portkey-admin-mcp 0.4.2 → 0.6.0

package/build/index.js

@@ -6,7 +6,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // src/lib/mcp-server.ts
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 
 // src/services/base.service.ts
 import crypto from "node:crypto";
@@ -120,6 +120,7 @@ var Logger = {
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
 var PRIVATE_BASE_URL_OVERRIDE_HINT = "Set PORTKEY_ALLOW_PRIVATE_BASE_URL=true to allow self-hosted gateways on loopback or private networks.";
+var INSECURE_HTTP_OVERRIDE_HINT = "Set PORTKEY_ALLOW_INSECURE_HTTP=true only for a trusted self-hosted gateway when TLS is unavailable.";
 function isPrivateOrLocalHost(hostname) {
   const host = hostname.trim().toLowerCase().replace(/^\[|\]$/g, "");
   if (host === "localhost" || host.endsWith(".localhost")) {
@@ -186,6 +187,14 @@ function validateUrl(url) {
       `Refusing to use a loopback or private-network PORTKEY_BASE_URL host: ${parsed.hostname}. ${PRIVATE_BASE_URL_OVERRIDE_HINT}`
     );
   }
+  const allowInsecureHttp = /^(1|true|yes)$/i.test(
+    process.env.PORTKEY_ALLOW_INSECURE_HTTP?.trim() ?? ""
+  );
+  if (parsed.protocol === "http:" && !allowInsecureHttp) {
+    throw new Error(
+      `Refusing insecure HTTP PORTKEY_BASE_URL: ${parsed.origin}. ${INSECURE_HTTP_OVERRIDE_HINT}`
+    );
+  }
 }
 var BaseService = class {
   apiKey;
@@ -197,13 +206,9 @@ var BaseService = class {
       throw new Error("PORTKEY_API_KEY environment variable is not set");
     }
     this.apiKey = apiKey;
-    if (baseUrlOverride !== void 0) {
-      this.baseUrl = baseUrlOverride;
-    } else {
-      const baseUrl = process.env.PORTKEY_BASE_URL ?? DEFAULT_BASE_URL;
-      validateUrl(baseUrl);
-      this.baseUrl = baseUrl;
-    }
+    const baseUrl = baseUrlOverride ?? process.env.PORTKEY_BASE_URL ?? DEFAULT_BASE_URL;
+    validateUrl(baseUrl);
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
   }
   encodePathSegment(value) {
     return encodeURIComponent(value);
@@ -239,6 +244,7 @@ var BaseService = class {
     try {
       const response = await fetchWithTimeout(url, {
         method,
+        redirect: "manual",
         headers: this.buildHeaders(method),
         body: this.serializeBody(options.body),
         timeout: this.timeout
@@ -767,6 +773,12 @@ var KeysService = class extends BaseService {
     await this.put(`/api-keys/${this.encodePathSegment(id)}`, data);
     return { success: true };
   }
+  async rotateApiKey(id, data = {}) {
+    return this.post(
+      `/api-keys/${this.encodePathSegment(id)}/rotate`,
+      data
+    );
+  }
   async deleteApiKey(id) {
     await this.delete(`/api-keys/${this.encodePathSegment(id)}`);
     return { success: true };
@@ -1476,6 +1488,31 @@ var ProvidersService = class extends BaseService {
   }
 };
 
+// src/services/secret-references.service.ts
+var SecretReferencesService = class extends BaseService {
+  async createSecretReference(data) {
+    return this.post("/secret-references", data);
+  }
+  async listSecretReferences(params) {
+    return this.get("/secret-references", params);
+  }
+  async getSecretReference(id) {
+    return this.get(
+      `/secret-references/${this.encodePathSegment(id)}`
+    );
+  }
+  async updateSecretReference(id, data) {
+    return this.put(
+      `/secret-references/${this.encodePathSegment(id)}`,
+      data
+    );
+  }
+  async deleteSecretReference(id) {
+    await this.delete(`/secret-references/${this.encodePathSegment(id)}`);
+    return { success: true };
+  }
+};
+
 // src/services/tracing.service.ts
 var TracingService = class extends BaseService {
   // Feedback endpoints
@@ -1626,8 +1663,9 @@ var WorkspacesService = class extends BaseService {
 };
 
 // src/services/index.ts
-import crypto2 from "node:crypto";
+import { createHmac, randomBytes } from "node:crypto";
 var MISSING_API_KEY_PLACEHOLDER = "__PORTKEY_API_KEY_NOT_CONFIGURED__";
+var SERVICE_CACHE_HMAC_KEY = randomBytes(32);
 function resolvePortkeyApiKey(apiKey) {
   const resolvedApiKey = apiKey ?? process.env.PORTKEY_API_KEY;
   if (!resolvedApiKey) {
@@ -1641,7 +1679,7 @@ function resolveSharedPortkeyApiKey(apiKey) {
   return apiKey ?? process.env.PORTKEY_API_KEY ?? MISSING_API_KEY_PLACEHOLDER;
 }
 function getSharedServiceCacheKey(apiKey) {
-  const keyDigest = crypto2.createHash("sha256").update(apiKey).digest("hex");
+  const keyDigest = createHmac("sha256", SERVICE_CACHE_HMAC_KEY).update(apiKey).digest("hex");
   return JSON.stringify({
     apiKey: keyDigest,
     baseUrl: process.env.PORTKEY_BASE_URL?.trim() || ""
@@ -1665,6 +1703,7 @@ var PortkeyService = class {
   tracing;
   logging;
   providers;
+  secretReferences;
   mcpIntegrations;
   mcpServers;
   health;
@@ -1691,6 +1730,10 @@ var PortkeyService = class {
     this.tracing = new TracingService(resolvedApiKey, resolvedBaseUrl);
     this.logging = new LoggingService(resolvedApiKey, resolvedBaseUrl);
     this.providers = new ProvidersService(resolvedApiKey, resolvedBaseUrl);
+    this.secretReferences = new SecretReferencesService(
+      resolvedApiKey,
+      resolvedBaseUrl
+    );
     this.mcpIntegrations = new McpIntegrationsService(
       resolvedApiKey,
       resolvedBaseUrl
@@ -1712,52 +1755,92 @@ function getSharedPortkeyService(apiKey) {
 }
 
 // src/tools/index.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 
 // src/lib/type-guards.ts
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
 
-// src/tools/analytics.tools.ts
+// src/schemas/contracts/secret-references.contract.ts
 import { z } from "zod";
+var SecretManagerTypeSchema = z.enum([
+  "aws_sm",
+  "azure_kv",
+  "hashicorp_vault"
+]);
+var SecretReferenceListItemSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  slug: z.string(),
+  manager_type: SecretManagerTypeSchema,
+  status: z.literal("ACTIVE"),
+  created_at: z.iso.datetime(),
+  last_updated_at: z.iso.datetime(),
+  object: z.literal("secret-reference")
+});
+var ListSecretReferencesResponseSchema = z.object({
+  object: z.literal("list"),
+  total: z.number().int().nonnegative(),
+  data: z.array(SecretReferenceListItemSchema)
+});
+var SecretReferenceDetailSchema = SecretReferenceListItemSchema.extend(
+  {
+    organisation_id: z.string().uuid(),
+    description: z.string().nullable(),
+    secret_path: z.string(),
+    secret_key: z.string().nullable(),
+    allow_all_workspaces: z.boolean(),
+    tags: z.record(z.string(), z.string()).nullable(),
+    created_by: z.string(),
+    auth_config: z.record(z.string(), z.unknown())
+  }
+);
+var CreateSecretReferenceResponseSchema = z.object({
+  id: z.string().uuid(),
+  slug: z.string(),
+  object: z.literal("secret-reference")
+});
+
+// src/tools/analytics.tools.ts
+import { z as z2 } from "zod";
 var baseAnalyticsSchema = {
-  time_of_generation_min: z.string().describe(
+  time_of_generation_min: z2.string().describe(
     "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
   ),
-  time_of_generation_max: z.string().describe(
+  time_of_generation_max: z2.string().describe(
     "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
   ),
-  total_units_min: z.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-  total_units_max: z.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-  cost_min: z.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-  cost_max: z.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-  prompt_token_min: z.coerce.number().positive().optional().describe("Minimum number of prompt tokens"),
-  prompt_token_max: z.coerce.number().positive().optional().describe("Maximum number of prompt tokens"),
-  completion_token_min: z.coerce.number().positive().optional().describe("Minimum number of completion tokens"),
-  completion_token_max: z.coerce.number().positive().optional().describe("Maximum number of completion tokens"),
-  status_code: z.string().optional().describe(
+  total_units_min: z2.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+  total_units_max: z2.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+  cost_min: z2.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+  cost_max: z2.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+  prompt_token_min: z2.coerce.number().positive().optional().describe("Minimum number of prompt tokens"),
+  prompt_token_max: z2.coerce.number().positive().optional().describe("Maximum number of prompt tokens"),
+  completion_token_min: z2.coerce.number().positive().optional().describe("Minimum number of completion tokens"),
+  completion_token_max: z2.coerce.number().positive().optional().describe("Maximum number of completion tokens"),
+  status_code: z2.string().optional().describe(
     "Legacy Portkey query param for HTTP status codes. Comma-separated string; prefer status_codes for structured inputs."
   ),
-  weighted_feedback_min: z.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
-  weighted_feedback_max: z.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
-  virtual_keys: z.string().optional().describe(
+  weighted_feedback_min: z2.coerce.number().min(-10).max(10).optional().describe("Minimum weighted feedback score (-10 to 10)"),
+  weighted_feedback_max: z2.coerce.number().min(-10).max(10).optional().describe("Maximum weighted feedback score (-10 to 10)"),
+  virtual_keys: z2.string().optional().describe(
     "Legacy Portkey query param for virtual key slugs. Comma-separated string; prefer virtual_key_slugs for structured inputs."
   ),
-  configs: z.string().optional().describe(
+  configs: z2.string().optional().describe(
     "Legacy Portkey query param for config slugs. Comma-separated string; prefer config_slugs for structured inputs."
   ),
-  status_codes: z.array(z.string()).optional().describe(
+  status_codes: z2.array(z2.string()).optional().describe(
     "Structured alias for status_code. Use an array of HTTP status codes; normalized to the legacy comma-separated Portkey query param."
   ),
-  virtual_key_slugs: z.array(z.string()).optional().describe(
+  virtual_key_slugs: z2.array(z2.string()).optional().describe(
     "Structured alias for virtual_keys. Use an array of virtual key slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  config_slugs: z.array(z.string()).optional().describe(
+  config_slugs: z2.array(z2.string()).optional().describe(
     "Structured alias for configs. Use an array of config slugs; normalized to the legacy comma-separated Portkey query param."
   ),
-  workspace_slug: z.string().optional().describe("Filter by specific workspace"),
-  api_key_ids: z.preprocess((value) => {
+  workspace_slug: z2.string().optional().describe("Filter by specific workspace"),
+  api_key_ids: z2.preprocess((value) => {
     if (value == null) {
       return value;
     }
@@ -1765,43 +1848,43 @@ var baseAnalyticsSchema = {
       return value.map((item) => String(item)).join(",");
     }
     return value;
-  }, z.string().optional()).describe(
+  }, z2.string().optional()).describe(
     "Legacy Portkey query param for API key UUIDs. Comma-separated string; request_analytics also accepts an array and normalizes it to this form."
   ),
-  metadata: z.string().optional().describe(
+  metadata: z2.string().optional().describe(
     `Legacy Portkey query param for metadata filtering. Stringified JSON object, e.g. '{"env":"prod","app":"myapp"}'; prefer metadata_filter for structured inputs.`
   ),
-  ai_org_model: z.string().optional().describe(
+  ai_org_model: z2.string().optional().describe(
     "Legacy Portkey query param for provider/model pairs. Format: 'provider__model' with double underscore, e.g. 'openai__gpt-4' or 'anthropic__claude-3-opus'. Comma-separated string; prefer provider_models for structured inputs."
   ),
-  provider_models: z.array(z.string()).optional().describe(
+  provider_models: z2.array(z2.string()).optional().describe(
     "Structured alias for ai_org_model. Use provider__model strings in an array; normalized to the legacy comma-separated Portkey query param."
   ),
-  trace_id: z.string().optional().describe(
+  trace_id: z2.string().optional().describe(
     "Legacy Portkey query param for trace IDs. Comma-separated string; prefer trace_ids for structured inputs."
   ),
-  trace_ids: z.array(z.string()).optional().describe(
+  trace_ids: z2.array(z2.string()).optional().describe(
     "Structured alias for trace_id. Use an array of trace IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  span_id: z.string().optional().describe(
+  span_id: z2.string().optional().describe(
     "Legacy Portkey query param for span IDs. Comma-separated string; prefer span_ids for structured inputs."
   ),
-  span_ids: z.array(z.string()).optional().describe(
+  span_ids: z2.array(z2.string()).optional().describe(
     "Structured alias for span_id. Use an array of span IDs; normalized to the legacy comma-separated Portkey query param."
   ),
-  metadata_filter: z.record(z.string(), z.unknown()).optional().describe(
+  metadata_filter: z2.record(z2.string(), z2.unknown()).optional().describe(
     "Structured alias for metadata. Use an object such as { env: 'prod' }; normalized to a JSON string before the request is sent."
   ),
-  prompt_slug: z.string().optional().describe("Filter by prompt slug")
+  prompt_slug: z2.string().optional().describe("Filter by prompt slug")
 };
 var paginatedAnalyticsSchema = {
   ...baseAnalyticsSchema,
-  current_page: z.coerce.number().positive().optional().describe("Page number for pagination"),
-  page_size: z.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
+  current_page: z2.coerce.number().int().positive().optional().describe("Page number for pagination"),
+  page_size: z2.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
 };
 var analyticsGroupMetadataSchema = {
   ...paginatedAnalyticsSchema,
-  metadata_key: z.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
+  metadata_key: z2.string().describe("The metadata key to group by (e.g., 'env', 'app', 'client_id')")
 };
 function formatGraphAnalytics(summary, dataPoints) {
   return {
@@ -2384,26 +2467,26 @@ function registerAnalyticsTools(server, service) {
 }
 
 // src/tools/audit.tools.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var AUDIT_TOOL_SCHEMAS = {
   listAuditLogs: {
-    workspace_id: z2.string().optional().describe("Filter audit logs by workspace ID"),
-    actor_id: z2.string().optional().describe("Filter by the user ID who performed the action"),
-    action: z2.string().optional().describe(
+    workspace_id: z3.string().optional().describe("Filter audit logs by workspace ID"),
+    actor_id: z3.string().optional().describe("Filter by the user ID who performed the action"),
+    action: z3.string().optional().describe(
       "Filter by action type (e.g., 'create', 'update', 'delete', 'login')"
     ),
-    resource_type: z2.string().optional().describe(
+    resource_type: z3.string().optional().describe(
       "Filter by resource type (e.g., 'user', 'workspace', 'config', 'virtual_key')"
     ),
-    resource_id: z2.string().optional().describe("Filter by specific resource ID"),
-    start_time: z2.string().optional().describe(
+    resource_id: z3.string().optional().describe("Filter by specific resource ID"),
+    start_time: z3.string().optional().describe(
       "Start of time range filter (ISO 8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    end_time: z2.string().optional().describe(
+    end_time: z3.string().optional().describe(
       "End of time range filter (ISO 8601 format, e.g., '2024-01-31T23:59:59Z')"
     ),
-    current_page: z2.coerce.number().positive().optional().describe("Page number for pagination (starts at 1)"),
-    page_size: z2.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z3.coerce.number().int().positive().optional().describe("Page number for pagination (starts at 1)"),
+    page_size: z3.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   }
 };
 function registerAuditTools(server, service) {
@@ -2456,30 +2539,30 @@ function registerAuditTools(server, service) {
 }
 
 // src/tools/collections.tools.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var COLLECTIONS_TOOL_SCHEMAS = {
   listCollections: {
-    workspace_id: z3.string().optional().describe("Filter by workspace ID"),
-    search: z3.string().optional().describe("Search collections by name"),
-    current_page: z3.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z3.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    workspace_id: z4.string().optional().describe("Filter by workspace ID"),
+    search: z4.string().optional().describe("Search collections by name"),
+    current_page: z4.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z4.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   createCollection: {
-    name: z3.string().describe(
+    name: z4.string().describe(
       "Collection name (e.g., 'hourlink', 'apizone', 'research-pilot')"
     ),
-    workspace_id: z3.string().optional().describe("Workspace ID to create collection in")
+    workspace_id: z4.string().optional().describe("Workspace ID to create collection in")
   },
   getCollection: {
-    collection_id: z3.string().describe("Collection ID or slug to retrieve")
+    collection_id: z4.string().describe("Collection ID or slug to retrieve")
   },
   updateCollection: {
-    collection_id: z3.string().describe("Collection ID to update"),
-    name: z3.string().optional().describe("New name for the collection"),
-    description: z3.string().optional().describe("New description for the collection")
+    collection_id: z4.string().describe("Collection ID to update"),
+    name: z4.string().optional().describe("New name for the collection"),
+    description: z4.string().optional().describe("New description for the collection")
   },
   deleteCollection: {
-    collection_id: z3.string().describe("Collection ID to delete")
+    collection_id: z4.string().describe("Collection ID to delete")
   }
 };
 function registerCollectionsTools(server, service) {
@@ -2600,69 +2683,69 @@ function registerCollectionsTools(server, service) {
 }
 
 // src/tools/configs.tools.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var CONFIGS_TOOL_SCHEMAS = {
   listConfigs: {
-    current_page: z4.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z4.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z5.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z5.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getConfig: {
-    slug: z4.string().describe(
+    slug: z5.string().describe(
       "The unique identifier (slug) of the configuration to retrieve. This can be found in the configuration's URL or from the list_configs tool response"
     )
   },
   createConfig: {
-    name: z4.string().describe("Name for the new configuration"),
-    workspace_id: z4.string().optional().describe("Workspace ID to create config in"),
-    cache_mode: z4.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z4.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z4.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z4.array(z4.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
-    strategy_mode: z4.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
-    targets: z4.array(
-      z4.object({
-        provider: z4.string().optional(),
-        virtual_key: z4.string().optional()
+    name: z5.string().describe("Name for the new configuration"),
+    workspace_id: z5.string().optional().describe("Workspace ID to create config in"),
+    cache_mode: z5.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z5.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
+    strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
+    targets: z5.array(
+      z5.object({
+        provider: z5.string().optional(),
+        virtual_key: z5.string().optional()
       }).refine((t) => t.provider || t.virtual_key, {
         message: "Each target must have at least provider or virtual_key"
       })
     ).optional().describe("Array of target providers with virtual keys")
   },
   updateConfig: {
-    slug: z4.string().describe("Configuration slug to update"),
-    name: z4.string().optional().describe("New name for the configuration"),
-    status: z4.enum(["active", "inactive"]).optional().describe("Configuration status"),
-    cache_mode: z4.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
-    cache_max_age: z4.coerce.number().positive().optional().describe("Cache max age in seconds"),
-    retry_attempts: z4.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
-    retry_on_status_codes: z4.array(z4.coerce.number()).optional().describe("HTTP status codes to retry on"),
-    strategy_mode: z4.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
-    targets: z4.array(
-      z4.object({
-        provider: z4.string().optional(),
-        virtual_key: z4.string().optional()
+    slug: z5.string().describe("Configuration slug to update"),
+    name: z5.string().optional().describe("New name for the configuration"),
+    status: z5.enum(["active", "inactive"]).optional().describe("Configuration status"),
+    cache_mode: z5.enum(["simple", "semantic"]).optional().describe("Cache mode: 'simple' or 'semantic'"),
+    cache_max_age: z5.coerce.number().positive().optional().describe("Cache max age in seconds"),
+    retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
+    retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on"),
+    strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
+    targets: z5.array(
+      z5.object({
+        provider: z5.string().optional(),
+        virtual_key: z5.string().optional()
       }).refine((t) => t.provider || t.virtual_key, {
         message: "Each target must have at least provider or virtual_key"
       })
     ).optional().describe("Array of target providers")
   },
   deleteConfig: {
-    slug: z4.string().describe("Configuration slug to delete")
+    slug: z5.string().describe("Configuration slug to delete")
   },
   listConfigVersions: {
-    slug: z4.string().describe("Configuration slug to list versions for")
+    slug: z5.string().describe("Configuration slug to list versions for")
   }
 };
-var configPayloadSchema = z4.object({
-  cache_mode: z4.enum(["simple", "semantic"]).optional(),
-  cache_max_age: z4.coerce.number().positive().optional(),
-  retry_attempts: z4.coerce.number().positive().max(5).optional(),
-  retry_on_status_codes: z4.array(z4.coerce.number()).optional(),
-  strategy_mode: z4.enum(["loadbalance", "fallback"]).optional(),
-  targets: z4.array(
-    z4.object({
-      provider: z4.string().optional(),
-      virtual_key: z4.string().optional()
+var configPayloadSchema = z5.object({
+  cache_mode: z5.enum(["simple", "semantic"]).optional(),
+  cache_max_age: z5.coerce.number().positive().optional(),
+  retry_attempts: z5.coerce.number().positive().max(5).optional(),
+  retry_on_status_codes: z5.array(z5.coerce.number()).optional(),
+  strategy_mode: z5.enum(["loadbalance", "fallback"]).optional(),
+  targets: z5.array(
+    z5.object({
+      provider: z5.string().optional(),
+      virtual_key: z5.string().optional()
     })
   ).optional()
 });
@@ -2879,53 +2962,53 @@ function registerConfigsTools(server, service) {
 }
 
 // src/tools/guardrails.tools.ts
-import { z as z5 } from "zod";
-var guardrailCheckSchema = z5.object({
-  id: z5.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
-  name: z5.string().optional().describe("Display name for the check"),
-  is_enabled: z5.boolean().optional().describe("Whether the check is enabled"),
-  parameters: z5.record(z5.string(), z5.unknown()).optional().describe("Check-specific configuration parameters")
+import { z as z6 } from "zod";
+var guardrailCheckSchema = z6.object({
+  id: z6.string().describe("Check identifier (e.g., 'default.jwt', 'default.pii')"),
+  name: z6.string().optional().describe("Display name for the check"),
+  is_enabled: z6.boolean().optional().describe("Whether the check is enabled"),
+  parameters: z6.record(z6.string(), z6.unknown()).optional().describe("Check-specific configuration parameters")
 });
-var guardrailFeedbackSchema = z5.object({
-  value: z5.coerce.number().optional().describe("Feedback value"),
-  weight: z5.coerce.number().optional().describe("Feedback weight"),
-  metadata: z5.record(z5.string(), z5.unknown()).optional().describe("Additional metadata")
+var guardrailFeedbackSchema = z6.object({
+  value: z6.coerce.number().optional().describe("Feedback value"),
+  weight: z6.coerce.number().optional().describe("Feedback weight"),
+  metadata: z6.record(z6.string(), z6.unknown()).optional().describe("Additional metadata")
 });
-var guardrailActionSchema = z5.object({
-  deny: z5.boolean().optional().describe("Whether to deny the request on check failure"),
-  async: z5.boolean().optional().describe("Whether to run checks asynchronously"),
+var guardrailActionSchema = z6.object({
+  deny: z6.boolean().optional().describe("Whether to deny the request on check failure"),
+  async: z6.boolean().optional().describe("Whether to run checks asynchronously"),
   on_success: guardrailFeedbackSchema.optional().describe("Feedback configuration for successful checks"),
   on_fail: guardrailFeedbackSchema.optional().describe("Feedback configuration for failed checks"),
-  on_fail_action: z5.string().optional().describe("Simple action on failure (e.g., 'block')"),
-  message: z5.string().optional().describe("Message to return when guardrail triggers")
+  on_fail_action: z6.string().optional().describe("Simple action on failure (e.g., 'block')"),
+  message: z6.string().optional().describe("Message to return when guardrail triggers")
 });
 var GUARDRAILS_TOOL_SCHEMAS = {
   listGuardrails: {
-    workspace_id: z5.string().optional().describe("Filter guardrails by workspace ID"),
-    organisation_id: z5.string().optional().describe("Filter guardrails by organization ID"),
-    page_size: z5.coerce.number().min(1).max(100).optional().describe("Number of items per page (1-100, default: 100)"),
-    current_page: z5.coerce.number().positive().optional().describe("Page number for pagination")
+    workspace_id: z6.string().optional().describe("Filter guardrails by workspace ID"),
+    organisation_id: z6.string().optional().describe("Filter guardrails by organization ID"),
+    page_size: z6.coerce.number().int().min(1).max(100).optional().describe("Number of items per page (1-100, default: 100)"),
+    current_page: z6.coerce.number().int().positive().optional().describe("Page number for pagination")
   },
   getGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
+    guardrail_id: z6.string().describe("The guardrail UUID or slug (with guard_ prefix) to retrieve")
   },
   createGuardrail: {
-    name: z5.string().describe("Name of the guardrail"),
-    checks: z5.array(guardrailCheckSchema).min(1).describe("Array of checks to apply (at least one required)"),
+    name: z6.string().describe("Name of the guardrail"),
+    checks: z6.array(guardrailCheckSchema).min(1).describe("Array of checks to apply (at least one required)"),
     actions: guardrailActionSchema.describe(
       "Actions to take when guardrail checks pass or fail"
     ),
-    workspace_id: z5.string().optional().describe("Workspace ID to create the guardrail in"),
-    organisation_id: z5.string().optional().describe("Organisation ID (required if workspace_id not provided)")
+    workspace_id: z6.string().optional().describe("Workspace ID to create the guardrail in"),
+    organisation_id: z6.string().optional().describe("Organisation ID (required if workspace_id not provided)")
   },
   updateGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug to update"),
-    name: z5.string().optional().describe("New name for the guardrail"),
-    checks: z5.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
+    guardrail_id: z6.string().describe("The guardrail UUID or slug to update"),
+    name: z6.string().optional().describe("New name for the guardrail"),
+    checks: z6.array(guardrailCheckSchema).min(1).optional().describe("Updated array of checks to apply"),
     actions: guardrailActionSchema.optional().describe("Updated actions configuration")
   },
   deleteGuardrail: {
-    guardrail_id: z5.string().describe("The guardrail UUID or slug to delete")
+    guardrail_id: z6.string().describe("The guardrail UUID or slug to delete")
   }
 };
 function registerGuardrailsTools(server, service) {
@@ -3075,7 +3158,7 @@ function registerGuardrailsTools(server, service) {
 }
 
 // src/tools/integrations.tools.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/lib/limits.ts
 var PERIODIC_RESET_DEFAULT = "monthly";
@@ -3120,91 +3203,91 @@ function buildRateLimits(params) {
 // src/tools/integrations.tools.ts
 var INTEGRATIONS_TOOL_SCHEMAS = {
   listIntegrations: {
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
-    workspace_id: z6.string().optional().describe("Filter integrations accessible by a specific workspace"),
-    type: z6.enum(["workspace", "organisation", "all"]).optional().describe(
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
+    workspace_id: z7.string().optional().describe("Filter integrations accessible by a specific workspace"),
+    type: z7.enum(["workspace", "organisation", "all"]).optional().describe(
       "Filter by integration type: 'workspace', 'organisation', or 'all' (default)"
     )
   },
   createIntegration: {
-    name: z6.string().describe("Human-readable name for the integration"),
-    ai_provider_id: z6.string().describe(
+    name: z7.string().describe("Human-readable name for the integration"),
+    ai_provider_id: z7.string().describe(
       "ID of the AI provider (e.g., 'openai', 'anthropic', 'azure-openai', 'aws-bedrock', 'vertex-ai')"
     ),
-    slug: z6.string().optional().describe(
+    slug: z7.string().optional().describe(
       "URL-friendly identifier (auto-generated from name if not provided)"
     ),
-    key: z6.string().optional().describe("API key for the provider (if required)"),
-    description: z6.string().optional().describe("Optional description of the integration"),
-    workspace_id: z6.string().optional().describe("Workspace ID for workspace-scoped integrations"),
-    api_version: z6.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z6.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z6.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    aws_region: z6.string().optional().describe("AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z6.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z6.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z6.string().optional().describe("GCP project ID (for Vertex AI)"),
-    vertex_region: z6.string().optional().describe("GCP region (for Vertex AI)"),
-    custom_host: z6.string().optional().describe("Custom base URL for the provider")
+    key: z7.string().optional().describe("API key for the provider (if required)"),
+    description: z7.string().optional().describe("Optional description of the integration"),
+    workspace_id: z7.string().optional().describe("Workspace ID for workspace-scoped integrations"),
+    api_version: z7.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z7.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z7.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    aws_region: z7.string().optional().describe("AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z7.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z7.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z7.string().optional().describe("GCP project ID (for Vertex AI)"),
+    vertex_region: z7.string().optional().describe("GCP region (for Vertex AI)"),
+    custom_host: z7.string().optional().describe("Custom base URL for the provider")
   },
   getIntegration: {
-    slug: z6.string().describe("The unique slug identifier of the integration to retrieve")
+    slug: z7.string().describe("The unique slug identifier of the integration to retrieve")
   },
   updateIntegration: {
-    slug: z6.string().describe("The slug of the integration to update"),
-    name: z6.string().optional().describe("New human-readable name for the integration"),
-    key: z6.string().optional().describe("New API key for the provider"),
-    description: z6.string().optional().describe("New description for the integration"),
-    api_version: z6.string().optional().describe("New API version (for Azure OpenAI)"),
-    resource_name: z6.string().optional().describe("New resource name (for Azure OpenAI)"),
-    deployment_name: z6.string().optional().describe("New deployment name (for Azure OpenAI)"),
-    aws_region: z6.string().optional().describe("New AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z6.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z6.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z6.string().optional().describe("New GCP project ID (for Vertex AI)"),
-    vertex_region: z6.string().optional().describe("New GCP region (for Vertex AI)"),
-    custom_host: z6.string().optional().describe("New custom base URL for the provider")
+    slug: z7.string().describe("The slug of the integration to update"),
+    name: z7.string().optional().describe("New human-readable name for the integration"),
+    key: z7.string().optional().describe("New API key for the provider"),
+    description: z7.string().optional().describe("New description for the integration"),
+    api_version: z7.string().optional().describe("New API version (for Azure OpenAI)"),
+    resource_name: z7.string().optional().describe("New resource name (for Azure OpenAI)"),
+    deployment_name: z7.string().optional().describe("New deployment name (for Azure OpenAI)"),
+    aws_region: z7.string().optional().describe("New AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z7.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z7.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z7.string().optional().describe("New GCP project ID (for Vertex AI)"),
+    vertex_region: z7.string().optional().describe("New GCP region (for Vertex AI)"),
+    custom_host: z7.string().optional().describe("New custom base URL for the provider")
   },
   deleteIntegration: {
-    slug: z6.string().describe("The slug of the integration to delete")
+    slug: z7.string().describe("The slug of the integration to delete")
   },
   listIntegrationModels: {
-    slug: z6.string().describe("The slug of the integration"),
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z7.string().describe("The slug of the integration"),
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationModels: {
-    slug: z6.string().describe("The slug of the integration"),
-    models: z6.array(
-      z6.object({
-        slug: z6.string().describe("The model slug identifier"),
-        model_name: z6.string().optional().describe(
+    slug: z7.string().describe("The slug of the integration"),
+    models: z7.array(
+      z7.object({
+        slug: z7.string().describe("The model slug identifier"),
+        model_name: z7.string().optional().describe(
           "Display name for the model (required for custom models)"
         ),
-        enabled: z6.boolean().describe("Whether the model is enabled"),
-        is_custom: z6.boolean().optional().describe("Whether this is a custom model (default: false)")
+        enabled: z7.boolean().describe("Whether the model is enabled"),
+        is_custom: z7.boolean().optional().describe("Whether this is a custom model (default: false)")
       })
     ).describe("Array of model configurations to update")
   },
   deleteIntegrationModel: {
-    slug: z6.string().describe("The slug of the integration"),
-    model_slug: z6.string().describe("The slug of the model to delete")
+    slug: z7.string().describe("The slug of the integration"),
+    model_slug: z7.string().describe("The slug of the model to delete")
   },
   listIntegrationWorkspaces: {
-    slug: z6.string().describe("The slug of the integration"),
-    current_page: z6.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z6.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z7.string().describe("The slug of the integration"),
+    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationWorkspaces: {
-    slug: z6.string().describe("The slug of the integration"),
-    workspaces: z6.array(
-      z6.object({
-        id: z6.string().describe("The workspace ID"),
-        enabled: z6.boolean().describe("Whether the workspace has access to this integration"),
-        credit_limit: z6.coerce.number().positive().optional().describe("Credit limit for this workspace"),
-        alert_threshold: z6.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-        rate_limit_rpm: z6.coerce.number().positive().optional().describe("Rate limit in requests per minute")
+    slug: z7.string().describe("The slug of the integration"),
+    workspaces: z7.array(
+      z7.object({
+        id: z7.string().describe("The workspace ID"),
+        enabled: z7.boolean().describe("Whether the workspace has access to this integration"),
+        credit_limit: z7.coerce.number().positive().optional().describe("Credit limit for this workspace"),
+        alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+        rate_limit_rpm: z7.coerce.number().positive().optional().describe("Rate limit in requests per minute")
       })
     ).describe("Array of workspace configurations to update")
   }
@@ -3537,104 +3620,110 @@ function registerIntegrationsTools(server, service) {
 }
 
 // src/tools/keys.tools.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var KEYS_TOOL_SCHEMAS = {
   listVirtualKeys: {
-    current_page: z7.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z7.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   createVirtualKey: {
-    name: z7.string().describe("Display name for the virtual key"),
-    provider: z7.string().describe(
+    name: z8.string().describe("Display name for the virtual key"),
+    provider: z8.string().describe(
       "Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')"
     ),
-    key: z7.string().describe("The actual provider API key to store"),
-    note: z7.string().optional().describe("Optional note or description for this key"),
-    workspace_id: z7.string().optional().describe("Workspace ID to create the key in"),
-    api_version: z7.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z7.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z7.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    credit_limit: z7.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe(
+    key: z8.string().describe("The actual provider API key to store"),
+    note: z8.string().optional().describe("Optional note or description for this key"),
+    workspace_id: z8.string().optional().describe("Workspace ID to create the key in"),
+    api_version: z8.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z8.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z8.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    credit_limit: z8.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe(
       "Percentage of credit_limit at which to send alert emails (0-100)"
     ),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("Requests per minute limit")
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Requests per minute limit")
   },
   getVirtualKey: {
-    slug: z7.string().describe("The unique slug identifier of the virtual key to retrieve")
+    slug: z8.string().describe("The unique slug identifier of the virtual key to retrieve")
   },
   updateVirtualKey: {
-    slug: z7.string().describe("The slug of the virtual key to update"),
-    name: z7.string().optional().describe("New display name for the key"),
-    key: z7.string().optional().describe("New provider API key value"),
-    note: z7.string().optional().describe("New note or description"),
-    credit_limit: z7.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("New rate limit in requests per minute")
+    slug: z8.string().describe("The slug of the virtual key to update"),
+    name: z8.string().optional().describe("New display name for the key"),
+    key: z8.string().optional().describe("New provider API key value"),
+    note: z8.string().optional().describe("New note or description"),
+    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute")
   },
   deleteVirtualKey: {
-    slug: z7.string().describe("The slug of the virtual key to delete")
+    slug: z8.string().describe("The slug of the virtual key to delete")
   },
   createApiKey: {
-    type: z7.enum(["organisation", "workspace"]).describe(
+    type: z8.enum(["organisation", "workspace"]).describe(
       "Key type: 'organisation' for org-wide access or 'workspace' for workspace-scoped"
     ),
-    sub_type: z7.enum(["user", "service"]).describe(
+    sub_type: z8.enum(["user", "service"]).describe(
       "Sub-type: 'user' for user-associated keys or 'service' for service accounts"
     ),
-    name: z7.string().describe("Display name for the API key"),
-    description: z7.string().optional().describe("Optional description for the key"),
-    workspace_id: z7.string().optional().describe("Workspace ID (required for workspace-type keys)"),
-    user_id: z7.string().optional().describe("User ID (required for user sub-type keys)"),
-    scopes: z7.array(z7.string()).describe(
+    name: z8.string().describe("Display name for the API key"),
+    description: z8.string().optional().describe("Optional description for the key"),
+    workspace_id: z8.string().optional().describe("Workspace ID (required for workspace-type keys)"),
+    user_id: z8.string().optional().describe("User ID (required for user sub-type keys)"),
+    scopes: z8.array(z8.string()).describe(
       "Permission scopes for the key (e.g., ['logs.read', 'analytics.read'])"
     ),
-    credit_limit: z7.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
-    default_config_id: z7.string().optional().describe("Default configuration ID to use with this key"),
-    default_metadata: z7.record(z7.string(), z7.string()).optional().describe("Default metadata key-value pairs"),
-    alert_emails: z7.array(z7.string()).optional().describe("Email addresses for alerts"),
-    expires_at: z7.string().optional().describe("Expiration date in ISO 8601 format")
+    credit_limit: z8.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+    default_config_id: z8.string().optional().describe("Default configuration ID to use with this key"),
+    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("Default metadata key-value pairs"),
+    alert_emails: z8.array(z8.string()).optional().describe("Email addresses for alerts"),
+    expires_at: z8.string().optional().describe("Expiration date in ISO 8601 format")
   },
   listApiKeys: {
-    page_size: z7.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    current_page: z7.coerce.number().positive().optional().describe("Page number for pagination"),
-    workspace_id: z7.string().optional().describe("Filter by workspace ID")
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    workspace_id: z8.string().optional().describe("Filter by workspace ID")
   },
   getApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to retrieve")
+    id: z8.string().uuid().describe("The UUID of the API key to retrieve")
   },
   updateApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to update"),
-    name: z7.string().optional().describe("New display name for the key"),
-    description: z7.string().optional().describe("New description for the key"),
-    scopes: z7.array(z7.string()).optional().describe("New permission scopes for the key"),
-    credit_limit: z7.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z7.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
-    default_config_id: z7.string().optional().describe("New default configuration ID"),
-    default_metadata: z7.record(z7.string(), z7.string()).optional().describe("New default metadata key-value pairs"),
-    alert_emails: z7.array(z7.string()).optional().describe("New email addresses for alerts"),
-    expires_at: z7.string().nullable().optional().describe(
+    id: z8.string().uuid().describe("The UUID of the API key to update"),
+    name: z8.string().optional().describe("New display name for the key"),
+    description: z8.string().optional().describe("New description for the key"),
+    scopes: z8.array(z8.string()).optional().describe("New permission scopes for the key"),
+    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
+    default_config_id: z8.string().optional().describe("New default configuration ID"),
+    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("New default metadata key-value pairs"),
+    alert_emails: z8.array(z8.string()).optional().describe("New email addresses for alerts"),
+    expires_at: z8.string().nullable().optional().describe(
       "New expiration date in ISO 8601 format, or null to remove expiration"
     )
   },
+  rotateApiKey: {
+    id: z8.string().uuid().describe("API key UUID obtained from list_api_keys"),
+    key_transition_period_ms: z8.coerce.number().int().min(18e5).optional().describe(
+      "Overlap in milliseconds while the previous key remains valid; minimum 1,800,000 (30 minutes), for example 3,600,000 for 1 hour"
+    )
+  },
   deleteApiKey: {
-    id: z7.string().uuid().describe("The UUID of the API key to delete")
+    id: z8.string().uuid().describe("The UUID of the API key to delete")
   }
 };
-var createApiKeySchema = z7.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
+var createApiKeySchema = z8.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
   if (value.type === "workspace" && !value.workspace_id) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["workspace_id"],
       message: "workspace_id is required when type is 'workspace'"
     });
   }
   if (value.sub_type === "user" && !value.user_id) {
     ctx.addIssue({
-      code: z7.ZodIssueCode.custom,
+      code: z8.ZodIssueCode.custom,
       path: ["user_id"],
       message: "user_id is required when sub_type is 'user'"
     });
@@ -3990,40 +4079,71 @@ function registerKeysTools(server, service) {
       };
     }
   );
+  server.tool(
+    "rotate_api_key",
+    "Rotate an API key without changing its identity or scopes. The new secret is returned once and exposed to this MCP transcript, while the previous secret remains valid until key_transition_expires_at. Store the new key securely, update callers during the transition window, and never log either secret.",
+    KEYS_TOOL_SCHEMAS.rotateApiKey,
+    {
+      title: "Rotate API Key",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.keys.rotateApiKey(params.id, {
+        key_transition_period_ms: params.key_transition_period_ms
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully rotated API key "${result.id}"`,
+              warning: "Copy this new key now; it is returned only once. Replace callers before key_transition_expires_at and never log either key.",
+              id: result.id,
+              key: result.key,
+              key_transition_expires_at: result.key_transition_expires_at
+            })
+          }
+        ]
+      };
+    }
+  );
 }
 
 // src/tools/labels.tools.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var LABELS_TOOL_SCHEMAS = {
   createPromptLabel: {
-    name: z8.string().describe("Name of the label"),
-    organisation_id: z8.string().optional().describe("Organisation ID to create the label in"),
-    workspace_id: z8.string().optional().describe("Workspace ID to create the label in"),
-    description: z8.string().optional().describe("Description of the label"),
-    color_code: z8.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
+    name: z9.string().describe("Name of the label"),
+    organisation_id: z9.string().optional().describe("Organisation ID to create the label in"),
+    workspace_id: z9.string().optional().describe("Workspace ID to create the label in"),
+    description: z9.string().optional().describe("Description of the label"),
+    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
       "Hex format, e.g. '#FF5733'. Optional \u2014 omit for default color."
     )
   },
   listPromptLabels: {
-    organisation_id: z8.string().optional().describe("Filter by organisation ID"),
-    workspace_id: z8.string().optional().describe("Filter by workspace ID"),
-    search: z8.string().optional().describe("Search labels by name"),
-    current_page: z8.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z8.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    organisation_id: z9.string().optional().describe("Filter by organisation ID"),
+    workspace_id: z9.string().optional().describe("Filter by workspace ID"),
+    search: z9.string().optional().describe("Search labels by name"),
+    current_page: z9.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z9.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPromptLabel: {
-    label_id: z8.string().describe("Label ID to retrieve"),
-    organisation_id: z8.string().optional().describe("Organisation ID for filtering"),
-    workspace_id: z8.string().optional().describe("Workspace ID for filtering")
+    label_id: z9.string().describe("Label ID to retrieve"),
+    organisation_id: z9.string().optional().describe("Organisation ID for filtering"),
+    workspace_id: z9.string().optional().describe("Workspace ID for filtering")
   },
   updatePromptLabel: {
-    label_id: z8.string().describe("Label ID to update"),
-    name: z8.string().optional().describe("New name for the label"),
-    description: z8.string().optional().describe("New description"),
-    color_code: z8.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
+    label_id: z9.string().describe("Label ID to update"),
+    name: z9.string().optional().describe("New name for the label"),
+    description: z9.string().optional().describe("New description"),
+    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
   },
   deletePromptLabel: {
-    label_id: z8.string().describe("Label ID to delete")
+    label_id: z9.string().describe("Label ID to delete")
   }
 };
 function registerLabelsTools(server, service) {
@@ -4163,86 +4283,86 @@ function registerLabelsTools(server, service) {
 }
 
 // src/tools/limits.tools.ts
-import { z as z9 } from "zod";
-var conditionSchema = z9.object({
-  field: z9.string().describe(
+import { z as z10 } from "zod";
+var conditionSchema = z10.object({
+  field: z10.string().describe(
     "The field to match on (e.g., 'virtual_key', 'api_key', 'user_id', 'metadata.key')"
   ),
-  operator: z9.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
-  value: z9.string().describe("The value to match against")
+  operator: z10.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
+  value: z10.string().describe("The value to match against")
 });
 var LIMITS_TOOL_SCHEMAS = {
   listRateLimits: {
-    workspace_id: z9.string().optional().describe("Filter rate limits by workspace ID")
+    workspace_id: z10.string().optional().describe("Filter rate limits by workspace ID")
   },
   getRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit")
+    id: z10.string().describe("The unique identifier of the rate limit")
   },
   createRateLimit: {
-    conditions: z9.array(conditionSchema).describe(
+    conditions: z10.array(conditionSchema).describe(
       "Array of conditions that determine which requests this rate limit applies to"
     ),
-    group_by: z9.array(z9.string()).describe(
+    group_by: z10.array(z10.string()).describe(
       "Array of fields to group the rate limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z9.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
-    unit: z9.enum(["rpm", "rph", "rpd"]).describe(
+    type: z10.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
+    unit: z10.enum(["rpm", "rph", "rpd"]).describe(
       "Time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z9.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
-    name: z9.string().optional().describe("Optional name for the rate limit"),
-    workspace_id: z9.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z9.string().optional().describe("Organisation ID to scope the limit to")
+    value: z10.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
+    name: z10.string().optional().describe("Optional name for the rate limit"),
+    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit"),
-    name: z9.string().optional().describe("New name for the rate limit"),
-    unit: z9.enum(["rpm", "rph", "rpd"]).optional().describe(
+    id: z10.string().describe("The unique identifier of the rate limit"),
+    name: z10.string().optional().describe("New name for the rate limit"),
+    unit: z10.enum(["rpm", "rph", "rpd"]).optional().describe(
       "New time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z9.coerce.number().positive().optional().describe("New maximum allowed value per unit")
+    value: z10.coerce.number().positive().optional().describe("New maximum allowed value per unit")
   },
   deleteRateLimit: {
-    id: z9.string().describe("The unique identifier of the rate limit")
+    id: z10.string().describe("The unique identifier of the rate limit")
   },
   listUsageLimits: {
-    workspace_id: z9.string().optional().describe("Filter usage limits by workspace ID")
+    workspace_id: z10.string().optional().describe("Filter usage limits by workspace ID")
   },
   getUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit")
+    id: z10.string().describe("The unique identifier of the usage limit")
   },
   createUsageLimit: {
-    conditions: z9.array(conditionSchema).describe(
+    conditions: z10.array(conditionSchema).describe(
       "Array of conditions that determine which requests this usage limit applies to"
     ),
-    group_by: z9.array(z9.string()).describe(
+    group_by: z10.array(z10.string()).describe(
       "Array of fields to group the usage limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z9.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
-    credit_limit: z9.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
-    name: z9.string().optional().describe("Optional name for the usage limit"),
-    alert_threshold: z9.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
-    periodic_reset: z9.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
-    workspace_id: z9.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z9.string().optional().describe("Organisation ID to scope the limit to")
+    type: z10.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
+    credit_limit: z10.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
+    name: z10.string().optional().describe("Optional name for the usage limit"),
+    alert_threshold: z10.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
+    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
+    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit"),
-    name: z9.string().optional().describe("New name for the usage limit"),
-    credit_limit: z9.coerce.number().positive().optional().describe("New maximum allowed usage value"),
-    alert_threshold: z9.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
-    periodic_reset: z9.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
-    reset_usage_for_value: z9.string().optional().describe("Reset usage counters for a specific group_by value")
+    id: z10.string().describe("The unique identifier of the usage limit"),
+    name: z10.string().optional().describe("New name for the usage limit"),
+    credit_limit: z10.coerce.number().positive().optional().describe("New maximum allowed usage value"),
+    alert_threshold: z10.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
+    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
+    reset_usage_for_value: z10.string().optional().describe("Reset usage counters for a specific group_by value")
   },
   deleteUsageLimit: {
-    id: z9.string().describe("The unique identifier of the usage limit")
+    id: z10.string().describe("The unique identifier of the usage limit")
   },
   listUsageLimitEntities: {
-    limit_id: z9.string().describe("Usage limit policy ID")
+    limit_id: z10.string().describe("Usage limit policy ID")
   },
   resetUsageLimitEntity: {
-    limit_id: z9.string().describe("Usage limit policy ID"),
-    entity_id: z9.string().describe("Entity ID to reset usage for")
+    limit_id: z10.string().describe("Usage limit policy ID"),
+    entity_id: z10.string().describe("Entity ID to reset usage for")
   }
 };
 function formatRateLimit(limit) {
@@ -4548,8 +4668,8 @@ function registerLimitsTools(server, service) {
 }
 
 // src/tools/logging.tools.ts
-import { z as z10 } from "zod";
-var logExportFieldSchema = z10.enum([
+import { z as z11 } from "zod";
+var logExportFieldSchema = z11.enum([
   "id",
   "trace_id",
   "created_at",
@@ -4573,64 +4693,64 @@ var logExportFieldSchema = z10.enum([
 ]);
 var LOGGING_TOOL_SCHEMAS = {
   insertLog: {
-    request_url: z10.string().optional().describe("The endpoint URL being called"),
-    request_provider: z10.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
-    request_method: z10.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
-    request_headers: z10.record(z10.string(), z10.string()).optional().describe("Request headers as key-value pairs"),
-    request_body: z10.record(z10.string(), z10.unknown()).optional().describe("Request payload/body"),
-    response_status: z10.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
-    response_headers: z10.record(z10.string(), z10.string()).optional().describe("Response headers as key-value pairs"),
-    response_body: z10.record(z10.string(), z10.unknown()).optional().describe("Response payload/body"),
-    response_time: z10.coerce.number().optional().describe("Response latency in milliseconds"),
-    streaming_mode: z10.boolean().optional().default(false).describe("Whether the response was streamed"),
-    metadata_organization: z10.string().optional().describe("Organization identifier for the log"),
-    metadata_user: z10.string().optional().describe("User identifier for the log"),
-    metadata_trace_id: z10.string().optional().describe("Trace ID for distributed tracing"),
-    metadata_span_id: z10.string().optional().describe("Span ID for tracing"),
-    metadata_span_name: z10.string().optional().describe("Span name for tracing"),
-    metadata_parent_span_id: z10.string().optional().describe("Parent span ID for tracing"),
-    metadata_custom: z10.record(z10.string(), z10.unknown()).optional().describe("Additional custom metadata key-value pairs")
+    request_url: z11.string().optional().describe("The endpoint URL being called"),
+    request_provider: z11.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
+    request_method: z11.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
+    request_headers: z11.record(z11.string(), z11.string()).optional().describe("Request headers as key-value pairs"),
+    request_body: z11.record(z11.string(), z11.unknown()).optional().describe("Request payload/body"),
+    response_status: z11.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
+    response_headers: z11.record(z11.string(), z11.string()).optional().describe("Response headers as key-value pairs"),
+    response_body: z11.record(z11.string(), z11.unknown()).optional().describe("Response payload/body"),
+    response_time: z11.coerce.number().optional().describe("Response latency in milliseconds"),
+    streaming_mode: z11.boolean().optional().default(false).describe("Whether the response was streamed"),
+    metadata_organization: z11.string().optional().describe("Organization identifier for the log"),
+    metadata_user: z11.string().optional().describe("User identifier for the log"),
+    metadata_trace_id: z11.string().optional().describe("Trace ID for distributed tracing"),
+    metadata_span_id: z11.string().optional().describe("Span ID for tracing"),
+    metadata_span_name: z11.string().optional().describe("Span name for tracing"),
+    metadata_parent_span_id: z11.string().optional().describe("Parent span ID for tracing"),
+    metadata_custom: z11.record(z11.string(), z11.unknown()).optional().describe("Additional custom metadata key-value pairs")
   },
   createLogExport: {
-    workspace_id: z10.string().optional().describe("Workspace ID for the export"),
-    description: z10.string().optional().describe("Human-readable description for the export job"),
-    time_min: z10.string().describe(
+    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
+    description: z11.string().optional().describe("Human-readable description for the export job"),
+    time_min: z11.string().describe(
       "Minimum time filter in date format (e.g., '2024-01-01' or ISO 8601)"
     ),
-    time_max: z10.string().describe(
+    time_max: z11.string().describe(
       "Maximum time filter in date format (e.g., '2024-01-31' or ISO 8601)"
     ),
-    cost_min: z10.coerce.number().optional().describe("Minimum cost filter"),
-    cost_max: z10.coerce.number().optional().describe("Maximum cost filter"),
-    total_units_min: z10.coerce.number().optional().describe("Minimum total units (tokens) filter"),
-    total_units_max: z10.coerce.number().optional().describe("Maximum total units (tokens) filter"),
-    ai_model: z10.array(z10.string()).optional().describe("Filter by specific AI model names"),
-    requested_fields: z10.array(logExportFieldSchema).describe(
+    cost_min: z11.coerce.number().optional().describe("Minimum cost filter"),
+    cost_max: z11.coerce.number().optional().describe("Maximum cost filter"),
+    total_units_min: z11.coerce.number().optional().describe("Minimum total units (tokens) filter"),
+    total_units_max: z11.coerce.number().optional().describe("Maximum total units (tokens) filter"),
+    ai_model: z11.array(z11.string()).optional().describe("Filter by specific AI model names"),
+    requested_fields: z11.array(logExportFieldSchema).describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   },
   listLogExports: {
-    workspace_id: z10.string().describe("Workspace ID to list exports for (required)")
+    workspace_id: z11.string().describe("Workspace ID to list exports for (required)")
   },
   getLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export")
+    export_id: z11.string().describe("The unique ID of the log export")
   },
   startLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to start")
+    export_id: z11.string().describe("The unique ID of the log export to start")
   },
   cancelLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to cancel")
+    export_id: z11.string().describe("The unique ID of the log export to cancel")
   },
   downloadLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to download")
+    export_id: z11.string().describe("The unique ID of the log export to download")
   },
   updateLogExport: {
-    export_id: z10.string().describe("The unique ID of the log export to update"),
-    workspace_id: z10.string().optional().describe("Workspace ID for the export"),
-    time_of_generation_max: z10.string().optional().describe(
+    export_id: z11.string().describe("The unique ID of the log export to update"),
+    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
+    time_of_generation_max: z11.string().optional().describe(
       "Maximum time filter in date format (e.g., '2024-07-25' or ISO 8601)"
     ),
-    requested_fields: z10.array(logExportFieldSchema).optional().describe(
+    requested_fields: z11.array(logExportFieldSchema).optional().describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   }
@@ -4871,73 +4991,73 @@ function registerLoggingTools(server, service) {
 }
 
 // src/tools/mcp-integrations.tools.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
   listMcpIntegrations: {
-    current_page: z11.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z11.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z11.string().optional().describe("Filter by workspace ID")
+    current_page: z12.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z12.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z12.string().optional().describe("Filter by workspace ID")
   },
   createMcpIntegration: {
-    name: z11.string().describe("Display name for the MCP integration"),
-    url: z11.string().describe("URL endpoint of the MCP server to integrate"),
-    auth_type: z11.enum(["oauth_auto", "headers", "none"]).describe(
+    name: z12.string().describe("Display name for the MCP integration"),
+    url: z12.string().describe("URL endpoint of the MCP server to integrate"),
+    auth_type: z12.enum(["oauth_auto", "headers", "none"]).describe(
       "Authentication type: 'none', 'headers' (custom headers), or 'oauth_auto' (OAuth)"
     ),
-    transport: z11.enum(["http", "sse"]).describe(
+    transport: z12.enum(["http", "sse"]).describe(
       "MCP transport protocol: 'http' (streamable HTTP) or 'sse' (server-sent events)"
     ),
-    slug: z11.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z11.string().optional().describe("Description of the MCP integration"),
-    custom_headers: z11.record(z11.string(), z11.string()).optional().describe(
+    slug: z12.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z12.string().optional().describe("Description of the MCP integration"),
+    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
       'Custom headers for authentication (e.g. { "Authorization": "Bearer xxx" }). Sent via configurations.custom_headers'
     ),
-    workspace_id: z11.string().optional().describe(
+    workspace_id: z12.string().optional().describe(
       "Workspace ID \u2014 required when using organization admin API keys"
     )
   },
   getMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to retrieve")
+    id: z12.string().describe("The MCP integration ID or slug to retrieve")
   },
   updateMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to update"),
-    name: z11.string().optional().describe("New display name"),
-    description: z11.string().optional().describe("New description"),
-    url: z11.string().optional().describe("New URL endpoint"),
-    auth_type: z11.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
-    transport: z11.enum(["http", "sse"]).optional().describe("New transport protocol"),
-    custom_headers: z11.record(z11.string(), z11.string()).optional().describe(
+    id: z12.string().describe("The MCP integration ID or slug to update"),
+    name: z12.string().optional().describe("New display name"),
+    description: z12.string().optional().describe("New description"),
+    url: z12.string().optional().describe("New URL endpoint"),
+    auth_type: z12.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
+    transport: z12.enum(["http", "sse"]).optional().describe("New transport protocol"),
+    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
       "New custom headers for authentication. Sent via configurations.custom_headers"
     )
   },
   deleteMcpIntegration: {
-    id: z11.string().describe("The MCP integration ID or slug to delete")
+    id: z12.string().describe("The MCP integration ID or slug to delete")
   },
   getMcpIntegrationMetadata: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   listMcpIntegrationCapabilities: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationCapabilities: {
-    id: z11.string().describe("The MCP integration ID or slug"),
-    capabilities: z11.array(
-      z11.object({
-        name: z11.string().describe("Capability name"),
-        type: z11.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z11.boolean().describe("Whether to enable the capability")
+    id: z12.string().describe("The MCP integration ID or slug"),
+    capabilities: z12.array(
+      z12.object({
+        name: z12.string().describe("Capability name"),
+        type: z12.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z12.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpIntegrationWorkspaces: {
-    id: z11.string().describe("The MCP integration ID or slug")
+    id: z12.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationWorkspaces: {
-    id: z11.string().describe("The MCP integration ID or slug"),
-    workspaces: z11.array(
-      z11.object({
-        id: z11.string().describe("Workspace ID"),
-        enabled: z11.boolean().describe("Whether workspace has access")
+    id: z12.string().describe("The MCP integration ID or slug"),
+    workspaces: z12.array(
+      z12.object({
+        id: z12.string().describe("Workspace ID"),
+        enabled: z12.boolean().describe("Whether workspace has access")
       })
     ).min(1).describe("Array of workspace access updates")
   }
@@ -5229,7 +5349,7 @@ function registerMcpIntegrationsTools(server, service) {
 }
 
 // src/tools/mcp-servers.tools.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/tools/utils.ts
 function formatFullName(firstName, lastName) {
@@ -5239,56 +5359,56 @@ function formatFullName(firstName, lastName) {
 // src/tools/mcp-servers.tools.ts
 var MCP_SERVERS_TOOL_SCHEMAS = {
   listMcpServers: {
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z12.string().optional().describe("Filter by workspace ID")
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z13.string().optional().describe("Filter by workspace ID")
   },
   createMcpServer: {
-    name: z12.string().describe("Display name for the MCP server"),
-    mcp_integration_id: z12.string().describe("ID or slug of the MCP integration this server belongs to"),
-    slug: z12.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z12.string().optional().describe("Description of the MCP server")
+    name: z13.string().describe("Display name for the MCP server"),
+    mcp_integration_id: z13.string().describe("ID or slug of the MCP integration this server belongs to"),
+    slug: z13.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z13.string().optional().describe("Description of the MCP server")
   },
   getMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to retrieve")
+    id: z13.string().describe("The MCP server ID or slug to retrieve")
   },
   updateMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to update"),
-    name: z12.string().optional().describe("New display name"),
-    description: z12.string().optional().describe("New description")
+    id: z13.string().describe("The MCP server ID or slug to update"),
+    name: z13.string().optional().describe("New display name"),
+    description: z13.string().optional().describe("New description")
   },
   deleteMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to delete")
+    id: z13.string().describe("The MCP server ID or slug to delete")
   },
   testMcpServer: {
-    id: z12.string().describe("The MCP server ID or slug to test")
+    id: z13.string().describe("The MCP server ID or slug to test")
   },
   listMcpServerCapabilities: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z13.string().describe("The MCP server ID or slug"),
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerCapabilities: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    capabilities: z12.array(
-      z12.object({
-        name: z12.string().describe("Capability name"),
-        type: z12.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z12.boolean().describe("Whether to enable the capability")
+    id: z13.string().describe("The MCP server ID or slug"),
+    capabilities: z13.array(
+      z13.object({
+        name: z13.string().describe("Capability name"),
+        type: z13.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z13.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpServerUserAccess: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    current_page: z12.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z13.string().describe("The MCP server ID or slug"),
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerUserAccess: {
-    id: z12.string().describe("The MCP server ID or slug"),
-    users: z12.array(
-      z12.object({
-        user_id: z12.string().describe("User ID"),
-        enabled: z12.boolean().describe("Whether user has access")
+    id: z13.string().describe("The MCP server ID or slug"),
+    users: z13.array(
+      z13.object({
+        user_id: z13.string().describe("User ID"),
+        enabled: z13.boolean().describe("Whether user has access")
       })
     ).min(1).describe("Array of user access updates")
   }
@@ -5532,40 +5652,40 @@ function registerMcpServersTools(server, service) {
 }
 
 // src/tools/partials.tools.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var PARTIALS_TOOL_SCHEMAS = {
   createPromptPartial: {
-    name: z13.string().describe("Display name for the partial"),
-    string: z13.string().describe("The partial content/template string"),
-    workspace_id: z13.string().optional().describe(
+    name: z14.string().describe("Display name for the partial"),
+    string: z14.string().describe("The partial content/template string"),
+    workspace_id: z14.string().optional().describe(
       "Workspace ID to create partial in (required for org-level API keys)"
     ),
-    version_description: z13.string().optional().describe("Description for this version")
+    version_description: z14.string().optional().describe("Description for this version")
   },
   listPromptPartials: {
-    collection_id: z13.string().optional().describe(
+    collection_id: z14.string().optional().describe(
       "Filter by collection ID. Optional \u2014 omit to list all partials across collections"
     )
   },
   getPromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to retrieve")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to retrieve")
   },
   updatePromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to update"),
-    name: z13.string().optional().describe("New display name for the partial"),
-    string: z13.string().optional().describe("New content for the partial"),
-    description: z13.string().optional().describe("Description for this version"),
-    status: z13.enum(["active", "archived"]).optional().describe("New status for the partial")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to update"),
+    name: z14.string().optional().describe("New display name for the partial"),
+    string: z14.string().optional().describe("New content for the partial"),
+    description: z14.string().optional().describe("Description for this version"),
+    status: z14.enum(["active", "archived"]).optional().describe("New status for the partial")
   },
   deletePromptPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to delete")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to delete")
   },
   listPartialVersions: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug to list versions for")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to list versions for")
   },
   publishPartial: {
-    prompt_partial_id: z13.string().describe("Prompt partial ID or slug"),
-    version: z13.coerce.number().positive().describe("Version number to publish as default")
+    prompt_partial_id: z14.string().describe("Prompt partial ID or slug"),
+    version: z14.coerce.number().positive().describe("Version number to publish as default")
   }
 };
 function registerPartialsTools(server, service) {
@@ -5751,57 +5871,57 @@ function registerPartialsTools(server, service) {
 }
 
 // src/tools/prompts.tools.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // src/lib/schemas.ts
-import { z as z14 } from "zod";
-var PromptFunctionSchema = z14.object({
-  name: z14.string().describe("Function name"),
-  description: z14.string().optional().describe("Function description"),
-  parameters: z14.record(z14.string(), z14.unknown()).optional().describe("Function parameters schema")
+import { z as z15 } from "zod";
+var PromptFunctionSchema = z15.object({
+  name: z15.string().describe("Function name"),
+  description: z15.string().optional().describe("Function description"),
+  parameters: z15.record(z15.string(), z15.unknown()).optional().describe("Function parameters schema")
 });
-var PromptToolSchema = z14.object({
-  type: z14.literal("function").describe("Tool type"),
+var PromptToolSchema = z15.object({
+  type: z15.literal("function").describe("Tool type"),
   function: PromptFunctionSchema.describe("Function definition")
 });
-var HyperparametersSchema = z14.object({
-  max_tokens: z14.coerce.number().positive().optional().describe("Maximum tokens to generate"),
-  temperature: z14.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
-  top_p: z14.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
-  top_k: z14.coerce.number().positive().optional().describe("Top-k sampling"),
-  presence_penalty: z14.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
-  frequency_penalty: z14.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
-  stop: z14.array(z14.string()).optional().describe("Stop sequences")
+var HyperparametersSchema = z15.object({
+  max_tokens: z15.coerce.number().positive().optional().describe("Maximum tokens to generate"),
+  temperature: z15.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
+  top_p: z15.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
+  top_k: z15.coerce.number().positive().optional().describe("Top-k sampling"),
+  presence_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
+  frequency_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
+  stop: z15.array(z15.string()).optional().describe("Stop sequences")
 });
-var PromptAppIdentifierSchema = z14.string().min(1).describe(
+var PromptAppIdentifierSchema = z15.string().min(1).describe(
   "App identifier (REQUIRED). Use your deployed app name, for example 'hourlink' or 'support-console'."
 );
-var PromptEnvironmentIdentifierSchema = z14.string().min(1).describe(
+var PromptEnvironmentIdentifierSchema = z15.string().min(1).describe(
   "Environment identifier (REQUIRED). Use your environment name, for example 'dev', 'staging', 'prod', or 'qa'."
 );
-var BillingMetadataSchema = z14.object({
-  client_id: z14.string().describe("Client ID for billing attribution (REQUIRED)"),
+var BillingMetadataSchema = z15.object({
+  client_id: z15.string().describe("Client ID for billing attribution (REQUIRED)"),
   app: PromptAppIdentifierSchema,
   env: PromptEnvironmentIdentifierSchema,
-  project_id: z14.string().optional().describe("Project ID for granular billing"),
-  feature: z14.string().optional().describe("Feature name for tracking")
+  project_id: z15.string().optional().describe("Project ID for granular billing"),
+  feature: z15.string().optional().describe("Feature name for tracking")
 });
-var ToolChoiceSchema = z14.object({
-  mode: z14.enum(["auto", "none", "function"]).describe(
+var ToolChoiceSchema = z15.object({
+  mode: z15.enum(["auto", "none", "function"]).describe(
     "Tool choice mode: auto lets the model decide, none disables tool use, function forces one function by name"
   ),
-  function_name: z14.string().optional().describe("Required when mode is 'function'; ignored otherwise")
+  function_name: z15.string().optional().describe("Required when mode is 'function'; ignored otherwise")
 }).superRefine((value, ctx) => {
   if (value.mode === "function" && !value.function_name) {
     ctx.addIssue({
-      code: z14.ZodIssueCode.custom,
+      code: z15.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is required when mode is 'function'"
     });
   }
   if (value.mode !== "function" && value.function_name !== void 0) {
     ctx.addIssue({
-      code: z14.ZodIssueCode.custom,
+      code: z15.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is only allowed when mode is 'function'"
     });
@@ -5823,98 +5943,98 @@ function toPromptToolChoice(toolChoice) {
 }
 
 // src/tools/prompts.tools.ts
-var PROMPT_VARIABLES_SCHEMA = z15.record(z15.string(), z15.union([z15.string(), z15.coerce.number(), z15.boolean()])).describe("Variable values to substitute into the template");
-var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z15.object({
-  type: z15.string().describe("Content block type"),
-  text: z15.string().optional().describe("Text content for text-based blocks")
+var PROMPT_VARIABLES_SCHEMA = z16.record(z16.string(), z16.union([z16.string(), z16.coerce.number(), z16.boolean()])).describe("Variable values to substitute into the template");
+var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z16.object({
+  type: z16.string().describe("Content block type"),
+  text: z16.string().optional().describe("Text content for text-based blocks")
 }).passthrough().describe("Content block within a structured chat message");
-var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z15.object({
-  role: z15.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
-  content: z15.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
+var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z16.object({
+  role: z16.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
+  content: z16.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
 }).passthrough().describe("Structured chat message in a prompt template");
 var PROMPTS_TOOL_SCHEMAS = {
   createPrompt: {
-    name: z15.string().describe("Display name for the prompt"),
-    collection_id: z15.string().describe(
+    name: z16.string().describe("Display name for the prompt"),
+    collection_id: z16.string().describe(
       "Collection ID to organize the prompt in (use list_collections to find)"
     ),
-    string: z15.string().optional().describe(
+    string: z16.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias. Serialized to the legacy string format before creation."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).describe("Default values for template variables"),
-    virtual_key: z15.string().describe("Virtual key slug for model access"),
-    model: z15.string().optional().describe(
+    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
+    virtual_key: z16.string().describe("Virtual key slug for model access"),
+    model: z16.string().optional().describe(
       "Model identifier (e.g., 'gpt-4', 'claude-3-opus'). Required unless ai_model_id or finetune_id is provided"
     ),
-    ai_model_id: z15.string().optional().describe(
+    ai_model_id: z16.string().optional().describe(
       "AI model ID (alternative to model). Required unless model or finetune_id is provided"
     ),
-    finetune_id: z15.string().optional().describe(
+    finetune_id: z16.string().optional().describe(
       "Fine-tune ID (alternative to model). Required unless model or ai_model_id is provided"
     ),
-    version_description: z15.string().optional().describe("Description for this prompt version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
-    tools: z15.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
+    version_description: z16.string().optional().describe("Description for this prompt version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
+    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z15.boolean().optional().describe("When true, validate without creating")
+    dry_run: z16.boolean().optional().describe("When true, validate without creating")
   },
   listPrompts: {
-    collection_id: z15.string().optional().describe(
+    collection_id: z16.string().optional().describe(
       "Filter by collection ID (recommended for app-specific prompts)"
     ),
-    workspace_id: z15.string().optional().describe("Filter by workspace ID"),
-    search: z15.string().optional().describe("Search prompts by name"),
-    current_page: z15.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z15.coerce.number().positive().max(100).optional().describe("Results per page (max 100)")
+    workspace_id: z16.string().optional().describe("Filter by workspace ID"),
+    search: z16.string().optional().describe("Search prompts by name"),
+    current_page: z16.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z16.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to retrieve")
+    prompt_id: z16.string().describe("Prompt ID or slug to retrieve")
   },
   updatePrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to update"),
-    name: z15.string().optional().describe("New display name for the prompt"),
-    collection_id: z15.string().optional().describe("Move to a different collection"),
-    string: z15.string().optional().describe(
+    prompt_id: z16.string().describe("Prompt ID or slug to update"),
+    name: z16.string().optional().describe("New display name for the prompt"),
+    collection_id: z16.string().optional().describe("Move to a different collection"),
+    string: z16.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for updates. Serialized to the legacy string format before the prompt is updated."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).optional().describe("New default values for template variables"),
-    model: z15.string().optional().describe("New model identifier"),
-    virtual_key: z15.string().optional().describe("New virtual key slug"),
-    version_description: z15.string().optional().describe("Description for this version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("New metadata"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("New function definitions"),
-    tools: z15.array(PromptToolSchema).optional().describe("New tool definitions"),
+    parameters: z16.record(z16.string(), z16.unknown()).optional().describe("New default values for template variables"),
+    model: z16.string().optional().describe("New model identifier"),
+    virtual_key: z16.string().optional().describe("New virtual key slug"),
+    version_description: z16.string().optional().describe("Description for this version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("New metadata"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("New function definitions"),
+    tools: z16.array(PromptToolSchema).optional().describe("New tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe(
       "New tool choice strategy"
     ),
-    dry_run: z15.boolean().optional().describe("When true, validate without updating")
+    dry_run: z16.boolean().optional().describe("When true, validate without updating")
   },
   deletePrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to delete")
+    prompt_id: z16.string().describe("Prompt ID or slug to delete")
   },
   publishPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to publish"),
-    version: z15.coerce.number().positive().describe("Version number to publish as the default")
+    prompt_id: z16.string().describe("Prompt ID or slug to publish"),
+    version: z16.coerce.number().positive().describe("Version number to publish as the default")
   },
   listPromptVersions: {
-    prompt_id: z15.string().describe("Prompt ID or slug to list versions for")
+    prompt_id: z16.string().describe("Prompt ID or slug to list versions for")
   },
   renderPrompt: {
-    prompt_id: z15.string().describe("Prompt ID or slug to render"),
+    prompt_id: z16.string().describe("Prompt ID or slug to render"),
     variables: PROMPT_VARIABLES_SCHEMA,
     hyperparameters: HyperparametersSchema.optional().describe(
       "Override default hyperparameters"
     )
   },
   runPromptCompletion: {
-    prompt_id: z15.string().describe("Prompt ID or slug to execute"),
+    prompt_id: z16.string().describe("Prompt ID or slug to execute"),
     variables: PROMPT_VARIABLES_SCHEMA,
     metadata: BillingMetadataSchema.describe(
       "Billing metadata - client_id, app, env are REQUIRED for cost attribution"
@@ -5924,54 +6044,54 @@ var PROMPTS_TOOL_SCHEMAS = {
     )
   },
   migratePrompt: {
-    name: z15.string().describe("Prompt name to create or find for update"),
+    name: z16.string().describe("Prompt name to create or find for update"),
     app: PromptAppIdentifierSchema,
     env: PromptEnvironmentIdentifierSchema,
-    collection_id: z15.string().describe("Collection ID to search in and create under"),
-    string: z15.string().optional().describe(
+    collection_id: z16.string().describe("Collection ID to search in and create under"),
+    string: z16.string().optional().describe(
       "Legacy prompt template string with {{variable}} mustache syntax."
     ),
-    messages: z15.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for migrations. Serialized to the legacy string format before the prompt is created or updated."
     ),
-    parameters: z15.record(z15.string(), z15.unknown()).describe("Default values for template variables"),
-    virtual_key: z15.string().describe("Virtual key slug for model access"),
-    model: z15.string().optional().describe("Model identifier"),
-    version_description: z15.string().optional().describe("Description for this version"),
-    template_metadata: z15.record(z15.string(), z15.unknown()).optional().describe("Additional custom metadata"),
-    functions: z15.array(PromptFunctionSchema).optional().describe("Function definitions"),
-    tools: z15.array(PromptToolSchema).optional().describe("Tool definitions"),
+    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
+    virtual_key: z16.string().describe("Virtual key slug for model access"),
+    model: z16.string().optional().describe("Model identifier"),
+    version_description: z16.string().optional().describe("Description for this version"),
+    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Additional custom metadata"),
+    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions"),
+    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z15.boolean().optional().describe(
+    dry_run: z16.boolean().optional().describe(
       "When true, only check what action would be taken without making changes"
     )
   },
   promotePrompt: {
-    source_prompt_id: z15.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
-    target_collection_id: z15.string().describe("Target collection ID for the promoted prompt"),
-    target_name: z15.string().optional().describe(
+    source_prompt_id: z16.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
+    target_collection_id: z16.string().describe("Target collection ID for the promoted prompt"),
+    target_name: z16.string().optional().describe(
       "Target prompt name (defaults to source name with env suffix replaced)"
     ),
     target_env: PromptEnvironmentIdentifierSchema,
-    virtual_key: z15.string().optional().describe(
+    virtual_key: z16.string().optional().describe(
       "Virtual key ID to use (defaults to source prompt's virtual_key)"
     )
   },
   validateCompletionMetadata: {
-    client_id: z15.string().optional().describe("Client ID for billing attribution"),
+    client_id: z16.string().optional().describe("Client ID for billing attribution"),
     app: PromptAppIdentifierSchema.optional(),
     env: PromptEnvironmentIdentifierSchema.optional(),
-    project_id: z15.string().optional().describe("Project ID for granular billing"),
-    feature: z15.string().optional().describe("Feature name for tracking")
+    project_id: z16.string().optional().describe("Project ID for granular billing"),
+    feature: z16.string().optional().describe("Feature name for tracking")
   },
   getPromptVersion: {
-    prompt_id: z15.string().describe("Prompt ID or slug"),
-    version_id: z15.string().describe("Version UUID to retrieve")
+    prompt_id: z16.string().describe("Prompt ID or slug"),
+    version_id: z16.string().describe("Version UUID to retrieve")
   },
   updatePromptVersion: {
-    prompt_id: z15.string().describe("Prompt ID or slug"),
-    version_id: z15.string().describe("Version UUID to update"),
-    label_id: z15.string().nullable().describe(
+    prompt_id: z16.string().describe("Prompt ID or slug"),
+    version_id: z16.string().describe("Version UUID to update"),
+    label_id: z16.string().nullable().describe(
       "Label ID to assign to this version, or null to remove the label"
     )
   }
@@ -6561,68 +6681,68 @@ function registerPromptsTools(server, service) {
 }
 
 // src/tools/providers.tools.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var PROVIDERS_TOOL_SCHEMAS = {
   listProviders: {
-    current_page: z16.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z16.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
-    workspace_id: z16.string().optional().describe(
+    current_page: z17.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z17.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
+    workspace_id: z17.string().optional().describe(
       "Workspace ID - required when using organization admin keys, optional with workspace API keys"
     )
   },
   createProvider: {
-    name: z16.string().describe("Display name for the provider"),
-    integration_id: z16.string().describe(
+    name: z17.string().describe("Display name for the provider"),
+    integration_id: z17.string().describe(
       "Integration slug for the provider (e.g., 'openai', 'anthropic', 'azure-openai')"
     ),
-    workspace_id: z16.string().optional().describe(
+    workspace_id: z17.string().optional().describe(
       "Workspace ID - required when using organization admin API keys"
     ),
-    slug: z16.string().optional().describe(
+    slug: z17.string().optional().describe(
       "Custom slug for the provider. Auto-generated with random suffix if omitted"
     ),
-    note: z16.string().optional().describe("Optional note or description for the provider"),
-    credit_limit: z16.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    usage_limit_type: z16.enum(["cost", "tokens"]).optional().describe(
+    note: z17.string().optional().describe("Optional note or description for the provider"),
+    credit_limit: z17.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z16.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z16.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
-    rate_limit_unit: z16.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z17.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
+    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Must be provided together with rate_limit_value. Values: 'rpm' (requests/min), 'rph' (requests/hour), or 'rpd' (requests/day)."
     ),
-    expires_at: z16.string().optional().describe("Expiration date in ISO 8601 format")
+    expires_at: z17.string().optional().describe("Expiration date in ISO 8601 format")
   },
   getProvider: {
-    slug: z16.string().describe("The unique slug identifier of the provider to retrieve"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z17.string().describe("The unique slug identifier of the provider to retrieve"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
   },
   updateProvider: {
-    slug: z16.string().describe("The slug of the provider to update"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys"),
-    name: z16.string().optional().describe("New display name for the provider"),
-    note: z16.string().optional().describe("New note or description for the provider"),
-    credit_limit: z16.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z16.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    usage_limit_type: z16.enum(["cost", "tokens"]).optional().describe(
+    slug: z17.string().describe("The slug of the provider to update"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys"),
+    name: z17.string().optional().describe("New display name for the provider"),
+    note: z17.string().optional().describe("New note or description for the provider"),
+    credit_limit: z17.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z16.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z16.coerce.number().positive().optional().describe("New rate limit value"),
-    rate_limit_unit: z16.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z17.coerce.number().positive().optional().describe("New rate limit value"),
+    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Rate limit unit: 'rpm' (requests per minute), 'rph' (requests per hour), or 'rpd' (requests per day)"
     ),
-    expires_at: z16.string().optional().describe("New expiration date in ISO 8601 format"),
-    reset_usage: z16.boolean().optional().describe("Set to true to reset accumulated usage metrics")
+    expires_at: z17.string().optional().describe("New expiration date in ISO 8601 format"),
+    reset_usage: z17.boolean().optional().describe("Set to true to reset accumulated usage metrics")
   },
   deleteProvider: {
-    slug: z16.string().describe("The slug of the provider to delete"),
-    workspace_id: z16.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z17.string().describe("The slug of the provider to delete"),
+    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
   }
 };
 function registerProvidersTools(server, service) {
@@ -6803,30 +6923,427 @@ function registerProvidersTools(server, service) {
   );
 }
 
+// src/tools/secret-references.tools.ts
+import { z as z18 } from "zod";
+var authFields = {
+  aws_auth_type: z18.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
+    "AWS authentication mode: accessKey uses a key pair, assumedRole uses an IAM role, and serviceRole uses the runtime workload identity"
+  ),
+  aws_access_key_id: z18.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
+  aws_secret_access_key: z18.string().min(1).describe(
+    "AWS secret access key; required when aws_auth_type is accessKey and exposed to the MCP transcript"
+  ),
+  aws_region: z18.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
+  aws_role_arn: z18.string().min(1).describe(
+    "IAM role ARN to assume; required when aws_auth_type is assumedRole"
+  ),
+  aws_external_id: z18.string().nullable().describe("Optional external ID required by the target IAM role"),
+  azure_auth_mode: z18.enum(["entra", "managed", "default"]).describe(
+    "Azure authentication mode: entra uses a client secret, managed uses managed identity, and default uses the runtime credential chain"
+  ),
+  azure_entra_tenant_id: z18.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
+  azure_entra_client_id: z18.string().min(1).describe(
+    "Microsoft Entra application client ID; required for entra authentication"
+  ),
+  azure_entra_client_secret: z18.string().min(1).describe(
+    "Microsoft Entra client secret; required for entra authentication and exposed to the MCP transcript"
+  ),
+  azure_managed_client_id: z18.string().min(1).describe(
+    "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
+  ),
+  azure_vault_url: z18.url().describe(
+    "Azure Key Vault URL, for example https://example.vault.azure.net"
+  ),
+  vault_auth_type: z18.enum(["token", "approle", "kubernetes"]).describe(
+    "HashiCorp Vault authentication mode: token, AppRole, or Kubernetes"
+  ),
+  vault_addr: z18.url().describe("Base URL of the HashiCorp Vault server"),
+  vault_token: z18.string().min(1).describe(
+    "HashiCorp Vault token; required for token authentication and exposed to the MCP transcript"
+  ),
+  vault_namespace: z18.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
+  vault_role_id: z18.string().min(1).describe(
+    "HashiCorp Vault AppRole role ID; required for approle authentication"
+  ),
+  vault_secret_id: z18.string().min(1).describe(
+    "HashiCorp Vault AppRole secret ID; required for approle authentication and exposed to the MCP transcript"
+  ),
+  vault_role: z18.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
+};
+var authConfigSchema = z18.union([
+  z18.object({
+    aws_auth_type: z18.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
+    aws_access_key_id: authFields.aws_access_key_id,
+    aws_secret_access_key: authFields.aws_secret_access_key,
+    aws_region: authFields.aws_region
+  }).strict(),
+  z18.object({
+    aws_auth_type: z18.literal("assumedRole").describe("Assume the specified AWS IAM role"),
+    aws_role_arn: authFields.aws_role_arn,
+    aws_external_id: authFields.aws_external_id.optional(),
+    aws_region: authFields.aws_region
+  }).strict(),
+  z18.object({
+    aws_auth_type: z18.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
+    aws_region: z18.string().optional().describe(
+      "Optional AWS region containing the secret, for example us-east-1"
+    )
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("entra").describe(
+      "Authenticate with a Microsoft Entra application client secret"
+    ),
+    azure_entra_tenant_id: authFields.azure_entra_tenant_id,
+    azure_entra_client_id: authFields.azure_entra_client_id,
+    azure_entra_client_secret: authFields.azure_entra_client_secret,
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("managed").describe("Authenticate with an Azure managed identity"),
+    azure_managed_client_id: authFields.azure_managed_client_id.optional(),
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    azure_auth_mode: z18.literal("default").describe("Use Azure's default runtime credential chain"),
+    azure_vault_url: authFields.azure_vault_url
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
+    vault_addr: authFields.vault_addr,
+    vault_token: authFields.vault_token,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
+    vault_addr: authFields.vault_addr,
+    vault_role_id: authFields.vault_role_id,
+    vault_secret_id: authFields.vault_secret_id,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: z18.literal("kubernetes").describe(
+      "Authenticate to HashiCorp Vault with a Kubernetes service account"
+    ),
+    vault_addr: authFields.vault_addr,
+    vault_role: authFields.vault_role,
+    vault_namespace: authFields.vault_namespace.optional()
+  }).strict()
+]);
+var updateAuthConfigSchema = z18.union([
+  z18.object({
+    aws_auth_type: authFields.aws_auth_type.optional(),
+    aws_access_key_id: authFields.aws_access_key_id.optional(),
+    aws_secret_access_key: authFields.aws_secret_access_key.optional(),
+    aws_region: z18.string().optional().describe("AWS region containing the secret, for example us-east-1"),
+    aws_role_arn: authFields.aws_role_arn.optional(),
+    aws_external_id: authFields.aws_external_id.optional()
+  }).strict(),
+  z18.object({
+    azure_auth_mode: authFields.azure_auth_mode.optional(),
+    azure_entra_tenant_id: authFields.azure_entra_tenant_id.optional(),
+    azure_entra_client_id: authFields.azure_entra_client_id.optional(),
+    azure_entra_client_secret: authFields.azure_entra_client_secret.optional(),
+    azure_managed_client_id: z18.string().optional().describe(
+      "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
+    ),
+    azure_vault_url: authFields.azure_vault_url.optional()
+  }).strict(),
+  z18.object({
+    vault_auth_type: authFields.vault_auth_type.optional(),
+    vault_addr: authFields.vault_addr.optional(),
+    vault_token: authFields.vault_token.optional(),
+    vault_namespace: z18.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
+    vault_role_id: authFields.vault_role_id.optional(),
+    vault_secret_id: authFields.vault_secret_id.optional(),
+    vault_role: authFields.vault_role.optional()
+  }).strict()
+]);
+var managerTypeSchema = z18.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
+  "External secret manager: aws_sm for AWS Secrets Manager, azure_kv for Azure Key Vault, or hashicorp_vault for HashiCorp Vault; must match the auth_config field family"
+);
+var tagsSchema = z18.record(z18.string(), z18.string()).describe("Tag filters or metadata as string key-value pairs");
+var SECRET_REFERENCE_TOOL_SCHEMAS = {
+  create: {
+    name: z18.string().min(1).max(255).describe("Human-readable name"),
+    manager_type: managerTypeSchema,
+    auth_config: authConfigSchema.describe(
+      "Choose exactly one documented authentication shape matching manager_type. Credentials are sent to Portkey and visible in the MCP transcript; prefer workload identity or short-lived credentials when available."
+    ),
+    secret_path: z18.string().max(1024).describe("Path of the secret in the external secret manager"),
+    organisation_id: z18.string().uuid().optional().describe(
+      "Organisation UUID; required when the MCP server is not authenticated with a Portkey API key"
+    ),
+    slug: z18.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
+      "Optional stable slug containing only letters, numbers, underscores, or hyphens; Portkey generates one when omitted"
+    ),
+    description: z18.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
+    secret_key: z18.string().max(255).nullable().optional().describe(
+      "Optional key within a structured external secret; null uses the whole secret value"
+    ),
+    allow_all_workspaces: z18.boolean().optional().describe(
+      "Whether every workspace may use this reference; defaults to true and cannot be true with allowed_workspaces"
+    ),
+    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+      "Workspace UUIDs or slugs allowed to use this reference; omit when allow_all_workspaces is true"
+    ),
+    tags: tagsSchema.nullable().optional().describe(
+      "Optional string key-value tags for filtering and organization"
+    )
+  },
+  list: {
+    manager_type: managerTypeSchema.optional().describe(
+      "Filter by external secret manager: aws_sm, azure_kv, or hashicorp_vault"
+    ),
+    tags: tagsSchema.optional().describe("Return references matching these tags"),
+    search: z18.string().min(1).max(255).optional().describe("Search references by name"),
+    current_page: z18.coerce.number().int().nonnegative().optional().describe("Zero-based page number; defaults to 0"),
+    page_size: z18.coerce.number().int().min(1).max(100).optional().describe("References per page, from 1 to 100; defaults to 20")
+  },
+  get: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+  },
+  update: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug"),
+    name: z18.string().min(1).max(255).optional().describe("New human-readable name"),
+    description: z18.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
+    auth_config: updateAuthConfigSchema.optional().describe(
+      "Provide at least one changed authentication field to merge into the existing configuration; choose one AWS, Azure, or HashiCorp field family and do not mix families"
+    ),
+    secret_path: z18.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
+    secret_key: z18.string().max(255).nullable().optional().describe(
+      "New key within a structured secret, or null to use the whole value"
+    ),
+    allow_all_workspaces: z18.boolean().optional().describe(
+      "Whether every workspace may use this reference; cannot be true with allowed_workspaces"
+    ),
+    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+      "Replacement list of workspace UUIDs or slugs allowed to use this reference; supplying it sets allow_all_workspaces=false"
+    ),
+    tags: tagsSchema.nullable().optional().describe("Replacement string key-value tags, or null to clear them")
+  },
+  delete: {
+    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+  }
+};
+function validateWorkspaceAccess(value) {
+  if (value.allow_all_workspaces === true && value.allowed_workspaces) {
+    throw new Error(
+      "allow_all_workspaces=true is mutually exclusive with allowed_workspaces"
+    );
+  }
+}
+function validateManagerAuth(managerType, authConfig) {
+  const matches = managerType === "aws_sm" && "aws_auth_type" in authConfig || managerType === "azure_kv" && "azure_auth_mode" in authConfig || managerType === "hashicorp_vault" && "vault_auth_type" in authConfig;
+  if (!matches) {
+    throw new Error(`auth_config does not match manager_type ${managerType}`);
+  }
+}
+function validateAuthUpdate(authConfig) {
+  if (Object.keys(authConfig).length === 0) {
+    throw new Error("auth_config update must contain at least one field");
+  }
+  const families = new Set(
+    Object.keys(authConfig).map((key) => {
+      if (key.startsWith("aws_")) return "AWS";
+      if (key.startsWith("azure_")) return "Azure";
+      if (key.startsWith("vault_")) return "HashiCorp Vault";
+      return "unknown";
+    })
+  );
+  if (families.size > 1) {
+    throw new Error(
+      "auth_config update must contain fields for exactly one secret-manager family"
+    );
+  }
+}
+var SENSITIVE_AUTH_FIELD = /(?:secret|token|password|credential|access_key_id)/i;
+function redactAuthConfig(authConfig) {
+  return Object.fromEntries(
+    Object.entries(authConfig).map(([key, value]) => {
+      if (SENSITIVE_AUTH_FIELD.test(key)) return [key, "[REDACTED]"];
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        return [key, redactAuthConfig(value)];
+      }
+      return [key, value];
+    })
+  );
+}
+function registerSecretReferencesTools(server, service) {
+  server.tool(
+    "create_secret_reference",
+    "Create a reference to a secret stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault. Authentication credentials are sent to Portkey and exposed to this MCP transcript; use short-lived or workload identity modes when possible. Returns the new UUID and slug, never the resolved external secret.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.create,
+    {
+      title: "Create Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
+    async (params) => {
+      validateWorkspaceAccess(params);
+      validateManagerAuth(params.manager_type, params.auth_config);
+      const result = await service.secretReferences.createSecretReference(params);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully created Secret Reference "${result.slug}"`,
+              id: result.id,
+              slug: result.slug
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_secret_references",
+    "List Secret References without returning authentication configuration or resolved secret values. Filter by manager type, tags, or name and use a returned UUID or slug with get_secret_reference.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.list,
+    {
+      title: "List Secret References",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.secretReferences.listSecretReferences({
+        ...params,
+        tags: params.tags ? JSON.stringify(params.tags) : void 0
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              total: result.total,
+              secret_references: result.data.map((reference) => ({
+                id: reference.id,
+                name: reference.name,
+                slug: reference.slug,
+                manager_type: reference.manager_type,
+                status: reference.status,
+                created_at: reference.created_at,
+                last_updated_at: reference.last_updated_at
+              }))
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "get_secret_reference",
+    "Retrieve one Secret Reference by UUID or slug. Portkey masks sensitive authentication fields for non-system users; the tool returns metadata and the masked auth configuration, not the resolved external secret value.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.get,
+    {
+      title: "Get Secret Reference",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id }) => {
+      const result = await service.secretReferences.getSecretReference(id);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              ...result,
+              auth_config: redactAuthConfig(result.auth_config)
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "update_secret_reference",
+    "Update at least one selected field on a Secret Reference. auth_config is merged into the existing manager-specific configuration. allowed_workspaces replaces all workspace mappings and sets allow_all_workspaces=false; allow_all_workspaces=true removes workspace-specific mappings. Credential values are sent to Portkey and exposed to the MCP transcript.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.update,
+    {
+      title: "Update Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id, ...updates }) => {
+      validateWorkspaceAccess(updates);
+      if (Object.keys(updates).length === 0) {
+        throw new Error("Provide at least one field to update");
+      }
+      if (updates.auth_config) validateAuthUpdate(updates.auth_config);
+      await service.secretReferences.updateSecretReference(id, updates);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully updated Secret Reference "${id}"`,
+              success: true
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "delete_secret_reference",
+    "Permanently delete a Secret Reference. This is irreversible and integrations or virtual keys using it can fail to resolve credentials immediately; confirm dependencies before deletion.",
+    SECRET_REFERENCE_TOOL_SCHEMAS.delete,
+    {
+      title: "Delete Secret Reference",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async ({ id }) => {
+      const result = await service.secretReferences.deleteSecretReference(id);
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Successfully deleted Secret Reference "${id}"`,
+              success: result.success
+            })
+          }
+        ]
+      };
+    }
+  );
+}
+
 // src/tools/tracing.tools.ts
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 var TRACING_TOOL_SCHEMAS = {
   createFeedback: {
-    trace_id: z17.string().describe(
+    trace_id: z19.string().describe(
       "The trace ID to associate the feedback with. This links feedback to a specific request/generation."
     ),
-    value: z17.coerce.number().describe(
+    value: z19.coerce.number().describe(
       "Feedback value/rating. Common patterns: 1 for positive (thumbs up), 0 for negative (thumbs down), or use a scale like 1-5."
     ),
-    weight: z17.coerce.number().positive().optional().describe(
+    weight: z19.coerce.number().positive().optional().describe(
       "Optional weighting factor for the feedback. Use to give more importance to certain feedback."
     ),
-    metadata: z17.record(z17.string(), z17.unknown()).optional().describe(
+    metadata: z19.record(z19.string(), z19.unknown()).optional().describe(
       "Optional custom metadata for categorization and analysis (e.g., feedback_source, category, user_segment)."
     )
   },
   updateFeedback: {
-    id: z17.string().describe("The unique identifier of the feedback to update"),
-    value: z17.coerce.number().optional().describe(
+    id: z19.string().describe("The unique identifier of the feedback to update"),
+    value: z19.coerce.number().optional().describe(
       "New feedback value/rating. Common patterns: 1 for positive, 0 for negative."
     ),
-    weight: z17.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
-    metadata: z17.record(z17.string(), z17.unknown()).optional().describe("New or updated custom metadata for the feedback")
+    weight: z19.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
+    metadata: z19.record(z19.string(), z19.unknown()).optional().describe("New or updated custom metadata for the feedback")
   }
 };
 function registerTracingTools(server, service) {
@@ -6882,77 +7399,77 @@ function registerTracingTools(server, service) {
 }
 
 // src/tools/users.tools.ts
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var USERS_TOOL_SCHEMAS = {
   listAllUsers: {
-    current_page: z18.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   inviteUser: {
-    email: z18.string().email().describe("Email address of the user to invite"),
-    role: z18.enum(["admin", "member"]).describe(
+    email: z20.string().email().describe("Email address of the user to invite"),
+    role: z20.enum(["admin", "member"]).describe(
       "Organization-level role: 'admin' for full access, 'member' for limited access"
     ),
-    first_name: z18.string().optional().describe("User's first name"),
-    last_name: z18.string().optional().describe("User's last name"),
-    workspaces: z18.array(
-      z18.object({
-        id: z18.string().describe(
+    first_name: z20.string().optional().describe("User's first name"),
+    last_name: z20.string().optional().describe("User's last name"),
+    workspaces: z20.array(
+      z20.object({
+        id: z20.string().describe(
           "Workspace ID/slug where the user will be granted access"
         ),
-        role: z18.enum(["admin", "member", "manager"]).describe(
+        role: z20.enum(["admin", "member", "manager"]).describe(
           "Workspace-level role: 'admin' for full access, 'manager' for workspace management, 'member' for basic access"
         )
       })
     ).describe(
       "List of workspaces and corresponding roles to grant to the user"
     ),
-    workspace_api_key_details: z18.object({
-      name: z18.string().optional().describe("Name of the API key to be created"),
-      expiry: z18.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
-      metadata: z18.record(z18.string(), z18.string()).optional().describe("Additional metadata key-value pairs for the API key"),
-      scopes: z18.array(z18.string()).describe("List of permission scopes for the API key")
+    workspace_api_key_details: z20.object({
+      name: z20.string().optional().describe("Name of the API key to be created"),
+      expiry: z20.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
+      metadata: z20.record(z20.string(), z20.string()).optional().describe("Additional metadata key-value pairs for the API key"),
+      scopes: z20.array(z20.string()).describe("List of permission scopes for the API key")
     }).optional().describe("Optional API key to be created for the user")
   },
   getUserStats: {
-    time_of_generation_min: z18.string().describe(
+    time_of_generation_min: z20.string().describe(
       "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    time_of_generation_max: z18.string().describe(
+    time_of_generation_max: z20.string().describe(
       "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
     ),
-    total_units_min: z18.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-    total_units_max: z18.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-    cost_min: z18.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-    cost_max: z18.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-    status_code: z18.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
-    virtual_keys: z18.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    total_units_min: z20.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+    total_units_max: z20.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+    cost_min: z20.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+    cost_max: z20.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+    status_code: z20.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
+    virtual_keys: z20.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUser: {
-    user_id: z18.string().describe("The user ID to retrieve")
+    user_id: z20.string().describe("The user ID to retrieve")
   },
   updateUser: {
-    user_id: z18.string().describe("The user ID to update"),
-    first_name: z18.string().optional().describe("New first name"),
-    last_name: z18.string().optional().describe("New last name"),
-    role: z18.enum(["admin", "member"]).optional().describe("New organization-level role")
+    user_id: z20.string().describe("The user ID to update"),
+    first_name: z20.string().optional().describe("New first name"),
+    last_name: z20.string().optional().describe("New last name"),
+    role: z20.enum(["admin", "member"]).optional().describe("New organization-level role")
   },
   deleteUser: {
-    user_id: z18.string().describe("The user ID to delete")
+    user_id: z20.string().describe("The user ID to delete")
   },
   listUserInvites: {
-    current_page: z18.coerce.number().positive().optional().describe("Page number for pagination"),
-    page_size: z18.coerce.number().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUserInvite: {
-    invite_id: z18.string().describe("The invite ID to retrieve")
+    invite_id: z20.string().describe("The invite ID to retrieve")
   },
   deleteUserInvite: {
-    invite_id: z18.string().describe("The invite ID to delete")
+    invite_id: z20.string().describe("The invite ID to delete")
   },
   resendUserInvite: {
-    invite_id: z18.string().describe("The invite ID to resend")
+    invite_id: z20.string().describe("The invite ID to resend")
   }
 };
 function formatUser(user) {
@@ -7178,59 +7695,59 @@ function registerUsersTools(server, service) {
 }
 
 // src/tools/workspaces.tools.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var WORKSPACES_TOOL_SCHEMAS = {
   listWorkspaces: {
-    page_size: z19.coerce.number().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
-    current_page: z19.coerce.number().positive().optional().describe("Page number to retrieve when results are paginated")
+    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
+    current_page: z21.coerce.number().int().positive().optional().describe("Page number to retrieve when results are paginated")
   },
   getWorkspace: {
-    workspace_id: z19.string().describe(
+    workspace_id: z21.string().describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
   createWorkspace: {
-    name: z19.string().describe("Name of the workspace"),
-    slug: z19.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
-    description: z19.string().optional().describe("Description of the workspace"),
-    is_default: z19.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z19.record(z19.string(), z19.string()).optional().describe("Custom metadata key-value pairs")
+    name: z21.string().describe("Name of the workspace"),
+    slug: z21.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
+    description: z21.string().optional().describe("Description of the workspace"),
+    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z21.record(z21.string(), z21.string()).optional().describe("Custom metadata key-value pairs")
   },
   updateWorkspace: {
-    workspace_id: z19.string().describe("The workspace ID to update"),
-    name: z19.string().optional().describe("New name for the workspace"),
-    slug: z19.string().optional().describe("New slug for the workspace"),
-    description: z19.string().optional().describe("New description"),
-    is_default: z19.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z19.record(z19.string(), z19.string()).optional().describe("New metadata key-value pairs")
+    workspace_id: z21.string().describe("The workspace ID to update"),
+    name: z21.string().optional().describe("New name for the workspace"),
+    slug: z21.string().optional().describe("New slug for the workspace"),
+    description: z21.string().optional().describe("New description"),
+    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z21.record(z21.string(), z21.string()).optional().describe("New metadata key-value pairs")
   },
   deleteWorkspace: {
-    workspace_id: z19.string().describe("The workspace ID to delete")
+    workspace_id: z21.string().describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID to add the member to"),
-    user_id: z19.string().uuid(
+    workspace_id: z21.string().describe("The workspace ID to add the member to"),
+    user_id: z21.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to add (must be a valid UUID from list_all_users, not an email address)"
     ),
-    role: z19.enum(["admin", "member", "manager"]).describe("Role in the workspace")
+    role: z21.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z19.string().describe("The workspace ID to list members for")
+    workspace_id: z21.string().describe("The workspace ID to list members for")
   },
   getWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to retrieve")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to retrieve")
   },
   updateWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to update"),
-    role: z19.enum(["admin", "member", "manager"]).describe("New role in the workspace")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to update"),
+    role: z21.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z19.string().describe("The workspace ID"),
-    user_id: z19.string().describe("The user ID to remove")
+    workspace_id: z21.string().describe("The workspace ID"),
+    user_id: z21.string().describe("The user ID to remove")
   }
 };
 function formatWorkspaceDefaults(defaults) {
@@ -7517,6 +8034,7 @@ var TOOL_DOMAIN_REGISTRARS = [
   ["tracing", registerTracingTools],
   ["logging", registerLoggingTools],
   ["providers", registerProvidersTools],
+  ["secret-references", registerSecretReferencesTools],
   ["integrations", registerIntegrationsTools],
   ["mcp-integrations", registerMcpIntegrationsTools],
   ["mcp-servers", registerMcpServersTools]
@@ -7639,13 +8157,81 @@ function getToolErrorMessage(error) {
   return String(error);
 }
 var STANDARD_TOOL_OUTPUT_SCHEMA = {
-  ok: z20.boolean().describe("Whether the tool call succeeded and returned structured data"),
-  data: z20.unknown().optional().describe("Structured success payload when ok is true"),
-  error: z20.object({
-    message: z20.string().describe("Human-readable error message"),
-    details: z20.unknown().optional().describe("Optional structured error details")
+  ok: z22.boolean().describe("Whether the tool call succeeded and returned structured data"),
+  data: z22.unknown().optional().describe("Structured success payload when ok is true"),
+  error: z22.object({
+    message: z22.string().describe("Human-readable error message"),
+    details: z22.unknown().optional().describe("Optional structured error details")
   }).optional().describe("Structured error payload when ok is false")
 };
+var TOOL_SUCCESS_DATA_SCHEMAS = {
+  rotate_api_key: z22.object({
+    message: z22.string().describe("Rotation confirmation"),
+    warning: z22.string().describe("Required handling guidance for the one-time secret"),
+    id: z22.string().uuid().describe("Rotated API key UUID"),
+    key: z22.string().describe("New API key secret, returned only once"),
+    key_transition_expires_at: z22.iso.datetime().describe("Time when the previous key stops working")
+  }),
+  create_secret_reference: z22.object({
+    message: z22.string().describe("Creation confirmation"),
+    id: z22.string().uuid().describe("New Secret Reference UUID"),
+    slug: z22.string().describe("New Secret Reference slug")
+  }),
+  list_secret_references: z22.object({
+    total: z22.number().int().nonnegative().describe("Total matching references"),
+    secret_references: z22.array(
+      z22.object({
+        id: z22.string().uuid().describe("Secret Reference UUID"),
+        name: z22.string().describe("Human-readable name"),
+        slug: z22.string().describe("Stable Secret Reference slug"),
+        manager_type: SecretManagerTypeSchema.describe(
+          "External secret manager type"
+        ),
+        status: z22.literal("ACTIVE").describe("Current reference status"),
+        created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
+        last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp")
+      })
+    ).describe(
+      "Current page of Secret References without authentication values"
+    )
+  }),
+  get_secret_reference: z22.object({
+    id: z22.string().uuid().describe("Secret Reference UUID"),
+    organisation_id: z22.string().uuid().describe("Owning organisation UUID"),
+    name: z22.string().describe("Human-readable name"),
+    slug: z22.string().describe("Stable Secret Reference slug"),
+    description: z22.string().nullable().describe("Reference description"),
+    manager_type: SecretManagerTypeSchema.describe(
+      "External secret manager type"
+    ),
+    secret_path: z22.string().describe("Path in the external secret manager"),
+    secret_key: z22.string().nullable().describe("Selected key within a structured secret"),
+    allow_all_workspaces: z22.boolean().describe("Whether all workspaces may use the reference"),
+    tags: z22.record(z22.string(), z22.string()).nullable().describe("String metadata tags"),
+    status: z22.literal("ACTIVE").describe("Current reference status"),
+    created_by: z22.string().describe("Creator identifier"),
+    created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
+    last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp"),
+    auth_config: z22.record(z22.string(), z22.unknown()).describe("Authentication configuration with sensitive values redacted"),
+    object: z22.literal("secret-reference").describe("Portkey object type")
+  }),
+  update_secret_reference: z22.object({
+    message: z22.string().describe("Update confirmation"),
+    success: z22.literal(true).describe("Whether the update succeeded")
+  }),
+  delete_secret_reference: z22.object({
+    message: z22.string().describe("Deletion confirmation"),
+    success: z22.literal(true).describe("Whether the deletion succeeded")
+  })
+};
+function getToolOutputSchema(toolName) {
+  const dataSchema = TOOL_SUCCESS_DATA_SCHEMAS[toolName];
+  if (!dataSchema) return STANDARD_TOOL_OUTPUT_SCHEMA;
+  return {
+    ...STANDARD_TOOL_OUTPUT_SCHEMA,
+    data: dataSchema.optional().describe("Structured success payload when ok is true")
+  };
+}
 function isStandardToolEnvelope(value) {
   if (!isRecord(value) || typeof value.ok !== "boolean") {
     return false;
@@ -7792,7 +8378,7 @@ function createSafeToolServer(server) {
         {
           ...registration.description ? { description: registration.description } : {},
           ...registration.inputSchema !== void 0 ? { inputSchema: registration.inputSchema } : {},
-          outputSchema: STANDARD_TOOL_OUTPUT_SCHEMA,
+          outputSchema: getToolOutputSchema(name),
           annotations: registration.annotations
         },
         registration.callback
@@ -7899,8 +8485,8 @@ function registerServerPromptsAndResources(server) {
       title: "Plan Portkey Admin Workflow",
       description: "Create a concise, safe plan for a Portkey Admin API task using this MCP server.",
       argsSchema: {
-        task: z21.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
-        area: z21.string().max(80).optional().describe(
+        task: z23.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
+        area: z23.string().max(80).optional().describe(
           "Optional Portkey area, such as prompts, analytics, configs, or users"
         )
       }
@@ -7952,6 +8538,25 @@ function parseConfiguredToolDomains(rawValue = process.env.PORTKEY_TOOL_DOMAINS?
   }
   return normalizeToolDomains(requestedDomains);
 }
+function resolveToolDomains(requestedDomains) {
+  const configuredDomains = parseConfiguredToolDomains();
+  if (!configuredDomains) {
+    return requestedDomains ? normalizeToolDomains(requestedDomains) : void 0;
+  }
+  if (!requestedDomains) {
+    return configuredDomains;
+  }
+  const configuredDomainSet = new Set(configuredDomains);
+  const disallowedDomains = normalizeToolDomains(requestedDomains).filter(
+    (domain) => !configuredDomainSet.has(domain)
+  );
+  if (disallowedDomains.length > 0) {
+    throw new Error(
+      `Requested tool domains are not allowed by PORTKEY_TOOL_DOMAINS: ${disallowedDomains.join(", ")}`
+    );
+  }
+  return normalizeToolDomains(requestedDomains);
+}
 function createMcpServer(options = {}) {
   const service = getSharedPortkeyService();
   const server = new McpServer(
@@ -7970,7 +8575,7 @@ function createMcpServer(options = {}) {
   );
   registerServerPromptsAndResources(server);
   registerAllTools(server, service, {
-    domains: options.toolDomains ?? parseConfiguredToolDomains()
+    domains: resolveToolDomains(options.toolDomains)
   });
   return {
     server,