@mastra/connect 0.7.0-alpha.1 → 1.0.0-alpha.4

package/dist/index.js

@@ -1,5 +1,6 @@
 import { MCPClient } from "@mastra/mcp";
 import { z } from "zod";
+import { SpanType, resolveCurrentSpan } from "@mastra/core/observability";
 import { createTool } from "@mastra/core/tools";
 //#region src/errors.ts
 const MAX_DETAIL_LENGTH = 2e3;
@@ -7,18 +8,56 @@ var MastraConnectError = class extends Error {
 	code;
 	status;
 	detail;
+	/**
+	* Axios-compatible alias for {@link status}. Generated provider tools come
+	* from upstream Nango templates whose error handlers check
+	* `error.response.status` (the axios/Nango SDK shape). Exposing the HTTP
+	* status under `response.status` as well lets that generated code work
+	* unchanged against the errors this package throws. Only set when the error
+	* carries an HTTP status.
+	*/
+	response;
 	constructor(code, message, options) {
 		super(message);
 		this.name = "MastraConnectError";
 		this.code = code;
 		this.status = options?.status;
 		this.detail = options?.detail ? truncate(options.detail) : void 0;
+		if (typeof options?.status === "number") this.response = { status: options.status };
+	}
+};
+/**
+* A caller configuration mistake (for example an unknown tool name in
+* `requireApproval`) that must fail resolution instead of being downgraded
+* to the resolver's warn-and-skip path, which exists for provider-side
+* failures. Internal to the package: callers observe it as a regular
+* `MastraConnectError` with code `invalid_options`.
+*
+* @internal
+*/
+var MastraConnectConfigError = class extends MastraConnectError {
+	constructor(message) {
+		super("invalid_options", message);
 	}
 };
 function truncate(text) {
 	return text.length > MAX_DETAIL_LENGTH ? `${text.slice(0, MAX_DETAIL_LENGTH)}…` : text;
 }
 /**
+* Pulls the first human-readable message from an array of error entries. Many
+* providers (Clerk, Linear's GraphQL envelope, Nango v2) return
+* `{ errors: [{ message, long_message, code }] }`; surfacing the first message
+* is the most useful detail without echoing the whole payload.
+*/
+function extractFirstArrayMessage(errors) {
+	for (const entry of errors) {
+		if (!entry || typeof entry !== "object") continue;
+		const record = entry;
+		const message = typeof record.long_message === "string" ? record.long_message : record.message;
+		if (typeof message === "string" && message) return message;
+	}
+}
+/**
 * Extracts a human-readable detail string from an RFC-7807 problem JSON body
 * (or a plain `{ error }` body) without echoing anything else from the response.
 * Returns undefined when the body is not parseable JSON.
@@ -49,6 +88,14 @@ async function extractProblemDetail(response) {
 					};
 				}
 			}
+			if (Array.isArray(data.errors)) {
+				const message = extractFirstArrayMessage(data.errors);
+				if (message) return {
+					detail: truncate(message),
+					code,
+					isProblemJson
+				};
+			}
 			return {
 				code,
 				isProblemJson
@@ -58,6 +105,98 @@ async function extractProblemDetail(response) {
 	return { isProblemJson };
 }
 //#endregion
+//#region src/instrumentation.ts
+const ID_SEGMENT_ROUTES = [{
+	prefix: "/v2/connections/",
+	placeholder: "{connectionId}",
+	key: "connectionId"
+}, {
+	prefix: "/v2/projects/",
+	placeholder: "{projectId}",
+	key: "projectId"
+}];
+const PROXY_SEGMENT = "/proxy/";
+/** Describes a platform request for span naming without leaking query params, ids, or vendor path segments. */
+function describePlatformCall(method, rawPath) {
+	const path = rawPath.split("?")[0];
+	let route = path;
+	const descriptor = {
+		method,
+		route,
+		isProxy: false
+	};
+	for (const idRoute of ID_SEGMENT_ROUTES) {
+		if (!path.startsWith(idRoute.prefix)) continue;
+		const rest = path.slice(idRoute.prefix.length);
+		const slash = rest.indexOf("/");
+		const id = slash === -1 ? rest : rest.slice(0, slash);
+		const tail = slash === -1 ? "" : rest.slice(slash);
+		descriptor[idRoute.key] = safeDecode(id);
+		route = `${idRoute.prefix}${idRoute.placeholder}${tail}`;
+		break;
+	}
+	const proxyIndex = route.indexOf(PROXY_SEGMENT);
+	if (proxyIndex !== -1) {
+		descriptor.isProxy = true;
+		route = `${route.slice(0, proxyIndex + 7)}*`;
+	}
+	descriptor.route = route;
+	return descriptor;
+}
+function safeDecode(segment) {
+	try {
+		return decodeURIComponent(segment);
+	} catch {
+		return segment;
+	}
+}
+/**
+* Starts a GENERIC child span for an outbound connect HTTP call, or returns
+* `undefined` when no ambient span is active. Span creation failures are
+* swallowed: instrumentation must never break a request.
+*/
+function startPlatformCallSpan(descriptor) {
+	let parent;
+	try {
+		parent = resolveCurrentSpan();
+		if (!parent) return void 0;
+		return parent.createChildSpan({
+			type: SpanType.GENERIC,
+			name: `connect.${descriptor.isProxy ? "proxy" : "platform"} ${descriptor.method} ${descriptor.route}`,
+			metadata: {
+				method: descriptor.method,
+				route: descriptor.route,
+				...descriptor.connectionId ? { connectionId: descriptor.connectionId } : {},
+				...descriptor.projectId ? { projectId: descriptor.projectId } : {}
+			}
+		});
+	} catch {
+		return;
+	}
+}
+/** Ends a platform-call span with the response status. Never throws. */
+function endPlatformCallSpan(span, status) {
+	if (!span) return;
+	try {
+		span.end({ metadata: { status } });
+	} catch {}
+}
+/**
+* Records a transport-level failure on a platform-call span. Nothing from the
+* original error is recorded — fetch failures can embed the request URL in
+* both `message` and `name`, which may carry secret query params — so the
+* span gets a fixed, constant error. Never throws.
+*/
+function errorPlatformCallSpan(span, _error) {
+	if (!span) return;
+	try {
+		span.error({
+			error: /* @__PURE__ */ new Error("connect request failed"),
+			endSpan: true
+		});
+	} catch {}
+}
+//#endregion
 //#region src/client.ts
 const DEFAULT_INTEGRATIONS_URL = "https://integrations.mastra.ai";
 const REGIONAL_INTEGRATIONS_URLS = {
@@ -100,20 +239,25 @@ function redact(message, accessToken) {
 	return message.split(accessToken).join("[REDACTED]");
 }
 async function platformFetch(client, path, init) {
+	const span = startPlatformCallSpan(describePlatformCall(init?.method ?? "GET", path));
 	try {
-		return await client.fetch(`${client.baseUrl}${path}`, {
+		const response = await client.fetch(`${client.baseUrl}${path}`, {
 			...init,
 			headers: {
 				...client.headers,
 				...init?.headers
 			}
 		});
+		endPlatformCallSpan(span, response.status);
+		return response;
 	} catch (error) {
 		if (error instanceof Error && error.message.includes(client.accessToken)) {
 			const redacted = new Error(redact(error.message, client.accessToken));
 			redacted.name = error.name;
+			errorPlatformCallSpan(span, redacted);
 			throw redacted;
 		}
+		errorPlatformCallSpan(span, error);
 		throw error;
 	}
 }
@@ -188,14 +332,35 @@ const integrationCatalogEntrySchema = z.object({
 	capabilities: z.object({ mcp: z.boolean().optional() })
 });
 const integrationCatalogResponseSchema = z.object({ integrations: z.array(integrationCatalogEntrySchema) });
-const credentialSchema = z.discriminatedUnion("type", [z.object({
-	type: z.literal("oauth2"),
+/**
+* Secondary access token minted by the vendor alongside the primary oauth2
+* credential (e.g. `devPortalAccessToken` on Microsoft Teams connections).
+* Keyed by the vendor's connection-config field name. Treat this like any
+* other bearer credential — it authenticates second-audience API calls
+* (Teams Dev Portal, etc.) and must not be logged or forwarded to code that
+* shouldn't hold connection secrets.
+*/
+const secondaryAccessTokenSchema = z.object({
 	accessToken: z.string(),
 	expiresAt: z.string().nullable()
-}), z.object({
-	type: z.literal("api_key"),
-	apiKey: z.string()
-})]);
+});
+const credentialSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("oauth2"),
+		accessToken: z.string(),
+		expiresAt: z.string().nullable(),
+		secondaryAccessTokens: z.record(z.string(), secondaryAccessTokenSchema).optional()
+	}),
+	z.object({
+		type: z.literal("api_key"),
+		apiKey: z.string()
+	}),
+	z.object({
+		type: z.literal("two_step"),
+		token: z.string(),
+		expiresAt: z.string().nullable()
+	})
+]);
 const connectionContextSchema = z.object({
 	connection_config: z.record(z.string(), z.unknown()).nullable(),
 	metadata: z.record(z.string(), z.unknown()).nullable()
@@ -271,9 +436,6 @@ function assertValidBaseUrlOverride(baseUrlOverride) {
 	if (parsed.protocol !== "https:") throw new MastraConnectError("invalid_options", `Invalid baseUrlOverride '${baseUrlOverride}': only https:// URLs are allowed.`);
 	if (parsed.username || parsed.password) throw new MastraConnectError("invalid_options", `Invalid baseUrlOverride '${baseUrlOverride}': embedded credentials are not allowed.`);
 }
-async function proxyRequest(client, connectionId, options) {
-	return (await proxyRequestWithResponse(client, connectionId, options)).data;
-}
 /** Preserves HTTP metadata for tools with status-dependent provider contracts. */
 async function proxyRequestWithResponse(client, connectionId, options) {
 	const cleanPath = options.path.replace(/^\/+/, "");
@@ -286,7 +448,12 @@ async function proxyRequestWithResponse(client, connectionId, options) {
 	}
 	const queryString = search.size > 0 ? `?${search.toString()}` : "";
 	const url = `/v2/connections/${encodeURIComponent(connectionId)}/proxy/${cleanPath}${queryString}`;
-	const headers = { ...options.headers };
+	const headers = {};
+	for (const [name, value] of Object.entries(options.headers ?? {})) {
+		const lower = name.toLowerCase();
+		if (lower === "authorization" || lower === "proxy-authorization") continue;
+		headers[name] = value;
+	}
 	if (options.baseUrlOverride !== void 0) {
 		assertValidBaseUrlOverride(options.baseUrlOverride);
 		headers["base-url-override"] = options.baseUrlOverride;
@@ -355,37 +522,64 @@ async function proxyRequestWithResponse(client, connectionId, options) {
 }
 //#endregion
 //#region src/toolset.ts
-/** Resolves a connection id lazily at execute time: option → env var → typed error naming the env var. */
-function resolveConnectionId(envVar, connectionId) {
-	const resolved = connectionId?.trim() || process.env[envVar]?.trim();
-	if (!resolved) throw new MastraConnectError("missing_connection_id", `Missing connection id: set ${envVar} or pass connectionId.`);
-	return resolved;
+/**
+* Compiles a tool-filter entry containing `*` wildcards into an anchored
+* regex; every other character matches literally.
+*/
+function compileToolPattern(pattern) {
+	const escaped = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return new RegExp(`^${escaped}$`);
 }
 /**
-* Wraps `createTool` so the tool executes through the platform connection
-* proxy. Connection id and client config resolve lazily inside execute, so
-* building tools without env vars set never throws.
+* Returns a predicate testing tool keys against filter `entries`, where an
+* entry containing `*` is a glob and anything else matches literally. Used
+* where keys are only known later (MCP approval predicates); list-shaped
+* call sites expand eagerly with {@link expandToolPatterns} instead.
 */
-function defineProxyTool(context, config) {
-	return createTool({
-		id: config.id,
-		description: config.description,
-		inputSchema: config.inputSchema,
-		outputSchema: config.outputSchema,
-		execute: async (input) => {
-			const connectionId = resolveConnectionId(context.envVar, context.options?.connectionId);
-			const raw = await proxyRequest(resolveClient(context.options?.client), connectionId, config.request(input));
-			return config.transform(raw, input);
+function compileToolMatcher(entries) {
+	const literals = /* @__PURE__ */ new Set();
+	const patterns = [];
+	for (const entry of entries) if (entry.includes("*")) patterns.push(compileToolPattern(entry));
+	else literals.add(entry);
+	return (toolKey) => literals.has(toolKey) || patterns.some((pattern) => pattern.test(toolKey));
+}
+/**
+* Expands `*` glob entries against the known tool keys, preserving order and
+* de-duplicating. Literal entries pass through untouched (callers validate
+* those against their own key sets). A glob that matches nothing throws:
+* like an unknown literal name, a dead pattern in access-limiting config is
+* a typo that must surface instead of silently filtering nothing.
+*/
+function expandToolPatterns(entries, knownKeys, label) {
+	const expanded = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (key) => {
+		if (seen.has(key)) return;
+		seen.add(key);
+		expanded.push(key);
+	};
+	for (const entry of entries) {
+		if (!entry.includes("*")) {
+			push(entry);
+			continue;
 		}
-	});
+		const pattern = compileToolPattern(entry);
+		const matches = knownKeys.filter((key) => pattern.test(key));
+		if (matches.length === 0) throw new MastraConnectConfigError(`Pattern '${entry}' in ${label} matched no tools. Known tools: ${knownKeys.join(", ")}.`);
+		for (const match of matches) push(match);
+	}
+	return expanded;
 }
 /**
-* Filters a toolset by tool key. Throws at build time on unknown names so
-* typos in access-limiting config surface immediately.
+* Filters a toolset by tool key. Entries containing `*` are globs expanded
+* against the toolset's keys. Throws at build time on unknown names and on
+* globs that match nothing, so typos in access-limiting config surface
+* immediately.
 */
-function applyAllowTools(tools, allowTools) {
-	if (!allowTools) return tools;
+function applyAllowTools(tools, allowToolsInput) {
+	if (!allowToolsInput) return tools;
 	const known = Object.keys(tools);
+	const allowTools = expandToolPatterns(allowToolsInput, known, "allowTools");
 	const unknown = allowTools.filter((name) => !known.includes(name));
 	if (unknown.length > 0) throw new Error(`Unknown tool name(s) in allowTools: ${unknown.join(", ")}. Known tools: ${known.join(", ")}.`);
 	const filtered = {};
@@ -393,13 +587,15 @@ function applyAllowTools(tools, allowTools) {
 	return filtered;
 }
 /**
-* Removes tool keys from a toolset. Throws at build time on unknown names so
-* typos in access-limiting config surface immediately instead of silently
-* removing nothing.
+* Removes tool keys from a toolset. Entries containing `*` are globs
+* expanded against the toolset's keys. Throws at build time on unknown names
+* and on globs that match nothing, so typos in access-limiting config
+* surface immediately instead of silently removing nothing.
 */
-function applyDisallowTools(tools, disallowTools) {
-	if (!disallowTools || disallowTools.length === 0) return tools;
+function applyDisallowTools(tools, disallowToolsInput) {
+	if (!disallowToolsInput || disallowToolsInput.length === 0) return tools;
 	const known = Object.keys(tools);
+	const disallowTools = expandToolPatterns(disallowToolsInput, known, "disallowTools");
 	const unknown = disallowTools.filter((name) => !known.includes(name));
 	if (unknown.length > 0) throw new Error(`Unknown tool name(s) in disallowTools: ${unknown.join(", ")}. Known tools: ${known.join(", ")}.`);
 	const remove = new Set(disallowTools);
@@ -636,8 +832,8 @@ function buildProxyMultiConnectionTools(input) {
 * client cache so stale clients can be reaped elsewhere.
 */
 async function buildMcpMultiConnectionTools(input) {
-	const { registration, connections, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connections, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? compileToolMatcher(requireApproval) : void 0;
 	const listToolKey = listConnectionsToolKey(registration.integrationId);
 	const innerAllowTools = allowTools?.filter((name) => name !== listToolKey);
 	const innerDisallowTools = disallowTools?.filter((name) => name !== listToolKey);
@@ -661,7 +857,7 @@ async function buildMcpMultiConnectionTools(input) {
 						id: `mastra-connect-${resolverId}-${registration.integrationId}-${connection.id}`,
 						servers: { [registration.integrationId]: {
 							...transport,
-							requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+							...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor(`${registration.integrationId}_${String(toolName)}`) } : {}
 						} }
 					})
 				};
@@ -678,8 +874,10 @@ async function buildMcpMultiConnectionTools(input) {
 		}
 		const catalogUnion = /* @__PURE__ */ new Set();
 		for (const catalog of rawInnerCatalogs.values()) for (const key of Object.keys(catalog)) catalogUnion.add(key);
-		const unknownAutoApprove = [...autoApproved].filter((name) => !catalogUnion.has(name));
-		if (unknownAutoApprove.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknownAutoApprove.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		if (Array.isArray(requireApproval)) {
+			const unknown = expandToolPatterns(requireApproval, [...catalogUnion], `requireApproval for '${registration.integrationId}'`).filter((name) => !catalogUnion.has(name));
+			if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${[...catalogUnion].join(", ")}.`);
+		}
 		innerToolsByConnectionId = /* @__PURE__ */ new Map();
 		for (const [connectionId, catalog] of rawInnerCatalogs) {
 			const filtered = applyToolFilter(catalog, {
@@ -707,11 +905,15 @@ async function buildMcpMultiConnectionTools(input) {
 }
 //#endregion
 //#region src/providers/channels.ts
-function credentialToken$1(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
+function credentialToken(credential) {
+	switch (credential.type) {
+		case "oauth2": return credential.accessToken;
+		case "two_step": return credential.token;
+		default: return credential.apiKey;
+	}
 }
 const RESERVED_OPTION_KEYS = {
-	slack: [
+	"slack-channels": [
 		"baseUrl",
 		"refreshToken",
 		"token",
@@ -725,7 +927,14 @@ const RESERVED_OPTION_KEYS = {
 		"tokenResolver",
 		"encryptionKey"
 	],
-	discord: ["baseUrl", "encryptionKey"]
+	discord: ["baseUrl", "encryptionKey"],
+	"microsoft-teams": [
+		"baseUrl",
+		"appId",
+		"appPassword",
+		"tokenResolver",
+		"encryptionKey"
+	]
 };
 function stripReservedOptions(integrationId, options) {
 	if (!options) return options;
@@ -745,12 +954,12 @@ function stripReservedOptions(integrationId, options) {
 }
 const CHANNELS$1 = [
 	{
-		integrationId: "slack",
+		integrationId: "slack-channels",
 		async create(options, runtime) {
 			const mod = await import("@mastra/slack");
-			const safeOptions = stripReservedOptions("slack", options);
+			const safeOptions = stripReservedOptions("slack-channels", options);
 			const tokenResolver = async () => {
-				return credentialToken$1(await runtime.getCredential());
+				return credentialToken(await runtime.getCredential());
 			};
 			return { provider: new mod.SlackProvider({
 				tokenResolver,
@@ -764,7 +973,7 @@ const CHANNELS$1 = [
 			const mod = await import("@mastra/telegram");
 			const safeOptions = stripReservedOptions("telegram", options);
 			const tokenResolver = async () => {
-				return credentialToken$1(await runtime.getCredential());
+				return credentialToken(await runtime.getCredential());
 			};
 			return { provider: new mod.TelegramProvider({
 				tokenResolver,
@@ -796,17 +1005,42 @@ const CHANNELS$1 = [
 				}
 			};
 		}
+	},
+	{
+		integrationId: "microsoft-teams",
+		async create(options, runtime) {
+			const mod = await import("@mastra/teams");
+			if (!process.env.MASTRA_ENCRYPTION_KEY) throw new MastraConnectError("invalid_options", "Microsoft Teams channel: MASTRA_ENCRYPTION_KEY is not set. The Teams install store persists per-agent bot secrets and requires an at-rest encryption key (a 32-byte value, base64-encoded).");
+			const safeOptions = stripReservedOptions("microsoft-teams", options);
+			const tokenResolver = async (scope) => {
+				const fresh = await runtime.getCredential();
+				if (!(Array.isArray(scope) ? scope : [scope]).includes(mod.TEAMS_DEV_PORTAL_SCOPE)) return credentialToken(fresh);
+				const token = fresh.type === "oauth2" ? fresh.secondaryAccessTokens?.devPortalAccessToken?.accessToken : void 0;
+				if (!token) throw new MastraConnectError("no_active_connection", `Teams connection ${runtime.getConnectionId()} has no Dev Portal token on its credential. Reconnect with an integration that requests the ${mod.TEAMS_DEV_PORTAL_SCOPE} scope.`);
+				return token;
+			};
+			return { provider: new mod.TeamsProvider({
+				tokenResolver,
+				...safeOptions ?? {}
+			}) };
+		}
 	}
 ];
 //#endregion
 //#region src/runtime/platform-proxy.ts
 /** Maps the platform credential to the field names templates are written against. */
 function toTemplateCredentials(credential) {
-	return credential.type === "oauth2" ? {
+	if (credential.type === "oauth2") return {
 		type: "OAUTH2",
 		access_token: credential.accessToken,
 		expires_at: credential.expiresAt
-	} : {
+	};
+	if (credential.type === "two_step") return {
+		type: "TWO_STEP",
+		token: credential.token,
+		expires_at: credential.expiresAt
+	};
+	return {
 		type: "API_KEY",
 		apiKey: credential.apiKey
 	};
@@ -1734,8 +1968,8 @@ const anthropicProvider = {
 //#endregion
 //#region src/providers/clerk/tools/assign-organization-role-permission.ts
 const assignOrganizationRolePermissionInputSchema = z.object({
-	organization_role_id: z.string(),
-	permission_id: z.string()
+	organization_role_id: z.string().min(1),
+	permission_id: z.string().min(1)
 });
 const ResourceSchema$49 = z.object({
 	id: z.string(),
@@ -1771,8 +2005,8 @@ function assignOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-email-address.ts
 const createEmailAddressInputSchema = z.object({
-	user_id: z.string(),
-	email_address: z.string(),
+	user_id: z.string().min(1),
+	email_address: z.string().email(),
 	verified: z.boolean().optional(),
 	primary: z.boolean().optional(),
 	notify_primary_email_address_changed: z.boolean().optional()
@@ -1817,16 +2051,22 @@ function createEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/create-organization-domain.ts
-const EnrollmentModeSchema$2 = z.enum([
+const EnrollmentModeSchema$3 = z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$2 = z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(z.string());
 const createOrganizationDomainInputSchema$1 = z.object({
-	organization_id: z.string(),
+	organization_id: z.string().min(1),
 	name: z.string(),
-	enrollment_mode: EnrollmentModeSchema$2,
+	enrollment_mode: EnrollmentModeSchema$3,
 	verified: z.boolean().optional()
 });
 const ResourceSchema$47 = z.object({
@@ -1834,15 +2074,15 @@ const ResourceSchema$47 = z.object({
 	object: z.string().optional(),
 	organization_id: z.string().optional(),
 	name: z.string(),
-	enrollment_mode: EnrollmentModeSchema$2.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$2.optional(),
 	affiliation_verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: z.boolean().optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
@@ -1871,7 +2111,7 @@ function createOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-invitation.ts
 const createOrganizationInvitationInputSchema = z.object({
-	organization_id: z.string(),
+	organization_id: z.string().min(1),
 	email_address: z.string().email(),
 	role: z.string(),
 	inviter_user_id: z.string().optional(),
@@ -1892,7 +2132,7 @@ const ResourceSchema$46 = z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(z.string()).optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
 }).passthrough();
@@ -1925,8 +2165,8 @@ function createOrganizationInvitationTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-organization-membership.ts
 const createOrganizationMembershipInputSchema$1 = z.object({
-	organization_id: z.string(),
-	user_id: z.string(),
+	organization_id: z.string().min(1),
+	user_id: z.string().min(1),
 	role: z.string(),
 	public_metadata: z.record(z.string(), z.unknown()).optional(),
 	private_metadata: z.record(z.string(), z.unknown()).optional()
@@ -2062,7 +2302,7 @@ function createOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/create-phone-number.ts
 const createPhoneNumberInputSchema = z.object({
-	user_id: z.string(),
+	user_id: z.string().min(1),
 	phone_number: z.string(),
 	verified: z.boolean().optional(),
 	primary: z.boolean().optional(),
@@ -2125,7 +2365,7 @@ const createUserInputSchema$2 = z.object({
 	public_metadata: z.record(z.string(), z.unknown()).optional(),
 	private_metadata: z.record(z.string(), z.unknown()).optional(),
 	unsafe_metadata: z.record(z.string(), z.unknown()).optional()
-});
+}).refine((value) => (value.email_address?.length ?? 0) > 0 || (value.phone_number?.length ?? 0) > 0 || value.username !== void 0 || value.password !== void 0, { message: "Provide at least one of email_address, phone_number, username, or password." });
 const UserSchema$27 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -2177,7 +2417,7 @@ function createUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-email-address.ts
-const deleteEmailAddressInputSchema = z.object({ email_address_id: z.string() });
+const deleteEmailAddressInputSchema = z.object({ email_address_id: z.string().min(1) });
 const deleteEmailAddressOutputSchema = z.object({
 	id: z.string(),
 	success: z.boolean()
@@ -2203,8 +2443,8 @@ function deleteEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-domain.ts
 const deleteOrganizationDomainInputSchema$1 = z.object({
-	organization_id: z.string(),
-	domain_id: z.string()
+	organization_id: z.string().min(1),
+	domain_id: z.string().min(1)
 });
 const deleteOrganizationDomainOutputSchema$1 = z.object({
 	id: z.string(),
@@ -2231,8 +2471,8 @@ function deleteOrganizationDomainTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-membership.ts
 const deleteOrganizationMembershipInputSchema$1 = z.object({
-	organization_id: z.string(),
-	user_id: z.string()
+	organization_id: z.string().min(1),
+	user_id: z.string().min(1)
 });
 const deleteOrganizationMembershipOutputSchema$1 = z.object({
 	id: z.string(),
@@ -2258,7 +2498,7 @@ function deleteOrganizationMembershipTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-organization-role.ts
-const deleteOrganizationRoleInputSchema = z.object({ organization_role_id: z.string() });
+const deleteOrganizationRoleInputSchema = z.object({ organization_role_id: z.string().min(1) });
 const deleteOrganizationRoleOutputSchema = z.object({
 	id: z.string(),
 	success: z.boolean()
@@ -2308,7 +2548,7 @@ function deleteOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/delete-phone-number.ts
-const deletePhoneNumberInputSchema = z.object({ phone_number_id: z.string() });
+const deletePhoneNumberInputSchema = z.object({ phone_number_id: z.string().min(1) });
 const deletePhoneNumberOutputSchema = z.object({
 	id: z.string(),
 	success: z.boolean()
@@ -2358,7 +2598,7 @@ function deleteUserTool$2(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-email-address.ts
-const getEmailAddressInputSchema = z.object({ email_address_id: z.string() });
+const getEmailAddressInputSchema = z.object({ email_address_id: z.string().min(1) });
 const ResourceSchema$42 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -2393,8 +2633,8 @@ function getEmailAddressTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/get-organization-invitation.ts
 const getOrganizationInvitationInputSchema = z.object({
-	organization_id: z.string(),
-	invitation_id: z.string()
+	organization_id: z.string().min(1),
+	invitation_id: z.string().min(1)
 });
 const ResourceSchema$41 = z.object({
 	id: z.string(),
@@ -2407,7 +2647,7 @@ const ResourceSchema$41 = z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(z.string()).optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
 }).passthrough();
@@ -2429,7 +2669,7 @@ function getOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-organization-role.ts
-const getOrganizationRoleInputSchema = z.object({ organization_role_id: z.string() });
+const getOrganizationRoleInputSchema = z.object({ organization_role_id: z.string().min(1) });
 const ResourceSchema$40 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -2501,7 +2741,7 @@ function getOrganizationTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-phone-number.ts
-const getPhoneNumberInputSchema = z.object({ phone_number_id: z.string() });
+const getPhoneNumberInputSchema = z.object({ phone_number_id: z.string().min(1) });
 const ResourceSchema$39 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -2536,7 +2776,7 @@ function getPhoneNumberTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/get-session.ts
-const getSessionInputSchema = z.object({ session_id: z.string() });
+const getSessionInputSchema = z.object({ session_id: z.string().min(1) });
 const ResourceSchema$38 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -2550,7 +2790,7 @@ const ResourceSchema$38 = z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(z.string()).optional(),
 	last_active_at: z.number().optional(),
 	expire_at: z.number().optional(),
 	abandon_at: z.number().optional(),
@@ -2610,33 +2850,39 @@ function getUserTool$7(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/list-organization-domains.ts
-const EnrollmentModeSchema$1 = z.enum([
+const EnrollmentModeSchema$2 = z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened$1 = z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(z.string());
 const listOrganizationDomainsInputSchema = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
-	organization_id: z.string(),
+	organization_id: z.string().min(1),
 	verified: z.boolean().optional(),
-	enrollment_mode: EnrollmentModeSchema$1.optional()
+	enrollment_mode: EnrollmentModeSchema$2.optional()
 });
 const ResourceSchema$37 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
 	organization_id: z.string().optional(),
 	name: z.string(),
-	enrollment_mode: EnrollmentModeSchema$1.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened$1.optional(),
 	affiliation_verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: z.boolean().optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
@@ -2647,7 +2893,7 @@ const ProviderResponseSchema$244 = z.object({
 });
 const listOrganizationDomainsOutputSchema = z.object({
 	items: z.array(ResourceSchema$37),
-	next_cursor: z.string().optional(),
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: z.number()
 });
 function listOrganizationDomainsTool(proxy) {
@@ -2658,11 +2904,7 @@ function listOrganizationDomainsTool(proxy) {
 		outputSchema: listOrganizationDomainsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/domains`,
 				params: {
@@ -2686,9 +2928,9 @@ function listOrganizationDomainsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-invitations.ts
 const listOrganizationInvitationsInputSchema = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
-	organization_id: z.string(),
+	organization_id: z.string().min(1),
 	status: z.enum([
 		"pending",
 		"accepted",
@@ -2709,7 +2951,7 @@ const ResourceSchema$36 = z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(z.string()).optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
 }).passthrough();
@@ -2719,7 +2961,7 @@ const ProviderResponseSchema$243 = z.object({
 });
 const listOrganizationInvitationsOutputSchema = z.object({
 	items: z.array(ResourceSchema$36),
-	next_cursor: z.string().optional(),
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: z.number()
 });
 function listOrganizationInvitationsTool(proxy) {
@@ -2730,11 +2972,7 @@ function listOrganizationInvitationsTool(proxy) {
 		outputSchema: listOrganizationInvitationsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/invitations`,
 				params: {
@@ -2759,9 +2997,9 @@ function listOrganizationInvitationsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-memberships.ts
 const listOrganizationMembershipsInputSchema$1 = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
-	organization_id: z.string(),
+	organization_id: z.string().min(1),
 	user_id: z.array(z.string()).optional(),
 	email_address: z.array(z.string()).optional(),
 	phone_number: z.array(z.string()).optional(),
@@ -2795,7 +3033,7 @@ const ProviderResponseSchema$242 = z.object({
 });
 const listOrganizationMembershipsOutputSchema$1 = z.object({
 	items: z.array(ResourceSchema$35),
-	next_cursor: z.string().optional(),
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: z.number()
 });
 function listOrganizationMembershipsTool$1(proxy) {
@@ -2806,11 +3044,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 		outputSchema: listOrganizationMembershipsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: `/v1/organizations/${encodeURIComponent(input.organization_id)}/memberships`,
 				params: {
@@ -2848,7 +3082,7 @@ function listOrganizationMembershipsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organization-roles.ts
 const listOrganizationRolesInputSchema = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
 	query: z.string().optional(),
 	order_by: z.string().optional()
@@ -2873,7 +3107,7 @@ const ProviderResponseSchema$241 = z.object({
 });
 const listOrganizationRolesOutputSchema = z.object({
 	items: z.array(ResourceSchema$34),
-	next_cursor: z.string().optional(),
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: z.number()
 });
 function listOrganizationRolesTool(proxy) {
@@ -2884,11 +3118,7 @@ function listOrganizationRolesTool(proxy) {
 		outputSchema: listOrganizationRolesOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organization_roles",
 				params: {
@@ -2912,7 +3142,7 @@ function listOrganizationRolesTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-organizations.ts
 const listOrganizationsInputSchema$1 = z.object({
-	cursor: z.string().optional(),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
 	query: z.string().optional(),
 	order_by: z.string().optional().describe("Sort by name, created_at, or members_count, prefixed with + or -."),
@@ -2952,11 +3182,7 @@ function listOrganizationsTool$1(proxy) {
 		outputSchema: listOrganizationsOutputSchema$1,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
 			const response = await platformProxy.get({
 				endpoint: "/v1/organizations",
 				params: {
@@ -2982,10 +3208,10 @@ function listOrganizationsTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-sessions.ts
 const listSessionsInputSchema = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional(),
-	client_id: z.string().optional(),
-	user_id: z.string().optional(),
+	client_id: z.string().min(1).optional(),
+	user_id: z.string().min(1).optional(),
 	status: z.enum([
 		"abandoned",
 		"active",
@@ -2995,7 +3221,7 @@ const listSessionsInputSchema = z.object({
 		"replaced",
 		"revoked"
 	]).optional()
-});
+}).refine((value) => value.client_id !== void 0 || value.user_id !== void 0, { message: "Provide at least one of client_id or user_id." });
 const ResourceSchema$33 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -3009,21 +3235,17 @@ const ResourceSchema$33 = z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(z.string()).optional(),
 	last_active_at: z.number().optional(),
 	expire_at: z.number().optional(),
 	abandon_at: z.number().optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
 }).passthrough();
-const ProviderResponseSchema$239 = z.object({
-	data: z.array(ResourceSchema$33),
-	total_count: z.number()
-});
+const ProviderResponseSchema$239 = z.array(ResourceSchema$33);
 const listSessionsOutputSchema = z.object({
 	items: z.array(ResourceSchema$33),
-	next_cursor: z.string().optional(),
-	total: z.number()
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page.")
 });
 function listSessionsTool(proxy) {
 	return createTool({
@@ -3033,28 +3255,23 @@ function listSessionsTool(proxy) {
 		outputSchema: listSessionsOutputSchema,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const limit = input.limit ?? 10;
 			const response = await platformProxy.get({
 				endpoint: "/v1/sessions",
 				params: {
 					offset: String(offset),
-					...input.limit !== void 0 && { limit: String(input.limit) },
+					limit: String(limit),
 					...input.client_id !== void 0 && { client_id: input.client_id },
 					...input.user_id !== void 0 && { user_id: input.user_id },
 					...input.status !== void 0 && { status: input.status }
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$239.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const sessions = ProviderResponseSchema$239.parse(response.data);
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: sessions,
+				...sessions.length === limit && { next_cursor: String(offset + sessions.length) }
 			};
 		}
 	});
@@ -3062,13 +3279,19 @@ function listSessionsTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/list-users.ts
 const listUsersInputSchema$9 = z.object({
-	cursor: z.string().optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
+	cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	limit: z.number().int().min(1).max(500).optional().describe("Maximum number of users to return. Maximum 500."),
 	query: z.string().optional().describe("Search across names, identifiers, email addresses, phone numbers, and usernames."),
 	email_address: z.array(z.string()).max(100).optional().describe("Filter by email addresses."),
+	phone_number: z.array(z.string()).max(100).optional().describe("Filter by phone numbers."),
+	username: z.array(z.string()).max(100).optional().describe("Filter by usernames."),
 	user_id: z.array(z.string()).max(100).optional().describe("Filter by Clerk user IDs."),
 	external_id: z.array(z.string()).max(100).optional().describe("Filter by external user IDs."),
 	organization_id: z.array(z.string()).max(100).optional().describe("Filter by organization IDs."),
+	last_active_at_before: z.number().int().optional().describe("Filter users last active before this Unix timestamp in milliseconds."),
+	last_active_at_after: z.number().int().optional().describe("Filter users last active after this Unix timestamp in milliseconds."),
+	created_at_before: z.number().int().optional().describe("Filter users created before this Unix timestamp in milliseconds."),
+	created_at_after: z.number().int().optional().describe("Filter users created after this Unix timestamp in milliseconds."),
 	order_by: z.string().optional().describe("Sort field prefixed with + for ascending or - for descending. Example: \"-created_at\"")
 });
 const UserSchema$25 = z.object({
@@ -3087,13 +3310,11 @@ const UserSchema$25 = z.object({
 	updated_at: z.number().optional(),
 	locale: z.string().nullable().optional()
 }).passthrough();
-const ProviderResponseSchema$238 = z.object({
-	data: z.array(UserSchema$25),
-	total_count: z.number()
-});
+const ProviderResponseSchema$238 = z.array(UserSchema$25);
+const ProviderCountSchema = z.object({ total_count: z.number() }).passthrough();
 const listUsersOutputSchema$9 = z.object({
 	items: z.array(UserSchema$25),
-	next_cursor: z.string().optional(),
+	next_cursor: z.string().regex(/^\d+$/, "Cursor must be a non-negative integer.").refine((value) => Number.isSafeInteger(Number(value)), "Cursor must be a non-negative integer.").optional().describe("Pagination cursor returned by a previous request. Omit for the first page."),
 	total: z.number()
 });
 function listUsersTool$9(proxy) {
@@ -3104,31 +3325,42 @@ function listUsersTool$9(proxy) {
 		outputSchema: listUsersOutputSchema$9,
 		execute: async (input, { requestContext }) => {
 			const platformProxy = proxy.withRequestContext(requestContext);
-			const offset = input.cursor === void 0 ? 0 : Number.parseInt(input.cursor, 10);
-			if (!Number.isInteger(offset) || offset < 0) throw new platformProxy.ActionError({
-				type: "invalid_cursor",
-				message: "Cursor must be a non-negative integer."
-			});
+			const offset = input.cursor === void 0 ? 0 : Number(input.cursor);
+			const filterParams = {
+				...input.query !== void 0 && { query: input.query },
+				...input.email_address !== void 0 && { email_address: input.email_address },
+				...input.phone_number !== void 0 && { phone_number: input.phone_number },
+				...input.username !== void 0 && { username: input.username },
+				...input.user_id !== void 0 && { user_id: input.user_id },
+				...input.external_id !== void 0 && { external_id: input.external_id },
+				...input.organization_id !== void 0 && { organization_id: input.organization_id },
+				...input.last_active_at_before !== void 0 && { last_active_at_before: String(input.last_active_at_before) },
+				...input.last_active_at_after !== void 0 && { last_active_at_after: String(input.last_active_at_after) },
+				...input.created_at_before !== void 0 && { created_at_before: String(input.created_at_before) },
+				...input.created_at_after !== void 0 && { created_at_after: String(input.created_at_after) }
+			};
 			const response = await platformProxy.get({
 				endpoint: "/v1/users",
 				params: {
 					offset: String(offset),
 					...input.limit !== void 0 && { limit: String(input.limit) },
-					...input.query !== void 0 && { query: input.query },
-					...input.email_address !== void 0 && { email_address: input.email_address },
-					...input.user_id !== void 0 && { user_id: input.user_id },
-					...input.external_id !== void 0 && { external_id: input.external_id },
-					...input.organization_id !== void 0 && { organization_id: input.organization_id },
-					...input.order_by !== void 0 && { order_by: input.order_by }
+					...input.order_by !== void 0 && { order_by: input.order_by },
+					...filterParams
 				},
 				retries: 3
 			});
-			const provider = ProviderResponseSchema$238.parse(response.data);
-			const nextOffset = offset + provider.data.length;
+			const users = ProviderResponseSchema$238.parse(response.data);
+			const countResponse = await platformProxy.get({
+				endpoint: "/v1/users/count",
+				params: filterParams,
+				retries: 3
+			});
+			const total = ProviderCountSchema.parse(countResponse.data).total_count;
+			const nextOffset = offset + users.length;
 			return {
-				items: provider.data,
-				...nextOffset < provider.total_count && { next_cursor: String(nextOffset) },
-				total: provider.total_count
+				items: users,
+				...users.length > 0 && nextOffset < total && { next_cursor: String(nextOffset) },
+				total
 			};
 		}
 	});
@@ -3136,8 +3368,8 @@ function listUsersTool$9(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/remove-organization-role-permission.ts
 const removeOrganizationRolePermissionInputSchema = z.object({
-	organization_role_id: z.string(),
-	permission_id: z.string()
+	organization_role_id: z.string().min(1),
+	permission_id: z.string().min(1)
 });
 const removeOrganizationRolePermissionOutputSchema = z.object({
 	id: z.string(),
@@ -3164,8 +3396,8 @@ function removeOrganizationRolePermissionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/revoke-organization-invitation.ts
 const revokeOrganizationInvitationInputSchema = z.object({
-	organization_id: z.string(),
-	invitation_id: z.string(),
+	organization_id: z.string().min(1),
+	invitation_id: z.string().min(1),
 	requesting_user_id: z.string().optional()
 });
 const ResourceSchema$32 = z.object({
@@ -3179,7 +3411,7 @@ const ResourceSchema$32 = z.object({
 		"accepted",
 		"revoked",
 		"expired"
-	]).optional(),
+	]).or(z.string()).optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
 }).passthrough();
@@ -3202,7 +3434,7 @@ function revokeOrganizationInvitationTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/revoke-session.ts
-const revokeSessionInputSchema = z.object({ session_id: z.string() });
+const revokeSessionInputSchema = z.object({ session_id: z.string().min(1) });
 const ResourceSchema$31 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -3216,7 +3448,7 @@ const ResourceSchema$31 = z.object({
 		"removed",
 		"replaced",
 		"revoked"
-	]).optional(),
+	]).or(z.string()).optional(),
 	last_active_at: z.number().optional(),
 	expire_at: z.number().optional(),
 	abandon_at: z.number().optional(),
@@ -3243,7 +3475,7 @@ function revokeSessionTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-email-address.ts
 const updateEmailAddressInputSchema = z.object({
-	email_address_id: z.string(),
+	email_address_id: z.string().min(1),
 	verified: z.boolean().optional(),
 	primary: z.boolean().optional(),
 	notify_primary_email_address_changed: z.boolean().optional()
@@ -3286,16 +3518,22 @@ function updateEmailAddressTool(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/update-organization-domain.ts
-const EnrollmentModeSchema = z.enum([
+const EnrollmentModeSchema$1 = z.enum([
 	"manual_invitation",
 	"automatic_invitation",
 	"automatic_suggestion",
 	"enterprise_sso"
 ]);
+const EnrollmentModeSchemaWidened = z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(z.string());
 const updateOrganizationDomainInputSchema = z.object({
-	organization_id: z.string(),
-	domain_id: z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	organization_id: z.string().min(1),
+	domain_id: z.string().min(1),
+	enrollment_mode: EnrollmentModeSchema$1.optional(),
 	verified: z.boolean().optional()
 });
 const ResourceSchema$29 = z.object({
@@ -3303,15 +3541,15 @@ const ResourceSchema$29 = z.object({
 	object: z.string().optional(),
 	organization_id: z.string().optional(),
 	name: z.string(),
-	enrollment_mode: EnrollmentModeSchema.optional(),
+	enrollment_mode: EnrollmentModeSchemaWidened.optional(),
 	affiliation_verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: z.boolean().optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
@@ -3339,8 +3577,8 @@ function updateOrganizationDomainTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership-metadata.ts
 const updateOrganizationMembershipMetadataInputSchema = z.object({
-	organization_id: z.string(),
-	user_id: z.string(),
+	organization_id: z.string().min(1),
+	user_id: z.string().min(1),
 	public_metadata: z.record(z.string(), z.unknown()).optional(),
 	private_metadata: z.record(z.string(), z.unknown()).optional()
 });
@@ -3377,8 +3615,8 @@ function updateOrganizationMembershipMetadataTool(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-membership.ts
 const updateOrganizationMembershipInputSchema$1 = z.object({
-	organization_id: z.string(),
-	user_id: z.string(),
+	organization_id: z.string().min(1),
+	user_id: z.string().min(1),
 	role: z.string()
 });
 const ResourceSchema$27 = z.object({
@@ -3411,12 +3649,12 @@ function updateOrganizationMembershipTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-organization-role.ts
 const updateOrganizationRoleInputSchema = z.object({
-	organization_role_id: z.string(),
+	organization_role_id: z.string().min(1),
 	name: z.string().optional(),
 	key: z.string().optional(),
 	description: z.string().optional(),
 	permissions: z.array(z.string()).optional()
-});
+}).refine((value) => value.name !== void 0 || value.key !== void 0 || value.description !== void 0 || value.permissions !== void 0, { message: "Provide at least one of name, key, description, or permissions." });
 const ResourceSchema$26 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
@@ -3460,7 +3698,8 @@ const updateOrganizationInputSchema$1 = z.object({
 	name: z.string().min(1).optional(),
 	slug: z.string().optional(),
 	admin_delete_enabled: z.boolean().optional(),
-	max_allowed_memberships: z.number().int().min(0).optional()
+	max_allowed_memberships: z.number().int().min(0).optional(),
+	public_metadata: z.record(z.string(), z.unknown()).optional()
 });
 const OrganizationSchema$1 = z.object({
 	id: z.string(),
@@ -3492,7 +3731,8 @@ function updateOrganizationTool$1(proxy) {
 					...input.name !== void 0 && { name: input.name },
 					...input.slug !== void 0 && { slug: input.slug },
 					...input.admin_delete_enabled !== void 0 && { admin_delete_enabled: input.admin_delete_enabled },
-					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships }
+					...input.max_allowed_memberships !== void 0 && { max_allowed_memberships: input.max_allowed_memberships },
+					...input.public_metadata !== void 0 && { public_metadata: input.public_metadata }
 				},
 				retries: 3
 			});
@@ -3503,7 +3743,7 @@ function updateOrganizationTool$1(proxy) {
 //#endregion
 //#region src/providers/clerk/tools/update-phone-number.ts
 const updatePhoneNumberInputSchema = z.object({
-	phone_number_id: z.string(),
+	phone_number_id: z.string().min(1),
 	verified: z.boolean().optional(),
 	primary: z.boolean().optional(),
 	reserved_for_second_factor: z.boolean().optional()
@@ -3549,14 +3789,14 @@ function updatePhoneNumberTool(proxy) {
 //#region src/providers/clerk/tools/update-user.ts
 const updateUserInputSchema$1 = z.object({
 	user_id: z.string().min(1),
-	first_name: z.string().optional(),
-	last_name: z.string().optional(),
-	username: z.string().optional(),
+	first_name: z.string().nullable().optional().describe("Pass null to clear the first name."),
+	last_name: z.string().nullable().optional().describe("Pass null to clear the last name."),
+	username: z.string().nullable().optional().describe("Pass null to clear the username."),
 	password: z.string().min(8).optional(),
 	skip_password_checks: z.boolean().optional(),
 	sign_out_of_other_sessions: z.boolean().optional(),
-	external_id: z.string().optional(),
-	locale: z.string().optional()
+	external_id: z.string().nullable().optional().describe("Pass null to clear the external ID."),
+	locale: z.string().nullable().optional().describe("Pass null to clear the locale.")
 });
 const UserSchema$24 = z.object({
 	id: z.string(),
@@ -3602,24 +3842,30 @@ function updateUserTool$1(proxy) {
 }
 //#endregion
 //#region src/providers/clerk/tools/verify-organization-domain.ts
+const EnrollmentModeSchema = z.enum([
+	"manual_invitation",
+	"automatic_invitation",
+	"automatic_suggestion",
+	"enterprise_sso"
+]).or(z.string());
 const verifyOrganizationDomainInputSchema$1 = z.object({
-	organization_id: z.string(),
-	domain_id: z.string()
+	organization_id: z.string().min(1),
+	domain_id: z.string().min(1)
 });
 const ResourceSchema$24 = z.object({
 	id: z.string(),
 	object: z.string().optional(),
 	organization_id: z.string().optional(),
 	name: z.string(),
-	enrollment_mode: z.string().optional(),
+	enrollment_mode: EnrollmentModeSchema.optional(),
 	affiliation_verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verification: z.object({
 		attempts: z.number().optional(),
 		status: z.string().optional()
-	}).passthrough().optional(),
+	}).passthrough().nullable().optional(),
 	verified: z.boolean().optional(),
 	created_at: z.number().optional(),
 	updated_at: z.number().optional()
@@ -5177,7 +5423,7 @@ const ChannelSchema$2 = z.object({
 	recipients: z.array(z.unknown()).optional(),
 	icon: z.string().nullable().optional(),
 	owner_id: z.string().optional(),
-	application_id: z.string().optional(),
+	application_id: z.string().nullable().optional(),
 	managed: z.boolean().optional(),
 	parent_id: z.string().nullable().optional(),
 	last_pin_timestamp: z.string().nullable().optional(),
@@ -34495,12 +34741,35 @@ const getCreateIssueMetadataInputSchema = z.object({
 	issuetypeIds: z.array(z.string()).optional().describe("List of issue type IDs to filter by. Example: [\"10000\", \"10001\"]"),
 	expand: z.string().optional().describe("Use expand to include additional information about issue metadata in the response. Supported values: projects, projects.issuetypes, projects.issuetypes.fields")
 });
+const CreateIssueFieldSchema = z.object({
+	required: z.boolean().optional(),
+	schema: z.record(z.string(), z.unknown()).optional(),
+	name: z.string().optional(),
+	key: z.string().optional(),
+	hasDefaultValue: z.boolean().optional(),
+	operations: z.array(z.string()).optional(),
+	allowedValues: z.array(z.unknown()).optional(),
+	defaultValue: z.unknown().optional(),
+	autoCompleteUrl: z.string().optional()
+});
+const IssueTypeSchema$1 = z.object({
+	id: z.string(),
+	name: z.string(),
+	self: z.string().optional(),
+	description: z.string().optional(),
+	iconUrl: z.string().optional(),
+	avatarId: z.number().optional(),
+	subtask: z.boolean().optional(),
+	hierarchyLevel: z.number().optional(),
+	fields: z.record(z.string(), CreateIssueFieldSchema).optional()
+});
 const ProjectSchema$3 = z.object({
 	id: z.string(),
 	key: z.string(),
 	name: z.string(),
 	self: z.string().optional(),
-	avatarUrls: z.record(z.string(), z.string()).optional()
+	avatarUrls: z.record(z.string(), z.string()).optional(),
+	issuetypes: z.array(IssueTypeSchema$1).optional()
 });
 const ProviderResponseSchema$149 = z.object({ projects: z.array(ProjectSchema$3).optional() });
 const getCreateIssueMetadataOutputSchema = z.object({ projects: z.array(ProjectSchema$3).optional() });
@@ -35620,7 +35889,7 @@ z.object({
 	cloudId: z.string().optional(),
 	baseUrl: z.string().optional()
 });
-const listIssueTypesInputSchema = z.object({});
+const listIssueTypesInputSchema = z.object({ projectId: z.string().optional().describe("Project ID used to list only issue types available in that project.") });
 const IssueTypeSchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -35649,7 +35918,7 @@ const AccessibleResourceSchema$1 = z.object({
 function listIssueTypesTool(proxy) {
 	return createTool({
 		id: "jira_list_issue_types",
-		description: "List Jira issue types available to the user",
+		description: "List Jira issue types available to the user. Pass projectId to list only the issue types available in that project (recommended before creating an issue).",
 		inputSchema: listIssueTypesInputSchema,
 		outputSchema: listIssueTypesOutputSchema,
 		execute: async (input, { requestContext }) => {
@@ -35684,7 +35953,12 @@ function listIssueTypesTool(proxy) {
 					baseUrl
 				});
 			}
-			const config = {
+			const config = input.projectId ? {
+				endpoint: `/ex/jira/${cloudId}/rest/api/3/issuetype/project`,
+				params: { projectId: input.projectId },
+				headers: { "X-Atlassian-Token": "no-check" },
+				retries: 3
+			} : {
 				endpoint: `/ex/jira/${cloudId}/rest/api/3/issuetype`,
 				headers: { "X-Atlassian-Token": "no-check" },
 				retries: 3
@@ -55242,7 +55516,7 @@ const cancelEmailInputSchema = z.object({ email_id: z.string() });
 const ProviderResponseSchema$107 = z.object({
 	object: z.string().optional(),
 	id: z.string().optional(),
-	message_id: z.string().optional(),
+	message_id: z.string().nullable().optional(),
 	to: z.array(z.string()).optional(),
 	from: z.string().optional(),
 	created_at: z.string().optional(),
@@ -56492,7 +56766,7 @@ const getEmailInputSchema = z.object({ email_id: z.string() });
 const ProviderResponseSchema$76 = z.object({
 	object: z.string().optional(),
 	id: z.string().optional(),
-	message_id: z.string().optional(),
+	message_id: z.string().nullable().optional(),
 	to: z.array(z.string()).optional(),
 	from: z.string().optional(),
 	created_at: z.string().optional(),
@@ -56579,7 +56853,7 @@ const ProviderResponseSchema$74 = z.object({
 	to: z.array(z.string()).optional(),
 	from: z.string().optional(),
 	subject: z.string().optional(),
-	message_id: z.string().optional(),
+	message_id: z.string().nullable().optional(),
 	bcc: z.array(z.string()).nullable().optional(),
 	cc: z.array(z.string()).nullable().optional(),
 	reply_to: z.array(z.string()).nullable().optional(),
@@ -56653,7 +56927,7 @@ const ProviderResponseSchema$72 = z.object({
 	current_version_id: z.string().optional(),
 	name: z.string().optional(),
 	alias: z.string().optional(),
-	from: z.string().optional(),
+	from: z.string().nullable().optional(),
 	subject: z.string().optional(),
 	reply_to: z.array(z.string()).nullable().optional(),
 	html: z.string().optional(),
@@ -57376,7 +57650,7 @@ const ProviderResponseSchema$57 = z.object({
 	data: z.array(z.object({
 		object: z.string().optional(),
 		id: z.string().optional(),
-		message_id: z.string().optional(),
+		message_id: z.string().nullable().optional(),
 		to: z.array(z.string()).optional(),
 		from: z.string().optional(),
 		created_at: z.string().optional(),
@@ -57495,7 +57769,7 @@ const ProviderResponseSchema$55 = z.object({
 		to: z.array(z.string()).optional(),
 		from: z.string().optional(),
 		subject: z.string().nullable().optional(),
-		message_id: z.string().optional(),
+		message_id: z.string().nullable().optional(),
 		bcc: z.array(z.string()).nullable().optional(),
 		cc: z.array(z.string()).nullable().optional(),
 		reply_to: z.array(z.string()).nullable().optional(),
@@ -58183,7 +58457,7 @@ function updateContactTopicsTool(proxy) {
 			const config = {
 				endpoint: `/contacts/${encodeURIComponent(input["contact_id"])}/topics`,
 				retries: 3,
-				data: input.body
+				data: input.body.topics
 			};
 			const response = await platformProxy.patch(config);
 			return ProviderResponseSchema$39.parse(response.data);
@@ -73973,7 +74247,7 @@ function createWorkosTools(options) {
 * Providers with checked-in HTTP toolsets. MCP-backed providers are discovered
 * from the Platform integration catalog at runtime.
 */
-const TOOLS = [
+const PROVIDERS = [
 	anthropicProvider,
 	clerkProvider,
 	discordProvider,
@@ -74006,27 +74280,16 @@ const TOOLS = [
 	}
 ];
 /**
-* @deprecated Use `TOOLS`. This alias is retained for one release cycle so
-* downstream consumers keep working; it will be removed in the next minor.
-*/
-const PROVIDERS = TOOLS;
-function findRegistration(integrationId) {
-	return TOOLS.find((p) => p.integrationId === integrationId);
-}
-/**
 * Channel-capable providers with a hand-maintained `channels()` registration.
 * The launch ships three (Slack, Telegram, Discord); the provider generator
 * grows to cover new entries when a fourth lands.
 */
 const CHANNELS = CHANNELS$1;
-function findChannelRegistration(integrationId) {
-	return CHANNELS.find((c) => c.integrationId === integrationId);
-}
 //#endregion
 //#region src/resolution.ts
 const INTEGRATION_ID_PATTERN = /^[a-zA-Z0-9_-]{1,128}$/;
-function validateIntegrationOverrides(integrations) {
-	for (const integrationId of Object.keys(integrations ?? {})) if (!INTEGRATION_ID_PATTERN.test(integrationId)) throw new MastraConnectError("invalid_options", `Invalid provider '${integrationId}' in integrations option: expected 1-128 letters, numbers, underscores, or hyphens.`);
+function validateProviderIds(providers) {
+	for (const integrationId of Object.keys(providers ?? {})) if (!INTEGRATION_ID_PATTERN.test(integrationId)) throw new MastraConnectError("invalid_options", `Invalid provider '${integrationId}' in providers option: expected 1-128 letters, numbers, underscores, or hyphens.`);
 }
 function connectionIdEnvVar(integrationId) {
 	return `MASTRA_${integrationId.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_CONNECTION_ID`;
@@ -74041,42 +74304,8 @@ function groupByIntegrationId(connections) {
 	return byIntegrationId;
 }
 /**
-* Resolves the connection to use for one provider, per the contract:
-* option/env var wins; else a single active connection; anything else
-* (ambiguity, needs_reauth, no usable candidate) warns and skips so one bad
-* integration never takes down the whole resolution. A needs_reauth
-* connection is never silently mapped.
-*/
-function resolveConnection(request, candidates) {
-	const integrationId = request.integrationId;
-	const directed = request.connectionId?.trim() || process.env[request.envVar]?.trim() || void 0;
-	if (directed) {
-		const match = candidates.find((connection) => connection.id === directed);
-		if (!match) {
-			console.warn(`[@mastra/connect] Skipping ${integrationId}: pinned connection ${directed} is not attached to this project.`);
-			return;
-		}
-		if (match.status === "needs_reauth") {
-			console.warn(`[@mastra/connect] Skipping ${integrationId}: connection ${directed} needs re-auth.`);
-			return;
-		}
-		if (match.status !== "active") {
-			console.warn(`[@mastra/connect] Skipping ${integrationId}: connection ${directed} is not active (status '${match.status}').`);
-			return;
-		}
-		return directed;
-	}
-	const active = candidates.filter((connection) => connection.status === "active");
-	if (active.length === 1) return active[0].id;
-	if (active.length === 0) {
-		console.warn(`[@mastra/connect] Skipping ${integrationId}: no active connections (found ${candidates.length} in other states).`);
-		return;
-	}
-	console.warn(`[@mastra/connect] Skipping ${integrationId}: ${active.length} active connections; pin one with connectionId or ${request.envVar}.`);
-}
-/**
 * Resolves how to configure one provider given its candidate connections:
-*   - An explicit pin (option or env var) forces `single` at that id.
+*   - An explicit pin (`connectionId`) forces `single` at that id.
 *   - Exactly one active connection → `single`.
 *   - Two or more active connections → `multi`; the caller wraps tools with
 *     `connection_name` so the agent chooses per call at execute time.
@@ -74127,16 +74356,18 @@ const FAILURE_COOLDOWN_MS$1 = 3e4;
 let nextResolverId = 0;
 /**
 * Returns a live toolset resolver over the project's Platform connections.
-* HTTP providers are loaded from the shipped `TOOLS` registry. MCP providers
+* HTTP providers are loaded from the shipped `PROVIDERS` registry. MCP providers
 * are discovered from the Platform integration catalog. Tools from every supported
 * provider with a matching project connection are merged into one flat record
 * (matched by `integrationId`). The resolver serves a cached snapshot,
-* revalidating from the platform every `ttlMs`, so integrations attached
-* to (or detached from) the project are picked up (or dropped) without a
+* revalidating from the platform every `ttlMs`, so providers connected
+* to (or disconnected from) the project are picked up (or dropped) without a
 * restart.
 *
-* Configuration errors (missing project id, bad ttlMs, malformed integration id)
-* throw here — at call time — so they surface at startup.
+* Configuration errors (missing project id, bad ttlMs, malformed integration id,
+* the removed `autoApproveTools` key) throw here — at call time — so they
+* surface at startup. Configuration errors that need discovery to detect
+* (an unknown tool name in `requireApproval`) fail the resolution instead.
 * Expected provider absence is silently skipped. Actionable per-integration
 * problems during resolution (needs re-auth or ambiguity) are downgraded to
 * warn-and-skip so one bad integration never takes down the whole toolset.
@@ -74149,9 +74380,14 @@ function tools(options = {}) {
 	const client = resolveClient(options.client);
 	const resolverId = ++nextResolverId;
 	const mcpClients = /* @__PURE__ */ new Map();
-	const integrationOverrides = normalizeIntegrationOverrides(options.integrations);
-	validateIntegrationOverrides(integrationOverrides);
-	validateIntegrationXor(integrationOverrides);
+	const normalizedProviders = normalizeProviderOverrides(options.providers);
+	const providerOverrides = normalizedProviders.overrides;
+	validateProviderIds(providerOverrides);
+	validateProviderXor(providerOverrides);
+	validateRequireApproval(providerOverrides);
+	rejectRemovedAutoApproveTools(providerOverrides);
+	if (options.allowTools !== void 0 && options.disallowTools !== void 0) throw new MastraConnectError("invalid_options", "Top-level allowTools and disallowTools are mutually exclusive; set at most one.");
+	if (options.requireApproval !== void 0 && typeof options.requireApproval !== "boolean" && !(Array.isArray(options.requireApproval) && options.requireApproval.every((name) => typeof name === "string"))) throw new MastraConnectError("invalid_options", "Top-level requireApproval must be a boolean or an array of tool keys.");
 	let cache;
 	let inflight;
 	let closing;
@@ -74167,15 +74403,17 @@ function tools(options = {}) {
 		const connections = connectionsResult.value;
 		if (catalogResult.status === "fulfilled") return {
 			connections,
-			catalog: catalogResult.value
+			catalog: catalogResult.value,
+			catalogAvailable: true
 		};
-		const checkedIn = new Set(TOOLS.map((registration) => registration.integrationId));
-		if (connections.some((connection) => connection.status === "active" && !checkedIn.has(connection.integrationId) && !integrationOverrides[connection.integrationId]?.disabled)) throw catalogResult.reason;
+		const checkedIn = new Set(PROVIDERS.map((registration) => registration.integrationId));
+		if (connections.some((connection) => connection.status === "active" && !checkedIn.has(connection.integrationId) && !providerOverrides[connection.integrationId]?.disabled && (normalizedProviders.only === void 0 || normalizedProviders.only.has(connection.integrationId)))) throw catalogResult.reason;
 		const reason = catalogResult.reason;
 		console.warn(`[@mastra/connect] Platform catalog unavailable (${reason instanceof Error ? reason.message : String(reason)}); resolving checked-in providers only.`);
 		return {
 			connections,
-			catalog: []
+			catalog: [],
+			catalogAvailable: false
 		};
 	};
 	/**
@@ -74186,8 +74424,8 @@ function tools(options = {}) {
 		if (closing) return closing.then(refresh);
 		if (!inflight) inflight = (async () => {
 			try {
-				const { connections, catalog } = await loadSnapshotInputs();
-				const snapshot = await mapTools(connections, buildRequests(integrationOverrides, catalog), options, client, mcpClients, resolverId);
+				const { connections, catalog, catalogAvailable } = await loadSnapshotInputs();
+				const snapshot = await mapTools(connections, buildRequests(normalizedProviders, catalog, catalogAvailable), options, client, mcpClients, resolverId);
 				cache = {
 					snapshot,
 					fetchedAt: Date.now()
@@ -74217,10 +74455,7 @@ function tools(options = {}) {
 		}
 		return refresh();
 	};
-	return Object.assign(resolve, {
-		invalidate: () => {
-			cache = void 0;
-		},
+	const resolver = Object.assign(resolve, {
 		refresh,
 		disconnect: () => {
 			closing ??= (async () => {
@@ -74235,28 +74470,75 @@ function tools(options = {}) {
 				}
 			})();
 			return closing;
-		}
+		},
+		with: (extra) => withExtraTools(resolver, extra)
 	});
+	return resolver;
 }
 /**
-* Turns the two accepted `integrations` shapes into the internal Record form.
-* The string-array shorthand (`["linear", "github"]`) becomes
-* `{ linear: {}, github: {} }`; the object form passes through unchanged.
-* Also rejects malformed inputs early (non-string array entries, duplicates)
-* so a bad option throws at tools() time rather than at first refresh.
+* Builds the resolver `.with()` returns: resolutions merge the base
+* resolver's tools with `extra` (extra wins on key collision), cache handles
+* delegate to the base, and further `.with()` calls chain.
 */
-function normalizeIntegrationOverrides(integrations) {
-	if (integrations === void 0) return {};
-	if (Array.isArray(integrations)) {
-		const record = {};
-		for (const entry of integrations) {
-			if (typeof entry !== "string") throw new MastraConnectError("invalid_options", `Invalid integrations entry: expected a string integration id, got ${typeof entry}.`);
-			if (record[entry] !== void 0) throw new MastraConnectError("invalid_options", `Duplicate integration '${entry}' in integrations array.`);
-			record[entry] = {};
-		}
-		return record;
+function withExtraTools(base, extra) {
+	const resolveExtra = typeof extra === "function" ? extra : () => extra;
+	const resolve = async (ctx) => {
+		const [baseTools, extraTools] = await Promise.all([base(ctx), resolveExtra(ctx)]);
+		return {
+			...baseTools,
+			...extraTools
+		};
+	};
+	const resolver = Object.assign(resolve, {
+		refresh: async () => {
+			const [baseTools, extraTools] = await Promise.all([base.refresh(), resolveExtra()]);
+			return {
+				...baseTools,
+				...extraTools
+			};
+		},
+		disconnect: () => base.disconnect(),
+		with: (more) => withExtraTools(resolver, more)
+	});
+	return resolver;
+}
+/**
+* Turns the two accepted `providers` shapes into the internal form. The
+* array form (`["linear", "github"]`) becomes an allowlist with default
+* options; the record form expands boolean shorthands (`true` → `{}`,
+* `false` → an internal exclusion marker). Malformed inputs (non-string
+* array entries, duplicates, non-boolean/non-object record values) throw at
+* tools() time rather than at first refresh.
+*/
+function normalizeProviderOverrides(providers) {
+	if (providers === void 0) return {
+		overrides: {},
+		only: void 0
+	};
+	if (Array.isArray(providers)) {
+		const overrides = {};
+		for (const entry of providers) {
+			if (typeof entry !== "string") throw new MastraConnectError("invalid_options", `Invalid providers entry: expected a string provider id, got ${typeof entry}.`);
+			if (overrides[entry] !== void 0) throw new MastraConnectError("invalid_options", `Duplicate provider '${entry}' in providers array.`);
+			overrides[entry] = {};
+		}
+		return {
+			overrides,
+			only: new Set(Object.keys(overrides))
+		};
 	}
-	return integrations;
+	const overrides = {};
+	for (const [providerId, value] of Object.entries(providers)) {
+		if (value === void 0) continue;
+		if (value === true) overrides[providerId] = {};
+		else if (value === false) overrides[providerId] = { disabled: true };
+		else if (typeof value === "object" && value !== null && !Array.isArray(value)) overrides[providerId] = value;
+		else throw new MastraConnectError("invalid_options", `Invalid providers entry for '${providerId}': expected true, false, or an options object, got ${value === null ? "null" : Array.isArray(value) ? "an array" : typeof value}.`);
+	}
+	return {
+		overrides,
+		only: void 0
+	};
 }
 /**
 * Rejects any provider that sets both `allowTools` and `disallowTools`.
@@ -74264,15 +74546,39 @@ function normalizeIntegrationOverrides(integrations) {
 * runtime guard catches loosely typed inputs (e.g. built from JSON or a
 * `Record<string, unknown>` upstream).
 */
-function validateIntegrationXor(integrations) {
-	for (const [integrationId, providerOptions] of Object.entries(integrations)) {
+function validateProviderXor(providers) {
+	for (const [integrationId, providerOptions] of Object.entries(providers)) {
 		const filters = providerOptions;
 		if (filters.allowTools !== void 0 && filters.disallowTools !== void 0) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': allowTools and disallowTools are mutually exclusive; set at most one.`);
 	}
 }
-function buildRequests(integrations, catalog) {
-	const overrides = integrations;
-	const registrations = new Map(TOOLS.map((registration) => [registration.integrationId, registration]));
+/**
+* Rejects a `requireApproval` value that is not a boolean or an array of
+* string tool keys. The approval branches check for literal `true` or an
+* array, so a loosely typed value like `'true'` would otherwise disable
+* approval on MCP providers silently (and crash the HTTP path into
+* warn-and-skip) instead of gating tools as the author intended.
+*/
+function validateRequireApproval(providers) {
+	for (const [integrationId, providerOptions] of Object.entries(providers)) {
+		const requireApproval = providerOptions.requireApproval;
+		if (requireApproval === void 0 || typeof requireApproval === "boolean") continue;
+		if (Array.isArray(requireApproval) && requireApproval.every((name) => typeof name === "string")) continue;
+		throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': requireApproval must be a boolean or an array of tool keys.`);
+	}
+}
+/**
+* Rejects the removed `autoApproveTools` option by name. Discovered MCP tools
+* no longer require approval by default, so a loosely typed config still
+* carrying this key would otherwise be ignored silently and its tools would
+* run without the prompts the author expected.
+*/
+function rejectRemovedAutoApproveTools(providers) {
+	for (const [integrationId, providerOptions] of Object.entries(providers)) if ("autoApproveTools" in providerOptions) throw new MastraConnectError("invalid_options", `Invalid options for '${integrationId}': autoApproveTools was removed. Tools no longer require approval by default; opt in with requireApproval: true or a list of tool keys to gate.`);
+}
+function buildRequests(providers, catalog, catalogAvailable) {
+	const { overrides, only } = providers;
+	const registrations = new Map(PROVIDERS.map((registration) => [registration.integrationId, registration]));
 	const catalogIds = new Set(catalog.map((integration) => integration.id));
 	for (const integration of catalog) {
 		if (!integration.capabilities.mcp) continue;
@@ -74282,9 +74588,14 @@ function buildRequests(integrations, catalog) {
 			transport: "mcp"
 		});
 	}
-	for (const integrationId of Object.keys(overrides)) if (!registrations.has(integrationId) && !catalogIds.has(integrationId)) console.warn(`[@mastra/connect] Ignoring unknown integration override '${integrationId}'.`);
+	const unknown = Object.keys(overrides).filter((integrationId) => !registrations.has(integrationId) && !catalogIds.has(integrationId) && !overrides[integrationId]?.disabled);
+	if (unknown.length > 0) {
+		if (catalogAvailable) throw new MastraConnectConfigError(`Unknown provider${unknown.length > 1 ? "s" : ""} in the providers option: ${unknown.map((id) => `'${id}'`).join(", ")}. Expected a checked-in provider id or a platform catalog integration id.`);
+		for (const integrationId of unknown) console.warn(`[@mastra/connect] Platform catalog unavailable; cannot verify provider '${integrationId}'. Skipping it this resolution.`);
+	}
 	const requests = [];
 	for (const registration of registrations.values()) {
+		if (only !== void 0 && !only.has(registration.integrationId)) continue;
 		const providerOptions = overrides[registration.integrationId] ?? {};
 		if (providerOptions.disabled) continue;
 		requests.push({
@@ -74300,6 +74611,7 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 	const activeMcpKeys = /* @__PURE__ */ new Set();
 	const result = {};
 	const toolOwners = /* @__PURE__ */ new Map();
+	const matchedDefaultEntries = /* @__PURE__ */ new Set();
 	for (const request of requests) {
 		const integrationId = request.registration.integrationId;
 		let providerTools;
@@ -74319,16 +74631,19 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connectionId: resolution.connectionId,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = request.registration.createTools({
-				connectionId: resolution.connectionId,
-				client: options.client,
-				...providerFilterOptions(request.options)
-			});
+			} else {
+				providerTools = request.registration.createTools({
+					connectionId: resolution.connectionId,
+					client: options.client,
+					...providerFilterOptions(request.options)
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval);
+			}
 			else if (request.registration.transport === "mcp") {
 				for (const connection of resolution.connections) activeMcpKeys.add(`${integrationId}::${connection.id}`);
 				providerTools = await buildMcpMultiConnectionTools({
@@ -74336,22 +74651,31 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 					connections: resolution.connections,
 					allowTools: request.options.allowTools,
 					disallowTools: request.options.disallowTools,
-					autoApproveTools: request.options.autoApproveTools,
+					requireApproval: request.options.requireApproval,
 					client,
 					mcpClients,
 					resolverId
 				});
-			} else providerTools = buildProxyMultiConnectionTools({
-				registration: request.registration,
-				connections: resolution.connections,
-				allowTools: request.options.allowTools,
-				disallowTools: request.options.disallowTools,
-				client: options.client
-			});
+			} else {
+				providerTools = buildProxyMultiConnectionTools({
+					registration: request.registration,
+					connections: resolution.connections,
+					allowTools: request.options.allowTools,
+					disallowTools: request.options.disallowTools,
+					client: options.client
+				});
+				applyProxyRequireApproval(providerTools, integrationId, request.options.requireApproval, [listConnectionsToolKey(integrationId)]);
+			}
 		} catch (error) {
+			if (error instanceof MastraConnectConfigError) throw error;
 			console.warn(`[@mastra/connect] Skipping ${integrationId}: ${error instanceof Error ? error.message : String(error)}`);
 			continue;
 		}
+		if (!(request.options.allowTools !== void 0 || request.options.disallowTools !== void 0) && (options.allowTools !== void 0 || options.disallowTools !== void 0)) providerTools = applyDefaultFilter(providerTools, options, integrationId, matchedDefaultEntries);
+		if (request.options.requireApproval === void 0 && options.requireApproval !== void 0) {
+			const policy = options.requireApproval;
+			if (policy !== false) applyDefaultRequireApproval(providerTools, policy, integrationId, matchedDefaultEntries);
+		}
 		for (const toolKey of Object.keys(providerTools)) {
 			const existingOwner = toolOwners.get(toolKey);
 			if (existingOwner) throw new MastraConnectError("invalid_options", `Duplicate tool key '${toolKey}' from providers '${existingOwner}' and '${integrationId}'.`);
@@ -74359,22 +74683,114 @@ async function mapTools(connections, requests, options, client, mcpClients, reso
 		}
 		Object.assign(result, providerTools);
 	}
+	if (Object.keys(result).length > 0) {
+		const defaultEntries = [
+			...options.allowTools ?? [],
+			...options.disallowTools ?? [],
+			...Array.isArray(options.requireApproval) ? options.requireApproval : []
+		];
+		for (const entry of defaultEntries) if (!matchedDefaultEntries.has(entry)) console.warn(`[@mastra/connect] Top-level entry '${entry}' matched no tools on any resolved provider.`);
+	}
 	const staleClients = Array.from(mcpClients.entries()).filter(([key]) => !activeMcpKeys.has(key));
 	for (const [key] of staleClients) mcpClients.delete(key);
 	await Promise.allSettled(staleClients.map(([, entry]) => entry.client.disconnect()));
 	return result;
 }
 /**
-* Extracts whichever provider tool filter is set. Since `ToolsIntegrationOptions`
+* Applies the top-level default filter to a provider that set no filter of
+* its own. Lenient by design: the provider set is live, so a default entry
+* that matches nothing on this provider simply does not apply here. Entries
+* that match are recorded in `matchedEntries` so mapTools can warn about
+* defaults that matched nothing anywhere. The synthetic
+* `<provider>__list_connections` wrapper is never filtered by defaults,
+* matching the per-provider multi-connection behavior.
+*/
+function applyDefaultFilter(providerTools, defaults, integrationId, matchedEntries) {
+	const listToolKey = listConnectionsToolKey(integrationId);
+	const matchers = (defaults.allowTools ?? defaults.disallowTools ?? []).map((entry) => ({
+		entry,
+		matches: compileToolMatcher([entry])
+	}));
+	const filtered = {};
+	for (const [key, tool] of Object.entries(providerTools)) {
+		if (key === listToolKey) {
+			filtered[key] = tool;
+			continue;
+		}
+		let matchedAny = false;
+		for (const { entry, matches } of matchers) if (matches(key)) {
+			matchedEntries.add(entry);
+			matchedAny = true;
+		}
+		if (defaults.allowTools !== void 0 ? matchedAny : !matchedAny) filtered[key] = tool;
+	}
+	return filtered;
+}
+/**
+* Applies the top-level default `requireApproval` policy to a provider that
+* set no policy of its own. `true` gates every tool except the synthetic
+* `<provider>__list_connections` wrapper; an array gates matching keys with
+* the same lenient semantics as {@link applyDefaultFilter}.
+*/
+function applyDefaultRequireApproval(providerTools, policy, integrationId, matchedEntries) {
+	const listToolKey = listConnectionsToolKey(integrationId);
+	if (policy === true) {
+		for (const [key, tool] of Object.entries(providerTools)) {
+			if (key === listToolKey) continue;
+			tool.requireApproval = true;
+		}
+		return;
+	}
+	const matchers = policy.map((entry) => ({
+		entry,
+		matches: compileToolMatcher([entry])
+	}));
+	for (const [key, tool] of Object.entries(providerTools)) {
+		if (key === listToolKey) continue;
+		for (const { entry, matches } of matchers) if (matches(key)) {
+			matchedEntries.add(entry);
+			tool.requireApproval = true;
+		}
+	}
+}
+/**
+* Extracts whichever provider tool filter is set. Since `ToolsProviderOptions`
 * is an XOR union and tools() validates co-occurrence up front, at most one
 * of the two will ever be defined here.
 */
 function providerFilterOptions(options) {
 	return options.allowTools !== void 0 ? { allowTools: options.allowTools } : options.disallowTools !== void 0 ? { disallowTools: options.disallowTools } : {};
 }
+/**
+* Applies a per-provider `requireApproval` policy to a checked-in HTTP
+* toolset by marking the selected tools. `true` gates every provider tool
+* (but never the synthetic `<provider>__list_connections` wrapper tool,
+* matching the MCP paths, where only server-discovered tools are gated);
+* an array gates the listed keys — entries containing `*` are globs,
+* expanded against the provider tools minus the synthetic wrapper so a
+* broad glob behaves like `true` — and rejects unknown names and dead
+* globs with the same `invalid_options` error MCP discovery raises, so a
+* typo never silently widens access.
+*/
+function applyProxyRequireApproval(providerTools, integrationId, requireApproval, excludeKeys = []) {
+	if (!requireApproval) return;
+	const excluded = new Set(excludeKeys);
+	if (requireApproval === true) {
+		for (const [toolKey, tool] of Object.entries(providerTools)) {
+			if (excluded.has(toolKey)) continue;
+			tool.requireApproval = true;
+		}
+		return;
+	}
+	const known = Object.keys(providerTools);
+	const expanded = expandToolPatterns(requireApproval, known.filter((key) => !excluded.has(key)), `requireApproval for '${integrationId}'`);
+	const unknown = expanded.filter((name) => !known.includes(name));
+	if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${integrationId}': ${unknown.join(", ")}. Known tools: ${known.join(", ")}.`);
+	for (const name of expanded) providerTools[name].requireApproval = true;
+}
 async function discoverMcpTools(input) {
-	const { registration, connectionId, allowTools, disallowTools, autoApproveTools, client, mcpClients, resolverId } = input;
-	const autoApproved = new Set(autoApproveTools ?? []);
+	const { registration, connectionId, allowTools, disallowTools, requireApproval, client, mcpClients, resolverId } = input;
+	const requireApprovalFor = Array.isArray(requireApproval) ? compileToolMatcher(requireApproval) : void 0;
 	const cacheKey = `${registration.integrationId}::${connectionId}`;
 	let entry = mcpClients.get(cacheKey);
 	if (!entry) {
@@ -74386,7 +74802,7 @@ async function discoverMcpTools(input) {
 				id: `mastra-connect-${resolverId}-${registration.integrationId}-${connectionId}`,
 				servers: { [registration.integrationId]: {
 					...transport,
-					requireToolApproval: ({ toolName }) => !autoApproved.has(`${registration.integrationId}_${String(toolName)}`)
+					...requireApproval === true ? { requireToolApproval: true } : requireApprovalFor ? { requireToolApproval: ({ toolName }) => requireApprovalFor(`${registration.integrationId}_${String(toolName)}`) } : {}
 				} }
 			})
 		};
@@ -74395,31 +74811,16 @@ async function discoverMcpTools(input) {
 	const discovery = await entry.client.listToolsWithErrors();
 	const error = discovery.errors[registration.integrationId];
 	if (error) throw new Error(`MCP tool discovery failed: ${error}`);
-	const unknown = [...autoApproved].filter((name) => !(name in discovery.tools));
-	if (unknown.length > 0) throw new MastraConnectError("invalid_options", `Unknown tool name(s) in autoApproveTools for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	if (Array.isArray(requireApproval)) {
+		const unknown = expandToolPatterns(requireApproval, Object.keys(discovery.tools), `requireApproval for '${registration.integrationId}'`).filter((name) => !(name in discovery.tools));
+		if (unknown.length > 0) throw new MastraConnectConfigError(`Unknown tool name(s) in requireApproval for '${registration.integrationId}': ${unknown.join(", ")}. Known tools: ${Object.keys(discovery.tools).join(", ")}.`);
+	}
 	return applyToolFilter(discovery.tools, {
 		allowTools,
 		disallowTools
 	});
 }
 //#endregion
-//#region src/connect.ts
-/**
-* @deprecated Use `tools` from `@mastra/connect` instead. This module is a
-* thin re-export retained for one release cycle so downstream consumers keep
-* working; it will be removed in the next minor.
-*/
-/**
-* @deprecated Renamed to {@link tools}.
-*
-* `connect(options)` is a drop-in alias for `tools(options)`. Prefer `tools`
-* from `@mastra/connect` in new code; this export will be removed in the next
-* minor version.
-*/
-function connect(options = {}) {
-	return tools(options);
-}
-//#endregion
 //#region src/channels.ts
 const DEFAULT_TTL_MS = 3e4;
 /** Minimum wait after a failed platform fetch before another background revalidation. */
@@ -74432,7 +74833,7 @@ const FAILURE_COOLDOWN_MS = 3e4;
 * Discord) are constructed once, up front and credential-less, so their
 * webhook/OAuth routes can mount at Mastra construction. Each resolution
 * fetches the project's connections and late-binds credentials into the live
-* instances: integrations with an active connection appear in the resolved
+* instances: providers with an active connection appear in the resolved
 * map, others don't — so connecting a new channel on the platform takes
 * effect without redeploying the app.
 *
@@ -74457,12 +74858,17 @@ async function channels(options = {}) {
 	const projectId = options.projectId?.trim() || process.env.MASTRA_PROJECT_ID?.trim();
 	if (!projectId) throw new MastraConnectError("missing_project_id", "Missing project id: set MASTRA_PROJECT_ID or pass projectId.");
 	if (options.ttlMs !== void 0 && (!Number.isFinite(options.ttlMs) || options.ttlMs < 0)) throw new MastraConnectError("invalid_options", `Invalid ttlMs (${options.ttlMs}): expected a finite number of milliseconds >= 0.`);
-	validateIntegrationOverrides(options.integrations);
+	const { overrides: providerOverrides, only } = normalizeChannelProviders(options.providers);
+	validateProviderIds(providerOverrides);
+	const knownChannelIds = new Set(CHANNELS.map((registration) => registration.integrationId));
+	const unknownChannelIds = Object.keys(providerOverrides).filter((integrationId) => !knownChannelIds.has(integrationId) && !providerOverrides[integrationId]?.disabled);
+	if (unknownChannelIds.length > 0) throw new MastraConnectError("invalid_options", `Unknown channel${unknownChannelIds.length > 1 ? "s" : ""} in the providers option: ${unknownChannelIds.map((id) => `'${id}'`).join(", ")}. Known channels: ${[...knownChannelIds].join(", ")}.`);
 	const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
 	const client = resolveClient(options.client);
 	const states = [];
 	for (const registration of CHANNELS) {
-		const overrides = options.integrations?.[registration.integrationId] ?? {};
+		if (only !== void 0 && !only.has(registration.integrationId)) continue;
+		const overrides = providerOverrides[registration.integrationId] ?? {};
 		if (overrides.disabled) continue;
 		const state = {
 			registration,
@@ -74498,6 +74904,7 @@ async function channels(options = {}) {
 	let cache;
 	let inflight;
 	let lastFailureAt;
+	let warnedStaleSlackConnection = false;
 	const buildSnapshot = async () => {
 		let connections;
 		try {
@@ -74508,9 +74915,13 @@ async function channels(options = {}) {
 		}
 		const byIntegrationId = groupByIntegrationId(connections);
 		const providers = {};
+		if (!warnedStaleSlackConnection && states.some((state) => state.registration.integrationId === "slack-channels") && (byIntegrationId.get("slack")?.length ?? 0) > 0 && (byIntegrationId.get("slack-channels")?.length ?? 0) === 0) {
+			warnedStaleSlackConnection = true;
+			console.warn(`[@mastra/connect] Project ${projectId} has an active 'slack' connection but no 'slack-channels' connection: the Slack channel is now keyed off 'slack-channels'. Connect Slack again as 'slack-channels' to restore it; the existing 'slack' connection still powers the generated Slack tools.`);
+		}
 		for (const state of states) {
 			const integrationId = state.registration.integrationId;
-			const overrides = options.integrations?.[integrationId] ?? {};
+			const overrides = providerOverrides[integrationId] ?? {};
 			const candidates = byIntegrationId.get(integrationId) ?? [];
 			const connectionId = candidates.length === 0 ? void 0 : selectChannelConnection(integrationId, overrides.connectionId, candidates);
 			state.connectionId = connectionId;
@@ -74557,9 +74968,6 @@ async function channels(options = {}) {
 	};
 	const invocable = ((_context) => resolve());
 	invocable.getRoutes = () => states.flatMap((state) => state.instance.provider.getRoutes());
-	invocable.invalidate = () => {
-		cache = void 0;
-	};
 	invocable.refresh = refresh;
 	invocable.disconnect = async () => {
 		cache = void 0;
@@ -74567,15 +74975,73 @@ async function channels(options = {}) {
 	return invocable;
 }
 /**
+* Friendly channel-key aliases. The Slack channel is keyed `slack-channels`
+* on the platform (plain `slack` names the Slack tools provider), but inside
+* a channels() config `slack` is unambiguous — accept it and canonicalize to
+* the platform key for registration and connection lookup.
+*/
+const CHANNEL_KEY_ALIASES = { slack: "slack-channels" };
+const canonicalChannelId = (id) => CHANNEL_KEY_ALIASES[id] ?? id;
+/** Throws when two option keys (e.g. `slack` and `slack-channels`) name the same channel. */
+function rejectAliasCollision(sourceKeys, canonical, key) {
+	const existing = sourceKeys[canonical];
+	if (existing === void 0) return;
+	throw new MastraConnectError("invalid_options", existing === key ? `Duplicate provider '${key}' in providers array.` : `Both '${existing}' and '${key}' name the '${canonical}' channel in the providers option; use one key.`);
+}
+/**
+* Turns the two accepted `providers` shapes into the internal form, mirroring
+* `tools()`. The array form becomes an allowlist with default options; the
+* record form expands boolean shorthands (`true` → `{}`, `false` → an
+* internal exclusion marker). Alias keys canonicalize first, so `slack` and
+* `slack-channels` configure the same channel (and collide loudly). Malformed
+* inputs throw at channels() time.
+*/
+function normalizeChannelProviders(providers) {
+	if (providers === void 0) return {
+		overrides: {},
+		only: void 0
+	};
+	const sourceKeys = {};
+	if (Array.isArray(providers)) {
+		const overrides = {};
+		for (const entry of providers) {
+			if (typeof entry !== "string") throw new MastraConnectError("invalid_options", `Invalid providers entry: expected a string channel id, got ${typeof entry}.`);
+			const canonical = canonicalChannelId(entry);
+			rejectAliasCollision(sourceKeys, canonical, entry);
+			sourceKeys[canonical] = entry;
+			overrides[canonical] = {};
+		}
+		return {
+			overrides,
+			only: new Set(Object.keys(overrides))
+		};
+	}
+	const overrides = {};
+	for (const [providerId, value] of Object.entries(providers)) {
+		if (value === void 0) continue;
+		const canonical = canonicalChannelId(providerId);
+		rejectAliasCollision(sourceKeys, canonical, providerId);
+		sourceKeys[canonical] = providerId;
+		if (value === true) overrides[canonical] = {};
+		else if (value === false) overrides[canonical] = { disabled: true };
+		else if (typeof value === "object" && value !== null && !Array.isArray(value)) overrides[canonical] = value;
+		else throw new MastraConnectError("invalid_options", `Invalid providers entry for '${providerId}': expected true, false, or an options object, got ${value === null ? "null" : Array.isArray(value) ? "an array" : typeof value}.`);
+	}
+	return {
+		overrides,
+		only: void 0
+	};
+}
+/**
 * Selects the connection `channels()` should use for one provider.
 *
-* - Pinned `connectionId` (from `integrations.<id>.connectionId`) wins, but is
+* - Pinned `connectionId` (from `providers.<id>.connectionId`) wins, but is
 *   skipped if the pinned id isn't attached to the project or the connection
 *   isn't `active`.
 * - Otherwise, the single active connection is used.
 * - When more than one active connection exists, this warns naming the chosen
 *   id and picks the first active connection. There is no env-var fallback;
-*   pin explicitly with `integrations.<id>.connectionId` when the deterministic
+*   pin explicitly with `providers.<id>.connectionId` when the deterministic
 *   choice matters.
 */
 function selectChannelConnection(integrationId, pinnedId, candidates) {
@@ -74604,7 +75070,7 @@ function selectChannelConnection(integrationId, pinnedId, candidates) {
 	if (active.length === 1) return active[0].id;
 	const chosen = active[0].id;
 	const others = active.slice(1).map((connection) => connection.id).join(", ");
-	console.warn(`[@mastra/connect] ${integrationId} channel: found ${active.length} active connections; using ${chosen}. Ignoring ${others}. Pin one with integrations.${integrationId}.connectionId to silence this warning.`);
+	console.warn(`[@mastra/connect] ${integrationId} channel: found ${active.length} active connections; using ${chosen}. Ignoring ${others}. Pin one with providers.${integrationId}.connectionId to silence this warning.`);
 	return chosen;
 }
 //#endregion
@@ -74617,108 +75083,6 @@ async function credential(connectionId, options) {
 	return getCredential(resolveClient(options?.client), connectionId);
 }
 //#endregion
-//#region src/environment.ts
-function credentialToken(credential) {
-	return credential.type === "oauth2" ? credential.accessToken : credential.apiKey;
-}
-/**
-* Wires git's credential helper to read the token from the environment at use
-* time, so the secret lives in the process env rather than in git config or
-* remote URLs. `gh` needs no setup: it honors GH_TOKEN directly.
-*/
-const GITHUB_GIT_CREDENTIAL_HELPER = "!f() { echo username=x-access-token; echo \"password=$GH_TOKEN\"; }; f";
-/** Providers that know how to materialize sandbox credentials. */
-const ENVIRONMENT_CONTRIBUTORS = [{
-	integrationId: "github",
-	envVar: "MASTRA_GITHUB_CONNECTION_ID",
-	build(credential) {
-		const token = credentialToken(credential);
-		return {
-			env: {
-				GH_TOKEN: token,
-				GITHUB_TOKEN: token
-			},
-			onStart: async ({ sandbox }) => {
-				if (!sandbox.executeCommand) {
-					console.warn("[@mastra/connect] github environment: sandbox does not support executeCommand; skipping git credential setup (gh still works via GH_TOKEN).");
-					return;
-				}
-				await sandbox.executeCommand("git", [
-					"config",
-					"--global",
-					"credential.https://github.com.helper",
-					GITHUB_GIT_CREDENTIAL_HELPER
-				]);
-			}
-		};
-	}
-}];
-/**
-* Resolves the project's Platform connections into sandbox credentials:
-* environment variables plus a start hook that finishes in-sandbox setup.
-* Currently GitHub-aware (`GH_TOKEN`/`GITHUB_TOKEN` + git credential helper);
-* more providers plug in over time.
-*
-* Connection resolution matches `connect()`: a per-integration `connectionId`
-* or the provider's `MASTRA_*_CONNECTION_ID` env var wins, else a single
-* active connection; ambiguity, needs_reauth, and credential-fetch failures
-* warn and skip that provider. Configuration errors (missing project id,
-* malformed integration id) throw here so they surface at startup.
-*
-* The returned `env` is a snapshot: call `environment()` again for a fresh
-* token when starting new sandboxes.
-*
-* @example
-* const { env, onStart } = await environment({ projectId });
-* const sandbox = new E2BSandbox({ env, onStart });
-* // in the sandbox: `gh pr list`, `git clone https://github.com/org/repo` just work
-*/
-async function environment(options = {}) {
-	const projectId = options.projectId?.trim() || process.env.MASTRA_PROJECT_ID?.trim();
-	if (!projectId) throw new MastraConnectError("missing_project_id", "Missing project id: set MASTRA_PROJECT_ID or pass projectId.");
-	validateIntegrationOverrides(options.integrations);
-	const client = resolveClient(options.client);
-	const byIntegrationId = groupByIntegrationId(await listProjectConnections(client, projectId));
-	const env = {};
-	const hooks = [];
-	for (const contributor of ENVIRONMENT_CONTRIBUTORS) {
-		const integrationId = contributor.integrationId;
-		const overrides = options.integrations?.[integrationId] ?? {};
-		if (overrides.disabled) continue;
-		const candidates = byIntegrationId.get(integrationId) ?? [];
-		if (candidates.length === 0) continue;
-		const connectionId = resolveConnection({
-			integrationId,
-			envVar: contributor.envVar,
-			connectionId: overrides.connectionId
-		}, candidates);
-		if (!connectionId) continue;
-		let credential;
-		try {
-			credential = await getCredential(client, connectionId);
-		} catch (error) {
-			console.warn(`[@mastra/connect] Skipping ${integrationId} environment: ${error instanceof Error ? error.message : String(error)}`);
-			continue;
-		}
-		const contribution = contributor.build(credential);
-		for (const [key, value] of Object.entries(contribution.env)) {
-			if (key in env) console.warn(`[@mastra/connect] ${integrationId} environment overwrites env var '${key}' set by an earlier provider.`);
-			env[key] = value;
-		}
-		if (contribution.onStart) hooks.push({
-			integrationId,
-			hook: contribution.onStart
-		});
-	}
-	const onStart = async (args) => {
-		for (const { hook } of hooks) await hook(args);
-	};
-	return {
-		env,
-		onStart
-	};
-}
-//#endregion
-export { CHANNELS, MastraConnectError, PROVIDERS, TOOLS, applyAllowTools, channels, connect, credential, defineProxyTool, environment, findChannelRegistration, findRegistration, resolveConnectionId, tools };
+export { CHANNELS, MastraConnectError, PROVIDERS, channels, credential, tools };
 
 //# sourceMappingURL=index.js.map