@zackbart/connecta 0.15.1 → 0.16.1

package/dist/providers/cloudflare.js

@@ -16,6 +16,7 @@
  * required-key list, and a declared output shape.
  */
 import { api } from "../connectors/api.js";
+import { guardedFetch, } from "../connectors/guarded-fetch.js";
 import { ConnectorCallError } from "../errors.js";
 /** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
 export const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
@@ -234,14 +235,28 @@ function failureFor(status, headers, errors) {
     if (status === 400 || status === 409 || status === 422) {
         return new ConnectorCallError("invalid_args", `Cloudflare rejected the request (HTTP ${status}). ${detail}`);
     }
+    // Cloudflare's 404 is an honest absence: a token that may not touch a
+    // resource is refused with 401 or 403 above, not hidden behind a miss, so
+    // this is the unambiguous case `not_found` exists for — re-address, do not
+    // retry and do not re-authorize.
     if (status === 404) {
-        return new ConnectorCallError("connector_call_failed", `Cloudflare found no such resource (HTTP 404). ${detail} Confirm the zone or account id with list_zones or list_accounts.`);
+        return new ConnectorCallError("not_found", `Cloudflare found no such resource (HTTP 404). ${detail} Confirm the zone or account id with list_zones or list_accounts.`);
     }
     if (status >= 500) {
         return new ConnectorCallError("unavailable", `Cloudflare is unavailable (HTTP ${status}). ${detail}`);
     }
     return new ConnectorCallError("connector_call_failed", `Cloudflare request failed (HTTP ${status}). ${detail}`);
 }
+// --- The request path --------------------------------------------------------
+/**
+ * The largest response this connection will read.
+ *
+ * Generous rather than tight, because `cloudflare_api_get` legitimately
+ * downloads Worker scripts and R2 objects. It is a ceiling on absurdity, not a
+ * quota: anything approaching it is already far past whatever `maxResultBytes`
+ * the deployment set, so the caller was never going to see it whole.
+ */
+const CLOUDFLARE_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 const AUTHENTICATION_CONTEXT = Symbol("cloudflareAuthentication");
 function withAuthentication(ctx, authentication) {
     return { ...ctx, [AUTHENTICATION_CONTEXT]: authentication };
@@ -262,72 +277,63 @@ async function readAuthenticationHeaders(ctx) {
     }
     return { Authorization: `Bearer ${token}` };
 }
-function buildUrl(base, spec) {
-    const url = new URL(`${base.replace(/\/+$/, "")}${spec.path}`);
-    for (const [key, value] of Object.entries(spec.query ?? {})) {
-        if (value === undefined)
-            continue;
-        url.searchParams.set(key, String(value));
-    }
-    return url.toString();
-}
-async function fetchCloudflare(base, spec, ctx) {
-    const authenticationHeaders = await readAuthenticationHeaders(ctx);
-    if (spec.body !== undefined && spec.rawBody !== undefined) {
-        throw new Error("A Cloudflare request cannot have both JSON and raw bodies.");
-    }
-    let response;
-    try {
-        response = await fetch(buildUrl(base, spec), {
-            method: spec.method,
-            headers: {
-                ...authenticationHeaders,
-                Accept: "application/json",
-                ...(spec.body !== undefined
-                    ? { "Content-Type": "application/json" }
-                    : {}),
-                ...Object.fromEntries(Object.entries(spec.headers ?? {}).filter((entry) => entry[1] !== undefined)),
-            },
-            ...(spec.body !== undefined
-                ? { body: JSON.stringify(spec.body) }
-                : spec.rawBody !== undefined
-                    ? { body: spec.rawBody }
-                    : {}),
-            ...(ctx.signal ? { signal: ctx.signal } : {}),
-        });
-    }
-    catch (cause) {
-        throw new ConnectorCallError("unavailable", `Could not reach the Cloudflare API: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-    }
-    return response;
+/**
+ * The one transport every Cloudflare tool goes through.
+ *
+ * URL confinement, `ctx.signal`, redirect refusal, bounded reads, and the
+ * "could not reach the provider" normalization all live in the shared helper.
+ * What stays here is what only Cloudflare knows: which headers prove identity,
+ * and what a status code means once it arrives.
+ */
+function cloudflareTransport(baseUrl) {
+    return guardedFetch({
+        provider: "Cloudflare",
+        baseUrl,
+        headers: { Accept: "application/json" },
+        maxResponseBytes: CLOUDFLARE_MAX_RESPONSE_BYTES,
+        authenticate: (ctx) => readAuthenticationHeaders(ctx),
+    });
 }
-async function callCloudflare(base, spec, ctx) {
-    const response = await fetchCloudflare(base, spec, ctx);
-    let envelope;
-    try {
-        envelope = (await response.json());
-    }
-    catch (cause) {
-        // A gateway error page, not JSON: the status is the only real signal left.
-        throw response.ok
-            ? new ConnectorCallError("unavailable", "Cloudflare returned a non-JSON body for a successful status.", { cause })
-            : failureFor(response.status, response.headers, []);
-    }
-    const errors = Array.isArray(envelope.errors) ? envelope.errors : [];
-    if (!response.ok || envelope.success === false) {
-        throw failureFor(response.status, response.headers, errors);
-    }
-    const isV4Envelope = "success" in envelope ||
-        "result" in envelope ||
-        "result_info" in envelope ||
-        "messages" in envelope;
-    return {
-        // `/graphql` and a small number of product APIs return ordinary JSON
-        // instead of the standard v4 envelope. Preserve that document whole so
-        // the raw tools cover them too.
-        result: isV4Envelope ? envelope.result : envelope,
-        resultInfo: isV4Envelope ? envelope.result_info : undefined,
-    };
+async function callCloudflare(send, spec, ctx) {
+    return await send(spec, ctx, async (response) => {
+        let envelope;
+        let parseFailure;
+        try {
+            envelope = (await response.json());
+        }
+        catch (cause) {
+            // A transport failure is not a parse failure. The connector's byte
+            // ceiling fires from inside this read and is deliberately non-retryable;
+            // routing it through the branch below would relabel it as a retryable
+            // `unavailable` and tell an agent to retry a response that will exceed
+            // the ceiling every time.
+            if (cause instanceof ConnectorCallError)
+                throw cause;
+            parseFailure = cause;
+        }
+        if (envelope === undefined) {
+            // A gateway error page or an empty body, not an envelope: the status is
+            // the only real signal left.
+            throw response.ok
+                ? new ConnectorCallError("unavailable", "Cloudflare returned a non-JSON body for a successful status.", parseFailure !== undefined ? { cause: parseFailure } : {})
+                : failureFor(response.status, response.headers, []);
+        }
+        const errors = Array.isArray(envelope.errors) ? envelope.errors : [];
+        if (!response.ok || envelope.success === false) {
+            throw failureFor(response.status, response.headers, errors);
+        }
+        const isV4Envelope = "success" in envelope ||
+            "result" in envelope ||
+            "result_info" in envelope ||
+            "messages" in envelope;
+        return {
+            // `/graphql` and a small number of product APIs return ordinary JSON
+            // instead of the standard v4 envelope. Preserve that document whole so
+            // the raw tools cover them too.
+            result: isV4Envelope ? envelope.result : envelope,
+            resultInfo: isV4Envelope ? envelope.result_info : undefined,
+        };
+    });
 }
 function base64FromBytes(bytes) {
     let binary = "";
@@ -336,33 +342,34 @@ function base64FromBytes(bytes) {
     }
     return btoa(binary);
 }
-async function callCloudflareContent(base, spec, ctx, responseType) {
-    const response = await fetchCloudflare(base, spec, ctx);
-    if (!response.ok) {
-        let errors = [];
-        try {
-            const envelope = (await response.clone().json());
-            if (Array.isArray(envelope.errors))
-                errors = envelope.errors;
+async function callCloudflareContent(send, spec, ctx, responseType) {
+    return await send(spec, ctx, async (response) => {
+        if (!response.ok) {
+            let errors = [];
+            try {
+                const envelope = (await response.json());
+                if (envelope && Array.isArray(envelope.errors))
+                    errors = envelope.errors;
+            }
+            catch {
+                // A raw or gateway error body has no structured detail to preserve,
+                // and one past the byte ceiling has none worth reporting over the
+                // status that already failed this call. Either way the throw below
+                // classifies the status, so nothing is swallowed into a success.
+            }
+            throw failureFor(response.status, response.headers, errors);
         }
-        catch {
-            // A raw or gateway error body has no structured detail to preserve.
+        const common = {
+            contentType: response.headers.get("content-type") ?? "application/octet-stream",
+            ...(response.headers.get("etag")
+                ? { etag: response.headers.get("etag") }
+                : {}),
+        };
+        if (responseType === "text") {
+            return { ...common, text: await response.text() };
         }
-        throw failureFor(response.status, response.headers, errors);
-    }
-    const common = {
-        contentType: response.headers.get("content-type") ?? "application/octet-stream",
-        ...(response.headers.get("etag")
-            ? { etag: response.headers.get("etag") }
-            : {}),
-    };
-    if (responseType === "text") {
-        return { ...common, text: await response.text() };
-    }
-    return {
-        ...common,
-        base64: base64FromBytes(new Uint8Array(await response.arrayBuffer())),
-    };
+        return { ...common, base64: base64FromBytes(await response.bytes()) };
+    });
 }
 /**
  * Cloudflare's `result_info` reshaped into the one question an agent actually
@@ -631,8 +638,8 @@ const RAW_INPUT_PROPERTY = {
  * an out-of-range value with a 400, so each caller passes its own. Encoding
  * them in the schema turns a wasted round trip into a local repair — but only
  * where the bound is really Cloudflare's. `bounds` records who chose the
- * range, because `strictValidation` refuses an out-of-range `perPage` locally
- * and an agent deserves to know whether the wall it hit is the API's or ours:
+ * range, because `api()` refuses an out-of-range `perPage` locally and an
+ * agent deserves to know whether the wall it hit is the API's or ours:
  *
  * - `"cloudflare"` — the schema's own documented minimum and maximum.
  * - `"clamped"` — Cloudflare accepts more; this connection caps it lower.
@@ -663,6 +670,24 @@ function pagingInputProperties(minPerPage, maxPerPage, options = {}) {
         },
     };
 }
+/**
+ * The second pagination convention, and the schemas say so.
+ *
+ * Rulesets, KV keys, and both R2 listings page by cursor rather than by page
+ * number, because that is how Cloudflare built them. The guide names the four,
+ * but an agent reading one tool's schema should not have to fetch the guide to
+ * learn that the `page` object it expected is not coming: absence of
+ * `nextCursor` is the loop condition here, and it is stated on both ends
+ * ([#342](https://github.com/zackbart/connecta/issues/342)).
+ */
+const CURSOR_INPUT_PROPERTY = {
+    type: "string",
+    description: "Opaque cursor from a previous call's nextCursor. This endpoint pages by cursor, not page number.",
+};
+const NEXT_CURSOR_OUTPUT_PROPERTY = {
+    type: "string",
+    description: "Pass back as `cursor` to continue. Absent when the listing is complete — this is the only signal; there is no page object.",
+};
 function listOutputSchema(key, item) {
     return {
         type: "object",
@@ -928,7 +953,7 @@ const OPEN_OBJECT_OUTPUT_SCHEMA = {
 };
 const QUERY_INPUT_PROPERTY = {
     type: "array",
-    description: "Optional query parameters as name/value pairs. Each parameter name may appear once.",
+    description: "Query parameters as name/value pairs; each name may appear once.",
     items: {
         type: "object",
         properties: {
@@ -939,9 +964,14 @@ const QUERY_INPUT_PROPERTY = {
         additionalProperties: false,
     },
 };
+// Shared by all three escape hatches, and the compact renderer inlines it
+// three times over. The refused-header list is the connector's boundary rather
+// than a fact the caller composes with, so it lives in the usage guide; keeping
+// it here pushed cloudflare_api_upload's compact input past the 1,024-byte
+// budget ([#342](https://github.com/zackbart/connecta/issues/342)).
 const HEADERS_INPUT_PROPERTY = {
     type: "array",
-    description: "Optional provider headers as name/value pairs, for example cf-r2-jurisdiction, Range, If-None-Match, or Cloudflare product metadata. Authorization, Cookie, Host, Content-Length, Content-Type, and Transfer-Encoding are connector-owned and refused.",
+    description: "Endpoint headers as name/value pairs, e.g. cf-r2-jurisdiction or Range. Connector-owned headers are refused.",
     items: {
         type: "object",
         properties: {
@@ -988,7 +1018,7 @@ const R2_OBJECT_SCHEMA = {
     required: ["key"],
 };
 function buildTools(scope, authentication) {
-    const { base } = scope;
+    const { send } = scope;
     const zoneArg = (args) => requireScope(args["zoneId"], scope.zoneId, "zoneId");
     const accountArg = (args) => requireScope(args["accountId"], scope.accountId, "accountId");
     const readOnly = { readOnlyHint: true, destructiveHint: false };
@@ -1018,7 +1048,7 @@ function buildTools(scope, authentication) {
                     required: ["status"],
                 },
                 handler: async (_args, ctx) => {
-                    const { result } = await callCloudflare(base, { method: "GET", path: "/user/tokens/verify" }, ctx);
+                    const { result } = await callCloudflare(send, { method: "GET", path: "/user/tokens/verify" }, ctx);
                     const token = asRecord(result);
                     return {
                         id: token["id"],
@@ -1055,14 +1085,14 @@ function buildTools(scope, authentication) {
                     required: ["email", "status"],
                 },
                 handler: async (_args, ctx) => {
-                    const { result } = await callCloudflare(base, { method: "GET", path: "/user" }, ctx);
+                    const { result } = await callCloudflare(send, { method: "GET", path: "/user" }, ctx);
                     const user = asRecord(result);
                     return { id: user["id"], email: user["email"], status: "active" };
                 },
             },
         {
             name: "cloudflare_api_get",
-            description: "Call any GET endpoint under Cloudflare's v4 API with this connector's credential. Use a named tool when one exists; use this read-only escape hatch for Images, Stream, Email Routing, D1, Queues, Access, Tunnels, Analytics, and newer product endpoints the curated surface does not yet name.",
+            description: "Call any GET endpoint under Cloudflare's v4 API with this connector's credential. Prefer a named tool when one exists; this read-only hatch covers the products the named surface does not reach, such as Images, Stream, D1, and Queues.",
             annotations: readOnly,
             inputSchema: {
                 type: "object",
@@ -1111,9 +1141,9 @@ function buildTools(scope, authentication) {
                     ...(headers !== undefined ? { headers } : {}),
                 };
                 if (responseType === "text" || responseType === "base64") {
-                    return await callCloudflareContent(base, spec, ctx, responseType);
+                    return await callCloudflareContent(send, spec, ctx, responseType);
                 }
-                const { result, resultInfo } = await callCloudflare(base, spec, ctx);
+                const { result, resultInfo } = await callCloudflare(send, spec, ctx);
                 return {
                     result,
                     ...(resultInfo !== undefined ? { resultInfo } : {}),
@@ -1122,7 +1152,7 @@ function buildTools(scope, authentication) {
         },
         {
             name: "cloudflare_api_mutate",
-            description: "Call any JSON POST, PUT, PATCH, or DELETE endpoint under Cloudflare's v4 API with this connector's credential. This is the approval-gated escape hatch for managing Cloudflare products without waiting for a named tool. It does not support multipart or binary uploads.",
+            description: "Call any JSON POST, PUT, PATCH, or DELETE endpoint under Cloudflare's v4 API with this connector's credential. The approval-gated write hatch for products the named surface does not reach. No multipart or binary uploads.",
             annotations: { readOnlyHint: false, destructiveHint: true },
             inputSchema: {
                 type: "object",
@@ -1164,7 +1194,7 @@ function buildTools(scope, authentication) {
                 const method = String(args["method"]);
                 const query = queryFromArgs(args["query"]);
                 const headers = headersFromArgs(args["headers"]);
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method,
                     path: cloudflareApiPath(args["path"]),
                     ...(query !== undefined ? { query } : {}),
@@ -1187,31 +1217,31 @@ function buildTools(scope, authentication) {
                     method: {
                         type: "string",
                         enum: ["POST", "PUT"],
-                        description: "HTTP upload method required by the Cloudflare endpoint.",
+                        description: "Upload method the Cloudflare endpoint requires.",
                     },
                     path: {
                         type: "string",
                         minLength: 1,
-                        description: "Relative path below /client/v4, beginning with '/'. Do not include a query string.",
+                        description: "Path below /client/v4, beginning with '/'. No query string.",
                     },
                     query: QUERY_INPUT_PROPERTY,
                     headers: HEADERS_INPUT_PROPERTY,
                     contentType: {
                         type: "string",
                         minLength: 1,
-                        description: "Content-Type for a raw text/base64 body. Omit for multipart because fetch supplies the boundary.",
+                        description: "Content-Type for a raw text or base64 body. Omit for multipart.",
                     },
                     textBody: {
                         type: "string",
-                        description: "Raw UTF-8 request body. Mutually exclusive with base64Body and multipart fields/files.",
+                        description: "Raw UTF-8 body. Exclusive with base64Body and fields/files.",
                     },
                     base64Body: {
                         type: "string",
-                        description: "Base64-encoded request bytes. Mutually exclusive with textBody and multipart fields/files.",
+                        description: "Base64-encoded body bytes. Exclusive with textBody and fields/files.",
                     },
                     fields: {
                         type: "array",
-                        description: "String fields for a multipart/form-data request.",
+                        description: "String fields of a multipart/form-data request.",
                         items: {
                             type: "object",
                             properties: {
@@ -1226,7 +1256,7 @@ function buildTools(scope, authentication) {
                     },
                     files: {
                         type: "array",
-                        description: "File parts for multipart/form-data. Each file needs exactly one of text or base64.",
+                        description: "Multipart file parts. Each needs exactly one of text or base64.",
                         items: {
                             type: "object",
                             properties: {
@@ -1257,7 +1287,7 @@ function buildTools(scope, authentication) {
                 const query = queryFromArgs(args["query"]);
                 const headers = headersFromArgs(args["headers"]);
                 const upload = uploadBody(args);
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: String(args["method"]),
                     path: cloudflareApiPath(args["path"]),
                     ...(query !== undefined ? { query } : {}),
@@ -1288,7 +1318,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("accounts", ACCOUNT_SCHEMA),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: "/accounts",
                     query: {
@@ -1333,7 +1363,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("zones", ZONE_SCHEMA),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: "/zones",
                     query: {
@@ -1371,31 +1401,15 @@ function buildTools(scope, authentication) {
             },
             outputSchema: ZONE_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, { method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }, ctx);
+                const { result } = await callCloudflare(send, { method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }, ctx);
                 return args["raw"] === true ? result : projectZone(result);
             },
         },
-        {
-            name: "list_zone_settings",
-            description: "List the effective settings for a zone, including each setting's current value and whether the plan allows editing it.",
-            annotations: readOnly,
-            inputSchema: {
-                type: "object",
-                properties: {
-                    zoneId: scopeProperty("zoneId", scope.zoneId),
-                },
-                required: scopeRequired("zoneId", scope.zoneId),
-                additionalProperties: false,
-            },
-            outputSchema: listOutputSchema("settings", OPEN_OBJECT_OUTPUT_SCHEMA),
-            handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
-                    method: "GET",
-                    path: `/zones/${encodePathSegment(zoneArg(args))}/settings`,
-                }, ctx);
-                return { settings: asArray(result), page: pageInfo(resultInfo) };
-            },
-        },
+        // There is deliberately no bulk zone-settings read here. Cloudflare
+        // publishes `GET /zones/{zone_id}/settings` as deprecated (#361), the
+        // per-setting operations below are not, and the tool that wrapped the bulk
+        // read projected nothing. See the Cloudflare guide's "What the named
+        // surface deliberately leaves out".
         {
             name: "get_zone_setting",
             description: "Get one zone setting by its Cloudflare setting id, such as ssl, always_use_https, min_tls_version, brotli, or development_mode.",
@@ -1407,7 +1421,7 @@ function buildTools(scope, authentication) {
                     settingId: {
                         type: "string",
                         minLength: 1,
-                        description: "Cloudflare zone setting id from list_zone_settings.",
+                        description: "Cloudflare zone setting id, such as ssl, brotli, http3, or min_tls_version.",
                     },
                 },
                 required: [...scopeRequired("zoneId", scope.zoneId), "settingId"],
@@ -1415,7 +1429,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/zones/${encodePathSegment(zoneArg(args))}/settings/${encodePathSegment(requireString(args, "settingId"))}`,
                 }, ctx);
@@ -1433,7 +1447,7 @@ function buildTools(scope, authentication) {
                     settingId: {
                         type: "string",
                         minLength: 1,
-                        description: "Cloudflare zone setting id from list_zone_settings.",
+                        description: "Cloudflare zone setting id, such as ssl, brotli, http3, or min_tls_version.",
                     },
                     value: {
                         type: ["string", "number", "boolean", "array"],
@@ -1446,7 +1460,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "PATCH",
                     path: `/zones/${encodePathSegment(zoneArg(args))}/settings/${encodePathSegment(requireString(args, "settingId"))}`,
                     body: { value: args["value"] },
@@ -1468,10 +1482,7 @@ function buildTools(scope, authentication) {
                         maximum: 50,
                         description: "Rulesets per request, 1 to 50.",
                     },
-                    cursor: {
-                        type: "string",
-                        description: "Opaque cursor returned as nextCursor by the previous call.",
-                    },
+                    cursor: CURSOR_INPUT_PROPERTY,
                 },
                 required: scopeRequired("zoneId", scope.zoneId),
                 additionalProperties: false,
@@ -1480,12 +1491,12 @@ function buildTools(scope, authentication) {
                 type: "object",
                 properties: {
                     rulesets: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
-                    nextCursor: { type: "string" },
+                    nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
                 },
                 required: ["rulesets"],
             },
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/zones/${encodePathSegment(zoneArg(args))}/rulesets`,
                     query: {
@@ -1521,7 +1532,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/zones/${encodePathSegment(zoneArg(args))}/rulesets/${encodePathSegment(requireString(args, "rulesetId"))}`,
                 }, ctx);
@@ -1573,7 +1584,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("records", DNS_RECORD_SCHEMA),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records`,
                     query: {
@@ -1613,7 +1624,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: DNS_RECORD_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(String(args["recordId"]))}`,
                 }, ctx);
@@ -1644,7 +1655,7 @@ function buildTools(scope, authentication) {
                 required: ["id"],
             }),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts`,
                 }, ctx);
@@ -1675,7 +1686,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/workers/scripts/${encodePathSegment(requireString(args, "scriptName"))}/settings`,
                 }, ctx);
@@ -1701,7 +1712,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA),
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/workers/scripts/${encodePathSegment(requireString(args, "scriptName"))}/deployments`,
                 }, ctx);
@@ -1740,7 +1751,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/workers/scripts/${encodePathSegment(requireString(args, "scriptName"))}/deployments/${encodePathSegment(requireString(args, "deploymentId"))}`,
                 }, ctx);
@@ -1778,7 +1789,7 @@ function buildTools(scope, authentication) {
             },
             handler: async (args, ctx) => {
                 const scriptName = requireString(args, "scriptName");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/workers/scripts/${encodePathSegment(scriptName)}`,
                     query: { force: optionalBoolean(args, "force") },
@@ -1810,7 +1821,7 @@ function buildTools(scope, authentication) {
                 required: ["id", "title"],
             }),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces`,
                     query: {
@@ -1845,7 +1856,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}`,
                 }, ctx);
@@ -1872,7 +1883,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces`,
                     body: { title: requireString(args, "title") },
@@ -1909,7 +1920,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "PUT",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}`,
                     body: { title: requireString(args, "title") },
@@ -1944,7 +1955,7 @@ function buildTools(scope, authentication) {
             },
             handler: async (args, ctx) => {
                 const namespaceId = requireString(args, "namespaceId");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(namespaceId)}`,
                 }, ctx);
@@ -1974,10 +1985,7 @@ function buildTools(scope, authentication) {
                         maximum: 1000,
                         description: "Keys per request, 10 to 1000. Defaults to 1000.",
                     },
-                    cursor: {
-                        type: "string",
-                        description: "Opaque cursor returned as nextCursor by the previous call.",
-                    },
+                    cursor: CURSOR_INPUT_PROPERTY,
                 },
                 required: [...scopeRequired("accountId", scope.accountId), "namespaceId"],
                 additionalProperties: false,
@@ -1986,12 +1994,12 @@ function buildTools(scope, authentication) {
                 type: "object",
                 properties: {
                     keys: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
-                    nextCursor: { type: "string" },
+                    nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
                 },
                 required: ["keys"],
             },
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}/keys`,
                     query: {
@@ -2048,7 +2056,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}/bulk/get`,
                     body: {
@@ -2083,12 +2091,34 @@ function buildTools(scope, authentication) {
                         items: {
                             type: "object",
                             properties: {
-                                key: { type: "string", minLength: 1, maxLength: 512 },
-                                value: { type: "string", maxLength: 26_214_400 },
-                                expiration: { type: "number" },
-                                expiration_ttl: { type: "number", minimum: 60 },
-                                metadata: { type: ["object", "array", "string", "number", "boolean", "null"] },
-                                base64: { type: "boolean" },
+                                key: {
+                                    type: "string",
+                                    minLength: 1,
+                                    maxLength: 512,
+                                    description: "Key name, up to Cloudflare's 512 bytes.",
+                                },
+                                value: {
+                                    type: "string",
+                                    maxLength: 26_214_400,
+                                    description: "Value, up to Cloudflare's 25 MiB.",
+                                },
+                                expiration: {
+                                    type: "number",
+                                    description: "Absolute expiry as a Unix timestamp in seconds.",
+                                },
+                                expiration_ttl: {
+                                    type: "number",
+                                    minimum: 60,
+                                    description: "Relative expiry in seconds; Cloudflare's floor is 60.",
+                                },
+                                metadata: {
+                                    type: ["object", "array", "string", "number", "boolean", "null"],
+                                    description: "JSON metadata returned beside the key by list_kv_keys.",
+                                },
+                                base64: {
+                                    type: "boolean",
+                                    description: "Treat value as base64 and store the decoded bytes.",
+                                },
                             },
                             required: ["key", "value"],
                             additionalProperties: false,
@@ -2104,7 +2134,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "PUT",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}/bulk`,
                     body: args["entries"],
@@ -2142,7 +2172,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/storage/kv/namespaces/${encodePathSegment(requireString(args, "namespaceId"))}/bulk/delete`,
                     body: args["keys"],
@@ -2168,10 +2198,7 @@ function buildTools(scope, authentication) {
                         maximum: 1000,
                         description: "Buckets per request, 1 to 1000. Defaults to 20.",
                     },
-                    cursor: {
-                        type: "string",
-                        description: "Opaque cursor from a previous call's nextCursor. R2 paginates by cursor, not page number.",
-                    },
+                    cursor: CURSOR_INPUT_PROPERTY,
                     jurisdiction: R2_JURISDICTION_PROPERTY,
                     raw: RAW_INPUT_PROPERTY,
                 },
@@ -2195,15 +2222,12 @@ function buildTools(scope, authentication) {
                             required: ["name"],
                         },
                     },
-                    nextCursor: {
-                        type: "string",
-                        description: "Pass back as `cursor` to continue. Absent when the listing is complete.",
-                    },
+                    nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
                 },
                 required: ["buckets"],
             },
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets`,
                     query: {
@@ -2243,7 +2267,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: R2_BUCKET_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}`,
                     headers: r2Headers(args),
@@ -2277,7 +2301,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: R2_BUCKET_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets`,
                     headers: r2Headers(args),
@@ -2319,7 +2343,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: R2_BUCKET_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "PATCH",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}`,
                     headers: {
@@ -2354,7 +2378,7 @@ function buildTools(scope, authentication) {
             },
             handler: async (args, ctx) => {
                 const bucketName = requireString(args, "bucketName");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(bucketName)}`,
                     headers: r2Headers(args),
@@ -2392,10 +2416,7 @@ function buildTools(scope, authentication) {
                         maximum: 1000,
                         description: "Objects per request, 1 to 1000.",
                     },
-                    cursor: {
-                        type: "string",
-                        description: "Opaque cursor returned as nextCursor by the previous call.",
-                    },
+                    cursor: CURSOR_INPUT_PROPERTY,
                 },
                 required: [...scopeRequired("accountId", scope.accountId), "bucketName"],
                 additionalProperties: false,
@@ -2405,13 +2426,13 @@ function buildTools(scope, authentication) {
                 properties: {
                     objects: { type: "array", items: R2_OBJECT_SCHEMA },
                     commonPrefixes: { type: "array", items: { type: "string" } },
-                    nextCursor: { type: "string" },
+                    nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
                     truncated: { type: "boolean" },
                 },
                 required: ["objects", "truncated"],
             },
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}/objects`,
                     headers: r2Headers(args),
@@ -2469,7 +2490,7 @@ function buildTools(scope, authentication) {
             },
             handler: async (args, ctx) => {
                 const objectKey = requireString(args, "objectKey");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}/objects/${encodeObjectKey(objectKey)}`,
                     headers: r2Headers(args),
@@ -2477,25 +2498,17 @@ function buildTools(scope, authentication) {
                 return { deleted: true, objectKey };
             },
         },
-        {
-            name: "get_r2_metrics",
-            description: "Get account-level R2 object-count and storage-size metrics split by storage class and publication state.",
-            annotations: readOnly,
-            inputSchema: {
-                type: "object",
-                properties: { accountId: scopeProperty("accountId", scope.accountId) },
-                required: scopeRequired("accountId", scope.accountId),
-                additionalProperties: false,
-            },
-            outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
-            handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
-                    method: "GET",
-                    path: `/accounts/${encodePathSegment(accountArg(args))}/r2/metrics`,
-                }, ctx);
-                return asRecord(result);
-            },
-        },
+        // No `get_r2_metrics`, `set_r2_cors`, or `delete_r2_cors` here on purpose.
+        // The #350 measurement found `get_r2_metrics` an unprojected,
+        // output-schema-less wrapper around a path, and `set_r2_cors` carrying a
+        // free-form `additionalProperties: true` rule body, so its schema did not
+        // validate the part of the call that actually fails. `delete_r2_cors`
+        // measured clean — a fixed `{deleted}` confirmation behind a closed output
+        // schema — and went anyway, as the other half of one policy pair: with the
+        // write unnamed, a named delete would change a CORS policy through a
+        // different route than setting it does. Reading a policy is still named;
+        // changing one takes the approval-gated raw route, exactly as
+        // structured-data DNS records already do.
         {
             name: "get_r2_cors",
             description: "Get the browser CORS rules configured on an R2 bucket.",
@@ -2512,7 +2525,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}/cors`,
                     headers: r2Headers(args),
@@ -2520,65 +2533,6 @@ function buildTools(scope, authentication) {
                 return asRecord(result);
             },
         },
-        {
-            name: "set_r2_cors",
-            description: "Replace an R2 bucket's CORS policy. Supply the complete desired rule list; omitted existing rules are removed.",
-            annotations: { readOnlyHint: false, destructiveHint: true },
-            inputSchema: {
-                type: "object",
-                properties: {
-                    accountId: scopeProperty("accountId", scope.accountId),
-                    bucketName: R2_BUCKET_NAME_PROPERTY,
-                    jurisdiction: R2_JURISDICTION_PROPERTY,
-                    rules: {
-                        type: "array",
-                        maxItems: 100,
-                        description: "Complete CORS rule list using Cloudflare fields: allowed.methods, allowed.origins, optional allowed.headers, id, exposeHeaders, and maxAgeSeconds.",
-                        items: { type: "object", additionalProperties: true },
-                    },
-                },
-                required: [...scopeRequired("accountId", scope.accountId), "bucketName", "rules"],
-                additionalProperties: false,
-            },
-            outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
-            handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
-                    method: "PUT",
-                    path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}/cors`,
-                    headers: r2Headers(args),
-                    body: { rules: args["rules"] },
-                }, ctx);
-                return asRecord(result);
-            },
-        },
-        {
-            name: "delete_r2_cors",
-            description: "Remove the complete CORS policy from an R2 bucket.",
-            annotations: { readOnlyHint: false, destructiveHint: true },
-            inputSchema: {
-                type: "object",
-                properties: {
-                    accountId: scopeProperty("accountId", scope.accountId),
-                    bucketName: R2_BUCKET_NAME_PROPERTY,
-                    jurisdiction: R2_JURISDICTION_PROPERTY,
-                },
-                required: [...scopeRequired("accountId", scope.accountId), "bucketName"],
-                additionalProperties: false,
-            },
-            outputSchema: {
-                type: "object",
-                properties: { deleted: { type: "boolean" } },
-                required: ["deleted"],
-            },
-            handler: async (args, ctx) => {
-                await callCloudflare(base, {
-                    method: "DELETE",
-                    path: `/accounts/${encodePathSegment(accountArg(args))}/r2/buckets/${encodePathSegment(requireString(args, "bucketName"))}/cors`,
-                    headers: r2Headers(args),
-                }, ctx);
-                return { deleted: true };
-            },
-        },
         {
             name: "list_pages_projects",
             description: "List Cloudflare Pages projects in an account, with their production branch and latest deployment.",
@@ -2614,7 +2568,7 @@ function buildTools(scope, authentication) {
                 required: ["name"],
             }),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects`,
                     query: {
@@ -2650,7 +2604,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}`,
                 }, ctx);
@@ -2682,7 +2636,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA),
             handler: async (args, ctx) => {
-                const { result, resultInfo } = await callCloudflare(base, {
+                const { result, resultInfo } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/deployments`,
                     query: {
@@ -2726,7 +2680,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/deployments/${encodePathSegment(requireString(args, "deploymentId"))}`,
                 }, ctx);
@@ -2749,7 +2703,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/deployments/${encodePathSegment(requireString(args, "deploymentId"))}/retry`,
                 }, ctx);
@@ -2772,7 +2726,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/deployments/${encodePathSegment(requireString(args, "deploymentId"))}/rollback`,
                 }, ctx);
@@ -2796,7 +2750,7 @@ function buildTools(scope, authentication) {
             outputSchema: { type: "object", properties: { deleted: { type: "boolean" }, deploymentId: { type: "string" } }, required: ["deleted", "deploymentId"] },
             handler: async (args, ctx) => {
                 const deploymentId = requireString(args, "deploymentId");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/deployments/${encodePathSegment(deploymentId)}`,
                 }, ctx);
@@ -2818,7 +2772,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: listOutputSchema("domains", OPEN_OBJECT_OUTPUT_SCHEMA),
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "GET",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/domains`,
                 }, ctx);
@@ -2841,7 +2795,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: OPEN_OBJECT_OUTPUT_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/domains`,
                     body: { name: requireString(args, "domain") },
@@ -2866,7 +2820,7 @@ function buildTools(scope, authentication) {
             outputSchema: { type: "object", properties: { deleted: { type: "boolean" }, domain: { type: "string" } }, required: ["deleted", "domain"] },
             handler: async (args, ctx) => {
                 const domain = requireString(args, "domain");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/domains/${encodePathSegment(domain)}`,
                 }, ctx);
@@ -2888,7 +2842,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: { type: "object", properties: { purged: { type: "boolean" } }, required: ["purged"] },
             handler: async (args, ctx) => {
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "POST",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(requireString(args, "projectName"))}/purge_build_cache`,
                 }, ctx);
@@ -2911,7 +2865,7 @@ function buildTools(scope, authentication) {
             outputSchema: { type: "object", properties: { deleted: { type: "boolean" }, projectName: { type: "string" } }, required: ["deleted", "projectName"] },
             handler: async (args, ctx) => {
                 const projectName = requireString(args, "projectName");
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/accounts/${encodePathSegment(accountArg(args))}/pages/projects/${encodePathSegment(projectName)}`,
                 }, ctx);
@@ -2923,7 +2877,7 @@ function buildTools(scope, authentication) {
             // `destructiveHint` stays unset. `readOnlyHint: false` already routes it
             // through call_destructive_tool.
             name: "create_dns_record",
-            description: "Create a content-based DNS record (A, AAAA, CNAME, MX, NS, OPENPGPKEY, PTR, TXT) in a zone. Check for an existing record with list_dns_records first: Cloudflare rejects a duplicate rather than replacing it. Record types that carry structured data, such as SRV and CAA, are readable here but not creatable.",
+            description: "Create a content-based DNS record in a zone; the type enum lists the creatable types. Check list_dns_records first — Cloudflare rejects a duplicate rather than replacing it. Structured types like SRV and CAA are readable but not creatable.",
             annotations: { readOnlyHint: false },
             inputSchema: {
                 type: "object",
@@ -2978,7 +2932,7 @@ function buildTools(scope, authentication) {
             },
             outputSchema: DNS_RECORD_SCHEMA,
             handler: async (args, ctx) => {
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "POST",
                     path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records`,
                     body: {
@@ -3079,7 +3033,7 @@ function buildTools(scope, authentication) {
                         },
                     });
                 }
-                const { result } = await callCloudflare(base, {
+                const { result } = await callCloudflare(send, {
                     method: "PATCH",
                     path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(String(args["recordId"]))}`,
                     body,
@@ -3113,7 +3067,7 @@ function buildTools(scope, authentication) {
             },
             handler: async (args, ctx) => {
                 const recordId = String(args["recordId"]);
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "DELETE",
                     path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(recordId)}`,
                 }, ctx);
@@ -3213,7 +3167,7 @@ function buildTools(scope, authentication) {
                     });
                 }
                 const variant = everything ? "everything" : targeted[0];
-                await callCloudflare(base, {
+                await callCloudflare(send, {
                     method: "POST",
                     path: `/zones/${encodeURIComponent(zoneId)}/purge_cache`,
                     body: everything
@@ -3246,10 +3200,11 @@ Account purpose: ${purpose}
 
 - ${zoneLine}
 - ${accountLine}
-- Prefer a named tool: its schema is complete, projected, and enough to call it without provider documentation. For an operation without a named tool, use \`cloudflare_api_get\` for GET, \`cloudflare_api_mutate\` for JSON POST/PUT/PATCH/DELETE, or \`cloudflare_api_upload\` for raw and multipart content. Raw tools take a path below \`/client/v4\`; their argument schemas are complete, but endpoint-specific query, header, and body fields come from Cloudflare's API reference. Use \`headers\` for endpoint-specific controls such as \`cf-r2-jurisdiction\`, ETags, and object metadata; authentication, host, content type, and request framing remain connector-owned.
+- Prefer a named tool: its schema is complete, projected, and enough to call it without provider documentation. For an operation without a named tool, use \`cloudflare_api_get\` for GET, \`cloudflare_api_mutate\` for JSON POST/PUT/PATCH/DELETE, or \`cloudflare_api_upload\` for raw and multipart content. Raw tools take a path below \`/client/v4\`; their argument schemas are complete, but endpoint-specific query, header, and body fields come from Cloudflare's API reference. Use \`headers\` for endpoint-specific controls such as \`cf-r2-jurisdiction\`, \`Range\`, \`If-None-Match\`, and Cloudflare product metadata. \`Authorization\`, \`Cookie\`, \`Host\`, \`Content-Length\`, \`Content-Type\`, and \`Transfer-Encoding\` are connector-owned and refused: authentication, host, content type, and request framing are not the caller's to set.
 - The raw tools cover the wider control plane without weakening routing: GET is explicitly read-only; every mutation and upload is destructive and must cross the host's approval boundary. The configured Cloudflare credential remains the hard provider-side permission boundary. Absolute URLs, traversal, and query strings embedded in \`path\` are refused locally.
 - Useful raw paths include \`/accounts/{accountId}/images/v1\` (Images), \`/accounts/{accountId}/stream\` (Stream), \`/zones/{zoneId}/email/routing/rules\` (Email Routing), \`/accounts/{accountId}/d1/database\` (D1), and \`/accounts/{accountId}/queues\` (Queues). On GET, use \`responseType: "text"\` or \`"base64"\` for non-JSON content. Direct-upload endpoints can issue upload URLs; \`cloudflare_api_upload\` can also send explicit text, base64 bytes, or multipart fields/files.
-- Lists paginate with \`page\` and \`perPage\` and return a \`page\` object; request the next page only when \`page.hasMore\` is true. \`list_zone_rulesets\`, \`list_r2_buckets\`, \`list_r2_objects\`, and \`list_kv_keys\` instead return \`nextCursor\`; \`list_worker_scripts\` is unpaginated.
+- Three areas are deliberately unnamed. Read a bucket's CORS policy with \`get_r2_cors\`, then change it with \`cloudflare_api_mutate\` — \`PUT\` or \`DELETE /accounts/{accountId}/r2/buckets/{bucketName}/cors\`, rule fields per Cloudflare's reference — and read account storage totals with \`cloudflare_api_get\` at \`/accounts/{accountId}/r2/metrics\`. Zone settings are read one at a time with \`get_zone_setting\`: Cloudflare deprecated the bulk \`/zones/{zoneId}/settings\` read and published no replacement for it, so reach for the whole set through \`cloudflare_api_get\` only when one setting genuinely will not do.
+- Lists paginate with \`page\` and \`perPage\` and return a \`page\` object; request the next page only when \`page.hasMore\` is true. \`list_zone_rulesets\`, \`list_r2_buckets\`, \`list_r2_objects\`, and \`list_kv_keys\` page by cursor instead: pass \`cursor\`, continue while \`nextCursor\` is present, and expect no \`page\` object. Their schemas say so too. \`list_worker_scripts\` is unpaginated.
 - Results are projected to the fields that identify and describe a resource. Pass \`raw: true\` on a read when you genuinely need a field the projection drops.
 - ${authenticationLine}
 - A \`rate_limited\` failure carries the wait window. Cloudflare's limit is 1,200 requests per five minutes per user, counted across the dashboard and every token, so do not fan out speculatively; filter server-side with \`name\`, \`type\`, and \`content\` instead of listing everything and filtering locally.
@@ -3273,7 +3228,7 @@ export function cloudflare(id, options) {
         throw new Error('cloudflare() authentication must be "apiToken" or "globalApiKey".');
     }
     const scope = {
-        base: options.baseUrl?.trim() || CLOUDFLARE_API_BASE,
+        send: cloudflareTransport(options.baseUrl?.trim() || CLOUDFLARE_API_BASE),
         accountId: options.accountId?.trim() || undefined,
         zoneId: options.zoneId?.trim() || undefined,
     };
@@ -3282,10 +3237,18 @@ export function cloudflare(id, options) {
         description: `Cloudflare control-plane access for zones, DNS, Workers, KV, R2, Pages, media, email, and other v4 APIs — ${purpose}`,
         credential: credentialConfig(authentication, options.credential),
         callAdmission: admissionPolicy(maxConcurrency),
-        usageGuide: usageGuide(purpose, scope, options.instructions, authentication),
-        // The schemas are hand-written and closed; a schema that cannot be
-        // enforced is a bug in this file, not input to pass through.
-        strictValidation: true,
+        usageGuide: {
+            content: usageGuide(purpose, scope, options.instructions, authentication),
+            // Explicit rather than derived: the first content line is the zone
+            // scoping rule, which varies per deployment and reads as an instruction
+            // rather than as the routing fact a browsing agent needs.
+            summary: "Zone and account scoping, named-vs-raw routing, two pagination shapes, and lean-vs-raw results.",
+            // Deliberately not `required`. Every named tool's schema is complete
+            // enough to call it correctly on its own, and the scoping convention the
+            // guide carries is repeated on each `zoneId` and `accountId` property —
+            // so forcing the guide into context before every operation would spend
+            // tokens on a sequence the schemas already express.
+        },
         ...(options.maxResultBytes !== undefined
             ? { maxResultBytes: options.maxResultBytes }
             : {}),
@@ -3294,7 +3257,7 @@ export function cloudflare(id, options) {
             ? {
                 async testCredential(value, ctx) {
                     try {
-                        const { result } = await callCloudflare(scope.base, { method: "GET", path: "/user/tokens/verify" }, withAuthentication({
+                        const { result } = await callCloudflare(scope.send, { method: "GET", path: "/user/tokens/verify" }, withAuthentication({
                             ...ctx,
                             credential: {
                                 get: async () => value,
@@ -3317,7 +3280,7 @@ export function cloudflare(id, options) {
             : {
                 async testCredentials(values, ctx) {
                     try {
-                        const { result } = await callCloudflare(scope.base, { method: "GET", path: "/user" }, withAuthentication({
+                        const { result } = await callCloudflare(scope.send, { method: "GET", path: "/user" }, withAuthentication({
                             ...ctx,
                             credential: {
                                 get: async (field) => field ? values[field] ?? null : null,
@@ -3340,4 +3303,3 @@ export function cloudflare(id, options) {
             }),
     });
 }
-//# sourceMappingURL=cloudflare.js.map