@mastra/connect 1.1.0-alpha.5 → 1.2.0-alpha.0

package/dist/index.d.ts

@@ -6,6 +6,8 @@ export type { ChannelProviderRegistration, ChannelInstance, ChannelRuntime } fro
 export { credential } from './credential.js';
 export { userConnectRoutes } from './user-connect-routes.js';
 export type { UserConnectRoutesOptions, UserConnectIdentityContext } from './user-connect-routes.js';
+export { CONNECT_PROMPT_TOOL_KEY } from './connect-prompt-tool.js';
+export type { ConnectPromptPayload, ConnectPromptProvider } from './connect-prompt-tool.js';
 export { MastraConnectError } from './errors.js';
 export type { MastraConnectErrorCode } from './errors.js';
 export type { ConnectClientOptions, ConnectionCredential, ProjectConnection } from './client.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,2BAA2B,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,oBAAoB,EACpB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,2BAA2B,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACpH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -372,6 +372,13 @@ const connectionListSchema = z.object({ connections: z.array(connectionSchema) }
 */
 const catalogAuthFieldSchema = z.object({
 	name: z.string(),
+	/**
+	* Where the value goes in a headless auth call: `credentials` are
+	* exchanged with the provider (API keys, passwords), `params` configure
+	* the flow (e.g. an MCP server URL). Absent on older platforms; clients
+	* treat missing as `credentials`.
+	*/
+	target: z.enum(["credentials", "params"]).nullish(),
 	label: z.string().nullish(),
 	description: z.string().nullish(),
 	placeholder: z.string().nullish(),
@@ -388,6 +395,9 @@ const integrationCatalogEntrySchema = z.object({
 	authFields: z.array(catalogAuthFieldSchema).nullish()
 });
 const integrationCatalogResponseSchema = z.object({ integrations: z.array(integrationCatalogEntrySchema) });
+const projectIntegrationSettingsResponseSchema = z.object({ 
+/** Null inherits the full public catalog; an empty array explicitly disables end-user connections. */
+endUserProviders: z.array(z.string()).nullable() });
 /**
 * Secondary access token minted by the vendor alongside the primary oauth2
 * credential (e.g. `devPortalAccessToken` on Microsoft Teams connections).
@@ -439,6 +449,14 @@ async function listIntegrations(client) {
 	if (!parsed.success) throw new MastraConnectError("platform_error", "Platform returned an unexpected integration catalog shape.");
 	return parsed.data.integrations;
 }
+async function getProjectIntegrationSettings(client, projectId) {
+	const response = await platformFetch(client, `/v2/projects/${encodeURIComponent(projectId)}/integration-settings`);
+	if (response.status === 404) throw new MastraConnectError("platform_error", `Integration settings were not found for project ${projectId}.`, { status: 404 });
+	if (!response.ok) await throwPlatformError(response, `retrieving integration settings for project ${projectId}`);
+	const parsed = projectIntegrationSettingsResponseSchema.safeParse(await parsePlatformJson(response, `retrieving integration settings for project ${projectId}`));
+	if (!parsed.success) throw new MastraConnectError("platform_error", `Platform returned an unexpected integration settings shape for project ${projectId}.`);
+	return parsed.data;
+}
 async function getConnectionContext(client, connectionId) {
 	const response = await platformFetch(client, `/v2/connections/${encodeURIComponent(connectionId)}/context`);
 	if (!response.ok) await throwPlatformError(response, `retrieving context for connection ${connectionId}`);
@@ -583,8 +601,19 @@ async function proxyRequestWithResponse(client, connectionId, options) {
 const connectSessionSchema = z.object({
 	connectionId: z.string(),
 	integrationId: z.string(),
-	connectUrl: z.string(),
-	sessionToken: z.string(),
+	/**
+	* Vendor connect link. The platform nulls this for resource-scoped
+	* sessions: their link is a bearer capability served only by the launch
+	* gate (`getConnectUrl`) under a matching resource assertion, so it never
+	* appears in a creation response that could reach a browser.
+	*/
+	connectUrl: z.string().nullish(),
+	/**
+	* Nango connect session token. Nulled by the platform for resource-scoped
+	* sessions for the same reason as `connectUrl`: the token alone can open
+	* the vendor Connect UI, so it is an equivalent launch capability.
+	*/
+	sessionToken: z.string().nullish(),
 	expiresAt: z.string()
 });
 /**
@@ -603,12 +632,89 @@ async function createProjectConnectSession(client, projectId, integrationId) {
 	if (!parsed.success) throw new MastraConnectError("platform_error", `Platform returned an unexpected connect-session shape for ${integrationId}.`);
 	return parsed.data;
 }
+const connectUrlSchema = z.object({
+	connectUrl: z.string(),
+	expiresAt: z.string()
+});
+/**
+* Fetches the vendor connect link for a pending resource-scoped connection
+* from the platform's launch gate. The platform serves it only while the
+* session is pending and unexpired, and only when the client's
+* `x-mastra-resource-id` assertion matches the row — any mismatch is a 404,
+* which surfaces here as `connection_not_found`. This is how the browser's
+* popup enters OAuth: the link itself never reaches browser-visible state.
+*/
+async function getConnectUrl(client, connectionId) {
+	const response = await platformFetch(client, `/v2/connections/${encodeURIComponent(connectionId)}/connect-url`);
+	if (response.status === 404) throw new MastraConnectError("connection_not_found", `No launchable connect session found for connection ${connectionId}.`);
+	if (!response.ok) await throwPlatformError(response, `fetching the connect URL for ${connectionId}`);
+	const parsed = connectUrlSchema.safeParse(await parsePlatformJson(response, `fetching the connect URL for ${connectionId}`));
+	if (!parsed.success) throw new MastraConnectError("platform_error", `Platform returned an unexpected connect-url shape for ${connectionId}.`);
+	return parsed.data;
+}
 /** Disconnects a connection. The platform tears down the vendor side asynchronously. */
 async function disconnectConnection(client, connectionId) {
 	const response = await platformFetch(client, `/v2/connections/${encodeURIComponent(connectionId)}`, { method: "DELETE" });
 	if (!response.ok) await throwPlatformError(response, `disconnecting connection ${connectionId}`);
 }
 //#endregion
+//#region src/connect-prompt-tool.ts
+/**
+* Record key of the built-in connect-prompt tool. Reserved: a provider tool
+* resolving to the same key is a hard error, same as any duplicate.
+*/
+const CONNECT_PROMPT_TOOL_KEY = "request_connection";
+/**
+* Builds the built-in tool that lets an agent prompt the end user to connect
+* a provider account mid-conversation. Only added to resource-scoped
+* resolutions: without an end-user identity there is nobody to scope a new
+* connection to.
+*
+* The connectable set respects the effective project policy: an explicit
+* `tools({ providers })` allowlist wins, otherwise the project's provider
+* configuration is loaded from Mastra Platform.
+*
+* `loadInputs` is called per tool invocation so provider policy and connection state are fresh —
+* after the user connects through the rendered card, the agent can call the
+* tool again and see `connected: true` without waiting out the snapshot TTL.
+*/
+function buildConnectPromptTool({ loadInputs, resourceId }) {
+	return createTool({
+		id: CONNECT_PROMPT_TOOL_KEY,
+		description: "Ask the current user to connect a provider account (e.g. Linear, Slack). Call this when a task needs a provider whose tools are unavailable because no account is connected, or when the user asks to connect one. The result renders as a connect prompt in the UI — tell the user to use it, and do not fabricate links. Pass `provider` to request one specific provider; omit it to list everything the user can connect.",
+		inputSchema: z.object({ provider: z.string().optional().describe("Provider id to request (e.g. \"linear\"). Omit to list all connectable providers.") }),
+		execute: async (input) => {
+			const { catalog, connections, allowlist } = await loadInputs();
+			const allow = allowlist === void 0 ? void 0 : new Set(Array.from(allowlist, (id) => id.toLowerCase()));
+			const connectable = catalog.filter((entry) => allow === void 0 || allow.has(entry.id.toLowerCase()));
+			const toProvider = (entry) => {
+				const usable = connections.filter((connection) => connection.integrationId.toLowerCase() === entry.id.toLowerCase() && connection.status === "active");
+				const own = usable.some((connection) => connection.resourceId === resourceId);
+				return {
+					id: entry.id,
+					displayName: entry.displayName ?? null,
+					logoUrl: entry.logoUrl ?? null,
+					authType: entry.authType ?? null,
+					authFields: entry.authFields ?? null,
+					connected: usable.length > 0,
+					scope: own ? "user" : usable.length > 0 ? "global" : null
+				};
+			};
+			const requestedId = input.provider?.toLowerCase();
+			const requested = requestedId === void 0 ? void 0 : connectable.find((entry) => entry.id.toLowerCase() === requestedId);
+			if (requested) return {
+				type: "connect-prompt",
+				requestedProvider: requested.id,
+				providers: [toProvider(requested)]
+			};
+			return {
+				type: "connect-prompt",
+				providers: connectable.map(toProvider)
+			};
+		}
+	});
+}
+//#endregion
 //#region src/toolset.ts
 /**
 * Compiles a tool-filter entry containing `*` wildcards into an anchored
@@ -75351,6 +75457,7 @@ function sharedStateKey(projectId, ttlMs, options) {
 		allowTools: options.allowTools,
 		disallowTools: options.disallowTools,
 		requireApproval: options.requireApproval,
+		connectPrompt: options.connectPrompt,
 		client: {
 			baseUrl: options.client?.baseUrl,
 			orgId: options.client?.orgId,
@@ -75487,6 +75594,18 @@ async function loadSnapshotInputs(state, client) {
 		catalogAvailable: false
 	};
 }
+/** Loads fresh prompt inputs and resolves project policy only when code did not provide an allowlist. */
+async function loadConnectPromptInputs(state, client) {
+	const codeAllowlist = state.normalizedProviders.only;
+	const [inputs, settings] = await Promise.all([loadSnapshotInputs(state, client), codeAllowlist === void 0 ? getProjectIntegrationSettings(client, state.projectId) : Promise.resolve(void 0)]);
+	const projectProviders = settings?.endUserProviders;
+	const allowlist = codeAllowlist ?? (projectProviders === null || projectProviders === void 0 ? void 0 : new Set(projectProviders));
+	return {
+		catalog: inputs.catalog,
+		connections: inputs.connections,
+		allowlist
+	};
+}
 /**
 * Fetches a fresh snapshot for one scope, deduplicating concurrent calls per
 * scope. Rejects on failure. A refresh requested while the state is closing
@@ -75505,6 +75624,14 @@ function refreshScope(state, scope) {
 				...scope.resourceId === void 0 ? {} : { resourceId: scope.resourceId }
 			};
 			const { record, mcpKeys } = await mapTools(connections, requests, state.options, clientOptions, scope.client, state.mcpClients, state.resolverId);
+			if (scope.resourceId !== void 0 && state.options.connectPrompt !== false) {
+				if (record["request_connection"]) throw new MastraConnectConfigError(`Tool key '${CONNECT_PROMPT_TOOL_KEY}' is reserved for the built-in connect-prompt tool; a provider resolved a tool with the same key. Disable it with connectPrompt: false or exclude the conflicting provider tool.`);
+				const client = scope.client;
+				record[CONNECT_PROMPT_TOOL_KEY] = buildConnectPromptTool({
+					loadInputs: () => loadConnectPromptInputs(state, client),
+					resourceId: scope.resourceId
+				});
+			}
 			scope.cache = {
 				snapshot: record,
 				fetchedAt: Date.now(),
@@ -75609,6 +75736,7 @@ function tools(options = {}) {
 	rejectRemovedAutoApproveTools(providerOverrides);
 	if (options.allowTools !== void 0 && options.disallowTools !== void 0) throw new MastraConnectError("invalid_options", "Top-level allowTools and disallowTools are mutually exclusive; set at most one.");
 	if (options.requireApproval !== void 0 && typeof options.requireApproval !== "boolean" && !(Array.isArray(options.requireApproval) && options.requireApproval.every((name) => typeof name === "string"))) throw new MastraConnectError("invalid_options", "Top-level requireApproval must be a boolean or an array of tool keys.");
+	if (options.connectPrompt !== void 0 && typeof options.connectPrompt !== "boolean") throw new MastraConnectError("invalid_options", `Invalid connectPrompt: expected a boolean, got ${typeof options.connectPrompt}.`);
 	const state = acquireSharedState(projectId, ttlMs, options, normalizedProviders);
 	const validateDynamicResourceId = (raw) => raw === void 0 || raw === null ? void 0 : validateResourceId(raw);
 	const resolve = (ctx) => {
@@ -76518,14 +76646,18 @@ function renderConnectPage(params) {
         return res.json();
       })
       .then(function (session) {
+        // The popup enters OAuth through the launch gate (same-origin,
+        // authenticated) rather than a raw vendor link: the server re-checks
+        // that this browser's identity owns the pending session immediately
+        // before redirecting into the provider's consent screen.
         if (popup && !popup.closed) {
-          popup.location = session.connectUrl;
+          popup.location = session.launchUrl;
           setStatus('Finish authorizing in the popup…', false);
         } else {
           // Popup blocked: offer a manual link instead of auto-navigating away.
           status.textContent = '';
           var link = document.createElement('a');
-          link.href = session.connectUrl;
+          link.href = session.launchUrl;
           link.target = '_blank';
           link.rel = 'noopener';
           link.textContent = 'Popup blocked — click here to authorize';
@@ -76553,6 +76685,7 @@ const RESERVED_PROVIDER_IDS = /* @__PURE__ */ new Set([
 	"sessions"
 ]);
 const NO_STORE = "no-store, private";
+const PROJECT_PROVIDER_POLICY_TTL_MS = 3e4;
 function errorResponse(c, error) {
 	c.header("cache-control", NO_STORE);
 	return c.json({ error: {
@@ -76562,8 +76695,10 @@ function errorResponse(c, error) {
 }
 /**
 * Maps a platform-call failure to a safe end-user response. Platform detail
-* strings never reach the end user — this is an unauthenticated-adjacent
-* surface, and the details describe the developer's platform account.
+* strings do not reach the end user — this is an unauthenticated-adjacent
+* surface, and the details describe the developer's platform account. The one
+* exception is 409 conflicts, whose details describe the caller's own
+* connection state and are authored by the platform for display.
 */
 function toRouteError(error) {
 	if (error instanceof MastraConnectError) {
@@ -76577,6 +76712,16 @@ function toRouteError(error) {
 			code: "misconfigured",
 			message: "Connect routes are not configured correctly."
 		};
+		if (error.status === 409) return {
+			status: 409,
+			code: "conflict",
+			message: error.detail ?? "The request conflicts with the current state of this connection."
+		};
+		if (error.status === 429) return {
+			status: 429,
+			code: "rate_limited",
+			message: "Too many requests. Try again shortly."
+		};
 		return {
 			status: 502,
 			code: "platform_error",
@@ -76664,18 +76809,44 @@ function connectionScope(connection) {
 * ```
 */
 function userConnectRoutes(options) {
-	if (!Array.isArray(options.providers) || options.providers.length === 0) throw new MastraConnectError("invalid_options", "userConnectRoutes requires a non-empty providers allowlist: the end-user surface never defaults open.");
-	const providers = options.providers.map((provider) => {
+	if (options.providers !== void 0 && (!Array.isArray(options.providers) || options.providers.length === 0)) throw new MastraConnectError("invalid_options", "Invalid providers: pass a non-empty allowlist, or omit the option to use the project provider configuration.");
+	const providers = options.providers?.map((provider) => {
 		const id = typeof provider === "string" ? provider.trim().toLowerCase() : "";
 		if (!id) throw new MastraConnectError("invalid_options", "Invalid provider id in userConnectRoutes providers allowlist.");
 		if (RESERVED_PROVIDER_IDS.has(id) || id.includes("/")) throw new MastraConnectError("invalid_options", `Invalid provider id '${id}': reserved route segment.`);
 		return id;
 	});
-	const allowlist = new Set(providers);
+	/** Explicit code configuration wins without reading project settings from the platform. */
+	const codeAllowlist = providers === void 0 ? void 0 : new Set(providers);
 	const basePath = options.basePath ?? "/connect";
 	if (!basePath.startsWith("/") || basePath.endsWith("/") || basePath.includes(":") || basePath.includes("*")) throw new MastraConnectError("invalid_options", `Invalid basePath '${basePath}': expected an absolute path without a trailing slash or route parameters.`);
 	const projectId = options.projectId?.trim() || process.env.MASTRA_PROJECT_ID?.trim();
 	if (!projectId) throw new MastraConnectError("missing_project_id", "Missing project id: set MASTRA_PROJECT_ID or pass projectId.");
+	let cachedProjectPolicy;
+	let projectPolicyInflight;
+	/** Lazily loads project policy, sharing one short-lived snapshot across end-user requests and status polling. */
+	const resolveProviderPolicy = (client) => {
+		if (providers !== void 0) return Promise.resolve({
+			providers,
+			allowlist: codeAllowlist
+		});
+		if (cachedProjectPolicy && Date.now() - cachedProjectPolicy.fetchedAt < PROJECT_PROVIDER_POLICY_TTL_MS) return Promise.resolve(cachedProjectPolicy.policy);
+		if (!projectPolicyInflight) projectPolicyInflight = getProjectIntegrationSettings(client, projectId).then((settings) => {
+			const configured = settings.endUserProviders?.map((provider) => provider.toLowerCase());
+			const policy = {
+				providers: configured,
+				allowlist: configured === void 0 ? void 0 : new Set(configured)
+			};
+			cachedProjectPolicy = {
+				policy,
+				fetchedAt: Date.now()
+			};
+			return policy;
+		}).finally(() => {
+			projectPolicyInflight = void 0;
+		});
+		return projectPolicyInflight;
+	};
 	if (options.client?.resourceId !== void 0) throw new MastraConnectError("invalid_options", "userConnectRoutes derives the resource key per request; do not set client.resourceId.");
 	if (options.resourceId !== void 0 && typeof options.resourceId !== "function") throw new MastraConnectError("invalid_options", "Invalid resourceId: userConnectRoutes expects a callback deriving the key per request.");
 	const allowedOrigins = options.returnTo?.allowedOrigins ?? [];
@@ -76727,13 +76898,20 @@ function userConnectRoutes(options) {
 			return errorResponse(c, toRouteError(error));
 		}
 	};
-	/** Lists the caller's visible connections (global + own), filtered to the allowlist. */
-	const listVisibleConnections = async (client) => {
-		return (await listProjectConnections(client, projectId)).filter((connection) => allowlist.has(connection.integrationId.toLowerCase()));
-	};
-	const providerParam = (c) => {
+	/**
+	* Lists the caller's visible connections (global + own, scoped by the
+	* platform via the resource header). Deliberately NOT filtered to the
+	* provider policy: the allowlist gates what end users can newly connect,
+	* not what already exists — agents keep resolving tools from existing
+	* connections, and narrowing the allowlist must not hide (or orphan) a
+	* user's own rows, which they still need to see and disconnect.
+	*/
+	const listVisibleConnections = async (client) => listProjectConnections(client, projectId);
+	const providerParam = (c, policy) => {
 		const provider = String(c.req.param("provider") ?? "").trim().toLowerCase();
-		return allowlist.has(provider) ? provider : null;
+		if (!provider || RESERVED_PROVIDER_IDS.has(provider) || provider.includes("/")) return null;
+		if (policy.allowlist !== void 0 && !policy.allowlist.has(provider)) return null;
+		return provider;
 	};
 	const notFound = (c, code, message) => errorResponse(c, {
 		status: 404,
@@ -76746,18 +76924,19 @@ function userConnectRoutes(options) {
 			method: "GET",
 			requiresAuth: true,
 			handler: gated(async (c, client) => {
-				const catalog = await listIntegrations(client);
+				const [catalog, policy] = await Promise.all([listIntegrations(client), resolveProviderPolicy(client)]);
+				const toListed = (entry) => ({
+					id: entry.id,
+					displayName: entry.displayName ?? null,
+					logoUrl: entry.logoUrl ?? null,
+					authType: entry.authType ?? null,
+					authFields: entry.authFields ?? null
+				});
+				if (policy.providers === void 0) return c.json({ providers: catalog.map(toListed) });
 				const byId = new Map(catalog.map((entry) => [entry.id.toLowerCase(), entry]));
-				const visible = providers.flatMap((id) => {
+				const visible = policy.providers.flatMap((id) => {
 					const entry = byId.get(id);
-					if (!entry) return [];
-					return [{
-						id: entry.id,
-						displayName: entry.displayName ?? null,
-						logoUrl: entry.logoUrl ?? null,
-						authType: entry.authType ?? null,
-						authFields: entry.authFields ?? null
-					}];
+					return entry ? [toListed(entry)] : [];
 				});
 				return c.json({ providers: visible });
 			})
@@ -76767,14 +76946,20 @@ function userConnectRoutes(options) {
 			method: "GET",
 			requiresAuth: true,
 			handler: gated(async (c, client) => {
-				const connections = await listVisibleConnections(client);
-				return c.json({ connections: connections.map((connection) => ({
-					id: connection.id,
-					integrationId: connection.integrationId,
-					status: connection.status,
-					accountLabel: connection.accountLabel ?? null,
-					scope: connectionScope(connection)
-				})) });
+				const [connections, catalog] = await Promise.all([listVisibleConnections(client), listIntegrations(client).catch(() => [])]);
+				const catalogById = new Map(catalog.map((entry) => [entry.id.toLowerCase(), entry]));
+				return c.json({ connections: connections.map((connection) => {
+					const entry = catalogById.get(connection.integrationId.toLowerCase());
+					return {
+						id: connection.id,
+						integrationId: connection.integrationId,
+						displayName: entry?.displayName ?? null,
+						logoUrl: entry?.logoUrl ?? null,
+						status: connection.status,
+						accountLabel: connection.accountLabel ?? null,
+						scope: connectionScope(connection)
+					};
+				}) });
 			})
 		},
 		{
@@ -76809,19 +76994,46 @@ function userConnectRoutes(options) {
 				return c.body(null, 204);
 			})
 		},
+		{
+			path: `${basePath}/connections/:id/launch`,
+			method: "GET",
+			requiresAuth: true,
+			handler: gated(async (c, client) => {
+				const id = String(c.req.param("id") ?? "");
+				if (!id) return notFound(c, "connection_not_found", "Connection not found.");
+				const { connectUrl, expiresAt } = await getConnectUrl(client, id);
+				c.header("Cache-Control", "no-store");
+				if ((c.req.header("accept") ?? "").includes("application/json")) {
+					let sessionToken = null;
+					try {
+						sessionToken = new URL(connectUrl).searchParams.get("session_token");
+					} catch {
+						sessionToken = null;
+					}
+					return c.json({
+						sessionToken,
+						expiresAt
+					});
+				}
+				return c.redirect(connectUrl, 302);
+			})
+		},
 		{
 			path: `${basePath}/:provider/sessions`,
 			method: "POST",
 			requiresAuth: true,
 			handler: gated(async (c, client) => {
-				const provider = providerParam(c);
+				const policy = await resolveProviderPolicy(client);
+				const provider = providerParam(c, policy);
 				if (!provider) return notFound(c, "provider_not_found", "Provider not available.");
+				if (policy.allowlist === void 0) {
+					if (!(await listIntegrations(client)).some((entry) => entry.id.toLowerCase() === provider)) return notFound(c, "provider_not_found", "Provider not available.");
+				}
 				const session = await createProjectConnectSession(client, projectId, provider);
 				return c.json({
 					connectionId: session.connectionId,
 					integrationId: session.integrationId,
-					connectUrl: session.connectUrl,
-					sessionToken: session.sessionToken,
+					launchUrl: `${basePath}/connections/${encodeURIComponent(session.connectionId)}/launch`,
 					expiresAt: session.expiresAt
 				}, 201);
 			})
@@ -76831,7 +77043,8 @@ function userConnectRoutes(options) {
 			method: "GET",
 			requiresAuth: true,
 			handler: gated(async (c, client) => {
-				const provider = providerParam(c);
+				const policy = await resolveProviderPolicy(client);
+				const provider = providerParam(c, policy);
 				if (!provider) return notFound(c, "provider_not_found", "Provider not available.");
 				const returnTo = validateReturnTo(c.req.query("returnTo") ?? void 0, allowedOrigins);
 				if (!returnTo.ok) return errorResponse(c, {
@@ -76865,6 +77078,6 @@ function userConnectRoutes(options) {
 	];
 }
 //#endregion
-export { CHANNELS, MastraConnectError, PROVIDERS, channels, credential, tools, userConnectRoutes };
+export { CHANNELS, CONNECT_PROMPT_TOOL_KEY, MastraConnectError, PROVIDERS, channels, credential, tools, userConnectRoutes };
 
 //# sourceMappingURL=index.js.map