@1mcp/agent 0.36.0 → 0.38.0

package/build/transport/http/restorableStreamableTransport.js.map

@@ -1 +1 @@
-{"version":3,"file":"restorableStreamableTransport.js","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAWnG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,uCAAwC,SAAQ,6BAA6B;IAChF,WAAW,GAAG,KAAK,CAAC;IAE5B;;;;;OAKG;IACH,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,kBAAkB;QAChB,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"restorableStreamableTransport.js","sourceRoot":"","sources":["../../../src/transport/http/restorableStreamableTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,iEAAiE,CAAC"}

package/build/transport/http/routes/adminRoutes.d.ts

@@ -8,7 +8,21 @@ import type { AdminOAuthOperations } from '../../../domains/admin/adminOAuthServ
 import { type AdminPresetOperations } from '../../../domains/admin/adminPresetService.js';
 import type { AdminMutationAvailability } from '../../../domains/admin/runtimeScopeAdminLock.js';
 import type { BackendLogBroker } from '../../../domains/backend-logs/backendLogBroker.js';
+import { type SensitiveOperationRateLimitPolicy } from '../../../transport/http/middlewares/securityMiddleware.js';
 import { Router } from 'express';
+export interface AdminRateLimitPolicy {
+    login: {
+        windowMs: number;
+        maxRequests: number;
+        maxFailedAttempts: number;
+    };
+    status: {
+        windowMs: number;
+        maxRequests: number;
+    };
+    sensitive: SensitiveOperationRateLimitPolicy;
+}
+export declare const DEFAULT_ADMIN_RATE_LIMIT_POLICY: AdminRateLimitPolicy;
 interface AdminRoutesOptions {
     adminEnabled: boolean;
     adminService: AdminIdentityService;
@@ -22,6 +36,7 @@ interface AdminRoutesOptions {
     getOAuthDashboard?: () => BackendOAuthDashboardResult;
     adminConsoleAssetsDir?: string;
     getBackendLogBroker?: () => BackendLogBroker;
+    rateLimit?: AdminRateLimitPolicy;
 }
 export declare function createAdminRoutes(options: AdminRoutesOptions): Router | null;
 export declare function resolveDefaultAdminConsoleAssetsDir(): string;
@@ -29,8 +44,9 @@ export declare class FailedLoginLimiter {
     private readonly now;
     private readonly maxActiveKeys;
     private readonly windowMs;
+    private readonly maxFailedAttempts;
     private readonly attempts;
-    constructor(now?: () => number, maxActiveKeys?: number, windowMs?: number);
+    constructor(now?: () => number, maxActiveKeys?: number, windowMs?: number, maxFailedAttempts?: number);
     isLimited(username: string, origin: string): boolean;
     recordFailure(username: string, origin: string): void;
     reset(username: string, origin: string): void;

package/build/transport/http/routes/adminRoutes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adminRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/adminRoutes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,OAAO,KAAK,EACV,6BAA6B,EAI9B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAIL,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAMpF,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAWtF,OAAgB,EAAqB,MAAM,EAAE,MAAM,SAAS,CAAC;AAsH7D,UAAU,kBAAkB;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,oBAAoB,CAAC;IACnC,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAC1D,0BAA0B,CAAC,EAAE,kCAAkC,CAAC;IAChE,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,iBAAiB,CAAC,EAAE,MAAM,2BAA2B,CAAC;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,gBAAgB,CAAC;CAC9C;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CA4iB5E;AAqQD,wBAAgB,mCAAmC,IAAI,MAAM,CAE5D;AAyoBD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgE;gBAGtE,GAAG,GAAE,MAAM,MAAiB,EAC5B,aAAa,SAA+B,EAC5C,QAAQ,SAAyB;IAGpD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IASpD,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAI7C,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,YAAY;CAQrB"}
+{"version":3,"file":"adminRoutes.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/adminRoutes.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAEvF,OAAO,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAE9E,OAAO,KAAK,EACV,6BAA6B,EAI9B,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAGL,KAAK,+BAA+B,EACrC,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAIL,oBAAoB,EACrB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAMpF,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,0CAA0C,CAAC;AAClD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAQtF,OAAO,EAGL,KAAK,iCAAiC,EACvC,MAAM,uDAAuD,CAAC;AAG/D,OAAgB,EAAqB,MAAM,EAAE,MAAM,SAAS,CAAC;AAqI7D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE;QACL,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,MAAM,EAAE;QACN,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,iCAAiC,CAAC;CAC9C;AAED,eAAO,MAAM,+BAA+B,EAAE,oBAW7C,CAAC;AAEF,UAAU,kBAAkB;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,oBAAoB,CAAC;IACnC,uBAAuB,CAAC,EAAE,+BAA+B,CAAC;IAC1D,0BAA0B,CAAC,EAAE,kCAAkC,CAAC;IAChE,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC;IACtD,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,iBAAiB,CAAC,EAAE,MAAM,2BAA2B,CAAC;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,gBAAgB,CAAC;IAC7C,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAukB5E;AAqQD,wBAAgB,mCAAmC,IAAI,MAAM,CAE5D;AA80BD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IANpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgE;gBAGtE,GAAG,GAAE,MAAM,MAAiB,EAC5B,aAAa,SAA+B,EAC5C,QAAQ,SAAyB,EACjC,iBAAiB,SAAqB;IAGzD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IASpD,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAWrD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAI7C,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,YAAY;CAQrB"}

package/build/transport/http/routes/adminRoutes.js

@@ -8,7 +8,7 @@ import { AdminConfiguredServerApplyError, AdminConfiguredServerNotFoundError, }
 import { ADMIN_SESSION_COOKIE_NAME, AdminIdentityError, } from '../../../domains/admin/adminIdentityService.js';
 import { AdminInstructionTemplateNotFoundError, } from '../../../domains/admin/adminInstructionTemplateService.js';
 import { AdminPresetConflictError, AdminPresetNotFoundError, } from '../../../domains/admin/adminPresetService.js';
-import { sensitiveOperationLimiter } from '../../../transport/http/middlewares/securityMiddleware.js';
+import { createSensitiveOperationLimiter, DEFAULT_SENSITIVE_OPERATION_RATE_LIMIT_POLICY, } from '../../../transport/http/middlewares/securityMiddleware.js';
 import { sanitizeErrorMessage } from '../../../utils/validation/sanitization.js';
 import express, { Router } from 'express';
 import rateLimit from 'express-rate-limit';
@@ -117,25 +117,54 @@ const requestContextSchema = z
 })
     .strict();
 const configuredServerSourceSchema = z.enum(['mcpServers', 'mcpTemplates']);
+const configuredServerDeleteApplySchema = z
+    .object({
+    previewFingerprint: z.string().trim().min(1).max(256),
+    confirmationFacts: z
+        .object({
+        previewConfirmed: z.string().trim().min(1).max(256),
+        targetIdentityConfirmed: z.string().trim().min(1).max(512),
+    })
+        .strict(),
+})
+    .strict();
+const configuredServerLifecyclePreviewSchema = z.object({ enabled: z.boolean() }).strict();
+const configuredServerLifecycleApplySchema = configuredServerDeleteApplySchema
+    .extend({ enabled: z.boolean() })
+    .strict();
+export const DEFAULT_ADMIN_RATE_LIMIT_POLICY = {
+    login: {
+        windowMs: ADMIN_AUTH_RATE_LIMIT_WINDOW_MS,
+        maxRequests: ADMIN_AUTH_RATE_LIMIT,
+        maxFailedAttempts: FAILED_LOGIN_LIMIT,
+    },
+    status: {
+        windowMs: ADMIN_STATUS_RATE_LIMIT_WINDOW_MS,
+        maxRequests: ADMIN_STATUS_RATE_LIMIT,
+    },
+    sensitive: { ...DEFAULT_SENSITIVE_OPERATION_RATE_LIMIT_POLICY },
+};
 export function createAdminRoutes(options) {
     if (!options.adminEnabled) {
         options.adminService.revokeAllSessions();
         return null;
     }
     const router = Router();
-    const failedLoginLimiter = new FailedLoginLimiter();
+    const rateLimitPolicy = options.rateLimit ?? DEFAULT_ADMIN_RATE_LIMIT_POLICY;
+    const failedLoginLimiter = new FailedLoginLimiter(Date.now, FAILED_LOGIN_MAX_ACTIVE_KEYS, rateLimitPolicy.login.windowMs, rateLimitPolicy.login.maxFailedAttempts);
     const authenticationLimiter = rateLimit({
-        windowMs: ADMIN_AUTH_RATE_LIMIT_WINDOW_MS,
-        max: ADMIN_AUTH_RATE_LIMIT,
+        windowMs: rateLimitPolicy.login.windowMs,
+        max: rateLimitPolicy.login.maxRequests,
         standardHeaders: true,
         legacyHeaders: false,
     });
     const statusLimiter = rateLimit({
-        windowMs: ADMIN_STATUS_RATE_LIMIT_WINDOW_MS,
-        max: ADMIN_STATUS_RATE_LIMIT,
+        windowMs: rateLimitPolicy.status.windowMs,
+        max: rateLimitPolicy.status.maxRequests,
         standardHeaders: true,
         legacyHeaders: false,
     });
+    const sensitiveOperationLimiter = createSensitiveOperationLimiter(rateLimitPolicy.sensitive);
     const adminConsoleAssets = resolveAdminConsoleAssets(options.adminConsoleAssetsDir);
     options.adminService.bootstrapFirstAdminFromEnvironment();
     router.get('/cli/v1/capabilities', (req, res) => {
@@ -562,6 +591,24 @@ export function createAdminRoutes(options) {
             return void res.status(400).json({ error: 'configured_server_source_invalid' });
         await handleConfiguredServerApply(req, res, options, source.data);
     });
+    router.post('/api/configured-servers/:source/:name/delete-preview', async (req, res) => {
+        const source = configuredServerSourceSchema.safeParse(req.params.source);
+        if (!source.success)
+            return void res.status(400).json({ error: 'configured_server_source_invalid' });
+        await handleConfiguredServerDeletePreview(req, res, options, source.data);
+    });
+    router.post('/api/configured-servers/mcpTemplates/:name/lifecycle-preview', async (req, res) => {
+        await handleConfiguredServerLifecyclePreview(req, res, options);
+    });
+    router.post('/api/configured-servers/mcpTemplates/:name/lifecycle', async (req, res) => {
+        await handleConfiguredServerLifecycleApply(req, res, options);
+    });
+    router.delete('/api/configured-servers/:source/:name', async (req, res) => {
+        const source = configuredServerSourceSchema.safeParse(req.params.source);
+        if (!source.success)
+            return void res.status(400).json({ error: 'configured_server_source_invalid' });
+        await handleConfiguredServerDelete(req, res, options, source.data);
+    });
     router.post('/api/configured-servers/mcpServers/:name/enable', async (req, res) => {
         await handleConfiguredServerMutation(req, res, options, 'enableConfiguredServer', 'mcpServers');
     });
@@ -1037,7 +1084,7 @@ async function handleConfiguredServerDetail(req, res, options, targetSource) {
         const result = await options.configuredServerService.getConfiguredServerDetail({
             context: buildAdminOperationContext(req, options, {
                 type: 'configured_server',
-                id: `${targetSource ?? 'mcpServers'}:${targetName}`,
+                id: `${targetSource ?? 'mcpServers'}/${targetName}`,
             }),
             targetName,
             ...(targetSource ? { targetSource } : {}),
@@ -1062,7 +1109,7 @@ async function handleConfiguredServerDetail(req, res, options, targetSource) {
                 error: error.code,
                 code: error.code,
                 message: 'Configured server target was not found',
-                target: { type: 'configured_server', id: error.targetName },
+                target: { type: 'configured_server', id: `${targetSource ?? 'mcpServers'}/${error.targetName}` },
             });
             return;
         }
@@ -1084,7 +1131,7 @@ async function handleConfiguredToolInventoryRefresh(req, res, options, targetSou
         const result = await options.configuredServerService.refreshConfiguredToolInventory({
             context: buildAdminOperationContext(req, options, {
                 type: 'configured_server',
-                id: `${targetSource}:${targetName}`,
+                id: `${targetSource}/${targetName}`,
             }),
             targetName,
             targetSource,
@@ -1107,7 +1154,7 @@ async function handleConfiguredToolInventoryRefresh(req, res, options, targetSou
                 error: error.code,
                 code: error.code,
                 message: 'Configured server target was not found',
-                target: { type: 'configured_server', id: `${targetSource}:${targetName}` },
+                target: { type: 'configured_server', id: `${targetSource}/${targetName}` },
             });
             return;
         }
@@ -1210,7 +1257,7 @@ async function handleConfiguredServerPreview(req, res, options, targetSource) {
         const result = await options.configuredServerService.previewConfiguredServerEdit({
             context: buildAdminOperationContext(req, options, {
                 type: 'configured_server',
-                id: `${targetSource ?? 'mcpServers'}:${targetName}`,
+                id: `${targetSource ?? 'mcpServers'}/${targetName}`,
             }),
             targetName,
             ...(targetSource ? { targetSource } : {}),
@@ -1235,7 +1282,7 @@ async function handleConfiguredServerPreview(req, res, options, targetSource) {
                 error: error.code,
                 code: error.code,
                 message: 'Configured server target was not found',
-                target: { type: 'configured_server', id: error.targetName },
+                target: { type: 'configured_server', id: `${targetSource ?? 'mcpServers'}/${error.targetName}` },
             });
             return;
         }
@@ -1264,7 +1311,7 @@ async function handleConfiguredServerApply(req, res, options, targetSource) {
         const result = await options.configuredServerService.applyConfiguredServerEdit({
             context: buildAdminOperationContext(req, options, {
                 type: 'configured_server',
-                id: `${targetSource ?? 'mcpServers'}:${targetName}`,
+                id: `${targetSource ?? 'mcpServers'}/${targetName}`,
             }),
             targetName,
             ...(targetSource ? { targetSource } : {}),
@@ -1290,6 +1337,180 @@ async function handleConfiguredServerApply(req, res, options, targetSource) {
         throw error;
     }
 }
+async function handleConfiguredServerDeletePreview(req, res, options, targetSource) {
+    if (!options.configuredServerService?.previewConfiguredServerDelete) {
+        res.status(404).json({ error: 'admin_configured_server_delete_unavailable' });
+        return;
+    }
+    const targetName = req.params.name;
+    try {
+        const result = await options.configuredServerService.previewConfiguredServerDelete({
+            context: buildAdminOperationContext(req, options, {
+                type: 'configured_server',
+                id: `${targetSource}/${targetName}`,
+            }),
+            targetName,
+            targetSource,
+        });
+        if (!result.ok) {
+            if (result.status === 'mutation_failed' && isConfiguredServerApplyErrorCode(result.error)) {
+                sendConfiguredServerApplyError(res, result.error);
+                return;
+            }
+            sendAdminOperationResult(res, result);
+            return;
+        }
+        res.status(200).json({ ok: true, operationId: result.operationId, preview: result.result });
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        if (error instanceof AdminConfiguredServerApplyError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        throw error;
+    }
+}
+async function handleConfiguredServerDelete(req, res, options, targetSource) {
+    if (!options.configuredServerService?.deleteConfiguredServer) {
+        res.status(404).json({ error: 'admin_configured_server_delete_unavailable' });
+        return;
+    }
+    if (!req.header('Idempotency-Key')?.trim()) {
+        res.status(400).json({ ok: false, error: 'idempotency_key_required', code: 'idempotency_key_required' });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendAdminOperationResult(res, {
+            ok: false,
+            status: 'runtime_scope_locked',
+            code: 'runtime_scope_locked',
+            retryable: true,
+            operationName: 'deleteConfiguredServer',
+            reason: 'writer_lock_unavailable',
+        });
+        return;
+    }
+    const targetName = req.params.name;
+    const parsedBody = configuredServerDeleteApplySchema.safeParse(req.body);
+    if (!parsedBody.success) {
+        res.status(400).json({
+            ok: false,
+            error: 'configured_server_delete_request_invalid',
+            code: 'configured_server_delete_request_invalid',
+            message: 'Delete requires a current preview fingerprint and exact source-qualified confirmation facts.',
+        });
+        return;
+    }
+    try {
+        const result = await options.configuredServerService.deleteConfiguredServer({
+            context: buildAdminOperationContext(req, options, {
+                type: 'configured_server',
+                id: `${targetSource}/${targetName}`,
+            }),
+            targetName,
+            targetSource,
+            previewFingerprint: parsedBody.data.previewFingerprint,
+        });
+        if (!result.ok && result.status === 'mutation_failed' && isConfiguredServerApplyErrorCode(result.error)) {
+            sendConfiguredServerApplyError(res, result.error);
+            return;
+        }
+        sendAdminOperationResult(res, result);
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError || error instanceof AdminConfiguredServerApplyError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        throw error;
+    }
+}
+async function handleConfiguredServerLifecyclePreview(req, res, options) {
+    if (!options.configuredServerService?.previewConfiguredServerLifecycle) {
+        res.status(404).json({ error: 'admin_configured_server_lifecycle_unavailable' });
+        return;
+    }
+    const body = configuredServerLifecyclePreviewSchema.safeParse(req.body);
+    if (!body.success) {
+        res.status(400).json({ ok: false, error: 'configured_server_lifecycle_request_invalid' });
+        return;
+    }
+    try {
+        const result = await options.configuredServerService.previewConfiguredServerLifecycle({
+            context: buildAdminOperationContext(req, options, {
+                type: 'configured_server',
+                id: `mcpTemplates/${req.params.name}`,
+            }),
+            targetName: req.params.name,
+            targetSource: 'mcpTemplates',
+            enabled: body.data.enabled,
+        });
+        if (!result.ok)
+            return void sendAdminOperationResult(res, result);
+        res.status(200).json({ ok: true, operationId: result.operationId, preview: result.result });
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError || error instanceof AdminConfiguredServerApplyError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        throw error;
+    }
+}
+async function handleConfiguredServerLifecycleApply(req, res, options) {
+    if (!options.configuredServerService?.applyConfiguredServerLifecycle) {
+        res.status(404).json({ error: 'admin_configured_server_lifecycle_unavailable' });
+        return;
+    }
+    if (!req.header('Idempotency-Key')?.trim()) {
+        res.status(400).json({ ok: false, error: 'idempotency_key_required', code: 'idempotency_key_required' });
+        return;
+    }
+    if (isMutationLocked(options)) {
+        sendAdminOperationResult(res, {
+            ok: false,
+            status: 'runtime_scope_locked',
+            code: 'runtime_scope_locked',
+            retryable: true,
+            operationName: 'applyConfiguredServerLifecycle',
+            reason: 'writer_lock_unavailable',
+        });
+        return;
+    }
+    const body = configuredServerLifecycleApplySchema.safeParse(req.body);
+    if (!body.success) {
+        res.status(400).json({ ok: false, error: 'configured_server_lifecycle_request_invalid' });
+        return;
+    }
+    try {
+        const result = await options.configuredServerService.applyConfiguredServerLifecycle({
+            context: buildAdminOperationContext(req, options, {
+                type: 'configured_server',
+                id: `mcpTemplates/${req.params.name}`,
+            }),
+            targetName: req.params.name,
+            targetSource: 'mcpTemplates',
+            enabled: body.data.enabled,
+            previewFingerprint: body.data.previewFingerprint,
+        });
+        if (!result.ok && result.status === 'mutation_failed' && isConfiguredServerApplyErrorCode(result.error)) {
+            sendConfiguredServerApplyError(res, result.error);
+            return;
+        }
+        sendAdminOperationResult(res, result);
+    }
+    catch (error) {
+        if (error instanceof AdminConfiguredServerNotFoundError || error instanceof AdminConfiguredServerApplyError) {
+            sendConfiguredServerApplyError(res, error.code);
+            return;
+        }
+        throw error;
+    }
+}
 function isConfiguredServerApplyErrorCode(value) {
     return value.startsWith('configured_server_');
 }
@@ -1320,6 +1541,12 @@ function configuredServerApplyErrorMessage(code) {
             return 'The configured server could not be persisted. Inspect the Runtime Scope configuration and retry with a new idempotency key.';
         case 'configured_server_not_found':
             return 'Configured server target was not found.';
+        case 'configured_server_already_removed':
+            return 'This source-qualified configured server target was already removed. Refresh the server inventory.';
+        case 'configured_server_source_changed':
+            return 'The requested source no longer owns this configured server target. Refresh the inventory; the same name in the other source was not changed.';
+        case 'configured_server_delete_failed':
+            return 'The configured server target could not be deleted. The recovery backup and original definition were preserved.';
         default:
             return 'The configured server edit could not be applied.';
     }
@@ -1343,7 +1570,7 @@ async function handleConfiguredServerMutation(req, res, options, operationName,
     const targetName = req.params.name;
     const context = buildAdminOperationContext(req, options, {
         type: 'configured_server',
-        id: `${targetSource ?? 'mcpServers'}:${targetName}`,
+        id: `${targetSource ?? 'mcpServers'}/${targetName}`,
     });
     const input = { context, targetName, ...(targetSource ? { targetSource } : {}) };
     const result = operationName === 'enableConfiguredServer'
@@ -1382,17 +1609,19 @@ export class FailedLoginLimiter {
     now;
     maxActiveKeys;
     windowMs;
+    maxFailedAttempts;
     attempts = new Map();
-    constructor(now = Date.now, maxActiveKeys = FAILED_LOGIN_MAX_ACTIVE_KEYS, windowMs = FAILED_LOGIN_WINDOW_MS) {
+    constructor(now = Date.now, maxActiveKeys = FAILED_LOGIN_MAX_ACTIVE_KEYS, windowMs = FAILED_LOGIN_WINDOW_MS, maxFailedAttempts = FAILED_LOGIN_LIMIT) {
         this.now = now;
         this.maxActiveKeys = maxActiveKeys;
         this.windowMs = windowMs;
+        this.maxFailedAttempts = maxFailedAttempts;
     }
     isLimited(username, origin) {
         this.pruneExpired();
         const attempt = this.getAttempt(username, origin);
         if (attempt) {
-            return attempt.count >= FAILED_LOGIN_LIMIT;
+            return attempt.count >= this.maxFailedAttempts;
         }
         return this.attempts.size >= this.maxActiveKeys;
     }
@@ -1437,7 +1666,7 @@ function isUnsafeMethod(method) {
     return method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS';
 }
 function getLoginSource(req) {
-    return req.ip ?? req.socket.remoteAddress ?? req.header('origin') ?? 'unknown';
+    return req.ip ?? 'unknown';
 }
 function setAdminSessionCookie(res, externalUrl, sessionToken, expiresAt) {
     res.cookie(ADMIN_SESSION_COOKIE_NAME, sessionToken, {
@@ -1830,6 +2059,25 @@ function configuredServerRequestFingerprint(operationName, targetName, body) {
                 draftDigest: keyedRequestFingerprint(previewFingerprint, 'configured-server-create-draft', stableJsonStringify(getBodyValue(body, 'draft') ?? {})),
             }
             : {}),
+        ...(operationName === 'deleteConfiguredServer'
+            ? {
+                previewFingerprint,
+                deleteDigest: keyedRequestFingerprint(previewFingerprint, 'configured-server-delete-body', stableJsonStringify({
+                    previewFingerprint,
+                    confirmationFacts: getBodyRecord(body, 'confirmationFacts') ?? {},
+                })),
+            }
+            : {}),
+        ...(operationName === 'applyConfiguredServerLifecycle'
+            ? {
+                previewFingerprint,
+                lifecycleDigest: keyedRequestFingerprint(previewFingerprint, 'configured-server-lifecycle-body', stableJsonStringify({
+                    enabled: getBodyValue(body, 'enabled') === true,
+                    previewFingerprint,
+                    confirmationFacts: getBodyRecord(body, 'confirmationFacts') ?? {},
+                })),
+            }
+            : {}),
         ...(operationName === 'restartBackend'
             ? {
                 restartSelection: {
@@ -1847,6 +2095,12 @@ function configuredServerRequestFingerprint(operationName, targetName, body) {
     if (operationName === 'applyConfiguredServerCreate') {
         return `configured_server_create_${keyedRequestFingerprint(previewFingerprint, 'configured-server-create', normalized)}`;
     }
+    if (operationName === 'deleteConfiguredServer') {
+        return `configured_server_delete_${keyedRequestFingerprint(previewFingerprint, 'configured-server-delete', normalized)}`;
+    }
+    if (operationName === 'applyConfiguredServerLifecycle') {
+        return `configured_server_lifecycle_${keyedRequestFingerprint(previewFingerprint, 'configured-server-lifecycle', normalized)}`;
+    }
     return operationName === 'applyConfiguredServerEdit'
         ? `configured_server_apply_${keyedRequestFingerprint(previewFingerprint, 'configured-server-apply', normalized)}`
         : normalized;
@@ -1978,9 +2232,21 @@ function operationNameForRequest(req) {
     if (req.method === 'GET' && req.path === '/api/configured-servers/create-contract') {
         return 'getConfiguredServerCreateContract';
     }
+    if (req.path.endsWith('/lifecycle-preview')) {
+        return 'previewConfiguredServerLifecycle';
+    }
+    if (req.path.endsWith('/lifecycle')) {
+        return 'applyConfiguredServerLifecycle';
+    }
     if (req.path.endsWith('/preview')) {
         return 'previewConfiguredServerEdit';
     }
+    if (req.path.endsWith('/delete-preview')) {
+        return 'previewConfiguredServerDelete';
+    }
+    if (req.method === 'DELETE' && req.path.startsWith('/api/configured-servers/')) {
+        return 'deleteConfiguredServer';
+    }
     if (req.path.endsWith('/apply')) {
         return 'applyConfiguredServerEdit';
     }