@zackbart/connecta 0.21.0 → 0.21.1

package/CHANGELOG.md

@@ -2,6 +2,50 @@
 
 All notable changes to this package are documented here.
 
+## 0.21.1 — 2026-08-30
+
+This patch aligns the handwritten Cloudflare and Notion contracts and the four
+hosted-provider manifests with their current catalogs. Existing deployments
+need no configuration or storage migration. Cloudflare programs that depend on
+provider fields outside the maintained `get_zone_setting` or
+`get_worker_settings` projections should pass `raw: true`. Stripe's server has
+retired three dedicated tool names, so programs that hardcoded them must search
+the current catalog and use the generic API tools or `stripe_analytics`.
+
+### Added
+
+- **Current Cloudflare jurisdictions.** All eight R2 bucket tools accept the
+  `us` jurisdiction alongside `default`, `eu`, and `fedramp`. KV namespace
+  creation accepts its separate `eu`, `fedramp`, and `us` set and preserves
+  jurisdiction on namespace reads (#498, #499).
+- **Current hosted-provider classifications.** Linear's workspace, template,
+  and issue-sharing tools join its plan-aware reviewed superset. RevenueCat's
+  refund-request preferences are read-only, and Mixpanel's metadata fill is a
+  destructive Lexicon update (#512).
+
+### Changed
+
+- **Useful Cloudflare result schemas.** All 48 named tools now declare their
+  maintained output keys. Zone settings and Worker settings project stable
+  camel-case fields by default and expose the provider response through
+  `raw: true`; rulesets, deployments, KV bulk operations, R2 CORS, and Pages
+  reuse named schemas instead of an empty object contract (#488).
+- **Stripe's current eleven tools.** Account listing, account-management links,
+  and analytics replace the retired account-info, refund, and report tools.
+  The integration planner and analytics are additive writes because their tool
+  boundaries can create provider-side guide or query-run state (#512).
+
+### Fixed
+
+- Worker settings retain VPC binding identity and observability fields,
+  rulesets retain origin-range metadata, and zone setting ids include
+  Cloudflare's current WebMCP settings (#500, #501, #502, #503).
+- Notion preserves every documented `verification.does_not_equal` value, and
+  Cloudflare's recorded KV bulk and zone-setting specifications match the
+  current published documents (#504, #509).
+- Mixpanel records the current schemas for all 64 classified tools, including
+  the three experiment contracts that changed since the prior review (#512).
+
 ## 0.21.0 — 2026-08-28
 
 Cloudflare Access becomes the canonical interactive-auth path for Worker

package/dist/providers/cloudflare.js

@@ -375,6 +375,15 @@ function projectZone(value) {
         modifiedOn: zone["modified_on"],
     });
 }
+function projectZoneSetting(value) {
+    const setting = asRecord(value);
+    return compact({
+        id: setting["id"],
+        value: setting["value"],
+        editable: setting["editable"],
+        modifiedOn: setting["modified_on"],
+    });
+}
 function projectDnsRecord(value) {
     const record = asRecord(value);
     const comment = record["comment"] ? record["comment"] : undefined;
@@ -404,12 +413,38 @@ function projectWorkerScript(value) {
         usageModel: script["usage_model"],
     });
 }
+function projectWorkerSettings(value) {
+    const settings = asRecord(value);
+    return compact({
+        compatibilityDate: settings["compatibility_date"],
+        compatibilityFlags: settings["compatibility_flags"],
+        bindings: settings["bindings"],
+        limits: settings["limits"],
+        observability: settings["observability"],
+        placement: settings["placement"],
+        usageModel: settings["usage_model"],
+        tailConsumers: settings["tail_consumers"],
+        logpush: settings["logpush"],
+    });
+}
 function projectKvNamespace(value) {
     const namespace = asRecord(value);
     return compact({
         id: namespace["id"],
         title: namespace["title"],
         supportsUrlEncoding: namespace["supports_url_encoding"],
+        jurisdiction: namespace["jurisdiction"],
+    });
+}
+function projectKvBulkValues(value) {
+    const result = asRecord(value);
+    return compact({ values: result["values"] });
+}
+function projectKvBulkResult(value) {
+    const result = asRecord(value);
+    return compact({
+        successfulKeyCount: result["successful_key_count"],
+        unsuccessfulKeys: result["unsuccessful_keys"],
     });
 }
 function projectR2Bucket(value) {
@@ -434,6 +469,10 @@ function projectR2Object(value) {
         customMetadata: object["custom_metadata"],
     });
 }
+function projectR2Cors(value) {
+    const cors = asRecord(value);
+    return compact({ rules: cors["rules"] });
+}
 function projectKvKey(value) {
     const key = asRecord(value);
     return compact({
@@ -825,10 +864,137 @@ function uploadBody(args) {
         },
     };
 }
-const OPEN_OBJECT_OUTPUT_SCHEMA = {
+const ZONE_SETTING_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        value: {
+            type: ["string", "number", "boolean", "array", "object", "null"],
+            items: {},
+            additionalProperties: true,
+        },
+        editable: { type: "boolean" },
+        modifiedOn: { type: "string" },
+    },
+    required: ["id", "value"],
+};
+const RULESET_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        name: { type: "string" },
+        kind: { type: "string" },
+        phase: { type: "string" },
+        description: { type: "string" },
+        version: { type: "string" },
+        lastUpdated: { type: "string" },
+        rules: {
+            type: "array",
+            items: { type: "object", additionalProperties: true },
+        },
+    },
+    required: ["id", "name"],
+};
+const WORKER_SETTINGS_SCHEMA = {
+    type: "object",
+    properties: {
+        compatibilityDate: { type: "string" },
+        compatibilityFlags: { type: "array", items: { type: "string" } },
+        bindings: { type: "array", items: { type: "object", additionalProperties: true } },
+        limits: { type: "object", additionalProperties: true },
+        observability: { type: "object", additionalProperties: true },
+        placement: { type: "object", additionalProperties: true },
+        usageModel: { type: "string" },
+        tailConsumers: { type: "array", items: { type: "object", additionalProperties: true } },
+        logpush: { type: "boolean" },
+    },
+};
+const WORKER_DEPLOYMENT_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        createdOn: { type: "string" },
+        source: { type: "string" },
+        strategy: { type: "string" },
+        versions: { type: "array", items: { type: "object", additionalProperties: true } },
+    },
+    required: ["id"],
+};
+const KV_NAMESPACE_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        title: { type: "string" },
+        supportsUrlEncoding: { type: "boolean" },
+        jurisdiction: { type: "string", enum: ["eu", "fedramp", "us"] },
+        renamed: { type: "boolean" },
+        namespaceId: { type: "string" },
+    },
+};
+const KV_BULK_VALUES_SCHEMA = {
+    type: "object",
+    properties: {
+        values: {
+            type: "object",
+            additionalProperties: true,
+        },
+    },
+    required: ["values"],
+};
+const KV_BULK_RESULT_SCHEMA = {
+    type: "object",
+    properties: {
+        successfulKeyCount: { type: "number" },
+        unsuccessfulKeys: { type: "array", items: { type: "string" } },
+    },
+};
+const R2_CORS_SCHEMA = {
+    type: "object",
+    properties: {
+        rules: {
+            type: "array",
+            items: { type: "object", additionalProperties: true },
+        },
+    },
+    required: ["rules"],
+};
+const PAGES_DEPLOYMENT_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        projectName: { type: "string" },
+        environment: { type: "string" },
+        url: { type: "string" },
+        aliases: { type: "array", items: { type: "string" } },
+        stage: { type: "object", additionalProperties: true },
+        latestStage: { type: "object", additionalProperties: true },
+        createdOn: { type: "string" },
+        modifiedOn: { type: "string" },
+    },
+    required: ["id"],
+};
+const PAGES_DOMAIN_SCHEMA = {
+    type: "object",
+    properties: {
+        id: { type: "string" },
+        name: { type: "string" },
+        status: { type: "string" },
+        verificationData: { type: "object", additionalProperties: true },
+        createdOn: { type: "string" },
+    },
+    required: ["name"],
+};
+const PAGES_PROJECT_SCHEMA = {
     type: "object",
-    description: "Cloudflare's result object. Its fields depend on the endpoint.",
-    additionalProperties: true,
+    properties: {
+        name: { type: "string" },
+        subdomain: { type: "string" },
+        domains: { type: "array", items: { type: "string" } },
+        productionBranch: { type: "string" },
+        createdOn: { type: "string" },
+        latestDeployment: PAGES_DEPLOYMENT_SCHEMA,
+    },
+    required: ["name"],
 };
 const QUERY_INPUT_PROPERTY = {
     type: "array",
@@ -859,8 +1025,13 @@ const HEADERS_INPUT_PROPERTY = {
 };
 const R2_JURISDICTION_PROPERTY = {
     type: "string",
-    enum: ["default", "eu", "fedramp"],
-    description: "Bucket jurisdiction. Omit for ordinary buckets; set eu or fedramp for jurisdictional buckets.",
+    enum: ["default", "eu", "us", "fedramp"],
+    description: "Bucket jurisdiction. Omit for ordinary buckets; set eu, us, or fedramp for jurisdictional buckets.",
+};
+const KV_JURISDICTION_PROPERTY = {
+    type: "string",
+    enum: ["eu", "fedramp", "us"],
+    description: "Creation-only namespace jurisdiction. Omit for an ordinary namespace; it cannot be changed by rename_kv_namespace.",
 };
 const R2_BUCKET_NAME_PROPERTY = {
     type: "string",
@@ -921,7 +1092,7 @@ const DELETE_PROJECT_NAME_PROPERTY = {
 const SETTING_ID_PROPERTY = {
     type: "string",
     minLength: 1,
-    description: "Cloudflare zone setting id, such as ssl, brotli, http3, or min_tls_version.",
+    description: "Cloudflare zone setting id, such as ssl, brotli, webmcp_enabled, or webmcp_packs.",
 };
 const RECORD_ID_PROPERTY = {
     type: "string",
@@ -933,7 +1104,7 @@ const R2_BUCKET_SCHEMA = {
         name: { type: "string" },
         location: { type: "string" },
         storageClass: { type: "string" },
-        jurisdiction: { type: "string" },
+        jurisdiction: { type: "string", enum: ["default", "eu", "us", "fedramp"] },
         creationDate: { type: "string" },
     },
     required: ["name"],
@@ -1251,11 +1422,12 @@ function buildTools(scope, authentication) {
         }, [], ZONE_SCHEMA, getResult(send, (args) => ({ method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }), (result, args) => args["raw"] === true ? result : projectZone(result))),
         // Removed tools: documentation/cloudflare.md#what-the-named-surface-deliberately-leaves-out.
         cfTool("get_zone_setting", "Get one zone setting by its Cloudflare setting id, such as ssl, always_use_https, min_tls_version, brotli, or development_mode.", readOnly, "zoneId", scope.zoneId, {
-            settingId: SETTING_ID_PROPERTY
-        }, ["settingId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+            settingId: SETTING_ID_PROPERTY,
+            raw: RAW_INPUT_PROPERTY
+        }, ["settingId"], ZONE_SETTING_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
-        }))),
+        }), (result, args) => args["raw"] === true ? result : projectZoneSetting(result))),
         cfTool("update_zone_setting", "Set one editable zone setting. Read it first: allowed value types and plan restrictions differ by setting.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
             settingId: SETTING_ID_PROPERTY,
             value: {
@@ -1263,13 +1435,13 @@ function buildTools(scope, authentication) {
                 description: "New setting value in the type returned by get_zone_setting. Arrays must contain strings.",
                 items: { type: "string" },
             }
-        }, ["settingId", "value"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["settingId", "value"], ZONE_SETTING_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PATCH",
                 path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
                 body: { value: args["value"] },
             }, ctx);
-            return result;
+            return projectZoneSetting(result);
         }),
         cfTool("list_zone_rulesets", "List zone rulesets for WAF, redirects, transforms, cache rules, configuration rules, and other Ruleset Engine phases.", readOnly, "zoneId", scope.zoneId, {
             perPage: {
@@ -1282,7 +1454,7 @@ function buildTools(scope, authentication) {
         }, [], {
             type: "object",
             properties: {
-                rulesets: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
+                rulesets: { type: "array", items: RULESET_SCHEMA },
                 nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
             },
             required: ["rulesets"],
@@ -1307,7 +1479,7 @@ function buildTools(scope, authentication) {
                 minLength: 1,
                 description: "Ruleset id from list_zone_rulesets.",
             }
-        }, ["rulesetId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["rulesetId"], RULESET_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/rulesets/${encodeURIComponent(requireString(args, "rulesetId"))}`,
         }), projectRuleset)),
@@ -1385,14 +1557,15 @@ function buildTools(scope, authentication) {
             return pagedList("scripts", projectWorkerScript)(result, resultInfo, args["raw"] === true);
         }),
         cfTool("get_worker_settings", "Get a Worker's compatibility date and flags, bindings, limits, observability, placement, usage model, and other script settings.", readOnly, "accountId", scope.accountId, {
-            scriptName: SCRIPT_NAME_PROPERTY
-        }, ["scriptName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+            scriptName: SCRIPT_NAME_PROPERTY,
+            raw: RAW_INPUT_PROPERTY
+        }, ["scriptName"], WORKER_SETTINGS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/settings`,
-        }))),
+        }), (result, args) => args["raw"] === true ? result : projectWorkerSettings(result))),
         cfTool("list_worker_deployments", "List deployments of a Worker script, including version traffic allocations and deployment strategy.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY
-        }, ["scriptName"], listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["scriptName"], listOutputSchema("deployments", WORKER_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments`,
@@ -1406,7 +1579,7 @@ function buildTools(scope, authentication) {
         cfTool("get_worker_deployment", "Get one Worker deployment and its version traffic allocations.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY,
             deploymentId: WORKER_DEPLOYMENT_ID_PROPERTY
-        }, ["scriptName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["scriptName", "deploymentId"], WORKER_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
         }), projectWorkerDeployment)),
@@ -1437,6 +1610,7 @@ function buildTools(scope, authentication) {
                 id: { type: "string" },
                 title: { type: "string" },
                 supportsUrlEncoding: { type: "boolean" },
+                jurisdiction: { type: "string", enum: ["eu", "fedramp", "us"] },
             },
             required: ["id", "title"],
         }), async (args, ctx) => {
@@ -1452,7 +1626,7 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_kv_namespace", "Get one Workers KV namespace by id.", readOnly, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY
-        }, ["namespaceId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["namespaceId"], KV_NAMESPACE_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
         }), projectKvNamespace)),
@@ -1462,12 +1636,16 @@ function buildTools(scope, authentication) {
                 minLength: 1,
                 maxLength: 512,
                 description: "Human-readable namespace title.",
-            }
-        }, ["title"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+            },
+            jurisdiction: KV_JURISDICTION_PROPERTY
+        }, ["title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces`,
-                body: { title: requireString(args, "title") },
+                body: compact({
+                    title: requireString(args, "title"),
+                    jurisdiction: args["jurisdiction"],
+                }),
             }, ctx);
             return projectKvNamespace(result);
         }),
@@ -1479,13 +1657,15 @@ function buildTools(scope, authentication) {
                 maxLength: 512,
                 description: "Replacement namespace title.",
             }
-        }, ["namespaceId", "title"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PUT",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
                 body: { title: requireString(args, "title") },
             }, ctx);
-            return result ?? { renamed: true, namespaceId: args["namespaceId"] };
+            return result
+                ? projectKvNamespace(result)
+                : { renamed: true, namespaceId: args["namespaceId"] };
         }),
         cfTool("delete_kv_namespace", "Permanently delete a Workers KV namespace and every key stored in it.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY
@@ -1516,7 +1696,18 @@ function buildTools(scope, authentication) {
         }, ["namespaceId"], {
             type: "object",
             properties: {
-                keys: { type: "array", items: OPEN_OBJECT_OUTPUT_SCHEMA },
+                keys: {
+                    type: "array",
+                    items: {
+                        type: "object",
+                        properties: {
+                            name: { type: "string" },
+                            expiration: { type: "number" },
+                            metadata: {},
+                        },
+                        required: ["name"],
+                    },
+                },
                 nextCursor: NEXT_CURSOR_OUTPUT_PROPERTY,
             },
             required: ["keys"],
@@ -1554,7 +1745,7 @@ function buildTools(scope, authentication) {
                 enum: ["text", "json"],
                 description: "Return strings as stored, or parse JSON values before returning them.",
             }
-        }, ["namespaceId", "keys"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "keys"], KV_BULK_VALUES_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk/get`,
@@ -1564,7 +1755,7 @@ function buildTools(scope, authentication) {
                     type: args["type"],
                 }),
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkValues(result);
         }),
         cfTool("bulk_write_kv_values", "Create or replace multiple Workers KV values, with optional expirations and JSON metadata.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY,
@@ -1609,13 +1800,13 @@ function buildTools(scope, authentication) {
                     additionalProperties: false,
                 },
             }
-        }, ["namespaceId", "entries"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "entries"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "PUT",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk`,
                 body: args["entries"],
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkResult(result);
         }),
         cfTool("bulk_delete_kv_values", "Permanently delete multiple keys from a Workers KV namespace.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY,
@@ -1626,13 +1817,13 @@ function buildTools(scope, authentication) {
                 items: { type: "string", minLength: 1, maxLength: 512 },
                 description: "Key names to delete, up to Cloudflare's 10,000-key bulk limit.",
             }
-        }, ["namespaceId", "keys"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["namespaceId", "keys"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk/delete`,
                 body: args["keys"],
             }, ctx);
-            return asRecord(result);
+            return projectKvBulkResult(result);
         }),
         cfTool("list_r2_buckets", "List R2 buckets in an account, with location and storage class.", readOnly, "accountId", scope.accountId, {
             nameContains: {
@@ -1829,34 +2020,15 @@ function buildTools(scope, authentication) {
         cfTool("get_r2_cors", "Get the browser CORS rules configured on an R2 bucket.", readOnly, "accountId", scope.accountId, {
             bucketName: R2_BUCKET_NAME_PROPERTY,
             jurisdiction: R2_JURISDICTION_PROPERTY
-        }, ["bucketName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["bucketName"], R2_CORS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}/cors`,
             headers: r2Headers(args),
-        }), asRecord)),
+        }), projectR2Cors)),
         cfTool("list_pages_projects", "List Cloudflare Pages projects in an account, with their production branch and latest deployment.", readOnly, "accountId", scope.accountId, {
             ...pagingInputProperties(1, 100, { bounds: "undocumented" }),
             raw: RAW_INPUT_PROPERTY
-        }, [], listOutputSchema("projects", {
-            type: "object",
-            properties: {
-                name: { type: "string" },
-                subdomain: { type: "string" },
-                domains: { type: "array", items: { type: "string" } },
-                productionBranch: { type: "string" },
-                createdOn: { type: "string" },
-                latestDeployment: {
-                    type: "object",
-                    properties: {
-                        id: { type: "string" },
-                        environment: { type: "string" },
-                        url: { type: "string" },
-                        createdOn: { type: "string" },
-                    },
-                },
-            },
-            required: ["name"],
-        }), async (args, ctx) => {
+        }, [], listOutputSchema("projects", PAGES_PROJECT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects`,
@@ -1870,7 +2042,7 @@ function buildTools(scope, authentication) {
         cfTool("get_pages_project", "Get one Pages project, including build configuration, deployment configuration, domains, and latest deployment.", readOnly, "accountId", scope.accountId, {
             projectName: PROJECT_NAME_PROPERTY,
             raw: RAW_INPUT_PROPERTY
-        }, ["projectName"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["projectName"], PAGES_PROJECT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}`,
         }), (result, args) => args["raw"] === true ? result : projectPagesProject(result))),
@@ -1882,7 +2054,7 @@ function buildTools(scope, authentication) {
                 description: "Optional deployment environment filter.",
             },
             ...pagingInputProperties(1, 100, { bounds: "undocumented" })
-        }, ["projectName"], listOutputSchema("deployments", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["projectName"], listOutputSchema("deployments", PAGES_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments`,
@@ -1901,14 +2073,14 @@ function buildTools(scope, authentication) {
             projectName: PROJECT_NAME_PROPERTY,
             deploymentId: DEPLOYMENT_ID_PROPERTY,
             raw: RAW_INPUT_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, getResult(send, (args) => ({
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
         }), (result, args) => args["raw"] === true ? result : projectPagesDeployment(result))),
         cfTool("retry_pages_deployment", "Retry a failed or cancelled Pages deployment using its existing source and build configuration.", { readOnlyHint: false }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             deploymentId: RETRY_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/retry`,
@@ -1918,7 +2090,7 @@ function buildTools(scope, authentication) {
         cfTool("rollback_pages_deployment", "Promote a previous Pages deployment to production, replacing the currently served production deployment.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             deploymentId: ROLLBACK_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/rollback`,
@@ -1934,7 +2106,7 @@ function buildTools(scope, authentication) {
         }))),
         cfTool("list_pages_domains", "List custom domains attached to a Pages project and their validation status.", readOnly, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY
-        }, ["projectName"], listOutputSchema("domains", OPEN_OBJECT_OUTPUT_SCHEMA), async (args, ctx) => {
+        }, ["projectName"], listOutputSchema("domains", PAGES_DOMAIN_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains`,
@@ -1944,7 +2116,7 @@ function buildTools(scope, authentication) {
         cfTool("add_pages_domain", "Attach a custom domain to a Pages project. DNS ownership and validation still apply.", { readOnlyHint: false }, "accountId", scope.accountId, {
             projectName: PAGES_PROJECT_NAME_PROPERTY,
             domain: { type: "string", minLength: 1, description: "Fully qualified custom domain to attach." }
-        }, ["projectName", "domain"], OPEN_OBJECT_OUTPUT_SCHEMA, async (args, ctx) => {
+        }, ["projectName", "domain"], PAGES_DOMAIN_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains`,

package/dist/providers/linear.js

@@ -42,6 +42,10 @@ const READ_ONLY_TOOLS = new Set([
     "get_team",
     "list_users",
     "get_user",
+    "get_workspace",
+    // Templates
+    "list_templates",
+    "get_template",
     // Status updates
     "get_status_updates",
     // Releases
@@ -103,6 +107,9 @@ const WRITE_TOOLS = new Map([
     ["create_attachment_from_upload", "additive"],
     ["create_attachment", "additive"],
     ["delete_attachment", "destructive"],
+    // Explicit issue access
+    ["share_issue", "destructive"],
+    ["unshare_issue", "destructive"],
     // Customer requests (plan-gated)
     ["save_customer", "destructive"],
     ["delete_customer", "destructive"],

package/dist/providers/mixpanel.js

@@ -74,15 +74,16 @@ const WRITE_TOOLS = new Map([
     ["Update-Experiment", "destructive"],
     ["Create-Feature-Flag", "additive"],
     ["Update-Feature-Flag", "destructive"],
+    ["Fill-Event-Metadata", "destructive"],
 ]);
-/** Live US hosted-MCP schemas reviewed read-only on 2026-08-13 (#395). */
+/** Live US hosted-MCP schemas reviewed read-only on 2026-08-30 (#395, #512). */
 const MIXPANEL_SCHEMA_DIGESTS = {
     "Bulk-Edit-Events": "sha256:94512138df153de95436371f5a313e32b97faffebda3be6c0c69d09d1ff2b340",
     "Bulk-Edit-Properties": "sha256:93481eb896ded45b623c678612e2156439efbaad5b4d660da1f2b087e7409ee3",
     "Create-Cohort": "sha256:ea687f4bc607f8bfb5b1949e060239d6f7d629d3ec80fb0b72eae6cc6156ed03",
     "Create-Custom-Property": "sha256:d22818b812f3fd0e785a5bbbee26cf099eaa911d5b6f383f94cf458a2ed26294",
     "Create-Dashboard": "sha256:bd3b6e5134d27dafb04ccdf04d19e54dd23e6e2dc16989e418006e484268037b",
-    "Create-Experiment": "sha256:3307bd7202f5483adbc28a9ef1d562095d6942eb2c3a15308f458072c93e6888",
+    "Create-Experiment": "sha256:1cfc2edeb2ac2d329a531d2095671a0653ab5b94b9e233b34268ff29a48c5ac5",
     "Create-Feature-Flag": "sha256:3460d11d726727349cac62db5c19915ab589b7f1d8387042f0a3783356b252c4",
     "Create-Lookup-Table": "sha256:c2fefa33a4f19fc65f394fecdc7126cab0ae874f7c97018cf003d8462a049e4c",
     "Create-Metric": "sha256:315766d0c197d87bb44aedd16732f6e69fbfc93661d1fcfc177cadc1751f26ce",
@@ -98,13 +99,14 @@ const MIXPANEL_SCHEMA_DIGESTS = {
     "Edit-Event": "sha256:28c47da0b56f57da0f11eb11435441a39ecd5175600f854442744c66a379ef93",
     "Edit-Property": "sha256:11975587d2a566edc468db7cb24df70167d12068f30c1fe52c84f543cf4e2399",
     "Explain-Experiment-Health-Check": "sha256:a50b1263247012dc78521bf6c1dd18584a7b08d46221a444b1ca49c81d3286e5",
+    "Fill-Event-Metadata": "sha256:53accc988f216bdd5d7a259d731f6df82549e4e6146b191f1815a0d1a72a1abe",
     "Find-Duplicate-Groups": "sha256:8f944cef9a147eab3c51bfcf1b873cef1409e5a6c21565d34e7ed20d23dcebb7",
     "Get-Business-Context": "sha256:309f5ba864c90132061096b4f0ebc1e78544a6486bac3a45bd661d16bcab2b6c",
     "Get-Cohort": "sha256:e18c500459edd9c2b6a614a3f6c97b668786be9abf72929a0a50086bdadb1dae",
     "Get-Custom-Property": "sha256:d1cbce906cee66d422846c8ef1a745bbeac2c058ecad6b1ee8dcdd2120fa86be",
     "Get-Dashboard": "sha256:56659fa3277723b75e24f3b4ca142ac9cd62120fb97e6c9252c221d00cdf8509",
     "Get-Events": "sha256:d206fe30ab47d64bf6090bffdb4d119a80cfc2a35963bbe7fd52d56060090ded",
-    "Get-Experiment": "sha256:f9f04a2bb136809c754ea612963e1cdfb57c2c9ecc34a53ac6e1730f8758798f",
+    "Get-Experiment": "sha256:ab685aa985aa2ec36d9cbeb1b3c1ef298b020e552e8fdce12e75abbeb4706f2b",
     "Get-Experiment-Results-Interpretation-Guidance": "sha256:e517d9759f66f4a7ad15b0b67ffaabfb605e80949afcf41d007dfafd8f3e9574",
     "Get-Experiment-Setup-Guidance": "sha256:e517d9759f66f4a7ad15b0b67ffaabfb605e80949afcf41d007dfafd8f3e9574",
     "Get-Feature-Flag": "sha256:129de58b379ffba272bdbcee2b5759262e586dd415edc2067a69e9844d4d0877",
@@ -136,7 +138,7 @@ const MIXPANEL_SCHEMA_DIGESTS = {
     "Update-Cohort": "sha256:ebe0d5afcc00e23eef55f079cd1816c851c2c647dff9565b7045f1f1615663f2",
     "Update-Custom-Property": "sha256:781aaaab41c1ab5958062dc393d02b1df2ef2a09a28d3c4f21ae3177f4f53c86",
     "Update-Dashboard": "sha256:2cc179ba75eda476ba7488f01503d947f023a4460aa98c4806ef0ab10c3b3ce8",
-    "Update-Experiment": "sha256:52ebf7595e48a40e218ff463ed72942a4818abc3ce93d8da6fafa8d358326437",
+    "Update-Experiment": "sha256:3ea3902555c146f45127fc563b36ffb7ff04b7594765dac9ae98cc09dc432808",
     "Update-Feature-Flag": "sha256:9b34b19164168938d08a75d268c9becf8d189c85a1789a45061ae304041faf7c",
     "Update-Lookup-Table": "sha256:ef28f1ec9c9484a7a53b5e2b6659e70f79a8e71e55bda17025aa4ab3c23b6a63",
     "Update-Metric": "sha256:739bb6abdab19282afd4a6644a96183daabe9098a5322c44a77b840608a5ee9d",

package/dist/providers/revenuecat.js

@@ -41,6 +41,7 @@ const READ_ONLY_TOOLS = new Set([
     // Customers and subscriptions
     "get-customer",
     "get-customer-center-config",
+    "get-refund-request-preferences",
     "get-subscription",
     "list-customer-events",
     "list-customers",
@@ -157,7 +158,7 @@ function sharedUsageGuide() {
 - \`get-chart-data\` is the metrics path: read \`get-chart-options-schema\` for the chart you want before calling it, rather than guessing an option name. \`get-overview-metrics\` and \`get-revenue-metric\` answer the summary questions in one call.
 - \`create-paywall-ai\`, \`edit-paywall-ai\`, and \`set-product-store-state\` are asynchronous. They return a task or operation id; poll it with \`get-paywall-ai-task\` or \`get-product-store-state-operation\` rather than assuming the work finished when the call returned.
 - This connection's tool list is not a fixed set. RevenueCat gates parts of its MCP catalog by plan, platform, and beta enrollment — paywall AI editing, benchmarks, experiments, virtual currencies, and the account-billing tools are the usual absentees — so search this connector for what it actually exposes rather than assuming a documented tool is here.
-- \`render-paywall-screenshot\` is unclassified on purpose: RevenueCat's reference gives it no access column, so it fails closed onto \`call_destructive_tool\` until a release reviews it.
+- \`render-paywall-screenshot\` is unclassified on purpose because RevenueCat's reference gives it no access column. The current server marks it read-only, which Connecta preserves; without that annotation it fails closed onto \`call_destructive_tool\`.
 - RevenueCat meters API v2 per minute and per domain, and the domains differ: 480 requests per minute for customer information and virtual currencies, 60 for project configuration and audiences, 25 for charts and metrics. It answers a breach with \`429\`, a \`Retry-After\` header, and a \`backoff_ms\` field. Back off on that rather than retrying immediately, and expect chart sweeps to hit the ceiling long before customer reads do.
 - Treat every create, update, archive, unarchive, attach, detach, delete, publish, unpublish, grant, assign, and submit operation as a write. Connecta routes the maintained write catalog through \`call_destructive_tool\`; newly added tools also fail closed until a release classifies them.
 - An \`auth_required\` failure means this connector's RevenueCat authorization is missing or expired: run \`authorize_connector\` for this connector id, then retry the same call unchanged. A rejected argument, a permission gap, or a plan restriction comes back in RevenueCat's own words instead — read it rather than re-authorizing.

package/dist/providers/stripe.js

@@ -37,16 +37,16 @@ const READ_ONLY_TOOLS = new Set([
     "stripe_api_search",
     "stripe_api_details",
     "stripe_api_read",
-    "get_stripe_account_info",
     "get_balance_summary",
+    "list_available_accounts_or_orgs",
+    "manage_stripe_accounts",
     "search_stripe_documentation",
-    "stripe_implementation_planner",
 ]);
-/** Reviewed writes, including refund rationale: `documentation/stripe.md`. */
+/** Reviewed writes, including mixed read/create tools: `documentation/stripe.md`. */
 const WRITE_TOOLS = new Map([
     ["stripe_api_write", "destructive"],
-    ["create_refund", "destructive"],
-    ["stripe_report", "additive"],
+    ["stripe_implementation_planner", "additive"],
+    ["stripe_analytics", "additive"],
     ["send_stripe_mcp_feedback", "additive"],
 ]);
 /** Release-reviewed manifest; see provider conventions P5 and P13. */
@@ -149,7 +149,8 @@ ${accountInstructions
 function sharedUsageGuide(rate) {
     return `
 - Four generic tools reach any Stripe API method. Find the method with \`stripe_api_search\`, read its parameters with \`stripe_api_details\`, then call \`stripe_api_read\` (GET) or \`stripe_api_write\` (POST/PATCH/PUT/DELETE). Never guess a path or a parameter name — \`stripe_api_details\` is cheaper than a rejected write.
-- Prefer a dedicated tool when one covers the task: \`get_stripe_account_info\` for account information, \`get_balance_summary\` for balances, \`create_refund\` for refunds, \`stripe_report\` for reports. One call instead of three, and a refund named \`create_refund\` reads far more clearly in the approval a human sees than the same refund buried in \`stripe_api_write\` arguments.
+- Prefer a dedicated tool when one covers the task: \`get_balance_summary\` for balances and \`stripe_analytics\` for Sigma or Metrics reporting. Use \`stripe_api_search\` for everything else instead of assuming a retired dedicated tool still exists.
+- \`stripe_implementation_planner\` and the query-execution intents of \`stripe_analytics\` create provider-side planning or query-run state. Connecta therefore routes both through \`call_destructive_tool\` as non-destructive writes; their retrieval paths stay behind the same tool boundary.
 - \`stripe_api_write\` carries the blast radius of the entire write API — every POST, PATCH, PUT, and DELETE, from a customer edit to a subscription cancellation. State the method and path explicitly; expect approval on every call.
 - Lists are cursor-paginated: \`limit\` defaults to 10 and caps at 100, \`starting_after\` and \`ending_before\` take an object id and are mutually exclusive, and \`has_more\` says whether to continue. Page inside \`execute_code\`.
 - Any \`stripe_api_read\` list or \`stripe_api_search\` that returns full objects belongs inside \`execute_code\`, projected to the fields the question needs before \`return\`. Neither \`limit\` nor \`expand\` substitutes for that: an unprojected list of customers or invoices truncates long before it answers, and a projected one keeps the customer's name, email, and address out of the transcript.

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.21.0";
+export declare const CONNECTA_VERSION = "0.21.1";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.21.0";
+export const CONNECTA_VERSION = "0.21.1";

package/documentation/auth.md

@@ -65,7 +65,7 @@ Worker-level Access runs before every connecta route. Consequently:
   OAuth discovery paths when Managed OAuth is enabled.
 
 The [Worker example](../examples/worker/) carries the complete deployment shape
-and the [upgrade guide](./upgrading.md#0200--0210) gives the reversible Clerk
+and the [upgrade guide](./upgrading.md#0200--0211) gives the reversible Clerk
 migration.
 
 ## Clerk configuration is checked at construction

package/documentation/cloudflare.md

@@ -153,6 +153,18 @@ every constrained field, endpoint-specific pagination bounds, and a description
 on every property. `test/cloudflare-provider.test.ts` walks the surface and
 asserts those properties rather than leaving them as a claim.
 
+The per-setting zone tools accept Cloudflare's current non-empty setting ids,
+including `webmcp_enabled` and `webmcp_packs`. Cloudflare's
+[rendered setting reference](https://developers.cloudflare.com/api/resources/zones/subresources/settings/)
+and current OpenAPI now agree on both beta ids. Results preserve the value and
+the actual `editable` flag Cloudflare returned; Connecta does not apply the
+document's defaults locally.
+
+KV namespace jurisdiction is creation-only. `create_kv_namespace` accepts
+`eu`, `fedramp`, or `us`, and namespace reads preserve the returned value.
+R2 uses a different enum: `default`, `eu`, `us`, or `fedramp`, sent through
+`cf-r2-jurisdiction` by all eight named R2 operations.
+
 ### What the named surface deliberately leaves out
 
 A named tool is a permanent line item in every deployment's catalog, so the
@@ -206,7 +218,7 @@ connection *calls*, dropping the tool drops the row — so
 rather than by a recorded exception. A path reached only through a hatch is
 named by the caller, so it was never a touched endpoint.
 
-The surviving 47 named tools all refuse malformed arguments locally, which is
+The surviving 48 named tools all refuse malformed arguments locally, which is
 the one thing no escape hatch can do: a hatch's path is an opaque string, so it
 can only check that a path is a path.
 
@@ -318,6 +330,12 @@ renamed to `camelCase`. A zone comes back as `id`, `name`, `status`, `paused`,
 `type`, `accountId`, `accountName`, `plan`, `nameServers`, and timestamps —
 not the forty-field object Cloudflare sends.
 
+Every named tool declares useful top-level output keys. Zone settings, Worker
+settings and deployments, KV namespaces and bulk operations, rulesets, R2 CORS,
+and Pages resources use maintained result schemas instead of an open
+"Cloudflare object" declaration. The three raw escape hatches remain open by
+design because their result fields depend on the caller-supplied endpoint.
+
 Paginated lists add a `page` object derived from `result_info`:
 `{ page, perPage, count, totalCount, totalPages, hasMore }`. `hasMore` is the
 field to branch on.

package/documentation/linear.md

@@ -110,9 +110,10 @@ the connector is present and reports `auth_required`. See
 
 The wrapper classifies Linear's documented `list_*`, `get_*`, and
 `search_documentation` tools as reads, and its `save_*`, `create_*`, `delete_*`,
-`resolve_*`, `submit_*`, and `merge_*` tools as writes. An unfamiliar tool the
-downstream leaves unannotated fails closed onto `call_destructive_tool` until a
-Connecta release reviews it.
+`resolve_*`, `submit_*`, `merge_*`, `share_issue`, and `unshare_issue` tools as
+writes. Sharing changes an existing issue's access, so both halves are
+destructive. An unfamiliar tool the downstream leaves unannotated fails closed
+onto `call_destructive_tool` until a Connecta release reviews it.
 
 That classification fills in downstream silence and otherwise preserves
 explicit annotations. A tool on the read allowlist arriving with
@@ -136,7 +137,8 @@ though some calls only create. The genuine creates are `create_issue_label` and
 ## The catalog is not a fixed set
 
 Linear's hosted `tools/list` varies by workspace plan and enabled features:
-customer requests, releases, and code review do not appear in every workspace.
+customer requests, releases, code review, templates, and explicit issue sharing
+do not appear in every workspace.
 The maintained allowlists are therefore a superset — a classified name a
 workspace never returns costs nothing, and a genuinely new tool fails closed.
 Agents should search this connector's catalog for what the workspace actually

package/documentation/mixpanel.md

@@ -84,7 +84,7 @@ the maintained guide carries the missing call guidance:
 A read-only live audit on 2026-08-13 confirmed all three refusals against the
 US hosted endpoint. They are reported upstream as
 [`mixpanel/mixpanel-headless#202`](https://github.com/mixpanel/mixpanel-headless/issues/202).
-The vetted catalog records the same audit's schema digests for all 63 tools,
+The vetted catalog records current schema digests for all 64 tools,
 so a later schema correction or regression appears by tool name in the
 maintainer drift check. The guide can then shrink when the downstream schema
 becomes complete; Connecta does not absorb the defect permanently.
@@ -110,8 +110,10 @@ rest) leave `destructiveHint` unset; `readOnlyHint: false` already routes them
 through the destructive path, and asserting destruction only inflates the
 approval copy the host shows a human.
 
-Experiments and Feature Flags — 15 of the 63 classified tools — are Mixpanel
-beta surfaces. Expect their names and schemas to move faster than the rest.
+Experiments and Feature Flags are Mixpanel beta surfaces. Their three changed
+schemas were reviewed again on 2026-08-30. The same review added
+`Fill-Event-Metadata` as a destructive write because it applies generated names
+and descriptions to existing Lexicon events.
 
 ## Rate limits
 

package/documentation/operations.md

@@ -233,7 +233,7 @@ in.
 | `catalog.test.ts` | lexical ranking and the compact schema renderer — `const`, `allOf` beside siblings, `$ref`, the depth limit, per-schema caching, and 2020-12 keyword compatibility |
 | `clerk.test.ts` | protected-resource metadata, the browser sign-in config, OAuth and session tokens, cached best-effort activity labels with their caps, the hand-applied `azp` rejection, and the `allowedDomains` allowlist including every lookalike that must not be repaired into a match |
 | `cloudflare-access-auth.test.ts` | trusted `ctx.access` human and service identities, absent/error fail-closed behavior, service-token MCP admission without operator mutation, human same-origin mutation, and the Clerk-to-ambient shell switch |
-| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, request building, projections, typed failures, and credential test |
+| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, current R2 and KV jurisdictions, useful output declarations, request building, projections including additive provider fields, typed failures, and credential test |
 | `code-first-surface.test.ts` | the seven-tool surface itself — an executor required, every removed option and top-level tool refused, compact always-loaded routing pinned below 1,000 characters, complete on-demand usage served, and `connecta.ui` findable before connector search |
 | `codemode-compat.test.ts` | the `Executor` seam staying structurally compatible with `@cloudflare/codemode`'s `DynamicWorkerExecutor`, enforced by `tsc` |
 | `config.test.ts` | the grouped `ConnectaConfig` boundary — each group forwarding to its internals, malformed admission bounds failing construction, and unknown own-properties rejected by their complete path before construction does work |
@@ -247,11 +247,11 @@ in.
 | `executor-admission.test.ts` | the portable bounded FIFO both pools use: active and queue ceilings, stable retryable overload, queue timeout, cancellation removal, idempotent release, shutdown |
 | `guarded-fetch.test.ts` | the guarded transport — construction, request building, destination confinement, and response handling |
 | `guest-api-contract.test.ts` | the shared guest contract on the Dynamic Worker, including caught call, typed inline describe recovery, discovery, utility, batch, and budget failure codes; plus the real authority boundary — local `data:` fetch, denied egress, unresolved DNS, empty environment paths, unavailable filesystem/HTTP builtins, and present runtime globals |
-| `linear-provider.test.ts` | the Linear proxy's construction, classification, and guide |
+| `linear-provider.test.ts` | the Linear proxy's construction, guide, plan-aware catalog superset, and current workspace, template, and issue-sharing classifications |
 | `meta-tools-call.test.ts` | registry-backed calls: structured errors, truncation and `get_result`, per-connector result bounds, JSON representation failures, MCP content bounds, and offset alignment |
 | `meta-tools-search.test.ts` | registry-backed discovery: bounded search with page and address maxima, compact and JSON schemas with constraints, typed describe recovery and suggestions, and structured-result compatibility |
 | `meta-tools.test.ts` | the remaining registry-backed meta-tools: the complete on-demand usage skill, connector-guide selection and summary bounds, stored-credential drift, catalog health, authorization, probe timeouts, and unavailable or unknown browse recovery |
-| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide and complete reviewed schema-digest manifest |
+| `mixpanel-provider.test.ts` | the Mixpanel proxy, its conditional-input guide, destructive metadata fill, and complete 64-tool schema-digest manifest |
 | `notion-provider.test.ts` | Notion's deliberate tool surface, including declined expanded page inputs, request construction, lean projections, both pagination conventions, error mapping, and writes |
 | `operator-boundary.test.ts` | the operator row of the decisions table, after every mutation route: authentication material managed without moving a declared structure, and the one honest exception — a credential write making a remote catalog appear, which is discovery arriving, not an operator editing the deployment |
 | `operator-store.test.ts` | `src/operator-ui/app/store.ts` against a fake browser: the Clerk listener, ambient Access requests without a browser-readable token, `gate()`, the generation fence, and the request path |
@@ -263,11 +263,11 @@ in.
 | `remote-mcp-pagination.test.ts` | the `tools/list` cursor chain in both directions — exact cursor handoff, first-wins dedup, a failed later page rejecting rather than returning its prefix, the runaway backstops, the tool-metadata re-prime across pages, and paginated catalogs reaching the discovery path |
 | `request-admission.test.ts` | `/mcp` bounded before auth, the stable 503 and `Retry-After`, health and operator responsiveness under saturation, payload-free counters, queued cancellation, shutdown rejection while active work drains, and the separate fallback code pool |
 | `result-shapes.test.ts` | passive output-shape learning: value-free bounded inference, merging, 256-entry LRU eviction, 24-hour expiry, runtime isolation, read-only admission, declared-schema precedence, definition-change invalidation, discovery provenance, and failure isolation |
-| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
+| `revenuecat-provider.test.ts` | the RevenueCat proxy's per-project key scoping and account-wide OAuth guides, its purpose-bearing summary, the refund-preference read and argued borderline verdicts in its digest-free manifest, and the deliberately unclassified `render-paywall-screenshot` |
 | `server.test.ts` | end-to-end `/mcp` (401 → compact initialize instructions → seven compact definitions with bounded connector inventory and exact model-only Apps metadata → complete usage skill → `call_tool`), conditional guide pointers, open routes, Clerk `.well-known` metadata without network, code mode, and deferred catalog reads through both discovery surfaces |
 | `server-route-contracts.test.ts` | the route contracts `server.ts` must keep byte-identical: every built-in answered ahead of connector routes inside the security wrapper, open data-free shells with framing denied, per-route auth and same-origin requirements with exact 401/403/405 bodies, and OAuth `verifyState`-before-`finishAuth` ordering |
 | `startup-warnings.test.ts` | every construction-time `logger.warn` and, as importantly, the conditions that must *not* trigger one: open mode with a credential or OAuth connector, `publicUrl` unset beside OAuth, dropped branding and `uiAuth` URLs, a missing `verifyState`, a credential test-hook mismatch, and an unusable `calls.maxResultBytes` |
-| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, admission, exact account selectors, and no-guess rule |
+| `stripe-provider.test.ts` | the Stripe proxy's mixed-mode OAuth and fixed-mode header contracts, current eleven-tool classifications, admission, exact account selectors, and no-guess rule |
 | `operator-view.test.ts` | the app's pure state rules from `view.ts`: filtering, page routing, capability states, activity summaries, drift display, and identity reset |
 | `ui-credentials.test.ts` | credential-management routes: save, test, delete, validation, authentication, same-origin checks, and multi-field credential shapes |
 | `ui.test.ts` | the server shell and remaining `/ui/*` routes: gated `/ui/data` with broken-connector isolation and registry-owned catalog-observation containment, plus the URL safety gates |

package/documentation/provider-conventions.md

@@ -693,8 +693,10 @@ Cloudflare keep/prune half of that judgment was made in
 [#350](https://github.com/zackbart/connecta/issues/350): 30 keep, 18 improve,
 3 prune, measured per tool in
 [`eval/current-version/results/issue-350-evidence.md`](https://github.com/zackbart/connecta/blob/main/eval/current-version/results/issue-350-evidence.md).
-Its eighteen `improve` rows are H8 and H9 misses on tools that clearly earn
-their place, so they are this audit's work, not a second removal argument.
+Its eighteen `improve` rows were H8 and H9 misses on tools that clearly earned
+their place. Issue #488 resolved them with useful output keys and maintained
+projections; the measurements remain the reason those tools stayed rather than
+a second removal argument.
 
 Each provider's own guide ([Cloudflare](./cloudflare.md),
 [Linear](./linear.md), [Mixpanel](./mixpanel.md), [Notion](./notion.md),

package/documentation/revenuecat.md

@@ -152,17 +152,18 @@ names the `authorize_connector` recovery. A permission gap, a plan restriction,
 or a rejected argument arrives as RevenueCat wrote it and is not an
 authorization problem.
 
-## The ninety-five tools, and what they are classified as
+## The ninety-six tools, and what they are classified as
 
 RevenueCat's
 [tool reference](https://www.revenuecat.com/docs/tools/mcp/tools-reference),
-read on **2026-08-18**, documents ninety-five tools in a Read/Write table.
-Ninety-four carry an access column and are classified here: **50 read-only, 15
-additive writes, 29 destructive writes.**
+read on **2026-08-30**, documents ninety-six tools. Ninety-five carry an access
+column and are classified here: **51 read-only, 15 additive writes, 29
+destructive writes.**
 
 Reads are every `Read` row, verbatim — the nine project and app reads, the four
 product reads, the entitlement, offering, targeting, paywall, customer, virtual
-currency, chart, webhook, and SDK reads, and `get-paywall-ai-task`.
+currency, chart, webhook, and SDK reads, `get-paywall-ai-task`, and
+`get-refund-request-preferences`.
 
 Writes follow the verb where the verb is honest: `archive-*` and `unarchive-*`
 flip an existing object's active state, `update-*`, `delete-*`, `publish-*`,
@@ -191,14 +192,15 @@ beside the row:
 `create-webhook-integration` deserves a sentence too. No existing integration
 changes, so the verb reads additive — but with filters omitted the new one
 "starts delivering" every customer event in the project to a URL the caller
-typed. Customer data leaving the account is the `create_refund` argument again:
-filed destructive on consequence, so the approval copy says what is at stake.
+typed. Customer data leaving the account makes it destructive on consequence,
+so the approval copy says what is at stake.
 
 **`render-paywall-screenshot` is deliberately unclassified.** RevenueCat's
-reference gives it no access column at all, so no release has reviewed what it
-does. It fails closed onto `call_destructive_tool` rather than being guessed
-into the read path because its name sounds harmless (P5). The guide names it,
-so an agent does not read the approval prompt as a bug.
+reference gives it no access column. The current live server explicitly marks
+it read-only, so that catalog keeps it callable from `execute_code`; if a later
+catalog omits the annotation, it fails closed onto `call_destructive_tool`.
+Connecta preserves the provider's current annotation without inventing a
+release classification from the tool's harmless-sounding name (P5).
 
 That classification fills in downstream silence and otherwise preserves explicit
 annotations. A tool on the read allowlist arriving with `destructiveHint: true`
@@ -242,7 +244,7 @@ API v2 meters per minute and **per domain**
 | Charts & Metrics | 25 |
 
 A `ConnectorCallAdmissionPolicy` carries exactly one rule, so a connector-wide
-budget has to pick one of those six numbers for all ninety-five tools.
+budget has to pick one of those six numbers for all ninety-six tools.
 Transcribing 25 would throttle a customer read loop to a nineteenth of its
 documented allowance; transcribing 480 would leave a chart sweep unprotected.
 Neither is the provider's limit, and both would look like RevenueCat being
@@ -281,15 +283,13 @@ still needs restrained use.
 
 ## What is not verified
 
-- **Every tool name is transcribed from RevenueCat's published reference on
-  2026-08-18, not read from a live catalog.** No maintainer ran this against a
-  project with a real key before it shipped. A name the reference lists and the
-  server does not serve costs nothing; a tool the server serves and the
-  reference omits fails closed. The maintainer-run drift check with
-  `CONNECTA_DRIFT_REVENUECAT_KEY` set is what turns that into a finding with a
-  name attached.
-- **No input or output schema has been read**, which is why the manifest
-  carries no digests.
+- **The 2026-08-30 live review used a project-scoped catalog.** It proves the
+  additions that catalog serves, including `get-refund-request-preferences`,
+  but cannot prove a globally documented tool was removed. The manifest stays
+  a superset because plan, platform, and credential scope hide tools.
+- **No complete schema set has been recorded**, which is why the manifest
+  carries no digests. The review read the new live schemas, but its scoped
+  catalog omitted many classified writes.
 - **Whether `render-paywall-screenshot` mutates anything.** It has no access
   column, and guessing is exactly what P5 exists to prevent.
 

package/documentation/stripe.md

@@ -139,38 +139,39 @@ boots but cannot list tools is usually a dashboard toggle, not a bad key.
 
 ## The eleven tools, and what they are classified as
 
-Stripe documents eleven tools on the hosted server. Seven are reads:
+Stripe currently serves eleven tools. Seven are reads:
 
 `stripe_api_search`, `stripe_api_details`, `stripe_api_read`,
-`get_stripe_account_info`, `get_balance_summary`,
-`search_stripe_documentation`, `stripe_implementation_planner`.
+`get_balance_summary`, `list_available_accounts_or_orgs`,
+`manage_stripe_accounts`, and `search_stripe_documentation`.
 
 Four are writes:
 
-`stripe_api_write` and `create_refund` are classified destructive;
-`stripe_report` and `send_stripe_mcp_feedback` are additive.
+`stripe_api_write` is destructive. `stripe_implementation_planner`,
+`stripe_analytics`, and `send_stripe_mcp_feedback` are additive.
 
 Two of those deserve a sentence. `stripe_api_read` is a read because Stripe
 documents it as the `GET` half of a generic pair — the tool is the read
 boundary, not whichever endpoint an agent names inside it, and its sibling
 `stripe_api_write` carries every `POST`, `PATCH`, `PUT`, and `DELETE`.
-`create_refund` is filed destructive despite its name: it reverses a settled
-charge and moves money back out, which is a mutation of something that already
-exists rather than a fresh object appearing beside it. Additive writes
-(`stripe_report`, `send_stripe_mcp_feedback`) leave `destructiveHint` unset;
+`stripe_implementation_planner` creates and continues provider-side guide
+state. `stripe_analytics` combines retrieval with query-run creation behind one
+tool. Stripe marks both not read-only and not destructive, so Connecta records
+them as additive writes. They leave `destructiveHint` unset. Their explicit
 `readOnlyHint: false` already routes them through `call_destructive_tool`, and
-asserting destruction only inflates the approval copy the host shows a human.
+asserting destruction would misstate their effect.
 
 That classification fills in downstream silence and otherwise preserves
-explicit annotations. It supplies the annotations Stripe leaves unset — Stripe
-documents no MCP annotations at all. A tool on the read allowlist arriving with
+explicit annotations. The current server annotates all eleven tools, while the
+manifest records what this release reviewed and exposes later contradictions.
+A tool on the read allowlist arriving with
 `destructiveHint: true` or `readOnlyHint: false` keeps exactly what the
 downstream said and stays behind `call_destructive_tool`. A tool on neither
 maintained list arriving with `readOnlyHint: true` keeps that too, and stays
 callable from `execute_code`. Both are the downstream telling you this release's
 allowlist is stale, and on a name no release has reviewed its word is the only
 evidence there is. One narrow fail-closed exception applies to a name this
-release reviewed and filed destructive: a `create_refund` claiming
+release reviewed and filed destructive: `stripe_api_write` claiming
 `readOnlyHint: true` is a downstream bug rather than news, and stays on the
 approval path.
 

package/documentation/upgrading.md

@@ -57,7 +57,7 @@ exist so far:
 | --- | --- | --- |
 | **pre-template** | before 0.10.2 | no `connecta init` existed; hand-written, or copied from the retired `examples/node` |
 | **A** | 0.10.2 – 0.15.1 | `.env.example`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `package.json`, `src/index.ts`, `tsconfig.json` |
-| **B** | 0.16.0 – 0.21.0 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
+| **B** | 0.16.0 – 0.21.1 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
 
 Generation A is a decade in template years and identifying it precisely does
 not matter, because you are about to reconstruct it exactly rather than guess
@@ -106,7 +106,7 @@ know what to preserve, once to know what to re-verify at the end.
 ### Bump the pin and install
 
 ```sh
-npm pkg set dependencies.@zackbart/connecta=0.21.0
+npm pkg set dependencies.@zackbart/connecta=0.21.1
 npm install
 ```
 
@@ -130,7 +130,7 @@ Generate the *current* template beside the base you already made, into the same
 `$SCRATCH`:
 
 ```sh
-(cd "$SCRATCH" && npx @zackbart/connecta@0.21.0 init current)
+(cd "$SCRATCH" && npx @zackbart/connecta@0.21.1 init current)
 ```
 
 You now have a three-way merge with a real base: `$SCRATCH/base` is what this
@@ -186,7 +186,7 @@ A deployment older than 0.10.2 has no base to diff against. Do not try to
 manufacture one. Instead:
 
 1. `SCRATCH=$(mktemp -d)`, then
-   `(cd "$SCRATCH" && npx @zackbart/connecta@0.21.0 init current)` — there is no
+   `(cd "$SCRATCH" && npx @zackbart/connecta@0.21.1 init current)` — there is no
    `base` leg here, only the current template to read from.
 2. Copy `$SCRATCH/current` into the deployment file by file, **skipping
    `src/index.ts`**.
@@ -207,9 +207,10 @@ first, so cross them bottom-up: start at the oldest one still above this
 deployment's pin and work back up the page, because each boundary assumes the
 older ones are already done.
 
-### 0.20.0 → 0.21.0
+### 0.20.0 → 0.21.1
 
-This is additive for Node and existing Clerk deployments. The new Worker path
+0.21.1 adds no deployment migration beyond 0.21.0. The boundary is additive
+for Node and existing Clerk deployments. The new Worker path
 uses Cloudflare Access identity directly and removes Clerk only after the edge
 cutover has been verified. An agent can perform every repository edit; a human
 must attach Access, choose its policy, create service credentials, and enable
@@ -217,7 +218,7 @@ Managed OAuth in the Cloudflare dashboard.
 
 For a Worker currently using Clerk, keep rollback live through the cutover:
 
-1. Bump and install 0.21.0. Add the new provider **before** the existing Clerk
+1. Bump and install 0.21.1. Add the new provider **before** the existing Clerk
    provider, but remove nothing:
 
    ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of seven meta-tools.",

package/templates/node/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.21.0",
+    "@zackbart/connecta": "0.21.1",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {