runtimeImpact,
+            warnings,
+        };
+    }
+    async previewConfiguredServerLifecycleResult(input) {
+        const document = this.options.readConfigDocument();
+        const currentConfig = document?.mcpTemplates?.[input.targetName];
+        if (!currentConfig) {
+            if (document?.mcpServers?.[input.targetName]) {
+                throw new AdminConfiguredServerApplyError('configured_server_source_changed');
+            }
+            throw new AdminConfiguredServerNotFoundError(input.targetName);
+        }
+        const targetFingerprint = fingerprintConfiguredServerTarget(currentConfig);
+        const qualifiedId = `mcpTemplates/${input.targetName}`;
+        const disabled = currentConfig.disabled;
+        const currentEnabled = !isConfiguredServerTargetDisabled(disabled);
+        const disabledValueKind = disabled === undefined
+            ? 'absent'
+            : typeof disabled === 'string' && disabled.includes('{{')
+                ? 'context_expression'
+                : 'literal';
+        const expressionReplacement = {
+            occurs: disabledValueKind === 'context_expression' && !input.enabled,
+            replacement: input.enabled ? 'enabled_absent' : 'disabled_true',
+        };
+        const activeInstanceCount = this.options.getTemplateActiveInstanceCount?.(input.targetName) ?? 0;
+        const configChange = await this.options.configChangeService.previewConfiguredServerTargetEnabledState({
+            targetName: input.targetName,
+            targetSource: input.targetSource,
+            enabled: input.enabled,
+            backup: 'skip',
+        });
+        if (configChange.status === 'not_found' || configChange.status === 'source_conflict') {
+            throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+        }
+        if (configChange.status === 'failed') {
+            throw new AdminConfiguredServerApplyError('configured_server_apply_failed');
+        }
+        const warnings = [
+            ...(expressionReplacement.occurs
+                ? ['The context-rendered disabled expression will be replaced with literal true without evaluating Request Context.']
+                : []),
+            ...(input.enabled
+                ? ['Re-enable restores eligibility only; instances and Request Sessions are created lazily by future matching requests.']
+                : activeInstanceCount > 0
+                    ? [`Successful reload retires ${activeInstanceCount} active Template Server instance${activeInstanceCount === 1 ? '' : 's'} and removes their Request Session memberships.`]
+                    : []),
+        ];
+        const runtimeImpact = {
+            activeInstanceCount,
+            retirement: !input.enabled && configChange.changed ? 'after_successful_reload' : 'not_required',
+            recreation: 'lazy_future_match_only',
+        };
+        const previewFingerprint = `lifecycle_preview_${createHash('sha256')
+            .update(stableStringify({
+            schemaVersion: 1,
+            qualifiedId,
+            targetFingerprint,
+            currentEnabled,
+            proposedEnabled: input.enabled,
+            disabledValueKind,
+            expressionReplacement,
+            changed: configChange.changed,
+            runtimeImpact,
+            warnings,
+        }))
+            .digest('hex')}`;
+        return {
+            target: { type: 'configured_server', id: input.targetName, source: input.targetSource },
+            qualifiedId,
+            targetFingerprint,
+            previewFingerprint,
+            current: { enabled: currentEnabled, disabledValueKind },
+            proposed: { enabled: input.enabled, disabledValueKind: input.enabled ? 'absent' : 'literal' },
+            expressionReplacement,
+            configChange: sanitizeConfiguredServerLifecycleResult(configChange),
+            expectedBackup: { policy: 'required', recoveryCopy: true },
+            expectedReload: {
+                policy: 'observe_after_write',
+                possibleStatuses: ['observed', 'runtime_not_running', 'reload_disabled', 'failed'],
+            },
+            runtimeImpact,
+            warnings,
+        };
+    }
+    readConfiguredServerState(targetName, targetSource, document = this.options.readConfigDocument()) {
+        const parsed = document;
         const source = this.resolveConfiguredServerSource(targetName, targetSource, parsed);
         const currentConfig = parsed?.[source]?.[targetName];
         if (!currentConfig) {
             throw new AdminConfiguredServerNotFoundError(targetName);
         }
-        return { currentConfig, serverDefaults: parsed?.serverDefaults, source };
+        return {
+            currentConfig,
+            serverDefaults: parsed?.serverDefaults,
+            source,
+            collision: Boolean((source === 'mcpTemplates' ? parsed?.mcpServers : parsed?.mcpTemplates)?.[targetName]),
+        };
     }
     resolveConfiguredServerSource(targetName, targetSource, document = this.options.readConfigDocument()) {
         if (targetSource)
@@ -715,6 +1079,9 @@ export class AdminConfiguredServerService {
     async previewConfiguredServerEditResult(input, currentConfig, serverDefaults, requireCriticalConnectivity = false, source = 'mcpServers') {
         const normalizedEdit = normalizeEditDraft(input.edit);
         const sourceValidation = validateEditForSource(source, normalizedEdit.edit);
+        const rawTemplateHeaderValidation = source === 'mcpTemplates'
+            ? validateRawTemplateHeaderEdit(input.edit)
+            : { status: 'valid', errors: [] };
         const currentReadModel = createConfiguredServerReadModel(input.targetName, mergeGlobalAndServerConfig(serverDefaults, currentConfig), source);
         const secretValidation = validateSecretEditCapabilities(normalizedEdit.edit, currentReadModel.secretInputs);
         const transportApplicabilityValidation = validateTransportFieldApplicability(currentConfig, normalizedEdit.edit);
@@ -724,7 +1091,10 @@ export class AdminConfiguredServerService {
         const proposedConfig = applyEditDraft(currentConfig, applicableEdit, serverDefaults, input.targetName);
         const proposedReadModel = createConfiguredServerReadModel(proposedTargetName, mergeGlobalAndServerConfig(serverDefaults, proposedConfig), source);
         const proposedTransportType = configuredTransportType(proposedConfig);
-        const serverValidation = validatePreviewServerConfig(proposedConfig);
+        const serverValidation = validatePreviewServerConfig(proposedConfig, source);
+        const templateValidation = source === 'mcpTemplates'
+            ? templateDefinitionValidation(proposedConfig)
+            : { status: 'valid', errors: [] };
         const currentToolInventory = this.options.readToolInventory
             ? await this.options.readToolInventory({
                 targetName: input.targetName,
@@ -734,7 +1104,7 @@ export class AdminConfiguredServerService {
             })
             : undefined;
         const toolEditValidation = validateConfiguredToolEdit(applicableEdit, currentToolInventory);
-        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), mergeValidation(mergeValidation(serverValidation, sourceValidation), toolEditValidation));
+        const validation = mergeValidation(mergeValidation(mergeValidation(mergeValidation(normalizedEdit.validation, secretValidation), transportApplicabilityValidation), overrideValidation), mergeValidation(mergeValidation(mergeValidation(mergeValidation(serverValidation, sourceValidation), toolEditValidation), rawTemplateHeaderValidation), templateValidation));
         const diff = createPreviewDiff(currentReadModel, proposedReadModel, applicableEdit);
         pushDiff(diff, ['disabledTools'], currentConfig.disabledTools ?? [], proposedConfig.disabledTools ?? [], [
             'tool_visibility',
@@ -742,6 +1112,9 @@ export class AdminConfiguredServerService {
         pushDiff(diff, ['toolDescriptionOverrides'], currentConfig.toolDescriptionOverrides ?? {}, proposedConfig.toolDescriptionOverrides ?? {}, ['tool_metadata']);
         appendClearedOverrideDiff(diff, currentReadModel, proposedReadModel, applicableEdit);
         const changed = validation.status === 'valid' && diff.length > 0;
+        const retirementRequired = source === 'mcpTemplates' &&
+            (proposedTargetName !== input.targetName ||
+                templateRuntimeHash(currentConfig) !== templateRuntimeHash(proposedConfig));
         const endpointChangedWithPreservedSecrets = endpointAuthorityChanged(currentConfig, proposedConfig) &&
             hasPreservedSecretInputs(currentReadModel.secretInputs.filter((input) => !proposedTransportType || transportFieldAppliesToType(input.fieldPath[0], proposedTransportType)), applicableEdit);
         const proposedToolInventory = this.options.readToolInventory
@@ -773,17 +1146,32 @@ export class AdminConfiguredServerService {
             validation,
             diff,
             configChange: previewConfigChange(input.targetName, changed, source),
-            connectivityCheck: await this.previewConnectivityCheck({
-                targetName: proposedTargetName,
-                serverConfig: proposedConfig,
-                enabled: proposedReadModel.enabled,
-                validationStatus: validation.status,
-                connectionCriticalChanged: diff.some((entry) => entry.riskFlags.includes('connection_critical')),
-                force: input.connectivityCheck === 'manual' ||
-                    (requireCriticalConnectivity && diff.some((entry) => entry.riskFlags.includes('connection_critical'))),
-                endpointChangedWithPreservedSecrets,
-            }),
+            connectivityCheck: source === 'mcpTemplates'
+                ? { status: 'skipped', reason: 'template_structural_preview' }
+                : await this.previewConnectivityCheck({
+                    targetName: proposedTargetName,
+                    serverConfig: proposedConfig,
+                    enabled: proposedReadModel.enabled,
+                    validationStatus: validation.status,
+                    connectionCriticalChanged: diff.some((entry) => entry.riskFlags.includes('connection_critical')),
+                    force: input.connectivityCheck === 'manual' ||
+                        (requireCriticalConnectivity && diff.some((entry) => entry.riskFlags.includes('connection_critical'))),
+                    endpointChangedWithPreservedSecrets,
+                }),
             ...(toolSelection ? { toolSelection } : {}),
+            ...(source === 'mcpTemplates'
+                ? {
+                    templateAnalysis: analyzeTemplateServerDefinition(proposedConfig),
+                    runtimeImpact: {
+                        activeInstanceCount: this.options.getTemplateActiveInstanceCount?.(input.targetName) ?? 0,
+                        retirementRequired: changed && retirementRequired,
+                        createsInstance: false,
+                    },
+                }
+                : {}),
+            warnings: source === 'mcpTemplates'
+                ? ['Structural preview only: Request Context values are not rendered and no backend is contacted.']
+                : [],
         };
     }
     async previewConnectivityCheck(input) {
@@ -810,6 +1198,42 @@ export class AdminConfiguredServerService {
             serverConfig: input.serverConfig,
         });
     }
+    async observeTemplateRetirement(templateName, configChange, retirementRequired, activeInstancesBefore, instanceIdentities) {
+        if (!retirementRequired) {
+            return {
+                activeInstancesBefore,
+                retiredInstances: 0,
+                activeInstancesAfter: activeInstancesBefore,
+                retirementObserved: true,
+            };
+        }
+        if (configChange.reload.status === 'failed' || !this.options.observeTemplateDefinitionRetirement) {
+            const activeInstancesAfter = this.options.getTemplateActiveInstanceCount?.(templateName) ?? activeInstancesBefore;
+            return {
+                activeInstancesBefore,
+                retiredInstances: Math.max(0, activeInstancesBefore - activeInstancesAfter),
+                activeInstancesAfter,
+                retirementObserved: activeInstancesAfter === 0,
+            };
+        }
+        try {
+            const observed = await this.options.observeTemplateDefinitionRetirement(templateName, instanceIdentities);
+            return {
+                ...observed,
+                activeInstancesBefore,
+                retiredInstances: Math.max(0, activeInstancesBefore - observed.activeInstancesAfter),
+            };
+        }
+        catch {
+            return {
+                activeInstancesBefore,
+                retiredInstances: 0,
+                activeInstancesAfter: this.options.getTemplateActiveInstanceCount?.(templateName) ?? activeInstancesBefore,
+                retirementObserved: false,
+                error: 'Template instance retirement could not be confirmed.',
+            };
+        }
+    }
     async previewConfiguredServerCreateResult(input, forceConnectivity = false, document = this.options.readConfigDocument() ?? {}) {
         const prepared = await this.resolveConfiguredServerCreate(input.draft, document);
         const proposedReadModel = prepared.config
@@ -818,17 +1242,19 @@ export class AdminConfiguredServerService {
         const validation = prepared.validation;
         const diff = proposedReadModel ? createConfiguredServerCreateDiff(proposedReadModel, prepared.draft) : [];
         const changed = validation.status === 'valid' && prepared.workflow.status === 'preview';
-        const connectivityCheck = prepared.config
-            ? await this.previewConnectivityCheck({
-                targetName: prepared.targetName,
-                serverConfig: prepared.config,
-                enabled: prepared.enabled,
-                validationStatus: validation.status,
-                connectionCriticalChanged: true,
-                force: forceConnectivity || input.connectivityCheck === 'manual',
-                endpointChangedWithPreservedSecrets: false,
-            })
-            : { status: 'skipped', reason: 'validation_failed' };
+        const connectivityCheck = prepared.targetSource === 'mcpTemplates'
+            ? { status: 'skipped', reason: 'template_structural_preview' }
+            : prepared.config
+                ? await this.previewConnectivityCheck({
+                    targetName: prepared.targetName,
+                    serverConfig: prepared.config,
+                    enabled: prepared.enabled,
+                    validationStatus: validation.status,
+                    connectionCriticalChanged: true,
+                    force: forceConnectivity || input.connectivityCheck === 'manual',
+                    endpointChangedWithPreservedSecrets: false,
+                })
+                : { status: 'skipped', reason: 'validation_failed' };
         const preview = {
             targetName: prepared.targetName,
             previewFingerprint: configuredServerCreatePreviewFingerprint({
@@ -841,12 +1267,25 @@ export class AdminConfiguredServerService {
             }),
             validation,
             diff,
-            configChange: previewCreateConfigChange(prepared.targetName, prepared.workflow.status, changed),
+            configChange: previewCreateConfigChange(prepared.targetName, prepared.workflow.status, changed, prepared.targetSource),
             connectivityCheck,
             expectedReload: {
                 policy: 'observe_after_write',
                 possibleStatuses: ['observed', 'runtime_not_running', 'reload_disabled', 'failed'],
             },
+            ...(prepared.targetSource === 'mcpTemplates' && prepared.config
+                ? {
+                    templateAnalysis: analyzeTemplateServerDefinition(prepared.config),
+                    runtimeImpact: {
+                        activeInstanceCount: 0,
+                        retirementRequired: false,
+                        createsInstance: false,
+                    },
+                }
+                : {}),
+            warnings: prepared.targetSource === 'mcpTemplates'
+                ? ['Creating a Template Server definition does not create a runtime instance.']
+                : [],
         };
         return preview;
     }
@@ -862,8 +1301,11 @@ export class AdminConfiguredServerService {
             },
         });
         const workflowResult = await workflow.run({ mode: 'preview', source: normalized.source });
-        const config = workflowResult.config;
-        const validation = mergeValidation(mergeValidation(normalized.validation, validateConfiguredServerCreateSecrets(normalized.draft)), createWorkflowValidation(workflowResult, config));
+        const config = normalized.targetSource === 'mcpTemplates' ? createTemplateServerConfig(normalized.draft) : workflowResult.config;
+        const templateValidation = normalized.targetSource === 'mcpTemplates' && config
+            ? templateDefinitionValidation(config)
+            : { status: 'valid', errors: [] };
+        const validation = mergeValidation(mergeValidation(mergeValidation(normalized.validation, validateConfiguredServerCreateSecrets(normalized.draft)), createWorkflowValidation(workflowResult, config, normalized.targetSource)), templateValidation);
         return {
             draft: normalized.draft,
             source: normalized.source,
@@ -872,20 +1314,71 @@ export class AdminConfiguredServerService {
             workflow: workflowResult,
             config,
             validation,
+            targetSource: normalized.targetSource,
         };
     }
 }
+function createTemplateServerConfig(draft) {
+    if (!draft.transport)
+        return undefined;
+    const config = cloneUnknown(draft.transport);
+    if (draft.tags?.length)
+        config.tags = [...draft.tags];
+    const secretContainer = config.type === 'stdio' ? 'env' : 'headers';
+    const secrets = configuredServerCreateSecretValues(draft, secretContainer);
+    if (Object.keys(secrets).length > 0) {
+        const current = config[secretContainer];
+        const currentRecord = current && !Array.isArray(current) ? current : {};
+        config[secretContainer] = { ...currentRecord, ...secrets };
+    }
+    return config;
+}
+function templateDefinitionValidation(config) {
+    const analysis = analyzeTemplateServerDefinition(config);
+    const headerErrors = Object.entries(config.headers ?? {}).flatMap(([name, value]) => typeof value === 'string' && value.includes('{{')
+        ? [
+            {
+                fieldPath: ['transport', 'headers', name],
+                code: 'template_header_not_rendered',
+                message: 'Template expressions are not supported in headers because the runtime does not render them.',
+            },
+        ]
+        : []);
+    const errors = [...analysis.syntax.errors, ...headerErrors];
+    return {
+        status: errors.length === 0 ? 'valid' : 'invalid',
+        errors,
+    };
+}
+function validateRawTemplateHeaderEdit(value) {
+    const record = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const transport = record.transport && typeof record.transport === 'object' && !Array.isArray(record.transport)
+        ? record.transport
+        : {};
+    const headers = transport.headers && typeof transport.headers === 'object' && !Array.isArray(transport.headers)
+        ? transport.headers
+        : {};
+    const errors = Object.entries(headers).flatMap(([name, entry]) => typeof entry === 'string' && entry.includes('{{')
+        ? [
+            {
+                fieldPath: ['transport', 'headers', name],
+                code: 'template_header_not_rendered',
+                message: 'Template expressions are not supported in headers because the runtime does not render them.',
+            },
+        ]
+        : []);
+    return { status: errors.length === 0 ? 'valid' : 'invalid', errors };
+}
 function validateEditForSource(source, edit) {
     if (source !== 'mcpTemplates')
         return { status: 'valid', errors: [] };
-    const supportedTemplateMetadata = new Set(['instructionOverride', 'disabledTools', 'toolDescriptionOverrides']);
-    const unsupported = Object.keys(edit).filter((key) => !supportedTemplateMetadata.has(key));
+    const unsupported = Object.keys(edit).filter((key) => key === 'enabled');
     return {
         status: unsupported.length === 0 ? 'valid' : 'invalid',
         errors: unsupported.map((key) => ({
             fieldPath: [key],
             code: 'template_edit_field_unsupported',
-            message: 'Template Server edits may only change instruction and tool metadata.',
+            message: 'Template Server definitions do not support enable or disable operations.',
         })),
     };
 }
@@ -928,6 +1421,59 @@ function assertSuccessfulConfiguredServerEdit(configChange) {
             throw new AdminConfiguredServerApplyError('configured_server_apply_failed');
     }
 }
+function assertSuccessfulConfiguredServerDelete(configChange) {
+    switch (configChange.status) {
+        case 'changed':
+            return;
+        case 'source_conflict':
+            throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+        case 'not_found':
+            throw new AdminConfiguredServerApplyError('configured_server_already_removed');
+        default:
+            throw new AdminConfiguredServerApplyError('configured_server_delete_failed');
+    }
+}
+function assertSuccessfulConfiguredServerLifecycle(configChange) {
+    switch (configChange.status) {
+        case 'changed':
+        case 'unchanged':
+            return;
+        case 'source_conflict':
+        case 'not_found':
+            throw new AdminConfiguredServerApplyError('configured_server_stale_preview');
+        default:
+            throw new AdminConfiguredServerApplyError('configured_server_apply_failed');
+    }
+}
+function sanitizeConfiguredServerDeleteResult(configChange) {
+    return sanitizeConfiguredServerMutationResult(configChange, 'Runtime reload failed after the configuration was deleted.');
+}
+function sanitizeConfiguredServerLifecycleResult(configChange) {
+    return sanitizeConfiguredServerMutationResult(configChange, 'Runtime reload failed after the lifecycle configuration was persisted.');
+}
+function sanitizeConfiguredServerMutationResult(configChange, reloadFailureMessage) {
+    return {
+        ...configChange,
+        configPath: '[redacted]',
+        backup: configChange.backup.created ? { created: true, path: '[redacted]' } : { created: false },
+        retentionCleanup: {
+            attempted: configChange.retentionCleanup.attempted,
+            deletedPaths: configChange.retentionCleanup.deletedPaths.map(() => '[redacted]'),
+            warnings: configChange.retentionCleanup.warnings.map(() => 'A recovery backup retention cleanup failed.'),
+        },
+        reload: configChange.reload.status === 'failed'
+            ? { status: 'failed', error: reloadFailureMessage }
+            : configChange.reload,
+        warnings: configChange.warnings.map(() => 'A recovery backup retention cleanup failed.'),
+    };
+}
+function sanitizeConfiguredServerIdentityConfirmationFacts(facts) {
+    if (!facts)
+        return undefined;
+    const allowed = ['previewConfirmed', 'targetIdentityConfirmed'];
+    const sanitized = Object.fromEntries(allowed.filter((key) => key in facts).map((key) => [key, facts[key]]));
+    return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
 function sanitizeApplyConfirmationFacts(facts) {
     if (!facts)
         return undefined;
@@ -1149,9 +1695,13 @@ function isSecretCapableRawTransportEdit(key, value) {
     if (key === 'url') {
         return isSecretCapableUrlEdit(value);
     }
-    if (key === 'headers' || key === 'env') {
+    if (key === 'headers') {
         return true;
     }
+    if (key === 'env' && value && typeof value === 'object' && !Array.isArray(value)) {
+        return Object.entries(value).some(([name, entry]) => !(typeof entry === 'string' && isSafeTemplateExpressionValue(entry)) &&
+            (isSecretLikeKey(name) || containsSecretLikeField(entry)));
+    }
     if (key === 'oauth' && value && typeof value === 'object' && !Array.isArray(value)) {
         return containsStringOrSecretLikeField(value);
     }
@@ -1774,7 +2324,7 @@ function deleteNestedValue(target, fieldPath) {
     }
     delete cursor[fieldPath[fieldPath.length - 1]];
 }
-function validatePreviewServerConfig(serverConfig) {
+function validatePreviewServerConfig(serverConfig, source = 'mcpServers') {
     const errors = [];
     const type = typeof serverConfig.type === 'string' ? serverConfig.type : undefined;
     const url = typeof serverConfig.url === 'string' ? serverConfig.url : undefined;
@@ -1815,7 +2365,7 @@ function validatePreviewServerConfig(serverConfig) {
             message: 'Transport type must be stdio, http, sse, or streamableHttp.',
         });
     }
-    if (url !== undefined && !isValidUrlOrEnvReference(url)) {
+    if (url !== undefined && !isValidUrlOrEnvReference(url, source === 'mcpTemplates')) {
         errors.push({
             fieldPath: ['transport', 'url'],
             code: 'invalid_url',
@@ -1849,7 +2399,9 @@ function mergeValidation(editValidation, serverValidation) {
         errors,
     };
 }
-function isValidUrlOrEnvReference(value) {
+function isValidUrlOrEnvReference(value, allowHandlebars = false) {
+    if (value.includes('{{'))
+        return allowHandlebars && /\{\{[^}]+\}\}/u.test(value);
     if (/\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*/u.test(value)) {
         return true;
     }
@@ -1874,6 +2426,19 @@ function previewConfigChange(targetName, changed, source = 'mcpServers') {
         warnings: [],
     };
 }
+function previewDeleteConfigChange(targetName, source) {
+    return {
+        status: 'changed',
+        operation: 'remove',
+        configPath: '[redacted]',
+        target: { name: targetName, source },
+        changed: true,
+        backup: { created: false },
+        retentionCleanup: { attempted: false, deletedPaths: [], warnings: [] },
+        reload: { status: 'skipped' },
+        warnings: [],
+    };
+}
 function previewFingerprint(input) {
     return `preview_${createHash('sha256')
         .update(stableStringify({
@@ -2086,9 +2651,11 @@ function stableStringify(value) {
     }
     return JSON.stringify(value);
 }
-function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServers', revision = fingerprintConfiguredServerTarget(serverConfig), instructionOverride = serverConfig.instructionOverride, hasInstructionOverride = Object.hasOwn(serverConfig, 'instructionOverride')) {
+function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServers', revision = fingerprintConfiguredServerTarget(serverConfig), instructionOverride = serverConfig.instructionOverride, hasInstructionOverride = Object.hasOwn(serverConfig, 'instructionOverride'), collision = false, activeInstanceCount = 0, mutationAvailable = true) {
     const secretInputs = [];
     const transport = {};
+    const templateAnalysis = source === 'mcpTemplates' ? analyzeTemplateServerDefinition(serverConfig) : undefined;
+    const invalidTemplateFields = new Set(templateAnalysis?.syntax.errors.map((error) => fieldKey(error.fieldPath)) ?? []);
     for (const [key, value] of Object.entries(serverConfig)) {
         if (key === 'disabled' ||
             key === 'tags' ||
@@ -2098,7 +2665,7 @@ function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServer
             continue;
         }
         if (key === 'env') {
-            transport.env = redactNamedSecretRecord(value, ['env'], secretInputs);
+            transport.env = redactNamedSecretRecord(value, ['env'], secretInputs, source === 'mcpTemplates', invalidTemplateFields);
             continue;
         }
         if (key === 'headers') {
@@ -2107,6 +2674,9 @@ function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServer
         }
         if (key === 'args') {
             transport.args = sanitizeCommandArgs(value, secretInputs);
+            if (Array.isArray(transport.args)) {
+                transport.args = transport.args.map((entry, index) => invalidTemplateFields.has(fieldKey(['transport', 'args', String(index)])) ? redactedValue() : entry);
+            }
             continue;
         }
         if (key === 'oauth') {
@@ -2114,7 +2684,13 @@ function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServer
             continue;
         }
         if (key === 'url' && typeof value === 'string') {
-            transport.url = redactUrlQuerySecrets(value, secretInputs);
+            transport.url = invalidTemplateFields.has(fieldKey(['transport', 'url']))
+                ? redactedValue()
+                : redactUrlQuerySecrets(value, secretInputs);
+            continue;
+        }
+        if (invalidTemplateFields.has(fieldKey(['transport', key]))) {
+            transport[key] = redactedValue();
             continue;
         }
         transport[key] = sanitizeUnknownValue(value, [key], secretInputs);
@@ -2133,15 +2709,11 @@ function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServer
         tags: normalizeTags(serverConfig.tags),
         transportSummary: createTransportSummary(serverConfig, transport),
         mutationAvailability: {
-            available: source === 'mcpServers',
-            operations: source === 'mcpServers' ? ['enable', 'disable'] : [],
+            available: mutationAvailable,
+            operations: ['enable', 'disable'],
+            deleteAvailable: mutationAvailable,
         },
-        actionState: source === 'mcpServers'
-            ? createActionState(name, enabled)
-            : {
-                enable: { available: false, label: `Enable ${name}`, disabledReason: 'already_enabled' },
-                disable: { available: false, label: `Disable ${name}`, disabledReason: 'already_disabled' },
-            },
+        actionState: createActionState(name, enabled),
         transport,
         secretInputs,
         instructionOverride: !hasInstructionOverride
@@ -2149,6 +2721,16 @@ function createConfiguredServerReadModel(name, serverConfig, source = 'mcpServer
             : instructionOverride === ''
                 ? { state: 'suppress', value: '' }
                 : { state: 'replace', value: instructionOverride },
+        definition: {
+            kind: source === 'mcpTemplates' ? 'template' : 'static',
+            qualifiedId: `${source}/${name}`,
+            authority: collision ? (source === 'mcpTemplates' ? 'authoritative' : 'shadowed') : 'sole',
+        },
+        ...(templateAnalysis ? { templateAnalysis } : {}),
+        runtime: {
+            objectKind: 'definition',
+            activeInstanceCount: source === 'mcpTemplates' ? activeInstanceCount : 0,
+        },
     };
 }
 const STDIO_TRANSPORT_TYPES = ['stdio'];
@@ -2257,7 +2839,7 @@ const TRANSPORT_FIELD_DEFINITIONS = [
 const TRANSPORT_FIELD_DEFINITION_BY_KEY = new Map(TRANSPORT_FIELD_DEFINITIONS.map((definition) => [definition.key, definition]));
 function createConfiguredServerEditContract(server, rawServerConfig, serverDefaults) {
     const secretFieldKeys = new Set(server.secretInputs.map((input) => fieldKey(input.fieldPath)));
-    const transportFields = TRANSPORT_FIELD_DEFINITIONS.map((definition) => {
+    const transportFields = TRANSPORT_FIELD_DEFINITIONS.filter((definition) => definition.key !== 'template').map((definition) => {
         const value = Object.prototype.hasOwnProperty.call(server.transport, definition.key)
             ? server.transport[definition.key]
             : definition.defaultValue;
@@ -2276,7 +2858,7 @@ function createConfiguredServerEditContract(server, rawServerConfig, serverDefau
             singleTargetEdit: true,
             rename: { supported: true },
             create: { supported: false },
-            delete: { supported: false },
+            delete: { supported: server.mutationAvailability.deleteAvailable === true },
             bulkEdit: { supported: false },
             rawJson: { supported: false },
             preview: { supported: true },
@@ -2299,7 +2881,7 @@ function createConfiguredServerEditContract(server, rawServerConfig, serverDefau
                         label: 'Enabled',
                         control: 'switch',
                         value: server.enabled,
-                        editable: true,
+                        editable: server.source === 'mcpServers',
                     },
                     {
                         fieldPath: ['tags'],
@@ -2315,6 +2897,15 @@ function createConfiguredServerEditContract(server, rawServerConfig, serverDefau
                 label: 'Transport',
                 fields: transportFields,
             },
+            ...(server.source === 'mcpTemplates'
+                ? [
+                    {
+                        id: 'template',
+                        label: 'Template instances',
+                        fields: templateLifecycleFields(server.transport.template, rawServerConfig.disabled),
+                    },
+                ]
+                : []),
             {
                 id: 'secrets',
                 label: 'Secrets',
@@ -2323,6 +2914,31 @@ function createConfiguredServerEditContract(server, rawServerConfig, serverDefau
         ],
     };
 }
+function templateLifecycleFields(value, disabled) {
+    const template = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const extraction = template.extractionOptions && typeof template.extractionOptions === 'object'
+        ? template.extractionOptions
+        : {};
+    return [
+        templateField(['disabled'], 'Disabled expression', 'text', disabled ?? ''),
+        templateField(['shareable'], 'Share instances', 'switch', template.shareable ?? true),
+        templateField(['perClient'], 'One instance per client', 'switch', template.perClient ?? false),
+        templateField(['maxInstances'], 'Maximum instances', 'number', template.maxInstances),
+        templateField(['idleTimeout'], 'Idle timeout (ms)', 'number', template.idleTimeout),
+        templateField(['extractionOptions', 'includeOptional'], 'Include optional context', 'switch', extraction.includeOptional ?? false),
+        templateField(['extractionOptions', 'includeEnvironment'], 'Include environment context', 'switch', extraction.includeEnvironment ?? false),
+    ];
+}
+function templateField(nestedPath, label, control, value) {
+    return {
+        fieldPath: nestedPath[0] === 'disabled' ? ['transport', 'disabled'] : ['transport', 'template', ...nestedPath],
+        label,
+        control,
+        value,
+        editable: true,
+        applicableSources: ['mcpTemplates'],
+    };
+}
 function omitSecretValues(value, fieldPath, secretFieldKeys) {
     if (secretFieldKeys.has(fieldKey(fieldPath))) {
         return undefined;
@@ -2567,7 +3183,7 @@ function wouldUseLocalStdioTransport(serverConfig) {
 function normalizeTags(tags) {
     return Array.isArray(tags) ? tags.filter((tag) => typeof tag === 'string') : [];
 }
-function redactNamedSecretRecord(value, basePath, secretInputs) {
+function redactNamedSecretRecord(value, basePath, secretInputs, exposeTemplateExpressions = false, invalidTemplateFields = new Set()) {
     if (Array.isArray(value)) {
         return value.map((entry, index) => {
             const label = typeof entry === 'string' && entry.includes('=') ? entry.split('=')[0] : String(index);
@@ -2579,12 +3195,44 @@ function redactNamedSecretRecord(value, basePath, secretInputs) {
         return {};
     }
     const redacted = {};
-    for (const key of Object.keys(value)) {
+    for (const [key, entry] of Object.entries(value)) {
+        if (invalidTemplateFields.has(fieldKey(['transport', ...basePath, key]))) {
+            redacted[key] = redactedValue();
+            continue;
+        }
+        if (exposeTemplateExpressions &&
+            typeof entry === 'string' &&
+            isSafeTemplateExpressionValue(entry) &&
+            !containsSecretLikeString(entry)) {
+            redacted[key] = entry;
+            continue;
+        }
         redacted[key] = redactedValue();
         secretInputs.push(secretInput([...basePath, key], key));
     }
     return redacted;
 }
+function isSafeTemplateExpressionValue(value) {
+    if (!value.includes('{{'))
+        return false;
+    const withoutExpressions = value.replace(/\{\{\{?[\s\S]*?\}\}\}?/gu, '');
+    if (!/^[\s,;:|/_.-]*$/u.test(withoutExpressions))
+        return false;
+    try {
+        return !templateAstContainsStringLiteral(Handlebars.parse(value));
+    }
+    catch {
+        return false;
+    }
+}
+function templateAstContainsStringLiteral(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (Array.isArray(value))
+        return value.some(templateAstContainsStringLiteral);
+    const node = value;
+    return node.type === 'StringLiteral' || Object.values(node).some(templateAstContainsStringLiteral);
+}
 function redactOAuthConfig(value, secretInputs) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return {};