@@ -32,6 +32,7 @@ vi.mock('@/lib/mothership/tasks/application/context', () => ({ TASK_DELEGATION_A
 vi.mock('@/lib/mothership/tasks/wake', () => ({ runWakeTurn: vi.fn() }))
 
 import { env } from '@/lib/core/config/env'
+import type { IntegrationCatalogRequest } from '@/lib/mothership/generated/integration-catalog'
 import { executeSimControl } from '@/lib/mothership/transport/control'
 import { POST } from '@/app/api/mothership/integrations/catalog/route'
 
@@ -41,7 +42,10 @@ const scope = {
   chatId: '33333333-3333-4333-8333-333333333333',
 }
 const input = { mode: 'agent' as const, mcpServerIds: [], toolId: 'gmail_send', limit: 1 }
-function request(key = env.INTERNAL_API_SECRET ?? '') {
+function request(
+  key = env.INTERNAL_API_SECRET ?? '',
+  catalogInput: IntegrationCatalogRequest = input
+) {
   return new NextRequest('http://localhost/api/mothership/integrations/catalog', {
     method: 'POST',
     headers: {
@@ -51,15 +55,15 @@ function request(key = env.INTERNAL_API_SECRET ?? '') {
       'x-mothership-workspace-id': scope.workspaceId,
       'x-mothership-chat-id': scope.chatId,
     },
-    body: JSON.stringify(input),
+    body: JSON.stringify(catalogInput),
   })
 }
-function checkpoint() {
+function checkpoint(catalogInput: IntegrationCatalogRequest = input) {
   return executeSimControl({
     id: 'catalog-control',
     scope,
     expiresAt: Date.now() + 5000,
-    operation: { kind: 'integration_catalog', input },
+    operation: { kind: 'integration_catalog', input: catalogInput },
   })
 }
 beforeEach(() => {
@@ -80,6 +84,37 @@ beforeEach(() => {
   ])
 })
 describe('direct and checkpoint catalog authorization parity', () => {
+  it.each(['google-email', 'Gmail', 'gmail'])(
+    'resolves %s identically through hosted HTTP and self-hosted outbound control',
+    async (service) => {
+      const query = { mode: 'agent' as const, mcpServerIds: [], service, query: 'email', limit: 5 }
+      const direct = await POST(request(undefined, query))
+      const outbound = await checkpoint(query)
+      expect(direct.status).toBe(200)
+      expect(outbound.status).toBe(200)
+      const body = await direct.json()
+      expect(body).toEqual(JSON.parse(outbound.body))
+      expect(body.operations).toEqual([
+        {
+          toolId: 'gmail_send',
+          service: 'gmail',
+          description: 'Send email',
+          inputSchema: { type: 'object' },
+        },
+      ])
+    }
+  )
+
+  it('reports an invalid service filter as a validation error on both transports', async () => {
+    const query = { ...input, service: 'not-a-service' }
+    const direct = await POST(request(undefined, query))
+    const outbound = await checkpoint(query)
+    expect(direct.status).toBe(400)
+    expect(outbound.status).toBe(400)
+    expect(JSON.stringify(await direct.json())).toContain('Unknown integration service')
+    expect(outbound.body).toContain('Unknown integration service')
+  })
+
   it('returns identical authorized schema responses through HTTP and outbound control', async () => {
     const direct = await POST(request())
     const outbound = await checkpoint()
 
@@ -0,0 +1,52 @@
+/** @vitest-environment node */
+import { INTEGRATION_METADATA } from '@sim/deployment-config/integration-metadata'
+import { stripVersionSuffix } from '@sim/utils/string'
+import { describe, expect, it, vi } from 'vitest'
+import { getExposedIntegrationTools } from '@/lib/integrations/tool-catalog'
+import type { ToolSchema } from '@/lib/mothership/chat/payload'
+import { projectIntegrationCatalog } from '@/lib/mothership/integrations/application/catalog'
+
+/** Registration assertions must exercise the executable registry, not the global empty mock. */
+vi.unmock('@/tools/registry')
+vi.mock('@/lib/mothership/chat/payload', () => ({ buildIntegrationToolSchemas: vi.fn() }))
+vi.mock('@/lib/mothership/mcp-tools', () => ({ buildTaggedMcpToolSchemas: vi.fn() }))
+vi.mock('@/lib/mcp/application/use-cases', () => ({ listMcpServersUseCase: { execute: vi.fn() } }))
+
+const tools: ToolSchema[] = getExposedIntegrationTools().map((tool) => ({
+  name: tool.toolId,
+  service: tool.service,
+  description: tool.config.description,
+  input_schema: {},
+}))
+const input = { mode: 'agent' as const, mcpServerIds: [], limit: 0 }
+
+describe('integration discovery identity registry', () => {
+  it('preserves every existing callable service ID, including services outside the public catalog', () => {
+    const services = new Set(tools.map((tool) => tool.service))
+    expect(services.has('google_calendar')).toBe(true)
+    for (const service of services) {
+      const result = projectIntegrationCatalog(tools, { ...input, service })
+      expect(result.operations.map((operation) => operation.toolId).sort()).toEqual(
+        tools
+          .filter((tool) => tool.service === service)
+          .map((tool) => tool.name)
+          .sort()
+      )
+    }
+  })
+
+  it('keeps generated integration names and slugs aligned with the real callable catalog', () => {
+    const services = new Set(tools.map((tool) => tool.service))
+    for (const integration of INTEGRATION_METADATA) {
+      const service = stripVersionSuffix(integration.type)
+      if (!services.has(service)) continue
+      const canonical = projectIntegrationCatalog(tools, { ...input, service })
+      for (const alias of [integration.type, integration.name, integration.slug]) {
+        expect(
+          projectIntegrationCatalog(tools, { ...input, service: alias }),
+          `${integration.name}: ${alias} must discover the same operations as ${service}`
+        ).toEqual(canonical)
+      }
+    }
+  })
+})
@@ -74,6 +74,106 @@ beforeEach(() => {
   mocks.listServers.mockResolvedValue({ servers: [{ id: 'mcp-abc' }] })
 })
 describe('integration catalog projection', () => {
+  it.each(['google_calendar', 'google-calendar', 'Google Calendar', ' GOOGLE-CALENDAR '])(
+    'resolves the registered Calendar service name %s without changing the operation',
+    (service) => {
+      const calendar = {
+        name: 'google_calendar_list_v2',
+        service: 'google_calendar',
+        description: 'List calendar events',
+        input_schema: { type: 'object', properties: { calendarId: { type: 'string' } } },
+      }
+      expect(projectIntegrationCatalog([calendar], { ...input, service, query: 'events' })).toEqual(
+        projectIntegrationCatalog([calendar], {
+          ...input,
+          service: 'google_calendar',
+          query: 'events',
+        })
+      )
+      expect(
+        projectIntegrationCatalog([calendar], { ...input, service, query: 'events' }).operations
+      ).toHaveLength(1)
+    }
+  )
+
+  it.each([
+    ['google-email', 'gmail'],
+    ['github-repositories', 'github'],
+    ['Microsoft Teams', 'microsoft_teams'],
+    ['microsoft-excel', 'microsoft_excel'],
+    ['Cal.com', 'calcom'],
+    ['Zoho Desk', 'zoho_desk'],
+    ['salesforce-sandbox', 'salesforce'],
+  ])('resolves metadata-backed alias %s to %s', (alias, service) => {
+    const tool = { ...tools[0]!, name: `${service}_read`, service }
+    expect(
+      projectIntegrationCatalog([tool], { ...input, service: alias }).operations.map(
+        (operation) => operation.toolId
+      )
+    ).toEqual([tool.name])
+  })
+
+  it('keeps specific service filters narrow and shared credential families scoped to supplied tools', () => {
+    const authorized = ['google_drive', 'google_slides', 'gmail', 'slack'].map((service) => ({
+      ...tools[0]!,
+      name: `${service}_read`,
+      service,
+    }))
+    for (const service of ['google_drive', 'google-drive', 'Google Drive']) {
+      expect(
+        projectIntegrationCatalog(authorized, { ...input, service }).operations.map(
+          (operation) => operation.service
+        )
+      ).toEqual(['google_drive'])
+    }
+    expect(
+      projectIntegrationCatalog(authorized, {
+        ...input,
+        service: 'google-service-account',
+      }).operations.map((operation) => operation.service)
+    ).toEqual(['gmail', 'google_drive', 'google_slides'])
+    expect(
+      projectIntegrationCatalog(
+        authorized.filter((tool) => tool.service === 'google_slides'),
+        {
+          ...input,
+          service: 'google-drive',
+        }
+      ).operations
+    ).toEqual([])
+  })
+
+  it('derives new provider bindings from callable tools before public metadata is published', () => {
+    const preview = {
+      ...tools[0]!,
+      name: 'preview_service_read',
+      service: 'preview_service',
+      oauth: { required: true, provider: 'preview-service-provider' },
+    }
+    expect(
+      projectIntegrationCatalog([preview, ...tools], {
+        ...input,
+        service: 'preview-service-provider',
+      }).operations.map((operation) => operation.toolId)
+    ).toEqual([preview.name])
+  })
+
+  it('distinguishes an unrecognized filter from valid empty results without revealing other tools', () => {
+    expect(() => projectIntegrationCatalog(tools, { ...input, service: 'gogle-calndar' })).toThrow(
+      'Unknown integration service'
+    )
+    expect(
+      projectIntegrationCatalog(tools, { ...input, service: 'Google Calendar' }).operations
+    ).toEqual([])
+    expect(
+      projectIntegrationCatalog(tools, { ...input, service: 'gmail', query: 'nonexistent' })
+        .operations
+    ).toEqual([])
+    expect(
+      projectIntegrationCatalog(tools, { ...input, service: 'mcp:unselected-server' }).operations
+    ).toEqual([])
+  })
+
   it('omits schemas from broad listings and treats zero as an explicit full listing', () => {
     expect(projectIntegrationCatalog(tools, { ...input, limit: 1 })).toEqual({
       total: 2,
@@ -102,6 +202,27 @@ describe('integration catalog projection', () => {
   })
 })
 describe('catalog authorization', () => {
+  it.each(['assistant', 'agent'] as const)(
+    'resolves provider aliases after the existing %s authorization and catalog projection',
+    async (mode) => {
+      queueChat(mode)
+      const result = await readIntegrationCatalog.execute({
+        principal: principal(),
+        input: { ...input, mode, service: 'google-email', query: 'email' },
+      })
+      expect(result.operations.map((operation) => operation.toolId)).toEqual(['gmail_send'])
+      expect(mocks.build).toHaveBeenCalledWith(
+        'actor',
+        {
+          schemaSurface: 'copilot',
+          personalAccountsOnly: mode === 'assistant',
+          organizationId: 'org-1',
+        },
+        undefined
+      )
+    }
+  )
+
   it('preserves assistant personal-account and organization-approval projection and excludes MCP', async () => {
     queueChat()
     await readIntegrationCatalog.execute({
 
@@ -6,9 +6,12 @@ import {
   resolvePrincipalExecutionActorUserId,
   resolvePrincipalSubjectUserId,
 } from '@sim/auth/principal'
+import { INTEGRATION_METADATA } from '@sim/deployment-config/integration-metadata'
+import { stripVersionSuffix } from '@sim/utils/string'
 import { defineWorkspaceOperation } from '@/lib/core/application'
 import { defineOrganizationOperation } from '@/lib/core/application/organization-operation'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { getIntegrationsForCredentialProvider } from '@/lib/integrations/credential-display'
 import {
   createExecutorPrincipalFromExecutionContext,
   resolveExecutorOriginSubject,
@@ -46,10 +49,10 @@ export function projectIntegrationCatalog(
 ): IntegrationCatalogResponse {
   const normalized = input.query?.trim().toLowerCase() ?? ''
   const terms = normalized.split(/[^a-z0-9]+/).filter(Boolean)
-  const service = input.service?.trim().toLowerCase()
+  const services = resolveServiceFilter(tools, input.service)
   const matches = tools.flatMap((tool) => {
     if (input.toolId && tool.name !== input.toolId) return []
-    if (service && tool.service?.toLowerCase() !== service) return []
+    if (services && (!tool.service || !services.has(tool.service.toLowerCase()))) return []
     const name = tool.name.toLowerCase()
     const description = tool.description.toLowerCase()
     let score = 0
@@ -80,6 +83,47 @@ export function projectIntegrationCatalog(
   }
 }
 
+/** Specific service identities win over credential families; resolution never adds callable tools. */
+function resolveServiceFilter(
+  tools: ToolSchema[],
+  service: string | undefined
+): ReadonlySet<string> | undefined {
+  const normalized = service?.trim().toLowerCase()
+  if (!normalized) return undefined
+  if (
+    normalized.startsWith('mcp:') ||
+    tools.some((tool) => tool.service?.toLowerCase() === normalized)
+  ) {
+    return new Set([normalized])
+  }
+
+  const named = INTEGRATION_METADATA.filter((integration) =>
+    [
+      integration.type,
+      stripVersionSuffix(integration.type),
+      integration.slug,
+      integration.name,
+    ].some((name) => name.toLowerCase() === normalized)
+  )
+  const integrations = named.length ? named : getIntegrationsForCredentialProvider(normalized)
+  const services = new Set(
+    integrations.map((integration) => stripVersionSuffix(integration.type).toLowerCase())
+  )
+  /** Callable preview integrations may not yet appear in the public metadata. */
+  if (!named.length) {
+    for (const tool of tools) {
+      if (tool.service && tool.oauth?.provider.toLowerCase() === normalized) {
+        services.add(tool.service.toLowerCase())
+      }
+    }
+  }
+  if (services.size) return services
+  throw new OrchestrationError(
+    'validation',
+    'Unknown integration service. Use a service ID, name, or credential provider from discovery, or retry without the service filter.'
+  )
+}
+
 /** Catalog access rechecks current grants; worker state carries scope and provenance, never schemas. */
 const catalogUseCase = defineAuthorizedChatUseCase({
   operation: readIntegrationCatalogOperation,