@mastra/connect 0.7.0-alpha.0 → 1.0.0-alpha.2

package/dist/index.cjs

@@ -8,18 +8,56 @@ var MastraConnectError = class extends Error {
 	code;
 	status;
 	detail;
+	/**
+	* Axios-compatible alias for {@link status}. Generated provider tools come
+	* from upstream Nango templates whose error handlers check
+	* `error.response.status` (the axios/Nango SDK shape). Exposing the HTTP
+	* status under `response.status` as well lets that generated code work
+	* unchanged against the errors this package throws. Only set when the error
+	* carries an HTTP status.
+	*/
+	response;
 	constructor(code, message, options) {
 		super(message);
 		this.name = "MastraConnectError";
 		this.code = code;
 		this.status = options?.status;
 		this.detail = options?.detail ? truncate(options.detail) : void 0;
+		if (typeof options?.status === "number") this.response = { status: options.status };
+	}
+};
+/**
+* A caller configuration mistake (for example an unknown tool name in
+* `requireApproval`) that must fail resolution instead of being downgraded
+* to the resolver's warn-and-skip path, which exists for provider-side
+* failures. Internal to the package: callers observe it as a regular
+* `MastraConnectError` with code `invalid_options`.
+*
+* @internal
+*/
+var MastraConnectConfigError = class extends MastraConnectError {
+	constructor(message) {
+		super("invalid_options", message);
 	}
 };
 function truncate(text) {
 	return text.length > MAX_DETAIL_LENGTH ? `${text.slice(0, MAX_DETAIL_LENGTH)}…` : text;
 }
 /**
+* Pulls the first human-readable message from an array of error entries. Many
+* providers (Clerk, Linear's GraphQL envelope, Nango v2) return
+* `{ errors: [{ message, long_message, code }] }`; surfacing the first message
+* is the most useful detail without echoing the whole payload.
+*/
+function extractFirstArrayMessage(errors) {
+	for (const entry of errors) {
+		if (!entry || typeof entry !== "object") continue;
+		const record = entry;
+		const message = typeof record.long_message === "string" ? record.long_message : record.message;
+		if (typeof message === "string" && message) return message;
+	}
+}
+/**
 * Extracts a human-readable detail string from an RFC-7807 problem JSON body
 * (or a plain `{ error }` body) without echoing anything else from the response.
 * Returns undefined when the body is not parseable JSON.
@@ -50,6 +88,14 @@ async function extractProblemDetail(response) {
 					};
 				}
 			}
+			if (Array.isArray(data.errors)) {
+				const message = extractFirstArrayMessage(data.errors);
+				if (message) return {
+					detail: truncate(message),
+					code,
+					isProblemJson
+				};
+			}
 			return {
 				code,
 				isProblemJson
@@ -189,14 +235,35 @@ const integrationCatalogEntrySchema = zod.z.object({
 	capabilities: zod.z.object({ mcp: zod.z.boolean().optional() })
 });
 const integrationCatalogResponseSchema = zod.z.object({ integrations: zod.z.array(integrationCatalogEntrySchema) });
-const credentialSchema = zod.z.discriminatedUnion("type", [zod.z.object({
-	type: zod.z.literal("oauth2"),
+/**
+* Secondary access token minted by the vendor alongside the primary oauth2
+* credential (e.g. `devPortalAccessToken` on Microsoft Teams connections).
+* Keyed by the vendor's connection-config field name. Treat this like any
+* other bearer credential — it authenticates second-audience API calls
+* (Teams Dev Portal, etc.) and must not be logged or forwarded to code that
+* shouldn't hold connection secrets.
+*/
+const secondaryAccessTokenSchema = zod.z.object({
 	accessToken: zod.z.string(),
 	expiresAt: zod.z.string().nullable()
-}), zod.z.object({
-	type: zod.z.literal("api_key"),
-	apiKey: zod.z.string()
-})]);
+});
+const credentialSchema = zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		type: zod.z.literal("oauth2"),
+		accessToken: zod.z.string(),
+		expiresAt: zod.z.string().nullable(),
+		secondaryAccessTokens: zod.z.record(zod.z.string(), secondaryAccessTokenSchema).optional()
+	}),
+	zod.z.object({
+		type: zod.z.literal("api_key"),
+		apiKey: zod.z.string()
+	}),
+	zod.z.object({
+		type: zod.z.literal("two_step"),
+		token: zod.z.string(),
+		expiresAt: zod.z.string().nullable()
+	})
+]);
 const connectionContextSchema = zod.z.object({
 	connection_config: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
 	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).nullable()
@@ -287,7 +354,12 @@ async function proxyRequestWithResponse(client, connectionId, options) {
 	}
 	const queryString = search.size > 0 ? `?${search.toString()}` : "";
 	const url = `/v2/connections/${encodeURIComponent(connectionId)}/proxy/${cleanPath}${queryString}`;
-	const headers = { ...options.headers };
+	const headers = {};
+	for (const [name, value] of Object.entries(options.headers ?? {})) {
+		const lower = name.toLowerCase();
+		if (lower === "authorization" || lower === "proxy-authorization") continue;
+		headers[name] = value;
+	}
 	if (options.baseUrlOverride !== void 0) {
 		assertValidBaseUrlOverride(options.baseUrlOverride);
 		headers["base-url-override"] = options.baseUrlOverride;
@@ -637,8 +709,8 @@ function buildProxyMultiConnectionTools(input) {
 * client cache so stale clients can be reaped elsewhere.
 */
 async function buildMcpMultiConnectionTools(input) {
-	const { registration, connections, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connections, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? new Set(requireApproval) : void 0;
 	const listToolKey = listConnectionsToolKey(registration.integrationId);
 	const innerAllowTools = allowTools?.filter((name) => name !== listToolKey);
 	const innerDisallowTools = disallowTools?.filter((name) => name !== listToolKey);
@@ -662,7 +734,7 @@ async function buildMcpMultiConnectionTools(input) {
 						id: `mastra-connect-${resolverId}-${registration.integrationId}-${connection.id}`,
 						servers: { [registration.integrationId]: {
 							...transport,
-							requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+							...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor.has(`${registration.integrationId}_${String(toolName)}`) } : {}
 						} }
 					})
 				};
@@ -679,8 +751,10 @@ async function buildMcpMultiConnectionTools(input) {
 		}
 		const catalogUnion = /* @__PURE__ */ new Set();
 		for (const catalog of rawInnerCatalogs.values()) for (const key of Object.keys(catalog)) catalogUnion.add(key);
-		const unknownAutoApprove = [...autoApproved].filter((name) => !catalogUnion.has(name));
-		if (unknownAutoApprove.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknownAutoApprove.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		if (requireApprovalFor) {
+			const unknown = [...requireApprovalFor].filter((name) => !catalogUnion.has(name));
+			if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		}
 		innerToolsByConnectionId = /* @__PURE__ */ new Map();
 		for (const [connectionId, catalog] of rawInnerCatalogs) {
 			const filtered = applyToolFilter(catalog, {
@@ -709,10 +783,14 @@ async function buildMcpMultiConnectionTools(input) {
 //#endregion
 //#region src/providers/channels.ts
 function credentialToken$1(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
+	switch (credential.type) {
+		case "oauth2": return credential.accessToken;
+		case "two_step": return credential.token;
+		default: return credential.apiKey;
+	}
 }
 const RESERVED_OPTION_KEYS = {
-	slack: [
+	"slack-channels": [
 		"baseUrl",
 		"refreshToken",
 		"token",
@@ -726,7 +804,14 @@ const RESERVED_OPTION_KEYS = {
 		"tokenResolver",
 		"encryptionKey"
 	],
-	discord: ["baseUrl", "encryptionKey"]
+	discord: ["baseUrl", "encryptionKey"],
+	"microsoft-teams": [
+		"baseUrl",
+		"appId",
+		"appPassword",
+		"tokenResolver",
+		"encryptionKey"
+	]
 };
 function stripReservedOptions(integrationId, options) {
 	if (!options) return options;
@@ -746,10 +831,10 @@ function stripReservedOptions(integrationId, options) {
 }
 const CHANNELS$1 = [
 	{
-		integrationId: "slack",
+		integrationId: "slack-channels",
 		async create(options, runtime) {
 			const mod = await import("@mastra/slack");
-			const safeOptions = stripReservedOptions("slack", options);
+			const safeOptions = stripReservedOptions("slack-channels", options);
 			const tokenResolver = async () => {
 				return credentialToken$1(await runtime.getCredential());
 			};
@@ -783,9 +868,11 @@ const CHANNELS$1 = [
 			return {
 				provider,
 				async sync() {
+					const credential = await runtime.getCredential();
+					if (credential.type !== "api_key") throw new MastraConnectError("unsupported_credential_type", `Discord connection ${runtime.getConnectionId()} returned a '${credential.type}' credential, but the Discord channel requires the bot token as an API-key credential (the 'discord' integration). OAuth Discord connections yield user Bearer tokens, which Discord rejects for bot auth.`);
+					const botToken = credential.apiKey;
+					if (typeof botToken !== "string" || botToken.length === 0) throw new MastraConnectError("no_active_connection", `Discord connection ${runtime.getConnectionId()} has no bot token on its credential.`);
 					const metadata = (await runtime.getConnectionContext())?.metadata ?? {};
-					const botToken = typeof metadata.botToken === "string" && metadata.botToken || typeof metadata.bot_token === "string" && metadata.bot_token || void 0;
-					if (!botToken) throw new MastraConnectError("no_active_connection", `Discord connection ${runtime.getConnectionId()} has no botToken in its metadata. Store the bot token on the connection (Nango setMetadata) to activate the Discord channel.`);
 					const applicationId = optionsAppId ?? (typeof metadata.applicationId === "string" ? metadata.applicationId : void 0) ?? (typeof metadata.application_id === "string" ? metadata.application_id : void 0);
 					const publicKey = optionsPublicKey ?? (typeof metadata.publicKey === "string" ? metadata.publicKey : void 0) ?? (typeof metadata.public_key === "string" ? metadata.public_key : void 0);
 					const credentials = { botToken };
@@ -795,17 +882,42 @@ const CHANNELS$1 = [
 				}
 			};
 		}
+	},
+	{
+		integrationId: "microsoft-teams",
+		async create(options, runtime) {
+			const mod = await import("@mastra/teams");
+			if (!process.env.MASTRA_ENCRYPTION_KEY) throw new MastraConnectError("invalid_options", "Microsoft Teams channel: MASTRA_ENCRYPTION_KEY is not set. The Teams install store persists per-agent bot secrets and requires an at-rest encryption key (a 32-byte value, base64-encoded).");
+			const safeOptions = stripReservedOptions("microsoft-teams", options);
+			const tokenResolver = async (scope) => {
+				const fresh = await runtime.getCredential();
+				if (!(Array.isArray(scope) ? scope : [scope]).includes(mod.TEAMS_DEV_PORTAL_SCOPE)) return credentialToken$1(fresh);
+				const token = fresh.type === "oauth2" ? fresh.secondaryAccessTokens?.devPortalAccessToken?.accessToken : void 0;
+				if (!token) throw new MastraConnectError("no_active_connection", `Teams connection ${runtime.getConnectionId()} has no Dev Portal token on its credential. Reconnect with an integration that requests the ${mod.TEAMS_DEV_PORTAL_SCOPE} scope.`);
+				return token;
+			};
+			return { provider: new mod.TeamsProvider({
+				tokenResolver,
+				...safeOptions ?? {}
+			}) };
+		}
 	}
 ];
 //#endregion
 //#region src/runtime/platform-proxy.ts
 /** Maps the platform credential to the field names templates are written against. */
 function toTemplateCredentials(credential) {
-	return credential.type === "oauth2" ? {
+	if (credential.type === "oauth2") return {
 		type: "OAUTH2",
 		access_token: credential.accessToken,
 		expires_at: credential.expiresAt
-	} : {
+	};
+	if (credential.type === "two_step") return {
+		type: "TWO_STEP",
+		token: credential.token,
+		expires_at: credential.expiresAt
+	};
+	return {
 		type: "API_KEY",
 		apiKey: credential.apiKey
 	};
@@ -1733,8 +1845,8 @@ const anthropicProvider = {
 //#endregion
 //#region src/providers/clerk/tools/assign-organization-role-permission.ts
 const assignOrganizationRolePermissionInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
-	permission_id: zod.z.string()
+	organization_role_id: zod.z.string().min(1),
+	permission_id: zod.z.string().min(1)
 });
 const ResourceSchema$49 = zod.z.object({
 	id: zod.z.string(),
@@ -1770,8 +1882,8 @@ function assignOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-email-address.ts
 const createEmailAddressInputSchema = zod.z.object({
-	user_id: zod.z.string(),
-	email_address: zod.z.string(),
+	user_id: zod.z.string().min(1),
+	email_address: zod.z.string().email(),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	notify_primary_email_address_changed: zod.z.boolean().optional()
@@ -1816,16 +1928,22 @@ function createEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/create-organization-domain.ts
-const EnrollmentModeSchema$2 = zod.z.enum([
+const EnrollmentModeSchema$3 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$2 = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const createOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$2,
+	enrollment_mode: EnrollmentModeSchema$3,
 	verified: zod.z.boolean().optional()
 });
 const ResourceSchema$47 = zod.z.object({
@@ -1833,15 +1951,15 @@ const ResourceSchema$47 = zod.z.object({
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$2.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$2.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -1870,7 +1988,7 @@ function createOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-invitation.ts
 const createOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	email_address: zod.z.string().email(),
 	role: zod.z.string(),
 	inviter_user_id: zod.z.string().optional(),
@@ -1891,7 +2009,7 @@ const ResourceSchema$46 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -1924,8 +2042,8 @@ function createOrganizationInvitationTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-membership.ts
 const createOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	role: zod.z.string(),
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
@@ -2061,7 +2179,7 @@ function createOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-phone-number.ts
 const createPhoneNumberInputSchema = zod.z.object({
-	user_id: zod.z.string(),
+	user_id: zod.z.string().min(1),
 	phone_number: zod.z.string(),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
@@ -2124,7 +2242,7 @@ const createUserInputSchema$2 = zod.z.object({
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	unsafe_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
+}).refine((value) => (value.email_address?.length ?? 0) > 0 || (value.phone_number?.length ?? 0) > 0 || value.username !== void 0 || value.password !== void 0, { message: "Provide at least one of email_address, phone_number, username, or password." });
 const UserSchema$27 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2176,7 +2294,7 @@ function createUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-email-address.ts
-const deleteEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string() });
+const deleteEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string().min(1) });
 const deleteEmailAddressOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2202,8 +2320,8 @@ function deleteEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-domain.ts
 const deleteOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1)
 });
 const deleteOrganizationDomainOutputSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -2230,8 +2348,8 @@ function deleteOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-membership.ts
 const deleteOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1)
 });
 const deleteOrganizationMembershipOutputSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -2257,7 +2375,7 @@ function deleteOrganizationMembershipTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-role.ts
-const deleteOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string() });
+const deleteOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string().min(1) });
 const deleteOrganizationRoleOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2307,7 +2425,7 @@ function deleteOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-phone-number.ts
-const deletePhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string() });
+const deletePhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string().min(1) });
 const deletePhoneNumberOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2357,7 +2475,7 @@ function deleteUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-email-address.ts
-const getEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string() });
+const getEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string().min(1) });
 const ResourceSchema$42 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2392,8 +2510,8 @@ function getEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/get-organization-invitation.ts
 const getOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	invitation_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	invitation_id: zod.z.string().min(1)
 });
 const ResourceSchema$41 = zod.z.object({
 	id: zod.z.string(),
@@ -2406,7 +2524,7 @@ const ResourceSchema$41 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -2428,7 +2546,7 @@ function getOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-organization-role.ts
-const getOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string() });
+const getOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string().min(1) });
 const ResourceSchema$40 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2500,7 +2618,7 @@ function getOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-phone-number.ts
-const getPhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string() });
+const getPhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string().min(1) });
 const ResourceSchema$39 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2535,7 +2653,7 @@ function getPhoneNumberTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-session.ts
-const getSessionInputSchema = zod.z.object({ session_id: zod.z.string() });
+const getSessionInputSchema = zod.z.object({ session_id: zod.z.string().min(1) });
 const ResourceSchema$38 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2549,7 +2667,7 @@ const ResourceSchema$38 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
@@ -2609,33 +2727,39 @@ function getUserTool$7(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/list-organization-domains.ts
-const EnrollmentModeSchema$1 = zod.z.enum([
+const EnrollmentModeSchema$2 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$1 = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const listOrganizationDomainsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
-	enrollment_mode: EnrollmentModeSchema$1.optional()
+	enrollment_mode: EnrollmentModeSchema$2.optional()
 });
 const ResourceSchema$37 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$1.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$1.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -2646,7 +2770,7 @@ const ProviderResponseSchema$244 = zod.z.object({
 });
 const listOrganizationDomainsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$37),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationDomainsTool(proxy) {
@@ -2657,11 +2781,7 @@ function listOrganizationDomainsTool(proxy) {
 		outputSchema: listOrganizationDomainsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/domains`,
 				params: {
@@ -2685,9 +2805,9 @@ function listOrganizationDomainsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-invitations.ts
 const listOrganizationInvitationsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	status: zod.z.enum([
 		"pending",
 		"accepted",
@@ -2708,7 +2828,7 @@ const ResourceSchema$36 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -2718,7 +2838,7 @@ const ProviderResponseSchema$243 = zod.z.object({
 });
 const listOrganizationInvitationsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$36),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationInvitationsTool(proxy) {
@@ -2729,11 +2849,7 @@ function listOrganizationInvitationsTool(proxy) {
 		outputSchema: listOrganizationInvitationsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/invitations`,
 				params: {
@@ -2758,9 +2874,9 @@ function listOrganizationInvitationsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-memberships.ts
 const listOrganizationMembershipsInputSchema$1 = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	user_id: zod.z.array(zod.z.string()).optional(),
 	email_address: zod.z.array(zod.z.string()).optional(),
 	phone_number: zod.z.array(zod.z.string()).optional(),
@@ -2794,7 +2910,7 @@ const ProviderResponseSchema$242 = zod.z.object({
 });
 const listOrganizationMembershipsOutputSchema$1 = zod.z.object({
 	items: zod.z.array(ResourceSchema$35),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationMembershipsTool$1(proxy) {
@@ -2805,11 +2921,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 		outputSchema: listOrganizationMembershipsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/memberships`,
 				params: {
@@ -2847,7 +2959,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-roles.ts
 const listOrganizationRolesInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
 	query: zod.z.string().optional(),
 	order_by: zod.z.string().optional()
@@ -2872,7 +2984,7 @@ const ProviderResponseSchema$241 = zod.z.object({
 });
 const listOrganizationRolesOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$34),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationRolesTool(proxy) {
@@ -2883,11 +2995,7 @@ function listOrganizationRolesTool(proxy) {
 		outputSchema: listOrganizationRolesOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organization_roles",
 				params: {
@@ -2911,7 +3019,7 @@ function listOrganizationRolesTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organizations.ts
 const listOrganizationsInputSchema$1 = zod.z.object({
-	cursor: zod.z.string().optional(),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
 	query: zod.z.string().optional(),
 	order_by: zod.z.string().optional().describe("Sort by name, created_at, or members_count, prefixed with + or -."),
@@ -2951,11 +3059,7 @@ function listOrganizationsTool$1(proxy) {
 		outputSchema: listOrganizationsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organizations",
 				params: {
@@ -2981,10 +3085,10 @@ function listOrganizationsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-sessions.ts
 const listSessionsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	client_id: zod.z.string().optional(),
-	user_id: zod.z.string().optional(),
+	client_id: zod.z.string().min(1).optional(),
+	user_id: zod.z.string().min(1).optional(),
 	status: zod.z.enum([
 		"abandoned",
 		"active",
@@ -2994,7 +3098,7 @@ const listSessionsInputSchema = zod.z.object({
 		"replaced",
 		"revoked"
 	]).optional()
-});
+}).refine((value) => value.client_id !== void 0 || value.user_id !== void 0, { message: "Provide at least one of client_id or user_id." });
 const ResourceSchema$33 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3008,21 +3112,17 @@ const ResourceSchema$33 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
-const ProviderResponseSchema$239 = zod.z.object({
-	data: zod.z.array(ResourceSchema$33),
-	total_count: zod.z.number()
-});
+const ProviderResponseSchema$239 = zod.z.array(ResourceSchema$33);
 const listSessionsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$33),
-	next_cursor: zod.z.string().optional(),
-	total: zod.z.number()
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page.")
 });
 function listSessionsTool(proxy) {
 	return (0, _mastra_core_tools.createTool)({
@@ -3032,28 +3132,23 @@ function listSessionsTool(proxy) {
 		outputSchema: listSessionsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const limit = input.limit ?? 10;
 			const response = await platformProxy.get({
 				endpoint: "/v1/sessions",
 				params: {
 					offset: String(offset),
-					...input.limit !== void 0 && { limit: String(input.limit) },
+					limit: String(limit),
 					...input.client_id !== void 0 && { client_id: input.client_id },
 					...input.user_id !== void 0 && { user_id: input.user_id },
 					...input.status !== void 0 && { status: input.status }
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$239.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const sessions = ProviderResponseSchema$239.parse(response.data);
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: sessions,
+				...sessions.length === limit && { next_cursor: String(offset + sessions.length) }
 			};
 		}
 	});
@@ -3061,13 +3156,19 @@ function listSessionsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-users.ts
 const listUsersInputSchema$9 = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional().describe("Maximum number of users to return. Maximum 500."),
 	query: zod.z.string().optional().describe("Search across names, identifiers, email addresses, phone numbers, and usernames."),
 	email_address: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by email addresses."),
+	phone_number: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by phone numbers."),
+	username: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by usernames."),
 	user_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by Clerk user IDs."),
 	external_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by external user IDs."),
 	organization_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by organization IDs."),
+	last_active_at_before: zod.z.number().int().optional().describe("Filter users last active before this Unix timestamp in milliseconds."),
+	last_active_at_after: zod.z.number().int().optional().describe("Filter users last active after this Unix timestamp in milliseconds."),
+	created_at_before: zod.z.number().int().optional().describe("Filter users created before this Unix timestamp in milliseconds."),
+	created_at_after: zod.z.number().int().optional().describe("Filter users created after this Unix timestamp in milliseconds."),
 	order_by: zod.z.string().optional().describe("Sort field prefixed with + for ascending or - for descending. Example: \"-created_at\"")
 });
 const UserSchema$25 = zod.z.object({
@@ -3086,13 +3187,11 @@ const UserSchema$25 = zod.z.object({
 	updated_at: zod.z.number().optional(),
 	locale: zod.z.string().nullable().optional()
 }).passthrough();
-const ProviderResponseSchema$238 = zod.z.object({
-	data: zod.z.array(UserSchema$25),
-	total_count: zod.z.number()
-});
+const ProviderResponseSchema$238 = zod.z.array(UserSchema$25);
+const ProviderCountSchema = zod.z.object({ total_count: zod.z.number() }).passthrough();
 const listUsersOutputSchema$9 = zod.z.object({
 	items: zod.z.array(UserSchema$25),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listUsersTool$9(proxy) {
@@ -3103,31 +3202,42 @@ function listUsersTool$9(proxy) {
 		outputSchema: listUsersOutputSchema$9,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const filterParams = {
+				...input.query !== void 0 && { query: input.query },
+				...input.email_address !== void 0 && { email_address: input.email_address },
+				...input.phone_number !== void 0 && { phone_number: input.phone_number },
+				...input.username !== void 0 && { username: input.username },
+				...input.user_id !== void 0 && { user_id: input.user_id },
+				...input.external_id !== void 0 && { external_id: input.external_id },
+				...input.organization_id !== void 0 && { organization_id: input.organization_id },
+				...input.last_active_at_before !== void 0 && { last_active_at_before: String(input.last_active_at_before) },
+				...input.last_active_at_after !== void 0 && { last_active_at_after: String(input.last_active_at_after) },
+				...input.created_at_before !== void 0 && { created_at_before: String(input.created_at_before) },
+				...input.created_at_after !== void 0 && { created_at_after: String(input.created_at_after) }
+			};
 			const response = await platformProxy.get({
 				endpoint: "/v1/users",
 				params: {
 					offset: String(offset),
 					...input.limit !== void 0 && { limit: String(input.limit) },
-					...input.query !== void 0 && { query: input.query },
-					...input.email_address !== void 0 && { email_address: input.email_address },
-					...input.user_id !== void 0 && { user_id: input.user_id },
-					...input.external_id !== void 0 && { external_id: input.external_id },
-					...input.organization_id !== void 0 && { organization_id: input.organization_id },
-					...input.order_by !== void 0 && { order_by: input.order_by }
+					...input.order_by !== void 0 && { order_by: input.order_by },
+					...filterParams
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$238.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const users = ProviderResponseSchema$238.parse(response.data);
+			const countResponse = await platformProxy.get({
+				endpoint: "/v1/users/count",
+				params: filterParams,
+				retries: 3
+			});
+			const total = ProviderCountSchema.parse(countResponse.data).total_count;
+			const nextOffset = offset + users.length;
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: users,
+				...users.length > 0 && nextOffset < total && { next_cursor: String(nextOffset) },
+				total
 			};
 		}
 	});
@@ -3135,8 +3245,8 @@ function listUsersTool$9(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/remove-organization-role-permission.ts
 const removeOrganizationRolePermissionInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
-	permission_id: zod.z.string()
+	organization_role_id: zod.z.string().min(1),
+	permission_id: zod.z.string().min(1)
 });
 const removeOrganizationRolePermissionOutputSchema = zod.z.object({
 	id: zod.z.string(),
@@ -3163,8 +3273,8 @@ function removeOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/revoke-organization-invitation.ts
 const revokeOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	invitation_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	invitation_id: zod.z.string().min(1),
 	requesting_user_id: zod.z.string().optional()
 });
 const ResourceSchema$32 = zod.z.object({
@@ -3178,7 +3288,7 @@ const ResourceSchema$32 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -3201,7 +3311,7 @@ function revokeOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/revoke-session.ts
-const revokeSessionInputSchema = zod.z.object({ session_id: zod.z.string() });
+const revokeSessionInputSchema = zod.z.object({ session_id: zod.z.string().min(1) });
 const ResourceSchema$31 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3215,7 +3325,7 @@ const ResourceSchema$31 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
@@ -3242,7 +3352,7 @@ function revokeSessionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-email-address.ts
 const updateEmailAddressInputSchema = zod.z.object({
-	email_address_id: zod.z.string(),
+	email_address_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	notify_primary_email_address_changed: zod.z.boolean().optional()
@@ -3285,16 +3395,22 @@ function updateEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/update-organization-domain.ts
-const EnrollmentModeSchema = zod.z.enum([
+const EnrollmentModeSchema$1 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const updateOrganizationDomainInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1),
+	enrollment_mode: EnrollmentModeSchema$1.optional(),
 	verified: zod.z.boolean().optional()
 });
 const ResourceSchema$29 = zod.z.object({
@@ -3302,15 +3418,15 @@ const ResourceSchema$29 = zod.z.object({
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -3338,8 +3454,8 @@ function updateOrganizationDomainTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership-metadata.ts
 const updateOrganizationMembershipMetadataInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
@@ -3376,8 +3492,8 @@ function updateOrganizationMembershipMetadataTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership.ts
 const updateOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	role: zod.z.string()
 });
 const ResourceSchema$27 = zod.z.object({
@@ -3410,12 +3526,12 @@ function updateOrganizationMembershipTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-role.ts
 const updateOrganizationRoleInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
+	organization_role_id: zod.z.string().min(1),
 	name: zod.z.string().optional(),
 	key: zod.z.string().optional(),
 	description: zod.z.string().optional(),
 	permissions: zod.z.array(zod.z.string()).optional()
-});
+}).refine((value) => value.name !== void 0 || value.key !== void 0 || value.description !== void 0 || value.permissions !== void 0, { message: "Provide at least one of name, key, description, or permissions." });
 const ResourceSchema$26 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3459,7 +3575,8 @@ const updateOrganizationInputSchema$1 = zod.z.object({
 	name: zod.z.string().min(1).optional(),
 	slug: zod.z.string().optional(),
 	admin_delete_enabled: zod.z.boolean().optional(),
-	max_allowed_memberships: zod.z.number().int().min(0).optional()
+	max_allowed_memberships: zod.z.number().int().min(0).optional(),
+	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
 const OrganizationSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -3491,7 +3608,8 @@ function updateOrganizationTool$1(proxy) {
 					...input.name !== void 0 && { name: input.name },
 					...input.slug !== void 0 && { slug: input.slug },
 					...input.admin_delete_enabled !== void 0 && { admin_delete_enabled: input.admin_delete_enabled },
-					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships }
+					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships },
+					...input.public_metadata !== void 0 && { public_metadata: input.public_metadata }
 				},
 				retries: 3
 			});
@@ -3502,7 +3620,7 @@ function updateOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-phone-number.ts
 const updatePhoneNumberInputSchema = zod.z.object({
-	phone_number_id: zod.z.string(),
+	phone_number_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	reserved_for_second_factor: zod.z.boolean().optional()
@@ -3548,14 +3666,14 @@ function updatePhoneNumberTool(proxy) {
 //#region src/providers/clerk/tools/update-user.ts
 const updateUserInputSchema$1 = zod.z.object({
 	user_id: zod.z.string().min(1),
-	first_name: zod.z.string().optional(),
-	last_name: zod.z.string().optional(),
-	username: zod.z.string().optional(),
+	first_name: zod.z.string().nullable().optional().describe("Pass null to clear the first name."),
+	last_name: zod.z.string().nullable().optional().describe("Pass null to clear the last name."),
+	username: zod.z.string().nullable().optional().describe("Pass null to clear the username."),
 	password: zod.z.string().min(8).optional(),
 	skip_password_checks: zod.z.boolean().optional(),
 	sign_out_of_other_sessions: zod.z.boolean().optional(),
-	external_id: zod.z.string().optional(),
-	locale: zod.z.string().optional()
+	external_id: zod.z.string().nullable().optional().describe("Pass null to clear the external ID."),
+	locale: zod.z.string().nullable().optional().describe("Pass null to clear the locale.")
 });
 const UserSchema$24 = zod.z.object({
 	id: zod.z.string(),
@@ -3601,24 +3719,30 @@ function updateUserTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/verify-organization-domain.ts
+const EnrollmentModeSchema = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const verifyOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1)
 });
 const ResourceSchema$24 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: zod.z.string().optional(),
+	enrollment_mode: EnrollmentModeSchema.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -3703,8 +3827,25 @@ const clerkProvider = {
 	createTools: createClerkTools
 };
 //#endregion
+//#region src/providers/discord/tools/_bot-token.ts
+/**
+* Resolves the Discord bot token from the connection's credentials. Nango's
+* `discord` provider is API_KEY-typed and stores the bot token as its
+* secret, so the platform serves it back as `credentials.apiKey` (the wire
+* shape templates are written against). Throws a ToolActionError with a
+* consistent `missing_credentials` payload so exec bodies don't need to repeat
+* the guard.
+*/
+async function resolveDiscordBotToken(platformProxy) {
+	const credentials = (await platformProxy.getConnectionWithCredentials()).credentials;
+	if (credentials && typeof credentials.apiKey === "string" && credentials.apiKey) return credentials.apiKey;
+	throw new platformProxy.ActionError({
+		type: "missing_credentials",
+		message: "Discord bot token is missing from the connection credentials. Reconnect the discord integration with a valid bot token."
+	});
+}
+//#endregion
 //#region src/providers/discord/tools/add-guild-member-role.ts
-const MetadataSchema$7 = zod.z.object({ botToken: zod.z.string() });
 const addGuildMemberRoleInputSchema = zod.z.object({
 	guildId: zod.z.string().describe("Guild ID. Example: \"123456789012345678\""),
 	userId: zod.z.string().describe("User ID. Example: \"987654321098765432\""),
@@ -3719,12 +3860,7 @@ function addGuildMemberRoleTool(proxy) {
 		outputSchema: addGuildMemberRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadataResult = MetadataSchema$7.safeParse(await platformProxy.getMetadata());
-			if (!metadataResult.success) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
-			const { botToken } = metadataResult.data;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.put({
 				endpoint: `/api/v10/guilds/${input.guildId}/members/${input.userId}/roles/${input.roleId}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -3740,7 +3876,6 @@ function addGuildMemberRoleTool(proxy) {
 }
 //#endregion
 //#region src/providers/discord/tools/create-channel.ts
-zod.z.object({ botToken: zod.z.string().describe("Discord bot token from the Discord Developer Portal") });
 const createChannelInputSchema$2 = zod.z.object({
 	guildId: zod.z.string().describe("The ID of the guild to create the channel in. Example: \"41771983423143937\""),
 	name: zod.z.string().min(1).max(100).describe("Channel name (1-100 characters). Example: \"general\""),
@@ -3810,11 +3945,7 @@ function createChannelTool$2(proxy) {
 		outputSchema: createChannelOutputSchema$2,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please provide a Discord bot token."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			if (!input.guildId) throw new platformProxy.ActionError({
 				type: "invalid_input",
 				message: "guildId is required to create a channel."
@@ -3840,7 +3971,7 @@ function createChannelTool$2(proxy) {
 			const response = await platformProxy.post({
 				endpoint: `/api/v10/guilds/${input.guildId}/channels`,
 				data: requestBody,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			const providerChannel = ProviderChannelSchema$10.parse(response.data);
@@ -3934,11 +4065,7 @@ function createMessageTool(proxy) {
 		outputSchema: createMessageOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const requestBody = {};
 			if (input.content !== void 0) requestBody["content"] = input.content;
 			if (input.embeds !== void 0) requestBody["embeds"] = input.embeds;
@@ -3990,11 +4117,7 @@ function createReactionTool(proxy) {
 		outputSchema: createReactionOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please configure the Discord bot token."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			await platformProxy.put({
 				endpoint: `/api/v10/channels/${input.channel_id}/messages/${input.message_id}/reactions/${encodeURIComponent(input.emoji)}/@me`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4069,7 +4192,6 @@ const createRoleOutputSchema = zod.z.object({
 	tags: RoleTagsSchema$3.optional(),
 	flags: zod.z.number().int()
 });
-zod.z.object({ botToken: zod.z.string() });
 function createRoleTool(proxy) {
 	return (0, _mastra_core_tools.createTool)({
 		id: "discord_create_role",
@@ -4078,11 +4200,7 @@ function createRoleTool(proxy) {
 		outputSchema: createRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.post({
 				endpoint: `/api/v10/guilds/${input.guildId}/roles`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4183,7 +4301,7 @@ function createThreadFromMessageTool(proxy) {
 		outputSchema: createThreadFromMessageOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken || "";
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const requestData = { name: input.name };
 			if (input.auto_archive_duration !== void 0) requestData["auto_archive_duration"] = input.auto_archive_duration;
 			if (input.rate_limit_per_user !== void 0) requestData["rate_limit_per_user"] = input.rate_limit_per_user;
@@ -4257,10 +4375,6 @@ const createWebhookOutputSchema$1 = zod.z.object({
 	token: zod.z.string().optional().describe("Webhook token (only for Incoming webhooks)"),
 	applicationId: zod.z.string().optional()
 });
-zod.z.object({
-	botToken: zod.z.string().describe("Discord bot token for authentication"),
-	channelId: zod.z.string().optional().describe("Optional default channel ID for creating webhooks")
-});
 function createWebhookTool$1(proxy) {
 	return (0, _mastra_core_tools.createTool)({
 		id: "discord_create_webhook",
@@ -4269,13 +4383,9 @@ function createWebhookTool$1(proxy) {
 		outputSchema: createWebhookOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const metadata = await platformProxy.getMetadata();
-			const botToken = metadata?.botToken;
 			const channelId = input.channelId ?? metadata?.channelId;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "missing_metadata",
-				message: "botToken is required in connection metadata."
-			});
 			if (!channelId) throw new platformProxy.ActionError({
 				type: "missing_channel",
 				message: "channelId is required in input or metadata."
@@ -4360,11 +4470,7 @@ function deleteChannelTool$1(proxy) {
 		outputSchema: deleteChannelOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please provide a Discord bot token."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.delete({
 				endpoint: `/api/v10/channels/${input.channelId}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4388,7 +4494,6 @@ function deleteChannelTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/discord/tools/delete-guild-member.ts
-zod.z.object({ botToken: zod.z.string().describe("Discord bot token for authentication") });
 const deleteGuildMemberInputSchema = zod.z.object({
 	guild_id: zod.z.string().describe("Guild ID. Example: \"123456789012345678\""),
 	user_id: zod.z.string().describe("User ID of the member to delete. Example: \"987654321098765432\"")
@@ -4405,16 +4510,12 @@ function deleteGuildMemberTool(proxy) {
 		outputSchema: deleteGuildMemberOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in connection metadata"
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			let response;
 			try {
 				response = await platformProxy.delete({
 					endpoint: `/api/v10/guilds/${input.guild_id}/members/${input.user_id}`,
-					headers: { Authorization: `Bot ${metadata.botToken}` },
+					headers: { Authorization: `Bot ${botToken}` },
 					retries: 1
 				});
 			} catch (err) {
@@ -4437,7 +4538,6 @@ function deleteGuildMemberTool(proxy) {
 }
 //#endregion
 //#region src/providers/discord/tools/delete-guild.ts
-const MetadataSchema$6 = zod.z.object({ botToken: zod.z.string().describe("Discord bot token from the Discord Developer Portal") });
 const deleteGuildInputSchema = zod.z.object({ guild_id: zod.z.string().describe("The ID of the guild for the bot to leave.") });
 const deleteGuildOutputSchema = zod.z.object({
 	success: zod.z.boolean().describe("Whether the bot successfully left the guild"),
@@ -4451,13 +4551,7 @@ function deleteGuildTool(proxy) {
 		outputSchema: deleteGuildOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			const parsedMetadata = MetadataSchema$6.safeParse(metadata);
-			if (!parsedMetadata.success) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please configure the bot token in the connection metadata."
-			});
-			const botToken = parsedMetadata.data.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.delete({
 				endpoint: `/api/v10/users/@me/guilds/${input.guild_id}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4477,7 +4571,6 @@ function deleteGuildTool(proxy) {
 }
 //#endregion
 //#region src/providers/discord/tools/delete-message.ts
-const MetadataSchema$5 = zod.z.object({ botToken: zod.z.string().describe("Discord bot token") });
 const deleteMessageInputSchema$2 = zod.z.object({
 	channelId: zod.z.string().describe("Channel ID where the message exists. Example: \"1234567890123456789\""),
 	messageId: zod.z.string().describe("Message ID to delete. Example: \"9876543210987654321\"")
@@ -4495,12 +4588,7 @@ function deleteMessageTool$2(proxy) {
 		outputSchema: deleteMessageOutputSchema$2,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = MetadataSchema$5.safeParse(await platformProxy.getMetadata());
-			if (!metadata.success) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "Invalid metadata: botToken is required."
-			});
-			const botToken = metadata.data.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			await platformProxy.delete({
 				endpoint: `/api/v10/channels/${input.channelId}/messages/${input.messageId}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4530,11 +4618,7 @@ function deleteReactionTool(proxy) {
 		outputSchema: deleteReactionOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please configure the bot token from Discord Developer Portal."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			await platformProxy.delete({
 				endpoint: `/api/v10/channels/${input.channel_id}/messages/${input.message_id}/reactions/${encodeURIComponent(input.emoji)}/@me`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4576,7 +4660,7 @@ function deleteRoleTool(proxy) {
 		outputSchema: deleteRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			if (!botToken) throw new platformProxy.ActionError({
 				type: "invalid_metadata",
 				message: "botToken is required in metadata. Please provide the Discord bot token from your Discord application settings."
@@ -4610,11 +4694,7 @@ function deleteWebhookTool$1(proxy) {
 		outputSchema: deleteWebhookOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please ensure the Discord connection has a botToken configured."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.delete({
 				endpoint: `/api/v10/webhooks/${input.webhookId}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4718,14 +4798,10 @@ function getChannelTool$2(proxy) {
 		outputSchema: getChannelOutputSchema$2,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please set up the connection with botToken in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/channels/${input.channelId}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			if (!response.data) throw new platformProxy.ActionError({
@@ -4824,14 +4900,10 @@ function getGuildMemberTool(proxy) {
 		outputSchema: getGuildMemberOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/guilds/${input.guild_id}/members/${input.user_id}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			if (response.status === 404) throw new platformProxy.ActionError({
@@ -4874,11 +4946,7 @@ function getGuildTool(proxy) {
 		outputSchema: getGuildOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please configure the bot token from Discord Developer Portal."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/guilds/${input.guildId}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -4989,14 +5057,10 @@ function getMessageTool$1(proxy) {
 		outputSchema: getMessageOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/channels/${input.channelId}/messages/${input.messageId}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			if (!response.data) throw new platformProxy.ActionError({
@@ -5107,14 +5171,10 @@ function getRoleTool(proxy) {
 		outputSchema: getRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/guilds/${input.guild_id}/roles/${input.role_id}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			if (!response.data) throw new platformProxy.ActionError({
@@ -5189,14 +5249,10 @@ function getWebhookTool$1(proxy) {
 		outputSchema: getWebhookOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/webhooks/${input.webhookId}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			if (!response.data) throw new platformProxy.ActionError({
@@ -5244,7 +5300,7 @@ const ChannelSchema$2 = zod.z.object({
 	recipients: zod.z.array(zod.z.unknown()).optional(),
 	icon: zod.z.string().nullable().optional(),
 	owner_id: zod.z.string().optional(),
-	application_id: zod.z.string().optional(),
+	application_id: zod.z.string().nullable().optional(),
 	managed: zod.z.boolean().optional(),
 	parent_id: zod.z.string().nullable().optional(),
 	last_pin_timestamp: zod.z.string().nullable().optional(),
@@ -5267,7 +5323,7 @@ function listChannelsTool$2(proxy) {
 		outputSchema: listChannelsOutputSchema$2,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			if (!botToken) throw new platformProxy.ActionError({
 				type: "invalid_metadata",
 				message: "botToken is required in metadata. Please configure the Discord connection with a bot token from your Discord application settings."
@@ -5360,12 +5416,7 @@ function listGuildMembersTool(proxy) {
 		outputSchema: listGuildMembersOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			const parsedMetadata = zod.z.object({ botToken: zod.z.string() }).safeParse(metadata);
-			if (!parsedMetadata.success) throw new platformProxy.ActionError({
-				type: "missing_bot_token",
-				message: "botToken is required in connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const limit = input.limit ?? 100;
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/guilds/${input.guild_id}/members`,
@@ -5373,7 +5424,7 @@ function listGuildMembersTool(proxy) {
 					limit: String(limit),
 					...input.after !== void 0 && { after: input.after }
 				},
-				headers: { Authorization: `Bot ${parsedMetadata.data.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			const rawMembers = zod.z.array(zod.z.unknown()).parse(response.data);
@@ -5443,11 +5494,7 @@ function listGuildsTool(proxy) {
 		outputSchema: listGuildsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const limit = input.limit ?? 200;
 			const response = await platformProxy.get({
 				endpoint: "/api/v10/users/@me/guilds",
@@ -5566,7 +5613,7 @@ function listMessagesTool$1(proxy) {
 		outputSchema: listMessagesOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			if (!botToken) throw new platformProxy.ActionError({
 				type: "missing_bot_token",
 				message: "Bot token is required in connection metadata. Please configure the bot token in your Nango connection."
@@ -5681,11 +5728,7 @@ function listRolesTool$1(proxy) {
 		outputSchema: listRolesOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/guilds/${input.guild_id}/roles`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -5745,7 +5788,6 @@ const WebhookSchema = zod.z.object({
 	url: zod.z.string().optional()
 });
 const listWebhooksOutputSchema$1 = zod.z.object({ webhooks: zod.z.array(WebhookSchema) });
-zod.z.object({ botToken: zod.z.string() });
 function listWebhooksTool$1(proxy) {
 	return (0, _mastra_core_tools.createTool)({
 		id: "discord_list_webhooks",
@@ -5754,14 +5796,10 @@ function listWebhooksTool$1(proxy) {
 		outputSchema: listWebhooksOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "missing_bot_token",
-				message: "Bot token is required in connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.get({
 				endpoint: `/api/v10/channels/${input.channelId}/webhooks`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				retries: 3
 			});
 			return { webhooks: zod.z.array(WebhookSchema).parse(response.data) };
@@ -5789,11 +5827,7 @@ function removeGuildMemberRoleTool(proxy) {
 		outputSchema: removeGuildMemberRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "missing_bot_token",
-				message: "Bot token is required in metadata. Please configure the botToken in your connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.delete({
 				endpoint: `/api/v10/guilds/${input.guild_id}/members/${input.user_id}/roles/${input.role_id}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -5859,7 +5893,6 @@ const ProviderChannelSchema$7 = zod.z.object({
 	default_auto_archive_duration: zod.z.number().int().optional(),
 	flags: zod.z.number().int().optional()
 });
-const MetadataSchema$4 = zod.z.object({ botToken: zod.z.string() });
 const updateChannelOutputSchema$1 = zod.z.object({
 	id: zod.z.string(),
 	type: zod.z.number().int(),
@@ -5890,12 +5923,7 @@ function updateChannelTool$1(proxy) {
 		outputSchema: updateChannelOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const rawMetadata = await platformProxy.getMetadata();
-			const metadata = MetadataSchema$4.safeParse(rawMetadata);
-			if (!metadata.success || !metadata.data.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please set the Discord bot token in the connection metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const updateData = {};
 			if (input["name"] !== void 0) updateData["name"] = input["name"];
 			if (input["type"] !== void 0) updateData["type"] = input["type"];
@@ -5911,7 +5939,7 @@ function updateChannelTool$1(proxy) {
 			if (input["flags"] !== void 0) updateData["flags"] = input["flags"];
 			const response = await platformProxy.patch({
 				endpoint: `/api/v10/channels/${input.channel_id}`,
-				headers: { Authorization: `Bot ${metadata.data.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				data: updateData,
 				retries: 10
 			});
@@ -6019,11 +6047,7 @@ function updateGuildMemberTool(proxy) {
 		outputSchema: updateGuildMemberOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata. Please provide the bot token from your Discord application."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const body = {};
 			if (input["nick"] !== void 0) body["nick"] = input["nick"];
 			if (input["roles"] !== void 0) body["roles"] = input["roles"];
@@ -6032,7 +6056,7 @@ function updateGuildMemberTool(proxy) {
 			if (input["channel_id"] !== void 0) body["channel_id"] = input["channel_id"];
 			if (input["communication_disabled_until"] !== void 0) body["communication_disabled_until"] = input["communication_disabled_until"];
 			if (input["flags"] !== void 0) body["flags"] = input["flags"];
-			const headers = { Authorization: `Bot ${metadata.botToken}` };
+			const headers = { Authorization: `Bot ${botToken}` };
 			if (input.reason) headers["X-Audit-Log-Reason"] = input.reason;
 			if (input["user_id"] === "@me") {
 				const currentMemberBody = {};
@@ -6083,7 +6107,6 @@ function updateGuildMemberTool(proxy) {
 }
 //#endregion
 //#region src/providers/discord/tools/update-guild.ts
-zod.z.object({ botToken: zod.z.string() });
 const updateGuildInputSchema = zod.z.object({
 	guild_id: zod.z.string().describe("Guild ID to update. Example: \"197038439483310086\""),
 	name: zod.z.string().min(2).max(100).optional().describe("Guild name (2-100 characters)"),
@@ -6139,11 +6162,7 @@ function updateGuildTool(proxy) {
 		outputSchema: updateGuildOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			if (!metadata?.botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const payload = {};
 			if (input.name !== void 0) payload["name"] = input.name;
 			if (input.region !== void 0) payload["region"] = input.region;
@@ -6168,7 +6187,7 @@ function updateGuildTool(proxy) {
 			if (input.safety_alerts_channel_id !== void 0) payload["safety_alerts_channel_id"] = input.safety_alerts_channel_id;
 			const response = await platformProxy.patch({
 				endpoint: `/api/v10/guilds/${input.guild_id}`,
-				headers: { Authorization: `Bot ${metadata.botToken}` },
+				headers: { Authorization: `Bot ${botToken}` },
 				data: payload,
 				retries: 3
 			});
@@ -6277,13 +6296,7 @@ function updateMessageTool$1(proxy) {
 		outputSchema: updateMessageOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			const parsedMetadata = zod.z.object({ botToken: zod.z.string() }).safeParse(metadata);
-			if (!parsedMetadata.success) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
-			const botToken = parsedMetadata.data.botToken;
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const response = await platformProxy.patch({
 				endpoint: `/api/v10/channels/${input.channel_id}/messages/${input.message_id}`,
 				headers: { Authorization: `Bot ${botToken}` },
@@ -6369,11 +6382,7 @@ function updateRoleTool(proxy) {
 		outputSchema: updateRoleOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const botToken = (await platformProxy.getMetadata())?.botToken;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			if (input.icon !== void 0 && input.icon !== null && input.unicodeEmoji !== void 0 && input.unicodeEmoji !== null) throw new platformProxy.ActionError({
 				type: "invalid_input",
 				message: "icon and unicodeEmoji are mutually exclusive; provide at most one."
@@ -6456,12 +6465,7 @@ function updateWebhookTool$1(proxy) {
 		outputSchema: updateWebhookOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const metadata = await platformProxy.getMetadata();
-			const botToken = metadata && typeof metadata === "object" && "botToken" in metadata && typeof metadata.botToken === "string" ? metadata.botToken : void 0;
-			if (!botToken) throw new platformProxy.ActionError({
-				type: "invalid_metadata",
-				message: "botToken is required in metadata."
-			});
+			const botToken = await resolveDiscordBotToken(platformProxy);
 			const requestBody = {};
 			if (input.name !== void 0) requestBody["name"] = input.name;
 			if (input.avatar !== void 0) requestBody["avatar"] = input.avatar;
@@ -55361,7 +55365,7 @@ const cancelEmailInputSchema = zod.z.object({ email_id: zod.z.string() });
 const ProviderResponseSchema$107 = zod.z.object({
 	object: zod.z.string().optional(),
 	id: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	created_at: zod.z.string().optional(),
@@ -56611,7 +56615,7 @@ const getEmailInputSchema = zod.z.object({ email_id: zod.z.string() });
 const ProviderResponseSchema$76 = zod.z.object({
 	object: zod.z.string().optional(),
 	id: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	created_at: zod.z.string().optional(),
@@ -56698,7 +56702,7 @@ const ProviderResponseSchema$74 = zod.z.object({
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	subject: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	bcc: zod.z.array(zod.z.string()).nullable().optional(),
 	cc: zod.z.array(zod.z.string()).nullable().optional(),
 	reply_to: zod.z.array(zod.z.string()).nullable().optional(),
@@ -56772,7 +56776,7 @@ const ProviderResponseSchema$72 = zod.z.object({
 	current_version_id: zod.z.string().optional(),
 	name: zod.z.string().optional(),
 	alias: zod.z.string().optional(),
-	from: zod.z.string().optional(),
+	from: zod.z.string().nullable().optional(),
 	subject: zod.z.string().optional(),
 	reply_to: zod.z.array(zod.z.string()).nullable().optional(),
 	html: zod.z.string().optional(),
@@ -57495,7 +57499,7 @@ const ProviderResponseSchema$57 = zod.z.object({
 	data: zod.z.array(zod.z.object({
 		object: zod.z.string().optional(),
 		id: zod.z.string().optional(),
-		message_id: zod.z.string().optional(),
+		message_id: zod.z.string().nullable().optional(),
 		to: zod.z.array(zod.z.string()).optional(),
 		from: zod.z.string().optional(),
 		created_at: zod.z.string().optional(),
@@ -57614,7 +57618,7 @@ const ProviderResponseSchema$55 = zod.z.object({
 		to: zod.z.array(zod.z.string()).optional(),
 		from: zod.z.string().optional(),
 		subject: zod.z.string().nullable().optional(),
-		message_id: zod.z.string().optional(),
+		message_id: zod.z.string().nullable().optional(),
 		bcc: zod.z.array(zod.z.string()).nullable().optional(),
 		cc: zod.z.array(zod.z.string()).nullable().optional(),
 		reply_to: zod.z.array(zod.z.string()).nullable().optional(),
@@ -58302,7 +58306,7 @@ function updateContactTopicsTool(proxy) {
 			const config = {
 				endpoint: `/contacts/${encodeURIComponent(input["contact_id"])}/topics`,
 				retries: 3,
-				data: input.body
+				data: input.body.topics
 			};
 			const response = await platformProxy.patch(config);
 			return ProviderResponseSchema$39.parse(response.data);
@@ -74254,8 +74258,10 @@ let nextResolverId = 0;
 * to (or detached from) the project are picked up (or dropped) without a
 * restart.
 *
-* Configuration errors (missing project id, bad ttlMs, malformed integration id)
-* throw here — at call time — so they surface at startup.
+* Configuration errors (missing project id, bad ttlMs, malformed integration id,
+* the removed `autoApproveTools` key) throw here — at call time — so they
+* surface at startup. Configuration errors that need discovery to detect
+* (an unknown tool name in `requireApproval`) fail the resolution instead.
 * Expected provider absence is silently skipped. Actionable per-integration
 * problems during resolution (needs re-auth or ambiguity) are downgraded to
 * warn-and-skip so one bad integration never takes down the whole toolset.
@@ -74271,6 +74277,8 @@ function tools(options = {}) {
 	const integrationOverrides = normalizeIntegrationOverrides(options.integrations);
 	validateIntegrationOverrides(integrationOverrides);
 	validateIntegrationXor(integrationOverrides);
+	validateRequireApproval(integrationOverrides);
+	rejectRemovedAutoApproveTools(integrationOverrides);
 	let cache;
 	let inflight;
 	let closing;
@@ -74389,6 +74397,30 @@ function validateIntegrationXor(integrations) {
 		if (filters.allowTools !== void 0 && filters.disallowTools !== void 0) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': allowTools and disallowTools are mutually exclusive; set at most one.`);
 	}
 }
+/**
+* Rejects a `requireApproval` value that is not a boolean or an array of
+* string tool keys. The approval branches check for literal `true` or an
+* array, so a loosely typed value like `'true'` would otherwise disable
+* approval on MCP providers silently (and crash the HTTP path into
+* warn-and-skip) instead of gating tools as the author intended.
+*/
+function validateRequireApproval(integrations) {
+	for (const [integrationId, providerOptions] of Object.entries(integrations)) {
+		const requireApproval = providerOptions.requireApproval;
+		if (requireApproval === void 0 || typeof requireApproval === "boolean") continue;
+		if (Array.isArray(requireApproval) && requireApproval.every((name) => typeof name === "string")) continue;
+		throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': requireApproval must be a boolean or an array of tool keys.`);
+	}
+}
+/**
+* Rejects the removed `autoApproveTools` option by name. Discovered MCP tools
+* no longer require approval by default, so a loosely typed config still
+* carrying this key would otherwise be ignored silently and its tools would
+* run without the prompts the author expected.
+*/
+function rejectRemovedAutoApproveTools(integrations) {
+	for (const [integrationId, providerOptions] of Object.entries(integrations)) if ("autoApproveTools" in providerOptions) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': autoApproveTools was removed. Tools no longer require approval by default; opt in with requireApproval: true or a list of tool keys to gate.`);
+}
 function buildRequests(integrations, catalog) {
 	const overrides = integrations;
 	const registrations = new Map(TOOLS.map((registration) => [registration.integrationId, registration]));
@@ -74438,16 +74470,19 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connectionId: resolution.connectionId,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = request.registration.createTools({
-				connectionId: resolution.connectionId,
-				client: options.client,
-				...providerFilterOptions(request.options)
-			});
+			} else {
+				providerTools = request.registration.createTools({
+					connectionId: resolution.connectionId,
+					client: options.client,
+					...providerFilterOptions(request.options)
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval);
+			}
 			else if (request.registration.transport === "mcp") {
 				for (const connection of resolution.connections) activeMcpKeys.add(`${integrationId}::${connection.id}`);
 				providerTools = await buildMcpMultiConnectionTools({
@@ -74455,19 +74490,23 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connections: resolution.connections,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = buildProxyMultiConnectionTools({
-				registration: request.registration,
-				connections: resolution.connections,
-				allowTools: request.options.allowTools,
-				disallowTools: request.options.disallowTools,
-				client: options.client
-			});
+			} else {
+				providerTools = buildProxyMultiConnectionTools({
+					registration: request.registration,
+					connections: resolution.connections,
+					allowTools: request.options.allowTools,
+					disallowTools: request.options.disallowTools,
+					client: options.client
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval, [listConnectionsToolKey(integrationId)]);
+			}
 		} catch (error) {
+			if (error instanceof MastraConnectConfigError) throw error;
 			console.warn(`[@mastra/connect] Skipping ${integrationId}: ${error instanceof Error ? error.message : String(error)}`);
 			continue;
 		}
@@ -74491,9 +74530,33 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 function providerFilterOptions(options) {
 	return options.allowTools !== void 0 ? { allowTools: options.allowTools } : options.disallowTools !== void 0 ? { disallowTools: options.disallowTools } : {};
 }
+/**
+* Applies a per-provider `requireApproval` policy to a checked-in HTTP
+* toolset by marking the selected tools. `true` gates every provider tool
+* (but never the synthetic `<provider>__list_connections` wrapper tool,
+* matching the MCP paths, where only server-discovered tools are gated);
+* an array gates the listed keys and rejects unknown names with the same
+* `invalid_options` error MCP discovery raises, so a typo never silently
+* widens access.
+*/
+function applyProxyRequireApproval(providerTools, integrationId, requireApproval, excludeKeys = []) {
+	if (!requireApproval) return;
+	if (requireApproval === true) {
+		const excluded = new Set(excludeKeys);
+		for (const [toolKey, tool] of Object.entries(providerTools)) {
+			if (excluded.has(toolKey)) continue;
+			tool.requireApproval = true;
+		}
+		return;
+	}
+	const known = Object.keys(providerTools);
+	const unknown = requireApproval.filter((name) => !known.includes(name));
+	if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${integrationId}': ${unknown.join(", ")}. Known tools: ${known.join(", ")}.`);
+	for (const name of requireApproval) providerTools[name].requireApproval = true;
+}
 async function discoverMcpTools(input) {
-	const { registration, connectionId, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connectionId, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? new Set(requireApproval) : void 0;
 	const cacheKey = `${registration.integrationId}::${connectionId}`;
 	let entry = mcpClients.get(cacheKey);
 	if (!entry) {
@@ -74505,7 +74568,7 @@ async function discoverMcpTools(input) {
 				id: `mastra-connect-${resolverId}-${registration.integrationId}-${connectionId}`,
 				servers: { [registration.integrationId]: {
 					...transport,
-					requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+					...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor.has(`${registration.integrationId}_${String(toolName)}`) } : {}
 				} }
 			})
 		};
@@ -74514,8 +74577,10 @@ async function discoverMcpTools(input) {
 	const discovery = await entry.client.listToolsWithErrors();
 	const error = discovery.errors[registration.integrationId];
 	if (error) throw new Error(`MCP tool discovery failed: ${error}`);
-	const unknown = [...autoApproved].filter((name) => !(name in discovery.tools));
-	if (unknown.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	if (requireApprovalFor) {
+		const unknown = [...requireApprovalFor].filter((name) => !(name in discovery.tools));
+		if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	}
 	return applyToolFilter(discovery.tools, {
 		allowTools,
 		disallowTools
@@ -74617,6 +74682,7 @@ async function channels(options = {}) {
 	let cache;
 	let inflight;
 	let lastFailureAt;
+	let warnedStaleSlackConnection = false;
 	const buildSnapshot = async () => {
 		let connections;
 		try {
@@ -74627,6 +74693,10 @@ async function channels(options = {}) {
 		}
 		const byIntegrationId = groupByIntegrationId(connections);
 		const providers = {};
+		if (!warnedStaleSlackConnection && states.some((state) => state.registration.integrationId === "slack-channels") && (byIntegrationId.get("slack")?.length ?? 0) > 0 && (byIntegrationId.get("slack-channels")?.length ?? 0) === 0) {
+			warnedStaleSlackConnection = true;
+			console.warn(`[@mastra/connect] Project ${projectId} has an active 'slack' connection but no 'slack-channels' connection: the Slack channel is now keyed off 'slack-channels'. Connect Slack again as 'slack-channels' to restore it; the existing 'slack' connection still powers the generated Slack tools.`);
+		}
 		for (const state of states) {
 			const integrationId = state.registration.integrationId;
 			const overrides = options.integrations?.[integrationId] ?? {};
@@ -74738,7 +74808,9 @@ async function credential(connectionId, options) {
 //#endregion
 //#region src/environment.ts
 function credentialToken(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
+	if (credential.type === "oauth2") return credential.accessToken;
+	if (credential.type === "two_step") return credential.token;
+	return credential.apiKey;
 }
 /**
 * Wires git's credential helper to read the token from the environment at use