portkey-admin-mcp 0.4.1 → 0.5.0

package/build/server.js

@@ -4,7 +4,7 @@
 import { pathToFileURL } from "node:url";
 
 // src/lib/http-app.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { readFileSync as readFileSync2 } from "node:fs";
 import {
   createServer as createHttpServer
@@ -12,7 +12,9 @@ import {
 import {
   createServer as createHttpsServer
 } from "node:https";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import {
+  StreamableHTTPServerTransport
+} from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import {
   isInitializeRequest,
   LATEST_PROTOCOL_VERSION,
@@ -212,11 +214,11 @@ var BaseService = class {
     }
     this.apiKey = apiKey;
     if (baseUrlOverride !== void 0) {
-      this.baseUrl = baseUrlOverride;
+      this.baseUrl = baseUrlOverride.replace(/\/+$/, "");
     } else {
       const baseUrl = process.env.PORTKEY_BASE_URL ?? DEFAULT_BASE_URL;
       validateUrl(baseUrl);
-      this.baseUrl = baseUrl;
+      this.baseUrl = baseUrl.replace(/\/+$/, "");
     }
   }
   encodePathSegment(value) {
@@ -781,6 +783,12 @@ var KeysService = class extends BaseService {
     await this.put(`/api-keys/${this.encodePathSegment(id)}`, data);
     return { success: true };
   }
+  async rotateApiKey(id, data = {}) {
+    return this.post(
+      `/api-keys/${this.encodePathSegment(id)}/rotate`,
+      data
+    );
+  }
   async deleteApiKey(id) {
     await this.delete(`/api-keys/${this.encodePathSegment(id)}`);
     return { success: true };
@@ -1490,6 +1498,31 @@ var ProvidersService = class extends BaseService {
   }
 };
 
+// src/services/secret-references.service.ts
+var SecretReferencesService = class extends BaseService {
+  async createSecretReference(data) {
+    return this.post("/secret-references", data);
+  }
+  async listSecretReferences(params) {
+    return this.get("/secret-references", params);
+  }
+  async getSecretReference(id) {
+    return this.get(
+      `/secret-references/${this.encodePathSegment(id)}`
+    );
+  }
+  async updateSecretReference(id, data) {
+    return this.put(
+      `/secret-references/${this.encodePathSegment(id)}`,
+      data
+    );
+  }
+  async deleteSecretReference(id) {
+    await this.delete(`/secret-references/${this.encodePathSegment(id)}`);
+    return { success: true };
+  }
+};
+
 // src/services/tracing.service.ts
 var TracingService = class extends BaseService {
   // Feedback endpoints
@@ -1640,8 +1673,9 @@ var WorkspacesService = class extends BaseService {
 };
 
 // src/services/index.ts
-import crypto2 from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
+var SERVICE_CACHE_HMAC_KEY = randomBytes(32);
 function resolvePortkeyApiKey(apiKey) {
   const resolvedApiKey = apiKey ?? process.env.PORTKEY_API_KEY;
   if (!resolvedApiKey) {
@@ -1655,7 +1689,7 @@ function resolveSharedPortkeyApiKey(apiKey) {
   return apiKey ?? process.env.PORTKEY_API_KEY ?? MISSING_API_KEY_PLACEHOLDER;
 }
 function getSharedServiceCacheKey(apiKey) {
-  const keyDigest = crypto2.createHash("sha256").update(apiKey).digest("hex");
+  const keyDigest = createHmac("sha256", SERVICE_CACHE_HMAC_KEY).update(apiKey).digest("hex");
   return JSON.stringify({
     apiKey: keyDigest,
     baseUrl: process.env.PORTKEY_BASE_URL?.trim() || ""
@@ -1679,6 +1713,7 @@ var PortkeyService = class {
   tracing;
   logging;
   providers;
+  secretReferences;
   mcpIntegrations;
   mcpServers;
   health;
@@ -1705,6 +1740,10 @@ var PortkeyService = class {
     this.tracing = new TracingService(resolvedApiKey, resolvedBaseUrl);
     this.logging = new LoggingService(resolvedApiKey, resolvedBaseUrl);
     this.providers = new ProvidersService(resolvedApiKey, resolvedBaseUrl);
+    this.secretReferences = new SecretReferencesService(
+      resolvedApiKey,
+      resolvedBaseUrl
+    );
     this.mcpIntegrations = new McpIntegrationsService(
       resolvedApiKey,
       resolvedBaseUrl
@@ -1726,52 +1765,92 @@ function getSharedPortkeyService(apiKey) {
 }
 
 // src/tools/index.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 
 // src/lib/type-guards.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
 
-// src/tools/analytics.tools.ts
+// src/schemas/contracts/secret-references.contract.ts
 import { z } from "zod";
+var SecretManagerTypeSchema = z.enum([
+  "aws_sm",
+  "azure_kv",
+  "hashicorp_vault"
+]);
+var SecretReferenceListItemSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  slug: z.string(),
+  manager_type: SecretManagerTypeSchema,
+  status: z.literal("ACTIVE"),
+  created_at: z.iso.datetime(),
+  last_updated_at: z.iso.datetime(),
+  object: z.literal("secret-reference")
+});
+var ListSecretReferencesResponseSchema = z.object({
+  object: z.literal("list"),
+  total: z.number().int().nonnegative(),
+  data: z.array(SecretReferenceListItemSchema)
+});
+var SecretReferenceDetailSchema = SecretReferenceListItemSchema.extend(
+  {
+    organisation_id: z.string().uuid(),
+    description: z.string().nullable(),
+    secret_path: z.string(),
+    secret_key: z.string().nullable(),
+    allow_all_workspaces: z.boolean(),
+    tags: z.record(z.string(), z.string()).nullable(),
+    created_by: z.string(),
+    auth_config: z.record(z.string(), z.unknown())
+  }
+);
+var CreateSecretReferenceResponseSchema = z.object({
+  id: z.string().uuid(),
+  slug: z.string(),
+  object: z.literal("secret-reference")
+});
+
+// src/tools/analytics.tools.ts
+import { z as z2 } from "zod";
 var baseAnalyticsSchema = {
-  time_of_generation_min: z.string().describe(
+  time_of_generation_min: z2.string().describe(
     "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
   ),
-  time_of_generation_max: z.string().describe(
+  time_of_generation_max: z2.string().describe(
     "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
   ),
-  total_units_min: z.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-  total_units_max: z.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-  cost_min: z.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-  cost_max: z.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-  prompt_token_min: z.coerce.number().positive().optional().describe("Minimum number of prompt tokens"),
-  prompt_token_max: z.coerce.number().positive().optional().describe("Maximum number of prompt tokens"),
-  completion_token_min: z.coerce.number().positive().optional().describe("Minimum number of completion tokens"),
-  completion_token_max: z.coerce.number().positive().optional().describe("Maximum number of completion tokens"),
-  status_code: z.string().optional().describe(
+  total_units_min: z2.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+  total_units_max: z2.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+  cost_min: z2.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+  cost_max: z2.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+  prompt_token_min: z2.coerce.number().positive().optional().describe("Minimum number of prompt tokens"),
+  prompt_token_max: z2.coerce.number().positive().optional().describe("Maximum number of prompt tokens"),
+  completion_token_min: z2.coerce.number().positive().optional().describe("Minimum number of completion tokens"),
+  completion_token_max: z2.coerce.number().positive().optional().describe("Maximum number of completion tokens"),
+  status_code: z2.string().optional().describe(
     "Legacy Portkey query param for HTTP status codes. Comma-separated string; prefer status_codes for structured inputs."
   ),
-  weighted_feedback_min: z.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
-  weighted_feedback_max: z.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
-  virtual_keys: z.string().optional().describe(
+  weighted_feedback_min: z2.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
+  weighted_feedback_max: z2.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
+  virtual_keys: z2.string().optional().describe(
     "Legacy Portkey query param for virtual key slugs. Comma-separated string; prefer virtual_key_slugs for structured inputs."
   ),
-  configs: z.string().optional().describe(
+  configs: z2.string().optional().describe(
     "Legacy Portkey query param for config slugs. Comma-separated string; prefer config_slugs for structured inputs."
   ),
-  status_codes: z.array(z.string()).optional().describe(
+  status_codes: z2.array(z2.string()).optional().describe(
     "Structured alias for status_code. Use an array of HTTP status codes; normalized to the legacy comma-separated Portkey query param."
   ),
-  virtual_key_slugs: z.array(z.string()).optional().describe(
+  virtual_key_slugs: z2.array(z2.string()).optional().describe(
     "Structured alias for virtual_keys. Use an array of virtual key slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  config_slugs: z.array(z.string()).optional().describe(
+  config_slugs: z2.array(z2.string()).optional().describe(
     "Structured alias for configs. Use an array of config slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  workspace_slug: z.string().optional().describe("Filter by specific workspace"),
-  api_key_ids: z.preprocess((value) => {
+  workspace_slug: z2.string().optional().describe("Filter by specific workspace"),
+  api_key_ids: z2.preprocess((value) => {
     if (value == null) {
       return value;
     }
@@ -1779,43 +1858,43 @@ var baseAnalyticsSchema = {
       return value.map((item) => String(item)).join(",");
     }
     return value;
-  }, z.string().optional()).describe(
+  }, z2.string().optional()).describe(
     "Legacy Portkey query param for API key UUIDs. Comma-separated string; request_analytics also accepts an array and normalizes it to this form."
   ),
-  metadata: z.string().optional().describe(
+  metadata: z2.string().optional().describe(
     `Legacy Portkey query param for metadata filtering. Stringified JSON object, e.g. '{"env":"prod","app":"myapp"}'; prefer metadata_filter for structured inputs.`
   ),
-  ai_org_model: z.string().optional().describe(
+  ai_org_model: z2.string().optional().describe(
     "Legacy Portkey query param for provider/model pairs. Format: 'provider__model' with double underscore, e.g. 'openai__gpt-4' or 'anthropic__claude-3-opus'. Comma-separated string; prefer provider_models for structured inputs."
   ),
-  provider_models: z.array(z.string()).optional().describe(
+  provider_models: z2.array(z2.string()).optional().describe(
     "Structured alias for ai_org_model. Use provider__model strings in an array; normalized to the legacy comma-separated Portkey query param."
   ),
-  trace_id: z.string().optional().describe(
+  trace_id: z2.string().optional().describe(
     "Legacy Portkey query param for trace IDs. Comma-separated string; prefer trace_ids for structured inputs."
   ),
-  trace_ids: z.array(z.string()).optional().describe(
+  trace_ids: z2.array(z2.string()).optional().describe(
     "Structured alias for trace_id. Use an array of trace IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  span_id: z.string().optional().describe(
+  span_id: z2.string().optional().describe(
     "Legacy Portkey query param for span IDs. Comma-separated string; prefer span_ids for structured inputs."
   ),
-  span_ids: z.array(z.string()).optional().describe(
+  span_ids: z2.array(z2.string()).optional().describe(
     "Structured alias for span_id. Use an array of span IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  metadata_filter: z.record(z.string(), z.unknown()).optional().describe(
+  metadata_filter: z2.record(z2.string(), z2.unknown()).optional().describe(
     "Structured alias for metadata. Use an object such as { env: 'prod' }; normalized to a JSON string before the request is sent."
   ),
-  prompt_slug: z.string().optional().describe("Filter by prompt slug")
+  prompt_slug: z2.string().optional().describe("Filter by prompt slug")
 };
 var paginatedAnalyticsSchema = {
   ...baseAnalyticsSchema,
-  current_page: z.coerce.number().positive().optional().describe("Page number for pagination"),
-  page_size: z.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
+  current_page: z2.coerce.number().int().positive().optional().describe("Page number for pagination"),
+  page_size: z2.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
 };
 var analyticsGroupMetadataSchema = {
   ...paginatedAnalyticsSchema,
-  metadata_key: z.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
+  metadata_key: z2.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
 };
 function formatGraphAnalytics(summary, dataPoints) {
   return {
@@ -2398,26 +2477,26 @@ function registerAnalyticsTools(server, service) {
 }
 
 // src/tools/audit.tools.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var AUDIT_TOOL_SCHEMAS = {
   listAuditLogs: {
-    workspace_id: z2.string().optional().describe("Filter audit logs by workspace ID"),
-    actor_id: z2.string().optional().describe("Filter by the user ID who performed the action"),
-    action: z2.string().optional().describe(
+    workspace_id: z3.string().optional().describe("Filter audit logs by workspace ID"),
+    actor_id: z3.string().optional().describe("Filter by the user ID who performed the action"),
+    action: z3.string().optional().describe(
       "Filter by action type (e.g., 'create', 'update', 'delete', 'login')"
     ),
-    resource_type: z2.string().optional().describe(
+    resource_type: z3.string().optional().describe(
       "Filter by resource type (e.g., 'user', 'workspace', 'config', 'virtual_key')"
     ),
-    resource_id: z2.string().optional().describe("Filter by specific resource ID"),
-    start_time: z2.string().optional().describe(
+    resource_id: z3.string().optional().describe("Filter by specific resource ID"),
+    start_time: z3.string().optional().describe(
       "Start of time range filter (ISO 8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    end_time: z2.string().optional().describe(
+    end_time: z3.string().optional().describe(
       "End of time range filter (ISO 8601 format, e.g., '2024-01-31T23:59:59Z')"
     ),
-    current_page: z2.coerce.number().positive().optional().describe("Page number for pagination (starts at 1)"),
-    page_size: z2.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z3.coerce.number().int().positive().optional().describe("Page number for pagination (starts at 1)"),
+    page_size: z3.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   }
 };
 function registerAuditTools(server, service) {
@@ -2470,30 +2549,30 @@ function registerAuditTools(server, service) {
 }
 
 // src/tools/collections.tools.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var COLLECTIONS_TOOL_SCHEMAS = {
   listCollections: {
-    workspace_id: z3.string().optional().describe("Filter by workspace ID"),
-    search: z3.string().optional().describe("Search collections by name"),
-    current_page: z3.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z3.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    workspace_id: z4.string().optional().describe("Filter by workspace ID"),
+    search: z4.string().optional().describe("Search collections by name"),
+    current_page: z4.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z4.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   createCollection: {
-    name: z3.string().describe(
+    name: z4.string().describe(
       "Collection name (e.g., 'hourlink', 'apizone', 'research-pilot')"
     ),
-    workspace_id: z3.string().optional().describe("Workspace ID to create collection in")
+    workspace_id: z4.string().optional().describe("Workspace ID to create collection in")
   },
   getCollection: {
-    collection_id: z3.string().describe("Collection ID or slug to retrieve")
+    collection_id: z4.string().describe("Collection ID or slug to retrieve")
   },
   updateCollection: {
-    collection_id: z3.string().describe("Collection ID to update"),
-    name: z3.string().optional().describe("New name for the collection"),
-    description: z3.string().optional().describe("New description for the collection")
+    collection_id: z4.string().describe("Collection ID to update"),
+    name: z4.string().optional().describe("New name for the collection"),
+    description: z4.string().optional().describe("New description for the collection")
   },
   deleteCollection: {
-    collection_id: z3.string().describe("Collection ID to delete")
+    collection_id: z4.string().describe("Collection ID to delete")
   }
 };
 function registerCollectionsTools(server, service) {
@@ -2614,69 +2693,69 @@ function registerCollectionsTools(server, service) {
 }
 
 // src/tools/configs.tools.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var CONFIGS_TOOL_SCHEMAS = {
   listConfigs: {
-    current_page: z4.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z4.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z5.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z5.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getConfig: {
-    slug: z4.string().describe(
+    slug: z5.string().describe(
       "The unique identifier (slug) of the configuration to retrieve. This can be found in the configuration's URL or from the list_configs tool response"
     )
   },
   createConfig: {
-    name: z4.string().describe("Name for the new configuration"),
-    workspace_id: z4.string().optional().describe("Workspace ID to create config in"),
-    cache_mode: z4.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z4.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z4.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z4.array(z4.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
-    strategy_mode: z4.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
-    targets: z4.array(
-      z4.object({
-        provider: z4.string().optional(),
-        virtual_key: z4.string().optional()
+    name: z5.string().describe("Name for the new configuration"),
+    workspace_id: z5.string().optional().describe("Workspace ID to create config in"),
+    cache_mode: z5.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z5.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
+    strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
+    targets: z5.array(
+      z5.object({
+        provider: z5.string().optional(),
+        virtual_key: z5.string().optional()
       }).refine((t) => t.provider || t.virtual_key, {
         message: "Each target must have at least provider or virtual_key"
       })
     ).optional().describe("Array of target providers with virtual keys")
   },
   updateConfig: {
-    slug: z4.string().describe("Configuration slug to update"),
-    name: z4.string().optional().describe("New name for the configuration"),
-    status: z4.enum(["active", "inactive"]).optional().describe("Configuration status"),
-    cache_mode: z4.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z4.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z4.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z4.array(z4.coerce.number()).optional().describe("HTTP status codes to retry on"),
-    strategy_mode: z4.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
-    targets: z4.array(
-      z4.object({
-        provider: z4.string().optional(),
-        virtual_key: z4.string().optional()
+    slug: z5.string().describe("Configuration slug to update"),
+    name: z5.string().optional().describe("New name for the configuration"),
+    status: z5.enum(["active", "inactive"]).optional().describe("Configuration status"),
+    cache_mode: z5.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z5.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on"),
+    strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
+    targets: z5.array(
+      z5.object({
+        provider: z5.string().optional(),
+        virtual_key: z5.string().optional()
       }).refine((t) => t.provider || t.virtual_key, {
         message: "Each target must have at least provider or virtual_key"
       })
     ).optional().describe("Array of target providers")
   },
   deleteConfig: {
-    slug: z4.string().describe("Configuration slug to delete")
+    slug: z5.string().describe("Configuration slug to delete")
   },
   listConfigVersions: {
-    slug: z4.string().describe("Configuration slug to list versions for")
+    slug: z5.string().describe("Configuration slug to list versions for")
   }
 };
-var configPayloadSchema = z4.object({
-  cache_mode: z4.enum(["simple", "semantic"]).optional(),
-  cache_max_age: z4.coerce.number().positive().optional(),
-  retry_attempts: z4.coerce.number().positive().max(5).optional(),
-  retry_on_status_codes: z4.array(z4.coerce.number()).optional(),
-  strategy_mode: z4.enum(["loadbalance", "fallback"]).optional(),
-  targets: z4.array(
-    z4.object({
-      provider: z4.string().optional(),
-      virtual_key: z4.string().optional()
+var configPayloadSchema = z5.object({
+  cache_mode: z5.enum(["simple", "semantic"]).optional(),
+  cache_max_age: z5.coerce.number().positive().optional(),
+  retry_attempts: z5.coerce.number().positive().max(5).optional(),
+  retry_on_status_codes: z5.array(z5.coerce.number()).optional(),
+  strategy_mode: z5.enum(["loadbalance", "fallback"]).optional(),
+  targets: z5.array(
+    z5.object({
+      provider: z5.string().optional(),
+      virtual_key: z5.string().optional()
     })
   ).optional()
 });
@@ -2893,53 +2972,53 @@ function registerConfigsTools(server, service) {
 }
 
 // src/tools/guardrails.tools.ts
-import { z as z5 } from "zod";
-var guardrailCheckSchema = z5.object({
-  id: z5.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
-  name: z5.string().optional().describe("Display name for the check"),
-  is_enabled: z5.boolean().optional().describe("Whether the check is enabled"),
-  parameters: z5.record(z5.string(), z5.unknown()).optional().describe("Check-specific configuration parameters")
+import { z as z6 } from "zod";
+var guardrailCheckSchema = z6.object({
+  id: z6.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
+  name: z6.string().optional().describe("Display name for the check"),
+  is_enabled: z6.boolean().optional().describe("Whether the check is enabled"),
+  parameters: z6.record(z6.string(), z6.unknown()).optional().describe("Check-specific configuration parameters")
 });
-var guardrailFeedbackSchema = z5.object({
-  value: z5.coerce.number().optional().describe("Feedback value"),
-  weight: z5.coerce.number().optional().describe("Feedback weight"),
-  metadata: z5.record(z5.string(), z5.unknown()).optional().describe("Additional metadata")
+var guardrailFeedbackSchema = z6.object({
+  value: z6.coerce.number().optional().describe("Feedback value"),
+  weight: z6.coerce.number().optional().describe("Feedback weight"),
+  metadata: z6.record(z6.string(), z6.unknown()).optional().describe("Additional metadata")
 });
-var guardrailActionSchema = z5.object({
-  deny: z5.boolean().optional().describe("Whether to deny the request on check failure"),
-  async: z5.boolean().optional().describe("Whether to run checks asynchronously"),
+var guardrailActionSchema = z6.object({
+  deny: z6.boolean().optional().describe("Whether to deny the request on check failure"),
+  async: z6.boolean().optional().describe("Whether to run checks asynchronously"),
   on_success: guardrailFeedbackSchema.optional().describe("Feedback configuration for successful checks"),
   on_fail: guardrailFeedbackSchema.optional().describe("Feedback configuration for failed checks"),
-  on_fail_action: z5.string().optional().describe("Simple action on failure (e.g., 'block')"),
-  message: z5.string().optional().describe("Message to return when guardrail triggers")
+  on_fail_action: z6.string().optional().describe("Simple action on failure (e.g., 'block')"),
+  message: z6.string().optional().describe("Message to return when guardrail triggers")
 });
 var GUARDRAILS_TOOL_SCHEMAS = {
   listGuardrails: {
-    workspace_id: z5.string().optional().describe("Filter guardrails by workspace ID"),
-    organisation_id: z5.string().optional().describe("Filter guardrails by organization ID"),
-    page_size: z5.coerce.number().min(1).max(100).optional().describe("Number of items per page (1-100, default: 100)"),
-    current_page: z5.coerce.number().positive().optional().describe("Page number for pagination")
+    workspace_id: z6.string().optional().describe("Filter guardrails by workspace ID"),
+    organisation_id: z6.string().optional().describe("Filter guardrails by organization ID"),
+    page_size: z6.coerce.number().int().min(1).max(100).optional().describe("Number of items per page (1-100, default: 100)"),
+    current_page: z6.coerce.number().int().positive().optional().describe("Page number for pagination")
   },
   getGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
+    guardrail_id: z6.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
   },
   createGuardrail: {
-    name: z5.string().describe("Name of the guardrail"),
-    checks: z5.array(guardrailCheckSchema).min(1).describe("Array of checks to apply (at least one required)"),
+    name: z6.string().describe("Name of the guardrail"),
+    checks: z6.array(guardrailCheckSchema).min(1).describe("Array of checks to apply (at least one required)"),
     actions: guardrailActionSchema.describe(
       "Actions to take when guardrail checks pass or fail"
     ),
-    workspace_id: z5.string().optional().describe("Workspace ID to create the guardrail in"),
-    organisation_id: z5.string().optional().describe("Organisation ID (required if workspace_id not provided)")
+    workspace_id: z6.string().optional().describe("Workspace ID to create the guardrail in"),
+    organisation_id: z6.string().optional().describe("Organisation ID (required if workspace_id not provided)")
   },
   updateGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug to update"),
-    name: z5.string().optional().describe("New name for the guardrail"),
-    checks: z5.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
+    guardrail_id: z6.string().describe("The guardrail UUID or slug to update"),
+    name: z6.string().optional().describe("New name for the guardrail"),
+    checks: z6.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
     actions: guardrailActionSchema.optional().describe("Updated actions configuration")
   },
   deleteGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug to delete")
+    guardrail_id: z6.string().describe("The guardrail UUID or slug to delete")
   }
 };
 function registerGuardrailsTools(server, service) {
@@ -3089,7 +3168,7 @@ function registerGuardrailsTools(server, service) {
 }
 
 // src/tools/integrations.tools.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/lib/limits.ts
 var PERIODIC_RESET_DEFAULT = "monthly";
@@ -3134,91 +3213,91 @@ function buildRateLimits(params) {
 // src/tools/integrations.tools.ts
 var INTEGRATIONS_TOOL_SCHEMAS = {
   listIntegrations: {
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
-    workspace_id: z6.string().optional().describe("Filter integrations accessible by a specific workspace"),
-    type: z6.enum(["workspace", "organisation", "all"]).optional().describe(
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
+    workspace_id: z7.string().optional().describe("Filter integrations accessible by a specific workspace"),
+    type: z7.enum(["workspace", "organisation", "all"]).optional().describe(
       "Filter by integration type: 'workspace', 'organisation', or 'all' (default)"
     )
   },
   createIntegration: {
-    name: z6.string().describe("Human-readable name for the integration"),
-    ai_provider_id: z6.string().describe(
+    name: z7.string().describe("Human-readable name for the integration"),
+    ai_provider_id: z7.string().describe(
       "ID of the AI provider (e.g., 'openai', 'anthropic', 'azure-openai', 'aws-bedrock', 'vertex-ai')"
     ),
-    slug: z6.string().optional().describe(
+    slug: z7.string().optional().describe(
       "URL-friendly identifier (auto-generated from name if not provided)"
     ),
-    key: z6.string().optional().describe("API key for the provider (if required)"),
-    description: z6.string().optional().describe("Optional description of the integration"),
-    workspace_id: z6.string().optional().describe("Workspace ID for workspace-scoped integrations"),
-    api_version: z6.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z6.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z6.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    aws_region: z6.string().optional().describe("AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z6.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z6.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z6.string().optional().describe("GCP project ID (for Vertex AI)"),
-    vertex_region: z6.string().optional().describe("GCP region (for Vertex AI)"),
-    custom_host: z6.string().optional().describe("Custom base URL for the provider")
+    key: z7.string().optional().describe("API key for the provider (if required)"),
+    description: z7.string().optional().describe("Optional description of the integration"),
+    workspace_id: z7.string().optional().describe("Workspace ID for workspace-scoped integrations"),
+    api_version: z7.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z7.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z7.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    aws_region: z7.string().optional().describe("AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z7.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z7.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z7.string().optional().describe("GCP project ID (for Vertex AI)"),
+    vertex_region: z7.string().optional().describe("GCP region (for Vertex AI)"),
+    custom_host: z7.string().optional().describe("Custom base URL for the provider")
   },
   getIntegration: {
-    slug: z6.string().describe("The unique slug identifier of the integration to retrieve")
+    slug: z7.string().describe("The unique slug identifier of the integration to retrieve")
   },
   updateIntegration: {
-    slug: z6.string().describe("The slug of the integration to update"),
-    name: z6.string().optional().describe("New human-readable name for the integration"),
-    key: z6.string().optional().describe("New API key for the provider"),
-    description: z6.string().optional().describe("New description for the integration"),
-    api_version: z6.string().optional().describe("New API version (for Azure OpenAI)"),
-    resource_name: z6.string().optional().describe("New resource name (for Azure OpenAI)"),
-    deployment_name: z6.string().optional().describe("New deployment name (for Azure OpenAI)"),
-    aws_region: z6.string().optional().describe("New AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z6.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z6.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z6.string().optional().describe("New GCP project ID (for Vertex AI)"),
-    vertex_region: z6.string().optional().describe("New GCP region (for Vertex AI)"),
-    custom_host: z6.string().optional().describe("New custom base URL for the provider")
+    slug: z7.string().describe("The slug of the integration to update"),
+    name: z7.string().optional().describe("New human-readable name for the integration"),
+    key: z7.string().optional().describe("New API key for the provider"),
+    description: z7.string().optional().describe("New description for the integration"),
+    api_version: z7.string().optional().describe("New API version (for Azure OpenAI)"),
+    resource_name: z7.string().optional().describe("New resource name (for Azure OpenAI)"),
+    deployment_name: z7.string().optional().describe("New deployment name (for Azure OpenAI)"),
+    aws_region: z7.string().optional().describe("New AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z7.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z7.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z7.string().optional().describe("New GCP project ID (for Vertex AI)"),
+    vertex_region: z7.string().optional().describe("New GCP region (for Vertex AI)"),
+    custom_host: z7.string().optional().describe("New custom base URL for the provider")
   },
   deleteIntegration: {
-    slug: z6.string().describe("The slug of the integration to delete")
+    slug: z7.string().describe("The slug of the integration to delete")
   },
   listIntegrationModels: {
-    slug: z6.string().describe("The slug of the integration"),
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z7.string().describe("The slug of the integration"),
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationModels: {
-    slug: z6.string().describe("The slug of the integration"),
-    models: z6.array(
-      z6.object({
-        slug: z6.string().describe("The model slug identifier"),
-        model_name: z6.string().optional().describe(
+    slug: z7.string().describe("The slug of the integration"),
+    models: z7.array(
+      z7.object({
+        slug: z7.string().describe("The model slug identifier"),
+        model_name: z7.string().optional().describe(
           "Display name for the model (required for custom models)"
         ),
-        enabled: z6.boolean().describe("Whether the model is enabled"),
-        is_custom: z6.boolean().optional().describe("Whether this is a custom model (default: false)")
+        enabled: z7.boolean().describe("Whether the model is enabled"),
+        is_custom: z7.boolean().optional().describe("Whether this is a custom model (default: false)")
       })
     ).describe("Array of model configurations to update")
   },
   deleteIntegrationModel: {
-    slug: z6.string().describe("The slug of the integration"),
-    model_slug: z6.string().describe("The slug of the model to delete")
+    slug: z7.string().describe("The slug of the integration"),
+    model_slug: z7.string().describe("The slug of the model to delete")
   },
   listIntegrationWorkspaces: {
-    slug: z6.string().describe("The slug of the integration"),
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z7.string().describe("The slug of the integration"),
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationWorkspaces: {
-    slug: z6.string().describe("The slug of the integration"),
-    workspaces: z6.array(
-      z6.object({
-        id: z6.string().describe("The workspace ID"),
-        enabled: z6.boolean().describe("Whether the workspace has access to this integration"),
-        credit_limit: z6.coerce.number().positive().optional().describe("Credit limit for this workspace"),
-        alert_threshold: z6.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-        rate_limit_rpm: z6.coerce.number().positive().optional().describe("Rate limit in requests per minute")
+    slug: z7.string().describe("The slug of the integration"),
+    workspaces: z7.array(
+      z7.object({
+        id: z7.string().describe("The workspace ID"),
+        enabled: z7.boolean().describe("Whether the workspace has access to this integration"),
+        credit_limit: z7.coerce.number().positive().optional().describe("Credit limit for this workspace"),
+        alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+        rate_limit_rpm: z7.coerce.number().positive().optional().describe("Rate limit in requests per minute")
       })
     ).describe("Array of workspace configurations to update")
   }
@@ -3551,104 +3630,110 @@ function registerIntegrationsTools(server, service) {
 }
 
 // src/tools/keys.tools.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var KEYS_TOOL_SCHEMAS = {
   listVirtualKeys: {
-    current_page: z7.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z7.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   createVirtualKey: {
-    name: z7.string().describe("Display name for the virtual key"),
-    provider: z7.string().describe(
+    name: z8.string().describe("Display name for the virtual key"),
+    provider: z8.string().describe(
       "Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')"
     ),
-    key: z7.string().describe("The actual provider API key to store"),
-    note: z7.string().optional().describe("Optional note or description for this key"),
-    workspace_id: z7.string().optional().describe("Workspace ID to create the key in"),
-    api_version: z7.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z7.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z7.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    credit_limit: z7.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe(
+    key: z8.string().describe("The actual provider API key to store"),
+    note: z8.string().optional().describe("Optional note or description for this key"),
+    workspace_id: z8.string().optional().describe("Workspace ID to create the key in"),
+    api_version: z8.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z8.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z8.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    credit_limit: z8.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe(
       "Percentage of credit_limit at which to send alert emails (0-100)"
     ),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("Requests per minute limit")
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Requests per minute limit")
   },
   getVirtualKey: {
-    slug: z7.string().describe("The unique slug identifier of the virtual key to retrieve")
+    slug: z8.string().describe("The unique slug identifier of the virtual key to retrieve")
   },
   updateVirtualKey: {
-    slug: z7.string().describe("The slug of the virtual key to update"),
-    name: z7.string().optional().describe("New display name for the key"),
-    key: z7.string().optional().describe("New provider API key value"),
-    note: z7.string().optional().describe("New note or description"),
-    credit_limit: z7.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("New rate limit in requests per minute")
+    slug: z8.string().describe("The slug of the virtual key to update"),
+    name: z8.string().optional().describe("New display name for the key"),
+    key: z8.string().optional().describe("New provider API key value"),
+    note: z8.string().optional().describe("New note or description"),
+    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute")
   },
   deleteVirtualKey: {
-    slug: z7.string().describe("The slug of the virtual key to delete")
+    slug: z8.string().describe("The slug of the virtual key to delete")
   },
   createApiKey: {
-    type: z7.enum(["organisation", "workspace"]).describe(
+    type: z8.enum(["organisation", "workspace"]).describe(
       "Key type: 'organisation' for org-wide access or 'workspace' for workspace-scoped"
     ),
-    sub_type: z7.enum(["user", "service"]).describe(
+    sub_type: z8.enum(["user", "service"]).describe(
       "Sub-type: 'user' for user-associated keys or 'service' for service accounts"
     ),
-    name: z7.string().describe("Display name for the API key"),
-    description: z7.string().optional().describe("Optional description for the key"),
-    workspace_id: z7.string().optional().describe("Workspace ID (required for workspace-type keys)"),
-    user_id: z7.string().optional().describe("User ID (required for user sub-type keys)"),
-    scopes: z7.array(z7.string()).describe(
+    name: z8.string().describe("Display name for the API key"),
+    description: z8.string().optional().describe("Optional description for the key"),
+    workspace_id: z8.string().optional().describe("Workspace ID (required for workspace-type keys)"),
+    user_id: z8.string().optional().describe("User ID (required for user sub-type keys)"),
+    scopes: z8.array(z8.string()).describe(
       "Permission scopes for the key (e.g., ['logs.read', 'analytics.read'])"
     ),
-    credit_limit: z7.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
-    default_config_id: z7.string().optional().describe("Default configuration ID to use with this key"),
-    default_metadata: z7.record(z7.string(), z7.string()).optional().describe("Default metadata key-value pairs"),
-    alert_emails: z7.array(z7.string()).optional().describe("Email addresses for alerts"),
-    expires_at: z7.string().optional().describe("Expiration date in ISO 8601 format")
+    credit_limit: z8.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+    default_config_id: z8.string().optional().describe("Default configuration ID to use with this key"),
+    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("Default metadata key-value pairs"),
+    alert_emails: z8.array(z8.string()).optional().describe("Email addresses for alerts"),
+    expires_at: z8.string().optional().describe("Expiration date in ISO 8601 format")
   },
   listApiKeys: {
-    page_size: z7.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    current_page: z7.coerce.number().positive().optional().describe("Page number for pagination"),
-    workspace_id: z7.string().optional().describe("Filter by workspace ID")
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    workspace_id: z8.string().optional().describe("Filter by workspace ID")
   },
   getApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to retrieve")
+    id: z8.string().uuid().describe("The UUID of the API key to retrieve")
   },
   updateApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to update"),
-    name: z7.string().optional().describe("New display name for the key"),
-    description: z7.string().optional().describe("New description for the key"),
-    scopes: z7.array(z7.string()).optional().describe("New permission scopes for the key"),
-    credit_limit: z7.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
-    default_config_id: z7.string().optional().describe("New default configuration ID"),
-    default_metadata: z7.record(z7.string(), z7.string()).optional().describe("New default metadata key-value pairs"),
-    alert_emails: z7.array(z7.string()).optional().describe("New email addresses for alerts"),
-    expires_at: z7.string().nullable().optional().describe(
+    id: z8.string().uuid().describe("The UUID of the API key to update"),
+    name: z8.string().optional().describe("New display name for the key"),
+    description: z8.string().optional().describe("New description for the key"),
+    scopes: z8.array(z8.string()).optional().describe("New permission scopes for the key"),
+    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
+    default_config_id: z8.string().optional().describe("New default configuration ID"),
+    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("New default metadata key-value pairs"),
+    alert_emails: z8.array(z8.string()).optional().describe("New email addresses for alerts"),
+    expires_at: z8.string().nullable().optional().describe(
       "New expiration date in ISO 8601 format, or null to remove expiration"
     )
   },
+  rotateApiKey: {
+    id: z8.string().uuid().describe("API key UUID obtained from list_api_keys"),
+    key_transition_period_ms: z8.coerce.number().int().min(18e5).optional().describe(
+      "Overlap in milliseconds while the previous key remains valid; minimum 1,800,000 (30 minutes), for example 3,600,000 for 1 hour"
+    )
+  },
   deleteApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to delete")
+    id: z8.string().uuid().describe("The UUID of the API key to delete")
   }
 };
-var createApiKeySchema = z7.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
+var createApiKeySchema = z8.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
   if (value.type === "workspace" && !value.workspace_id) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["workspace_id"],
       message: "workspace_id is required when type is 'workspace'"
     });
   }
   if (value.sub_type === "user" && !value.user_id) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["user_id"],
       message: "user_id is required when sub_type is 'user'"
     });
@@ -4004,40 +4089,71 @@ function registerKeysTools(server, service) {
       };
     }
   );
+  server.tool(
+    "rotate_api_key",
+    "Rotate an API key without changing its identity or scopes. The new secret is returned once and exposed to this MCP transcript, while the previous secret remains valid until key_transition_expires_at. Store the new key securely, update callers during the transition window, and never log either secret.",
+    KEYS_TOOL_SCHEMAS.rotateApiKey,
+    {
+      title: "Rotate API Key",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.keys.rotateApiKey(params.id, {
+        key_transition_period_ms: params.key_transition_period_ms
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully rotated API key "${result.id}"`,
+              warning: "Copy this new key now; it is returned only once. Replace callers before key_transition_expires_at and never log either key.",
+              id: result.id,
+              key: result.key,
+              key_transition_expires_at: result.key_transition_expires_at
+            })
+          }
+        ]
+      };
+    }
+  );
 }
 
 // src/tools/labels.tools.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var LABELS_TOOL_SCHEMAS = {
   createPromptLabel: {
-    name: z8.string().describe("Name of the label"),
-    organisation_id: z8.string().optional().describe("Organisation ID to create the label in"),
-    workspace_id: z8.string().optional().describe("Workspace ID to create the label in"),
-    description: z8.string().optional().describe("Description of the label"),
-    color_code: z8.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
+    name: z9.string().describe("Name of the label"),
+    organisation_id: z9.string().optional().describe("Organisation ID to create the label in"),
+    workspace_id: z9.string().optional().describe("Workspace ID to create the label in"),
+    description: z9.string().optional().describe("Description of the label"),
+    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
       "Hex format, e.g. '#FF5733'. Optional \u2014 omit for default color."
     )
   },
   listPromptLabels: {
-    organisation_id: z8.string().optional().describe("Filter by organisation ID"),
-    workspace_id: z8.string().optional().describe("Filter by workspace ID"),
-    search: z8.string().optional().describe("Search labels by name"),
-    current_page: z8.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z8.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    organisation_id: z9.string().optional().describe("Filter by organisation ID"),
+    workspace_id: z9.string().optional().describe("Filter by workspace ID"),
+    search: z9.string().optional().describe("Search labels by name"),
+    current_page: z9.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z9.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPromptLabel: {
-    label_id: z8.string().describe("Label ID to retrieve"),
-    organisation_id: z8.string().optional().describe("Organisation ID for filtering"),
-    workspace_id: z8.string().optional().describe("Workspace ID for filtering")
+    label_id: z9.string().describe("Label ID to retrieve"),
+    organisation_id: z9.string().optional().describe("Organisation ID for filtering"),
+    workspace_id: z9.string().optional().describe("Workspace ID for filtering")
   },
   updatePromptLabel: {
-    label_id: z8.string().describe("Label ID to update"),
-    name: z8.string().optional().describe("New name for the label"),
-    description: z8.string().optional().describe("New description"),
-    color_code: z8.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
+    label_id: z9.string().describe("Label ID to update"),
+    name: z9.string().optional().describe("New name for the label"),
+    description: z9.string().optional().describe("New description"),
+    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
   },
   deletePromptLabel: {
-    label_id: z8.string().describe("Label ID to delete")
+    label_id: z9.string().describe("Label ID to delete")
   }
 };
 function registerLabelsTools(server, service) {
@@ -4177,86 +4293,86 @@ function registerLabelsTools(server, service) {
 }
 
 // src/tools/limits.tools.ts
-import { z as z9 } from "zod";
-var conditionSchema = z9.object({
-  field: z9.string().describe(
+import { z as z10 } from "zod";
+var conditionSchema = z10.object({
+  field: z10.string().describe(
     "The field to match on (e.g., 'virtual_key', 'api_key', 'user_id', 'metadata.key')"
   ),
-  operator: z9.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
-  value: z9.string().describe("The value to match against")
+  operator: z10.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
+  value: z10.string().describe("The value to match against")
 });
 var LIMITS_TOOL_SCHEMAS = {
   listRateLimits: {
-    workspace_id: z9.string().optional().describe("Filter rate limits by workspace ID")
+    workspace_id: z10.string().optional().describe("Filter rate limits by workspace ID")
   },
   getRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit")
+    id: z10.string().describe("The unique identifier of the rate limit")
   },
   createRateLimit: {
-    conditions: z9.array(conditionSchema).describe(
+    conditions: z10.array(conditionSchema).describe(
       "Array of conditions that determine which requests this rate limit applies to"
     ),
-    group_by: z9.array(z9.string()).describe(
+    group_by: z10.array(z10.string()).describe(
       "Array of fields to group the rate limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z9.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
-    unit: z9.enum(["rpm", "rph", "rpd"]).describe(
+    type: z10.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
+    unit: z10.enum(["rpm", "rph", "rpd"]).describe(
       "Time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z9.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
-    name: z9.string().optional().describe("Optional name for the rate limit"),
-    workspace_id: z9.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z9.string().optional().describe("Organisation ID to scope the limit to")
+    value: z10.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
+    name: z10.string().optional().describe("Optional name for the rate limit"),
+    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit"),
-    name: z9.string().optional().describe("New name for the rate limit"),
-    unit: z9.enum(["rpm", "rph", "rpd"]).optional().describe(
+    id: z10.string().describe("The unique identifier of the rate limit"),
+    name: z10.string().optional().describe("New name for the rate limit"),
+    unit: z10.enum(["rpm", "rph", "rpd"]).optional().describe(
       "New time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z9.coerce.number().positive().optional().describe("New maximum allowed value per unit")
+    value: z10.coerce.number().positive().optional().describe("New maximum allowed value per unit")
   },
   deleteRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit")
+    id: z10.string().describe("The unique identifier of the rate limit")
   },
   listUsageLimits: {
-    workspace_id: z9.string().optional().describe("Filter usage limits by workspace ID")
+    workspace_id: z10.string().optional().describe("Filter usage limits by workspace ID")
   },
   getUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit")
+    id: z10.string().describe("The unique identifier of the usage limit")
   },
   createUsageLimit: {
-    conditions: z9.array(conditionSchema).describe(
+    conditions: z10.array(conditionSchema).describe(
       "Array of conditions that determine which requests this usage limit applies to"
     ),
-    group_by: z9.array(z9.string()).describe(
+    group_by: z10.array(z10.string()).describe(
       "Array of fields to group the usage limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z9.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
-    credit_limit: z9.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
-    name: z9.string().optional().describe("Optional name for the usage limit"),
-    alert_threshold: z9.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
-    periodic_reset: z9.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
-    workspace_id: z9.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z9.string().optional().describe("Organisation ID to scope the limit to")
+    type: z10.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
+    credit_limit: z10.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
+    name: z10.string().optional().describe("Optional name for the usage limit"),
+    alert_threshold: z10.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
+    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
+    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit"),
-    name: z9.string().optional().describe("New name for the usage limit"),
-    credit_limit: z9.coerce.number().positive().optional().describe("New maximum allowed usage value"),
-    alert_threshold: z9.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
-    periodic_reset: z9.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
-    reset_usage_for_value: z9.string().optional().describe("Reset usage counters for a specific group_by value")
+    id: z10.string().describe("The unique identifier of the usage limit"),
+    name: z10.string().optional().describe("New name for the usage limit"),
+    credit_limit: z10.coerce.number().positive().optional().describe("New maximum allowed usage value"),
+    alert_threshold: z10.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
+    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
+    reset_usage_for_value: z10.string().optional().describe("Reset usage counters for a specific group_by value")
   },
   deleteUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit")
+    id: z10.string().describe("The unique identifier of the usage limit")
   },
   listUsageLimitEntities: {
-    limit_id: z9.string().describe("Usage limit policy ID")
+    limit_id: z10.string().describe("Usage limit policy ID")
   },
   resetUsageLimitEntity: {
-    limit_id: z9.string().describe("Usage limit policy ID"),
-    entity_id: z9.string().describe("Entity ID to reset usage for")
+    limit_id: z10.string().describe("Usage limit policy ID"),
+    entity_id: z10.string().describe("Entity ID to reset usage for")
   }
 };
 function formatRateLimit(limit) {
@@ -4562,8 +4678,8 @@ function registerLimitsTools(server, service) {
 }
 
 // src/tools/logging.tools.ts
-import { z as z10 } from "zod";
-var logExportFieldSchema = z10.enum([
+import { z as z11 } from "zod";
+var logExportFieldSchema = z11.enum([
   "id",
   "trace_id",
   "created_at",
@@ -4587,64 +4703,64 @@ var logExportFieldSchema = z10.enum([
 ]);
 var LOGGING_TOOL_SCHEMAS = {
   insertLog: {
-    request_url: z10.string().optional().describe("The endpoint URL being called"),
-    request_provider: z10.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
-    request_method: z10.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
-    request_headers: z10.record(z10.string(), z10.string()).optional().describe("Request headers as key-value pairs"),
-    request_body: z10.record(z10.string(), z10.unknown()).optional().describe("Request payload/body"),
-    response_status: z10.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
-    response_headers: z10.record(z10.string(), z10.string()).optional().describe("Response headers as key-value pairs"),
-    response_body: z10.record(z10.string(), z10.unknown()).optional().describe("Response payload/body"),
-    response_time: z10.coerce.number().optional().describe("Response latency in milliseconds"),
-    streaming_mode: z10.boolean().optional().default(false).describe("Whether the response was streamed"),
-    metadata_organization: z10.string().optional().describe("Organization identifier for the log"),
-    metadata_user: z10.string().optional().describe("User identifier for the log"),
-    metadata_trace_id: z10.string().optional().describe("Trace ID for distributed tracing"),
-    metadata_span_id: z10.string().optional().describe("Span ID for tracing"),
-    metadata_span_name: z10.string().optional().describe("Span name for tracing"),
-    metadata_parent_span_id: z10.string().optional().describe("Parent span ID for tracing"),
-    metadata_custom: z10.record(z10.string(), z10.unknown()).optional().describe("Additional custom metadata key-value pairs")
+    request_url: z11.string().optional().describe("The endpoint URL being called"),
+    request_provider: z11.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
+    request_method: z11.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
+    request_headers: z11.record(z11.string(), z11.string()).optional().describe("Request headers as key-value pairs"),
+    request_body: z11.record(z11.string(), z11.unknown()).optional().describe("Request payload/body"),
+    response_status: z11.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
+    response_headers: z11.record(z11.string(), z11.string()).optional().describe("Response headers as key-value pairs"),
+    response_body: z11.record(z11.string(), z11.unknown()).optional().describe("Response payload/body"),
+    response_time: z11.coerce.number().optional().describe("Response latency in milliseconds"),
+    streaming_mode: z11.boolean().optional().default(false).describe("Whether the response was streamed"),
+    metadata_organization: z11.string().optional().describe("Organization identifier for the log"),
+    metadata_user: z11.string().optional().describe("User identifier for the log"),
+    metadata_trace_id: z11.string().optional().describe("Trace ID for distributed tracing"),
+    metadata_span_id: z11.string().optional().describe("Span ID for tracing"),
+    metadata_span_name: z11.string().optional().describe("Span name for tracing"),
+    metadata_parent_span_id: z11.string().optional().describe("Parent span ID for tracing"),
+    metadata_custom: z11.record(z11.string(), z11.unknown()).optional().describe("Additional custom metadata key-value pairs")
   },
   createLogExport: {
-    workspace_id: z10.string().optional().describe("Workspace ID for the export"),
-    description: z10.string().optional().describe("Human-readable description for the export job"),
-    time_min: z10.string().describe(
+    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
+    description: z11.string().optional().describe("Human-readable description for the export job"),
+    time_min: z11.string().describe(
       "Minimum time filter in date format (e.g., '2024-01-01' or ISO 8601)"
     ),
-    time_max: z10.string().describe(
+    time_max: z11.string().describe(
       "Maximum time filter in date format (e.g., '2024-01-31' or ISO 8601)"
     ),
-    cost_min: z10.coerce.number().optional().describe("Minimum cost filter"),
-    cost_max: z10.coerce.number().optional().describe("Maximum cost filter"),
-    total_units_min: z10.coerce.number().optional().describe("Minimum total units (tokens) filter"),
-    total_units_max: z10.coerce.number().optional().describe("Maximum total units (tokens) filter"),
-    ai_model: z10.array(z10.string()).optional().describe("Filter by specific AI model names"),
-    requested_fields: z10.array(logExportFieldSchema).describe(
+    cost_min: z11.coerce.number().optional().describe("Minimum cost filter"),
+    cost_max: z11.coerce.number().optional().describe("Maximum cost filter"),
+    total_units_min: z11.coerce.number().optional().describe("Minimum total units (tokens) filter"),
+    total_units_max: z11.coerce.number().optional().describe("Maximum total units (tokens) filter"),
+    ai_model: z11.array(z11.string()).optional().describe("Filter by specific AI model names"),
+    requested_fields: z11.array(logExportFieldSchema).describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   },
   listLogExports: {
-    workspace_id: z10.string().describe("Workspace ID to list exports for (required)")
+    workspace_id: z11.string().describe("Workspace ID to list exports for (required)")
   },
   getLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export")
+    export_id: z11.string().describe("The unique ID of the log export")
   },
   startLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to start")
+    export_id: z11.string().describe("The unique ID of the log export to start")
   },
   cancelLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to cancel")
+    export_id: z11.string().describe("The unique ID of the log export to cancel")
   },
   downloadLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to download")
+    export_id: z11.string().describe("The unique ID of the log export to download")
   },
   updateLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to update"),
-    workspace_id: z10.string().optional().describe("Workspace ID for the export"),
-    time_of_generation_max: z10.string().optional().describe(
+    export_id: z11.string().describe("The unique ID of the log export to update"),
+    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
+    time_of_generation_max: z11.string().optional().describe(
       "Maximum time filter in date format (e.g., '2024-07-25' or ISO 8601)"
     ),
-    requested_fields: z10.array(logExportFieldSchema).optional().describe(
+    requested_fields: z11.array(logExportFieldSchema).optional().describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   }
@@ -4885,73 +5001,73 @@ function registerLoggingTools(server, service) {
 }
 
 // src/tools/mcp-integrations.tools.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
   listMcpIntegrations: {
-    current_page: z11.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z11.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z11.string().optional().describe("Filter by workspace ID")
+    current_page: z12.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z12.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z12.string().optional().describe("Filter by workspace ID")
   },
   createMcpIntegration: {
-    name: z11.string().describe("Display name for the MCP integration"),
-    url: z11.string().describe("URL endpoint of the MCP server to integrate"),
-    auth_type: z11.enum(["oauth_auto", "headers", "none"]).describe(
+    name: z12.string().describe("Display name for the MCP integration"),
+    url: z12.string().describe("URL endpoint of the MCP server to integrate"),
+    auth_type: z12.enum(["oauth_auto", "headers", "none"]).describe(
       "Authentication type: 'none', 'headers' (custom headers), or 'oauth_auto' (OAuth)"
     ),
-    transport: z11.enum(["http", "sse"]).describe(
+    transport: z12.enum(["http", "sse"]).describe(
       "MCP transport protocol: 'http' (streamable HTTP) or 'sse' (server-sent events)"
     ),
-    slug: z11.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z11.string().optional().describe("Description of the MCP integration"),
-    custom_headers: z11.record(z11.string(), z11.string()).optional().describe(
+    slug: z12.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z12.string().optional().describe("Description of the MCP integration"),
+    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
       'Custom headers for authentication (e.g. { "Authorization": "Bearer xxx" }). Sent via configurations.custom_headers'
     ),
-    workspace_id: z11.string().optional().describe(
+    workspace_id: z12.string().optional().describe(
       "Workspace ID \u2014 required when using organization admin API keys"
     )
   },
   getMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to retrieve")
+    id: z12.string().describe("The MCP integration ID or slug to retrieve")
   },
   updateMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to update"),
-    name: z11.string().optional().describe("New display name"),
-    description: z11.string().optional().describe("New description"),
-    url: z11.string().optional().describe("New URL endpoint"),
-    auth_type: z11.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
-    transport: z11.enum(["http", "sse"]).optional().describe("New transport protocol"),
-    custom_headers: z11.record(z11.string(), z11.string()).optional().describe(
+    id: z12.string().describe("The MCP integration ID or slug to update"),
+    name: z12.string().optional().describe("New display name"),
+    description: z12.string().optional().describe("New description"),
+    url: z12.string().optional().describe("New URL endpoint"),
+    auth_type: z12.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
+    transport: z12.enum(["http", "sse"]).optional().describe("New transport protocol"),
+    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
       "New custom headers for authentication. Sent via configurations.custom_headers"
     )
   },
   deleteMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to delete")
+    id: z12.string().describe("The MCP integration ID or slug to delete")
   },
   getMcpIntegrationMetadata: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   listMcpIntegrationCapabilities: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationCapabilities: {
-    id: z11.string().describe("The MCP integration ID or slug"),
-    capabilities: z11.array(
-      z11.object({
-        name: z11.string().describe("Capability name"),
-        type: z11.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z11.boolean().describe("Whether to enable the capability")
+    id: z12.string().describe("The MCP integration ID or slug"),
+    capabilities: z12.array(
+      z12.object({
+        name: z12.string().describe("Capability name"),
+        type: z12.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z12.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpIntegrationWorkspaces: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationWorkspaces: {
-    id: z11.string().describe("The MCP integration ID or slug"),
-    workspaces: z11.array(
-      z11.object({
-        id: z11.string().describe("Workspace ID"),
-        enabled: z11.boolean().describe("Whether workspace has access")
+    id: z12.string().describe("The MCP integration ID or slug"),
+    workspaces: z12.array(
+      z12.object({
+        id: z12.string().describe("Workspace ID"),
+        enabled: z12.boolean().describe("Whether workspace has access")
       })
     ).min(1).describe("Array of workspace access updates")
   }
@@ -5243,7 +5359,7 @@ function registerMcpIntegrationsTools(server, service) {
 }
 
 // src/tools/mcp-servers.tools.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/tools/utils.ts
 function formatFullName(firstName, lastName) {
@@ -5253,56 +5369,56 @@ function formatFullName(firstName, lastName) {
 // src/tools/mcp-servers.tools.ts
 var MCP_SERVERS_TOOL_SCHEMAS = {
   listMcpServers: {
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z12.string().optional().describe("Filter by workspace ID")
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z13.string().optional().describe("Filter by workspace ID")
   },
   createMcpServer: {
-    name: z12.string().describe("Display name for the MCP server"),
-    mcp_integration_id: z12.string().describe("ID or slug of the MCP integration this server belongs to"),
-    slug: z12.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z12.string().optional().describe("Description of the MCP server")
+    name: z13.string().describe("Display name for the MCP server"),
+    mcp_integration_id: z13.string().describe("ID or slug of the MCP integration this server belongs to"),
+    slug: z13.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z13.string().optional().describe("Description of the MCP server")
   },
   getMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to retrieve")
+    id: z13.string().describe("The MCP server ID or slug to retrieve")
   },
   updateMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to update"),
-    name: z12.string().optional().describe("New display name"),
-    description: z12.string().optional().describe("New description")
+    id: z13.string().describe("The MCP server ID or slug to update"),
+    name: z13.string().optional().describe("New display name"),
+    description: z13.string().optional().describe("New description")
   },
   deleteMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to delete")
+    id: z13.string().describe("The MCP server ID or slug to delete")
   },
   testMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to test")
+    id: z13.string().describe("The MCP server ID or slug to test")
   },
   listMcpServerCapabilities: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z13.string().describe("The MCP server ID or slug"),
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerCapabilities: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    capabilities: z12.array(
-      z12.object({
-        name: z12.string().describe("Capability name"),
-        type: z12.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z12.boolean().describe("Whether to enable the capability")
+    id: z13.string().describe("The MCP server ID or slug"),
+    capabilities: z13.array(
+      z13.object({
+        name: z13.string().describe("Capability name"),
+        type: z13.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z13.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpServerUserAccess: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z13.string().describe("The MCP server ID or slug"),
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerUserAccess: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    users: z12.array(
-      z12.object({
-        user_id: z12.string().describe("User ID"),
-        enabled: z12.boolean().describe("Whether user has access")
+    id: z13.string().describe("The MCP server ID or slug"),
+    users: z13.array(
+      z13.object({
+        user_id: z13.string().describe("User ID"),
+        enabled: z13.boolean().describe("Whether user has access")
       })
     ).min(1).describe("Array of user access updates")
   }
@@ -5546,40 +5662,40 @@ function registerMcpServersTools(server, service) {
 }
 
 // src/tools/partials.tools.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var PARTIALS_TOOL_SCHEMAS = {
   createPromptPartial: {
-    name: z13.string().describe("Display name for the partial"),
-    string: z13.string().describe("The partial content/template string"),
-    workspace_id: z13.string().optional().describe(
+    name: z14.string().describe("Display name for the partial"),
+    string: z14.string().describe("The partial content/template string"),
+    workspace_id: z14.string().optional().describe(
       "Workspace ID to create partial in (required for org-level API keys)"
     ),
-    version_description: z13.string().optional().describe("Description for this version")
+    version_description: z14.string().optional().describe("Description for this version")
   },
   listPromptPartials: {
-    collection_id: z13.string().optional().describe(
+    collection_id: z14.string().optional().describe(
       "Filter by collection ID. Optional \u2014 omit to list all partials across collections"
     )
   },
   getPromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to retrieve")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to retrieve")
   },
   updatePromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to update"),
-    name: z13.string().optional().describe("New display name for the partial"),
-    string: z13.string().optional().describe("New content for the partial"),
-    description: z13.string().optional().describe("Description for this version"),
-    status: z13.enum(["active", "archived"]).optional().describe("New status for the partial")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to update"),
+    name: z14.string().optional().describe("New display name for the partial"),
+    string: z14.string().optional().describe("New content for the partial"),
+    description: z14.string().optional().describe("Description for this version"),
+    status: z14.enum(["active", "archived"]).optional().describe("New status for the partial")
   },
   deletePromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to delete")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to delete")
   },
   listPartialVersions: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to list versions for")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to list versions for")
   },
   publishPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug"),
-    version: z13.coerce.number().positive().describe("Version number to publish as default")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug"),
+    version: z14.coerce.number().positive().describe("Version number to publish as default")
   }
 };
 function registerPartialsTools(server, service) {
@@ -5765,57 +5881,57 @@ function registerPartialsTools(server, service) {
 }
 
 // src/tools/prompts.tools.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // src/lib/schemas.ts
-import { z as z14 } from "zod";
-var PromptFunctionSchema = z14.object({
-  name: z14.string().describe("Function name"),
-  description: z14.string().optional().describe("Function description"),
-  parameters: z14.record(z14.string(), z14.unknown()).optional().describe("Function parameters schema")
+import { z as z15 } from "zod";
+var PromptFunctionSchema = z15.object({
+  name: z15.string().describe("Function name"),
+  description: z15.string().optional().describe("Function description"),
+  parameters: z15.record(z15.string(), z15.unknown()).optional().describe("Function parameters schema")
 });
-var PromptToolSchema = z14.object({
-  type: z14.literal("function").describe("Tool type"),
+var PromptToolSchema = z15.object({
+  type: z15.literal("function").describe("Tool type"),
   function: PromptFunctionSchema.describe("Function definition")
 });
-var HyperparametersSchema = z14.object({
-  max_tokens: z14.coerce.number().positive().optional().describe("Maximum tokens to generate"),
-  temperature: z14.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
-  top_p: z14.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
-  top_k: z14.coerce.number().positive().optional().describe("Top-k sampling"),
-  presence_penalty: z14.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
-  frequency_penalty: z14.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
-  stop: z14.array(z14.string()).optional().describe("Stop sequences")
+var HyperparametersSchema = z15.object({
+  max_tokens: z15.coerce.number().positive().optional().describe("Maximum tokens to generate"),
+  temperature: z15.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
+  top_p: z15.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
+  top_k: z15.coerce.number().positive().optional().describe("Top-k sampling"),
+  presence_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
+  frequency_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
+  stop: z15.array(z15.string()).optional().describe("Stop sequences")
 });
-var PromptAppIdentifierSchema = z14.string().min(1).describe(
+var PromptAppIdentifierSchema = z15.string().min(1).describe(
   "App identifier (REQUIRED). Use your deployed app name, for example 'hourlink' or 'support-console'."
 );
-var PromptEnvironmentIdentifierSchema = z14.string().min(1).describe(
+var PromptEnvironmentIdentifierSchema = z15.string().min(1).describe(
   "Environment identifier (REQUIRED). Use your environment name, for example 'dev', 'staging', 'prod', or 'qa'."
 );
-var BillingMetadataSchema = z14.object({
-  client_id: z14.string().describe("Client ID for billing attribution (REQUIRED)"),
+var BillingMetadataSchema = z15.object({
+  client_id: z15.string().describe("Client ID for billing attribution (REQUIRED)"),
   app: PromptAppIdentifierSchema,
   env: PromptEnvironmentIdentifierSchema,
-  project_id: z14.string().optional().describe("Project ID for granular billing"),
-  feature: z14.string().optional().describe("Feature name for tracking")
+  project_id: z15.string().optional().describe("Project ID for granular billing"),
+  feature: z15.string().optional().describe("Feature name for tracking")
 });
-var ToolChoiceSchema = z14.object({
-  mode: z14.enum(["auto", "none", "function"]).describe(
+var ToolChoiceSchema = z15.object({
+  mode: z15.enum(["auto", "none", "function"]).describe(
     "Tool choice mode: auto lets the model decide, none disables tool use, function forces one function by name"
   ),
-  function_name: z14.string().optional().describe("Required when mode is 'function'; ignored otherwise")
+  function_name: z15.string().optional().describe("Required when mode is 'function'; ignored otherwise")
 }).superRefine((value, ctx) => {
   if (value.mode === "function" && !value.function_name) {
     ctx.addIssue({
-      code: z14.ZodIssueCode.custom,
+      code: z15.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is required when mode is 'function'"
     });
   }
   if (value.mode !== "function" && value.function_name !== void 0) {
     ctx.addIssue({
-      code: z14.ZodIssueCode.custom,
+      code: z15.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is only allowed when mode is 'function'"
     });
@@ -5837,98 +5953,98 @@ function toPromptToolChoice(toolChoice) {
 }
 
 // src/tools/prompts.tools.ts
-var PROMPT_VARIABLES_SCHEMA = z15.record(z15.string(), z15.union([z15.string(), z15.coerce.number(), z15.boolean()])).describe("Variable values to substitute into the template");
-var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z15.object({
-  type: z15.string().describe("Content block type"),
-  text: z15.string().optional().describe("Text content for text-based blocks")
+var PROMPT_VARIABLES_SCHEMA = z16.record(z16.string(), z16.union([z16.string(), z16.coerce.number(), z16.boolean()])).describe("Variable values to substitute into the template");
+var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z16.object({
+  type: z16.string().describe("Content block type"),
+  text: z16.string().optional().describe("Text content for text-based blocks")
 }).passthrough().describe("Content block within a structured chat message");
-var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z15.object({
-  role: z15.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
-  content: z15.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
+var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z16.object({
+  role: z16.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
+  content: z16.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
 }).passthrough().describe("Structured chat message in a prompt template");
 var PROMPTS_TOOL_SCHEMAS = {
   createPrompt: {
-    name: z15.string().describe("Display name for the prompt"),
-    collection_id: z15.string().describe(
+    name: z16.string().describe("Display name for the prompt"),
+    collection_id: z16.string().describe(
       "Collection ID to organize the prompt in (use list_collections to find)"
     ),
-    string: z15.string().optional().describe(
+    string: z16.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias. Serialized to the legacy string format before creation."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).describe("Default values for template variables"),
-    virtual_key: z15.string().describe("Virtual key slug for model access"),
-    model: z15.string().optional().describe(
+    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
+    virtual_key: z16.string().describe("Virtual key slug for model access"),
+    model: z16.string().optional().describe(
       "Model identifier (e.g., 'gpt-4', 'claude-3-opus'). Required unless ai_model_id or finetune_id is provided"
     ),
-    ai_model_id: z15.string().optional().describe(
+    ai_model_id: z16.string().optional().describe(
       "AI model ID (alternative to model). Required unless model or finetune_id is provided"
     ),
-    finetune_id: z15.string().optional().describe(
+    finetune_id: z16.string().optional().describe(
       "Fine-tune ID (alternative to model). Required unless model or ai_model_id is provided"
     ),
-    version_description: z15.string().optional().describe("Description for this prompt version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
-    tools: z15.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
+    version_description: z16.string().optional().describe("Description for this prompt version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
+    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z15.boolean().optional().describe("When true, validate without creating")
+    dry_run: z16.boolean().optional().describe("When true, validate without creating")
   },
   listPrompts: {
-    collection_id: z15.string().optional().describe(
+    collection_id: z16.string().optional().describe(
       "Filter by collection ID (recommended for app-specific prompts)"
     ),
-    workspace_id: z15.string().optional().describe("Filter by workspace ID"),
-    search: z15.string().optional().describe("Search prompts by name"),
-    current_page: z15.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z15.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    workspace_id: z16.string().optional().describe("Filter by workspace ID"),
+    search: z16.string().optional().describe("Search prompts by name"),
+    current_page: z16.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z16.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to retrieve")
+    prompt_id: z16.string().describe("Prompt ID or slug to retrieve")
   },
   updatePrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to update"),
-    name: z15.string().optional().describe("New display name for the prompt"),
-    collection_id: z15.string().optional().describe("Move to a different collection"),
-    string: z15.string().optional().describe(
+    prompt_id: z16.string().describe("Prompt ID or slug to update"),
+    name: z16.string().optional().describe("New display name for the prompt"),
+    collection_id: z16.string().optional().describe("Move to a different collection"),
+    string: z16.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for updates. Serialized to the legacy string format before the prompt is updated."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).optional().describe("New default values for template variables"),
-    model: z15.string().optional().describe("New model identifier"),
-    virtual_key: z15.string().optional().describe("New virtual key slug"),
-    version_description: z15.string().optional().describe("Description for this version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("New metadata"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("New function definitions"),
-    tools: z15.array(PromptToolSchema).optional().describe("New tool definitions"),
+    parameters: z16.record(z16.string(), z16.unknown()).optional().describe("New default values for template variables"),
+    model: z16.string().optional().describe("New model identifier"),
+    virtual_key: z16.string().optional().describe("New virtual key slug"),
+    version_description: z16.string().optional().describe("Description for this version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("New metadata"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("New function definitions"),
+    tools: z16.array(PromptToolSchema).optional().describe("New tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe(
       "New tool choice strategy"
     ),
-    dry_run: z15.boolean().optional().describe("When true, validate without updating")
+    dry_run: z16.boolean().optional().describe("When true, validate without updating")
   },
   deletePrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to delete")
+    prompt_id: z16.string().describe("Prompt ID or slug to delete")
   },
   publishPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to publish"),
-    version: z15.coerce.number().positive().describe("Version number to publish as the default")
+    prompt_id: z16.string().describe("Prompt ID or slug to publish"),
+    version: z16.coerce.number().positive().describe("Version number to publish as the default")
   },
   listPromptVersions: {
-    prompt_id: z15.string().describe("Prompt ID or slug to list versions for")
+    prompt_id: z16.string().describe("Prompt ID or slug to list versions for")
   },
   renderPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to render"),
+    prompt_id: z16.string().describe("Prompt ID or slug to render"),
     variables: PROMPT_VARIABLES_SCHEMA,
     hyperparameters: HyperparametersSchema.optional().describe(
       "Override default hyperparameters"
     )
   },
   runPromptCompletion: {
-    prompt_id: z15.string().describe("Prompt ID or slug to execute"),
+    prompt_id: z16.string().describe("Prompt ID or slug to execute"),
     variables: PROMPT_VARIABLES_SCHEMA,
     metadata: BillingMetadataSchema.describe(
       "Billing metadata - client_id, app, env are REQUIRED for cost attribution"
@@ -5938,54 +6054,54 @@ var PROMPTS_TOOL_SCHEMAS = {
     )
   },
   migratePrompt: {
-    name: z15.string().describe("Prompt name to create or find for update"),
+    name: z16.string().describe("Prompt name to create or find for update"),
     app: PromptAppIdentifierSchema,
     env: PromptEnvironmentIdentifierSchema,
-    collection_id: z15.string().describe("Collection ID to search in and create under"),
-    string: z15.string().optional().describe(
+    collection_id: z16.string().describe("Collection ID to search in and create under"),
+    string: z16.string().optional().describe(
       "Legacy prompt template string with {{variable}} mustache syntax."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for migrations. Serialized to the legacy string format before the prompt is created or updated."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).describe("Default values for template variables"),
-    virtual_key: z15.string().describe("Virtual key slug for model access"),
-    model: z15.string().optional().describe("Model identifier"),
-    version_description: z15.string().optional().describe("Description for this version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("Additional custom metadata"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("Function definitions"),
-    tools: z15.array(PromptToolSchema).optional().describe("Tool definitions"),
+    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
+    virtual_key: z16.string().describe("Virtual key slug for model access"),
+    model: z16.string().optional().describe("Model identifier"),
+    version_description: z16.string().optional().describe("Description for this version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Additional custom metadata"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions"),
+    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z15.boolean().optional().describe(
+    dry_run: z16.boolean().optional().describe(
       "When true, only check what action would be taken without making changes"
     )
   },
   promotePrompt: {
-    source_prompt_id: z15.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
-    target_collection_id: z15.string().describe("Target collection ID for the promoted prompt"),
-    target_name: z15.string().optional().describe(
+    source_prompt_id: z16.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
+    target_collection_id: z16.string().describe("Target collection ID for the promoted prompt"),
+    target_name: z16.string().optional().describe(
       "Target prompt name (defaults to source name with env suffix replaced)"
     ),
     target_env: PromptEnvironmentIdentifierSchema,
-    virtual_key: z15.string().optional().describe(
+    virtual_key: z16.string().optional().describe(
       "Virtual key ID to use (defaults to source prompt's virtual_key)"
     )
   },
   validateCompletionMetadata: {
-    client_id: z15.string().optional().describe("Client ID for billing attribution"),
+    client_id: z16.string().optional().describe("Client ID for billing attribution"),
     app: PromptAppIdentifierSchema.optional(),
     env: PromptEnvironmentIdentifierSchema.optional(),
-    project_id: z15.string().optional().describe("Project ID for granular billing"),
-    feature: z15.string().optional().describe("Feature name for tracking")
+    project_id: z16.string().optional().describe("Project ID for granular billing"),
+    feature: z16.string().optional().describe("Feature name for tracking")
   },
   getPromptVersion: {
-    prompt_id: z15.string().describe("Prompt ID or slug"),
-    version_id: z15.string().describe("Version UUID to retrieve")
+    prompt_id: z16.string().describe("Prompt ID or slug"),
+    version_id: z16.string().describe("Version UUID to retrieve")
   },
   updatePromptVersion: {
-    prompt_id: z15.string().describe("Prompt ID or slug"),
-    version_id: z15.string().describe("Version UUID to update"),
-    label_id: z15.string().nullable().describe(
+    prompt_id: z16.string().describe("Prompt ID or slug"),
+    version_id: z16.string().describe("Version UUID to update"),
+    label_id: z16.string().nullable().describe(
       "Label ID to assign to this version, or null to remove the label"
     )
   }
@@ -6419,7 +6535,7 @@ function registerPromptsTools(server, service) {
   );
   server.tool(
     "migrate_prompt",
-    "Create or update a prompt in one idempotent step for CI/CD and prompt-as-code flows, unlike create_prompt which always makes a new prompt. Looks up the prompt by name within collection_id: if found it adds a new version (nothing is overwritten), otherwise it creates the prompt; dry_run reports what would happen without changing anything. Stores app/env in template_metadata; get collection_id from list_collections. Returns the action taken (created or updated), dry_run flag, prompt id, slug, and version id.",
+    "Create or update a prompt in one idempotent step for CI/CD and prompt-as-code flows, unlike create_prompt which always makes a new prompt. Looks up the prompt by name within collection_id: if missing it creates the prompt, if found with different content it adds a new version (nothing is overwritten), and if the content already matches it no-ops; dry_run reports what would happen without changing anything. Stores app/env in template_metadata; get collection_id from list_collections. Returns the action taken (created, updated, or unchanged), dry_run flag, message, prompt id, slug, and version id.",
     PROMPTS_TOOL_SCHEMAS.migratePrompt,
     {
       readOnlyHint: false,
@@ -6575,68 +6691,68 @@ function registerPromptsTools(server, service) {
 }
 
 // src/tools/providers.tools.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var PROVIDERS_TOOL_SCHEMAS = {
   listProviders: {
-    current_page: z16.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z16.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
-    workspace_id: z16.string().optional().describe(
+    current_page: z17.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z17.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
+    workspace_id: z17.string().optional().describe(
       "Workspace ID - required when using organization admin keys, optional with workspace API keys"
     )
   },
   createProvider: {
-    name: z16.string().describe("Display name for the provider"),
-    integration_id: z16.string().describe(
+    name: z17.string().describe("Display name for the provider"),
+    integration_id: z17.string().describe(
       "Integration slug for the provider (e.g., 'openai', 'anthropic', 'azure-openai')"
     ),
-    workspace_id: z16.string().optional().describe(
+    workspace_id: z17.string().optional().describe(
       "Workspace ID - required when using organization admin API keys"
     ),
-    slug: z16.string().optional().describe(
+    slug: z17.string().optional().describe(
       "Custom slug for the provider. Auto-generated with random suffix if omitted"
     ),
-    note: z16.string().optional().describe("Optional note or description for the provider"),
-    credit_limit: z16.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    usage_limit_type: z16.enum(["cost", "tokens"]).optional().describe(
+    note: z17.string().optional().describe("Optional note or description for the provider"),
+    credit_limit: z17.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z16.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z16.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
-    rate_limit_unit: z16.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z17.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
+    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Must be provided together with rate_limit_value. Values: 'rpm' (requests/min), 'rph' (requests/hour), or 'rpd' (requests/day)."
     ),
-    expires_at: z16.string().optional().describe("Expiration date in ISO 8601 format")
+    expires_at: z17.string().optional().describe("Expiration date in ISO 8601 format")
   },
   getProvider: {
-    slug: z16.string().describe("The unique slug identifier of the provider to retrieve"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z17.string().describe("The unique slug identifier of the provider to retrieve"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
   },
   updateProvider: {
-    slug: z16.string().describe("The slug of the provider to update"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys"),
-    name: z16.string().optional().describe("New display name for the provider"),
-    note: z16.string().optional().describe("New note or description for the provider"),
-    credit_limit: z16.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    usage_limit_type: z16.enum(["cost", "tokens"]).optional().describe(
+    slug: z17.string().describe("The slug of the provider to update"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys"),
+    name: z17.string().optional().describe("New display name for the provider"),
+    note: z17.string().optional().describe("New note or description for the provider"),
+    credit_limit: z17.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z16.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z16.coerce.number().positive().optional().describe("New rate limit value"),
-    rate_limit_unit: z16.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z17.coerce.number().positive().optional().describe("New rate limit value"),
+    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Rate limit unit: 'rpm' (requests per minute), 'rph' (requests per hour), or 'rpd' (requests per day)"
     ),
-    expires_at: z16.string().optional().describe("New expiration date in ISO 8601 format"),
-    reset_usage: z16.boolean().optional().describe("Set to true to reset accumulated usage metrics")
+    expires_at: z17.string().optional().describe("New expiration date in ISO 8601 format"),
+    reset_usage: z17.boolean().optional().describe("Set to true to reset accumulated usage metrics")
   },
   deleteProvider: {
-    slug: z16.string().describe("The slug of the provider to delete"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z17.string().describe("The slug of the provider to delete"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
   }
 };
 function registerProvidersTools(server, service) {
@@ -6817,30 +6933,427 @@ function registerProvidersTools(server, service) {
   );
 }
 
+// src/tools/secret-references.tools.ts
+import { z as z18 } from "zod";
+var authFields = {
+  aws_auth_type: z18.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
+    "AWS authentication mode: accessKey uses a key pair, assumedRole uses an IAM role, and serviceRole uses the runtime workload identity"
+  ),
+  aws_access_key_id: z18.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
+  aws_secret_access_key: z18.string().min(1).describe(
+    "AWS secret access key; required when aws_auth_type is accessKey and exposed to the MCP transcript"
+  ),
+  aws_region: z18.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
+  aws_role_arn: z18.string().min(1).describe(
+    "IAM role ARN to assume; required when aws_auth_type is assumedRole"
+  ),
+  aws_external_id: z18.string().nullable().describe("Optional external ID required by the target IAM role"),
+  azure_auth_mode: z18.enum(["entra", "managed", "default"]).describe(
+    "Azure authentication mode: entra uses a client secret, managed uses managed identity, and default uses the runtime credential chain"
+  ),
+  azure_entra_tenant_id: z18.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
+  azure_entra_client_id: z18.string().min(1).describe(
+    "Microsoft Entra application client ID; required for entra authentication"
+  ),
+  azure_entra_client_secret: z18.string().min(1).describe(
+    "Microsoft Entra client secret; required for entra authentication and exposed to the MCP transcript"
+  ),
+  azure_managed_client_id: z18.string().min(1).describe(
+    "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
+  ),
+  azure_vault_url: z18.url().describe(
+    "Azure Key Vault URL, for example https://example.vault.azure.net"
+  ),
+  vault_auth_type: z18.enum(["token", "approle", "kubernetes"]).describe(
+    "HashiCorp Vault authentication mode: token, AppRole, or Kubernetes"
+  ),
+  vault_addr: z18.url().describe("Base URL of the HashiCorp Vault server"),
+  vault_token: z18.string().min(1).describe(
+    "HashiCorp Vault token; required for token authentication and exposed to the MCP transcript"
+  ),
+  vault_namespace: z18.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
+  vault_role_id: z18.string().min(1).describe(
+    "HashiCorp Vault AppRole role ID; required for approle authentication"
+  ),
+  vault_secret_id: z18.string().min(1).describe(
+    "HashiCorp Vault AppRole secret ID; required for approle authentication and exposed to the MCP transcript"
+  ),
+  vault_role: z18.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
+};
+var authConfigSchema = z18.union([
+  z18.object({
+    aws_auth_type: z18.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
+    aws_access_key_id: authFields.aws_access_key_id,
+    aws_secret_access_key: authFields.aws_secret_access_key,
+    aws_region: authFields.aws_region
+  }).strict(),
+  z18.object({
+    aws_auth_type: z18.literal("assumedRole").describe("Assume the specified AWS IAM role"),
+    aws_role_arn: authFields.aws_role_arn,
+    aws_external_id: authFields.aws_external_id.optional(),
+    aws_region: authFields.aws_region
+  }).strict(),
+  z18.object({
+    aws_auth_type: z18.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
+    aws_region: z18.string().optional().describe(
+      "Optional AWS region containing the secret, for example us-east-1"
+    )
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("entra").describe(
+      "Authenticate with a Microsoft Entra application client secret"
+    ),
+    azure_entra_tenant_id: authFields.azure_entra_tenant_id,
+    azure_entra_client_id: authFields.azure_entra_client_id,
+    azure_entra_client_secret: authFields.azure_entra_client_secret,
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("managed").describe("Authenticate with an Azure managed identity"),
+    azure_managed_client_id: authFields.azure_managed_client_id.optional(),
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("default").describe("Use Azure's default runtime credential chain"),
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
+    vault_addr: authFields.vault_addr,
+    vault_token: authFields.vault_token,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
+    vault_addr: authFields.vault_addr,
+    vault_role_id: authFields.vault_role_id,
+    vault_secret_id: authFields.vault_secret_id,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("kubernetes").describe(
+      "Authenticate to HashiCorp Vault with a Kubernetes service account"
+    ),
+    vault_addr: authFields.vault_addr,
+    vault_role: authFields.vault_role,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict()
+]);
+var updateAuthConfigSchema = z18.union([
+  z18.object({
+    aws_auth_type: authFields.aws_auth_type.optional(),
+    aws_access_key_id: authFields.aws_access_key_id.optional(),
+    aws_secret_access_key: authFields.aws_secret_access_key.optional(),
+    aws_region: z18.string().optional().describe("AWS region containing the secret, for example us-east-1"),
+    aws_role_arn: authFields.aws_role_arn.optional(),
+    aws_external_id: authFields.aws_external_id.optional()
+  }).strict(),
+  z18.object({
+    azure_auth_mode: authFields.azure_auth_mode.optional(),
+    azure_entra_tenant_id: authFields.azure_entra_tenant_id.optional(),
+    azure_entra_client_id: authFields.azure_entra_client_id.optional(),
+    azure_entra_client_secret: authFields.azure_entra_client_secret.optional(),
+    azure_managed_client_id: z18.string().optional().describe(
+      "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
+    ),
+    azure_vault_url: authFields.azure_vault_url.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: authFields.vault_auth_type.optional(),
+    vault_addr: authFields.vault_addr.optional(),
+    vault_token: authFields.vault_token.optional(),
+    vault_namespace: z18.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
+    vault_role_id: authFields.vault_role_id.optional(),
+    vault_secret_id: authFields.vault_secret_id.optional(),
+    vault_role: authFields.vault_role.optional()
+  }).strict()
+]);
+var managerTypeSchema = z18.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
+  "External secret manager: aws_sm for AWS Secrets Manager, azure_kv for Azure Key Vault, or hashicorp_vault for HashiCorp Vault; must match the auth_config field family"
+);
+var tagsSchema = z18.record(z18.string(), z18.string()).describe("Tag filters or metadata as string key-value pairs");
+var SECRET_REFERENCE_TOOL_SCHEMAS = {
+  create: {
+    name: z18.string().min(1).max(255).describe("Human-readable name"),
+    manager_type: managerTypeSchema,
+    auth_config: authConfigSchema.describe(
+      "Choose exactly one documented authentication shape matching manager_type. Credentials are sent to Portkey and visible in the MCP transcript; prefer workload identity or short-lived credentials when available."
+    ),
+    secret_path: z18.string().max(1024).describe("Path of the secret in the external secret manager"),
+    organisation_id: z18.string().uuid().optional().describe(
+      "Organisation UUID; required when the MCP server is not authenticated with a Portkey API key"
+    ),
+    slug: z18.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
+      "Optional stable slug containing only letters, numbers, underscores, or hyphens; Portkey generates one when omitted"
+    ),
+    description: z18.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
+    secret_key: z18.string().max(255).nullable().optional().describe(
+      "Optional key within a structured external secret; null uses the whole secret value"
+    ),
+    allow_all_workspaces: z18.boolean().optional().describe(
+      "Whether every workspace may use this reference; defaults to true and cannot be true with allowed_workspaces"
+    ),
+    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+      "Workspace UUIDs or slugs allowed to use this reference; omit when allow_all_workspaces is true"
+    ),
+    tags: tagsSchema.nullable().optional().describe(
+      "Optional string key-value tags for filtering and organization"
+    )
+  },
+  list: {
+    manager_type: managerTypeSchema.optional().describe(
+      "Filter by external secret manager: aws_sm, azure_kv, or hashicorp_vault"
+    ),
+    tags: tagsSchema.optional().describe("Return references matching these tags"),
+    search: z18.string().min(1).max(255).optional().describe("Search references by name"),
+    current_page: z18.coerce.number().int().nonnegative().optional().describe("Zero-based page number; defaults to 0"),
+    page_size: z18.coerce.number().int().min(1).max(100).optional().describe("References per page, from 1 to 100; defaults to 20")
+  },
+  get: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+  },
+  update: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug"),
+    name: z18.string().min(1).max(255).optional().describe("New human-readable name"),
+    description: z18.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
+    auth_config: updateAuthConfigSchema.optional().describe(
+      "Provide at least one changed authentication field to merge into the existing configuration; choose one AWS, Azure, or HashiCorp field family and do not mix families"
+    ),
+    secret_path: z18.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
+    secret_key: z18.string().max(255).nullable().optional().describe(
+      "New key within a structured secret, or null to use the whole value"
+    ),
+    allow_all_workspaces: z18.boolean().optional().describe(
+      "Whether every workspace may use this reference; cannot be true with allowed_workspaces"
+    ),
+    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+      "Replacement list of workspace UUIDs or slugs allowed to use this reference; supplying it sets allow_all_workspaces=false"
+    ),
+    tags: tagsSchema.nullable().optional().describe("Replacement string key-value tags, or null to clear them")
+  },
+  delete: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+  }
+};
+function validateWorkspaceAccess(value) {
+  if (value.allow_all_workspaces === true && value.allowed_workspaces) {
+    throw new Error(
+      "allow_all_workspaces=true is mutually exclusive with allowed_workspaces"
+    );
+  }
+}
+function validateManagerAuth(managerType, authConfig) {
+  const matches = managerType === "aws_sm" && "aws_auth_type" in authConfig || managerType === "azure_kv" && "azure_auth_mode" in authConfig || managerType === "hashicorp_vault" && "vault_auth_type" in authConfig;
+  if (!matches) {
+    throw new Error(`auth_config does not match manager_type ${managerType}`);
+  }
+}
+function validateAuthUpdate(authConfig) {
+  if (Object.keys(authConfig).length === 0) {
+    throw new Error("auth_config update must contain at least one field");
+  }
+  const families = new Set(
+    Object.keys(authConfig).map((key) => {
+      if (key.startsWith("aws_")) return "AWS";
+      if (key.startsWith("azure_")) return "Azure";
+      if (key.startsWith("vault_")) return "HashiCorp Vault";
+      return "unknown";
+    })
+  );
+  if (families.size > 1) {
+    throw new Error(
+      "auth_config update must contain fields for exactly one secret-manager family"
+    );
+  }
+}
+var SENSITIVE_AUTH_FIELD = /(?:secret|token|password|credential|access_key_id)/i;
+function redactAuthConfig(authConfig) {
+  return Object.fromEntries(
+    Object.entries(authConfig).map(([key, value]) => {
+      if (SENSITIVE_AUTH_FIELD.test(key)) return [key, "[REDACTED]"];
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        return [key, redactAuthConfig(value)];
+      }
+      return [key, value];
+    })
+  );
+}
+function registerSecretReferencesTools(server, service) {
+  server.tool(
+    "create_secret_reference",
+    "Create a reference to a secret stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault. Authentication credentials are sent to Portkey and exposed to this MCP transcript; use short-lived or workload identity modes when possible. Returns the new UUID and slug, never the resolved external secret.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.create,
+    {
+      title: "Create Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    async (params) => {
+      validateWorkspaceAccess(params);
+      validateManagerAuth(params.manager_type, params.auth_config);
+      const result = await service.secretReferences.createSecretReference(params);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully created Secret Reference "${result.slug}"`,
+              id: result.id,
+              slug: result.slug
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_secret_references",
+    "List Secret References without returning authentication configuration or resolved secret values. Filter by manager type, tags, or name and use a returned UUID or slug with get_secret_reference.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.list,
+    {
+      title: "List Secret References",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.secretReferences.listSecretReferences({
+        ...params,
+        tags: params.tags ? JSON.stringify(params.tags) : void 0
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              total: result.total,
+              secret_references: result.data.map((reference) => ({
+                id: reference.id,
+                name: reference.name,
+                slug: reference.slug,
+                manager_type: reference.manager_type,
+                status: reference.status,
+                created_at: reference.created_at,
+                last_updated_at: reference.last_updated_at
+              }))
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "get_secret_reference",
+    "Retrieve one Secret Reference by UUID or slug. Portkey masks sensitive authentication fields for non-system users; the tool returns metadata and the masked auth configuration, not the resolved external secret value.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.get,
+    {
+      title: "Get Secret Reference",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id }) => {
+      const result = await service.secretReferences.getSecretReference(id);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              ...result,
+              auth_config: redactAuthConfig(result.auth_config)
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "update_secret_reference",
+    "Update at least one selected field on a Secret Reference. auth_config is merged into the existing manager-specific configuration. allowed_workspaces replaces all workspace mappings and sets allow_all_workspaces=false; allow_all_workspaces=true removes workspace-specific mappings. Credential values are sent to Portkey and exposed to the MCP transcript.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.update,
+    {
+      title: "Update Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id, ...updates }) => {
+      validateWorkspaceAccess(updates);
+      if (Object.keys(updates).length === 0) {
+        throw new Error("Provide at least one field to update");
+      }
+      if (updates.auth_config) validateAuthUpdate(updates.auth_config);
+      await service.secretReferences.updateSecretReference(id, updates);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully updated Secret Reference "${id}"`,
+              success: true
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "delete_secret_reference",
+    "Permanently delete a Secret Reference. This is irreversible and integrations or virtual keys using it can fail to resolve credentials immediately; confirm dependencies before deletion.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.delete,
+    {
+      title: "Delete Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id }) => {
+      const result = await service.secretReferences.deleteSecretReference(id);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully deleted Secret Reference "${id}"`,
+              success: result.success
+            })
+          }
+        ]
+      };
+    }
+  );
+}
+
 // src/tools/tracing.tools.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 var TRACING_TOOL_SCHEMAS = {
   createFeedback: {
-    trace_id: z17.string().describe(
+    trace_id: z19.string().describe(
       "The trace ID to associate the feedback with. This links feedback to a specific request/generation."
     ),
-    value: z17.coerce.number().describe(
+    value: z19.coerce.number().describe(
       "Feedback value/rating. Common patterns: 1 for positive (thumbs up), 0 for negative (thumbs down), or use a scale like 1-5."
     ),
-    weight: z17.coerce.number().positive().optional().describe(
+    weight: z19.coerce.number().positive().optional().describe(
       "Optional weighting factor for the feedback. Use to give more importance to certain feedback."
     ),
-    metadata: z17.record(z17.string(), z17.unknown()).optional().describe(
+    metadata: z19.record(z19.string(), z19.unknown()).optional().describe(
       "Optional custom metadata for categorization and analysis (e.g., feedback_source, category, user_segment)."
     )
   },
   updateFeedback: {
-    id: z17.string().describe("The unique identifier of the feedback to update"),
-    value: z17.coerce.number().optional().describe(
+    id: z19.string().describe("The unique identifier of the feedback to update"),
+    value: z19.coerce.number().optional().describe(
       "New feedback value/rating. Common patterns: 1 for positive, 0 for negative."
     ),
-    weight: z17.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
-    metadata: z17.record(z17.string(), z17.unknown()).optional().describe("New or updated custom metadata for the feedback")
+    weight: z19.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
+    metadata: z19.record(z19.string(), z19.unknown()).optional().describe("New or updated custom metadata for the feedback")
   }
 };
 function registerTracingTools(server, service) {
@@ -6896,77 +7409,77 @@ function registerTracingTools(server, service) {
 }
 
 // src/tools/users.tools.ts
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var USERS_TOOL_SCHEMAS = {
   listAllUsers: {
-    current_page: z18.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   inviteUser: {
-    email: z18.string().email().describe("Email address of the user to invite"),
-    role: z18.enum(["admin", "member"]).describe(
+    email: z20.string().email().describe("Email address of the user to invite"),
+    role: z20.enum(["admin", "member"]).describe(
       "Organization-level role: 'admin' for full access, 'member' for limited access"
     ),
-    first_name: z18.string().optional().describe("User's first name"),
-    last_name: z18.string().optional().describe("User's last name"),
-    workspaces: z18.array(
-      z18.object({
-        id: z18.string().describe(
+    first_name: z20.string().optional().describe("User's first name"),
+    last_name: z20.string().optional().describe("User's last name"),
+    workspaces: z20.array(
+      z20.object({
+        id: z20.string().describe(
           "Workspace ID/slug where the user will be granted access"
         ),
-        role: z18.enum(["admin", "member", "manager"]).describe(
+        role: z20.enum(["admin", "member", "manager"]).describe(
           "Workspace-level role: 'admin' for full access, 'manager' for workspace management, 'member' for basic access"
         )
       })
     ).describe(
       "List of workspaces and corresponding roles to grant to the user"
     ),
-    workspace_api_key_details: z18.object({
-      name: z18.string().optional().describe("Name of the API key to be created"),
-      expiry: z18.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
-      metadata: z18.record(z18.string(), z18.string()).optional().describe("Additional metadata key-value pairs for the API key"),
-      scopes: z18.array(z18.string()).describe("List of permission scopes for the API key")
+    workspace_api_key_details: z20.object({
+      name: z20.string().optional().describe("Name of the API key to be created"),
+      expiry: z20.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
+      metadata: z20.record(z20.string(), z20.string()).optional().describe("Additional metadata key-value pairs for the API key"),
+      scopes: z20.array(z20.string()).describe("List of permission scopes for the API key")
     }).optional().describe("Optional API key to be created for the user")
   },
   getUserStats: {
-    time_of_generation_min: z18.string().describe(
+    time_of_generation_min: z20.string().describe(
       "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    time_of_generation_max: z18.string().describe(
+    time_of_generation_max: z20.string().describe(
       "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
     ),
-    total_units_min: z18.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-    total_units_max: z18.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-    cost_min: z18.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-    cost_max: z18.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-    status_code: z18.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
-    virtual_keys: z18.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    total_units_min: z20.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+    total_units_max: z20.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+    cost_min: z20.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+    cost_max: z20.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+    status_code: z20.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
+    virtual_keys: z20.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUser: {
-    user_id: z18.string().describe("The user ID to retrieve")
+    user_id: z20.string().describe("The user ID to retrieve")
   },
   updateUser: {
-    user_id: z18.string().describe("The user ID to update"),
-    first_name: z18.string().optional().describe("New first name"),
-    last_name: z18.string().optional().describe("New last name"),
-    role: z18.enum(["admin", "member"]).optional().describe("New organization-level role")
+    user_id: z20.string().describe("The user ID to update"),
+    first_name: z20.string().optional().describe("New first name"),
+    last_name: z20.string().optional().describe("New last name"),
+    role: z20.enum(["admin", "member"]).optional().describe("New organization-level role")
   },
   deleteUser: {
-    user_id: z18.string().describe("The user ID to delete")
+    user_id: z20.string().describe("The user ID to delete")
   },
   listUserInvites: {
-    current_page: z18.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUserInvite: {
-    invite_id: z18.string().describe("The invite ID to retrieve")
+    invite_id: z20.string().describe("The invite ID to retrieve")
   },
   deleteUserInvite: {
-    invite_id: z18.string().describe("The invite ID to delete")
+    invite_id: z20.string().describe("The invite ID to delete")
   },
   resendUserInvite: {
-    invite_id: z18.string().describe("The invite ID to resend")
+    invite_id: z20.string().describe("The invite ID to resend")
   }
 };
 function formatUser(user) {
@@ -7192,59 +7705,59 @@ function registerUsersTools(server, service) {
 }
 
 // src/tools/workspaces.tools.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var WORKSPACES_TOOL_SCHEMAS = {
   listWorkspaces: {
-    page_size: z19.coerce.number().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
-    current_page: z19.coerce.number().positive().optional().describe("Page number to retrieve when results are paginated")
+    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
+    current_page: z21.coerce.number().int().positive().optional().describe("Page number to retrieve when results are paginated")
   },
   getWorkspace: {
-    workspace_id: z19.string().describe(
+    workspace_id: z21.string().describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
   createWorkspace: {
-    name: z19.string().describe("Name of the workspace"),
-    slug: z19.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
-    description: z19.string().optional().describe("Description of the workspace"),
-    is_default: z19.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z19.record(z19.string(), z19.string()).optional().describe("Custom metadata key-value pairs")
+    name: z21.string().describe("Name of the workspace"),
+    slug: z21.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
+    description: z21.string().optional().describe("Description of the workspace"),
+    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z21.record(z21.string(), z21.string()).optional().describe("Custom metadata key-value pairs")
   },
   updateWorkspace: {
-    workspace_id: z19.string().describe("The workspace ID to update"),
-    name: z19.string().optional().describe("New name for the workspace"),
-    slug: z19.string().optional().describe("New slug for the workspace"),
-    description: z19.string().optional().describe("New description"),
-    is_default: z19.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z19.record(z19.string(), z19.string()).optional().describe("New metadata key-value pairs")
+    workspace_id: z21.string().describe("The workspace ID to update"),
+    name: z21.string().optional().describe("New name for the workspace"),
+    slug: z21.string().optional().describe("New slug for the workspace"),
+    description: z21.string().optional().describe("New description"),
+    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z21.record(z21.string(), z21.string()).optional().describe("New metadata key-value pairs")
   },
   deleteWorkspace: {
-    workspace_id: z19.string().describe("The workspace ID to delete")
+    workspace_id: z21.string().describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID to add the member to"),
-    user_id: z19.string().uuid(
+    workspace_id: z21.string().describe("The workspace ID to add the member to"),
+    user_id: z21.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to add (must be a valid UUID from list_all_users, not an email address)"
     ),
-    role: z19.enum(["admin", "member", "manager"]).describe("Role in the workspace")
+    role: z21.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z19.string().describe("The workspace ID to list members for")
+    workspace_id: z21.string().describe("The workspace ID to list members for")
   },
   getWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to retrieve")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to retrieve")
   },
   updateWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to update"),
-    role: z19.enum(["admin", "member", "manager"]).describe("New role in the workspace")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to update"),
+    role: z21.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to remove")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to remove")
   }
 };
 function formatWorkspaceDefaults(defaults) {
@@ -7531,6 +8044,7 @@ var TOOL_DOMAIN_REGISTRARS = [
   ["tracing", registerTracingTools],
   ["logging", registerLoggingTools],
   ["providers", registerProvidersTools],
+  ["secret-references", registerSecretReferencesTools],
   ["integrations", registerIntegrationsTools],
   ["mcp-integrations", registerMcpIntegrationsTools],
   ["mcp-servers", registerMcpServersTools]
@@ -7653,13 +8167,81 @@ function getToolErrorMessage(error) {
   return String(error);
 }
 var STANDARD_TOOL_OUTPUT_SCHEMA = {
-  ok: z20.boolean().describe("Whether the tool call succeeded and returned structured data"),
-  data: z20.unknown().optional().describe("Structured success payload when ok is true"),
-  error: z20.object({
-    message: z20.string().describe("Human-readable error message"),
-    details: z20.unknown().optional().describe("Optional structured error details")
+  ok: z22.boolean().describe("Whether the tool call succeeded and returned structured data"),
+  data: z22.unknown().optional().describe("Structured success payload when ok is true"),
+  error: z22.object({
+    message: z22.string().describe("Human-readable error message"),
+    details: z22.unknown().optional().describe("Optional structured error details")
   }).optional().describe("Structured error payload when ok is false")
 };
+var TOOL_SUCCESS_DATA_SCHEMAS = {
+  rotate_api_key: z22.object({
+    message: z22.string().describe("Rotation confirmation"),
+    warning: z22.string().describe("Required handling guidance for the one-time secret"),
+    id: z22.string().uuid().describe("Rotated API key UUID"),
+    key: z22.string().describe("New API key secret, returned only once"),
+    key_transition_expires_at: z22.iso.datetime().describe("Time when the previous key stops working")
+  }),
+  create_secret_reference: z22.object({
+    message: z22.string().describe("Creation confirmation"),
+    id: z22.string().uuid().describe("New Secret Reference UUID"),
+    slug: z22.string().describe("New Secret Reference slug")
+  }),
+  list_secret_references: z22.object({
+    total: z22.number().int().nonnegative().describe("Total matching references"),
+    secret_references: z22.array(
+      z22.object({
+        id: z22.string().uuid().describe("Secret Reference UUID"),
+        name: z22.string().describe("Human-readable name"),
+        slug: z22.string().describe("Stable Secret Reference slug"),
+        manager_type: SecretManagerTypeSchema.describe(
+          "External secret manager type"
+        ),
+        status: z22.literal("ACTIVE").describe("Current reference status"),
+        created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
+        last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp")
+      })
+    ).describe(
+      "Current page of Secret References without authentication values"
+    )
+  }),
+  get_secret_reference: z22.object({
+    id: z22.string().uuid().describe("Secret Reference UUID"),
+    organisation_id: z22.string().uuid().describe("Owning organisation UUID"),
+    name: z22.string().describe("Human-readable name"),
+    slug: z22.string().describe("Stable Secret Reference slug"),
+    description: z22.string().nullable().describe("Reference description"),
+    manager_type: SecretManagerTypeSchema.describe(
+      "External secret manager type"
+    ),
+    secret_path: z22.string().describe("Path in the external secret manager"),
+    secret_key: z22.string().nullable().describe("Selected key within a structured secret"),
+    allow_all_workspaces: z22.boolean().describe("Whether all workspaces may use the reference"),
+    tags: z22.record(z22.string(), z22.string()).nullable().describe("String metadata tags"),
+    status: z22.literal("ACTIVE").describe("Current reference status"),
+    created_by: z22.string().describe("Creator identifier"),
+    created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
+    last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp"),
+    auth_config: z22.record(z22.string(), z22.unknown()).describe("Authentication configuration with sensitive values redacted"),
+    object: z22.literal("secret-reference").describe("Portkey object type")
+  }),
+  update_secret_reference: z22.object({
+    message: z22.string().describe("Update confirmation"),
+    success: z22.literal(true).describe("Whether the update succeeded")
+  }),
+  delete_secret_reference: z22.object({
+    message: z22.string().describe("Deletion confirmation"),
+    success: z22.literal(true).describe("Whether the deletion succeeded")
+  })
+};
+function getToolOutputSchema(toolName) {
+  const dataSchema = TOOL_SUCCESS_DATA_SCHEMAS[toolName];
+  if (!dataSchema) return STANDARD_TOOL_OUTPUT_SCHEMA;
+  return {
+    ...STANDARD_TOOL_OUTPUT_SCHEMA,
+    data: dataSchema.optional().describe("Structured success payload when ok is true")
+  };
+}
 function isStandardToolEnvelope(value) {
   if (!isRecord(value) || typeof value.ok !== "boolean") {
     return false;
@@ -7806,7 +8388,7 @@ function createSafeToolServer(server) {
         {
           ...registration.description ? { description: registration.description } : {},
           ...registration.inputSchema !== void 0 ? { inputSchema: registration.inputSchema } : {},
-          outputSchema: STANDARD_TOOL_OUTPUT_SCHEMA,
+          outputSchema: getToolOutputSchema(name),
           annotations: registration.annotations
         },
         registration.callback
@@ -7841,7 +8423,7 @@ function registerAllTools(server, service, options = {}) {
 }
 
 // src/lib/auth.ts
-import crypto3 from "node:crypto";
+import crypto2 from "node:crypto";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 var AUTH_SCHEMES = {
   bearer: "Bearer"
@@ -7956,9 +8538,9 @@ function extractBearerToken(req) {
   return token.trim();
 }
 function timingSafeEqual(a, b) {
-  const left = crypto3.createHash("sha256").update(a, "utf8").digest();
-  const right = crypto3.createHash("sha256").update(b, "utf8").digest();
-  return crypto3.timingSafeEqual(left, right);
+  const left = crypto2.createHash("sha256").update(a, "utf8").digest();
+  const right = crypto2.createHash("sha256").update(b, "utf8").digest();
+  return crypto2.timingSafeEqual(left, right);
 }
 var jwksCache = /* @__PURE__ */ new Map();
 async function verifyClerkToken(token, config) {
@@ -8022,10 +8604,17 @@ async function mcpAuthMiddleware(req, res, next) {
 }
 
 // src/lib/config.ts
+function parseStrictInteger(value) {
+  if (!/^\d+$/.test(value)) {
+    return Number.NaN;
+  }
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) ? parsed : Number.NaN;
+}
 function getServerConfig() {
   const transport = process.env.MCP_TRANSPORT?.trim() || "stdio";
   const sessionMode = process.env.MCP_SESSION_MODE?.trim().toLowerCase() || "stateful";
-  const eventStoreMode = process.env.MCP_EVENT_STORE?.trim().toLowerCase() || (sessionMode === "stateless" ? "memory" : "off");
+  const eventStoreMode = process.env.MCP_EVENT_STORE?.trim().toLowerCase() || "off";
   if (transport !== "stdio" && transport !== "http") {
     throw new Error(
       `Invalid MCP_TRANSPORT value: ${transport}. Must be 'stdio' or 'http'`
@@ -8041,13 +8630,12 @@ function getServerConfig() {
       `Invalid MCP_EVENT_STORE value: ${eventStoreMode}. Must be 'off', 'memory', or 'redis'`
     );
   }
-  const port = Number.parseInt(
-    process.env.PORT?.trim() || process.env.MCP_PORT?.trim() || "3000",
-    10
-  );
+  const portVariable = process.env.PORT?.trim() ? "PORT" : "MCP_PORT";
+  const portValue = process.env.PORT?.trim() || process.env.MCP_PORT?.trim() || "3000";
+  const port = parseStrictInteger(portValue);
   if (Number.isNaN(port) || port < 1 || port > 65535) {
     throw new Error(
-      `Invalid MCP_PORT value: ${process.env.MCP_PORT}. Must be a valid port number (1-65535)`
+      `Invalid ${portVariable} value: ${portValue}. Must be a valid port number (1-65535)`
     );
   }
   let host;
@@ -8061,21 +8649,28 @@ function getServerConfig() {
     host = "127.0.0.1";
   }
   const sessionTimeoutStr = (process.env.MCP_SESSION_TIMEOUT || "3600000").trim();
-  const sessionTimeout = Number.parseInt(sessionTimeoutStr, 10);
+  const sessionTimeout = parseStrictInteger(sessionTimeoutStr);
   if (Number.isNaN(sessionTimeout) || sessionTimeout < 0) {
     throw new Error(
       `Invalid MCP_SESSION_TIMEOUT value: ${sessionTimeoutStr}. Must be a non-negative number`
     );
   }
+  const shutdownTimeoutStr = (process.env.MCP_SHUTDOWN_TIMEOUT_MS || "10000").trim();
+  const shutdownTimeout = parseStrictInteger(shutdownTimeoutStr);
+  if (Number.isNaN(shutdownTimeout) || shutdownTimeout <= 0) {
+    throw new Error(
+      `Invalid MCP_SHUTDOWN_TIMEOUT_MS value: ${shutdownTimeoutStr}. Must be a positive integer`
+    );
+  }
   const maxSessionsStr = (process.env.MCP_MAX_SESSIONS || "100").trim();
-  const maxSessions = Number.parseInt(maxSessionsStr, 10);
+  const maxSessions = parseStrictInteger(maxSessionsStr);
   if (!Number.isInteger(maxSessions) || maxSessions <= 0) {
     throw new Error(
       `Invalid MCP_MAX_SESSIONS value: ${maxSessionsStr}. Must be a positive integer`
     );
   }
   const eventStoreTtlStr = (process.env.MCP_EVENT_TTL_SECONDS || "3600").trim();
-  const eventStoreTtlSeconds = Number.parseInt(eventStoreTtlStr, 10);
+  const eventStoreTtlSeconds = parseStrictInteger(eventStoreTtlStr);
   if (Number.isNaN(eventStoreTtlSeconds) || eventStoreTtlSeconds <= 0) {
     throw new Error(
       `Invalid MCP_EVENT_TTL_SECONDS value: ${eventStoreTtlStr}. Must be a positive integer`
@@ -8114,6 +8709,7 @@ function getServerConfig() {
     host,
     maxSessions,
     sessionTimeout,
+    shutdownTimeout,
     tls: {
       enabled: tlsEnabled,
       keyPath,
@@ -8124,6 +8720,7 @@ function getServerConfig() {
 }
 
 // src/lib/event-store.ts
+import { randomUUID } from "node:crypto";
 var EVENT_STORE_CLEANUP_INTERVAL_MS = 3e4;
 var SAFE_EVENT_ID_PATTERN = /^[\w-]{1,128}$/;
 function assertSafeRedisId(id, kind) {
@@ -8135,10 +8732,10 @@ function assertSafeRedisId(id, kind) {
   return id;
 }
 var InMemoryEventStore = class {
-  sequence = 0;
   ttlMs;
   events = /* @__PURE__ */ new Map();
   streamEvents = /* @__PURE__ */ new Map();
+  activeReplayStreams = /* @__PURE__ */ new Set();
   lastCleanupAt = 0;
   constructor(ttlSeconds) {
     this.ttlMs = ttlSeconds * 1e3;
@@ -8194,8 +8791,7 @@ var InMemoryEventStore = class {
   }
   async storeEvent(streamId, message) {
     this.maybeCleanupExpired();
-    this.sequence += 1;
-    const eventId = String(this.sequence);
+    const eventId = randomUUID();
     this.events.set(eventId, {
       streamId,
       message,
@@ -8211,6 +8807,26 @@ var InMemoryEventStore = class {
     this.maybeCleanupExpired(now);
     return this.getEventIfUnexpired(eventId, now)?.streamId;
   }
+  async acquireReplayLease(eventId) {
+    const streamId = await this.getStreamIdForEventId(eventId);
+    if (!streamId) {
+      return { status: "missing" };
+    }
+    if (this.activeReplayStreams.has(streamId)) {
+      return { status: "conflict" };
+    }
+    this.activeReplayStreams.add(streamId);
+    let released = false;
+    return {
+      status: "acquired",
+      release: async () => {
+        if (!released) {
+          released = true;
+          this.activeReplayStreams.delete(streamId);
+        }
+      }
+    };
+  }
   async replayEventsAfter(lastEventId, {
     send
   }) {
@@ -8257,10 +8873,21 @@ var RedisEventStore = class {
   streamEventsKey(streamId) {
     return `${this.keyPrefix}:stream:${assertSafeRedisId(streamId, "streamId")}:events`;
   }
+  replayLeaseKey(streamId) {
+    return `${this.keyPrefix}:stream:${assertSafeRedisId(streamId, "streamId")}:replay-lease`;
+  }
   async ensureConnected() {
     if (!this.client) {
       const { createClient } = await import("redis");
-      this.client = createClient({ url: this.redisUrl });
+      this.client = createClient({
+        url: this.redisUrl,
+        // node-redis v6 defaults to RESP3, a 5-second command timeout, and a
+        // 30-second keepalive delay. Keep the event store's v5 behavior stable
+        // while taking the v6 fixes and supported runtime baseline.
+        RESP: 2,
+        socket: { keepAliveInitialDelay: 5e3 },
+        commandOptions: { timeout: void 0 }
+      });
       this.client.on("error", (error) => {
         Logger.error("Redis event store error", {
           metadata: {
@@ -8289,17 +8916,19 @@ var RedisEventStore = class {
   async storeEvent(streamId, message) {
     await this.ensureConnected();
     const client = this.getConnectedClient();
-    const eventId = String(await client.incr(this.counterKey()));
+    const sequence = await client.incr(this.counterKey());
+    const eventId = randomUUID();
     const eventKey = this.eventKey(eventId);
     const streamKey = this.streamEventsKey(streamId);
     const tx = client.multi();
     tx.hSet(eventKey, {
       streamId,
+      sequence: String(sequence),
       message: JSON.stringify(message)
     });
     tx.expire(eventKey, this.ttlSeconds);
     tx.zAdd(streamKey, {
-      score: Number(eventId),
+      score: sequence,
       value: eventId
     });
     tx.expire(streamKey, this.ttlSeconds);
@@ -8317,6 +8946,36 @@ var RedisEventStore = class {
     );
     return streamId || void 0;
   }
+  async acquireReplayLease(eventId) {
+    const streamId = await this.getStreamIdForEventId(eventId);
+    if (!streamId) {
+      return { status: "missing" };
+    }
+    const client = this.getConnectedClient();
+    const leaseKey = this.replayLeaseKey(streamId);
+    const ownerToken = randomUUID();
+    const acquired = await client.set(leaseKey, ownerToken, {
+      NX: true,
+      PX: 6e4
+    });
+    if (acquired !== "OK") {
+      return { status: "conflict" };
+    }
+    let released = false;
+    return {
+      status: "acquired",
+      release: async () => {
+        if (released) {
+          return;
+        }
+        released = true;
+        await client.eval(
+          "if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) else return 0 end",
+          { keys: [leaseKey], arguments: [ownerToken] }
+        );
+      }
+    };
+  }
   async replayEventsAfter(lastEventId, {
     send
   }) {
@@ -8327,9 +8986,9 @@ var RedisEventStore = class {
     if (!streamId) {
       throw new Error(`Event not found for replay: ${lastEventId}`);
     }
-    const baseScore = Number(lastEventId);
+    const baseScore = Number(baseEvent.sequence);
     if (!Number.isFinite(baseScore)) {
-      throw new Error(`Invalid replay event ID: ${lastEventId}`);
+      throw new Error(`Invalid replay sequence for event: ${lastEventId}`);
     }
     const eventIds = await client.zRangeByScore(
       this.streamEventsKey(streamId),
@@ -8370,7 +9029,7 @@ var RedisEventStore = class {
       }
     }
     if (this.client.isOpen) {
-      await this.client.quit();
+      await this.client.close();
     }
   }
 };
@@ -8383,9 +9042,11 @@ function createManagedEventStore(config) {
     };
   }
   if (config.eventStore.mode === "memory") {
+    const memoryStore = new InMemoryEventStore(config.eventStore.ttlSeconds);
     return {
       mode: "memory",
-      eventStore: new InMemoryEventStore(config.eventStore.ttlSeconds),
+      eventStore: memoryStore,
+      acquireReplayLease: (eventId) => memoryStore.acquireReplayLease(eventId),
       close: async () => {
       }
     };
@@ -8398,6 +9059,7 @@ function createManagedEventStore(config) {
   return {
     mode: "redis",
     eventStore: redisStore,
+    acquireReplayLease: (eventId) => redisStore.acquireReplayLease(eventId),
     close: async () => {
       await redisStore.close();
     }
@@ -8407,7 +9069,7 @@ function createManagedEventStore(config) {
 // src/lib/mcp-server.ts
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 var PACKAGE_JSON_URL_CANDIDATES = [
   new URL("../../package.json", import.meta.url),
   new URL("../package.json", import.meta.url)
@@ -8480,8 +9142,8 @@ function registerServerPromptsAndResources(server) {
       title: "Plan Portkey Admin Workflow",
       description: "Create a concise, safe plan for a Portkey Admin API task using this MCP server.",
       argsSchema: {
-        task: z21.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
-        area: z21.string().max(80).optional().describe(
+        task: z23.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
+        area: z23.string().max(80).optional().describe(
           "Optional Portkey area, such as prompts, analytics, configs, or users"
         )
       }
@@ -8576,7 +9238,16 @@ function parseOriginParts(value) {
   }
 }
 function normalizeHostWithoutPort(value) {
-  return value.trim().toLowerCase().split(":")[0];
+  const normalized = value.trim().toLowerCase();
+  if (normalized.startsWith("[")) {
+    const bracketEnd = normalized.indexOf("]");
+    if (bracketEnd < 0) {
+      return normalized;
+    }
+    const remainder = normalized.slice(bracketEnd + 1);
+    return remainder === "" || /^:\d+$/.test(remainder) ? normalized.slice(0, bracketEnd + 1) : normalized;
+  }
+  return normalized.split(":", 1)[0];
 }
 function isOriginMatch(origin, allowedOrigin) {
   const originParts = parseOriginParts(origin);
@@ -8600,7 +9271,14 @@ function resolveAllowedOrigins() {
       return parsed;
     }
   }
-  return ["http://localhost", "https://localhost"];
+  return [
+    "http://localhost",
+    "https://localhost",
+    "http://127.0.0.1",
+    "https://127.0.0.1",
+    "http://[::1]",
+    "https://[::1]"
+  ];
 }
 var ALLOWED_ORIGINS = resolveAllowedOrigins();
 function getAllowedOrigins() {
@@ -8669,7 +9347,8 @@ function parsePositiveIntegerEnv(name, fallback) {
   if (raw === void 0) {
     return fallback;
   }
-  const parsed = Number.parseInt(raw.trim(), 10);
+  const normalized = raw.trim();
+  const parsed = /^\d+$/.test(normalized) ? Number(normalized) : Number.NaN;
   if (Number.isFinite(parsed) && Number.isInteger(parsed) && parsed > 0) {
     return parsed;
   }
@@ -8951,6 +9630,17 @@ var SessionStore = class {
 };
 
 // src/lib/http-app.ts
+function waitForResponseWritable(response) {
+  return new Promise((resolve) => {
+    const done = () => {
+      response.off("drain", done);
+      response.off("close", done);
+      resolve();
+    };
+    response.once("drain", done);
+    response.once("close", done);
+  });
+}
 function getReadyCheckMode() {
   const readyCheckMode = process.env.MCP_READY_CHECK_MODE?.trim().toLowerCase() || "local";
   if (readyCheckMode !== "local" && readyCheckMode !== "portkey") {
@@ -9114,7 +9804,7 @@ function getMcpProtocolVersion(req) {
 }
 function validateRequiredProtocolVersion(protocolVersion, expectedProtocolVersion) {
   if (!protocolVersion) {
-    return "Bad Request: MCP-Protocol-Version header is required for requests after initialization";
+    return void 0;
   }
   if (!SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
     const safe = sanitizeProtocolVersion(protocolVersion);
@@ -9146,6 +9836,8 @@ function createHttpAppRuntime() {
   const isStatefulSessionMode = config.sessionMode === "stateful";
   const publicBaseUrl = buildConfiguredPublicBaseUrl(config);
   const sessionStore = new SessionStore(config.maxSessions);
+  const activeStatelessConnections = /* @__PURE__ */ new Set();
+  const activeReplayOperations = /* @__PURE__ */ new Set();
   const app = express();
   let isReady = false;
   let server;
@@ -9154,11 +9846,31 @@ function createHttpAppRuntime() {
   let sigintHandler;
   let sigtermHandler;
   async function handleStatelessRequest(req, res, context, parsedBody, toolDomains) {
+    let replayStreamId;
+    let responseDisconnected = false;
+    const storedMessages = /* @__PURE__ */ new WeakSet();
+    const sharedEventStore = managedEventStore.eventStore;
+    const requestEventStore = sharedEventStore ? {
+      storeEvent: async (streamId, message) => {
+        replayStreamId ??= streamId;
+        storedMessages.add(message);
+        return sharedEventStore.storeEvent(streamId, message);
+      },
+      getStreamIdForEventId: async (eventId) => sharedEventStore.getStreamIdForEventId?.(eventId),
+      replayEventsAfter: (lastEventId, options) => sharedEventStore.replayEventsAfter(lastEventId, options)
+    } : void 0;
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: void 0,
-      eventStore: managedEventStore.eventStore
+      eventStore: requestEventStore
     });
     const { server: mcpServer } = createMcpServer({ toolDomains });
+    const requestMessages = Array.isArray(parsedBody) ? parsedBody : [parsedBody];
+    const pendingRequestIds = /* @__PURE__ */ new Set();
+    for (const message of requestMessages) {
+      if (isRecord(message) && typeof message.method === "string" && (typeof message.id === "string" || typeof message.id === "number")) {
+        pendingRequestIds.add(message.id);
+      }
+    }
     let closePromise;
     const closeConnection = () => {
       if (!closePromise) {
@@ -9169,16 +9881,60 @@ function createHttpAppRuntime() {
               error: error instanceof Error ? error.message : String(error)
             }
           });
+        }).finally(() => {
+          activeStatelessConnections.delete(closeConnection);
         });
       }
       return closePromise;
     };
+    activeStatelessConnections.add(closeConnection);
+    const originalSend = transport.send.bind(transport);
+    transport.send = async (message, options) => {
+      if ((responseDisconnected || res.destroyed) && replayStreamId && sharedEventStore) {
+        await sharedEventStore.storeEvent(replayStreamId, message);
+        storedMessages.add(message);
+      } else {
+        try {
+          await originalSend(message, options);
+        } catch (error) {
+          const disconnected = error instanceof Error && error.message.startsWith(
+            "No connection established for request ID:"
+          );
+          if (!disconnected || !replayStreamId || !sharedEventStore) {
+            throw error;
+          }
+          if (!storedMessages.has(message)) {
+            await sharedEventStore.storeEvent(replayStreamId, message);
+            storedMessages.add(message);
+          }
+        }
+        if ((responseDisconnected || res.destroyed) && replayStreamId && sharedEventStore && !storedMessages.has(message)) {
+          await sharedEventStore.storeEvent(replayStreamId, message);
+          storedMessages.add(message);
+        }
+      }
+      if ("id" in message && ("result" in message || "error" in message)) {
+        pendingRequestIds.delete(message.id);
+        if (pendingRequestIds.size === 0) {
+          queueMicrotask(() => {
+            void closeConnection();
+          });
+        }
+      }
+    };
     res.once("close", () => {
-      void closeConnection();
+      if (pendingRequestIds.size > 0 && replayStreamId) {
+        responseDisconnected = true;
+      } else {
+        void closeConnection();
+      }
     });
     try {
       await mcpServer.connect(transport);
       await transport.handleRequest(req, res, parsedBody);
+      if (pendingRequestIds.size === 0) {
+        await closeConnection();
+      }
     } catch (error) {
       await closeConnection();
       throw error;
@@ -9208,10 +9964,15 @@ function createHttpAppRuntime() {
   app.use(mcpAuthMiddleware);
   app.use(
     (err, _req, res, next) => {
-      if (err && typeof err === "object" && "type" in err && err.type === "entity.too.large") {
+      const errorType = err && typeof err === "object" && "type" in err ? err.type : void 0;
+      if (errorType === "entity.too.large") {
         res.status(413).json({ error: "Payload too large" });
         return;
       }
+      if (errorType === "entity.parse.failed") {
+        res.status(400).json({ error: "Malformed JSON request body" });
+        return;
+      }
       next(err);
     }
   );
@@ -9370,6 +10131,15 @@ function createHttpAppRuntime() {
       return;
     }
     if (!isStatefulSessionMode) {
+      if (activeStatelessConnections.size >= config.maxSessions) {
+        respondJsonRpcClientError(
+          res,
+          503,
+          `Maximum active stateless request limit reached (${config.maxSessions})`,
+          -32e3
+        );
+        return;
+      }
       if (!isInitializeRequest(req.body)) {
         const protocolError = validateRequiredProtocolVersion(
           protocolVersionHeader
@@ -9438,7 +10208,7 @@ function createHttpAppRuntime() {
       }
       hasReservedSessionSlot = true;
       const newTransport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: () => randomUUID(),
+        sessionIdGenerator: () => randomUUID2(),
         eventStore: managedEventStore.eventStore,
         onsessioninitialized: (id) => {
           sessionStore.set(id, {
@@ -9508,19 +10278,6 @@ function createHttpAppRuntime() {
     }
   });
   app.get("/mcp", async (req, res) => {
-    if (!isStatefulSessionMode) {
-      res.status(405).json({
-        jsonrpc: "2.0",
-        error: {
-          code: -32e3,
-          message: "GET /mcp is not used in stateless session mode"
-        },
-        id: null
-      });
-      return;
-    }
-    const sessionId = req.headers["mcp-session-id"];
-    const protocolVersionHeader = getMcpProtocolVersion(req);
     let requestedToolDomains;
     try {
       requestedToolDomains = parseRequestedToolDomains(req.query.tools);
@@ -9532,6 +10289,158 @@ function createHttpAppRuntime() {
       );
       return;
     }
+    if (!isStatefulSessionMode) {
+      if (activeReplayOperations.size >= config.maxSessions) {
+        respondJsonRpcClientError(
+          res,
+          503,
+          `Maximum active stateless replay limit reached (${config.maxSessions})`,
+          -32e3
+        );
+        return;
+      }
+      if (!managedEventStore.eventStore || !managedEventStore.acquireReplayLease) {
+        res.setHeader("Allow", "POST");
+        respondJsonRpcClientError(
+          res,
+          405,
+          "Stateless GET /mcp replay requires MCP_EVENT_STORE=memory or redis",
+          -32e3
+        );
+        return;
+      }
+      const lastEventId = req.headers["last-event-id"];
+      if (typeof lastEventId !== "string" || lastEventId.length === 0) {
+        res.setHeader("Allow", "POST");
+        respondJsonRpcClientError(
+          res,
+          405,
+          "Stateless GET /mcp only supports replay with Last-Event-ID",
+          -32e3
+        );
+        return;
+      }
+      if (!req.headers.accept?.includes("text/event-stream")) {
+        respondJsonRpcClientError(
+          res,
+          406,
+          "Not Acceptable: Client must accept text/event-stream",
+          -32e3
+        );
+        return;
+      }
+      const protocolError = validateRequiredProtocolVersion(
+        getMcpProtocolVersion(req)
+      );
+      if (protocolError) {
+        respondJsonRpcClientError(res, 400, protocolError, -32e3);
+        return;
+      }
+      const replayEventStore = managedEventStore.eventStore;
+      if (!replayEventStore) {
+        return;
+      }
+      try {
+        const lease = await managedEventStore.acquireReplayLease(lastEventId);
+        if (lease.status !== "acquired") {
+          if (lease.status === "missing") {
+            respondJsonRpcClientError(
+              res,
+              400,
+              "Invalid event ID format",
+              -32e3
+            );
+            return;
+          }
+          respondJsonRpcClientError(
+            res,
+            409,
+            "Conflict: Stream already has an active replay connection",
+            -32e3
+          );
+          return;
+        }
+        const replayOperation = (async () => {
+          try {
+            res.status(200);
+            res.setHeader("Content-Type", "text/event-stream");
+            res.setHeader("Cache-Control", "no-cache, no-transform");
+            res.flushHeaders();
+            let cursor = lastEventId;
+            let finalResponseSeen = false;
+            const deadline = Date.now() + 25e3;
+            while (isReady && !res.destroyed && !finalResponseSeen) {
+              await replayEventStore.replayEventsAfter(cursor, {
+                send: async (eventId, message) => {
+                  cursor = eventId;
+                  finalResponseSeen = "id" in message && ("result" in message || "error" in message);
+                  if (!res.write(
+                    `event: message
+id: ${eventId}
+data: ${JSON.stringify(message)}
+
+`
+                  )) {
+                    await waitForResponseWritable(res);
+                  }
+                }
+              });
+              if (finalResponseSeen || res.destroyed) {
+                break;
+              }
+              if (Date.now() >= deadline) {
+                res.write(`id: ${cursor}
+data: 
+
+`);
+                break;
+              }
+              await new Promise((resolvePoll) => setTimeout(resolvePoll, 100));
+            }
+            if (!res.writableEnded && !res.destroyed) {
+              await new Promise((resolveResponse) => {
+                const done = () => resolveResponse();
+                res.once("finish", done);
+                res.once("close", done);
+                res.end();
+              });
+            }
+          } finally {
+            try {
+              await lease.release();
+            } catch (error) {
+              Logger.error("Failed to release stateless replay lease", {
+                metadata: {
+                  error: error instanceof Error ? error.message : String(error)
+                }
+              });
+            }
+          }
+        })();
+        activeReplayOperations.add(replayOperation);
+        try {
+          await replayOperation;
+        } finally {
+          activeReplayOperations.delete(replayOperation);
+        }
+      } catch (error) {
+        if (res.headersSent) {
+          Logger.error("GET /mcp stateless replay failed", {
+            metadata: {
+              error: error instanceof Error ? error.message : String(error)
+            }
+          });
+          if (!res.writableEnded) {
+            res.end();
+          }
+        } else {
+          respondJsonRpcInternalError(res, "GET /mcp stateless", error);
+        }
+      }
+      return;
+    }
+    const sessionId = req.headers["mcp-session-id"];
+    const protocolVersionHeader = getMcpProtocolVersion(req);
     if (!sessionId) {
       res.status(400).json({
         jsonrpc: "2.0",
@@ -9667,6 +10576,13 @@ function createHttpAppRuntime() {
           if (isStatefulSessionMode) {
             await sessionStore.closeAll();
           }
+          await Promise.allSettled(
+            Array.from(
+              activeStatelessConnections,
+              (closeConnection) => closeConnection()
+            )
+          );
+          await Promise.allSettled(activeReplayOperations);
         } finally {
           await managedEventStore.close();
         }
@@ -9715,7 +10631,7 @@ function createHttpAppRuntime() {
     console.log("  GET  /ready  - Readiness check");
     console.log("  POST /mcp    - MCP requests");
     console.log(
-      `  GET  /mcp    - ${isStatefulSessionMode ? "SSE notifications" : "Not used in stateless mode"}`
+      `  GET  /mcp    - ${isStatefulSessionMode ? "SSE notifications and replay" : managedEventStore.eventStore ? "SSE replay (requires Last-Event-ID)" : "Unavailable (event store off)"}`
     );
     console.log(
       `  DELETE /mcp  - ${isStatefulSessionMode ? "Close session" : "Not used in stateless mode"}`
@@ -9730,9 +10646,7 @@ function createHttpAppRuntime() {
   async function shutdown(signal) {
     console.log(`
 [MCP] Received ${signal}, shutting down gracefully...`);
-    const rawShutdownTimeout = process.env.MCP_SHUTDOWN_TIMEOUT_MS?.trim();
-    const parsedShutdownTimeout = rawShutdownTimeout ? Number.parseInt(rawShutdownTimeout, 10) : 1e4;
-    const shutdownTimeoutMs = Number.isFinite(parsedShutdownTimeout) && parsedShutdownTimeout > 0 ? parsedShutdownTimeout : 1e4;
+    const shutdownTimeoutMs = config.shutdownTimeout;
     const forceExitTimer = setTimeout(() => {
       console.error(
         `[MCP] Forced shutdown after ${shutdownTimeoutMs}ms timeout`