portkey-admin-mcp 0.6.2 → 0.7.0

package/build/server.js

@@ -136,6 +136,7 @@ var Logger = {
 
 // src/services/base.service.ts
 var DEFAULT_BASE_URL = "https://api.portkey.ai/v1";
+var DEFAULT_PUBLIC_BASE_URL = "https://api.portkey.ai";
 var PRIVATE_BASE_URL_OVERRIDE_HINT = "Set PORTKEY_ALLOW_PRIVATE_BASE_URL=true to allow self-hosted gateways on loopback or private networks.";
 var INSECURE_HTTP_OVERRIDE_HINT = "Set PORTKEY_ALLOW_INSECURE_HTTP=true only for a trusted self-hosted gateway when TLS is unavailable.";
 function isPrivateOrLocalHost(hostname) {
@@ -230,14 +231,12 @@ var BaseService = class {
   encodePathSegment(value) {
     return encodeURIComponent(value);
   }
-  buildUrl(path, params) {
-    return `${this.baseUrl}${path}${buildQueryString(params)}`;
+  buildUrl(path, params, baseUrl = this.baseUrl) {
+    return `${baseUrl}${path}${buildQueryString(params)}`;
   }
-  buildHeaders(method) {
-    const headers = {
-      "x-portkey-api-key": this.apiKey,
-      Accept: "application/json"
-    };
+  buildHeaders(method, authenticate = true) {
+    const headers = { Accept: "application/json" };
+    if (authenticate) headers["x-portkey-api-key"] = this.apiKey;
     if (method === "POST" || method === "PUT") {
       headers["Content-Type"] = "application/json";
     }
@@ -248,7 +247,7 @@ var BaseService = class {
   }
   async executeRequest(method, path, options = {}) {
     const requestId = crypto.randomUUID();
-    const url = this.buildUrl(path, options.params);
+    const url = this.buildUrl(path, options.params, options.baseUrl);
     const startTime = Date.now();
     Logger.debug("HTTP request started", {
       requestId,
@@ -262,7 +261,7 @@ var BaseService = class {
       const response = await fetchWithTimeout(url, {
         method,
         redirect: "manual",
-        headers: this.buildHeaders(method),
+        headers: this.buildHeaders(method, options.authenticate),
         body: this.serializeBody(options.body),
         timeout: this.timeout
       });
@@ -307,14 +306,25 @@ var BaseService = class {
   async get(path, params) {
     return this.executeRequest("GET", path, { params });
   }
+  /** Read an unauthenticated Portkey public-catalog endpoint outside /v1. */
+  async getPublic(path, params) {
+    return this.executeRequest("GET", path, {
+      params,
+      baseUrl: DEFAULT_PUBLIC_BASE_URL,
+      authenticate: false
+    });
+  }
   async post(path, body) {
     return this.executeRequest("POST", path, { body });
   }
   async put(path, body) {
     return this.executeRequest("PUT", path, { body });
   }
-  async delete(path) {
-    return this.executeRequest("DELETE", path, { allowNoContent: true });
+  async delete(path, params) {
+    return this.executeRequest("DELETE", path, {
+      params,
+      allowNoContent: true
+    });
   }
 };
 
@@ -581,6 +591,33 @@ var ConfigsService = class extends BaseService {
 
 // src/services/guardrails.service.ts
 var GuardrailsService = class extends BaseService {
+  /** Get the organisation-wide input and output guardrail defaults. */
+  async getOrganisationDefaults() {
+    return this.get(
+      "/admin/organisation/defaults"
+    );
+  }
+  /** Replace either or both organisation-wide guardrail default lists. */
+  async updateOrganisationDefaults(data) {
+    return this.put(
+      "/admin/organisation/defaults",
+      data
+    );
+  }
+  /** List workspace exclusions for input or output organisation guardrails. */
+  async listWorkspaceExclusions(direction, params) {
+    return this.get(
+      `/workspace-exclusions/${direction}-guardrails`,
+      params
+    );
+  }
+  /** Update workspace exclusions for input or output organisation guardrails. */
+  async updateWorkspaceExclusions(direction, data) {
+    return this.put(
+      `/workspace-exclusions/${direction}-guardrails`,
+      data
+    );
+  }
   /**
    * List all guardrails with optional filtering
    */
@@ -667,6 +704,12 @@ var HealthService = class extends BaseService {
 
 // src/services/integrations.service.ts
 var IntegrationsService = class extends BaseService {
+  // Get current public catalog pricing (USD cents per token/unit).
+  async getModelPricing(provider, model) {
+    return this.getPublic(
+      `/model-configs/pricing/${this.encodePathSegment(provider)}/${this.encodePathSegment(model)}`
+    );
+  }
   // List all integrations
   async listIntegrations(params) {
     return this.get("/integrations", {
@@ -698,13 +741,16 @@ var IntegrationsService = class extends BaseService {
   }
   // List models for an integration
   async listIntegrationModels(slug, params) {
-    return this.get(
-      `/integrations/${this.encodePathSegment(slug)}/models`,
-      {
-        current_page: params?.current_page,
-        page_size: params?.page_size
-      }
-    );
+    const response = await this.get(`/integrations/${this.encodePathSegment(slug)}/models`, {
+      current_page: params?.current_page,
+      page_size: params?.page_size
+    });
+    const data = response.data ?? response.models ?? [];
+    return {
+      object: response.object ?? "list",
+      total: response.total ?? data.length,
+      data
+    };
   }
   // Update models for an integration
   async updateIntegrationModels(slug, data) {
@@ -723,13 +769,16 @@ var IntegrationsService = class extends BaseService {
   }
   // List workspaces for an integration
   async listIntegrationWorkspaces(slug, params) {
-    return this.get(
-      `/integrations/${this.encodePathSegment(slug)}/workspaces`,
-      {
-        current_page: params?.current_page,
-        page_size: params?.page_size
-      }
-    );
+    const response = await this.get(`/integrations/${this.encodePathSegment(slug)}/workspaces`, {
+      current_page: params?.current_page,
+      page_size: params?.page_size
+    });
+    const data = response.data ?? response.workspaces ?? [];
+    return {
+      object: response.object ?? "list",
+      total: response.total ?? data.length,
+      data
+    };
   }
   // Update workspaces for an integration
   async updateIntegrationWorkspaces(slug, data) {
@@ -930,6 +979,20 @@ var LimitsService = class extends BaseService {
 
 // src/services/logging.service.ts
 var LoggingService = class extends BaseService {
+  /** Get one gateway log by ID. */
+  async getLog(logId, params) {
+    return this.get(
+      `/logs/${this.encodePathSegment(logId)}`,
+      params
+    );
+  }
+  /** Get organisation-managed export field restrictions for a workspace. */
+  async getLogExportFieldRestrictions(params) {
+    return this.get(
+      "/logs/exports/field-restrictions",
+      params
+    );
+  }
   /**
    * Insert a log entry (or multiple entries) into Portkey
    */
@@ -1049,6 +1112,19 @@ var McpIntegrationsService = class extends BaseService {
 
 // src/services/mcp-servers.service.ts
 var McpServersService = class extends BaseService {
+  async listMcpServerConnections(id, params) {
+    return this.get(
+      `/mcp-servers/${this.encodePathSegment(id)}/connections`,
+      params
+    );
+  }
+  async disconnectMcpServerConnection(id, params) {
+    await this.delete(
+      `/mcp-servers/${this.encodePathSegment(id)}/connections`,
+      params
+    );
+    return { success: true };
+  }
   async listMcpServers(params) {
     return this.get("/mcp-servers", {
       current_page: params?.current_page,
@@ -1626,6 +1702,22 @@ var UsersService = class extends BaseService {
 
 // src/services/workspaces.service.ts
 var WorkspacesService = class extends BaseService {
+  async listScimWorkspaceMappings(params) {
+    return this.get(
+      "/scim/workspaces",
+      params
+    );
+  }
+  async createScimWorkspaceMapping(data) {
+    return this.post("/scim/workspaces", data);
+  }
+  async deleteScimWorkspaceMapping(mappingId) {
+    await this.delete(`/scim/workspaces/${this.encodePathSegment(mappingId)}`);
+    return { success: true };
+  }
+  async listScimGroups(params) {
+    return this.get("/scim/groups", params);
+  }
   async listWorkspaces(params) {
     return this.get("/admin/workspaces", params);
   }
@@ -1772,7 +1864,7 @@ function getSharedPortkeyService(apiKey) {
 }
 
 // src/tools/index.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // src/lib/type-guards.ts
 function isRecord(value) {
@@ -2701,6 +2793,12 @@ function registerCollectionsTools(server, service) {
 
 // src/tools/configs.tools.ts
 import { z as z5 } from "zod";
+var configTargetSchema = z5.object({
+  provider: z5.string().optional().describe("Provider slug to route requests to"),
+  virtual_key: z5.string().optional().describe("Virtual key slug to use for this routing target")
+}).refine((target) => target.provider || target.virtual_key, {
+  message: "Each target must have at least provider or virtual_key"
+});
 var CONFIGS_TOOL_SCHEMAS = {
   listConfigs: {
     current_page: z5.coerce.number().int().positive().optional().describe("Page number for pagination"),
@@ -2719,14 +2817,7 @@ var CONFIGS_TOOL_SCHEMAS = {
     retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
     retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on (e.g., [429, 500, 502, 503])"),
     strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy: 'loadbalance' or 'fallback'"),
-    targets: z5.array(
-      z5.object({
-        provider: z5.string().optional(),
-        virtual_key: z5.string().optional()
-      }).refine((t) => t.provider || t.virtual_key, {
-        message: "Each target must have at least provider or virtual_key"
-      })
-    ).optional().describe("Array of target providers with virtual keys")
+    targets: z5.array(configTargetSchema).optional().describe("Array of target providers with virtual keys")
   },
   updateConfig: {
     slug: z5.string().describe("Configuration slug to update"),
@@ -2737,14 +2828,7 @@ var CONFIGS_TOOL_SCHEMAS = {
     retry_attempts: z5.coerce.number().positive().max(5).optional().describe("Number of retry attempts (1-5)"),
     retry_on_status_codes: z5.array(z5.coerce.number()).optional().describe("HTTP status codes to retry on"),
     strategy_mode: z5.enum(["loadbalance", "fallback"]).optional().describe("Routing strategy"),
-    targets: z5.array(
-      z5.object({
-        provider: z5.string().optional(),
-        virtual_key: z5.string().optional()
-      }).refine((t) => t.provider || t.virtual_key, {
-        message: "Each target must have at least provider or virtual_key"
-      })
-    ).optional().describe("Array of target providers")
+    targets: z5.array(configTargetSchema).optional().describe("Array of target providers")
   },
   deleteConfig: {
     slug: z5.string().describe("Configuration slug to delete")
@@ -2759,12 +2843,7 @@ var configPayloadSchema = z5.object({
   retry_attempts: z5.coerce.number().positive().max(5).optional(),
   retry_on_status_codes: z5.array(z5.coerce.number()).optional(),
   strategy_mode: z5.enum(["loadbalance", "fallback"]).optional(),
-  targets: z5.array(
-    z5.object({
-      provider: z5.string().optional(),
-      virtual_key: z5.string().optional()
-    })
-  ).optional()
+  targets: z5.array(configTargetSchema).optional()
 });
 function buildConfigPayload(params) {
   const cache = params.cache_mode !== void 0 || params.cache_max_age !== void 0 ? {
@@ -2999,7 +3078,12 @@ var guardrailActionSchema = z6.object({
   on_fail_action: z6.string().optional().describe("Simple action on failure (e.g., 'block')"),
   message: z6.string().optional().describe("Message to return when guardrail triggers")
 });
+var workspaceGuardrailExclusionSchema = z6.object({
+  workspace_id: z6.string().describe("Workspace ID whose exclusion state changes"),
+  excluded: z6.boolean().describe("True to exclude this workspace; false to restore enforcement")
+});
 var GUARDRAILS_TOOL_SCHEMAS = {
+  getOrganisationDefaults: {},
   listGuardrails: {
     workspace_id: z6.string().optional().describe("Filter guardrails by workspace ID"),
     organisation_id: z6.string().optional().describe("Filter guardrails by organization ID"),
@@ -3026,9 +3110,157 @@ var GUARDRAILS_TOOL_SCHEMAS = {
   },
   deleteGuardrail: {
     guardrail_id: z6.string().describe("The guardrail UUID or slug to delete")
+  },
+  updateOrganisationDefaults: {
+    input_guardrails: z6.array(z6.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model input"),
+    output_guardrails: z6.array(z6.string()).optional().describe("Ordered guardrail IDs or slugs to enforce on model output")
+  },
+  listWorkspaceExclusions: {
+    organisation_id: z6.string().describe("Organisation ID whose workspace exclusions should be listed")
+  },
+  updateWorkspaceExclusions: {
+    organisation_id: z6.string().describe("Organisation ID whose workspace exclusions should be updated"),
+    workspaces: z6.array(workspaceGuardrailExclusionSchema).min(1).describe("Workspace exclusion states to apply"),
+    override_existing: z6.boolean().optional().describe("Replace existing exclusion states instead of merging changes")
   }
 };
+var GET_ORGANISATION_DEFAULTS_ANNOTATIONS = {
+  title: "Get Organisation Guardrail Defaults",
+  readOnlyHint: true,
+  destructiveHint: false,
+  idempotentHint: true,
+  openWorldHint: true
+};
 function registerGuardrailsTools(server, service) {
+  server.tool(
+    "get_organisation_defaults",
+    "Get the organisation-wide input and output guardrails that workspaces inherit by default. Use this before update_organisation_defaults or when auditing baseline enforcement; it does not include per-workspace exclusions, which are available from the directional exclusion list tools. Requires an organisation service API key with organisation_settings.read scope.",
+    GUARDRAILS_TOOL_SCHEMAS.getOrganisationDefaults,
+    GET_ORGANISATION_DEFAULTS_ANNOTATIONS,
+    async () => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.getOrganisationDefaults()
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "update_organisation_defaults",
+    "Replace the organisation-wide default input and/or output guardrail lists inherited by workspaces. Only supplied directions change, but enforcement updates immediately across non-excluded workspaces; inspect get_organisation_defaults and the directional workspace exclusions first. Repeating the same lists is safe. Requires an organisation service API key with organisation_settings.update scope.",
+    GUARDRAILS_TOOL_SCHEMAS.updateOrganisationDefaults,
+    {
+      title: "Update Organisation Guardrail Defaults",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.updateOrganisationDefaults(params)
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "list_input_guardrail_workspace_exclusions",
+    "List workspaces excluded from organisation-wide input guardrails for one organisation. Use this to audit exceptions or establish the current state before the matching update tool; it reads input exclusions only and does not return the organisation's default guardrail list. Requires an organisation service API key with organisation_exclusions.list scope.",
+    GUARDRAILS_TOOL_SCHEMAS.listWorkspaceExclusions,
+    {
+      title: "List Input Guardrail Workspace Exclusions",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.listWorkspaceExclusions("input", params)
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "update_input_guardrail_workspace_exclusions",
+    "Set workspace exclusions from organisation-wide input guardrails. Each entry excludes or restores one workspace; override_existing replaces prior states while the default merge behavior preserves unmentioned workspaces. Review the matching list tool first because enforcement changes immediately. Repeating the same states is safe. Requires an organisation service API key with organisation_exclusions.update scope.",
+    GUARDRAILS_TOOL_SCHEMAS.updateWorkspaceExclusions,
+    {
+      title: "Update Input Guardrail Workspace Exclusions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.updateWorkspaceExclusions("input", params)
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "list_output_guardrail_workspace_exclusions",
+    "List workspaces excluded from organisation-wide output guardrails for one organisation. Use this to audit exceptions or establish the current state before the matching update tool; it reads output exclusions only and does not return the organisation's default guardrail list. Requires an organisation service API key with organisation_exclusions.list scope.",
+    GUARDRAILS_TOOL_SCHEMAS.listWorkspaceExclusions,
+    {
+      title: "List Output Guardrail Workspace Exclusions",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.listWorkspaceExclusions("output", params)
+          )
+        }
+      ]
+    })
+  );
+  server.tool(
+    "update_output_guardrail_workspace_exclusions",
+    "Set workspace exclusions from organisation-wide output guardrails. Each entry excludes or restores one workspace; override_existing replaces prior states while the default merge behavior preserves unmentioned workspaces. Review the matching list tool first because enforcement changes immediately. Repeating the same states is safe. Requires an organisation service API key with organisation_exclusions.update scope.",
+    GUARDRAILS_TOOL_SCHEMAS.updateWorkspaceExclusions,
+    {
+      title: "Update Output Guardrail Workspace Exclusions",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.guardrails.updateWorkspaceExclusions(
+              "output",
+              params
+            )
+          )
+        }
+      ]
+    })
+  );
   server.tool(
     "list_guardrails",
     "List guardrails in the org with id, slug, status, ownership, and optional workspace/org filters. Use this to find IDs and slugs before get_guardrail, update_guardrail, or delete_guardrail.",
@@ -3175,7 +3407,7 @@ function registerGuardrailsTools(server, service) {
 }
 
 // src/tools/integrations.tools.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/lib/limits.ts
 var PERIODIC_RESET_DEFAULT = "monthly";
@@ -3217,96 +3449,257 @@ function buildRateLimits(params) {
   ];
 }
 
+// src/tools/secret-mapping.schemas.ts
+import { z as z7 } from "zod";
+function createSecretMappingSchema({
+  allowKeyTarget,
+  targetFieldDescription,
+  secretReferenceDescription,
+  valueFormatDescription
+}) {
+  return z7.object({
+    target_field: z7.string().refine(
+      (value) => allowKeyTarget && value === "key" || value.startsWith("configurations."),
+      allowKeyTarget ? "target_field must be 'key' or start with 'configurations.'" : "target_field must start with 'configurations.'"
+    ).describe(targetFieldDescription),
+    secret_reference_id: z7.string().describe(secretReferenceDescription),
+    secret_key: z7.string().nullable().optional().describe("Optional key to select from a multi-value secret"),
+    value_format: z7.enum(["string", "json"]).nullable().optional().describe(valueFormatDescription)
+  });
+}
+function uniqueSecretMappingsSchema(itemSchema) {
+  return z7.array(itemSchema).superRefine((mappings, context) => {
+    const firstIndexByTarget = /* @__PURE__ */ new Map();
+    for (const [index, mapping] of mappings.entries()) {
+      const firstIndex = firstIndexByTarget.get(mapping.target_field);
+      if (firstIndex !== void 0) {
+        context.addIssue({
+          code: "custom",
+          path: [index, "target_field"],
+          message: `target_field must be unique; also used at index ${firstIndex}`
+        });
+      } else {
+        firstIndexByTarget.set(mapping.target_field, index);
+      }
+    }
+  });
+}
+
 // src/tools/integrations.tools.ts
+var integrationSecretMappingSchema = createSecretMappingSchema({
+  allowKeyTarget: true,
+  targetFieldDescription: "Integration field populated at runtime: key or configurations.<field>",
+  secretReferenceDescription: "Secret Reference UUID or slug accessible to the workspace",
+  valueFormatDescription: "Treat the resolved value as a plain string or parsed JSON"
+});
+var integrationSecretMappingsSchema = uniqueSecretMappingsSchema(
+  integrationSecretMappingSchema
+);
+var nullableMultiplier = (description) => z8.coerce.number().nonnegative().nullable().optional().describe(description);
+var pricingMultiplierSchema = z8.object({
+  default: nullableMultiplier(
+    "Fallback multiplier for pricing units; 1 is unchanged, 0.8 is a 20% discount"
+  ),
+  request_token: nullableMultiplier("Input token price multiplier"),
+  response_token: nullableMultiplier("Output token price multiplier"),
+  cache_read_input_token: nullableMultiplier(
+    "Cache-read input token price multiplier"
+  ),
+  cache_write_input_token: nullableMultiplier(
+    "Cache-write input token price multiplier"
+  ),
+  cache_read_audio_input_token: nullableMultiplier(
+    "Cache-read audio input token price multiplier"
+  ),
+  request_audio_token: nullableMultiplier("Audio input token price multiplier"),
+  response_audio_token: nullableMultiplier(
+    "Audio output token price multiplier"
+  ),
+  reasoning_token: nullableMultiplier("Reasoning token price multiplier"),
+  prediction_accepted_token: nullableMultiplier(
+    "Accepted predicted-output token price multiplier"
+  ),
+  prediction_rejected_token: nullableMultiplier(
+    "Rejected predicted-output token price multiplier"
+  ),
+  request_image_token: nullableMultiplier("Image input token price multiplier"),
+  response_image_token: nullableMultiplier(
+    "Image output token price multiplier"
+  ),
+  request_text_token: nullableMultiplier("Text input token price multiplier"),
+  response_text_token: nullableMultiplier("Text output token price multiplier"),
+  cache_read_image_input_token: nullableMultiplier(
+    "Cache-read image input token price multiplier"
+  ),
+  cache_read_text_input_token: nullableMultiplier(
+    "Cache-read text input token price multiplier"
+  ),
+  cache_write_text_input_token: nullableMultiplier(
+    "Cache-write text input token price multiplier"
+  ),
+  cache_write_image_input_token: nullableMultiplier(
+    "Cache-write image input token price multiplier"
+  ),
+  image: z8.object({
+    default: nullableMultiplier("Default image-generation price multiplier")
+  }).nullable().optional().describe("Image-generation pricing multipliers"),
+  additional_units: z8.record(z8.string(), z8.coerce.number().nonnegative().nullable()).nullable().optional().describe(
+    "Multipliers keyed by Portkey pricing unit, such as web_search or file_search"
+  )
+});
+var pricingAdjustmentsSchema = z8.object({
+  multiplier: pricingMultiplierSchema.optional().describe("Per-unit multipliers applied over Portkey catalog pricing")
+}).nullable();
+var modelConfigurationsSchema = z8.object({
+  custom_host: z8.string().url().optional().describe("Custom upstream URL used only for this model"),
+  custom_headers: z8.record(z8.string(), z8.string()).optional().describe("Headers sent only for this model; values may contain secrets")
+});
+var tokenPricingSchema = z8.object({
+  price: z8.coerce.number().nonnegative().describe("Static price per token in the integration pricing unit")
+});
+var integrationModelPricingSchema = z8.object({
+  type: z8.literal("static").describe("Static per-token pricing configuration"),
+  pay_as_you_go: z8.object({
+    request_token: tokenPricingSchema.optional().describe("Input token pricing"),
+    response_token: tokenPricingSchema.optional().describe("Output token pricing")
+  }).optional().describe("Pay-as-you-go rates for this integration model")
+});
 var INTEGRATIONS_TOOL_SCHEMAS = {
+  getModelPricing: {
+    provider: z8.string().describe(
+      "Lowercase Portkey provider identifier, such as openai, anthropic, bedrock, or x-ai"
+    ),
+    model: z8.string().describe("Exact provider model identifier, such as gpt-4o")
+  },
   listIntegrations: {
-    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
-    workspace_id: z7.string().optional().describe("Filter integrations accessible by a specific workspace"),
-    type: z7.enum(["workspace", "organisation", "all"]).optional().describe(
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (default 100, max 100)"),
+    workspace_id: z8.string().optional().describe("Filter integrations accessible by a specific workspace"),
+    type: z8.enum(["workspace", "organisation", "all"]).optional().describe(
       "Filter by integration type: 'workspace', 'organisation', or 'all' (default)"
     )
   },
   createIntegration: {
-    name: z7.string().describe("Human-readable name for the integration"),
-    ai_provider_id: z7.string().describe(
+    name: z8.string().describe("Human-readable name for the integration"),
+    ai_provider_id: z8.string().describe(
       "ID of the AI provider (e.g., 'openai', 'anthropic', 'azure-openai', 'aws-bedrock', 'vertex-ai')"
     ),
-    slug: z7.string().optional().describe(
+    slug: z8.string().optional().describe(
       "URL-friendly identifier (auto-generated from name if not provided)"
     ),
-    key: z7.string().optional().describe("API key for the provider (if required)"),
-    description: z7.string().optional().describe("Optional description of the integration"),
-    workspace_id: z7.string().optional().describe("Workspace ID for workspace-scoped integrations"),
-    api_version: z7.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z7.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z7.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    aws_region: z7.string().optional().describe("AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z7.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z7.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z7.string().optional().describe("GCP project ID (for Vertex AI)"),
-    vertex_region: z7.string().optional().describe("GCP region (for Vertex AI)"),
-    custom_host: z7.string().optional().describe("Custom base URL for the provider")
+    key: z8.string().optional().describe("API key for the provider (if required)"),
+    description: z8.string().optional().describe("Optional description of the integration"),
+    workspace_id: z8.string().optional().describe("Workspace ID for workspace-scoped integrations"),
+    api_version: z8.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z8.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z8.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    aws_region: z8.string().optional().describe("AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z8.string().optional().describe("AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z8.string().optional().describe("AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z8.string().optional().describe("GCP project ID (for Vertex AI)"),
+    vertex_region: z8.string().optional().describe("GCP region (for Vertex AI)"),
+    custom_host: z8.string().optional().describe("Custom base URL for the provider"),
+    create_default_provider: z8.boolean().optional().describe(
+      "Create a provider automatically for a workspace-scoped integration; defaults to true"
+    ),
+    default_provider_slug: z8.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe("Custom slug for the automatically created workspace provider"),
+    secret_mappings: integrationSecretMappingsSchema.optional().describe(
+      "Unique runtime Secret Reference mappings; mapping key allows the key field to be omitted"
+    ),
+    pricing_adjustments: pricingAdjustmentsSchema.optional().describe(
+      "Negotiated discount or markup multipliers for cost accounting"
+    )
   },
   getIntegration: {
-    slug: z7.string().describe("The unique slug identifier of the integration to retrieve")
+    slug: z8.string().describe("The unique slug identifier of the integration to retrieve")
   },
   updateIntegration: {
-    slug: z7.string().describe("The slug of the integration to update"),
-    name: z7.string().optional().describe("New human-readable name for the integration"),
-    key: z7.string().optional().describe("New API key for the provider"),
-    description: z7.string().optional().describe("New description for the integration"),
-    api_version: z7.string().optional().describe("New API version (for Azure OpenAI)"),
-    resource_name: z7.string().optional().describe("New resource name (for Azure OpenAI)"),
-    deployment_name: z7.string().optional().describe("New deployment name (for Azure OpenAI)"),
-    aws_region: z7.string().optional().describe("New AWS region (for AWS Bedrock)"),
-    aws_access_key_id: z7.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
-    aws_secret_access_key: z7.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
-    vertex_project_id: z7.string().optional().describe("New GCP project ID (for Vertex AI)"),
-    vertex_region: z7.string().optional().describe("New GCP region (for Vertex AI)"),
-    custom_host: z7.string().optional().describe("New custom base URL for the provider")
+    slug: z8.string().describe("The slug of the integration to update"),
+    name: z8.string().optional().describe("New human-readable name for the integration"),
+    key: z8.string().optional().describe("New API key for the provider"),
+    description: z8.string().optional().describe("New description for the integration"),
+    api_version: z8.string().optional().describe("New API version (for Azure OpenAI)"),
+    resource_name: z8.string().optional().describe("New resource name (for Azure OpenAI)"),
+    deployment_name: z8.string().optional().describe("New deployment name (for Azure OpenAI)"),
+    aws_region: z8.string().optional().describe("New AWS region (for AWS Bedrock)"),
+    aws_access_key_id: z8.string().optional().describe("New AWS access key ID (for AWS Bedrock)"),
+    aws_secret_access_key: z8.string().optional().describe("New AWS secret access key (for AWS Bedrock)"),
+    vertex_project_id: z8.string().optional().describe("New GCP project ID (for Vertex AI)"),
+    vertex_region: z8.string().optional().describe("New GCP region (for Vertex AI)"),
+    custom_host: z8.string().optional().describe("New custom base URL for the provider"),
+    secret_mappings: integrationSecretMappingsSchema.optional().describe(
+      "Replacement runtime Secret Reference mappings; each target_field must be unique"
+    ),
+    pricing_adjustments: pricingAdjustmentsSchema.optional().describe(
+      "Replacement cost multiplier configuration, or null to clear adjustments"
+    )
   },
   deleteIntegration: {
-    slug: z7.string().describe("The slug of the integration to delete")
+    slug: z8.string().describe("The slug of the integration to delete")
   },
   listIntegrationModels: {
-    slug: z7.string().describe("The slug of the integration"),
-    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z8.string().describe("The slug of the integration"),
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationModels: {
-    slug: z7.string().describe("The slug of the integration"),
-    models: z7.array(
-      z7.object({
-        slug: z7.string().describe("The model slug identifier"),
-        model_name: z7.string().optional().describe(
+    slug: z8.string().describe("The slug of the integration"),
+    allow_all_models: z8.boolean().optional().describe(
+      "Whether newly available provider models are enabled by default"
+    ),
+    models: z8.array(
+      z8.object({
+        slug: z8.string().describe("The model slug identifier"),
+        model_name: z8.string().optional().describe(
           "Display name for the model (required for custom models)"
         ),
-        enabled: z7.boolean().describe("Whether the model is enabled"),
-        is_custom: z7.boolean().optional().describe("Whether this is a custom model (default: false)")
+        enabled: z8.boolean().describe("Whether the model is enabled"),
+        is_custom: z8.boolean().optional().describe("Whether this is a custom model (default: false)"),
+        is_finetune: z8.boolean().optional().describe("Whether this entry is a fine-tuned model"),
+        base_model_slug: z8.string().optional().describe("Base model slug for a fine-tuned model"),
+        configurations: modelConfigurationsSchema.optional().describe("Per-model custom upstream host and headers"),
+        pricing_config: integrationModelPricingSchema.optional().describe("Static custom pricing for this integration model")
       })
     ).describe("Array of model configurations to update")
   },
   deleteIntegrationModel: {
-    slug: z7.string().describe("The slug of the integration"),
-    model_slug: z7.string().describe("The slug of the model to delete")
+    slug: z8.string().describe("The slug of the integration"),
+    model_slug: z8.string().describe("The slug of the model to delete")
   },
   listIntegrationWorkspaces: {
-    slug: z7.string().describe("The slug of the integration"),
-    current_page: z7.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z7.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
+    slug: z8.string().describe("The slug of the integration"),
+    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page")
   },
   updateIntegrationWorkspaces: {
-    slug: z7.string().describe("The slug of the integration"),
-    workspaces: z7.array(
-      z7.object({
-        id: z7.string().describe("The workspace ID"),
-        enabled: z7.boolean().describe("Whether the workspace has access to this integration"),
-        credit_limit: z7.coerce.number().positive().optional().describe("Credit limit for this workspace"),
-        alert_threshold: z7.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-        rate_limit_rpm: z7.coerce.number().positive().optional().describe("Rate limit in requests per minute")
+    slug: z8.string().describe("The slug of the integration"),
+    workspaces: z8.array(
+      z8.object({
+        id: z8.string().describe("The workspace ID"),
+        enabled: z8.boolean().describe("Whether the workspace has access to this integration"),
+        credit_limit: z8.coerce.number().positive().optional().describe("Credit limit for this workspace"),
+        alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+        rate_limit_rpm: z8.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+        reset_usage: z8.boolean().optional().describe("Reset exhausted usage status to active"),
+        create_default_provider: z8.boolean().optional().describe(
+          "Override whether a provider is auto-created for this workspace"
+        ),
+        default_provider_slug: z8.string().optional().describe(
+          "Override the auto-created provider slug for this workspace"
+        )
       })
-    ).describe("Array of workspace configurations to update")
+    ).describe("Array of workspace configurations to update"),
+    global_workspace_access_enabled: z8.boolean().optional().describe(
+      "Enable or disable access for all current and future workspaces"
+    ),
+    global_credit_limit: z8.coerce.number().positive().optional().describe(
+      "Global cost credit limit applied with global workspace access"
+    ),
+    global_alert_threshold: z8.coerce.number().nonnegative().max(100).optional().describe("Global cost alert threshold applied to workspace access"),
+    global_rate_limit_rpm: z8.coerce.number().positive().optional().describe("Global requests-per-minute limit for workspace access"),
+    override_existing_workspace_access: z8.boolean().optional().describe("Apply global settings over existing per-workspace access"),
+    create_default_provider: z8.boolean().optional().describe("Auto-create providers when granting workspace access"),
+    default_provider_slug: z8.string().optional().describe("Default slug for providers auto-created in workspaces")
   }
 };
 function buildIntegrationConfigurations(params) {
@@ -3332,6 +3725,31 @@ function buildIntegrationConfigurations(params) {
   return Object.keys(configurations).length > 0 ? configurations : void 0;
 }
 function registerIntegrationsTools(server, service) {
+  server.tool(
+    "get_model_pricing",
+    "Get Portkey's current public pricing configuration for one exact provider/model pair. Prices are returned in USD cents per token or provider-specific unit and may include cache, audio, image, fine-tuning, and calculation metadata. Use this read-only catalog lookup before setting integration pricing_adjustments or custom-model pricing; it does not return your negotiated integration multiplier or require Portkey authentication.",
+    INTEGRATIONS_TOOL_SCHEMAS.getModelPricing,
+    {
+      title: "Get Model Pricing",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.integrations.getModelPricing(
+              params.provider,
+              params.model
+            )
+          )
+        }
+      ]
+    })
+  );
   server.tool(
     "list_integrations",
     "List org-level AI provider connections with optional workspace or type filters. Use this to find integration slugs before model or workspace updates. Returns total plus id, name, slug, provider, status, description, workspace counts, and config summary.",
@@ -3368,13 +3786,14 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "create_integration",
-    "Create an org-level provider integration that stores an AI provider's API key and becomes the source workspace providers (create_provider) build on. ai_provider_id takes a provider identifier such as 'openai' or 'anthropic'; some backends (azure-openai, aws-bedrock, vertex-ai) need provider-specific fields, and the key is write-only afterwards (get_integration shows it masked). Provision models and workspace access afterwards with update_integration_models and update_integration_workspaces. Returns the new integration id and slug.",
+    "Create an AI-provider integration that becomes the source for workspace providers. ai_provider_id identifies the backend; provider-specific fields configure Azure, Bedrock, Vertex, or custom hosts. For workspace-scoped integrations, create_default_provider controls automatic provider creation. key is write-only, but secret_mappings can resolve it or configuration fields from Secret References at runtime. pricing_adjustments apply negotiated discounts or markups to cost accounting. Use update_integration_models and update_integration_workspaces after creation; returns the new integration id and slug.",
     INTEGRATIONS_TOOL_SCHEMAS.createIntegration,
     {
+      title: "Create AI Provider Integration",
       readOnlyHint: false,
       destructiveHint: false,
       idempotentHint: false,
-      openWorldHint: false
+      openWorldHint: true
     },
     async (params) => {
       const result = await service.integrations.createIntegration({
@@ -3384,7 +3803,11 @@ function registerIntegrationsTools(server, service) {
         key: params.key,
         description: params.description,
         workspace_id: params.workspace_id,
-        configurations: buildIntegrationConfigurations(params)
+        configurations: buildIntegrationConfigurations(params),
+        ...params.create_default_provider !== void 0 ? { create_default_provider: params.create_default_provider } : {},
+        ...params.default_provider_slug !== void 0 ? { default_provider_slug: params.default_provider_slug } : {},
+        ...params.secret_mappings !== void 0 ? { secret_mappings: params.secret_mappings } : {},
+        ...params.pricing_adjustments !== void 0 ? { pricing_adjustments: params.pricing_adjustments } : {}
       });
       return {
         content: [
@@ -3425,6 +3848,8 @@ function registerIntegrationsTools(server, service) {
               global_workspace_access_settings: integration.global_workspace_access_settings,
               allow_all_models: integration.allow_all_models,
               workspace_count: integration.workspace_count,
+              secret_mappings: integration.secret_mappings,
+              pricing_adjustments: integration.pricing_adjustments,
               created_at: integration.created_at,
               last_updated_at: integration.last_updated_at
             })
@@ -3435,20 +3860,23 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "update_integration",
-    "Update an org-level integration's name, description, API key, or provider-specific config by slug. Only provided fields change and the update is in place (no version history); key and config changes take effect immediately and can disrupt dependent providers or live requests, so review current settings with get_integration first. Get the slug from list_integrations; model provisioning and workspace access are managed separately via update_integration_models and update_integration_workspaces. Returns a success flag.",
+    "Update an integration's name, description, API key, provider config, Secret Reference mappings, or pricing adjustments by slug. Only provided fields change; key, secret mapping, and config changes take effect immediately and can disrupt dependent providers or live requests, while pricing multipliers change cost analytics and budget accounting. Review get_integration first. Model availability and workspace access remain separate in update_integration_models and update_integration_workspaces.",
     INTEGRATIONS_TOOL_SCHEMAS.updateIntegration,
     {
+      title: "Update AI Provider Integration",
       readOnlyHint: false,
       destructiveHint: true,
       idempotentHint: true,
-      openWorldHint: false
+      openWorldHint: true
     },
     async (params) => {
       const result = await service.integrations.updateIntegration(params.slug, {
         name: params.name,
         key: params.key,
         description: params.description,
-        configurations: buildIntegrationConfigurations(params)
+        configurations: buildIntegrationConfigurations(params),
+        secret_mappings: params.secret_mappings,
+        pricing_adjustments: params.pricing_adjustments
       });
       return {
         content: [
@@ -3503,10 +3931,14 @@ function registerIntegrationsTools(server, service) {
               integration_slug: params.slug,
               models: models.data.map((model) => ({
                 id: model.id,
-                model_id: model.model_id,
-                model_name: model.model_name,
+                slug: model.slug ?? model.model_id,
+                name: model.name ?? model.model_name,
                 enabled: model.enabled,
-                custom: model.custom,
+                is_custom: model.is_custom ?? model.custom,
+                is_finetune: model.is_finetune,
+                base_model_slug: model.base_model_slug,
+                configurations: model.configurations,
+                pricing_config: model.pricing_config,
                 created_at: model.created_at,
                 last_updated_at: model.last_updated_at
               }))
@@ -3518,13 +3950,21 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "update_integration_models",
-    "Enable, disable, or register custom models for an integration. This changes model availability for every workspace using it, so confirm the downstream impact first. Returns success and the number of models updated.",
+    "Bulk enable or disable integration models, register custom or fine-tuned models, set per-model hosts and headers, and attach static token pricing. allow_all_models controls whether future provider models start enabled. These changes affect every workspace using the integration; inspect list_integration_models first and use get_model_pricing when deriving custom rates. Returns success and the number of models updated.",
     INTEGRATIONS_TOOL_SCHEMAS.updateIntegrationModels,
+    {
+      title: "Update Integration Models",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     async (params) => {
       const result = await service.integrations.updateIntegrationModels(
         params.slug,
         {
-          models: params.models
+          models: params.models,
+          allow_all_models: params.allow_all_models
         }
       );
       return {
@@ -3584,7 +4024,7 @@ function registerIntegrationsTools(server, service) {
               integration_slug: params.slug,
               workspaces: workspaces.data.map((ws) => ({
                 id: ws.id,
-                workspace_id: ws.workspace_id,
+                workspace_id: ws.workspace_id ?? ws.id,
                 workspace_name: ws.workspace_name,
                 enabled: ws.enabled,
                 usage_limits: ws.usage_limits,
@@ -3600,9 +4040,41 @@ function registerIntegrationsTools(server, service) {
   );
   server.tool(
     "update_integration_workspaces",
-    "Control which workspaces can use an integration and set per-workspace limits, unlike update_integration which edits the org-level connection. Call list_integration_workspaces first to review current state; access changes and new limits apply to downstream usage immediately, and the call returns success plus the number of workspaces updated.",
+    "Control per-workspace and global access to an integration, including cost/rate limits, usage resets, and automatic default-provider creation. global_workspace_access_enabled affects current and future workspaces; override_existing_workspace_access determines whether it replaces explicit workspace settings. Per-workspace default-provider fields override top-level values. Review list_integration_workspaces first because access and limits change downstream usage immediately.",
     INTEGRATIONS_TOOL_SCHEMAS.updateIntegrationWorkspaces,
+    {
+      title: "Update Integration Workspace Access",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     async (params) => {
+      const hasGlobalLimits = params.global_credit_limit !== void 0 || params.global_alert_threshold !== void 0 || params.global_rate_limit_rpm !== void 0;
+      if (hasGlobalLimits && params.global_workspace_access_enabled === void 0) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: "global_workspace_access_enabled is required when setting global limits."
+            }
+          ],
+          isError: true
+        };
+      }
+      const globalUsageLimits = params.global_credit_limit !== void 0 || params.global_alert_threshold !== void 0 ? [
+        {
+          type: "cost",
+          credit_limit: params.global_credit_limit,
+          alert_threshold: params.global_alert_threshold
+        }
+      ] : void 0;
+      const globalRateLimits = buildRateLimitsRpm(params.global_rate_limit_rpm);
+      const globalWorkspaceAccess = params.global_workspace_access_enabled !== void 0 ? {
+        enabled: params.global_workspace_access_enabled,
+        usage_limits: globalUsageLimits,
+        rate_limits: globalRateLimits
+      } : void 0;
       const result = await service.integrations.updateIntegrationWorkspaces(
         params.slug,
         {
@@ -3615,9 +4087,16 @@ function registerIntegrationsTools(server, service) {
               id: ws.id,
               enabled: ws.enabled,
               usage_limits: usageLimits ? [usageLimits] : void 0,
-              rate_limits: buildRateLimitsRpm(ws.rate_limit_rpm)
+              rate_limits: buildRateLimitsRpm(ws.rate_limit_rpm),
+              reset_usage: ws.reset_usage,
+              create_default_provider: ws.create_default_provider,
+              default_provider_slug: ws.default_provider_slug
             };
-          })
+          }),
+          global_workspace_access: globalWorkspaceAccess,
+          override_existing_workspace_access: params.override_existing_workspace_access,
+          create_default_provider: params.create_default_provider,
+          default_provider_slug: params.default_provider_slug
         }
       );
       return {
@@ -3637,110 +4116,110 @@ function registerIntegrationsTools(server, service) {
 }
 
 // src/tools/keys.tools.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var KEYS_TOOL_SCHEMAS = {
   listVirtualKeys: {
-    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z9.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z9.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   createVirtualKey: {
-    name: z8.string().describe("Display name for the virtual key"),
-    provider: z8.string().describe(
+    name: z9.string().describe("Display name for the virtual key"),
+    provider: z9.string().describe(
       "Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')"
     ),
-    key: z8.string().describe("The actual provider API key to store"),
-    note: z8.string().optional().describe("Optional note or description for this key"),
-    workspace_id: z8.string().optional().describe("Workspace ID to create the key in"),
-    api_version: z8.string().optional().describe("API version (for Azure OpenAI)"),
-    resource_name: z8.string().optional().describe("Resource name (for Azure OpenAI)"),
-    deployment_name: z8.string().optional().describe("Deployment name (for Azure OpenAI)"),
-    credit_limit: z8.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
-    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe(
+    key: z9.string().describe("The actual provider API key to store"),
+    note: z9.string().optional().describe("Optional note or description for this key"),
+    workspace_id: z9.string().optional().describe("Workspace ID to create the key in"),
+    api_version: z9.string().optional().describe("API version (for Azure OpenAI)"),
+    resource_name: z9.string().optional().describe("Resource name (for Azure OpenAI)"),
+    deployment_name: z9.string().optional().describe("Deployment name (for Azure OpenAI)"),
+    credit_limit: z9.coerce.number().positive().optional().describe("Maximum usage cost threshold"),
+    alert_threshold: z9.coerce.number().min(0).max(100).optional().describe(
       "Percentage of credit_limit at which to send alert emails (0-100)"
     ),
-    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Requests per minute limit")
+    rate_limit_rpm: z9.coerce.number().positive().optional().describe("Requests per minute limit")
   },
   getVirtualKey: {
-    slug: z8.string().describe("The unique slug identifier of the virtual key to retrieve")
+    slug: z9.string().describe("The unique slug identifier of the virtual key to retrieve")
   },
   updateVirtualKey: {
-    slug: z8.string().describe("The slug of the virtual key to update"),
-    name: z8.string().optional().describe("New display name for the key"),
-    key: z8.string().optional().describe("New provider API key value"),
-    note: z8.string().optional().describe("New note or description"),
-    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute")
+    slug: z9.string().describe("The slug of the virtual key to update"),
+    name: z9.string().optional().describe("New display name for the key"),
+    key: z9.string().optional().describe("New provider API key value"),
+    note: z9.string().optional().describe("New note or description"),
+    credit_limit: z9.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z9.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z9.coerce.number().positive().optional().describe("New rate limit in requests per minute")
   },
   deleteVirtualKey: {
-    slug: z8.string().describe("The slug of the virtual key to delete")
+    slug: z9.string().describe("The slug of the virtual key to delete")
   },
   createApiKey: {
-    type: z8.enum(["organisation", "workspace"]).describe(
+    type: z9.enum(["organisation", "workspace"]).describe(
       "Key type: 'organisation' for org-wide access or 'workspace' for workspace-scoped"
     ),
-    sub_type: z8.enum(["user", "service"]).describe(
+    sub_type: z9.enum(["user", "service"]).describe(
       "Sub-type: 'user' for user-associated keys or 'service' for service accounts"
     ),
-    name: z8.string().describe("Display name for the API key"),
-    description: z8.string().optional().describe("Optional description for the key"),
-    workspace_id: z8.string().optional().describe("Workspace ID (required for workspace-type keys)"),
-    user_id: z8.string().optional().describe("User ID (required for user sub-type keys)"),
-    scopes: z8.array(z8.string()).describe(
+    name: z9.string().describe("Display name for the API key"),
+    description: z9.string().optional().describe("Optional description for the key"),
+    workspace_id: z9.string().optional().describe("Workspace ID (required for workspace-type keys)"),
+    user_id: z9.string().optional().describe("User ID (required for user sub-type keys)"),
+    scopes: z9.array(z9.string()).describe(
       "Permission scopes for the key (e.g., ['logs.read', 'analytics.read'])"
     ),
-    credit_limit: z8.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    rate_limit_rpm: z8.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
-    default_config_id: z8.string().optional().describe("Default configuration ID to use with this key"),
-    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("Default metadata key-value pairs"),
-    alert_emails: z8.array(z8.string()).optional().describe("Email addresses for alerts"),
-    expires_at: z8.string().optional().describe("Expiration date in ISO 8601 format")
+    credit_limit: z9.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z9.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    rate_limit_rpm: z9.coerce.number().positive().optional().describe("Rate limit in requests per minute"),
+    default_config_id: z9.string().optional().describe("Default configuration ID to use with this key"),
+    default_metadata: z9.record(z9.string(), z9.string()).optional().describe("Default metadata key-value pairs"),
+    alert_emails: z9.array(z9.string()).optional().describe("Email addresses for alerts"),
+    expires_at: z9.string().optional().describe("Expiration date in ISO 8601 format")
   },
   listApiKeys: {
-    page_size: z8.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    current_page: z8.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    workspace_id: z8.string().optional().describe("Filter by workspace ID")
+    page_size: z9.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    current_page: z9.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    workspace_id: z9.string().optional().describe("Filter by workspace ID")
   },
   getApiKey: {
-    id: z8.string().uuid().describe("The UUID of the API key to retrieve")
+    id: z9.string().uuid().describe("The UUID of the API key to retrieve")
   },
   updateApiKey: {
-    id: z8.string().uuid().describe("The UUID of the API key to update"),
-    name: z8.string().optional().describe("New display name for the key"),
-    description: z8.string().optional().describe("New description for the key"),
-    scopes: z8.array(z8.string()).optional().describe("New permission scopes for the key"),
-    credit_limit: z8.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z8.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    rate_limit_rpm: z8.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
-    default_config_id: z8.string().optional().describe("New default configuration ID"),
-    default_metadata: z8.record(z8.string(), z8.string()).optional().describe("New default metadata key-value pairs"),
-    alert_emails: z8.array(z8.string()).optional().describe("New email addresses for alerts"),
-    expires_at: z8.string().nullable().optional().describe(
+    id: z9.string().uuid().describe("The UUID of the API key to update"),
+    name: z9.string().optional().describe("New display name for the key"),
+    description: z9.string().optional().describe("New description for the key"),
+    scopes: z9.array(z9.string()).optional().describe("New permission scopes for the key"),
+    credit_limit: z9.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z9.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    rate_limit_rpm: z9.coerce.number().positive().optional().describe("New rate limit in requests per minute"),
+    default_config_id: z9.string().optional().describe("New default configuration ID"),
+    default_metadata: z9.record(z9.string(), z9.string()).optional().describe("New default metadata key-value pairs"),
+    alert_emails: z9.array(z9.string()).optional().describe("New email addresses for alerts"),
+    expires_at: z9.string().nullable().optional().describe(
       "New expiration date in ISO 8601 format, or null to remove expiration"
     )
   },
   rotateApiKey: {
-    id: z8.string().uuid().describe("API key UUID obtained from list_api_keys"),
-    key_transition_period_ms: z8.coerce.number().int().min(18e5).optional().describe(
+    id: z9.string().uuid().describe("API key UUID obtained from list_api_keys"),
+    key_transition_period_ms: z9.coerce.number().int().min(18e5).optional().describe(
       "Overlap in milliseconds while the previous key remains valid; minimum 1,800,000 (30 minutes), for example 3,600,000 for 1 hour"
     )
   },
   deleteApiKey: {
-    id: z8.string().uuid().describe("The UUID of the API key to delete")
+    id: z9.string().uuid().describe("The UUID of the API key to delete")
   }
 };
-var createApiKeySchema = z8.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
+var createApiKeySchema = z9.object(KEYS_TOOL_SCHEMAS.createApiKey).superRefine((value, ctx) => {
   if (value.type === "workspace" && !value.workspace_id) {
     ctx.addIssue({
-      code: z8.ZodIssueCode.custom,
+      code: z9.ZodIssueCode.custom,
       path: ["workspace_id"],
       message: "workspace_id is required when type is 'workspace'"
     });
   }
   if (value.sub_type === "user" && !value.user_id) {
     ctx.addIssue({
-      code: z8.ZodIssueCode.custom,
+      code: z9.ZodIssueCode.custom,
       path: ["user_id"],
       message: "user_id is required when sub_type is 'user'"
     });
@@ -4130,37 +4609,37 @@ function registerKeysTools(server, service) {
 }
 
 // src/tools/labels.tools.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var LABELS_TOOL_SCHEMAS = {
   createPromptLabel: {
-    name: z9.string().describe("Name of the label"),
-    organisation_id: z9.string().optional().describe("Organisation ID to create the label in"),
-    workspace_id: z9.string().optional().describe("Workspace ID to create the label in"),
-    description: z9.string().optional().describe("Description of the label"),
-    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
+    name: z10.string().describe("Name of the label"),
+    organisation_id: z10.string().optional().describe("Organisation ID to create the label in"),
+    workspace_id: z10.string().optional().describe("Workspace ID to create the label in"),
+    description: z10.string().optional().describe("Description of the label"),
+    color_code: z10.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe(
       "Hex format, e.g. '#FF5733'. Optional \u2014 omit for default color."
     )
   },
   listPromptLabels: {
-    organisation_id: z9.string().optional().describe("Filter by organisation ID"),
-    workspace_id: z9.string().optional().describe("Filter by workspace ID"),
-    search: z9.string().optional().describe("Search labels by name"),
-    current_page: z9.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z9.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
+    organisation_id: z10.string().optional().describe("Filter by organisation ID"),
+    workspace_id: z10.string().optional().describe("Filter by workspace ID"),
+    search: z10.string().optional().describe("Search labels by name"),
+    current_page: z10.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z10.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPromptLabel: {
-    label_id: z9.string().describe("Label ID to retrieve"),
-    organisation_id: z9.string().optional().describe("Organisation ID for filtering"),
-    workspace_id: z9.string().optional().describe("Workspace ID for filtering")
+    label_id: z10.string().describe("Label ID to retrieve"),
+    organisation_id: z10.string().optional().describe("Organisation ID for filtering"),
+    workspace_id: z10.string().optional().describe("Workspace ID for filtering")
   },
   updatePromptLabel: {
-    label_id: z9.string().describe("Label ID to update"),
-    name: z9.string().optional().describe("New name for the label"),
-    description: z9.string().optional().describe("New description"),
-    color_code: z9.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
+    label_id: z10.string().describe("Label ID to update"),
+    name: z10.string().optional().describe("New name for the label"),
+    description: z10.string().optional().describe("New description"),
+    color_code: z10.string().regex(/^#[0-9A-Fa-f]{6}$/).optional().describe("New hex color code (e.g., '#FF5733')")
   },
   deletePromptLabel: {
-    label_id: z9.string().describe("Label ID to delete")
+    label_id: z10.string().describe("Label ID to delete")
   }
 };
 function registerLabelsTools(server, service) {
@@ -4300,86 +4779,86 @@ function registerLabelsTools(server, service) {
 }
 
 // src/tools/limits.tools.ts
-import { z as z10 } from "zod";
-var conditionSchema = z10.object({
-  field: z10.string().describe(
+import { z as z11 } from "zod";
+var conditionSchema = z11.object({
+  field: z11.string().describe(
     "The field to match on (e.g., 'virtual_key', 'api_key', 'user_id', 'metadata.key')"
   ),
-  operator: z10.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
-  value: z10.string().describe("The value to match against")
+  operator: z11.string().describe("The comparison operator (e.g., 'is', 'contains', 'is_not')"),
+  value: z11.string().describe("The value to match against")
 });
 var LIMITS_TOOL_SCHEMAS = {
   listRateLimits: {
-    workspace_id: z10.string().optional().describe("Filter rate limits by workspace ID")
+    workspace_id: z11.string().optional().describe("Filter rate limits by workspace ID")
   },
   getRateLimit: {
-    id: z10.string().describe("The unique identifier of the rate limit")
+    id: z11.string().describe("The unique identifier of the rate limit")
   },
   createRateLimit: {
-    conditions: z10.array(conditionSchema).describe(
+    conditions: z11.array(conditionSchema).describe(
       "Array of conditions that determine which requests this rate limit applies to"
     ),
-    group_by: z10.array(z10.string()).describe(
+    group_by: z11.array(z11.string()).describe(
       "Array of fields to group the rate limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z10.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
-    unit: z10.enum(["rpm", "rph", "rpd"]).describe(
+    type: z11.enum(["requests", "tokens"]).describe("What to rate limit: 'requests' or 'tokens'"),
+    unit: z11.enum(["rpm", "rph", "rpd"]).describe(
       "Time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z10.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
-    name: z10.string().optional().describe("Optional name for the rate limit"),
-    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
+    value: z11.coerce.number().positive().describe("The maximum allowed value per unit (e.g., 100 rpm)"),
+    name: z11.string().optional().describe("Optional name for the rate limit"),
+    workspace_id: z11.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z11.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateRateLimit: {
-    id: z10.string().describe("The unique identifier of the rate limit"),
-    name: z10.string().optional().describe("New name for the rate limit"),
-    unit: z10.enum(["rpm", "rph", "rpd"]).optional().describe(
+    id: z11.string().describe("The unique identifier of the rate limit"),
+    name: z11.string().optional().describe("New name for the rate limit"),
+    unit: z11.enum(["rpm", "rph", "rpd"]).optional().describe(
       "New time unit: 'rpm' (per minute), 'rph' (per hour), or 'rpd' (per day)"
     ),
-    value: z10.coerce.number().positive().optional().describe("New maximum allowed value per unit")
+    value: z11.coerce.number().positive().optional().describe("New maximum allowed value per unit")
   },
   deleteRateLimit: {
-    id: z10.string().describe("The unique identifier of the rate limit")
+    id: z11.string().describe("The unique identifier of the rate limit")
   },
   listUsageLimits: {
-    workspace_id: z10.string().optional().describe("Filter usage limits by workspace ID")
+    workspace_id: z11.string().optional().describe("Filter usage limits by workspace ID")
   },
   getUsageLimit: {
-    id: z10.string().describe("The unique identifier of the usage limit")
+    id: z11.string().describe("The unique identifier of the usage limit")
   },
   createUsageLimit: {
-    conditions: z10.array(conditionSchema).describe(
+    conditions: z11.array(conditionSchema).describe(
       "Array of conditions that determine which requests this usage limit applies to"
     ),
-    group_by: z10.array(z10.string()).describe(
+    group_by: z11.array(z11.string()).describe(
       "Array of fields to group the usage limit by (e.g., ['virtual_key'], ['api_key', 'user_id'])"
     ),
-    type: z10.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
-    credit_limit: z10.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
-    name: z10.string().optional().describe("Optional name for the usage limit"),
-    alert_threshold: z10.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
-    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
-    workspace_id: z10.string().optional().describe("Workspace ID to scope the limit to"),
-    organisation_id: z10.string().optional().describe("Organisation ID to scope the limit to")
+    type: z11.enum(["cost", "tokens"]).describe("What to limit: 'cost' (in dollars) or 'tokens'"),
+    credit_limit: z11.coerce.number().positive().describe("The maximum allowed usage (cost in dollars or token count)"),
+    name: z11.string().optional().describe("Optional name for the usage limit"),
+    alert_threshold: z11.coerce.number().optional().describe("Percentage threshold (0-100) at which to send an alert"),
+    periodic_reset: z11.enum(["monthly", "weekly"]).optional().describe("Automatically reset usage counters on this schedule"),
+    workspace_id: z11.string().optional().describe("Workspace ID to scope the limit to"),
+    organisation_id: z11.string().optional().describe("Organisation ID to scope the limit to")
   },
   updateUsageLimit: {
-    id: z10.string().describe("The unique identifier of the usage limit"),
-    name: z10.string().optional().describe("New name for the usage limit"),
-    credit_limit: z10.coerce.number().positive().optional().describe("New maximum allowed usage value"),
-    alert_threshold: z10.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
-    periodic_reset: z10.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
-    reset_usage_for_value: z10.string().optional().describe("Reset usage counters for a specific group_by value")
+    id: z11.string().describe("The unique identifier of the usage limit"),
+    name: z11.string().optional().describe("New name for the usage limit"),
+    credit_limit: z11.coerce.number().positive().optional().describe("New maximum allowed usage value"),
+    alert_threshold: z11.coerce.number().optional().describe("New alert threshold percentage (0-100)"),
+    periodic_reset: z11.enum(["monthly", "weekly"]).optional().describe("New periodic reset schedule"),
+    reset_usage_for_value: z11.string().optional().describe("Reset usage counters for a specific group_by value")
   },
   deleteUsageLimit: {
-    id: z10.string().describe("The unique identifier of the usage limit")
+    id: z11.string().describe("The unique identifier of the usage limit")
   },
   listUsageLimitEntities: {
-    limit_id: z10.string().describe("Usage limit policy ID")
+    limit_id: z11.string().describe("Usage limit policy ID")
   },
   resetUsageLimitEntity: {
-    limit_id: z10.string().describe("Usage limit policy ID"),
-    entity_id: z10.string().describe("Entity ID to reset usage for")
+    limit_id: z11.string().describe("Usage limit policy ID"),
+    entity_id: z11.string().describe("Entity ID to reset usage for")
   }
 };
 function formatRateLimit(limit) {
@@ -4685,8 +5164,8 @@ function registerLimitsTools(server, service) {
 }
 
 // src/tools/logging.tools.ts
-import { z as z11 } from "zod";
-var logExportFieldSchema = z11.enum([
+import { z as z12 } from "zod";
+var logExportFieldSchema = z12.enum([
   "id",
   "trace_id",
   "created_at",
@@ -4708,71 +5187,132 @@ var logExportFieldSchema = z11.enum([
   "prompt_slug",
   "metadata"
 ]);
+var getLogInputSchema = z12.object({
+  log_id: z12.string().describe("Gateway log ID to retrieve"),
+  path_format: z12.enum(["v1", "v2"]).optional().describe("Log storage path format; defaults to v1"),
+  created_at: z12.iso.datetime({ offset: true }).optional().describe("Log creation timestamp in ISO 8601 format; required for v2"),
+  type: z12.enum(["hooks"]).optional().describe("Set to hooks when retrieving a hook execution log")
+}).superRefine((input, context) => {
+  if (input.path_format === "v2" && input.created_at === void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["created_at"],
+      message: "created_at is required when path_format is v2"
+    });
+  }
+});
 var LOGGING_TOOL_SCHEMAS = {
+  getLogExportFieldRestrictions: {
+    workspace_id: z12.string().describe("Workspace ID whose export field restrictions should be read")
+  },
   insertLog: {
-    request_url: z11.string().optional().describe("The endpoint URL being called"),
-    request_provider: z11.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
-    request_method: z11.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
-    request_headers: z11.record(z11.string(), z11.string()).optional().describe("Request headers as key-value pairs"),
-    request_body: z11.record(z11.string(), z11.unknown()).optional().describe("Request payload/body"),
-    response_status: z11.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
-    response_headers: z11.record(z11.string(), z11.string()).optional().describe("Response headers as key-value pairs"),
-    response_body: z11.record(z11.string(), z11.unknown()).optional().describe("Response payload/body"),
-    response_time: z11.coerce.number().optional().describe("Response latency in milliseconds"),
-    streaming_mode: z11.boolean().optional().default(false).describe("Whether the response was streamed"),
-    metadata_organization: z11.string().optional().describe("Organization identifier for the log"),
-    metadata_user: z11.string().optional().describe("User identifier for the log"),
-    metadata_trace_id: z11.string().optional().describe("Trace ID for distributed tracing"),
-    metadata_span_id: z11.string().optional().describe("Span ID for tracing"),
-    metadata_span_name: z11.string().optional().describe("Span name for tracing"),
-    metadata_parent_span_id: z11.string().optional().describe("Parent span ID for tracing"),
-    metadata_custom: z11.record(z11.string(), z11.unknown()).optional().describe("Additional custom metadata key-value pairs")
+    request_url: z12.string().optional().describe("The endpoint URL being called"),
+    request_provider: z12.string().optional().describe("AI provider name (e.g., 'openai', 'anthropic')"),
+    request_method: z12.string().optional().default("post").describe("HTTP method used (defaults to 'post')"),
+    request_headers: z12.record(z12.string(), z12.string()).optional().describe("Request headers as key-value pairs"),
+    request_body: z12.record(z12.string(), z12.unknown()).optional().describe("Request payload/body"),
+    response_status: z12.coerce.number().optional().default(200).describe("HTTP response status code (defaults to 200)"),
+    response_headers: z12.record(z12.string(), z12.string()).optional().describe("Response headers as key-value pairs"),
+    response_body: z12.record(z12.string(), z12.unknown()).optional().describe("Response payload/body"),
+    response_time: z12.coerce.number().optional().describe("Response latency in milliseconds"),
+    streaming_mode: z12.boolean().optional().default(false).describe("Whether the response was streamed"),
+    metadata_organization: z12.string().optional().describe("Organization identifier for the log"),
+    metadata_user: z12.string().optional().describe("User identifier for the log"),
+    metadata_trace_id: z12.string().optional().describe("Trace ID for distributed tracing"),
+    metadata_span_id: z12.string().optional().describe("Span ID for tracing"),
+    metadata_span_name: z12.string().optional().describe("Span name for tracing"),
+    metadata_parent_span_id: z12.string().optional().describe("Parent span ID for tracing"),
+    metadata_custom: z12.record(z12.string(), z12.unknown()).optional().describe("Additional custom metadata key-value pairs")
   },
   createLogExport: {
-    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
-    description: z11.string().optional().describe("Human-readable description for the export job"),
-    time_min: z11.string().describe(
+    workspace_id: z12.string().optional().describe("Workspace ID for the export"),
+    description: z12.string().optional().describe("Human-readable description for the export job"),
+    time_min: z12.string().describe(
       "Minimum time filter in date format (e.g., '2024-01-01' or ISO 8601)"
     ),
-    time_max: z11.string().describe(
+    time_max: z12.string().describe(
       "Maximum time filter in date format (e.g., '2024-01-31' or ISO 8601)"
     ),
-    cost_min: z11.coerce.number().optional().describe("Minimum cost filter"),
-    cost_max: z11.coerce.number().optional().describe("Maximum cost filter"),
-    total_units_min: z11.coerce.number().optional().describe("Minimum total units (tokens) filter"),
-    total_units_max: z11.coerce.number().optional().describe("Maximum total units (tokens) filter"),
-    ai_model: z11.array(z11.string()).optional().describe("Filter by specific AI model names"),
-    requested_fields: z11.array(logExportFieldSchema).describe(
+    cost_min: z12.coerce.number().optional().describe("Minimum cost filter"),
+    cost_max: z12.coerce.number().optional().describe("Maximum cost filter"),
+    total_units_min: z12.coerce.number().optional().describe("Minimum total units (tokens) filter"),
+    total_units_max: z12.coerce.number().optional().describe("Maximum total units (tokens) filter"),
+    ai_model: z12.array(z12.string()).optional().describe("Filter by specific AI model names"),
+    requested_fields: z12.array(logExportFieldSchema).describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   },
   listLogExports: {
-    workspace_id: z11.string().describe("Workspace ID to list exports for (required)")
+    workspace_id: z12.string().describe("Workspace ID to list exports for (required)")
   },
   getLogExport: {
-    export_id: z11.string().describe("The unique ID of the log export")
+    export_id: z12.string().describe("The unique ID of the log export")
   },
   startLogExport: {
-    export_id: z11.string().describe("The unique ID of the log export to start")
+    export_id: z12.string().describe("The unique ID of the log export to start")
   },
   cancelLogExport: {
-    export_id: z11.string().describe("The unique ID of the log export to cancel")
+    export_id: z12.string().describe("The unique ID of the log export to cancel")
   },
   downloadLogExport: {
-    export_id: z11.string().describe("The unique ID of the log export to download")
+    export_id: z12.string().describe("The unique ID of the log export to download")
   },
   updateLogExport: {
-    export_id: z11.string().describe("The unique ID of the log export to update"),
-    workspace_id: z11.string().optional().describe("Workspace ID for the export"),
-    time_of_generation_max: z11.string().optional().describe(
+    export_id: z12.string().describe("The unique ID of the log export to update"),
+    workspace_id: z12.string().optional().describe("Workspace ID for the export"),
+    time_of_generation_max: z12.string().optional().describe(
       "Maximum time filter in date format (e.g., '2024-07-25' or ISO 8601)"
     ),
-    requested_fields: z11.array(logExportFieldSchema).optional().describe(
+    requested_fields: z12.array(logExportFieldSchema).optional().describe(
       "Fields to include in export: id, trace_id, created_at, request, response, is_success, ai_org, ai_model, req_units, res_units, total_units, request_url, cost, cost_currency, response_time, response_status_code, mode, config, prompt_slug, metadata"
     )
   }
 };
 function registerLoggingTools(server, service) {
+  server.registerTool(
+    "get_log",
+    {
+      description: "Get one gateway request log by ID, including its request, response, usage, cost, and metadata payload when available. For path_format v2, also provide the log's created_at timestamp.",
+      inputSchema: getLogInputSchema,
+      annotations: {
+        title: "Get Gateway Log",
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async (params) => {
+      const result = await service.logging.getLog(params.log_id, {
+        path_format: params.path_format,
+        created_at: params.created_at,
+        type: params.type
+      });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result) }]
+      };
+    }
+  );
+  server.tool(
+    "get_log_export_field_restrictions",
+    "Get the organisation-managed fields that a workspace is restricted from including in log exports. Use before create_log_export or update_log_export to avoid requesting disallowed fields. Requires an API key with logs.export scope; completion-log fields may additionally require completion scope.",
+    LOGGING_TOOL_SCHEMAS.getLogExportFieldRestrictions,
+    {
+      title: "Get Log Export Field Restrictions",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.logging.getLogExportFieldRestrictions({
+        workspace_id: params.workspace_id
+      });
+      return {
+        content: [{ type: "text", text: JSON.stringify(result) }]
+      };
+    }
+  );
   server.tool(
     "insert_log",
     "Insert log records for requests that bypassed the gateway. This writes request, response, and trace metadata into Portkey immediately, and the call will fail if request_provider does not match a configured integration. Use the span fields to stitch trace hierarchies together.",
@@ -5008,73 +5548,88 @@ function registerLoggingTools(server, service) {
 }
 
 // src/tools/mcp-integrations.tools.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
+var mcpSecretMappingSchema = createSecretMappingSchema({
+  allowKeyTarget: false,
+  targetFieldDescription: "Configuration field resolved at runtime, such as configurations.oauth_metadata",
+  secretReferenceDescription: "Secret Reference UUID or slug accessible to this integration",
+  valueFormatDescription: "Use json when the target configuration field expects a structured object"
+});
+var mcpSecretMappingsSchema = uniqueSecretMappingsSchema(
+  mcpSecretMappingSchema
+);
 var MCP_INTEGRATIONS_TOOL_SCHEMAS = {
   listMcpIntegrations: {
-    current_page: z12.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z12.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z12.string().optional().describe("Filter by workspace ID")
+    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z13.string().optional().describe("Filter by workspace ID")
   },
   createMcpIntegration: {
-    name: z12.string().describe("Display name for the MCP integration"),
-    url: z12.string().describe("URL endpoint of the MCP server to integrate"),
-    auth_type: z12.enum(["oauth_auto", "headers", "none"]).describe(
+    name: z13.string().describe("Display name for the MCP integration"),
+    url: z13.string().describe("URL endpoint of the MCP server to integrate"),
+    auth_type: z13.enum(["oauth_auto", "headers", "none"]).describe(
       "Authentication type: 'none', 'headers' (custom headers), or 'oauth_auto' (OAuth)"
     ),
-    transport: z12.enum(["http", "sse"]).describe(
+    transport: z13.enum(["http", "sse"]).describe(
       "MCP transport protocol: 'http' (streamable HTTP) or 'sse' (server-sent events)"
     ),
-    slug: z12.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z12.string().optional().describe("Description of the MCP integration"),
-    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
+    slug: z13.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z13.string().optional().describe("Description of the MCP integration"),
+    custom_headers: z13.record(z13.string(), z13.string()).optional().describe(
       'Custom headers for authentication (e.g. { "Authorization": "Bearer xxx" }). Sent via configurations.custom_headers'
     ),
-    workspace_id: z12.string().optional().describe(
+    workspace_id: z13.string().optional().describe(
       "Workspace ID \u2014 required when using organization admin API keys"
+    ),
+    secret_mappings: mcpSecretMappingsSchema.optional().describe(
+      "Runtime Secret Reference mappings; every configurations.<field> target must be unique"
     )
   },
   getMcpIntegration: {
-    id: z12.string().describe("The MCP integration ID or slug to retrieve")
+    id: z13.string().describe("The MCP integration ID or slug to retrieve")
   },
   updateMcpIntegration: {
-    id: z12.string().describe("The MCP integration ID or slug to update"),
-    name: z12.string().optional().describe("New display name"),
-    description: z12.string().optional().describe("New description"),
-    url: z12.string().optional().describe("New URL endpoint"),
-    auth_type: z12.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
-    transport: z12.enum(["http", "sse"]).optional().describe("New transport protocol"),
-    custom_headers: z12.record(z12.string(), z12.string()).optional().describe(
+    id: z13.string().describe("The MCP integration ID or slug to update"),
+    name: z13.string().optional().describe("New display name"),
+    description: z13.string().optional().describe("New description"),
+    url: z13.string().optional().describe("New URL endpoint"),
+    auth_type: z13.enum(["oauth_auto", "headers", "none"]).optional().describe("New authentication type"),
+    transport: z13.enum(["http", "sse"]).optional().describe("New transport protocol"),
+    custom_headers: z13.record(z13.string(), z13.string()).optional().describe(
       "New custom headers for authentication. Sent via configurations.custom_headers"
+    ),
+    secret_mappings: mcpSecretMappingsSchema.optional().describe(
+      "Replacement runtime Secret Reference mappings; each target_field must be unique"
     )
   },
   deleteMcpIntegration: {
-    id: z12.string().describe("The MCP integration ID or slug to delete")
+    id: z13.string().describe("The MCP integration ID or slug to delete")
   },
   getMcpIntegrationMetadata: {
-    id: z12.string().describe("The MCP integration ID or slug")
+    id: z13.string().describe("The MCP integration ID or slug")
   },
   listMcpIntegrationCapabilities: {
-    id: z12.string().describe("The MCP integration ID or slug")
+    id: z13.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationCapabilities: {
-    id: z12.string().describe("The MCP integration ID or slug"),
-    capabilities: z12.array(
-      z12.object({
-        name: z12.string().describe("Capability name"),
-        type: z12.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z12.boolean().describe("Whether to enable the capability")
+    id: z13.string().describe("The MCP integration ID or slug"),
+    capabilities: z13.array(
+      z13.object({
+        name: z13.string().describe("Capability name"),
+        type: z13.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z13.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpIntegrationWorkspaces: {
-    id: z12.string().describe("The MCP integration ID or slug")
+    id: z13.string().describe("The MCP integration ID or slug")
   },
   updateMcpIntegrationWorkspaces: {
-    id: z12.string().describe("The MCP integration ID or slug"),
-    workspaces: z12.array(
-      z12.object({
-        id: z12.string().describe("Workspace ID"),
-        enabled: z12.boolean().describe("Whether workspace has access")
+    id: z13.string().describe("The MCP integration ID or slug"),
+    workspaces: z13.array(
+      z13.object({
+        id: z13.string().describe("Workspace ID"),
+        enabled: z13.boolean().describe("Whether workspace has access")
       })
     ).min(1).describe("Array of workspace access updates")
   }
@@ -5102,6 +5657,7 @@ function formatMcpIntegration(integration) {
     global_workspace_access: integration.global_workspace_access,
     configuration_keys: integration.configurations ? Object.keys(integration.configurations) : void 0,
     custom_header_names: getCustomHeaderNames(integration.configurations),
+    secret_mappings: integration.secret_mappings,
     created_at: integration.created_at,
     last_updated_at: integration.last_updated_at
   };
@@ -5154,10 +5710,19 @@ function registerMcpIntegrationsTools(server, service) {
   );
   server.tool(
     "create_mcp_integration",
-    "Create an MCP integration from an external server URL. Registers the Portkey-side connection and returns the new id and slug; if auth_type is headers, custom_headers are required, and you usually follow with create_mcp_server and capability updates.",
+    "Create a Portkey integration for an external MCP server URL. For headers auth, provide custom_headers or a Secret Reference mapping targeting configurations.custom_headers; secret_mappings resolve protected values at runtime without storing them in the tool call. Organisation admin keys normally need workspace_id. After creation, create_mcp_server and configure capabilities/access; returns the integration id and slug.",
     MCP_INTEGRATIONS_TOOL_SCHEMAS.createMcpIntegration,
+    {
+      title: "Create MCP Integration",
+      readOnlyHint: false,
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true
+    },
     async (params) => {
-      if (params.auth_type === "headers" && (!params.custom_headers || Object.keys(params.custom_headers).length === 0)) {
+      if (params.auth_type === "headers" && (!params.custom_headers || Object.keys(params.custom_headers).length === 0) && !params.secret_mappings?.some(
+        (mapping) => mapping.target_field === "configurations.custom_headers"
+      )) {
         return {
           content: [
             {
@@ -5207,8 +5772,15 @@ function registerMcpIntegrationsTools(server, service) {
   );
   server.tool(
     "update_mcp_integration",
-    "Update an MCP integration's name, description, URL, auth, or transport. Changes apply immediately and altering url or auth_type can break connected clients; use update_mcp_server when you only need to rename or re-describe a server.",
+    "Update an MCP integration's name, description, URL, auth, transport, headers, or runtime Secret Reference mappings. Only supplied fields change; URL, auth, header, and secret changes apply immediately and can break active clients, so inspect get_mcp_integration first. Use update_mcp_server when changing only a Portkey server instance's display metadata.",
     MCP_INTEGRATIONS_TOOL_SCHEMAS.updateMcpIntegration,
+    {
+      title: "Update MCP Integration",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
     async (params) => {
       const { id, custom_headers, ...rest } = params;
       await service.mcpIntegrations.updateMcpIntegration(id, {
@@ -5366,7 +5938,7 @@ function registerMcpIntegrationsTools(server, service) {
 }
 
 // src/tools/mcp-servers.tools.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/tools/utils.ts
 function formatFullName(firstName, lastName) {
@@ -5376,58 +5948,78 @@ function formatFullName(firstName, lastName) {
 // src/tools/mcp-servers.tools.ts
 var MCP_SERVERS_TOOL_SCHEMAS = {
   listMcpServers: {
-    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
-    workspace_id: z13.string().optional().describe("Filter by workspace ID")
+    current_page: z14.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z14.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)"),
+    workspace_id: z14.string().optional().describe("Filter by workspace ID")
   },
   createMcpServer: {
-    name: z13.string().describe("Display name for the MCP server"),
-    mcp_integration_id: z13.string().describe("ID or slug of the MCP integration this server belongs to"),
-    slug: z13.string().optional().describe("Custom slug. Auto-generated if omitted"),
-    description: z13.string().optional().describe("Description of the MCP server")
+    name: z14.string().describe("Display name for the MCP server"),
+    mcp_integration_id: z14.string().describe("ID or slug of the MCP integration this server belongs to"),
+    slug: z14.string().optional().describe("Custom slug. Auto-generated if omitted"),
+    description: z14.string().optional().describe("Description of the MCP server")
   },
   getMcpServer: {
-    id: z13.string().describe("The MCP server ID or slug to retrieve")
+    id: z14.string().describe("The MCP server ID or slug to retrieve")
   },
   updateMcpServer: {
-    id: z13.string().describe("The MCP server ID or slug to update"),
-    name: z13.string().optional().describe("New display name"),
-    description: z13.string().optional().describe("New description")
+    id: z14.string().describe("The MCP server ID or slug to update"),
+    name: z14.string().optional().describe("New display name"),
+    description: z14.string().optional().describe("New description")
   },
   deleteMcpServer: {
-    id: z13.string().describe("The MCP server ID or slug to delete")
+    id: z14.string().describe("The MCP server ID or slug to delete")
   },
   testMcpServer: {
-    id: z13.string().describe("The MCP server ID or slug to test")
+    id: z14.string().describe("The MCP server ID or slug to test")
   },
   listMcpServerCapabilities: {
-    id: z13.string().describe("The MCP server ID or slug"),
-    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z14.string().describe("The MCP server ID or slug"),
+    current_page: z14.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z14.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerCapabilities: {
-    id: z13.string().describe("The MCP server ID or slug"),
-    capabilities: z13.array(
-      z13.object({
-        name: z13.string().describe("Capability name"),
-        type: z13.enum(["tool", "prompt", "resource"]).describe("Capability type"),
-        enabled: z13.boolean().describe("Whether to enable the capability")
+    id: z14.string().describe("The MCP server ID or slug"),
+    capabilities: z14.array(
+      z14.object({
+        name: z14.string().describe("Capability name"),
+        type: z14.enum(["tool", "prompt", "resource"]).describe("Capability type"),
+        enabled: z14.boolean().describe("Whether to enable the capability")
       })
     ).min(1).describe("Array of capability updates")
   },
   listMcpServerUserAccess: {
-    id: z13.string().describe("The MCP server ID or slug"),
-    current_page: z13.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z13.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    id: z14.string().describe("The MCP server ID or slug"),
+    current_page: z14.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z14.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   updateMcpServerUserAccess: {
-    id: z13.string().describe("The MCP server ID or slug"),
-    users: z13.array(
-      z13.object({
-        user_id: z13.string().describe("User ID"),
-        enabled: z13.boolean().describe("Whether user has access")
+    id: z14.string().describe("The MCP server ID or slug"),
+    users: z14.array(
+      z14.object({
+        user_id: z14.string().describe("User ID"),
+        enabled: z14.boolean().describe("Whether user has access")
       })
     ).min(1).describe("Array of user access updates")
+  },
+  listMcpServerConnections: {
+    id: z14.string().describe("MCP server ID or slug whose connections to list"),
+    user_id: z14.string().uuid().optional().describe(
+      "User UUID to filter; user-scoped keys default to their own user when omitted"
+    ),
+    workspace_id: z14.string().optional().describe(
+      "Workspace ID or slug; required with an organisation admin API key"
+    ),
+    current_page: z14.coerce.number().int().min(0).optional().describe("Zero-based results page; defaults to 0"),
+    page_size: z14.coerce.number().int().min(1).max(500).optional().describe("Connections per page, from 1 through 500; defaults to 100")
+  },
+  disconnectMcpServerConnection: {
+    id: z14.string().describe("MCP server ID or slug containing the active connection"),
+    user_id: z14.string().uuid().optional().describe(
+      "User UUID to disconnect; required with service keys and derived from user keys when omitted"
+    ),
+    workspace_id: z14.string().optional().describe(
+      "Workspace ID or slug; required with an organisation admin API key"
+    )
   }
 };
 function formatMcpServer(server) {
@@ -5461,6 +6053,73 @@ function formatMcpServerUserAccess(user) {
   };
 }
 function registerMcpServersTools(server, service) {
+  server.tool(
+    "list_mcp_server_connections",
+    "List active connection records for one Portkey-managed MCP server, including user, connected state, and connection timestamps. Use it to audit sessions or identify the user/workspace before disconnect_mcp_server_connection; service keys can list all users, while user keys default to their own user. Organisation admin keys must provide workspace_id. This reads live connection state and does not test upstream server reachability (use test_mcp_server for that).",
+    MCP_SERVERS_TOOL_SCHEMAS.listMcpServerConnections,
+    {
+      title: "List MCP Server Connections",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.mcpServers.listMcpServerConnections(
+        params.id,
+        {
+          user_id: params.user_id,
+          workspace_id: params.workspace_id,
+          current_page: params.current_page,
+          page_size: params.page_size
+        }
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              total: result.total,
+              has_more: result.has_more,
+              connections: result.data
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "disconnect_mcp_server_connection",
+    "Disconnect one user's active session from a Portkey-managed MCP server. This immediately ends that connection but does not revoke future access; use update_mcp_server_user_access when access itself should be removed. Provide user_id with service keys (user keys derive it), and workspace_id with organisation admin keys. Inspect list_mcp_server_connections first when the target is uncertain.",
+    MCP_SERVERS_TOOL_SCHEMAS.disconnectMcpServerConnection,
+    {
+      title: "Disconnect MCP Server Connection",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.mcpServers.disconnectMcpServerConnection(
+        params.id,
+        {
+          user_id: params.user_id,
+          workspace_id: params.workspace_id
+        }
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Disconnected MCP server connection for "${params.id}"`,
+              ...result
+            })
+          }
+        ]
+      };
+    }
+  );
   server.tool(
     "list_mcp_servers",
     "List MCP servers in the organization. Returns paginated server records plus total for discovering server IDs; use get_mcp_server for one server's details and list_mcp_integrations for the parent integration.",
@@ -5669,40 +6328,40 @@ function registerMcpServersTools(server, service) {
 }
 
 // src/tools/partials.tools.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var PARTIALS_TOOL_SCHEMAS = {
   createPromptPartial: {
-    name: z14.string().describe("Display name for the partial"),
-    string: z14.string().describe("The partial content/template string"),
-    workspace_id: z14.string().optional().describe(
+    name: z15.string().describe("Display name for the partial"),
+    string: z15.string().describe("The partial content/template string"),
+    workspace_id: z15.string().optional().describe(
       "Workspace ID to create partial in (required for org-level API keys)"
     ),
-    version_description: z14.string().optional().describe("Description for this version")
+    version_description: z15.string().optional().describe("Description for this version")
   },
   listPromptPartials: {
-    collection_id: z14.string().optional().describe(
+    collection_id: z15.string().optional().describe(
       "Filter by collection ID. Optional \u2014 omit to list all partials across collections"
     )
   },
   getPromptPartial: {
-    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to retrieve")
+    prompt_partial_id: z15.string().describe("Prompt partial ID or slug to retrieve")
   },
   updatePromptPartial: {
-    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to update"),
-    name: z14.string().optional().describe("New display name for the partial"),
-    string: z14.string().optional().describe("New content for the partial"),
-    description: z14.string().optional().describe("Description for this version"),
-    status: z14.enum(["active", "archived"]).optional().describe("New status for the partial")
+    prompt_partial_id: z15.string().describe("Prompt partial ID or slug to update"),
+    name: z15.string().optional().describe("New display name for the partial"),
+    string: z15.string().optional().describe("New content for the partial"),
+    description: z15.string().optional().describe("Description for this version"),
+    status: z15.enum(["active", "archived"]).optional().describe("New status for the partial")
   },
   deletePromptPartial: {
-    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to delete")
+    prompt_partial_id: z15.string().describe("Prompt partial ID or slug to delete")
   },
   listPartialVersions: {
-    prompt_partial_id: z14.string().describe("Prompt partial ID or slug to list versions for")
+    prompt_partial_id: z15.string().describe("Prompt partial ID or slug to list versions for")
   },
   publishPartial: {
-    prompt_partial_id: z14.string().describe("Prompt partial ID or slug"),
-    version: z14.coerce.number().positive().describe("Version number to publish as default")
+    prompt_partial_id: z15.string().describe("Prompt partial ID or slug"),
+    version: z15.coerce.number().positive().describe("Version number to publish as default")
   }
 };
 function registerPartialsTools(server, service) {
@@ -5888,57 +6547,57 @@ function registerPartialsTools(server, service) {
 }
 
 // src/tools/prompts.tools.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // src/lib/schemas.ts
-import { z as z15 } from "zod";
-var PromptFunctionSchema = z15.object({
-  name: z15.string().describe("Function name"),
-  description: z15.string().optional().describe("Function description"),
-  parameters: z15.record(z15.string(), z15.unknown()).optional().describe("Function parameters schema")
+import { z as z16 } from "zod";
+var PromptFunctionSchema = z16.object({
+  name: z16.string().describe("Function name"),
+  description: z16.string().optional().describe("Function description"),
+  parameters: z16.record(z16.string(), z16.unknown()).optional().describe("Function parameters schema")
 });
-var PromptToolSchema = z15.object({
-  type: z15.literal("function").describe("Tool type"),
+var PromptToolSchema = z16.object({
+  type: z16.literal("function").describe("Tool type"),
   function: PromptFunctionSchema.describe("Function definition")
 });
-var HyperparametersSchema = z15.object({
-  max_tokens: z15.coerce.number().positive().optional().describe("Maximum tokens to generate"),
-  temperature: z15.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
-  top_p: z15.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
-  top_k: z15.coerce.number().positive().optional().describe("Top-k sampling"),
-  presence_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
-  frequency_penalty: z15.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
-  stop: z15.array(z15.string()).optional().describe("Stop sequences")
+var HyperparametersSchema = z16.object({
+  max_tokens: z16.coerce.number().positive().optional().describe("Maximum tokens to generate"),
+  temperature: z16.coerce.number().min(0).max(2).optional().describe("Sampling temperature (0-2)"),
+  top_p: z16.coerce.number().min(0).max(1).optional().describe("Top-p sampling (0-1)"),
+  top_k: z16.coerce.number().positive().optional().describe("Top-k sampling"),
+  presence_penalty: z16.coerce.number().min(-2).max(2).optional().describe("Presence penalty (-2 to 2)"),
+  frequency_penalty: z16.coerce.number().min(-2).max(2).optional().describe("Frequency penalty (-2 to 2)"),
+  stop: z16.array(z16.string()).optional().describe("Stop sequences")
 });
-var PromptAppIdentifierSchema = z15.string().min(1).describe(
+var PromptAppIdentifierSchema = z16.string().min(1).describe(
   "App identifier (REQUIRED). Use your deployed app name, for example 'hourlink' or 'support-console'."
 );
-var PromptEnvironmentIdentifierSchema = z15.string().min(1).describe(
+var PromptEnvironmentIdentifierSchema = z16.string().min(1).describe(
   "Environment identifier (REQUIRED). Use your environment name, for example 'dev', 'staging', 'prod', or 'qa'."
 );
-var BillingMetadataSchema = z15.object({
-  client_id: z15.string().describe("Client ID for billing attribution (REQUIRED)"),
+var BillingMetadataSchema = z16.object({
+  client_id: z16.string().describe("Client ID for billing attribution (REQUIRED)"),
   app: PromptAppIdentifierSchema,
   env: PromptEnvironmentIdentifierSchema,
-  project_id: z15.string().optional().describe("Project ID for granular billing"),
-  feature: z15.string().optional().describe("Feature name for tracking")
+  project_id: z16.string().optional().describe("Project ID for granular billing"),
+  feature: z16.string().optional().describe("Feature name for tracking")
 });
-var ToolChoiceSchema = z15.object({
-  mode: z15.enum(["auto", "none", "function"]).describe(
+var ToolChoiceSchema = z16.object({
+  mode: z16.enum(["auto", "none", "function"]).describe(
     "Tool choice mode: auto lets the model decide, none disables tool use, function forces one function by name"
   ),
-  function_name: z15.string().optional().describe("Required when mode is 'function'; ignored otherwise")
+  function_name: z16.string().optional().describe("Required when mode is 'function'; ignored otherwise")
 }).superRefine((value, ctx) => {
   if (value.mode === "function" && !value.function_name) {
     ctx.addIssue({
-      code: z15.ZodIssueCode.custom,
+      code: z16.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is required when mode is 'function'"
     });
   }
   if (value.mode !== "function" && value.function_name !== void 0) {
     ctx.addIssue({
-      code: z15.ZodIssueCode.custom,
+      code: z16.ZodIssueCode.custom,
       path: ["function_name"],
       message: "function_name is only allowed when mode is 'function'"
     });
@@ -5960,98 +6619,98 @@ function toPromptToolChoice(toolChoice) {
 }
 
 // src/tools/prompts.tools.ts
-var PROMPT_VARIABLES_SCHEMA = z16.record(z16.string(), z16.union([z16.string(), z16.coerce.number(), z16.boolean()])).describe("Variable values to substitute into the template");
-var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z16.object({
-  type: z16.string().describe("Content block type"),
-  text: z16.string().optional().describe("Text content for text-based blocks")
+var PROMPT_VARIABLES_SCHEMA = z17.record(z17.string(), z17.union([z17.string(), z17.coerce.number(), z17.boolean()])).describe("Variable values to substitute into the template");
+var PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA = z17.object({
+  type: z17.string().describe("Content block type"),
+  text: z17.string().optional().describe("Text content for text-based blocks")
 }).passthrough().describe("Content block within a structured chat message");
-var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z16.object({
-  role: z16.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
-  content: z16.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
+var PROMPT_TEMPLATE_MESSAGE_SCHEMA = z17.object({
+  role: z17.enum(["system", "user", "assistant"]).describe("Message role in the chat template"),
+  content: z17.array(PROMPT_TEMPLATE_CONTENT_BLOCK_SCHEMA).describe("Message content blocks")
 }).passthrough().describe("Structured chat message in a prompt template");
 var PROMPTS_TOOL_SCHEMAS = {
   createPrompt: {
-    name: z16.string().describe("Display name for the prompt"),
-    collection_id: z16.string().describe(
+    name: z17.string().describe("Display name for the prompt"),
+    collection_id: z17.string().describe(
       "Collection ID to organize the prompt in (use list_collections to find)"
     ),
-    string: z16.string().optional().describe(
+    string: z17.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z17.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias. Serialized to the legacy string format before creation."
     ),
-    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
-    virtual_key: z16.string().describe("Virtual key slug for model access"),
-    model: z16.string().optional().describe(
+    parameters: z17.record(z17.string(), z17.unknown()).describe("Default values for template variables"),
+    virtual_key: z17.string().describe("Virtual key slug for model access"),
+    model: z17.string().optional().describe(
       "Model identifier (e.g., 'gpt-4', 'claude-3-opus'). Required unless ai_model_id or finetune_id is provided"
     ),
-    ai_model_id: z16.string().optional().describe(
+    ai_model_id: z17.string().optional().describe(
       "AI model ID (alternative to model). Required unless model or finetune_id is provided"
     ),
-    finetune_id: z16.string().optional().describe(
+    finetune_id: z17.string().optional().describe(
       "Fine-tune ID (alternative to model). Required unless model or ai_model_id is provided"
     ),
-    version_description: z16.string().optional().describe("Description for this prompt version"),
-    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
-    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
-    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
+    version_description: z17.string().optional().describe("Description for this prompt version"),
+    template_metadata: z17.record(z17.string(), z17.unknown()).optional().describe("Custom metadata (app, env, source_file, etc.)"),
+    functions: z17.array(PromptFunctionSchema).optional().describe("Function definitions for function calling"),
+    tools: z17.array(PromptToolSchema).optional().describe("Tool definitions for tool use"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z16.boolean().optional().describe("When true, validate without creating")
+    dry_run: z17.boolean().optional().describe("When true, validate without creating")
   },
   listPrompts: {
-    collection_id: z16.string().optional().describe(
+    collection_id: z17.string().optional().describe(
       "Filter by collection ID (recommended for app-specific prompts)"
     ),
-    workspace_id: z16.string().optional().describe("Filter by workspace ID"),
-    search: z16.string().optional().describe("Search prompts by name"),
-    current_page: z16.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z16.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
+    workspace_id: z17.string().optional().describe("Filter by workspace ID"),
+    search: z17.string().optional().describe("Search prompts by name"),
+    current_page: z17.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z17.coerce.number().int().positive().max(100).optional().describe("Results per page (max 100)")
   },
   getPrompt: {
-    prompt_id: z16.string().describe("Prompt ID or slug to retrieve")
+    prompt_id: z17.string().describe("Prompt ID or slug to retrieve")
   },
   updatePrompt: {
-    prompt_id: z16.string().describe("Prompt ID or slug to update"),
-    name: z16.string().optional().describe("New display name for the prompt"),
-    collection_id: z16.string().optional().describe("Move to a different collection"),
-    string: z16.string().optional().describe(
+    prompt_id: z17.string().describe("Prompt ID or slug to update"),
+    name: z17.string().optional().describe("New display name for the prompt"),
+    collection_id: z17.string().optional().describe("Move to a different collection"),
+    string: z17.string().optional().describe(
       "Legacy prompt template string. Use plain text for single-message prompts, or a JSON-encoded messages array string for multi-message chat prompts."
     ),
-    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z17.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for updates. Serialized to the legacy string format before the prompt is updated."
     ),
-    parameters: z16.record(z16.string(), z16.unknown()).optional().describe("New default values for template variables"),
-    model: z16.string().optional().describe("New model identifier"),
-    virtual_key: z16.string().optional().describe("New virtual key slug"),
-    version_description: z16.string().optional().describe("Description for this version"),
-    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("New metadata"),
-    functions: z16.array(PromptFunctionSchema).optional().describe("New function definitions"),
-    tools: z16.array(PromptToolSchema).optional().describe("New tool definitions"),
+    parameters: z17.record(z17.string(), z17.unknown()).optional().describe("New default values for template variables"),
+    model: z17.string().optional().describe("New model identifier"),
+    virtual_key: z17.string().optional().describe("New virtual key slug"),
+    version_description: z17.string().optional().describe("Description for this version"),
+    template_metadata: z17.record(z17.string(), z17.unknown()).optional().describe("New metadata"),
+    functions: z17.array(PromptFunctionSchema).optional().describe("New function definitions"),
+    tools: z17.array(PromptToolSchema).optional().describe("New tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe(
       "New tool choice strategy"
     ),
-    dry_run: z16.boolean().optional().describe("When true, validate without updating")
+    dry_run: z17.boolean().optional().describe("When true, validate without updating")
   },
   deletePrompt: {
-    prompt_id: z16.string().describe("Prompt ID or slug to delete")
+    prompt_id: z17.string().describe("Prompt ID or slug to delete")
   },
   publishPrompt: {
-    prompt_id: z16.string().describe("Prompt ID or slug to publish"),
-    version: z16.coerce.number().positive().describe("Version number to publish as the default")
+    prompt_id: z17.string().describe("Prompt ID or slug to publish"),
+    version: z17.coerce.number().positive().describe("Version number to publish as the default")
   },
   listPromptVersions: {
-    prompt_id: z16.string().describe("Prompt ID or slug to list versions for")
+    prompt_id: z17.string().describe("Prompt ID or slug to list versions for")
   },
   renderPrompt: {
-    prompt_id: z16.string().describe("Prompt ID or slug to render"),
+    prompt_id: z17.string().describe("Prompt ID or slug to render"),
     variables: PROMPT_VARIABLES_SCHEMA,
     hyperparameters: HyperparametersSchema.optional().describe(
       "Override default hyperparameters"
     )
   },
   runPromptCompletion: {
-    prompt_id: z16.string().describe("Prompt ID or slug to execute"),
+    prompt_id: z17.string().describe("Prompt ID or slug to execute"),
     variables: PROMPT_VARIABLES_SCHEMA,
     metadata: BillingMetadataSchema.describe(
       "Billing metadata - client_id, app, env are REQUIRED for cost attribution"
@@ -6061,54 +6720,54 @@ var PROMPTS_TOOL_SCHEMAS = {
     )
   },
   migratePrompt: {
-    name: z16.string().describe("Prompt name to create or find for update"),
+    name: z17.string().describe("Prompt name to create or find for update"),
     app: PromptAppIdentifierSchema,
     env: PromptEnvironmentIdentifierSchema,
-    collection_id: z16.string().describe("Collection ID to search in and create under"),
-    string: z16.string().optional().describe(
+    collection_id: z17.string().describe("Collection ID to search in and create under"),
+    string: z17.string().optional().describe(
       "Legacy prompt template string with {{variable}} mustache syntax."
     ),
-    messages: z16.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
+    messages: z17.array(PROMPT_TEMPLATE_MESSAGE_SCHEMA).optional().describe(
       "Structured chat template alias for migrations. Serialized to the legacy string format before the prompt is created or updated."
     ),
-    parameters: z16.record(z16.string(), z16.unknown()).describe("Default values for template variables"),
-    virtual_key: z16.string().describe("Virtual key slug for model access"),
-    model: z16.string().optional().describe("Model identifier"),
-    version_description: z16.string().optional().describe("Description for this version"),
-    template_metadata: z16.record(z16.string(), z16.unknown()).optional().describe("Additional custom metadata"),
-    functions: z16.array(PromptFunctionSchema).optional().describe("Function definitions"),
-    tools: z16.array(PromptToolSchema).optional().describe("Tool definitions"),
+    parameters: z17.record(z17.string(), z17.unknown()).describe("Default values for template variables"),
+    virtual_key: z17.string().describe("Virtual key slug for model access"),
+    model: z17.string().optional().describe("Model identifier"),
+    version_description: z17.string().optional().describe("Description for this version"),
+    template_metadata: z17.record(z17.string(), z17.unknown()).optional().describe("Additional custom metadata"),
+    functions: z17.array(PromptFunctionSchema).optional().describe("Function definitions"),
+    tools: z17.array(PromptToolSchema).optional().describe("Tool definitions"),
     tool_choice: ToolChoiceSchema.optional().describe("Tool choice strategy"),
-    dry_run: z16.boolean().optional().describe(
+    dry_run: z17.boolean().optional().describe(
       "When true, only check what action would be taken without making changes"
     )
   },
   promotePrompt: {
-    source_prompt_id: z16.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
-    target_collection_id: z16.string().describe("Target collection ID for the promoted prompt"),
-    target_name: z16.string().optional().describe(
+    source_prompt_id: z17.string().describe("Source prompt ID or slug (e.g., staging prompt)"),
+    target_collection_id: z17.string().describe("Target collection ID for the promoted prompt"),
+    target_name: z17.string().optional().describe(
       "Target prompt name (defaults to source name with env suffix replaced)"
     ),
     target_env: PromptEnvironmentIdentifierSchema,
-    virtual_key: z16.string().optional().describe(
+    virtual_key: z17.string().optional().describe(
       "Virtual key ID to use (defaults to source prompt's virtual_key)"
     )
   },
   validateCompletionMetadata: {
-    client_id: z16.string().optional().describe("Client ID for billing attribution"),
+    client_id: z17.string().optional().describe("Client ID for billing attribution"),
     app: PromptAppIdentifierSchema.optional(),
     env: PromptEnvironmentIdentifierSchema.optional(),
-    project_id: z16.string().optional().describe("Project ID for granular billing"),
-    feature: z16.string().optional().describe("Feature name for tracking")
+    project_id: z17.string().optional().describe("Project ID for granular billing"),
+    feature: z17.string().optional().describe("Feature name for tracking")
   },
   getPromptVersion: {
-    prompt_id: z16.string().describe("Prompt ID or slug"),
-    version_id: z16.string().describe("Version UUID to retrieve")
+    prompt_id: z17.string().describe("Prompt ID or slug"),
+    version_id: z17.string().describe("Version UUID to retrieve")
   },
   updatePromptVersion: {
-    prompt_id: z16.string().describe("Prompt ID or slug"),
-    version_id: z16.string().describe("Version UUID to update"),
-    label_id: z16.string().nullable().describe(
+    prompt_id: z17.string().describe("Prompt ID or slug"),
+    version_id: z17.string().describe("Version UUID to update"),
+    label_id: z17.string().nullable().describe(
       "Label ID to assign to this version, or null to remove the label"
     )
   }
@@ -6698,68 +7357,68 @@ function registerPromptsTools(server, service) {
 }
 
 // src/tools/providers.tools.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var PROVIDERS_TOOL_SCHEMAS = {
   listProviders: {
-    current_page: z17.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z17.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
-    workspace_id: z17.string().optional().describe(
+    current_page: z18.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z18.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100, default 50)"),
+    workspace_id: z18.string().optional().describe(
       "Workspace ID - required when using organization admin keys, optional with workspace API keys"
     )
   },
   createProvider: {
-    name: z17.string().describe("Display name for the provider"),
-    integration_id: z17.string().describe(
+    name: z18.string().describe("Display name for the provider"),
+    integration_id: z18.string().describe(
       "Integration slug for the provider (e.g., 'openai', 'anthropic', 'azure-openai')"
     ),
-    workspace_id: z17.string().optional().describe(
+    workspace_id: z18.string().optional().describe(
       "Workspace ID - required when using organization admin API keys"
     ),
-    slug: z17.string().optional().describe(
+    slug: z18.string().optional().describe(
       "Custom slug for the provider. Auto-generated with random suffix if omitted"
     ),
-    note: z17.string().optional().describe("Optional note or description for the provider"),
-    credit_limit: z17.coerce.number().positive().optional().describe("Credit limit for usage"),
-    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
-    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
+    note: z18.string().optional().describe("Optional note or description for the provider"),
+    credit_limit: z18.coerce.number().positive().optional().describe("Credit limit for usage"),
+    alert_threshold: z18.coerce.number().min(0).max(100).optional().describe("Alert threshold percentage (0-100)"),
+    usage_limit_type: z18.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z18.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z17.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
-    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z18.coerce.number().positive().optional().describe("Must be provided together with rate_limit_unit."),
+    rate_limit_unit: z18.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Must be provided together with rate_limit_value. Values: 'rpm' (requests/min), 'rph' (requests/hour), or 'rpd' (requests/day)."
     ),
-    expires_at: z17.string().optional().describe("Expiration date in ISO 8601 format")
+    expires_at: z18.string().optional().describe("Expiration date in ISO 8601 format")
   },
   getProvider: {
-    slug: z17.string().describe("The unique slug identifier of the provider to retrieve"),
-    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z18.string().describe("The unique slug identifier of the provider to retrieve"),
+    workspace_id: z18.string().optional().describe("Workspace ID - required when using organization admin keys")
   },
   updateProvider: {
-    slug: z17.string().describe("The slug of the provider to update"),
-    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys"),
-    name: z17.string().optional().describe("New display name for the provider"),
-    note: z17.string().optional().describe("New note or description for the provider"),
-    credit_limit: z17.coerce.number().positive().optional().describe("New credit limit for usage"),
-    alert_threshold: z17.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
-    usage_limit_type: z17.enum(["cost", "tokens"]).optional().describe(
+    slug: z18.string().describe("The slug of the provider to update"),
+    workspace_id: z18.string().optional().describe("Workspace ID - required when using organization admin keys"),
+    name: z18.string().optional().describe("New display name for the provider"),
+    note: z18.string().optional().describe("New note or description for the provider"),
+    credit_limit: z18.coerce.number().positive().optional().describe("New credit limit for usage"),
+    alert_threshold: z18.coerce.number().min(0).max(100).optional().describe("New alert threshold percentage (0-100)"),
+    usage_limit_type: z18.enum(["cost", "tokens"]).optional().describe(
       "Type of usage limit: 'cost' (monetary) or 'tokens' (token count). Defaults to 'cost'."
     ),
-    periodic_reset: z17.enum(["monthly", "weekly"]).optional().describe(
+    periodic_reset: z18.enum(["monthly", "weekly"]).optional().describe(
       "Period for resetting usage limits: 'monthly' or 'weekly'. Defaults to 'monthly'."
     ),
-    rate_limit_value: z17.coerce.number().positive().optional().describe("New rate limit value"),
-    rate_limit_unit: z17.enum(["rpm", "rph", "rpd"]).optional().describe(
+    rate_limit_value: z18.coerce.number().positive().optional().describe("New rate limit value"),
+    rate_limit_unit: z18.enum(["rpm", "rph", "rpd"]).optional().describe(
       "Rate limit unit: 'rpm' (requests per minute), 'rph' (requests per hour), or 'rpd' (requests per day)"
     ),
-    expires_at: z17.string().optional().describe("New expiration date in ISO 8601 format"),
-    reset_usage: z17.boolean().optional().describe("Set to true to reset accumulated usage metrics")
+    expires_at: z18.string().optional().describe("New expiration date in ISO 8601 format"),
+    reset_usage: z18.boolean().optional().describe("Set to true to reset accumulated usage metrics")
   },
   deleteProvider: {
-    slug: z17.string().describe("The slug of the provider to delete"),
-    workspace_id: z17.string().optional().describe("Workspace ID - required when using organization admin keys")
+    slug: z18.string().describe("The slug of the provider to delete"),
+    workspace_id: z18.string().optional().describe("Workspace ID - required when using organization admin keys")
   }
 };
 function registerProvidersTools(server, service) {
@@ -6941,73 +7600,73 @@ function registerProvidersTools(server, service) {
 }
 
 // src/tools/secret-references.tools.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var authFields = {
-  aws_auth_type: z18.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
+  aws_auth_type: z19.enum(["accessKey", "assumedRole", "serviceRole"]).describe(
     "AWS authentication mode: accessKey uses a key pair, assumedRole uses an IAM role, and serviceRole uses the runtime workload identity"
   ),
-  aws_access_key_id: z18.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
-  aws_secret_access_key: z18.string().min(1).describe(
+  aws_access_key_id: z19.string().min(1).describe("AWS access key ID; required when aws_auth_type is accessKey"),
+  aws_secret_access_key: z19.string().min(1).describe(
     "AWS secret access key; required when aws_auth_type is accessKey and exposed to the MCP transcript"
   ),
-  aws_region: z18.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
-  aws_role_arn: z18.string().min(1).describe(
+  aws_region: z19.string().min(1).describe("AWS region containing the secret, for example us-east-1"),
+  aws_role_arn: z19.string().min(1).describe(
     "IAM role ARN to assume; required when aws_auth_type is assumedRole"
   ),
-  aws_external_id: z18.string().nullable().describe("Optional external ID required by the target IAM role"),
-  azure_auth_mode: z18.enum(["entra", "managed", "default"]).describe(
+  aws_external_id: z19.string().nullable().describe("Optional external ID required by the target IAM role"),
+  azure_auth_mode: z19.enum(["entra", "managed", "default"]).describe(
     "Azure authentication mode: entra uses a client secret, managed uses managed identity, and default uses the runtime credential chain"
   ),
-  azure_entra_tenant_id: z18.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
-  azure_entra_client_id: z18.string().min(1).describe(
+  azure_entra_tenant_id: z19.string().min(1).describe("Microsoft Entra tenant ID; required for entra authentication"),
+  azure_entra_client_id: z19.string().min(1).describe(
     "Microsoft Entra application client ID; required for entra authentication"
   ),
-  azure_entra_client_secret: z18.string().min(1).describe(
+  azure_entra_client_secret: z19.string().min(1).describe(
     "Microsoft Entra client secret; required for entra authentication and exposed to the MCP transcript"
   ),
-  azure_managed_client_id: z18.string().min(1).describe(
+  azure_managed_client_id: z19.string().min(1).describe(
     "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
   ),
-  azure_vault_url: z18.url().describe(
+  azure_vault_url: z19.url().describe(
     "Azure Key Vault URL, for example https://example.vault.azure.net"
   ),
-  vault_auth_type: z18.enum(["token", "approle", "kubernetes"]).describe(
+  vault_auth_type: z19.enum(["token", "approle", "kubernetes"]).describe(
     "HashiCorp Vault authentication mode: token, AppRole, or Kubernetes"
   ),
-  vault_addr: z18.url().describe("Base URL of the HashiCorp Vault server"),
-  vault_token: z18.string().min(1).describe(
+  vault_addr: z19.url().describe("Base URL of the HashiCorp Vault server"),
+  vault_token: z19.string().min(1).describe(
     "HashiCorp Vault token; required for token authentication and exposed to the MCP transcript"
   ),
-  vault_namespace: z18.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
-  vault_role_id: z18.string().min(1).describe(
+  vault_namespace: z19.string().min(1).describe("Optional HashiCorp Vault Enterprise namespace"),
+  vault_role_id: z19.string().min(1).describe(
     "HashiCorp Vault AppRole role ID; required for approle authentication"
   ),
-  vault_secret_id: z18.string().min(1).describe(
+  vault_secret_id: z19.string().min(1).describe(
     "HashiCorp Vault AppRole secret ID; required for approle authentication and exposed to the MCP transcript"
   ),
-  vault_role: z18.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
+  vault_role: z19.string().min(1).describe("HashiCorp Vault Kubernetes auth role name")
 };
-var authConfigSchema = z18.union([
-  z18.object({
-    aws_auth_type: z18.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
+var authConfigSchema = z19.union([
+  z19.object({
+    aws_auth_type: z19.literal("accessKey").describe("Use an AWS access key ID and secret access key"),
     aws_access_key_id: authFields.aws_access_key_id,
     aws_secret_access_key: authFields.aws_secret_access_key,
     aws_region: authFields.aws_region
   }).strict(),
-  z18.object({
-    aws_auth_type: z18.literal("assumedRole").describe("Assume the specified AWS IAM role"),
+  z19.object({
+    aws_auth_type: z19.literal("assumedRole").describe("Assume the specified AWS IAM role"),
     aws_role_arn: authFields.aws_role_arn,
     aws_external_id: authFields.aws_external_id.optional(),
     aws_region: authFields.aws_region
   }).strict(),
-  z18.object({
-    aws_auth_type: z18.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
-    aws_region: z18.string().optional().describe(
+  z19.object({
+    aws_auth_type: z19.literal("serviceRole").describe("Use the AWS workload or service role available at runtime"),
+    aws_region: z19.string().optional().describe(
       "Optional AWS region containing the secret, for example us-east-1"
     )
   }).strict(),
-  z18.object({
-    azure_auth_mode: z18.literal("entra").describe(
+  z19.object({
+    azure_auth_mode: z19.literal("entra").describe(
       "Authenticate with a Microsoft Entra application client secret"
     ),
     azure_entra_tenant_id: authFields.azure_entra_tenant_id,
@@ -7015,30 +7674,30 @@ var authConfigSchema = z18.union([
     azure_entra_client_secret: authFields.azure_entra_client_secret,
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z18.object({
-    azure_auth_mode: z18.literal("managed").describe("Authenticate with an Azure managed identity"),
+  z19.object({
+    azure_auth_mode: z19.literal("managed").describe("Authenticate with an Azure managed identity"),
     azure_managed_client_id: authFields.azure_managed_client_id.optional(),
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z18.object({
-    azure_auth_mode: z18.literal("default").describe("Use Azure's default runtime credential chain"),
+  z19.object({
+    azure_auth_mode: z19.literal("default").describe("Use Azure's default runtime credential chain"),
     azure_vault_url: authFields.azure_vault_url
   }).strict(),
-  z18.object({
-    vault_auth_type: z18.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
+  z19.object({
+    vault_auth_type: z19.literal("token").describe("Authenticate to HashiCorp Vault with a token"),
     vault_addr: authFields.vault_addr,
     vault_token: authFields.vault_token,
     vault_namespace: authFields.vault_namespace.optional()
   }).strict(),
-  z18.object({
-    vault_auth_type: z18.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
+  z19.object({
+    vault_auth_type: z19.literal("approle").describe("Authenticate to HashiCorp Vault with AppRole credentials"),
     vault_addr: authFields.vault_addr,
     vault_role_id: authFields.vault_role_id,
     vault_secret_id: authFields.vault_secret_id,
     vault_namespace: authFields.vault_namespace.optional()
   }).strict(),
-  z18.object({
-    vault_auth_type: z18.literal("kubernetes").describe(
+  z19.object({
+    vault_auth_type: z19.literal("kubernetes").describe(
       "Authenticate to HashiCorp Vault with a Kubernetes service account"
     ),
     vault_addr: authFields.vault_addr,
@@ -7046,61 +7705,61 @@ var authConfigSchema = z18.union([
     vault_namespace: authFields.vault_namespace.optional()
   }).strict()
 ]);
-var updateAuthConfigSchema = z18.union([
-  z18.object({
+var updateAuthConfigSchema = z19.union([
+  z19.object({
     aws_auth_type: authFields.aws_auth_type.optional(),
     aws_access_key_id: authFields.aws_access_key_id.optional(),
     aws_secret_access_key: authFields.aws_secret_access_key.optional(),
-    aws_region: z18.string().optional().describe("AWS region containing the secret, for example us-east-1"),
+    aws_region: z19.string().optional().describe("AWS region containing the secret, for example us-east-1"),
     aws_role_arn: authFields.aws_role_arn.optional(),
     aws_external_id: authFields.aws_external_id.optional()
   }).strict(),
-  z18.object({
+  z19.object({
     azure_auth_mode: authFields.azure_auth_mode.optional(),
     azure_entra_tenant_id: authFields.azure_entra_tenant_id.optional(),
     azure_entra_client_id: authFields.azure_entra_client_id.optional(),
     azure_entra_client_secret: authFields.azure_entra_client_secret.optional(),
-    azure_managed_client_id: z18.string().optional().describe(
+    azure_managed_client_id: z19.string().optional().describe(
       "Optional client ID of a user-assigned managed identity; omit for the system-assigned identity"
     ),
     azure_vault_url: authFields.azure_vault_url.optional()
   }).strict(),
-  z18.object({
+  z19.object({
     vault_auth_type: authFields.vault_auth_type.optional(),
     vault_addr: authFields.vault_addr.optional(),
     vault_token: authFields.vault_token.optional(),
-    vault_namespace: z18.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
+    vault_namespace: z19.string().optional().describe("Optional HashiCorp Vault Enterprise namespace"),
     vault_role_id: authFields.vault_role_id.optional(),
     vault_secret_id: authFields.vault_secret_id.optional(),
     vault_role: authFields.vault_role.optional()
   }).strict()
 ]);
-var managerTypeSchema = z18.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
+var managerTypeSchema = z19.enum(["aws_sm", "azure_kv", "hashicorp_vault"]).describe(
   "External secret manager: aws_sm for AWS Secrets Manager, azure_kv for Azure Key Vault, or hashicorp_vault for HashiCorp Vault; must match the auth_config field family"
 );
-var tagsSchema = z18.record(z18.string(), z18.string()).describe("Tag filters or metadata as string key-value pairs");
+var tagsSchema = z19.record(z19.string(), z19.string()).describe("Tag filters or metadata as string key-value pairs");
 var SECRET_REFERENCE_TOOL_SCHEMAS = {
   create: {
-    name: z18.string().min(1).max(255).describe("Human-readable name"),
+    name: z19.string().min(1).max(255).describe("Human-readable name"),
     manager_type: managerTypeSchema,
     auth_config: authConfigSchema.describe(
       "Choose exactly one documented authentication shape matching manager_type. Credentials are sent to Portkey and visible in the MCP transcript; prefer workload identity or short-lived credentials when available."
     ),
-    secret_path: z18.string().max(1024).describe("Path of the secret in the external secret manager"),
-    organisation_id: z18.string().uuid().optional().describe(
+    secret_path: z19.string().max(1024).describe("Path of the secret in the external secret manager"),
+    organisation_id: z19.string().uuid().optional().describe(
       "Organisation UUID; required when the MCP server is not authenticated with a Portkey API key"
     ),
-    slug: z18.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
+    slug: z19.string().max(255).regex(/^[a-zA-Z0-9_-]+$/).optional().describe(
       "Optional stable slug containing only letters, numbers, underscores, or hyphens; Portkey generates one when omitted"
     ),
-    description: z18.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
-    secret_key: z18.string().max(255).nullable().optional().describe(
+    description: z19.string().max(1024).nullable().optional().describe("Optional description; use null to leave it empty"),
+    secret_key: z19.string().max(255).nullable().optional().describe(
       "Optional key within a structured external secret; null uses the whole secret value"
     ),
-    allow_all_workspaces: z18.boolean().optional().describe(
+    allow_all_workspaces: z19.boolean().optional().describe(
       "Whether every workspace may use this reference; defaults to true and cannot be true with allowed_workspaces"
     ),
-    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+    allowed_workspaces: z19.array(z19.string()).min(1).optional().describe(
       "Workspace UUIDs or slugs allowed to use this reference; omit when allow_all_workspaces is true"
     ),
     tags: tagsSchema.nullable().optional().describe(
@@ -7112,34 +7771,34 @@ var SECRET_REFERENCE_TOOL_SCHEMAS = {
       "Filter by external secret manager: aws_sm, azure_kv, or hashicorp_vault"
     ),
     tags: tagsSchema.optional().describe("Return references matching these tags"),
-    search: z18.string().min(1).max(255).optional().describe("Search references by name"),
-    current_page: z18.coerce.number().int().nonnegative().optional().describe("Zero-based page number; defaults to 0"),
-    page_size: z18.coerce.number().int().min(1).max(100).optional().describe("References per page, from 1 to 100; defaults to 20")
+    search: z19.string().min(1).max(255).optional().describe("Search references by name"),
+    current_page: z19.coerce.number().int().nonnegative().optional().describe("Zero-based page number; defaults to 0"),
+    page_size: z19.coerce.number().int().min(1).max(100).optional().describe("References per page, from 1 to 100; defaults to 20")
   },
   get: {
-    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+    id: z19.string().min(1).describe("Secret Reference UUID or slug")
   },
   update: {
-    id: z18.string().min(1).describe("Secret Reference UUID or slug"),
-    name: z18.string().min(1).max(255).optional().describe("New human-readable name"),
-    description: z18.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
+    id: z19.string().min(1).describe("Secret Reference UUID or slug"),
+    name: z19.string().min(1).max(255).optional().describe("New human-readable name"),
+    description: z19.string().max(1024).nullable().optional().describe("New description, or null to clear it"),
     auth_config: updateAuthConfigSchema.optional().describe(
       "Provide at least one changed authentication field to merge into the existing configuration; choose one AWS, Azure, or HashiCorp field family and do not mix families"
     ),
-    secret_path: z18.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
-    secret_key: z18.string().max(255).nullable().optional().describe(
+    secret_path: z19.string().max(1024).optional().describe("New path of the secret in the external secret manager"),
+    secret_key: z19.string().max(255).nullable().optional().describe(
       "New key within a structured secret, or null to use the whole value"
     ),
-    allow_all_workspaces: z18.boolean().optional().describe(
+    allow_all_workspaces: z19.boolean().optional().describe(
       "Whether every workspace may use this reference; cannot be true with allowed_workspaces"
     ),
-    allowed_workspaces: z18.array(z18.string()).min(1).optional().describe(
+    allowed_workspaces: z19.array(z19.string()).min(1).optional().describe(
       "Replacement list of workspace UUIDs or slugs allowed to use this reference; supplying it sets allow_all_workspaces=false"
     ),
     tags: tagsSchema.nullable().optional().describe("Replacement string key-value tags, or null to clear them")
   },
   delete: {
-    id: z18.string().min(1).describe("Secret Reference UUID or slug")
+    id: z19.string().min(1).describe("Secret Reference UUID or slug")
   }
 };
 function validateWorkspaceAccess(value) {
@@ -7338,29 +7997,29 @@ function registerSecretReferencesTools(server, service) {
 }
 
 // src/tools/tracing.tools.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var TRACING_TOOL_SCHEMAS = {
   createFeedback: {
-    trace_id: z19.string().describe(
+    trace_id: z20.string().describe(
       "The trace ID to associate the feedback with. This links feedback to a specific request/generation."
     ),
-    value: z19.coerce.number().describe(
+    value: z20.coerce.number().describe(
       "Feedback value/rating. Common patterns: 1 for positive (thumbs up), 0 for negative (thumbs down), or use a scale like 1-5."
     ),
-    weight: z19.coerce.number().positive().optional().describe(
+    weight: z20.coerce.number().positive().optional().describe(
       "Optional weighting factor for the feedback. Use to give more importance to certain feedback."
     ),
-    metadata: z19.record(z19.string(), z19.unknown()).optional().describe(
+    metadata: z20.record(z20.string(), z20.unknown()).optional().describe(
       "Optional custom metadata for categorization and analysis (e.g., feedback_source, category, user_segment)."
     )
   },
   updateFeedback: {
-    id: z19.string().describe("The unique identifier of the feedback to update"),
-    value: z19.coerce.number().optional().describe(
+    id: z20.string().describe("The unique identifier of the feedback to update"),
+    value: z20.coerce.number().optional().describe(
       "New feedback value/rating. Common patterns: 1 for positive, 0 for negative."
     ),
-    weight: z19.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
-    metadata: z19.record(z19.string(), z19.unknown()).optional().describe("New or updated custom metadata for the feedback")
+    weight: z20.coerce.number().positive().optional().describe("New weighting factor for the feedback"),
+    metadata: z20.record(z20.string(), z20.unknown()).optional().describe("New or updated custom metadata for the feedback")
   }
 };
 function registerTracingTools(server, service) {
@@ -7416,77 +8075,77 @@ function registerTracingTools(server, service) {
 }
 
 // src/tools/users.tools.ts
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var USERS_TOOL_SCHEMAS = {
   listAllUsers: {
-    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z21.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   inviteUser: {
-    email: z20.string().email().describe("Email address of the user to invite"),
-    role: z20.enum(["admin", "member"]).describe(
+    email: z21.string().email().describe("Email address of the user to invite"),
+    role: z21.enum(["admin", "member"]).describe(
       "Organization-level role: 'admin' for full access, 'member' for limited access"
     ),
-    first_name: z20.string().optional().describe("User's first name"),
-    last_name: z20.string().optional().describe("User's last name"),
-    workspaces: z20.array(
-      z20.object({
-        id: z20.string().describe(
+    first_name: z21.string().optional().describe("User's first name"),
+    last_name: z21.string().optional().describe("User's last name"),
+    workspaces: z21.array(
+      z21.object({
+        id: z21.string().describe(
           "Workspace ID/slug where the user will be granted access"
         ),
-        role: z20.enum(["admin", "member", "manager"]).describe(
+        role: z21.enum(["admin", "member", "manager"]).describe(
           "Workspace-level role: 'admin' for full access, 'manager' for workspace management, 'member' for basic access"
         )
       })
     ).describe(
       "List of workspaces and corresponding roles to grant to the user"
     ),
-    workspace_api_key_details: z20.object({
-      name: z20.string().optional().describe("Name of the API key to be created"),
-      expiry: z20.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
-      metadata: z20.record(z20.string(), z20.string()).optional().describe("Additional metadata key-value pairs for the API key"),
-      scopes: z20.array(z20.string()).describe("List of permission scopes for the API key")
+    workspace_api_key_details: z21.object({
+      name: z21.string().optional().describe("Name of the API key to be created"),
+      expiry: z21.string().optional().describe("Expiration date for the API key (ISO8601 format)"),
+      metadata: z21.record(z21.string(), z21.string()).optional().describe("Additional metadata key-value pairs for the API key"),
+      scopes: z21.array(z21.string()).describe("List of permission scopes for the API key")
     }).optional().describe("Optional API key to be created for the user")
   },
   getUserStats: {
-    time_of_generation_min: z20.string().describe(
+    time_of_generation_min: z21.string().describe(
       "Start time for the analytics period (ISO8601 format, e.g., '2024-01-01T00:00:00Z')"
     ),
-    time_of_generation_max: z20.string().describe(
+    time_of_generation_max: z21.string().describe(
       "End time for the analytics period (ISO8601 format, e.g., '2024-02-01T00:00:00Z')"
     ),
-    total_units_min: z20.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
-    total_units_max: z20.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
-    cost_min: z20.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
-    cost_max: z20.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
-    status_code: z20.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
-    virtual_keys: z20.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
-    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    total_units_min: z21.coerce.number().positive().optional().describe("Minimum number of total tokens to filter by"),
+    total_units_max: z21.coerce.number().positive().optional().describe("Maximum number of total tokens to filter by"),
+    cost_min: z21.coerce.number().positive().optional().describe("Minimum cost in cents to filter by"),
+    cost_max: z21.coerce.number().positive().optional().describe("Maximum cost in cents to filter by"),
+    status_code: z21.string().optional().describe("Filter by specific HTTP status codes (comma-separated)"),
+    virtual_keys: z21.string().optional().describe("Filter by specific virtual key slugs (comma-separated)"),
+    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUser: {
-    user_id: z20.string().describe("The user ID to retrieve")
+    user_id: z21.string().describe("The user ID to retrieve")
   },
   updateUser: {
-    user_id: z20.string().describe("The user ID to update"),
-    first_name: z20.string().optional().describe("New first name"),
-    last_name: z20.string().optional().describe("New last name"),
-    role: z20.enum(["admin", "member"]).optional().describe("New organization-level role")
+    user_id: z21.string().describe("The user ID to update"),
+    first_name: z21.string().optional().describe("New first name"),
+    last_name: z21.string().optional().describe("New last name"),
+    role: z21.enum(["admin", "member"]).optional().describe("New organization-level role")
   },
   deleteUser: {
-    user_id: z20.string().describe("The user ID to delete")
+    user_id: z21.string().describe("The user ID to delete")
   },
   listUserInvites: {
-    current_page: z20.coerce.number().int().positive().optional().describe("Page number for pagination"),
-    page_size: z20.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
+    current_page: z21.coerce.number().int().positive().optional().describe("Page number for pagination"),
+    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of results per page (max 100)")
   },
   getUserInvite: {
-    invite_id: z20.string().describe("The invite ID to retrieve")
+    invite_id: z21.string().describe("The invite ID to retrieve")
   },
   deleteUserInvite: {
-    invite_id: z20.string().describe("The invite ID to delete")
+    invite_id: z21.string().describe("The invite ID to delete")
   },
   resendUserInvite: {
-    invite_id: z20.string().describe("The invite ID to resend")
+    invite_id: z21.string().describe("The invite ID to resend")
   }
 };
 function formatUser(user) {
@@ -7712,59 +8371,97 @@ function registerUsersTools(server, service) {
 }
 
 // src/tools/workspaces.tools.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
+var scimWorkspaceMappingBaseShape = {
+  workspace_id: z22.string().describe("Portkey workspace ID that the SCIM group should access"),
+  role: z22.enum(["admin", "member", "manager"]).describe("Workspace role automatically granted to group members")
+};
+var createScimWorkspaceMappingInputSchema = z22.object({
+  ...scimWorkspaceMappingBaseShape,
+  scim_group_id: z22.string().min(1).optional().describe(
+    "Existing identity-provider SCIM group ID; provide this or scim_group_name, but not both"
+  ),
+  scim_group_name: z22.string().min(1).optional().describe(
+    "Existing SCIM group display name; provide this or scim_group_id, but not both"
+  )
+}).superRefine((input, context) => {
+  if (Boolean(input.scim_group_id) === Boolean(input.scim_group_name)) {
+    context.addIssue({
+      code: "custom",
+      path: ["scim_group_id"],
+      message: "Provide exactly one of scim_group_id or scim_group_name"
+    });
+  }
+});
 var WORKSPACES_TOOL_SCHEMAS = {
   listWorkspaces: {
-    page_size: z21.coerce.number().int().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
-    current_page: z21.coerce.number().int().positive().optional().describe("Page number to retrieve when results are paginated")
+    page_size: z22.coerce.number().int().positive().max(100).optional().describe("Number of workspaces to return per page (max 100)"),
+    current_page: z22.coerce.number().int().positive().optional().describe("Page number to retrieve when results are paginated")
   },
   getWorkspace: {
-    workspace_id: z21.string().describe(
+    workspace_id: z22.string().describe(
       "The unique identifier of the workspace to retrieve. This can be found in the workspace's URL or from the list_workspaces tool response"
     )
   },
   createWorkspace: {
-    name: z21.string().describe("Name of the workspace"),
-    slug: z21.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
-    description: z21.string().optional().describe("Description of the workspace"),
-    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z21.record(z21.string(), z21.string()).optional().describe("Custom metadata key-value pairs")
+    name: z22.string().describe("Name of the workspace"),
+    slug: z22.string().optional().describe("URL-friendly slug (auto-generated if not provided)"),
+    description: z22.string().optional().describe("Description of the workspace"),
+    is_default: z22.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z22.record(z22.string(), z22.string()).optional().describe("Custom metadata key-value pairs")
   },
   updateWorkspace: {
-    workspace_id: z21.string().describe("The workspace ID to update"),
-    name: z21.string().optional().describe("New name for the workspace"),
-    slug: z21.string().optional().describe("New slug for the workspace"),
-    description: z21.string().optional().describe("New description"),
-    is_default: z21.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
-    metadata: z21.record(z21.string(), z21.string()).optional().describe("New metadata key-value pairs")
+    workspace_id: z22.string().describe("The workspace ID to update"),
+    name: z22.string().optional().describe("New name for the workspace"),
+    slug: z22.string().optional().describe("New slug for the workspace"),
+    description: z22.string().optional().describe("New description"),
+    is_default: z22.coerce.number().optional().describe("Set as default workspace (1 = yes, 0 = no)"),
+    metadata: z22.record(z22.string(), z22.string()).optional().describe("New metadata key-value pairs")
   },
   deleteWorkspace: {
-    workspace_id: z21.string().describe("The workspace ID to delete")
+    workspace_id: z22.string().describe("The workspace ID to delete")
   },
   addWorkspaceMember: {
-    workspace_id: z21.string().describe("The workspace ID to add the member to"),
-    user_id: z21.string().uuid(
+    workspace_id: z22.string().describe("The workspace ID to add the member to"),
+    user_id: z22.string().uuid(
       "user_id must be a valid UUID (use list_all_users to find user IDs)"
     ).describe(
       "The user ID to add (must be a valid UUID from list_all_users, not an email address)"
     ),
-    role: z21.enum(["admin", "member", "manager"]).describe("Role in the workspace")
+    role: z22.enum(["admin", "member", "manager"]).describe("Role in the workspace")
   },
   listWorkspaceMembers: {
-    workspace_id: z21.string().describe("The workspace ID to list members for")
+    workspace_id: z22.string().describe("The workspace ID to list members for")
   },
   getWorkspaceMember: {
-    workspace_id: z21.string().describe("The workspace ID"),
-    user_id: z21.string().describe("The user ID to retrieve")
+    workspace_id: z22.string().describe("The workspace ID"),
+    user_id: z22.string().describe("The user ID to retrieve")
   },
   updateWorkspaceMember: {
-    workspace_id: z21.string().describe("The workspace ID"),
-    user_id: z21.string().describe("The user ID to update"),
-    role: z21.enum(["admin", "member", "manager"]).describe("New role in the workspace")
+    workspace_id: z22.string().describe("The workspace ID"),
+    user_id: z22.string().describe("The user ID to update"),
+    role: z22.enum(["admin", "member", "manager"]).describe("New role in the workspace")
   },
   removeWorkspaceMember: {
-    workspace_id: z21.string().describe("The workspace ID"),
-    user_id: z21.string().describe("The user ID to remove")
+    workspace_id: z22.string().describe("The workspace ID"),
+    user_id: z22.string().describe("The user ID to remove")
+  },
+  listScimWorkspaceMappings: {
+    workspace_id: z22.string().optional().describe("Return only mappings for this Portkey workspace ID"),
+    scim_group_id: z22.string().optional().describe(
+      "Return only mappings for this identity-provider SCIM group ID"
+    ),
+    role: z22.enum(["admin", "member", "manager"]).optional().describe("Return only mappings that grant this workspace role"),
+    page: z22.coerce.number().int().nonnegative().optional().describe("Zero-based results page to retrieve; the first page is 0"),
+    page_size: z22.coerce.number().int().positive().max(100).optional().describe("Mappings per page, from 1 through 100")
+  },
+  deleteScimWorkspaceMapping: {
+    mapping_id: z22.string().describe("SCIM workspace mapping ID from list_scim_workspace_mappings")
+  },
+  listScimGroups: {
+    search: z22.string().optional().describe("Case-insensitive text to match against SCIM group names"),
+    page: z22.coerce.number().int().nonnegative().optional().describe("Zero-based results page to retrieve; the first page is 0"),
+    page_size: z22.coerce.number().int().positive().max(100).optional().describe("SCIM groups per page, from 1 through 100")
   }
 };
 function formatWorkspaceDefaults(defaults) {
@@ -7811,6 +8508,114 @@ function formatWorkspaceDetail(workspace) {
   };
 }
 function registerWorkspacesTools(server, service) {
+  server.tool(
+    "list_scim_workspace_mappings",
+    "List identity-provider SCIM group mappings that automatically grant Portkey workspace roles. Use it to audit provisioned access or obtain mapping_id before delete_scim_workspace_mapping; filter by workspace, group, or role and page through large directories. This reads mappings only and does not query individual workspace members.",
+    WORKSPACES_TOOL_SCHEMAS.listScimWorkspaceMappings,
+    {
+      title: "List SCIM Workspace Mappings",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(
+            await service.workspaces.listScimWorkspaceMappings(params)
+          )
+        }
+      ]
+    })
+  );
+  server.registerTool(
+    "create_scim_workspace_mapping",
+    {
+      description: "Map one identity-provider SCIM group to a Portkey workspace role so current and future group members receive access automatically. Provide exactly one of scim_group_id or scim_group_name; a name can pre-create the Portkey SCIM group before the IdP provisions it. Use list_scim_groups to discover existing groups and list_workspaces for the workspace ID. This changes access provisioning and is distinct from add_workspace_member, which grants one user directly.",
+      inputSchema: createScimWorkspaceMappingInputSchema,
+      annotations: {
+        title: "Create SCIM Workspace Mapping",
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    },
+    async (params) => {
+      let request;
+      if (params.scim_group_id !== void 0) {
+        request = {
+          workspace_id: params.workspace_id,
+          role: params.role,
+          scim_group_id: params.scim_group_id
+        };
+      } else if (params.scim_group_name !== void 0) {
+        request = {
+          workspace_id: params.workspace_id,
+          role: params.role,
+          scim_group_name: params.scim_group_name
+        };
+      } else {
+        throw new Error(
+          "Provide exactly one of scim_group_id or scim_group_name"
+        );
+      }
+      const result = await service.workspaces.createScimWorkspaceMapping(request);
+      return {
+        content: [{ type: "text", text: JSON.stringify(result) }]
+      };
+    }
+  );
+  server.tool(
+    "delete_scim_workspace_mapping",
+    "Delete a SCIM group-to-workspace mapping by mapping_id and stop future group updates from affecting that workspace. Existing provisioned members remain in the workspace and must be managed separately. Inspect list_scim_workspace_mappings first; this does not delete the identity-provider group or the Portkey workspace.",
+    WORKSPACES_TOOL_SCHEMAS.deleteScimWorkspaceMapping,
+    {
+      title: "Delete SCIM Workspace Mapping",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => {
+      const result = await service.workspaces.deleteScimWorkspaceMapping(
+        params.mapping_id
+      );
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({
+              message: `Deleted SCIM workspace mapping "${params.mapping_id}"`,
+              ...result
+            })
+          }
+        ]
+      };
+    }
+  );
+  server.tool(
+    "list_scim_groups",
+    "Search and page through identity-provider groups synchronized to Portkey over SCIM. Use this to resolve a group ID or exact display name before create_scim_workspace_mapping; it reads directory groups only and does not show their workspace mappings or individual members.",
+    WORKSPACES_TOOL_SCHEMAS.listScimGroups,
+    {
+      title: "List SCIM Groups",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    async (params) => ({
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify(await service.workspaces.listScimGroups(params))
+        }
+      ]
+    })
+  );
   server.tool(
     "list_workspaces",
     "List workspaces with id, name, slug, default settings, and timestamps. Use this to find a workspace_id before get_workspace, update_workspace, add_workspace_member, or remove_workspace_member.",
@@ -8117,7 +8922,25 @@ var ENTERPRISE_GATED_TOOL_NAMES = /* @__PURE__ */ new Set([
   "list_all_users",
   "get_user",
   "list_user_invites",
-  "get_user_stats"
+  "get_user_stats",
+  "get_organisation_defaults",
+  "update_organisation_defaults",
+  "list_input_guardrail_workspace_exclusions",
+  "update_input_guardrail_workspace_exclusions",
+  "list_output_guardrail_workspace_exclusions",
+  "update_output_guardrail_workspace_exclusions",
+  "create_log_export",
+  "list_log_exports",
+  "get_log_export",
+  "start_log_export",
+  "cancel_log_export",
+  "download_log_export",
+  "update_log_export",
+  "get_log_export_field_restrictions",
+  "list_scim_workspace_mappings",
+  "create_scim_workspace_mapping",
+  "delete_scim_workspace_mapping",
+  "list_scim_groups"
 ]);
 var ENTERPRISE_GATED_DESCRIPTION_NOTE = "Enterprise-gated. Returns 403 on non-Enterprise Portkey plans.";
 function isToolAnnotationsLike(value) {
@@ -8174,71 +8997,71 @@ function getToolErrorMessage(error) {
   return String(error);
 }
 var STANDARD_TOOL_OUTPUT_SCHEMA = {
-  ok: z22.boolean().describe("Whether the tool call succeeded and returned structured data"),
-  data: z22.unknown().optional().describe("Structured success payload when ok is true"),
-  error: z22.object({
-    message: z22.string().describe("Human-readable error message"),
-    details: z22.unknown().optional().describe("Optional structured error details")
+  ok: z23.boolean().describe("Whether the tool call succeeded and returned structured data"),
+  data: z23.unknown().optional().describe("Structured success payload when ok is true"),
+  error: z23.object({
+    message: z23.string().describe("Human-readable error message"),
+    details: z23.unknown().optional().describe("Optional structured error details")
   }).optional().describe("Structured error payload when ok is false")
 };
 var TOOL_SUCCESS_DATA_SCHEMAS = {
-  rotate_api_key: z22.object({
-    message: z22.string().describe("Rotation confirmation"),
-    warning: z22.string().describe("Required handling guidance for the one-time secret"),
-    id: z22.string().uuid().describe("Rotated API key UUID"),
-    key: z22.string().describe("New API key secret, returned only once"),
-    key_transition_expires_at: z22.iso.datetime().describe("Time when the previous key stops working")
+  rotate_api_key: z23.object({
+    message: z23.string().describe("Rotation confirmation"),
+    warning: z23.string().describe("Required handling guidance for the one-time secret"),
+    id: z23.string().uuid().describe("Rotated API key UUID"),
+    key: z23.string().describe("New API key secret, returned only once"),
+    key_transition_expires_at: z23.iso.datetime().describe("Time when the previous key stops working")
   }),
-  create_secret_reference: z22.object({
-    message: z22.string().describe("Creation confirmation"),
-    id: z22.string().uuid().describe("New Secret Reference UUID"),
-    slug: z22.string().describe("New Secret Reference slug")
+  create_secret_reference: z23.object({
+    message: z23.string().describe("Creation confirmation"),
+    id: z23.string().uuid().describe("New Secret Reference UUID"),
+    slug: z23.string().describe("New Secret Reference slug")
   }),
-  list_secret_references: z22.object({
-    total: z22.number().int().nonnegative().describe("Total matching references"),
-    secret_references: z22.array(
-      z22.object({
-        id: z22.string().uuid().describe("Secret Reference UUID"),
-        name: z22.string().describe("Human-readable name"),
-        slug: z22.string().describe("Stable Secret Reference slug"),
+  list_secret_references: z23.object({
+    total: z23.number().int().nonnegative().describe("Total matching references"),
+    secret_references: z23.array(
+      z23.object({
+        id: z23.string().uuid().describe("Secret Reference UUID"),
+        name: z23.string().describe("Human-readable name"),
+        slug: z23.string().describe("Stable Secret Reference slug"),
         manager_type: SecretManagerTypeSchema.describe(
           "External secret manager type"
         ),
-        status: z22.literal("ACTIVE").describe("Current reference status"),
-        created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
-        last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp")
+        status: z23.literal("ACTIVE").describe("Current reference status"),
+        created_at: z23.iso.datetime().describe("ISO 8601 creation timestamp"),
+        last_updated_at: z23.iso.datetime().describe("ISO 8601 last-update timestamp")
       })
     ).describe(
       "Current page of Secret References without authentication values"
     )
   }),
-  get_secret_reference: z22.object({
-    id: z22.string().uuid().describe("Secret Reference UUID"),
-    organisation_id: z22.string().uuid().describe("Owning organisation UUID"),
-    name: z22.string().describe("Human-readable name"),
-    slug: z22.string().describe("Stable Secret Reference slug"),
-    description: z22.string().nullable().describe("Reference description"),
+  get_secret_reference: z23.object({
+    id: z23.string().uuid().describe("Secret Reference UUID"),
+    organisation_id: z23.string().uuid().describe("Owning organisation UUID"),
+    name: z23.string().describe("Human-readable name"),
+    slug: z23.string().describe("Stable Secret Reference slug"),
+    description: z23.string().nullable().describe("Reference description"),
     manager_type: SecretManagerTypeSchema.describe(
       "External secret manager type"
     ),
-    secret_path: z22.string().describe("Path in the external secret manager"),
-    secret_key: z22.string().nullable().describe("Selected key within a structured secret"),
-    allow_all_workspaces: z22.boolean().describe("Whether all workspaces may use the reference"),
-    tags: z22.record(z22.string(), z22.string()).nullable().describe("String metadata tags"),
-    status: z22.literal("ACTIVE").describe("Current reference status"),
-    created_by: z22.string().describe("Creator identifier"),
-    created_at: z22.iso.datetime().describe("ISO 8601 creation timestamp"),
-    last_updated_at: z22.iso.datetime().describe("ISO 8601 last-update timestamp"),
-    auth_config: z22.record(z22.string(), z22.unknown()).describe("Authentication configuration with sensitive values redacted"),
-    object: z22.literal("secret-reference").describe("Portkey object type")
+    secret_path: z23.string().describe("Path in the external secret manager"),
+    secret_key: z23.string().nullable().describe("Selected key within a structured secret"),
+    allow_all_workspaces: z23.boolean().describe("Whether all workspaces may use the reference"),
+    tags: z23.record(z23.string(), z23.string()).nullable().describe("String metadata tags"),
+    status: z23.literal("ACTIVE").describe("Current reference status"),
+    created_by: z23.string().describe("Creator identifier"),
+    created_at: z23.iso.datetime().describe("ISO 8601 creation timestamp"),
+    last_updated_at: z23.iso.datetime().describe("ISO 8601 last-update timestamp"),
+    auth_config: z23.record(z23.string(), z23.unknown()).describe("Authentication configuration with sensitive values redacted"),
+    object: z23.literal("secret-reference").describe("Portkey object type")
   }),
-  update_secret_reference: z22.object({
-    message: z22.string().describe("Update confirmation"),
-    success: z22.literal(true).describe("Whether the update succeeded")
+  update_secret_reference: z23.object({
+    message: z23.string().describe("Update confirmation"),
+    success: z23.literal(true).describe("Whether the update succeeded")
   }),
-  delete_secret_reference: z22.object({
-    message: z22.string().describe("Deletion confirmation"),
-    success: z22.literal(true).describe("Whether the deletion succeeded")
+  delete_secret_reference: z23.object({
+    message: z23.string().describe("Deletion confirmation"),
+    success: z23.literal(true).describe("Whether the deletion succeeded")
   })
 };
 function getToolOutputSchema(toolName) {
@@ -8383,6 +9206,36 @@ function createSafeToolServer(server) {
       args
     );
   };
+  safeServer.registerTool = ((name, config, callback) => {
+    const description = augmentToolDescription(
+      name,
+      typeof config.description === "string" ? config.description : void 0
+    );
+    const annotations = {
+      ...inferToolAnnotations(name),
+      ...isToolAnnotationsLike(config.annotations) ? config.annotations : {}
+    };
+    const wrappedCallback = wrapToolCallback(name, callback);
+    if (originalRegisterTool) {
+      return callOriginalRegisterTool(
+        name,
+        {
+          ...config,
+          ...description === void 0 ? {} : { description },
+          outputSchema: config.outputSchema ?? getToolOutputSchema(name),
+          annotations
+        },
+        wrappedCallback
+      );
+    }
+    const legacyArguments = [
+      ...description === void 0 ? [] : [description],
+      ...config.inputSchema === void 0 ? [] : [config.inputSchema],
+      annotations,
+      wrappedCallback
+    ];
+    return callOriginalTool(name, ...legacyArguments);
+  });
   safeServer.tool = ((name, ...rest) => {
     const maybeCallback = rest.at(-1);
     if (typeof maybeCallback !== "function") {
@@ -9314,7 +10167,7 @@ function createManagedEventStore(config) {
 // src/lib/mcp-server.ts
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var PACKAGE_JSON_URL_CANDIDATES = [
   new URL("../../package.json", import.meta.url),
   new URL("../package.json", import.meta.url)
@@ -9387,8 +10240,8 @@ function registerServerPromptsAndResources(server) {
       title: "Plan Portkey Admin Workflow",
       description: "Create a concise, safe plan for a Portkey Admin API task using this MCP server.",
       argsSchema: {
-        task: z23.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
-        area: z23.string().max(80).optional().describe(
+        task: z24.string().min(1).max(500).describe("Portkey admin task to plan, such as promoting a prompt"),
+        area: z24.string().max(80).optional().describe(
           "Optional Portkey area, such as prompts, analytics, configs, or users"
         )
       }