Reconcile provider contracts and Cloudflare outputs

documentation/cloudflare.md

@@ -153,6 +153,18 @@ every constrained field, endpoint-specific pagination bounds, and a description
 on every property. `test/cloudflare-provider.test.ts` walks the surface and
 asserts those properties rather than leaving them as a claim.
 
+The per-setting zone tools accept Cloudflare's current non-empty setting ids,
+including `webmcp_enabled` and `webmcp_packs`. Cloudflare's
+[rendered setting reference](https://developers.cloudflare.com/api/resources/zones/subresources/settings/)
+and current OpenAPI now agree on both beta ids. Results preserve the value and
+the actual `editable` flag Cloudflare returned; Connecta does not apply the
+document's defaults locally.
+
+KV namespace jurisdiction is creation-only. `create_kv_namespace` accepts
+`eu`, `fedramp`, or `us`, and namespace reads preserve the returned value.
+R2 uses a different enum: `default`, `eu`, `us`, or `fedramp`, sent through
+`cf-r2-jurisdiction` by all eight named R2 operations.
+
 ### What the named surface deliberately leaves out
 
 A named tool is a permanent line item in every deployment's catalog, so the
@@ -206,7 +218,7 @@ connection *calls*, dropping the tool drops the row — so
 rather than by a recorded exception. A path reached only through a hatch is
 named by the caller, so it was never a touched endpoint.
 
-The surviving 47 named tools all refuse malformed arguments locally, which is
+The surviving 48 named tools all refuse malformed arguments locally, which is
 the one thing no escape hatch can do: a hatch's path is an opaque string, so it
 can only check that a path is a path.
 
@@ -318,6 +330,12 @@ renamed to `camelCase`. A zone comes back as `id`, `name`, `status`, `paused`,
 `type`, `accountId`, `accountName`, `plan`, `nameServers`, and timestamps —
 not the forty-field object Cloudflare sends.
 
+Every named tool declares useful top-level output keys. Zone settings, Worker
+settings and deployments, KV namespaces and bulk operations, rulesets, R2 CORS,
+and Pages resources use maintained result schemas instead of an open
+"Cloudflare object" declaration. The three raw escape hatches remain open by
+design because their result fields depend on the caller-supplied endpoint.
+
 Paginated lists add a `page` object derived from `result_info`:
 `{ page, perPage, count, totalCount, totalPages, hasMore }`. `hasMore` is the
 field to branch on.

documentation/operations.md

@@ -233,7 +233,7 @@ in.
 | `catalog.test.ts` | lexical ranking and the compact schema renderer — `const`, `allOf` beside siblings, `$ref`, the depth limit, per-schema caching, and 2020-12 keyword compatibility |
 | `clerk.test.ts` | protected-resource metadata, the browser sign-in config, OAuth and session tokens, cached best-effort activity labels with their caps, the hand-applied `azp` rejection, and the `allowedDomains` allowlist including every lookalike that must not be repaired into a match |
 | `cloudflare-access-auth.test.ts` | trusted `ctx.access` human and service identities, absent/error fail-closed behavior, service-token MCP admission without operator mutation, human same-origin mutation, and the Clerk-to-ambient shell switch |
-| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, request building, projections, typed failures, and credential test |
+| `cloudflare-provider.test.ts` | `cloudflare()` construction, tool surface, current R2 and KV jurisdictions, useful output declarations, request building, projections including additive provider fields, typed failures, and credential test |
 | `code-first-surface.test.ts` | the seven-tool surface itself — an executor required, every removed option and top-level tool refused, compact always-loaded routing pinned below 1,000 characters, complete on-demand usage served, and `connecta.ui` findable before connector search |
 | `codemode-compat.test.ts` | the `Executor` seam staying structurally compatible with `@cloudflare/codemode`'s `DynamicWorkerExecutor`, enforced by `tsc` |
 | `config.test.ts` | the grouped `ConnectaConfig` boundary — each group forwarding to its internals, malformed admission bounds failing construction, and unknown own-properties rejected by their complete path before construction does work |

documentation/provider-conventions.md

@@ -693,8 +693,10 @@ Cloudflare keep/prune half of that judgment was made in
 [#350](https://github.com/zackbart/connecta/issues/350): 30 keep, 18 improve,
 3 prune, measured per tool in
 [`eval/current-version/results/issue-350-evidence.md`](https://github.com/zackbart/connecta/blob/main/eval/current-version/results/issue-350-evidence.md).
-Its eighteen `improve` rows are H8 and H9 misses on tools that clearly earn
-their place, so they are this audit's work, not a second removal argument.
+Its eighteen `improve` rows were H8 and H9 misses on tools that clearly earned
+their place. Issue #488 resolved them with useful output keys and maintained
+projections; the measurements remain the reason those tools stayed rather than
+a second removal argument.
 
 Each provider's own guide ([Cloudflare](./cloudflare.md),
 [Linear](./linear.md), [Mixpanel](./mixpanel.md), [Notion](./notion.md),

eval/current-version/results/issue-350-evidence.md

@@ -19,6 +19,9 @@ went with `set_r2_cors` as the other half of one policy pair, which the rule
 below states as its own ground so the record does not pretend it was a defect.
 The surviving surface is 48 named tools.
 
+The eighteen `improve` rows are historical findings. Issue #488 later replaced
+their empty output declarations with useful keys and maintained projections.
+
 ## The measurement
 
 The retired deterministic lane used one representative operator request per

records/provider-audit.md

@@ -36,7 +36,7 @@ Two things this audit deliberately does not decide:
 
 ## Cloudflare — hand-written HTTP
 
-Fifty-five tools over the v4 REST API: fifty-two named, three guarded escape
+Fifty-one tools over the v4 REST API: forty-eight named, three guarded escape
 hatches. The largest surface here and the one with the most to get wrong.
 
 | Convention | Verdict | Notes |
@@ -49,14 +49,14 @@ hatches. The largest surface here and the one with the most to get wrong.
 | H5 exception | recorded | the three escape hatches' request parts — `query[]`, `headers[]`, `fields[]`, `files[]` — keep undescribed `name`/`value` members, because H5 collides with H7 there. `query` and `headers` are one shared constant the renderer inlines into all three hatches, and `cloudflare_api_upload` sits at 1,007 of the 1,024-byte budget this same audit brought it back under; describing name/value pairs the parent property has already named as name/value pairs would truncate the whole tool in discovery. The 21 properties are listed by path in `test/provider-conventions.test.ts` and asserted exactly, so a new one fails and so does a stale entry |
 | H6 whose bound | meets | exemplary. `pagingInputProperties` carries a three-way `bounds` vocabulary — `cloudflare`, `clamped`, `undocumented` — and the description says which one applies |
 | H7 compact fit | **missed → fixed** | `cloudflare_api_upload` rendered to 1,297 bytes. The refused-header list, inlined once per hatch, moved to the usage guide; the remaining upload descriptions were cut to the fact each adds. Now 1,007 |
-| H8 output schemas | meets | 52 of 52 declare one |
+| H8 output schemas | meets | all 48 named tools declare useful top-level keys; the three endpoint-generic hatches alone keep open result objects |
 | H9 projection | meets | reads project and rename; `raw: true` wherever the projection drops something recoverable; `cloudflare_api_get` is the universal unprojected read |
 | H10 pagination | **missed → fixed** | two conventions live here, which H10 allows, but only the guide said so. Three of the four cursor tools had a bare `nextCursor: { type: "string" }` with no description. Both ends now state it: `cursor` says the endpoint pages by cursor, `nextCursor` says it is the only signal and no `page` object is coming |
 | H11 errors | meets | mapped by the caller's next move, including the 400-with-credential-code case that is `auth_required` rather than `invalid_args`; every mapped status has a test asserting code and retryability |
 | H12 credential | meets | labeled fields per authentication mode, `testCredential` on the token path (`/user/tokens/verify`) and `testCredentials` on the Global API Key pair (`/user`), each reporting who it authenticated as |
 | H13 guide | **missed → fixed** | the guide was a bare string, so its summary was derived from the first content line — the zone-scoping rule, which varies per deployment and reads as an instruction. Now structured with a declared summary. `required` stays unset, deliberately: every named schema is complete enough to call on its own and the scoping convention is repeated on each `zoneId` and `accountId` property, so forcing the guide into context before every operation would buy nothing |
 | H14 hatch shape | meets | split GET / JSON-mutate / upload, the split is Connecta's, the GET tool is annotated read-only, paths are provider-relative and confined |
-| H14 keep/prune | **open — [#350](https://github.com/zackbart/connecta/issues/350)** | whether each of the named tools beats the hatch on schema, projection, or safety routing is a reading that needs usage evidence. Out of scope here by the issue's own terms |
+| H14 keep/prune | meets | #350 measured 30 keep, 18 improve, and 3 prune; the three removals shipped, and #488 resolved the output misses on the tools that stayed |
 
 ## Notion — hand-written HTTP
 

scripts/drift/cloudflare-endpoints.json

@@ -164,13 +164,13 @@
       "method": "PUT",
       "path": "/accounts/{account_id}/storage/kv/namespaces/{namespace_id}/bulk",
       "specRevision": "4.0.0",
-      "contract": "sha256:90b888706e5235d55a60c848672de347e6b68728c3525a818936d027c7e0281d"
+      "contract": "sha256:999dc0b7711a4e8052e4c2305819f6cfe38eff0acf91b4979d63f42cd9f25073"
     },
     {
       "method": "POST",
       "path": "/accounts/{account_id}/storage/kv/namespaces/{namespace_id}/bulk/delete",
       "specRevision": "4.0.0",
-      "contract": "sha256:511865ab33597f3effa82a513e01fa6fad33141c1b3a73434aaaf5a8eb07c43e"
+      "contract": "sha256:62bb7e37e596f18517040d859bfb727325e4e4e659c0fbeddcc017b45156269c"
     },
     {
       "method": "POST",
@@ -290,13 +290,13 @@
       "method": "GET",
       "path": "/zones/{zone_id}/settings/{setting_id}",
       "specRevision": "4.0.0",
-      "contract": "sha256:55b55adc0ed04a368710e274615faceca0c8456dd59694b68edf075c52060b28"
+      "contract": "sha256:d40d6e69038efbcb47a4e211d4e2c293c557a943fb383975c838245ee9c96888"
     },
     {
       "method": "PATCH",
       "path": "/zones/{zone_id}/settings/{setting_id}",
       "specRevision": "4.0.0",
-      "contract": "sha256:edb944622554aca746c8cde0e4efe68e2434eb050b09129cb5410e3bb9e65a27"
+      "contract": "sha256:131e78bf0692cc655846a3ab748ca1738522244117eb3733c75d7032847a6512"
     }
   ]
 }