@mastra/connect 0.7.0-alpha.1 → 1.0.0-alpha.2

package/dist/index.cjs

@@ -8,18 +8,56 @@ var MastraConnectError = class extends Error {
 	code;
 	status;
 	detail;
+	/**
+	* Axios-compatible alias for {@link status}. Generated provider tools come
+	* from upstream Nango templates whose error handlers check
+	* `error.response.status` (the axios/Nango SDK shape). Exposing the HTTP
+	* status under `response.status` as well lets that generated code work
+	* unchanged against the errors this package throws. Only set when the error
+	* carries an HTTP status.
+	*/
+	response;
 	constructor(code, message, options) {
 		super(message);
 		this.name = "MastraConnectError";
 		this.code = code;
 		this.status = options?.status;
 		this.detail = options?.detail ? truncate(options.detail) : void 0;
+		if (typeof options?.status === "number") this.response = { status: options.status };
+	}
+};
+/**
+* A caller configuration mistake (for example an unknown tool name in
+* `requireApproval`) that must fail resolution instead of being downgraded
+* to the resolver's warn-and-skip path, which exists for provider-side
+* failures. Internal to the package: callers observe it as a regular
+* `MastraConnectError` with code `invalid_options`.
+*
+* @internal
+*/
+var MastraConnectConfigError = class extends MastraConnectError {
+	constructor(message) {
+		super("invalid_options", message);
 	}
 };
 function truncate(text) {
 	return text.length > MAX_DETAIL_LENGTH ? `${text.slice(0, MAX_DETAIL_LENGTH)}…` : text;
 }
 /**
+* Pulls the first human-readable message from an array of error entries. Many
+* providers (Clerk, Linear's GraphQL envelope, Nango v2) return
+* `{ errors: [{ message, long_message, code }] }`; surfacing the first message
+* is the most useful detail without echoing the whole payload.
+*/
+function extractFirstArrayMessage(errors) {
+	for (const entry of errors) {
+		if (!entry || typeof entry !== "object") continue;
+		const record = entry;
+		const message = typeof record.long_message === "string" ? record.long_message : record.message;
+		if (typeof message === "string" && message) return message;
+	}
+}
+/**
 * Extracts a human-readable detail string from an RFC-7807 problem JSON body
 * (or a plain `{ error }` body) without echoing anything else from the response.
 * Returns undefined when the body is not parseable JSON.
@@ -50,6 +88,14 @@ async function extractProblemDetail(response) {
 					};
 				}
 			}
+			if (Array.isArray(data.errors)) {
+				const message = extractFirstArrayMessage(data.errors);
+				if (message) return {
+					detail: truncate(message),
+					code,
+					isProblemJson
+				};
+			}
 			return {
 				code,
 				isProblemJson
@@ -189,14 +235,35 @@ const integrationCatalogEntrySchema = zod.z.object({
 	capabilities: zod.z.object({ mcp: zod.z.boolean().optional() })
 });
 const integrationCatalogResponseSchema = zod.z.object({ integrations: zod.z.array(integrationCatalogEntrySchema) });
-const credentialSchema = zod.z.discriminatedUnion("type", [zod.z.object({
-	type: zod.z.literal("oauth2"),
+/**
+* Secondary access token minted by the vendor alongside the primary oauth2
+* credential (e.g. `devPortalAccessToken` on Microsoft Teams connections).
+* Keyed by the vendor's connection-config field name. Treat this like any
+* other bearer credential — it authenticates second-audience API calls
+* (Teams Dev Portal, etc.) and must not be logged or forwarded to code that
+* shouldn't hold connection secrets.
+*/
+const secondaryAccessTokenSchema = zod.z.object({
 	accessToken: zod.z.string(),
 	expiresAt: zod.z.string().nullable()
-}), zod.z.object({
-	type: zod.z.literal("api_key"),
-	apiKey: zod.z.string()
-})]);
+});
+const credentialSchema = zod.z.discriminatedUnion("type", [
+	zod.z.object({
+		type: zod.z.literal("oauth2"),
+		accessToken: zod.z.string(),
+		expiresAt: zod.z.string().nullable(),
+		secondaryAccessTokens: zod.z.record(zod.z.string(), secondaryAccessTokenSchema).optional()
+	}),
+	zod.z.object({
+		type: zod.z.literal("api_key"),
+		apiKey: zod.z.string()
+	}),
+	zod.z.object({
+		type: zod.z.literal("two_step"),
+		token: zod.z.string(),
+		expiresAt: zod.z.string().nullable()
+	})
+]);
 const connectionContextSchema = zod.z.object({
 	connection_config: zod.z.record(zod.z.string(), zod.z.unknown()).nullable(),
 	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).nullable()
@@ -287,7 +354,12 @@ async function proxyRequestWithResponse(client, connectionId, options) {
 	}
 	const queryString = search.size > 0 ? `?${search.toString()}` : "";
 	const url = `/v2/connections/${encodeURIComponent(connectionId)}/proxy/${cleanPath}${queryString}`;
-	const headers = { ...options.headers };
+	const headers = {};
+	for (const [name, value] of Object.entries(options.headers ?? {})) {
+		const lower = name.toLowerCase();
+		if (lower === "authorization" || lower === "proxy-authorization") continue;
+		headers[name] = value;
+	}
 	if (options.baseUrlOverride !== void 0) {
 		assertValidBaseUrlOverride(options.baseUrlOverride);
 		headers["base-url-override"] = options.baseUrlOverride;
@@ -637,8 +709,8 @@ function buildProxyMultiConnectionTools(input) {
 * client cache so stale clients can be reaped elsewhere.
 */
 async function buildMcpMultiConnectionTools(input) {
-	const { registration, connections, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connections, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? new Set(requireApproval) : void 0;
 	const listToolKey = listConnectionsToolKey(registration.integrationId);
 	const innerAllowTools = allowTools?.filter((name) => name !== listToolKey);
 	const innerDisallowTools = disallowTools?.filter((name) => name !== listToolKey);
@@ -662,7 +734,7 @@ async function buildMcpMultiConnectionTools(input) {
 						id: `mastra-connect-${resolverId}-${registration.integrationId}-${connection.id}`,
 						servers: { [registration.integrationId]: {
 							...transport,
-							requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+							...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor.has(`${registration.integrationId}_${String(toolName)}`) } : {}
 						} }
 					})
 				};
@@ -679,8 +751,10 @@ async function buildMcpMultiConnectionTools(input) {
 		}
 		const catalogUnion = /* @__PURE__ */ new Set();
 		for (const catalog of rawInnerCatalogs.values()) for (const key of Object.keys(catalog)) catalogUnion.add(key);
-		const unknownAutoApprove = [...autoApproved].filter((name) => !catalogUnion.has(name));
-		if (unknownAutoApprove.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknownAutoApprove.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		if (requireApprovalFor) {
+			const unknown = [...requireApprovalFor].filter((name) => !catalogUnion.has(name));
+			if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		}
 		innerToolsByConnectionId = /* @__PURE__ */ new Map();
 		for (const [connectionId, catalog] of rawInnerCatalogs) {
 			const filtered = applyToolFilter(catalog, {
@@ -709,10 +783,14 @@ async function buildMcpMultiConnectionTools(input) {
 //#endregion
 //#region src/providers/channels.ts
 function credentialToken$1(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
+	switch (credential.type) {
+		case "oauth2": return credential.accessToken;
+		case "two_step": return credential.token;
+		default: return credential.apiKey;
+	}
 }
 const RESERVED_OPTION_KEYS = {
-	slack: [
+	"slack-channels": [
 		"baseUrl",
 		"refreshToken",
 		"token",
@@ -726,7 +804,14 @@ const RESERVED_OPTION_KEYS = {
 		"tokenResolver",
 		"encryptionKey"
 	],
-	discord: ["baseUrl", "encryptionKey"]
+	discord: ["baseUrl", "encryptionKey"],
+	"microsoft-teams": [
+		"baseUrl",
+		"appId",
+		"appPassword",
+		"tokenResolver",
+		"encryptionKey"
+	]
 };
 function stripReservedOptions(integrationId, options) {
 	if (!options) return options;
@@ -746,10 +831,10 @@ function stripReservedOptions(integrationId, options) {
 }
 const CHANNELS$1 = [
 	{
-		integrationId: "slack",
+		integrationId: "slack-channels",
 		async create(options, runtime) {
 			const mod = await import("@mastra/slack");
-			const safeOptions = stripReservedOptions("slack", options);
+			const safeOptions = stripReservedOptions("slack-channels", options);
 			const tokenResolver = async () => {
 				return credentialToken$1(await runtime.getCredential());
 			};
@@ -797,17 +882,42 @@ const CHANNELS$1 = [
 				}
 			};
 		}
+	},
+	{
+		integrationId: "microsoft-teams",
+		async create(options, runtime) {
+			const mod = await import("@mastra/teams");
+			if (!process.env.MASTRA_ENCRYPTION_KEY) throw new MastraConnectError("invalid_options", "Microsoft Teams channel: MASTRA_ENCRYPTION_KEY is not set. The Teams install store persists per-agent bot secrets and requires an at-rest encryption key (a 32-byte value, base64-encoded).");
+			const safeOptions = stripReservedOptions("microsoft-teams", options);
+			const tokenResolver = async (scope) => {
+				const fresh = await runtime.getCredential();
+				if (!(Array.isArray(scope) ? scope : [scope]).includes(mod.TEAMS_DEV_PORTAL_SCOPE)) return credentialToken$1(fresh);
+				const token = fresh.type === "oauth2" ? fresh.secondaryAccessTokens?.devPortalAccessToken?.accessToken : void 0;
+				if (!token) throw new MastraConnectError("no_active_connection", `Teams connection ${runtime.getConnectionId()} has no Dev Portal token on its credential. Reconnect with an integration that requests the ${mod.TEAMS_DEV_PORTAL_SCOPE} scope.`);
+				return token;
+			};
+			return { provider: new mod.TeamsProvider({
+				tokenResolver,
+				...safeOptions ?? {}
+			}) };
+		}
 	}
 ];
 //#endregion
 //#region src/runtime/platform-proxy.ts
 /** Maps the platform credential to the field names templates are written against. */
 function toTemplateCredentials(credential) {
-	return credential.type === "oauth2" ? {
+	if (credential.type === "oauth2") return {
 		type: "OAUTH2",
 		access_token: credential.accessToken,
 		expires_at: credential.expiresAt
-	} : {
+	};
+	if (credential.type === "two_step") return {
+		type: "TWO_STEP",
+		token: credential.token,
+		expires_at: credential.expiresAt
+	};
+	return {
 		type: "API_KEY",
 		apiKey: credential.apiKey
 	};
@@ -1735,8 +1845,8 @@ const anthropicProvider = {
 //#endregion
 //#region src/providers/clerk/tools/assign-organization-role-permission.ts
 const assignOrganizationRolePermissionInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
-	permission_id: zod.z.string()
+	organization_role_id: zod.z.string().min(1),
+	permission_id: zod.z.string().min(1)
 });
 const ResourceSchema$49 = zod.z.object({
 	id: zod.z.string(),
@@ -1772,8 +1882,8 @@ function assignOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-email-address.ts
 const createEmailAddressInputSchema = zod.z.object({
-	user_id: zod.z.string(),
-	email_address: zod.z.string(),
+	user_id: zod.z.string().min(1),
+	email_address: zod.z.string().email(),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	notify_primary_email_address_changed: zod.z.boolean().optional()
@@ -1818,16 +1928,22 @@ function createEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/create-organization-domain.ts
-const EnrollmentModeSchema$2 = zod.z.enum([
+const EnrollmentModeSchema$3 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$2 = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const createOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$2,
+	enrollment_mode: EnrollmentModeSchema$3,
 	verified: zod.z.boolean().optional()
 });
 const ResourceSchema$47 = zod.z.object({
@@ -1835,15 +1951,15 @@ const ResourceSchema$47 = zod.z.object({
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$2.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$2.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -1872,7 +1988,7 @@ function createOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-invitation.ts
 const createOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	email_address: zod.z.string().email(),
 	role: zod.z.string(),
 	inviter_user_id: zod.z.string().optional(),
@@ -1893,7 +2009,7 @@ const ResourceSchema$46 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -1926,8 +2042,8 @@ function createOrganizationInvitationTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-membership.ts
 const createOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	role: zod.z.string(),
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
@@ -2063,7 +2179,7 @@ function createOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-phone-number.ts
 const createPhoneNumberInputSchema = zod.z.object({
-	user_id: zod.z.string(),
+	user_id: zod.z.string().min(1),
 	phone_number: zod.z.string(),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
@@ -2126,7 +2242,7 @@ const createUserInputSchema$2 = zod.z.object({
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	unsafe_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
+}).refine((value) => (value.email_address?.length ?? 0) > 0 || (value.phone_number?.length ?? 0) > 0 || value.username !== void 0 || value.password !== void 0, { message: "Provide at least one of email_address, phone_number, username, or password." });
 const UserSchema$27 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2178,7 +2294,7 @@ function createUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-email-address.ts
-const deleteEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string() });
+const deleteEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string().min(1) });
 const deleteEmailAddressOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2204,8 +2320,8 @@ function deleteEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-domain.ts
 const deleteOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1)
 });
 const deleteOrganizationDomainOutputSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -2232,8 +2348,8 @@ function deleteOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-membership.ts
 const deleteOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1)
 });
 const deleteOrganizationMembershipOutputSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -2259,7 +2375,7 @@ function deleteOrganizationMembershipTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-role.ts
-const deleteOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string() });
+const deleteOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string().min(1) });
 const deleteOrganizationRoleOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2309,7 +2425,7 @@ function deleteOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-phone-number.ts
-const deletePhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string() });
+const deletePhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string().min(1) });
 const deletePhoneNumberOutputSchema = zod.z.object({
 	id: zod.z.string(),
 	success: zod.z.boolean()
@@ -2359,7 +2475,7 @@ function deleteUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-email-address.ts
-const getEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string() });
+const getEmailAddressInputSchema = zod.z.object({ email_address_id: zod.z.string().min(1) });
 const ResourceSchema$42 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2394,8 +2510,8 @@ function getEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/get-organization-invitation.ts
 const getOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	invitation_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	invitation_id: zod.z.string().min(1)
 });
 const ResourceSchema$41 = zod.z.object({
 	id: zod.z.string(),
@@ -2408,7 +2524,7 @@ const ResourceSchema$41 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -2430,7 +2546,7 @@ function getOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-organization-role.ts
-const getOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string() });
+const getOrganizationRoleInputSchema = zod.z.object({ organization_role_id: zod.z.string().min(1) });
 const ResourceSchema$40 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2502,7 +2618,7 @@ function getOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-phone-number.ts
-const getPhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string() });
+const getPhoneNumberInputSchema = zod.z.object({ phone_number_id: zod.z.string().min(1) });
 const ResourceSchema$39 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2537,7 +2653,7 @@ function getPhoneNumberTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-session.ts
-const getSessionInputSchema = zod.z.object({ session_id: zod.z.string() });
+const getSessionInputSchema = zod.z.object({ session_id: zod.z.string().min(1) });
 const ResourceSchema$38 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -2551,7 +2667,7 @@ const ResourceSchema$38 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
@@ -2611,33 +2727,39 @@ function getUserTool$7(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/list-organization-domains.ts
-const EnrollmentModeSchema$1 = zod.z.enum([
+const EnrollmentModeSchema$2 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$1 = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const listOrganizationDomainsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
-	enrollment_mode: EnrollmentModeSchema$1.optional()
+	enrollment_mode: EnrollmentModeSchema$2.optional()
 });
 const ResourceSchema$37 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema$1.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$1.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -2648,7 +2770,7 @@ const ProviderResponseSchema$244 = zod.z.object({
 });
 const listOrganizationDomainsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$37),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationDomainsTool(proxy) {
@@ -2659,11 +2781,7 @@ function listOrganizationDomainsTool(proxy) {
 		outputSchema: listOrganizationDomainsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/domains`,
 				params: {
@@ -2687,9 +2805,9 @@ function listOrganizationDomainsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-invitations.ts
 const listOrganizationInvitationsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	status: zod.z.enum([
 		"pending",
 		"accepted",
@@ -2710,7 +2828,7 @@ const ResourceSchema$36 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -2720,7 +2838,7 @@ const ProviderResponseSchema$243 = zod.z.object({
 });
 const listOrganizationInvitationsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$36),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationInvitationsTool(proxy) {
@@ -2731,11 +2849,7 @@ function listOrganizationInvitationsTool(proxy) {
 		outputSchema: listOrganizationInvitationsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/invitations`,
 				params: {
@@ -2760,9 +2874,9 @@ function listOrganizationInvitationsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-memberships.ts
 const listOrganizationMembershipsInputSchema$1 = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	organization_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
 	user_id: zod.z.array(zod.z.string()).optional(),
 	email_address: zod.z.array(zod.z.string()).optional(),
 	phone_number: zod.z.array(zod.z.string()).optional(),
@@ -2796,7 +2910,7 @@ const ProviderResponseSchema$242 = zod.z.object({
 });
 const listOrganizationMembershipsOutputSchema$1 = zod.z.object({
 	items: zod.z.array(ResourceSchema$35),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationMembershipsTool$1(proxy) {
@@ -2807,11 +2921,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 		outputSchema: listOrganizationMembershipsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/memberships`,
 				params: {
@@ -2849,7 +2959,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-roles.ts
 const listOrganizationRolesInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
 	query: zod.z.string().optional(),
 	order_by: zod.z.string().optional()
@@ -2874,7 +2984,7 @@ const ProviderResponseSchema$241 = zod.z.object({
 });
 const listOrganizationRolesOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$34),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listOrganizationRolesTool(proxy) {
@@ -2885,11 +2995,7 @@ function listOrganizationRolesTool(proxy) {
 		outputSchema: listOrganizationRolesOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organization_roles",
 				params: {
@@ -2913,7 +3019,7 @@ function listOrganizationRolesTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organizations.ts
 const listOrganizationsInputSchema$1 = zod.z.object({
-	cursor: zod.z.string().optional(),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
 	query: zod.z.string().optional(),
 	order_by: zod.z.string().optional().describe("Sort by name, created_at, or members_count, prefixed with + or -."),
@@ -2953,11 +3059,7 @@ function listOrganizationsTool$1(proxy) {
 		outputSchema: listOrganizationsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organizations",
 				params: {
@@ -2983,10 +3085,10 @@ function listOrganizationsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-sessions.ts
 const listSessionsInputSchema = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional(),
-	client_id: zod.z.string().optional(),
-	user_id: zod.z.string().optional(),
+	client_id: zod.z.string().min(1).optional(),
+	user_id: zod.z.string().min(1).optional(),
 	status: zod.z.enum([
 		"abandoned",
 		"active",
@@ -2996,7 +3098,7 @@ const listSessionsInputSchema = zod.z.object({
 		"replaced",
 		"revoked"
 	]).optional()
-});
+}).refine((value) => value.client_id !== void 0 || value.user_id !== void 0, { message: "Provide at least one of client_id or user_id." });
 const ResourceSchema$33 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3010,21 +3112,17 @@ const ResourceSchema$33 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
-const ProviderResponseSchema$239 = zod.z.object({
-	data: zod.z.array(ResourceSchema$33),
-	total_count: zod.z.number()
-});
+const ProviderResponseSchema$239 = zod.z.array(ResourceSchema$33);
 const listSessionsOutputSchema = zod.z.object({
 	items: zod.z.array(ResourceSchema$33),
-	next_cursor: zod.z.string().optional(),
-	total: zod.z.number()
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page.")
 });
 function listSessionsTool(proxy) {
 	return (0, _mastra_core_tools.createTool)({
@@ -3034,28 +3132,23 @@ function listSessionsTool(proxy) {
 		outputSchema: listSessionsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const limit = input.limit ?? 10;
 			const response = await platformProxy.get({
 				endpoint: "/v1/sessions",
 				params: {
 					offset: String(offset),
-					...input.limit !== void 0 && { limit: String(input.limit) },
+					limit: String(limit),
 					...input.client_id !== void 0 && { client_id: input.client_id },
 					...input.user_id !== void 0 && { user_id: input.user_id },
 					...input.status !== void 0 && { status: input.status }
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$239.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const sessions = ProviderResponseSchema$239.parse(response.data);
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: sessions,
+				...sessions.length === limit && { next_cursor: String(offset + sessions.length) }
 			};
 		}
 	});
@@ -3063,13 +3156,19 @@ function listSessionsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-users.ts
 const listUsersInputSchema$9 = zod.z.object({
-	cursor: zod.z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: zod.z.number().int().min(1).max(500).optional().describe("Maximum number of users to return. Maximum 500."),
 	query: zod.z.string().optional().describe("Search across names, identifiers, email addresses, phone numbers, and usernames."),
 	email_address: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by email addresses."),
+	phone_number: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by phone numbers."),
+	username: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by usernames."),
 	user_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by Clerk user IDs."),
 	external_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by external user IDs."),
 	organization_id: zod.z.array(zod.z.string()).max(100).optional().describe("Filter by organization IDs."),
+	last_active_at_before: zod.z.number().int().optional().describe("Filter users last active before this Unix timestamp in milliseconds."),
+	last_active_at_after: zod.z.number().int().optional().describe("Filter users last active after this Unix timestamp in milliseconds."),
+	created_at_before: zod.z.number().int().optional().describe("Filter users created before this Unix timestamp in milliseconds."),
+	created_at_after: zod.z.number().int().optional().describe("Filter users created after this Unix timestamp in milliseconds."),
 	order_by: zod.z.string().optional().describe("Sort field prefixed with + for ascending or - for descending. Example: \"-created_at\"")
 });
 const UserSchema$25 = zod.z.object({
@@ -3088,13 +3187,11 @@ const UserSchema$25 = zod.z.object({
 	updated_at: zod.z.number().optional(),
 	locale: zod.z.string().nullable().optional()
 }).passthrough();
-const ProviderResponseSchema$238 = zod.z.object({
-	data: zod.z.array(UserSchema$25),
-	total_count: zod.z.number()
-});
+const ProviderResponseSchema$238 = zod.z.array(UserSchema$25);
+const ProviderCountSchema = zod.z.object({ total_count: zod.z.number() }).passthrough();
 const listUsersOutputSchema$9 = zod.z.object({
 	items: zod.z.array(UserSchema$25),
-	next_cursor: zod.z.string().optional(),
+	next_cursor: zod.z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: zod.z.number()
 });
 function listUsersTool$9(proxy) {
@@ -3105,31 +3202,42 @@ function listUsersTool$9(proxy) {
 		outputSchema: listUsersOutputSchema$9,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const filterParams = {
+				...input.query !== void 0 && { query: input.query },
+				...input.email_address !== void 0 && { email_address: input.email_address },
+				...input.phone_number !== void 0 && { phone_number: input.phone_number },
+				...input.username !== void 0 && { username: input.username },
+				...input.user_id !== void 0 && { user_id: input.user_id },
+				...input.external_id !== void 0 && { external_id: input.external_id },
+				...input.organization_id !== void 0 && { organization_id: input.organization_id },
+				...input.last_active_at_before !== void 0 && { last_active_at_before: String(input.last_active_at_before) },
+				...input.last_active_at_after !== void 0 && { last_active_at_after: String(input.last_active_at_after) },
+				...input.created_at_before !== void 0 && { created_at_before: String(input.created_at_before) },
+				...input.created_at_after !== void 0 && { created_at_after: String(input.created_at_after) }
+			};
 			const response = await platformProxy.get({
 				endpoint: "/v1/users",
 				params: {
 					offset: String(offset),
 					...input.limit !== void 0 && { limit: String(input.limit) },
-					...input.query !== void 0 && { query: input.query },
-					...input.email_address !== void 0 && { email_address: input.email_address },
-					...input.user_id !== void 0 && { user_id: input.user_id },
-					...input.external_id !== void 0 && { external_id: input.external_id },
-					...input.organization_id !== void 0 && { organization_id: input.organization_id },
-					...input.order_by !== void 0 && { order_by: input.order_by }
+					...input.order_by !== void 0 && { order_by: input.order_by },
+					...filterParams
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$238.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const users = ProviderResponseSchema$238.parse(response.data);
+			const countResponse = await platformProxy.get({
+				endpoint: "/v1/users/count",
+				params: filterParams,
+				retries: 3
+			});
+			const total = ProviderCountSchema.parse(countResponse.data).total_count;
+			const nextOffset = offset + users.length;
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: users,
+				...users.length > 0 && nextOffset < total && { next_cursor: String(nextOffset) },
+				total
 			};
 		}
 	});
@@ -3137,8 +3245,8 @@ function listUsersTool$9(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/remove-organization-role-permission.ts
 const removeOrganizationRolePermissionInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
-	permission_id: zod.z.string()
+	organization_role_id: zod.z.string().min(1),
+	permission_id: zod.z.string().min(1)
 });
 const removeOrganizationRolePermissionOutputSchema = zod.z.object({
 	id: zod.z.string(),
@@ -3165,8 +3273,8 @@ function removeOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/revoke-organization-invitation.ts
 const revokeOrganizationInvitationInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	invitation_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	invitation_id: zod.z.string().min(1),
 	requesting_user_id: zod.z.string().optional()
 });
 const ResourceSchema$32 = zod.z.object({
@@ -3180,7 +3288,7 @@ const ResourceSchema$32 = zod.z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
 }).passthrough();
@@ -3203,7 +3311,7 @@ function revokeOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/revoke-session.ts
-const revokeSessionInputSchema = zod.z.object({ session_id: zod.z.string() });
+const revokeSessionInputSchema = zod.z.object({ session_id: zod.z.string().min(1) });
 const ResourceSchema$31 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3217,7 +3325,7 @@ const ResourceSchema$31 = zod.z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(zod.z.string()).optional(),
 	last_active_at: zod.z.number().optional(),
 	expire_at: zod.z.number().optional(),
 	abandon_at: zod.z.number().optional(),
@@ -3244,7 +3352,7 @@ function revokeSessionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-email-address.ts
 const updateEmailAddressInputSchema = zod.z.object({
-	email_address_id: zod.z.string(),
+	email_address_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	notify_primary_email_address_changed: zod.z.boolean().optional()
@@ -3287,16 +3395,22 @@ function updateEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/update-organization-domain.ts
-const EnrollmentModeSchema = zod.z.enum([
+const EnrollmentModeSchema$1 = zod.z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const updateOrganizationDomainInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1),
+	enrollment_mode: EnrollmentModeSchema$1.optional(),
 	verified: zod.z.boolean().optional()
 });
 const ResourceSchema$29 = zod.z.object({
@@ -3304,15 +3418,15 @@ const ResourceSchema$29 = zod.z.object({
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -3340,8 +3454,8 @@ function updateOrganizationDomainTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership-metadata.ts
 const updateOrganizationMembershipMetadataInputSchema = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
 	private_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
@@ -3378,8 +3492,8 @@ function updateOrganizationMembershipMetadataTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership.ts
 const updateOrganizationMembershipInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	user_id: zod.z.string(),
+	organization_id: zod.z.string().min(1),
+	user_id: zod.z.string().min(1),
 	role: zod.z.string()
 });
 const ResourceSchema$27 = zod.z.object({
@@ -3412,12 +3526,12 @@ function updateOrganizationMembershipTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-role.ts
 const updateOrganizationRoleInputSchema = zod.z.object({
-	organization_role_id: zod.z.string(),
+	organization_role_id: zod.z.string().min(1),
 	name: zod.z.string().optional(),
 	key: zod.z.string().optional(),
 	description: zod.z.string().optional(),
 	permissions: zod.z.array(zod.z.string()).optional()
-});
+}).refine((value) => value.name !== void 0 || value.key !== void 0 || value.description !== void 0 || value.permissions !== void 0, { message: "Provide at least one of name, key, description, or permissions." });
 const ResourceSchema$26 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
@@ -3461,7 +3575,8 @@ const updateOrganizationInputSchema$1 = zod.z.object({
 	name: zod.z.string().min(1).optional(),
 	slug: zod.z.string().optional(),
 	admin_delete_enabled: zod.z.boolean().optional(),
-	max_allowed_memberships: zod.z.number().int().min(0).optional()
+	max_allowed_memberships: zod.z.number().int().min(0).optional(),
+	public_metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
 });
 const OrganizationSchema$1 = zod.z.object({
 	id: zod.z.string(),
@@ -3493,7 +3608,8 @@ function updateOrganizationTool$1(proxy) {
 					...input.name !== void 0 && { name: input.name },
 					...input.slug !== void 0 && { slug: input.slug },
 					...input.admin_delete_enabled !== void 0 && { admin_delete_enabled: input.admin_delete_enabled },
-					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships }
+					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships },
+					...input.public_metadata !== void 0 && { public_metadata: input.public_metadata }
 				},
 				retries: 3
 			});
@@ -3504,7 +3620,7 @@ function updateOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-phone-number.ts
 const updatePhoneNumberInputSchema = zod.z.object({
-	phone_number_id: zod.z.string(),
+	phone_number_id: zod.z.string().min(1),
 	verified: zod.z.boolean().optional(),
 	primary: zod.z.boolean().optional(),
 	reserved_for_second_factor: zod.z.boolean().optional()
@@ -3550,14 +3666,14 @@ function updatePhoneNumberTool(proxy) {
 //#region src/providers/clerk/tools/update-user.ts
 const updateUserInputSchema$1 = zod.z.object({
 	user_id: zod.z.string().min(1),
-	first_name: zod.z.string().optional(),
-	last_name: zod.z.string().optional(),
-	username: zod.z.string().optional(),
+	first_name: zod.z.string().nullable().optional().describe("Pass null to clear the first name."),
+	last_name: zod.z.string().nullable().optional().describe("Pass null to clear the last name."),
+	username: zod.z.string().nullable().optional().describe("Pass null to clear the username."),
 	password: zod.z.string().min(8).optional(),
 	skip_password_checks: zod.z.boolean().optional(),
 	sign_out_of_other_sessions: zod.z.boolean().optional(),
-	external_id: zod.z.string().optional(),
-	locale: zod.z.string().optional()
+	external_id: zod.z.string().nullable().optional().describe("Pass null to clear the external ID."),
+	locale: zod.z.string().nullable().optional().describe("Pass null to clear the locale.")
 });
 const UserSchema$24 = zod.z.object({
 	id: zod.z.string(),
@@ -3603,24 +3719,30 @@ function updateUserTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/verify-organization-domain.ts
+const EnrollmentModeSchema = zod.z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(zod.z.string());
 const verifyOrganizationDomainInputSchema$1 = zod.z.object({
-	organization_id: zod.z.string(),
-	domain_id: zod.z.string()
+	organization_id: zod.z.string().min(1),
+	domain_id: zod.z.string().min(1)
 });
 const ResourceSchema$24 = zod.z.object({
 	id: zod.z.string(),
 	object: zod.z.string().optional(),
 	organization_id: zod.z.string().optional(),
 	name: zod.z.string(),
-	enrollment_mode: zod.z.string().optional(),
+	enrollment_mode: EnrollmentModeSchema.optional(),
 	affiliation_verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: zod.z.object({
 		attempts: zod.z.number().optional(),
 		status: zod.z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: zod.z.boolean().optional(),
 	created_at: zod.z.number().optional(),
 	updated_at: zod.z.number().optional()
@@ -5178,7 +5300,7 @@ const ChannelSchema$2 = zod.z.object({
 	recipients: zod.z.array(zod.z.unknown()).optional(),
 	icon: zod.z.string().nullable().optional(),
 	owner_id: zod.z.string().optional(),
-	application_id: zod.z.string().optional(),
+	application_id: zod.z.string().nullable().optional(),
 	managed: zod.z.boolean().optional(),
 	parent_id: zod.z.string().nullable().optional(),
 	last_pin_timestamp: zod.z.string().nullable().optional(),
@@ -55243,7 +55365,7 @@ const cancelEmailInputSchema = zod.z.object({ email_id: zod.z.string() });
 const ProviderResponseSchema$107 = zod.z.object({
 	object: zod.z.string().optional(),
 	id: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	created_at: zod.z.string().optional(),
@@ -56493,7 +56615,7 @@ const getEmailInputSchema = zod.z.object({ email_id: zod.z.string() });
 const ProviderResponseSchema$76 = zod.z.object({
 	object: zod.z.string().optional(),
 	id: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	created_at: zod.z.string().optional(),
@@ -56580,7 +56702,7 @@ const ProviderResponseSchema$74 = zod.z.object({
 	to: zod.z.array(zod.z.string()).optional(),
 	from: zod.z.string().optional(),
 	subject: zod.z.string().optional(),
-	message_id: zod.z.string().optional(),
+	message_id: zod.z.string().nullable().optional(),
 	bcc: zod.z.array(zod.z.string()).nullable().optional(),
 	cc: zod.z.array(zod.z.string()).nullable().optional(),
 	reply_to: zod.z.array(zod.z.string()).nullable().optional(),
@@ -56654,7 +56776,7 @@ const ProviderResponseSchema$72 = zod.z.object({
 	current_version_id: zod.z.string().optional(),
 	name: zod.z.string().optional(),
 	alias: zod.z.string().optional(),
-	from: zod.z.string().optional(),
+	from: zod.z.string().nullable().optional(),
 	subject: zod.z.string().optional(),
 	reply_to: zod.z.array(zod.z.string()).nullable().optional(),
 	html: zod.z.string().optional(),
@@ -57377,7 +57499,7 @@ const ProviderResponseSchema$57 = zod.z.object({
 	data: zod.z.array(zod.z.object({
 		object: zod.z.string().optional(),
 		id: zod.z.string().optional(),
-		message_id: zod.z.string().optional(),
+		message_id: zod.z.string().nullable().optional(),
 		to: zod.z.array(zod.z.string()).optional(),
 		from: zod.z.string().optional(),
 		created_at: zod.z.string().optional(),
@@ -57496,7 +57618,7 @@ const ProviderResponseSchema$55 = zod.z.object({
 		to: zod.z.array(zod.z.string()).optional(),
 		from: zod.z.string().optional(),
 		subject: zod.z.string().nullable().optional(),
-		message_id: zod.z.string().optional(),
+		message_id: zod.z.string().nullable().optional(),
 		bcc: zod.z.array(zod.z.string()).nullable().optional(),
 		cc: zod.z.array(zod.z.string()).nullable().optional(),
 		reply_to: zod.z.array(zod.z.string()).nullable().optional(),
@@ -58184,7 +58306,7 @@ function updateContactTopicsTool(proxy) {
 			const config = {
 				endpoint: `/contacts/${encodeURIComponent(input["contact_id"])}/topics`,
 				retries: 3,
-				data: input.body
+				data: input.body.topics
 			};
 			const response = await platformProxy.patch(config);
 			return ProviderResponseSchema$39.parse(response.data);
@@ -74136,8 +74258,10 @@ let nextResolverId = 0;
 * to (or detached from) the project are picked up (or dropped) without a
 * restart.
 *
-* Configuration errors (missing project id, bad ttlMs, malformed integration id)
-* throw here — at call time — so they surface at startup.
+* Configuration errors (missing project id, bad ttlMs, malformed integration id,
+* the removed `autoApproveTools` key) throw here — at call time — so they
+* surface at startup. Configuration errors that need discovery to detect
+* (an unknown tool name in `requireApproval`) fail the resolution instead.
 * Expected provider absence is silently skipped. Actionable per-integration
 * problems during resolution (needs re-auth or ambiguity) are downgraded to
 * warn-and-skip so one bad integration never takes down the whole toolset.
@@ -74153,6 +74277,8 @@ function tools(options = {}) {
 	const integrationOverrides = normalizeIntegrationOverrides(options.integrations);
 	validateIntegrationOverrides(integrationOverrides);
 	validateIntegrationXor(integrationOverrides);
+	validateRequireApproval(integrationOverrides);
+	rejectRemovedAutoApproveTools(integrationOverrides);
 	let cache;
 	let inflight;
 	let closing;
@@ -74271,6 +74397,30 @@ function validateIntegrationXor(integrations) {
 		if (filters.allowTools !== void 0 && filters.disallowTools !== void 0) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': allowTools and disallowTools are mutually exclusive; set at most one.`);
 	}
 }
+/**
+* Rejects a `requireApproval` value that is not a boolean or an array of
+* string tool keys. The approval branches check for literal `true` or an
+* array, so a loosely typed value like `'true'` would otherwise disable
+* approval on MCP providers silently (and crash the HTTP path into
+* warn-and-skip) instead of gating tools as the author intended.
+*/
+function validateRequireApproval(integrations) {
+	for (const [integrationId, providerOptions] of Object.entries(integrations)) {
+		const requireApproval = providerOptions.requireApproval;
+		if (requireApproval === void 0 || typeof requireApproval === "boolean") continue;
+		if (Array.isArray(requireApproval) && requireApproval.every((name) => typeof name === "string")) continue;
+		throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': requireApproval must be a boolean or an array of tool keys.`);
+	}
+}
+/**
+* Rejects the removed `autoApproveTools` option by name. Discovered MCP tools
+* no longer require approval by default, so a loosely typed config still
+* carrying this key would otherwise be ignored silently and its tools would
+* run without the prompts the author expected.
+*/
+function rejectRemovedAutoApproveTools(integrations) {
+	for (const [integrationId, providerOptions] of Object.entries(integrations)) if ("autoApproveTools" in providerOptions) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': autoApproveTools was removed. Tools no longer require approval by default; opt in with requireApproval: true or a list of tool keys to gate.`);
+}
 function buildRequests(integrations, catalog) {
 	const overrides = integrations;
 	const registrations = new Map(TOOLS.map((registration) => [registration.integrationId, registration]));
@@ -74320,16 +74470,19 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connectionId: resolution.connectionId,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = request.registration.createTools({
-				connectionId: resolution.connectionId,
-				client: options.client,
-				...providerFilterOptions(request.options)
-			});
+			} else {
+				providerTools = request.registration.createTools({
+					connectionId: resolution.connectionId,
+					client: options.client,
+					...providerFilterOptions(request.options)
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval);
+			}
 			else if (request.registration.transport === "mcp") {
 				for (const connection of resolution.connections) activeMcpKeys.add(`${integrationId}::${connection.id}`);
 				providerTools = await buildMcpMultiConnectionTools({
@@ -74337,19 +74490,23 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connections: resolution.connections,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = buildProxyMultiConnectionTools({
-				registration: request.registration,
-				connections: resolution.connections,
-				allowTools: request.options.allowTools,
-				disallowTools: request.options.disallowTools,
-				client: options.client
-			});
+			} else {
+				providerTools = buildProxyMultiConnectionTools({
+					registration: request.registration,
+					connections: resolution.connections,
+					allowTools: request.options.allowTools,
+					disallowTools: request.options.disallowTools,
+					client: options.client
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval, [listConnectionsToolKey(integrationId)]);
+			}
 		} catch (error) {
+			if (error instanceof MastraConnectConfigError) throw error;
 			console.warn(`[@mastra/connect] Skipping ${integrationId}: ${error instanceof Error ? error.message : String(error)}`);
 			continue;
 		}
@@ -74373,9 +74530,33 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 function providerFilterOptions(options) {
 	return options.allowTools !== void 0 ? { allowTools: options.allowTools } : options.disallowTools !== void 0 ? { disallowTools: options.disallowTools } : {};
 }
+/**
+* Applies a per-provider `requireApproval` policy to a checked-in HTTP
+* toolset by marking the selected tools. `true` gates every provider tool
+* (but never the synthetic `<provider>__list_connections` wrapper tool,
+* matching the MCP paths, where only server-discovered tools are gated);
+* an array gates the listed keys and rejects unknown names with the same
+* `invalid_options` error MCP discovery raises, so a typo never silently
+* widens access.
+*/
+function applyProxyRequireApproval(providerTools, integrationId, requireApproval, excludeKeys = []) {
+	if (!requireApproval) return;
+	if (requireApproval === true) {
+		const excluded = new Set(excludeKeys);
+		for (const [toolKey, tool] of Object.entries(providerTools)) {
+			if (excluded.has(toolKey)) continue;
+			tool.requireApproval = true;
+		}
+		return;
+	}
+	const known = Object.keys(providerTools);
+	const unknown = requireApproval.filter((name) => !known.includes(name));
+	if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${integrationId}': ${unknown.join(", ")}. Known tools: ${known.join(", ")}.`);
+	for (const name of requireApproval) providerTools[name].requireApproval = true;
+}
 async function discoverMcpTools(input) {
-	const { registration, connectionId, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connectionId, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? new Set(requireApproval) : void 0;
 	const cacheKey = `${registration.integrationId}::${connectionId}`;
 	let entry = mcpClients.get(cacheKey);
 	if (!entry) {
@@ -74387,7 +74568,7 @@ async function discoverMcpTools(input) {
 				id: `mastra-connect-${resolverId}-${registration.integrationId}-${connectionId}`,
 				servers: { [registration.integrationId]: {
 					...transport,
-					requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+					...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor.has(`${registration.integrationId}_${String(toolName)}`) } : {}
 				} }
 			})
 		};
@@ -74396,8 +74577,10 @@ async function discoverMcpTools(input) {
 	const discovery = await entry.client.listToolsWithErrors();
 	const error = discovery.errors[registration.integrationId];
 	if (error) throw new Error(`MCP tool discovery failed: ${error}`);
-	const unknown = [...autoApproved].filter((name) => !(name in discovery.tools));
-	if (unknown.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	if (requireApprovalFor) {
+		const unknown = [...requireApprovalFor].filter((name) => !(name in discovery.tools));
+		if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	}
 	return applyToolFilter(discovery.tools, {
 		allowTools,
 		disallowTools
@@ -74499,6 +74682,7 @@ async function channels(options = {}) {
 	let cache;
 	let inflight;
 	let lastFailureAt;
+	let warnedStaleSlackConnection = false;
 	const buildSnapshot = async () => {
 		let connections;
 		try {
@@ -74509,6 +74693,10 @@ async function channels(options = {}) {
 		}
 		const byIntegrationId = groupByIntegrationId(connections);
 		const providers = {};
+		if (!warnedStaleSlackConnection && states.some((state) => state.registration.integrationId === "slack-channels") && (byIntegrationId.get("slack")?.length ?? 0) > 0 && (byIntegrationId.get("slack-channels")?.length ?? 0) === 0) {
+			warnedStaleSlackConnection = true;
+			console.warn(`[@mastra/connect] Project ${projectId} has an active 'slack' connection but no 'slack-channels' connection: the Slack channel is now keyed off 'slack-channels'. Connect Slack again as 'slack-channels' to restore it; the existing 'slack' connection still powers the generated Slack tools.`);
+		}
 		for (const state of states) {
 			const integrationId = state.registration.integrationId;
 			const overrides = options.integrations?.[integrationId] ?? {};
@@ -74620,7 +74808,9 @@ async function credential(connectionId, options) {
 //#endregion
 //#region src/environment.ts
 function credentialToken(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
+	if (credential.type === "oauth2") return credential.accessToken;
+	if (credential.type === "two_step") return credential.token;
+	return credential.apiKey;
 }
 /**
 * Wires git's credential helper to read the token from the environment at use