@zackbart/connecta 0.28.0 → 0.29.0

package/dist/providers/{cloudflare.js → cloudflare/index.js}

@@ -1,3 +1,4 @@
+import { skill } from "./skill.generated.js";
 /**
  * No official `cloudflare` SDK on purpose. What the SDK sells — typed request
  * wrappers and pagination helpers — is what this connection replaces: an agent
@@ -6,14 +7,17 @@
  * optional peer, an install step, and an import that never belongs in the root
  * graph. Cloudflare's v4 API is authenticated `fetch` over a uniform
  * `{ success, errors, messages, result, result_info }` envelope, so Web APIs
- * alone keep this provider Workers-clean. `test/package-surface.test.ts` pins
+ * alone keep this provider Workers-clean. `test/package-surface.node.test.ts` pins
  * it: no `cloudflare` package in any dependency field, every import relative.
  */
-import { api, defined } from "../connectors/api.js";
-import { remoteMcp, withCredentialDefaults, } from "../connectors/remote-mcp.js";
-import { vettedCatalog, withVettedCatalog } from "../catalog-drift.js";
-import { guardedFetch, retryAfterMs, } from "../connectors/guarded-fetch.js";
-import { ConnectorCallError } from "../errors.js";
+import { apiConnector as api } from "../../connectors/api-connector.js";
+import { remoteMcp, withCredentialDefaults } from "../../connectors/remote-mcp.js";
+import { reviewedCatalog } from "../../catalog-drift.js";
+import { guardedFetch, retryAfterMs, } from "../../connectors/guarded-fetch.js";
+import { ConnectorCallError } from "../../errors.js";
+import { keys, optionsOf, variants } from "../../config-schema.js";
+import { CREDENTIAL, PROVIDER_COMMON, REMOTE_MCP_AUTH } from "../../connectors/option-shapes.js";
+import { defineProvider } from "../../provider.js";
 /** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
 export const CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
 /** Cloudflare's official whole-API hosted MCP endpoint. */
@@ -92,7 +96,7 @@ function admissionPolicy(maxConcurrency) {
 }
 const API_TOKEN_CREDENTIAL = {
     label: "Cloudflare API token",
-    description: "A scoped API token (My Profile → API Tokens → Create Token), not a Global API Key. Grant only the permissions the deployment needs: zone-scoped \"Zone Read\", \"Zone Settings Write\", \"DNS Write\", \"Cache Purge\", and the phase-specific Rules product Read permissions as needed; account-scoped \"Workers Scripts Read/Write\", \"Workers KV Storage Read/Write\", \"Workers R2 Storage Read/Write\", or \"Cloudflare Pages Read/Write\" for the platform tools.",
+    description: 'A scoped API token (My Profile → API Tokens → Create Token), not a Global API Key. Grant only the permissions the deployment needs: zone-scoped "Zone Read", "Zone Settings Write", "DNS Write", "Cache Purge", and the phase-specific Rules product Read permissions as needed; account-scoped "Workers Scripts Read/Write", "Workers KV Storage Read/Write", "Workers R2 Storage Read/Write", or "Cloudflare Pages Read/Write" for the platform tools.',
     placeholder: "Paste API token",
 };
 const GLOBAL_API_KEY_CREDENTIAL = {
@@ -137,9 +141,7 @@ function credentialConfig(authentication, override) {
     return credential;
 }
 function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function asArray(value) {
     return Array.isArray(value) ? value : [];
@@ -222,9 +224,12 @@ function failureFor(status, headers, errors) {
         { retryAfterMs: wait ?? 300_000 });
     }
     const authCoded = [...codes].some((code) => AUTH_ERROR_CODES.has(code));
-    if (status === 401 || status === 403 || authCoded) {
+    if (status === 401 || authCoded) {
         return new ConnectorCallError("auth_required", `Cloudflare rejected the configured credential (HTTP ${status}). ${detail} Check that it is valid and has permission to access this resource.`);
     }
+    if (status === 403) {
+        return new ConnectorCallError("provider_permission_denied", `Cloudflare refused access to this resource (HTTP 403). ${detail} Verify the configured credential first; if valid, ask the account administrator to grant the required resource permission and token scope.`);
+    }
     if (status === 400 || status === 409 || status === 422) {
         return new ConnectorCallError("invalid_args", `Cloudflare rejected the request (HTTP ${status}). ${detail}`);
     }
@@ -286,24 +291,20 @@ function cloudflareTransport(baseUrl, authentication) {
 async function callCloudflare(send, spec, ctx) {
     return await send(spec, ctx, async (response) => {
         const parsed = await response.jsonResult();
-        const envelope = "value" in parsed
-            ? parsed.value
-            : undefined;
+        const envelope = "value" in parsed ? parsed.value : undefined;
         if (envelope === undefined) {
             // A gateway error page or an empty body, not an envelope: the status is
             // the only real signal left.
+            // No cause: the parser's error quotes the body it could not read.
             throw response.ok
-                ? new ConnectorCallError("unavailable", "Cloudflare returned a non-JSON body for a successful status.", "parseError" in parsed ? { cause: parsed.parseError } : {})
+                ? new ConnectorCallError("unavailable", "Cloudflare returned a non-JSON body for a successful status.")
                 : failureFor(response.status, response.headers, []);
         }
         const errors = Array.isArray(envelope.errors) ? envelope.errors : [];
         if (!response.ok || envelope.success === false) {
             throw failureFor(response.status, response.headers, errors);
         }
-        const isV4Envelope = "success" in envelope ||
-            "result" in envelope ||
-            "result_info" in envelope ||
-            "messages" in envelope;
+        const isV4Envelope = "success" in envelope || "result" in envelope || "result_info" in envelope || "messages" in envelope;
         return {
             // `/graphql` and a small number of product APIs return ordinary JSON
             // instead of the standard v4 envelope. Preserve that document whole so
@@ -338,10 +339,7 @@ async function callCloudflareContent(send, spec, ctx, responseType) {
             let envelope;
             try {
                 const parsed = await response.jsonResult();
-                envelope =
-                    "value" in parsed
-                        ? parsed.value
-                        : undefined;
+                envelope = "value" in parsed ? parsed.value : undefined;
             }
             catch {
                 // Content reads classify an already-failed status even when its error
@@ -369,9 +367,7 @@ function pageInfo(info) {
         return undefined;
     // A cursor-only result_info carries no page counters; inventing them would
     // report `hasMore: false` on a listing that has more.
-    if (info.page === undefined &&
-        info.total_pages === undefined &&
-        info.count === undefined) {
+    if (info.page === undefined && info.total_pages === undefined && info.count === undefined) {
         return undefined;
     }
     const page = typeof info.page === "number" ? info.page : 1;
@@ -392,9 +388,7 @@ function pagedList(key, project) {
     });
 }
 function cursorResult(cursor) {
-    return typeof cursor === "string" && cursor !== ""
-        ? { nextCursor: cursor }
-        : {};
+    return typeof cursor === "string" && cursor !== "" ? { nextCursor: cursor } : {};
 }
 function projectAccount(value) {
     const account = asRecord(value);
@@ -409,9 +403,7 @@ function projectZone(value) {
     const zone = asRecord(value);
     const account = asRecord(zone["account"]);
     const plan = asRecord(zone["plan"]);
-    const nameServers = Array.isArray(zone["name_servers"])
-        ? zone["name_servers"]
-        : undefined;
+    const nameServers = Array.isArray(zone["name_servers"]) ? zone["name_servers"] : undefined;
     return compact({
         id: zone["id"],
         name: zone["name"],
@@ -438,9 +430,7 @@ function projectZoneSetting(value) {
 function projectDnsRecord(value) {
     const record = asRecord(value);
     const comment = record["comment"] ? record["comment"] : undefined;
-    const tags = Array.isArray(record["tags"]) && record["tags"].length > 0
-        ? record["tags"]
-        : undefined;
+    const tags = Array.isArray(record["tags"]) && record["tags"].length > 0 ? record["tags"] : undefined;
     return compact({
         id: record["id"],
         name: record["name"],
@@ -491,13 +481,6 @@ function projectKvBulkValues(value) {
     const result = asRecord(value);
     return compact({ values: result["values"] });
 }
-function projectKvBulkResult(value) {
-    const result = asRecord(value);
-    return compact({
-        successfulKeyCount: result["successful_key_count"],
-        unsuccessfulKeys: result["unsuccessful_keys"],
-    });
-}
 function projectR2Bucket(value) {
     const bucket = asRecord(value);
     return compact({
@@ -582,9 +565,7 @@ function projectRuleset(value) {
 function projectPagesProject(value) {
     const project = asRecord(value);
     const latest = asRecord(project["latest_deployment"]);
-    const domains = Array.isArray(project["domains"])
-        ? project["domains"]
-        : undefined;
+    const domains = Array.isArray(project["domains"]) ? project["domains"] : undefined;
     const latestDeployment = latest["id"] === undefined
         ? undefined
         : compact({
@@ -636,9 +617,7 @@ const RAW_INPUT_PROPERTY = {
  */
 function pagingInputProperties(minPerPage, maxPerPage, options = {}) {
     const { defaultPerPage, bounds = "cloudflare" } = options;
-    const defaultNote = defaultPerPage === undefined
-        ? " Cloudflare chooses the default."
-        : ` Defaults to ${defaultPerPage}.`;
+    const defaultNote = defaultPerPage === undefined ? " Cloudflare chooses the default." : ` Defaults to ${defaultPerPage}.`;
     const boundsNote = bounds === "clamped"
         ? ` The ${maxPerPage} ceiling is this connection's cap, not Cloudflare's limit.`
         : bounds === "undocumented"
@@ -768,9 +747,7 @@ function scopeRequired(kind, fallback) {
 }
 function optionalString(args, key) {
     const value = args[key];
-    return typeof value === "string" && value.trim() !== ""
-        ? value.trim()
-        : undefined;
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
 }
 function optionalNumber(args, key) {
     const value = args[key];
@@ -782,17 +759,6 @@ function requireString(args, key) {
         return value;
     throw new ConnectorCallError("invalid_args", `${key} must not be blank.`);
 }
-function encodeObjectKey(value) {
-    return value
-        .split("/")
-        .map((segment) => {
-        if (segment === "." || segment === "..") {
-            throw new ConnectorCallError("invalid_args", "objectKey cannot contain '.' or '..' path segments because URL normalization would change the target resource.");
-        }
-        return encodeURIComponent(segment);
-    })
-        .join("/");
-}
 function cloudflareApiPath(value) {
     if (typeof value !== "string") {
         throw new ConnectorCallError("invalid_args", "path must be a string.");
@@ -864,7 +830,11 @@ function headersFromArgs(value) {
         if (forbidden.has(name.toLowerCase())) {
             throw new ConnectorCallError("invalid_args", `The raw Cloudflare tools do not allow the ${name} header. Authentication and request framing are connector-owned; use contentType for a raw upload body.`);
         }
-        headers[name] = String(entry["value"]);
+        const value = String(entry["value"]);
+        if (name.toLowerCase() === "cf-r2-storage-class" && value !== "Standard" && value !== "InfrequentAccess") {
+            throw new ConnectorCallError("invalid_args", "cf-r2-storage-class must be Standard or InfrequentAccess.");
+        }
+        headers[name] = value;
     }
     return headers;
 }
@@ -875,6 +845,32 @@ function rawSpec(args) {
         headers: headersFromArgs(args["headers"]),
     });
 }
+// The hosted helper cannot send R2 jurisdiction or bucket-edit storage headers.
+// Ordinary headers such as Accept are not a reason to restore JSON duplicates.
+function needsMutationHeaders(method, spec) {
+    const headers = Object.entries(spec.headers ?? {});
+    if (method === "PATCH" &&
+        /^\/accounts\/[^/]+\/r2\/buckets\/[^/]+\/?$/.test(spec.path) &&
+        headers.some(([name, value]) => name.toLowerCase() === "cf-r2-storage-class" && (value === "Standard" || value === "InfrequentAccess")))
+        return true;
+    return (/^\/accounts\/[^/]+\/r2\/buckets(?:\/|$)/.test(spec.path) &&
+        headers.some(([name, value]) => name.toLowerCase() === "cf-r2-jurisdiction" && typeof value === "string" && value.trim().length > 0));
+}
+// Reviewed raw-body families, rather than a Content-Type assertion that could
+// send an ordinary JSON DNS/configuration mutation through the upload tool.
+function isUploadEndpoint(method, path) {
+    const match = /^\/accounts\/[^/]+(\/.*)$/.exec(path);
+    if (!match)
+        return false;
+    const accountPath = match[1];
+    if (method === "PUT") {
+        return /^(?:\/workers\/scripts\/[^/]+|\/storage\/kv\/namespaces\/[^/]+\/values\/.+|\/r2\/buckets\/[^/]+\/objects\/.+)\/?$/.test(accountPath);
+    }
+    if (method === "POST") {
+        return /^(?:\/workers\/scripts\/[^/]+\/versions|\/images\/v1|\/stream|\/pages\/assets\/upload|\/pages\/projects\/[^/]+\/deployments)\/?$/.test(accountPath);
+    }
+    return false;
+}
 function r2Headers(args) {
     return { "cf-r2-jurisdiction": optionalString(args, "jurisdiction") };
 }
@@ -884,7 +880,9 @@ function bytesFromBase64(value) {
         return Uint8Array.from(binary, (character) => character.charCodeAt(0));
     }
     catch (cause) {
-        throw new ConnectorCallError("invalid_args", "base64Body and multipart file base64 values must be valid base64.", { cause });
+        throw new ConnectorCallError("invalid_args", "base64Body and multipart file base64 values must be valid base64.", {
+            cause,
+        });
     }
 }
 function uploadBody(args) {
@@ -917,7 +915,9 @@ function uploadBody(args) {
             if (Number(text !== undefined) + Number(base64 !== undefined) !== 1) {
                 throw new ConnectorCallError("invalid_args", "Each multipart file needs exactly one of text or base64.");
             }
-            const blob = new Blob([text ?? bytesFromBase64(base64)], { type: String(file["contentType"] ?? "application/octet-stream") });
+            const blob = new Blob([text ?? bytesFromBase64(base64)], {
+                type: String(file["contentType"] ?? "application/octet-stream"),
+            });
             form.append(String(file["name"]), blob, String(file["fileName"]));
         }
         return { rawBody: form };
@@ -1007,13 +1007,6 @@ const KV_BULK_VALUES_SCHEMA = {
     },
     required: ["values"],
 };
-const KV_BULK_RESULT_SCHEMA = {
-    type: "object",
-    properties: {
-        successfulKeyCount: { type: "number" },
-        unsuccessfulKeys: { type: "array", items: { type: "string" } },
-    },
-};
 const R2_CORS_SCHEMA = {
     type: "object",
     properties: {
@@ -1083,7 +1076,7 @@ const QUERY_INPUT_PROPERTY = {
 // cloudflare_api_upload's compact input past the 1,024-byte discovery budget.
 const HEADERS_INPUT_PROPERTY = {
     type: "array",
-    description: "Endpoint headers as name/value pairs, e.g. cf-r2-jurisdiction or Range. Connector-owned headers are refused.",
+    description: "Endpoint headers as name/value pairs, e.g. cf-r2-jurisdiction, cf-r2-storage-class (Standard or InfrequentAccess), or Range. Connector-owned headers are refused.",
     items: {
         type: "object",
         properties: {
@@ -1099,11 +1092,6 @@ const R2_JURISDICTION_PROPERTY = {
     enum: ["default", "eu", "us", "fedramp"],
     description: "Bucket jurisdiction. Omit for ordinary buckets; set eu, us, or fedramp for jurisdictional buckets.",
 };
-const KV_JURISDICTION_PROPERTY = {
-    type: "string",
-    enum: ["eu", "fedramp", "us"],
-    description: "Creation-only namespace jurisdiction. Omit for an ordinary namespace; it cannot be changed by rename_kv_namespace.",
-};
 const R2_BUCKET_NAME_PROPERTY = {
     type: "string",
     minLength: 3,
@@ -1140,26 +1128,6 @@ const WORKER_DEPLOYMENT_ID_PROPERTY = {
     minLength: 1,
     description: "Deployment id from list_worker_deployments.",
 };
-const RETRY_DEPLOYMENT_ID_PROPERTY = {
-    type: "string",
-    minLength: 1,
-    description: "Deployment id to retry.",
-};
-const ROLLBACK_DEPLOYMENT_ID_PROPERTY = {
-    type: "string",
-    minLength: 1,
-    description: "Previous deployment id to promote.",
-};
-const DELETE_DEPLOYMENT_ID_PROPERTY = {
-    type: "string",
-    minLength: 1,
-    description: "Deployment id to delete.",
-};
-const DELETE_PROJECT_NAME_PROPERTY = {
-    type: "string",
-    minLength: 1,
-    description: "Pages project name to delete.",
-};
 const SETTING_ID_PROPERTY = {
     type: "string",
     minLength: 1,
@@ -1206,9 +1174,7 @@ function cfTool(name, description, annotations, scopeKind, scopeFallback, proper
                     ...properties,
                 }
                 : properties,
-            required: scopeKind
-                ? [...scopeRequired(scopeKind, scopeFallback), ...required]
-                : required,
+            required: scopeKind ? [...scopeRequired(scopeKind, scopeFallback), ...required] : required,
             additionalProperties: false,
         },
         outputSchema,
@@ -1221,13 +1187,6 @@ function getResult(send, request, project = (result) => result) {
         return project(result, args);
     };
 }
-function deleteAck(send, key, value, request) {
-    return async (args, ctx) => {
-        const id = value(args);
-        await callCloudflare(send, request(args, id), ctx);
-        return { deleted: true, [key]: id };
-    };
-}
 function buildTools(scope, authentication) {
     const { send } = scope;
     const zoneArg = (args) => requireScope(args["zoneId"], scope.zoneId, "zoneId");
@@ -1241,7 +1200,7 @@ function buildTools(scope, authentication) {
                     id: { type: "string" },
                     status: {
                         type: "string",
-                        description: "\"active\" for a usable token.",
+                        description: '"active" for a usable token.',
                     },
                     notBefore: { type: "string" },
                     expiresOn: { type: "string" },
@@ -1264,7 +1223,7 @@ function buildTools(scope, authentication) {
                     email: { type: "string" },
                     status: {
                         type: "string",
-                        description: "\"active\" when Cloudflare accepts the email and key.",
+                        description: '"active" when Cloudflare accepts the email and key.',
                     },
                 },
                 required: ["email", "status"],
@@ -1285,7 +1244,7 @@ function buildTools(scope, authentication) {
                 type: "string",
                 enum: ["json", "text", "base64"],
                 description: "How to read a successful response. Defaults to json; use text or base64 for object, log, script, and media downloads.",
-            }
+            },
         }, ["path"], {
             type: "object",
             properties: {
@@ -1318,7 +1277,7 @@ function buildTools(scope, authentication) {
                 resultInfo,
             });
         }),
-        cfTool("cloudflare_api_mutate", "Call any JSON POST, PUT, PATCH, or DELETE endpoint under Cloudflare's v4 API with this connector's credential. The approval-gated write hatch for products the named surface does not reach. No multipart or binary uploads.", { readOnlyHint: false, destructiveHint: true }, undefined, undefined, {
+        cfTool("cloudflare_api_mutate", "Call JSON mutations for Global API Key identity or R2 jurisdiction/storage-class header gaps. Ordinary API-token writes use hosted execute. Bucket PATCH accepts cf-r2-storage-class: Standard or InfrequentAccess; no uploads.", { readOnlyHint: false, destructiveHint: true }, undefined, undefined, {
             method: {
                 type: "string",
                 enum: ["POST", "PUT", "PATCH", "DELETE"],
@@ -1334,7 +1293,7 @@ function buildTools(scope, authentication) {
             body: {
                 type: ["object", "array", "string", "number", "boolean", "null"],
                 description: "JSON request body exactly as documented by Cloudflare. Omit for endpoints with no body.",
-            }
+            },
         }, ["method", "path"], {
             type: "object",
             properties: {
@@ -1350,6 +1309,9 @@ function buildTools(scope, authentication) {
         }, async (args, ctx) => {
             const method = String(args["method"]);
             const spec = rawSpec(args);
+            if (authentication === "apiToken" && !needsMutationHeaders(method, spec)) {
+                throw new ConnectorCallError("invalid_args", "Use the Cloudflare MCP execute tool for JSON mutations with an API token. This REST tool is reserved for Global API Key identity, R2 bucket operations requiring cf-r2-jurisdiction, or bucket PATCH with cf-r2-storage-class set to Standard or InfrequentAccess.");
+            }
             const { result, resultInfo } = await callCloudflare(send, compact({
                 method,
                 ...spec,
@@ -1416,7 +1378,7 @@ function buildTools(scope, authentication) {
                     required: ["name", "fileName", "contentType"],
                     additionalProperties: false,
                 },
-            }
+            },
         }, ["method", "path"], {
             type: "object",
             properties: {
@@ -1427,6 +1389,9 @@ function buildTools(scope, authentication) {
             required: ["result"],
         }, async (args, ctx) => {
             const spec = rawSpec(args);
+            if (authentication === "apiToken" && !isUploadEndpoint(args["method"], spec.path)) {
+                throw new ConnectorCallError("invalid_args", "Use the Cloudflare MCP execute tool for this mutation. REST uploads are confined to Workers, KV values, R2 objects, Images, Stream and Pages upload endpoints.");
+            }
             const upload = uploadBody(args);
             const { result } = await callCloudflare(send, compact({
                 method: String(args["method"]),
@@ -1444,7 +1409,7 @@ function buildTools(scope, authentication) {
                 description: "Filter by exact account name.",
             },
             ...pagingInputProperties(5, 50, { defaultPerPage: 20 }),
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("accounts", ACCOUNT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
@@ -1472,7 +1437,7 @@ function buildTools(scope, authentication) {
                 description: "Filter by zone status.",
             },
             ...pagingInputProperties(5, 50, { defaultPerPage: 20 }),
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("zones", ZONE_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
@@ -1493,8 +1458,8 @@ function buildTools(scope, authentication) {
             return pagedList("zones", projectZone)(result, resultInfo, args["raw"] === true);
         }),
         cfTool("get_zone", "Fetch one zone's settings summary by id: status, plan, name servers, and owning account.", readOnly, "zoneId", scope.zoneId, {
-            raw: RAW_INPUT_PROPERTY
-        }, [], ZONE_SCHEMA, getResult(send, (args) => ({ method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }), (result, args) => args["raw"] === true ? result : projectZone(result))),
+            raw: RAW_INPUT_PROPERTY,
+        }, [], ZONE_SCHEMA, getResult(send, (args) => ({ method: "GET", path: `/zones/${encodeURIComponent(zoneArg(args))}` }), (result, args) => (args["raw"] === true ? result : projectZone(result)))),
         // No bulk `list_zone_settings` on purpose (#361): Cloudflare's published
         // document marks GET /zones/{zoneId}/settings and its PATCH sibling
         // deprecated with no bulk replacement, and the tool projected nothing while
@@ -1504,26 +1469,11 @@ function buildTools(scope, authentication) {
         // the caller's risk rather than promised by connecta's catalog.
         cfTool("get_zone_setting", "Get one zone setting by its Cloudflare setting id, such as ssl, always_use_https, min_tls_version, brotli, or development_mode.", readOnly, "zoneId", scope.zoneId, {
             settingId: SETTING_ID_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, ["settingId"], ZONE_SETTING_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
-        }), (result, args) => args["raw"] === true ? result : projectZoneSetting(result))),
-        cfTool("update_zone_setting", "Set one editable zone setting. Read it first: allowed value types and plan restrictions differ by setting.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
-            settingId: SETTING_ID_PROPERTY,
-            value: {
-                type: ["string", "number", "boolean", "array"],
-                description: "New setting value in the type returned by get_zone_setting. Arrays must contain strings.",
-                items: { type: "string" },
-            }
-        }, ["settingId", "value"], ZONE_SETTING_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "PATCH",
-                path: `/zones/${encodeURIComponent(zoneArg(args))}/settings/${encodeURIComponent(requireString(args, "settingId"))}`,
-                body: { value: args["value"] },
-            }, ctx);
-            return projectZoneSetting(result);
-        }),
+        }), (result, args) => (args["raw"] === true ? result : projectZoneSetting(result)))),
         cfTool("list_zone_rulesets", "List zone rulesets for WAF, redirects, transforms, cache rules, configuration rules, and other Ruleset Engine phases.", readOnly, "zoneId", scope.zoneId, {
             perPage: {
                 type: "integer",
@@ -1531,7 +1481,7 @@ function buildTools(scope, authentication) {
                 maximum: 50,
                 description: "Rulesets per request, 1 to 50.",
             },
-            cursor: CURSOR_INPUT_PROPERTY
+            cursor: CURSOR_INPUT_PROPERTY,
         }, [], {
             type: "object",
             properties: {
@@ -1559,7 +1509,7 @@ function buildTools(scope, authentication) {
                 type: "string",
                 minLength: 1,
                 description: "Ruleset id from list_zone_rulesets.",
-            }
+            },
         }, ["rulesetId"], RULESET_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/rulesets/${encodeURIComponent(requireString(args, "rulesetId"))}`,
@@ -1595,7 +1545,7 @@ function buildTools(scope, authentication) {
                 defaultPerPage: 100,
                 bounds: "clamped",
             }),
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("records", DNS_RECORD_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
@@ -1614,13 +1564,13 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_dns_record", "Fetch one DNS record by its record id.", readOnly, "zoneId", scope.zoneId, {
             recordId: RECORD_ID_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, ["recordId"], DNS_RECORD_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(String(args["recordId"]))}`,
-        }), (result, args) => args["raw"] === true ? result : projectDnsRecord(result))),
+        }), (result, args) => (args["raw"] === true ? result : projectDnsRecord(result)))),
         cfTool("list_worker_scripts", "List Workers scripts deployed in an account, with their last-modified times.", readOnly, "accountId", scope.accountId, {
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("scripts", {
             type: "object",
             properties: {
@@ -1639,52 +1589,32 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_worker_settings", "Get a Worker's compatibility date and flags, bindings, limits, observability, placement, usage model, and other script settings.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, ["scriptName"], WORKER_SETTINGS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/settings`,
-        }), (result, args) => args["raw"] === true ? result : projectWorkerSettings(result))),
+        }), (result, args) => (args["raw"] === true ? result : projectWorkerSettings(result)))),
         cfTool("list_worker_deployments", "List deployments of a Worker script, including version traffic allocations and deployment strategy.", readOnly, "accountId", scope.accountId, {
-            scriptName: SCRIPT_NAME_PROPERTY
+            scriptName: SCRIPT_NAME_PROPERTY,
         }, ["scriptName"], listOutputSchema("deployments", WORKER_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
                 path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments`,
             }, ctx);
             const record = asRecord(result);
-            const deployments = Array.isArray(result)
-                ? result
-                : asArray(record["deployments"]);
+            const deployments = Array.isArray(result) ? result : asArray(record["deployments"]);
             return { deployments: deployments.map(projectWorkerDeployment) };
         }),
         cfTool("get_worker_deployment", "Get one Worker deployment and its version traffic allocations.", readOnly, "accountId", scope.accountId, {
             scriptName: SCRIPT_NAME_PROPERTY,
-            deploymentId: WORKER_DEPLOYMENT_ID_PROPERTY
+            deploymentId: WORKER_DEPLOYMENT_ID_PROPERTY,
         }, ["scriptName", "deploymentId"], WORKER_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(requireString(args, "scriptName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
         }), projectWorkerDeployment)),
-        cfTool("delete_worker_script", "Delete a Worker script and stop traffic served by that script. This cannot be undone from the API.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            scriptName: SCRIPT_NAME_PROPERTY,
-            force: {
-                type: "boolean",
-                description: "Pass Cloudflare's force=true option when the script has dependencies that permit forced removal.",
-            }
-        }, ["scriptName"], {
-            type: "object",
-            properties: {
-                deleted: { type: "boolean" },
-                scriptName: { type: "string" },
-            },
-            required: ["deleted", "scriptName"],
-        }, deleteAck(send, "scriptName", (args) => requireString(args, "scriptName"), (args, scriptName) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/workers/scripts/${encodeURIComponent(scriptName)}`,
-            query: { force: typeof args["force"] === "boolean" ? args["force"] : undefined },
-        }))),
         cfTool("list_kv_namespaces", "List Workers KV namespaces in an account, with the namespace ids bindings refer to.", readOnly, "accountId", scope.accountId, {
             ...pagingInputProperties(1, 1000, { defaultPerPage: 20 }),
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("namespaces", {
             type: "object",
             properties: {
@@ -1706,61 +1636,11 @@ function buildTools(scope, authentication) {
             return pagedList("namespaces", projectKvNamespace)(result, resultInfo, args["raw"] === true);
         }),
         cfTool("get_kv_namespace", "Get one Workers KV namespace by id.", readOnly, "accountId", scope.accountId, {
-            namespaceId: NAMESPACE_ID_PROPERTY
+            namespaceId: NAMESPACE_ID_PROPERTY,
         }, ["namespaceId"], KV_NAMESPACE_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
         }), projectKvNamespace)),
-        cfTool("create_kv_namespace", "Create a Workers KV namespace.", { readOnlyHint: false }, "accountId", scope.accountId, {
-            title: {
-                type: "string",
-                minLength: 1,
-                maxLength: 512,
-                description: "Human-readable namespace title.",
-            },
-            jurisdiction: KV_JURISDICTION_PROPERTY
-        }, ["title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces`,
-                body: compact({
-                    title: requireString(args, "title"),
-                    jurisdiction: args["jurisdiction"],
-                }),
-            }, ctx);
-            return projectKvNamespace(result);
-        }),
-        cfTool("rename_kv_namespace", "Rename an existing Workers KV namespace without changing its id or keys.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            namespaceId: NAMESPACE_ID_PROPERTY,
-            title: {
-                type: "string",
-                minLength: 1,
-                maxLength: 512,
-                description: "Replacement namespace title.",
-            }
-        }, ["namespaceId", "title"], KV_NAMESPACE_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "PUT",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}`,
-                body: { title: requireString(args, "title") },
-            }, ctx);
-            return result
-                ? projectKvNamespace(result)
-                : { renamed: true, namespaceId: args["namespaceId"] };
-        }),
-        cfTool("delete_kv_namespace", "Permanently delete a Workers KV namespace and every key stored in it.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            namespaceId: NAMESPACE_ID_PROPERTY
-        }, ["namespaceId"], {
-            type: "object",
-            properties: {
-                deleted: { type: "boolean" },
-                namespaceId: { type: "string" },
-            },
-            required: ["deleted", "namespaceId"],
-        }, deleteAck(send, "namespaceId", (args) => requireString(args, "namespaceId"), (args, namespaceId) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(namespaceId)}`,
-        }))),
         cfTool("list_kv_keys", "List keys and metadata in a Workers KV namespace by prefix, using cursor pagination.", readOnly, "accountId", scope.accountId, {
             namespaceId: NAMESPACE_ID_PROPERTY,
             prefix: {
@@ -1773,7 +1653,7 @@ function buildTools(scope, authentication) {
                 maximum: 1000,
                 description: "Keys per request, 10 to 1000. Defaults to 1000.",
             },
-            cursor: CURSOR_INPUT_PROPERTY
+            cursor: CURSOR_INPUT_PROPERTY,
         }, ["namespaceId"], {
             type: "object",
             properties: {
@@ -1825,7 +1705,7 @@ function buildTools(scope, authentication) {
                 type: "string",
                 enum: ["text", "json"],
                 description: "Return strings as stored, or parse JSON values before returning them.",
-            }
+            },
         }, ["namespaceId", "keys"], KV_BULK_VALUES_SCHEMA, async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "POST",
@@ -1838,74 +1718,6 @@ function buildTools(scope, authentication) {
             }, ctx);
             return projectKvBulkValues(result);
         }),
-        cfTool("bulk_write_kv_values", "Create or replace multiple Workers KV values, with optional expirations and JSON metadata.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            namespaceId: NAMESPACE_ID_PROPERTY,
-            entries: {
-                type: "array",
-                minItems: 1,
-                maxItems: 10_000,
-                description: "Key/value entries to write, up to Cloudflare's 10,000-key bulk limit.",
-                items: {
-                    type: "object",
-                    properties: {
-                        key: {
-                            type: "string",
-                            minLength: 1,
-                            maxLength: 512,
-                            description: "Key name, up to Cloudflare's 512 bytes.",
-                        },
-                        value: {
-                            type: "string",
-                            maxLength: 26_214_400,
-                            description: "Value, up to Cloudflare's 25 MiB.",
-                        },
-                        expiration: {
-                            type: "number",
-                            description: "Absolute expiry as a Unix timestamp in seconds.",
-                        },
-                        expiration_ttl: {
-                            type: "number",
-                            minimum: 60,
-                            description: "Relative expiry in seconds; Cloudflare's floor is 60.",
-                        },
-                        metadata: {
-                            type: ["object", "array", "string", "number", "boolean", "null"],
-                            description: "JSON metadata returned beside the key by list_kv_keys.",
-                        },
-                        base64: {
-                            type: "boolean",
-                            description: "Treat value as base64 and store the decoded bytes.",
-                        },
-                    },
-                    required: ["key", "value"],
-                    additionalProperties: false,
-                },
-            }
-        }, ["namespaceId", "entries"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "PUT",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk`,
-                body: args["entries"],
-            }, ctx);
-            return projectKvBulkResult(result);
-        }),
-        cfTool("bulk_delete_kv_values", "Permanently delete multiple keys from a Workers KV namespace.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            namespaceId: NAMESPACE_ID_PROPERTY,
-            keys: {
-                type: "array",
-                minItems: 1,
-                maxItems: 10_000,
-                items: { type: "string", minLength: 1, maxLength: 512 },
-                description: "Key names to delete, up to Cloudflare's 10,000-key bulk limit.",
-            }
-        }, ["namespaceId", "keys"], KV_BULK_RESULT_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/storage/kv/namespaces/${encodeURIComponent(requireString(args, "namespaceId"))}/bulk/delete`,
-                body: args["keys"],
-            }, ctx);
-            return projectKvBulkResult(result);
-        }),
         cfTool("list_r2_buckets", "List R2 buckets in an account, with location and storage class.", readOnly, "accountId", scope.accountId, {
             nameContains: {
                 type: "string",
@@ -1919,7 +1731,7 @@ function buildTools(scope, authentication) {
             },
             cursor: CURSOR_INPUT_PROPERTY,
             jurisdiction: R2_JURISDICTION_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], {
             type: "object",
             properties: {
@@ -1954,72 +1766,12 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_r2_bucket", "Get one R2 bucket's location, jurisdiction, storage class, and creation time.", readOnly, "accountId", scope.accountId, {
             bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY
+            jurisdiction: R2_JURISDICTION_PROPERTY,
         }, ["bucketName"], R2_BUCKET_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}`,
             headers: r2Headers(args),
         }), projectR2Bucket)),
-        cfTool("create_r2_bucket", "Create an R2 bucket with an optional location hint and default storage class.", { readOnlyHint: false }, "accountId", scope.accountId, {
-            bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY,
-            locationHint: {
-                type: "string",
-                enum: ["apac", "eeur", "enam", "weur", "wnam", "oc"],
-                description: "Optional placement hint for the new bucket.",
-            },
-            storageClass: {
-                type: "string",
-                enum: ["Standard", "InfrequentAccess"],
-                description: "Default storage class for new objects.",
-            }
-        }, ["bucketName"], R2_BUCKET_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets`,
-                headers: r2Headers(args),
-                body: compact({
-                    name: requireString(args, "bucketName"),
-                    locationHint: args["locationHint"],
-                    storageClass: args["storageClass"],
-                }),
-            }, ctx);
-            return projectR2Bucket(result);
-        }),
-        cfTool("update_r2_bucket", "Change the default storage class used for newly uploaded objects in an R2 bucket.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY,
-            storageClass: {
-                type: "string",
-                enum: ["Standard", "InfrequentAccess"],
-                description: "New default storage class for future uploads.",
-            }
-        }, ["bucketName", "storageClass"], R2_BUCKET_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "PATCH",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}`,
-                headers: {
-                    ...r2Headers(args),
-                    "cf-r2-storage-class": String(args["storageClass"]),
-                },
-            }, ctx);
-            return projectR2Bucket(result);
-        }),
-        cfTool("delete_r2_bucket", "Permanently delete an empty R2 bucket and all of its configuration. Cloudflare refuses non-empty buckets.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY
-        }, ["bucketName"], {
-            type: "object",
-            properties: {
-                deleted: { type: "boolean" },
-                bucketName: { type: "string" },
-            },
-            required: ["deleted", "bucketName"],
-        }, deleteAck(send, "bucketName", (args) => requireString(args, "bucketName"), (args, bucketName) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(bucketName)}`,
-            headers: r2Headers(args),
-        }))),
         cfTool("list_r2_objects", "List object keys and metadata in an R2 bucket by prefix, with delimiter grouping and cursor pagination.", readOnly, "accountId", scope.accountId, {
             bucketName: R2_BUCKET_NAME_PROPERTY,
             jurisdiction: R2_JURISDICTION_PROPERTY,
@@ -2043,7 +1795,7 @@ function buildTools(scope, authentication) {
                 maximum: 1000,
                 description: "Objects per request, 1 to 1000.",
             },
-            cursor: CURSOR_INPUT_PROPERTY
+            cursor: CURSOR_INPUT_PROPERTY,
         }, ["bucketName"], {
             type: "object",
             properties: {
@@ -2069,33 +1821,11 @@ function buildTools(scope, authentication) {
             const cursor = resultInfo?.cursor;
             return {
                 objects: asArray(result).map(projectR2Object),
-                ...(Array.isArray(resultInfo?.delimited)
-                    ? { commonPrefixes: resultInfo.delimited }
-                    : {}),
+                ...(Array.isArray(resultInfo?.delimited) ? { commonPrefixes: resultInfo.delimited } : {}),
                 ...cursorResult(cursor),
                 truncated: resultInfo?.is_truncated === true,
             };
         }),
-        cfTool("delete_r2_object", "Permanently delete one object from an R2 bucket by key.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY,
-            objectKey: {
-                type: "string",
-                minLength: 1,
-                description: "Exact object key. Slashes are preserved as path separators.",
-            }
-        }, ["bucketName", "objectKey"], {
-            type: "object",
-            properties: {
-                deleted: { type: "boolean" },
-                objectKey: { type: "string" },
-            },
-            required: ["deleted", "objectKey"],
-        }, deleteAck(send, "objectKey", (args) => requireString(args, "objectKey"), (args, objectKey) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}/objects/${encodeObjectKey(objectKey)}`,
-            headers: r2Headers(args),
-        }))),
         // No `get_r2_metrics`, `set_r2_cors`, or `delete_r2_cors` on purpose (#350).
         // A named tool is a permanent line item in every deployment's catalog, and
         // these lost the comparison against the escape hatches: `get_r2_metrics`
@@ -2110,7 +1840,7 @@ function buildTools(scope, authentication) {
         // PUT/DELETE /accounts/{accountId}/r2/buckets/{bucketName}/cors.
         cfTool("get_r2_cors", "Get the browser CORS rules configured on an R2 bucket.", readOnly, "accountId", scope.accountId, {
             bucketName: R2_BUCKET_NAME_PROPERTY,
-            jurisdiction: R2_JURISDICTION_PROPERTY
+            jurisdiction: R2_JURISDICTION_PROPERTY,
         }, ["bucketName"], R2_CORS_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/r2/buckets/${encodeURIComponent(requireString(args, "bucketName"))}/cors`,
@@ -2118,7 +1848,7 @@ function buildTools(scope, authentication) {
         }), projectR2Cors)),
         cfTool("list_pages_projects", "List Cloudflare Pages projects in an account, with their production branch and latest deployment.", readOnly, "accountId", scope.accountId, {
             ...pagingInputProperties(1, 100, { bounds: "undocumented" }),
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, [], listOutputSchema("projects", PAGES_PROJECT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
@@ -2132,11 +1862,11 @@ function buildTools(scope, authentication) {
         }),
         cfTool("get_pages_project", "Get one Pages project, including build configuration, deployment configuration, domains, and latest deployment.", readOnly, "accountId", scope.accountId, {
             projectName: PROJECT_NAME_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, ["projectName"], PAGES_PROJECT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}`,
-        }), (result, args) => args["raw"] === true ? result : projectPagesProject(result))),
+        }), (result, args) => (args["raw"] === true ? result : projectPagesProject(result)))),
         cfTool("list_pages_deployments", "List production and preview deployments for a Pages project.", readOnly, "accountId", scope.accountId, {
             projectName: PROJECT_NAME_PROPERTY,
             env: {
@@ -2144,7 +1874,7 @@ function buildTools(scope, authentication) {
                 enum: ["production", "preview"],
                 description: "Optional deployment environment filter.",
             },
-            ...pagingInputProperties(1, 100, { bounds: "undocumented" })
+            ...pagingInputProperties(1, 100, { bounds: "undocumented" }),
         }, ["projectName"], listOutputSchema("deployments", PAGES_DEPLOYMENT_SCHEMA), async (args, ctx) => {
             const { result, resultInfo } = await callCloudflare(send, {
                 method: "GET",
@@ -2163,40 +1893,13 @@ function buildTools(scope, authentication) {
         cfTool("get_pages_deployment", "Get one Pages deployment including its environment, URLs, stages, source, and build configuration.", readOnly, "accountId", scope.accountId, {
             projectName: PROJECT_NAME_PROPERTY,
             deploymentId: DEPLOYMENT_ID_PROPERTY,
-            raw: RAW_INPUT_PROPERTY
+            raw: RAW_INPUT_PROPERTY,
         }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, getResult(send, (args) => ({
             method: "GET",
             path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}`,
-        }), (result, args) => args["raw"] === true ? result : projectPagesDeployment(result))),
-        cfTool("retry_pages_deployment", "Retry a failed or cancelled Pages deployment using its existing source and build configuration.", { readOnlyHint: false }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY,
-            deploymentId: RETRY_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/retry`,
-            }, ctx);
-            return projectPagesDeployment(result);
-        }),
-        cfTool("rollback_pages_deployment", "Promote a previous Pages deployment to production, replacing the currently served production deployment.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY,
-            deploymentId: ROLLBACK_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], PAGES_DEPLOYMENT_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(requireString(args, "deploymentId"))}/rollback`,
-            }, ctx);
-            return projectPagesDeployment(result);
-        }),
-        cfTool("delete_pages_deployment", "Permanently delete a Pages deployment and its immutable deployment URL.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY,
-            deploymentId: DELETE_DEPLOYMENT_ID_PROPERTY
-        }, ["projectName", "deploymentId"], { type: "object", properties: { deleted: { type: "boolean" }, deploymentId: { type: "string" } }, required: ["deleted", "deploymentId"] }, deleteAck(send, "deploymentId", (args) => requireString(args, "deploymentId"), (args, deploymentId) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/deployments/${encodeURIComponent(deploymentId)}`,
-        }))),
+        }), (result, args) => (args["raw"] === true ? result : projectPagesDeployment(result)))),
         cfTool("list_pages_domains", "List custom domains attached to a Pages project and their validation status.", readOnly, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY
+            projectName: PAGES_PROJECT_NAME_PROPERTY,
         }, ["projectName"], listOutputSchema("domains", PAGES_DOMAIN_SCHEMA), async (args, ctx) => {
             const { result } = await callCloudflare(send, {
                 method: "GET",
@@ -2204,275 +1907,6 @@ function buildTools(scope, authentication) {
             }, ctx);
             return { domains: asArray(result).map(projectPagesDomain) };
         }),
-        cfTool("add_pages_domain", "Attach a custom domain to a Pages project. DNS ownership and validation still apply.", { readOnlyHint: false }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY,
-            domain: { type: "string", minLength: 1, description: "Fully qualified custom domain to attach." }
-        }, ["projectName", "domain"], PAGES_DOMAIN_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains`,
-                body: { name: requireString(args, "domain") },
-            }, ctx);
-            return projectPagesDomain(result);
-        }),
-        cfTool("delete_pages_domain", "Detach a custom domain from a Pages project.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY,
-            domain: { type: "string", minLength: 1, description: "Custom domain to detach." }
-        }, ["projectName", "domain"], { type: "object", properties: { deleted: { type: "boolean" }, domain: { type: "string" } }, required: ["deleted", "domain"] }, deleteAck(send, "domain", (args) => requireString(args, "domain"), (args, domain) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/domains/${encodeURIComponent(domain)}`,
-        }))),
-        cfTool("purge_pages_build_cache", "Clear a Pages project's build cache so its next deployment rebuilds dependencies and artifacts from scratch.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            projectName: PAGES_PROJECT_NAME_PROPERTY
-        }, ["projectName"], { type: "object", properties: { purged: { type: "boolean" } }, required: ["purged"] }, async (args, ctx) => {
-            await callCloudflare(send, {
-                method: "POST",
-                path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(requireString(args, "projectName"))}/purge_build_cache`,
-            }, ctx);
-            return { purged: true };
-        }),
-        cfTool("delete_pages_project", "Permanently delete a Pages project, its deployments, and project configuration.", { readOnlyHint: false, destructiveHint: true }, "accountId", scope.accountId, {
-            projectName: DELETE_PROJECT_NAME_PROPERTY
-        }, ["projectName"], { type: "object", properties: { deleted: { type: "boolean" }, projectName: { type: "string" } }, required: ["deleted", "projectName"] }, deleteAck(send, "projectName", (args) => requireString(args, "projectName"), (args, projectName) => ({
-            method: "DELETE",
-            path: `/accounts/${encodeURIComponent(accountArg(args))}/pages/projects/${encodeURIComponent(projectName)}`,
-        }))),
-        cfTool(
-        // Additive: brings a record into being and destroys nothing, so
-        // `destructiveHint` stays unset. `readOnlyHint: false` already routes it
-        // through call_destructive_tool.
-        "create_dns_record", "Create a content-based DNS record in a zone; the type enum lists the creatable types. Check list_dns_records first — Cloudflare rejects a duplicate rather than replacing it. Structured types like SRV and CAA are readable but not creatable.", { readOnlyHint: false }, "zoneId", scope.zoneId, {
-            type: {
-                type: "string",
-                enum: [...CLOUDFLARE_CONTENT_DNS_RECORD_TYPES],
-                description: "Record type.",
-            },
-            name: {
-                type: "string",
-                description: "Record name. Use the apex domain for the root, or a fully qualified subdomain, e.g. www.example.com.",
-            },
-            content: {
-                type: "string",
-                description: "Record value: an IPv4 address for A, IPv6 for AAAA, a hostname for CNAME/MX/NS, or the text body for TXT.",
-            },
-            ttl: {
-                type: "integer",
-                minimum: 1,
-                maximum: 86400,
-                description: "Time to live in seconds. 1 means automatic, which is what a proxied record must use; any other value must be at least 60 (30 on Enterprise zones). Defaults to 1.",
-            },
-            proxied: {
-                type: "boolean",
-                description: "Route through Cloudflare's proxy. Only A, AAAA, and CNAME records are proxiable. Defaults to false.",
-            },
-            priority: {
-                type: "integer",
-                minimum: 0,
-                maximum: 65535,
-                description: "Mail-server preference. MX records only.",
-            },
-            comment: {
-                type: "string",
-                description: "Operator-facing note stored with the record.",
-            },
-            tags: {
-                type: "array",
-                items: { type: "string" },
-                description: "Custom tags, available on paid plans.",
-            }
-        }, ["type", "name", "content"], DNS_RECORD_SCHEMA, async (args, ctx) => {
-            const { result } = await callCloudflare(send, {
-                method: "POST",
-                path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records`,
-                body: compact({
-                    type: args["type"],
-                    name: args["name"],
-                    content: args["content"],
-                    ttl: optionalNumber(args, "ttl") ?? 1,
-                    proxied: args["proxied"],
-                    priority: args["priority"],
-                    comment: args["comment"],
-                    tags: args["tags"],
-                }),
-            }, ctx);
-            return projectDnsRecord(result);
-        }),
-        cfTool(
-        // Destructive: it overwrites what a record already resolves to.
-        "update_dns_record", "Update fields on an existing DNS record. Only the supplied fields change; everything else keeps its current value. Changing content on a live record repoints traffic immediately.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
-            recordId: RECORD_ID_PROPERTY,
-            type: {
-                type: "string",
-                enum: [...CLOUDFLARE_CONTENT_DNS_RECORD_TYPES],
-                description: "Record type. Send it whenever content changes; Cloudflare treats type and content as a pair.",
-            },
-            name: { type: "string", description: "Fully qualified record name." },
-            content: { type: "string", description: "New record value." },
-            ttl: {
-                type: "integer",
-                minimum: 1,
-                maximum: 86400,
-                description: "Seconds; 1 means automatic, otherwise at least 60 (30 on Enterprise zones).",
-            },
-            proxied: {
-                type: "boolean",
-                description: "Route through Cloudflare's proxy. Only A, AAAA, and CNAME records are proxiable, and a proxied record must use ttl 1.",
-            },
-            priority: {
-                type: "integer",
-                minimum: 0,
-                maximum: 65535,
-                description: "Mail-server preference. MX records only.",
-            },
-            comment: {
-                type: "string",
-                description: "Operator-facing note stored with the record. Replaces the existing note.",
-            },
-            tags: {
-                type: "array",
-                items: { type: "string" },
-                description: "Custom tags, available on paid plans. Replaces the existing tag set rather than adding to it.",
-            }
-        }, ["recordId"], DNS_RECORD_SCHEMA, async (args, ctx) => {
-            const body = {};
-            for (const key of [
-                "type",
-                "name",
-                "content",
-                "ttl",
-                "proxied",
-                "priority",
-                "comment",
-                "tags",
-            ]) {
-                if (args[key] !== undefined)
-                    body[key] = args[key];
-            }
-            if (Object.keys(body).length === 0) {
-                throw new ConnectorCallError("invalid_args", "update_dns_record needs at least one field to change besides zoneId and recordId.", {
-                    validation: {
-                        issues: [
-                            {
-                                path: "/",
-                                code: "anyOf",
-                                expected: "at least one of type, name, content, ttl, proxied, priority, comment, tags",
-                            },
-                        ],
-                    },
-                });
-            }
-            const { result } = await callCloudflare(send, {
-                method: "PATCH",
-                path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(String(args["recordId"]))}`,
-                body,
-            }, ctx);
-            return projectDnsRecord(result);
-        }),
-        cfTool("delete_dns_record", "Delete a DNS record by id. The record stops resolving immediately and Cloudflare keeps no undo.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
-            recordId: RECORD_ID_PROPERTY
-        }, ["recordId"], {
-            type: "object",
-            properties: {
-                deleted: { type: "boolean" },
-                recordId: { type: "string" },
-            },
-            required: ["deleted", "recordId"],
-        }, deleteAck(send, "recordId", (args) => String(args["recordId"]), (args, recordId) => ({
-            method: "DELETE",
-            path: `/zones/${encodeURIComponent(zoneArg(args))}/dns_records/${encodeURIComponent(recordId)}`,
-        }))),
-        cfTool("purge_cache", "Purge Cloudflare's edge cache for a zone. Prefer files, tags, hosts, or prefixes; everything discards the entire zone cache and sends every subsequent request to the origin until the cache refills.", { readOnlyHint: false, destructiveHint: true }, "zoneId", scope.zoneId, {
-            everything: {
-                type: "boolean",
-                description: "Purge the entire zone cache. Mutually exclusive with the targeted options below, and a real load event for the origin.",
-            },
-            files: {
-                type: "array",
-                items: { type: "string" },
-                minItems: 1,
-                maxItems: 100,
-                description: "Absolute URLs to purge, e.g. https://example.com/style.css. Up to 100 per request (500 on Enterprise).",
-            },
-            tags: {
-                type: "array",
-                items: { type: "string" },
-                minItems: 1,
-                maxItems: 100,
-                description: "Cache-Tag values to purge. Up to 100 per request; available on every plan.",
-            },
-            hosts: {
-                type: "array",
-                items: { type: "string" },
-                minItems: 1,
-                maxItems: 100,
-                description: "Hostnames to purge. Up to 100 per request; available on every plan.",
-            },
-            prefixes: {
-                type: "array",
-                items: { type: "string" },
-                minItems: 1,
-                maxItems: 100,
-                description: "URL prefixes to purge, e.g. example.com/assets. Up to 100 per request; available on every plan.",
-            }
-        }, [], {
-            type: "object",
-            properties: {
-                purged: { type: "boolean" },
-                zoneId: { type: "string" },
-                scope: {
-                    type: "string",
-                    description: "Which variant ran: everything, files, tags, hosts, or prefixes.",
-                },
-            },
-            required: ["purged", "zoneId", "scope"],
-        }, async (args, ctx) => {
-            const zoneId = zoneArg(args);
-            const targeted = ["files", "tags", "hosts", "prefixes"].filter((key) => Array.isArray(args[key]) && args[key].length > 0);
-            const everything = args["everything"] === true;
-            // One variant per call is this connection's contract, not a
-            // documented API restriction: Cloudflare's schema models the body as
-            // `anyOf`, which does not forbid combining. Refusing locally gives an
-            // agent `invalid_args` naming the conflict instead of a purge whose
-            // actual scope is ambiguous. Combined purging would be a deliberate
-            // change here.
-            if (everything && targeted.length > 0) {
-                throw new ConnectorCallError("invalid_args", "purge_cache takes either everything: true or one targeted list, never both.", {
-                    validation: {
-                        issues: [
-                            {
-                                path: "/everything",
-                                code: "oneOf",
-                                expected: "everything: true alone, or exactly one of files, tags, hosts, prefixes",
-                            },
-                        ],
-                    },
-                });
-            }
-            if (!everything && targeted.length !== 1) {
-                throw new ConnectorCallError("invalid_args", targeted.length === 0
-                    ? "purge_cache needs everything: true or one of files, tags, hosts, or prefixes."
-                    : `purge_cache takes exactly one targeted list; received ${targeted.join(", ")}.`, {
-                    validation: {
-                        issues: [
-                            {
-                                path: "/",
-                                code: "oneOf",
-                                expected: "everything: true, or exactly one of files, tags, hosts, prefixes",
-                            },
-                        ],
-                    },
-                });
-            }
-            const variant = everything ? "everything" : targeted[0];
-            await callCloudflare(send, {
-                method: "POST",
-                path: `/zones/${encodeURIComponent(zoneId)}/purge_cache`,
-                body: everything
-                    ? { purge_everything: true }
-                    : { [variant]: args[variant] },
-            }, ctx);
-            return { purged: true, zoneId, scope: variant };
-        }),
     ];
     return tools;
 }
@@ -2485,66 +1919,43 @@ function apiUsageGuide(purpose, scope, instructions, authentication) {
         ? `It defaults to account \`${scope.accountId}\`; omit \`accountId\` unless the request names a different account.`
         : "It declares no default account. `list_accounts` supplies the `accountId` the Workers, KV, R2, and Pages tools need.";
     const authenticationLine = authentication === "apiToken"
-        ? "The API token is operator-managed and scoped by permission. An `auth_required` failure means the token is missing, invalid, or lacks that call's permission. Call `verify_api_token` first."
-        : "The Global API Key and account email are operator-managed. The key has the same access as its Cloudflare user. An `auth_required` failure means one field is missing, the pair is invalid, or the user lacks access. Call `verify_global_api_key` first.";
+        ? "The API token is operator-managed and scoped by permission. An `auth_required` failure means the token is missing or invalid. A `provider_permission_denied` failure asks an administrator to grant resource permission and token scope. Call `verify_api_token` first."
+        : "The Global API Key and account email are operator-managed. The key has the same access as its Cloudflare user. An `auth_required` failure means one field is missing or the pair is invalid. A `provider_permission_denied` failure asks an administrator to grant the user access. Call `verify_global_api_key` first.";
     return `# Cloudflare usage
 
 Account purpose: ${purpose}
 
 - ${zoneLine}
-- ${accountLine}
-- Prefer a named tool: its schema is complete, projected, and enough to call it without provider documentation. For an operation without a named tool, use \`cloudflare_api_get\` for GET, \`cloudflare_api_mutate\` for JSON POST/PUT/PATCH/DELETE, or \`cloudflare_api_upload\` for raw and multipart content. Raw tools take a path below \`/client/v4\`; their argument schemas are complete, but endpoint-specific query, header, and body fields come from Cloudflare's API reference. Use \`headers\` for endpoint-specific controls such as \`cf-r2-jurisdiction\`, \`Range\`, \`If-None-Match\`, and Cloudflare product metadata. \`Authorization\`, \`Cookie\`, \`Host\`, \`Content-Length\`, \`Content-Type\`, and \`Transfer-Encoding\` are connector-owned and refused: authentication, host, content type, and request framing are not the caller's to set.
-- The raw tools cover the wider control plane without weakening routing: GET is explicitly read-only; every mutation and upload is destructive and must cross the host's approval boundary. The configured Cloudflare credential remains the hard provider-side permission boundary. Absolute URLs, traversal, and query strings embedded in \`path\` are refused locally.
-- Useful raw paths include \`/accounts/{accountId}/images/v1\` (Images), \`/accounts/{accountId}/stream\` (Stream), \`/zones/{zoneId}/email/routing/rules\` (Email Routing), \`/accounts/{accountId}/d1/database\` (D1), and \`/accounts/{accountId}/queues\` (Queues). On GET, use \`responseType: "text"\` or \`"base64"\` for non-JSON content. Direct-upload endpoints can issue upload URLs; \`cloudflare_api_upload\` can also send explicit text, base64 bytes, or multipart fields/files.
-- Three areas are deliberately unnamed. Read a bucket's CORS policy with \`get_r2_cors\`, then change it with \`cloudflare_api_mutate\` — \`PUT\` or \`DELETE /accounts/{accountId}/r2/buckets/{bucketName}/cors\`, rule fields per Cloudflare's reference — and read account storage totals with \`cloudflare_api_get\` at \`/accounts/{accountId}/r2/metrics\`. Zone settings are read one at a time with \`get_zone_setting\`: Cloudflare deprecated the bulk \`/zones/{zoneId}/settings\` read and published no replacement for it, so reach for the whole set through \`cloudflare_api_get\` only when one setting genuinely will not do.
-- Lists paginate with \`page\` and \`perPage\` and return a \`page\` object; request the next page only when \`page.hasMore\` is true. \`list_zone_rulesets\`, \`list_r2_buckets\`, \`list_r2_objects\`, and \`list_kv_keys\` page by cursor instead: pass \`cursor\`, continue while \`nextCursor\` is present, and expect no \`page\` object. Their schemas say so too. \`list_worker_scripts\` is unpaginated.
-- Results are projected to the fields that identify and describe a resource. Pass \`raw: true\` on a read when you genuinely need a field the projection drops.
-- ${authenticationLine}
-- A \`rate_limited\` failure carries the wait window. Cloudflare's limit is 1,200 requests per five minutes per user, counted across the dashboard and every token, so do not fan out speculatively; filter server-side with \`name\`, \`type\`, and \`content\` instead of listing everything and filtering locally.
-- Named creates that only add a resource are write-routed without claiming destruction. Updates, overwrites, deletes, rollbacks, cache purges, \`cloudflare_api_mutate\`, and \`cloudflare_api_upload\` are destructive. Read current state before changing it, and prefer a targeted \`purge_cache\` over \`everything\`.
-${accountInstructions
-        ? `\n## Account instructions\n\n${accountInstructions}\n`
-        : ""}`;
+- ${accountLine}${skill.fragments.guide_0}${authenticationLine}${skill.fragments.guide_1}${accountInstructions ? `\n## ${skill.instructionsHeading}\n\n${accountInstructions}\n` : ""}`;
 }
-export const CLOUDFLARE_MCP_VETTED_CATALOG = vettedCatalog({
-    reads: new Set(["search"]),
-    // `execute` can send any method to more than 2,500 API endpoints. Its input
-    // schema cannot prove a particular program is observational, so it stays on
-    // the approval path even when that program happens to issue only GETs.
-    writes: new Map([["execute", "destructive"]]),
-});
+/**
+ * Reviewed in #705's provider audit against https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/.
+ * Retains the release-reviewed inventory, including names absent from today's
+ * public reference. Live annotations were not reverified without credentials.
+ * No schema digest is asserted without a captured schema to review.
+ */
+const CLOUDFLARE_MCP_CLASSIFICATION = {
+    tools: {
+        "search": {
+            "verdict": "read",
+            "reason": "Searches the Cloudflare OpenAPI contract without executing API methods.",
+        },
+        "execute": {
+            "verdict": "destructive",
+            "reason": "Can mix HTTP methods across the Cloudflare API; no input schema proves a program only reads.",
+        },
+    },
+};
 function mcpUsageGuide(purpose, instructions) {
     const accountInstructions = instructions?.trim();
     return `# Cloudflare MCP usage
 
-Official whole-API MCP interface: ${purpose}
-
-- The catalog contains \`search\` and \`execute\`. Search runs code against
-  Cloudflare's OpenAPI document. Execute runs code that may call any authorized
-  Cloudflare API endpoint.
-- Use \`search\` to find the exact method, path, and fields before writing an
-  execute program. Do not guess an endpoint from product naming.
-- Connecta routes every \`execute\` call through approval because the tool can
-  mix GET, POST, PUT, PATCH, and DELETE requests inside one program. The MCP
-  schema cannot establish that arbitrary code is read-only.
-- Keep returned values small. Filter and project inside the Cloudflare MCP
-  program, then reduce again inside Connecta's \`execute_code\` when several
-  calls must be joined.
-- OAuth and API-token permissions remain the provider-side boundary. An
-  \`auth_required\` failure needs authorization or a token with the required
-  Cloudflare permission.
-${accountInstructions
-        ? `\n## Account instructions\n\n${accountInstructions}\n`
-        : ""}`;
+Official whole-API MCP interface: ${purpose}${skill.fragments.guide_2}${accountInstructions ? `\n## ${skill.instructionsHeading}\n\n${accountInstructions}\n` : ""}`;
 }
-function cloudflareMcp(id, purpose, options) {
+function cloudflareMcp(id, purpose, options, provider) {
     const connector = remoteMcp(id, {
         url: CLOUDFLARE_MCP_ENDPOINT,
-        ...defined({
-            authScope: options.authScope,
-            callAdmission: options.callAdmission,
-            maxResultBytes: options.maxResultBytes,
-        }),
+        ...provider.connectorOptions,
         title: options.title ?? "Cloudflare (MCP)",
         description: `Cloudflare's official whole-API MCP interface: ${purpose}`,
         auth: withCredentialDefaults(options.auth ?? { type: "oauth" }, {
@@ -2555,13 +1966,14 @@ function cloudflareMcp(id, purpose, options) {
             },
         }),
         requireHttps: true,
+        classify: provider.classify,
         usageGuide: {
             content: mcpUsageGuide(purpose, options.instructions),
-            summary: "Official whole-API MCP. Search the OpenAPI document, then approve each mixed-method execute program.",
+            summary: "Official whole-API MCP. Search the OpenAPI document; execute programs always classify as writes.",
             required: true,
         },
     });
-    return withVettedCatalog(connector, CLOUDFLARE_MCP_VETTED_CATALOG);
+    return connector;
 }
 function cloudflareApi(id, purpose, options) {
     const maxConcurrency = options.maxConcurrency ?? 6;
@@ -2595,9 +2007,7 @@ function cloudflareApi(id, purpose, options) {
             // so forcing the guide into context before every operation would spend
             // tokens on a sequence the schemas already express.
         },
-        ...(options.maxResultBytes !== undefined
-            ? { maxResultBytes: options.maxResultBytes }
-            : {}),
+        ...(options.maxResultBytes !== undefined ? { maxResultBytes: options.maxResultBytes } : {}),
         tools: buildTools(scope, authentication),
         ...(authentication === "apiToken"
             ? {
@@ -2621,7 +2031,7 @@ function cloudflareApi(id, purpose, options) {
                     return await testCloudflareCredential(scope.send, { method: "GET", path: "/user" }, {
                         ...ctx,
                         credential: {
-                            get: async (field) => field ? values[field] ?? null : null,
+                            get: async (field) => (field ? (values[field] ?? null) : null),
                             getAll: async () => values,
                         },
                     }, (result) => ({
@@ -2632,13 +2042,36 @@ function cloudflareApi(id, purpose, options) {
             }),
     });
 }
+/** The closed options cloudflare() accepts; see `assertKnownOptions`. */
+const CLOUDFLARE_OPTIONS = variants("surface", {
+    api: optionsOf()({
+        ...keys("title", "authScope", "purpose", "instructions", "maxResultBytes"),
+        ...keys("surface", "accountId", "zoneId", "baseUrl", "authentication", "maxConcurrency"),
+        credential: CREDENTIAL,
+    }).shape,
+    mcp: optionsOf()({
+        ...PROVIDER_COMMON,
+        ...keys("surface"),
+        auth: REMOTE_MCP_AUTH,
+    }).shape,
+}, "mcp");
 /** A maintained Cloudflare connection using the selected provider interface. */
-export function cloudflare(id, options) {
+export const cloudflare = defineProvider({
+    name: "cloudflare",
+    title: "Cloudflare",
+    kind: "composed",
+    readme: "Cloudflare",
+    bundle: { "baselineGzip": 151186, "maxGzip": 211186 },
+    skill,
+    options: CLOUDFLARE_OPTIONS,
+    classify: CLOUDFLARE_MCP_CLASSIFICATION,
+    create: cloudflareConnector,
+});
+function cloudflareConnector(id, options, provider) {
     const purpose = options.purpose.trim();
-    if (!purpose) {
-        throw new Error("cloudflare() requires a non-empty account purpose.");
-    }
-    return options.surface === "mcp"
-        ? cloudflareMcp(id, purpose, options)
-        : cloudflareApi(id, purpose, options);
+    return options.surface === "api"
+        ? cloudflareApi(id, purpose, options)
+        : cloudflareMcp(id, purpose, options, provider);
 }
+/** @deprecated Read `cloudflare.definition.classify` instead. Kept for existing imports. */
+export const CLOUDFLARE_MCP_VETTED_CATALOG = reviewedCatalog(cloudflare.definition.classify, 'defineProvider("cloudflare")');