@vigilbase/cli 0.1.4 → 0.2.0

package/dist/local/cloudflare-checkup/contract.d.ts

@@ -0,0 +1,2793 @@
+/**
+ * Local Cloudflare Checkup snapshot contract (`vigilbase.cloudflare-checkup.snapshot/1`).
+ *
+ * Single source of truth for the snapshot the Vigilbase CLI collects with
+ * Cloudflare's `cf` CLI and vigilbase.com evaluates with the existing scanner:
+ * schemas, limits, request keys, projectors, the IP pseudonymiser, the rule-run
+ * encoder and expander, the credential tripwire, the snapshot serialiser and
+ * the local-session HTTP contract.
+ *
+ * Portability rules (the file is vendored byte-for-byte into packages/cli):
+ * - imports only `zod`, never a relative module;
+ * - ES2022 built-ins only, so it compiles under the tools config
+ *   (ES2017 target, bundler resolution) and the CLI config (ES2022, NodeNext);
+ * - no raw line terminators inside regex literals (TS1161); use `\p{…}` escapes.
+ *
+ * Projection principle (spec §D3). A value the scanner prints is kept verbatim,
+ * or the whole entry becomes `collection_failed/invalid_output`. A value the
+ * scanner only compares against fixed literals may be mapped to a sentinel that
+ * cannot equal any of those literals. A value the scanner tests for truthiness
+ * keeps its truthiness. Projection never truncates; caps fail the entry.
+ * Line references below are to `packages/tools/src/cloudflare-checkup/scanner.ts`
+ * before the read-client refactor; the function names are the stable anchor.
+ *
+ * Any change to a field read or a projection rule is a new schema version
+ * (`/2`), and the server then accepts both for at least one CLI minor release.
+ */
+import { z } from 'zod';
+export declare const SNAPSHOT_SCHEMA_VERSION: "vigilbase.cloudflare-checkup.snapshot/1";
+export declare const SNAPSHOT_PROJECTION_VERSION: 1;
+export declare const IP_PSEUDONYMIZATION: "per_prefix_sequential/1";
+export declare const SNAPSHOT_COLLECTOR_NAME: "@vigilbase/cli";
+export declare const SESSION_CODE_REGEX: RegExp;
+export declare const PRODUCTION_ORIGIN: "https://vigilbase.com";
+export declare const LOCAL_SESSION_PATH: "/api/v1/tools/cloudflare-checkup/local-session";
+export declare const LOCAL_SNAPSHOT_PATH: "/api/v1/tools/cloudflare-checkup/local-session/snapshot";
+/** The CLI asks vigilbase.com to email a verification code (no browser, no Turnstile). */
+export declare const LOCAL_REQUEST_PATH: "/api/v1/tools/cloudflare-checkup/local-session/request";
+/** The CLI trades the verification token and the emailed code for a session code. */
+export declare const LOCAL_VERIFY_PATH: "/api/v1/tools/cloudflare-checkup/local-session/verify";
+/** `vbcv1_` + base64url_nopad(iv[12] ‖ AES-256-GCM(runId[16] ‖ iat[4]) ‖ tag[16]): names a run awaiting its emailed code. */
+export declare const VERIFICATION_TOKEN_REGEX: RegExp;
+/** The six-digit code One emails for a tool run. */
+export declare const EMAIL_CODE_REGEX: RegExp;
+/** Verification email languages; the CLI picks one from LC_ALL, LC_MESSAGES or LANG. */
+export declare const LOCAL_EMAIL_LOCALES: readonly ["en", "pt-PT", "ar"];
+export type LocalEmailLocale = (typeof LOCAL_EMAIL_LOCALES)[number];
+export declare const SNAPSHOT_SHA256_HEADER: "X-Vigilbase-Snapshot-Sha256";
+export declare const CLI_VERSION_HEADER: "X-Vigilbase-CLI-Version";
+export declare const CF_SUPPORTED: Readonly<{
+    min: "1.0.0-beta.13";
+    maxExclusive: "2.0.0";
+    tested: readonly string[];
+}>;
+export declare const SNAPSHOT_LIMITS: Readonly<{
+    maxBytes: 8388608;
+    defaultServerMaxBytes: 4194304;
+    maxZones: 100;
+    maxEntries: 12000;
+    maxListItems: 5000;
+    maxRuleBodies: 2000;
+    maxRunsPerBody: 5000;
+    maxRulesPerBody: 20000;
+    maxRulesExpandedTotal: 400000;
+    maxIssueRulesExpandedTotal: 20000;
+    maxIssueTextExpandedBytes: 2097152;
+    maxCollectionHours: 6;
+    maxAgeHours: 24;
+    maxFutureSkewSeconds: 300;
+    rulesetListTruncationAt: 100;
+}>;
+export declare const ZONE_SETTING_IDS: readonly ["ssl", "always_use_https", "min_tls_version", "tls_1_3", "security_level", "email_obfuscation", "hotlink_protection", "browser_check", "origin_pulls", "challenge_ttl", "browser_cache_ttl", "minify", "early_hints", "rocket_loader", "waf", "automatic_https_rewrites", "security_header", "opportunistic_encryption", "always_online"];
+export declare const MANAGED_RULESET_IDS: readonly string[];
+export declare const MANAGED_NAME_NEEDLES: readonly ["cloudflare managed ruleset", "owasp core ruleset", "exposed credentials check", "sensitive data detection"];
+export declare const LEGACY_PAGE_RULE_ACTIONS: readonly ["disable_security", "disable_performance", "waf", "security_level", "browser_check"];
+export declare const ACCOUNT_KINDS: readonly ["account", "zones", "account_members", "account_rulesets", "account_access_rules", "access_apps", "access_identity_providers", "access_service_tokens", "gateway_rules", "gateway_locations", "cfd_tunnels"];
+export declare const ZONE_SINGLE_KINDS: readonly ["zone_dnssec", "zone_dns_records", "zone_universal_ssl", "zone_total_tls", "zone_rulesets", "zone_access_rules", "zone_page_rules", "zone_bot_management", "zone_page_shield", "zone_schema_validation_settings", "zone_schema_validation_schemas"];
+export declare const NOT_COLLECTABLE_ZONE_KINDS: readonly ["zone_legacy_firewall_rules", "zone_legacy_filters", "zone_legacy_waf_packages", "zone_legacy_rate_limits", "zone_waf_analytics"];
+export declare const SNAPSHOT_KINDS: readonly ["account", "zones", "account_members", "account_rulesets", "account_access_rules", "access_apps", "access_identity_providers", "access_service_tokens", "gateway_rules", "gateway_locations", "cfd_tunnels", "zone_setting", "zone_dnssec", "zone_dns_records", "zone_universal_ssl", "zone_total_tls", "zone_rulesets", "zone_access_rules", "zone_page_rules", "zone_bot_management", "zone_page_shield", "zone_schema_validation_settings", "zone_schema_validation_schemas", "zone_ruleset", "zone_legacy_firewall_rules", "zone_legacy_filters", "zone_legacy_waf_packages", "zone_legacy_rate_limits", "zone_waf_analytics"];
+export declare const COLLECTION_FAILURE_DETAILS: readonly ["cf_error", "invalid_output", "timeout", "output_too_large", "possibly_truncated", "page_limit", "command_unavailable"];
+export declare const RECOMMENDED_CF_SCOPES: readonly ["account:read", "account-settings.read", "memberships.read", "user:read", "user-details.read", "zone:read", "zone.read", "zone-settings.read", "dns.read", "dns_records:read", "ssl-and-certificates.read", "zone-waf.read", "account-waf.read", "account-rulesets.read", "http-ddos-managed-ruleset.read", "firewall-services.read", "account-firewall-access-rules.read", "page-rules.read", "bot-management.read", "page-shield.read", "domain-page-shield.read", "api-gateway.read", "access.read", "access:read", "access-app.read", "access-idp.read", "access-service-token.read", "teams.read", "teams:read", "argotunnel.read", "teams-connector-cloudflared.read"];
+export type AccountKind = (typeof ACCOUNT_KINDS)[number];
+export type ZoneSingleKind = (typeof ZONE_SINGLE_KINDS)[number];
+export type NotCollectableZoneKind = (typeof NOT_COLLECTABLE_ZONE_KINDS)[number];
+export type SnapshotKind = (typeof SNAPSHOT_KINDS)[number];
+export type CollectableKind = Exclude<SnapshotKind, NotCollectableZoneKind>;
+export type ZoneSettingId = (typeof ZONE_SETTING_IDS)[number];
+export type CollectionFailureDetail = (typeof COLLECTION_FAILURE_DETAILS)[number];
+/**
+ * SemVer 2 precedence. Returns a negative number, zero or a positive number,
+ * or `NaN` when either side is not `MAJOR.MINOR.PATCH[-PRERELEASE]`.
+ */
+export declare function compareSemver(a: string, b: string): number;
+/**
+ * True when `version` lies in `[CF_SUPPORTED.min, CF_SUPPORTED.maxExclusive)`.
+ * The upper bound compares release cores only, so a `2.0.0-beta.1` preview of
+ * the next major is unsupported too.
+ */
+export declare function isSupportedCfVersion(version: string): boolean;
+export declare const HEX32_REGEX: RegExp;
+declare const httpError: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodLiteral<"http_error">;
+    status: z.ZodNumber;
+}, z.core.$strict>;
+declare const notCollected: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodLiteral<"not_collected">;
+}, z.core.$strict>;
+declare const collectionFailed: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    reason: z.ZodLiteral<"collection_failed">;
+    detail: z.ZodEnum<{
+        timeout: "timeout";
+        cf_error: "cf_error";
+        invalid_output: "invalid_output";
+        output_too_large: "output_too_large";
+        possibly_truncated: "possibly_truncated";
+        page_limit: "page_limit";
+        command_unavailable: "command_unavailable";
+    }>;
+}, z.core.$strict>;
+export type HttpErrorResult = z.infer<typeof httpError>;
+export type NotCollectedResult = z.infer<typeof notCollected>;
+export type CollectionFailedResult = z.infer<typeof collectionFailed>;
+export declare const AccountData: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodOptional<z.ZodString>;
+    settings: z.ZodOptional<z.ZodObject<{
+        enforce_twofactor: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const ZoneData: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    status: z.ZodOptional<z.ZodString>;
+    paused: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodOptional<z.ZodString>;
+    development_mode: z.ZodOptional<z.ZodNumber>;
+    plan: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    account: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const MemberData: z.ZodObject<{
+    status: z.ZodOptional<z.ZodLiteral<"pending">>;
+    email: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodObject<{
+        two_factor_authentication_enabled: z.ZodLiteral<false>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AccessRuleData: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodString>;
+    configuration: z.ZodOptional<z.ZodObject<{
+        target: z.ZodOptional<z.ZodString>;
+        value: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const IdentityProviderData: z.ZodObject<{
+    type: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ServiceTokenData: z.ZodObject<{
+    expires_at: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>;
+export declare const GatewayRuleData: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodLiteral<false>>;
+    filters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const TunnelData: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    is_deleted: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export declare const SettingData: z.ZodObject<{
+    value: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>]>>;
+}, z.core.$strict>;
+export declare const DnssecData: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    algorithm: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+}, z.core.$strict>;
+export declare const DnsRecordData: z.ZodObject<{
+    type: z.ZodEnum<{
+        A: "A";
+        AAAA: "AAAA";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+    content: z.ZodString;
+    proxied: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export declare const RulesetHeadData: z.ZodObject<{
+    id: z.ZodString;
+    phase: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+}, z.core.$strict>;
+export declare const RulesetDetailData: z.ZodObject<{
+    id: z.ZodString;
+    phase: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+    rulesBody: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const PageRuleData: z.ZodObject<{
+    actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodEnum<{
+            waf: "waf";
+            security_level: "security_level";
+            browser_check: "browser_check";
+            disable_security: "disable_security";
+            disable_performance: "disable_performance";
+        }>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare const BotManagementData: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodString>]>>;
+export declare const SchemaValidationSettingsData: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+export declare const CountedData: z.ZodObject<{
+    count: z.ZodNumber;
+}, z.core.$strict>;
+export declare const EnabledOnlyData: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const ProjectedRuleData: z.ZodObject<{
+    action: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodLiteral<false>>;
+    expression: z.ZodOptional<z.ZodEnum<{
+        true: "true";
+        "ip.geoip.country in": "ip.geoip.country in";
+    }>>;
+    action_parameters: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    id: z.ZodOptional<z.ZodString>;
+    ref: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const RuleRunData: z.ZodObject<{
+    action: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodLiteral<false>>;
+    expression: z.ZodOptional<z.ZodEnum<{
+        true: "true";
+        "ip.geoip.country in": "ip.geoip.country in";
+    }>>;
+    action_parameters: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    id: z.ZodOptional<z.ZodString>;
+    ref: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    n: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const ProjectedRulesetDetailData: z.ZodObject<{
+    id: z.ZodString;
+    phase: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+    rules: z.ZodArray<z.ZodObject<{
+        action: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodLiteral<false>>;
+        expression: z.ZodOptional<z.ZodEnum<{
+            true: "true";
+            "ip.geoip.country in": "ip.geoip.country in";
+        }>>;
+        action_parameters: z.ZodOptional<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        id: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AccountData = z.infer<typeof AccountData>;
+export type ZoneData = z.infer<typeof ZoneData>;
+export type MemberData = z.infer<typeof MemberData>;
+export type AccessRuleData = z.infer<typeof AccessRuleData>;
+export type IdentityProviderData = z.infer<typeof IdentityProviderData>;
+export type ServiceTokenData = z.infer<typeof ServiceTokenData>;
+export type GatewayRuleData = z.infer<typeof GatewayRuleData>;
+export type TunnelData = z.infer<typeof TunnelData>;
+export type SettingData = z.infer<typeof SettingData>;
+export type DnssecData = z.infer<typeof DnssecData>;
+export type DnsRecordData = z.infer<typeof DnsRecordData>;
+export type RulesetHeadData = z.infer<typeof RulesetHeadData>;
+export type RulesetDetailData = z.infer<typeof RulesetDetailData>;
+export type PageRuleData = z.infer<typeof PageRuleData>;
+export type BotManagementData = z.infer<typeof BotManagementData>;
+export type SchemaValidationSettingsData = z.infer<typeof SchemaValidationSettingsData>;
+export type CountedData = z.infer<typeof CountedData>;
+export type EnabledOnlyData = z.infer<typeof EnabledOnlyData>;
+export type ProjectedRule = z.infer<typeof ProjectedRuleData>;
+export type RuleRun = z.infer<typeof RuleRunData>;
+export type ProjectedRulesetDetail = z.infer<typeof ProjectedRulesetDetailData>;
+export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"account">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            type: z.ZodOptional<z.ZodString>;
+            settings: z.ZodOptional<z.ZodObject<{
+                enforce_twofactor: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zones">;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            status: z.ZodOptional<z.ZodString>;
+            paused: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodOptional<z.ZodString>;
+            development_mode: z.ZodOptional<z.ZodNumber>;
+            plan: z.ZodOptional<z.ZodObject<{
+                name: z.ZodString;
+            }, z.core.$strict>>;
+            account: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"account_members">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            status: z.ZodOptional<z.ZodLiteral<"pending">>;
+            email: z.ZodOptional<z.ZodString>;
+            user: z.ZodOptional<z.ZodObject<{
+                two_factor_authentication_enabled: z.ZodLiteral<false>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"account_rulesets">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            count: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"account_access_rules">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodString>;
+            configuration: z.ZodOptional<z.ZodObject<{
+                target: z.ZodOptional<z.ZodString>;
+                value: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"access_apps">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            count: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"access_identity_providers">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            type: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"access_service_tokens">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            expires_at: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"gateway_rules">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodLiteral<false>>;
+            filters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"gateway_locations">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            count: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"cfd_tunnels">;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            status: z.ZodOptional<z.ZodString>;
+            is_deleted: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_setting">;
+    zoneId: z.ZodString;
+    settingId: z.ZodEnum<{
+        waf: "waf";
+        ssl: "ssl";
+        always_use_https: "always_use_https";
+        min_tls_version: "min_tls_version";
+        tls_1_3: "tls_1_3";
+        security_level: "security_level";
+        email_obfuscation: "email_obfuscation";
+        hotlink_protection: "hotlink_protection";
+        browser_check: "browser_check";
+        origin_pulls: "origin_pulls";
+        challenge_ttl: "challenge_ttl";
+        browser_cache_ttl: "browser_cache_ttl";
+        minify: "minify";
+        early_hints: "early_hints";
+        rocket_loader: "rocket_loader";
+        automatic_https_rewrites: "automatic_https_rewrites";
+        security_header: "security_header";
+        opportunistic_encryption: "opportunistic_encryption";
+        always_online: "always_online";
+    }>;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            value: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>]>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_dnssec">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            status: z.ZodOptional<z.ZodString>;
+            algorithm: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_dns_records">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<{
+                A: "A";
+                AAAA: "AAAA";
+            }>;
+            name: z.ZodOptional<z.ZodString>;
+            content: z.ZodString;
+            proxied: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_universal_ssl">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_total_tls">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_rulesets">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            phase: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_ruleset">;
+    zoneId: z.ZodString;
+    rulesetId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            id: z.ZodString;
+            phase: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+            rulesBody: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_access_rules">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodString>;
+            configuration: z.ZodOptional<z.ZodObject<{
+                target: z.ZodOptional<z.ZodString>;
+                value: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_page_rules">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodEnum<{
+                    waf: "waf";
+                    security_level: "security_level";
+                    browser_check: "browser_check";
+                    disable_security: "disable_security";
+                    disable_performance: "disable_performance";
+                }>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_bot_management">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodString>]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_page_shield">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_schema_validation_settings">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_schema_validation_schemas">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodObject<{
+            count: z.ZodNumber;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
+    zoneId: z.ZodString;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_legacy_filters">;
+    zoneId: z.ZodString;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_legacy_waf_packages">;
+    zoneId: z.ZodString;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_legacy_rate_limits">;
+    zoneId: z.ZodString;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_waf_analytics">;
+    zoneId: z.ZodString;
+    result: z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
+export type SnapshotEntry = z.infer<typeof SnapshotEntrySchema>;
+export declare const SnapshotCollectorSchema: z.ZodObject<{
+    name: z.ZodLiteral<"@vigilbase/cli">;
+    version: z.ZodString;
+    cf: z.ZodObject<{
+        version: z.ZodString;
+    }, z.core.$strict>;
+    authSource: z.ZodEnum<{
+        cf_profile: "cf_profile";
+        cf_env_token: "cf_env_token";
+        cf_default_profile: "cf_default_profile";
+    }>;
+    platform: z.ZodEnum<{
+        darwin: "darwin";
+        linux: "linux";
+        win32: "win32";
+    }>;
+    startedAt: z.ZodISODateTime;
+    finishedAt: z.ZodISODateTime;
+    cfInvocations: z.ZodNumber;
+}, z.core.$strict>;
+export type SnapshotCollector = z.infer<typeof SnapshotCollectorSchema>;
+declare const SnapshotObjectSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"vigilbase.cloudflare-checkup.snapshot/1">;
+    projection: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        ipPseudonymization: z.ZodLiteral<"per_prefix_sequential/1">;
+    }, z.core.$strict>;
+    accountId: z.ZodString;
+    collector: z.ZodObject<{
+        name: z.ZodLiteral<"@vigilbase/cli">;
+        version: z.ZodString;
+        cf: z.ZodObject<{
+            version: z.ZodString;
+        }, z.core.$strict>;
+        authSource: z.ZodEnum<{
+            cf_profile: "cf_profile";
+            cf_env_token: "cf_env_token";
+            cf_default_profile: "cf_default_profile";
+        }>;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+        startedAt: z.ZodISODateTime;
+        finishedAt: z.ZodISODateTime;
+        cfInvocations: z.ZodNumber;
+    }, z.core.$strict>;
+    entries: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"account">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                type: z.ZodOptional<z.ZodString>;
+                settings: z.ZodOptional<z.ZodObject<{
+                    enforce_twofactor: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zones">;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                status: z.ZodOptional<z.ZodString>;
+                paused: z.ZodOptional<z.ZodBoolean>;
+                type: z.ZodOptional<z.ZodString>;
+                development_mode: z.ZodOptional<z.ZodNumber>;
+                plan: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                }, z.core.$strict>>;
+                account: z.ZodObject<{
+                    id: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_members">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodLiteral<"pending">>;
+                email: z.ZodOptional<z.ZodString>;
+                user: z.ZodOptional<z.ZodObject<{
+                    two_factor_authentication_enabled: z.ZodLiteral<false>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_rulesets">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_access_rules">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                mode: z.ZodOptional<z.ZodString>;
+                configuration: z.ZodOptional<z.ZodObject<{
+                    target: z.ZodOptional<z.ZodString>;
+                    value: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_apps">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_identity_providers">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                type: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_service_tokens">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                expires_at: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"gateway_rules">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodLiteral<false>>;
+                filters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"gateway_locations">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"cfd_tunnels">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                is_deleted: z.ZodOptional<z.ZodLiteral<true>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_setting">;
+        zoneId: z.ZodString;
+        settingId: z.ZodEnum<{
+            waf: "waf";
+            ssl: "ssl";
+            always_use_https: "always_use_https";
+            min_tls_version: "min_tls_version";
+            tls_1_3: "tls_1_3";
+            security_level: "security_level";
+            email_obfuscation: "email_obfuscation";
+            hotlink_protection: "hotlink_protection";
+            browser_check: "browser_check";
+            origin_pulls: "origin_pulls";
+            challenge_ttl: "challenge_ttl";
+            browser_cache_ttl: "browser_cache_ttl";
+            minify: "minify";
+            early_hints: "early_hints";
+            rocket_loader: "rocket_loader";
+            automatic_https_rewrites: "automatic_https_rewrites";
+            security_header: "security_header";
+            opportunistic_encryption: "opportunistic_encryption";
+            always_online: "always_online";
+        }>;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                value: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>]>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_dnssec">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                algorithm: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_dns_records">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    A: "A";
+                    AAAA: "AAAA";
+                }>;
+                name: z.ZodOptional<z.ZodString>;
+                content: z.ZodString;
+                proxied: z.ZodOptional<z.ZodLiteral<true>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_universal_ssl">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_total_tls">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_rulesets">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                phase: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_ruleset">;
+        zoneId: z.ZodString;
+        rulesetId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                id: z.ZodString;
+                phase: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                rulesBody: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_access_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                mode: z.ZodOptional<z.ZodString>;
+                configuration: z.ZodOptional<z.ZodObject<{
+                    target: z.ZodOptional<z.ZodString>;
+                    value: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_page_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    id: z.ZodEnum<{
+                        waf: "waf";
+                        security_level: "security_level";
+                        browser_check: "browser_check";
+                        disable_security: "disable_security";
+                        disable_performance: "disable_performance";
+                    }>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_bot_management">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodString>]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_page_shield">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_schema_validation_settings">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_schema_validation_schemas">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_filters">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_waf_packages">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_rate_limits">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_waf_analytics">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "kind">>;
+    ruleBodies: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        action: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodLiteral<false>>;
+        expression: z.ZodOptional<z.ZodEnum<{
+            true: "true";
+            "ip.geoip.country in": "ip.geoip.country in";
+        }>>;
+        action_parameters: z.ZodOptional<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        id: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        n: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+type SnapshotShape = z.infer<typeof SnapshotObjectSchema>;
+export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"vigilbase.cloudflare-checkup.snapshot/1">;
+    projection: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        ipPseudonymization: z.ZodLiteral<"per_prefix_sequential/1">;
+    }, z.core.$strict>;
+    accountId: z.ZodString;
+    collector: z.ZodObject<{
+        name: z.ZodLiteral<"@vigilbase/cli">;
+        version: z.ZodString;
+        cf: z.ZodObject<{
+            version: z.ZodString;
+        }, z.core.$strict>;
+        authSource: z.ZodEnum<{
+            cf_profile: "cf_profile";
+            cf_env_token: "cf_env_token";
+            cf_default_profile: "cf_default_profile";
+        }>;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+        startedAt: z.ZodISODateTime;
+        finishedAt: z.ZodISODateTime;
+        cfInvocations: z.ZodNumber;
+    }, z.core.$strict>;
+    entries: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"account">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                type: z.ZodOptional<z.ZodString>;
+                settings: z.ZodOptional<z.ZodObject<{
+                    enforce_twofactor: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zones">;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                status: z.ZodOptional<z.ZodString>;
+                paused: z.ZodOptional<z.ZodBoolean>;
+                type: z.ZodOptional<z.ZodString>;
+                development_mode: z.ZodOptional<z.ZodNumber>;
+                plan: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodString;
+                }, z.core.$strict>>;
+                account: z.ZodObject<{
+                    id: z.ZodString;
+                    name: z.ZodString;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_members">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodLiteral<"pending">>;
+                email: z.ZodOptional<z.ZodString>;
+                user: z.ZodOptional<z.ZodObject<{
+                    two_factor_authentication_enabled: z.ZodLiteral<false>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_rulesets">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"account_access_rules">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                mode: z.ZodOptional<z.ZodString>;
+                configuration: z.ZodOptional<z.ZodObject<{
+                    target: z.ZodOptional<z.ZodString>;
+                    value: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_apps">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_identity_providers">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                type: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"access_service_tokens">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                expires_at: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"gateway_rules">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodLiteral<false>>;
+                filters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"gateway_locations">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"cfd_tunnels">;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                is_deleted: z.ZodOptional<z.ZodLiteral<true>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_setting">;
+        zoneId: z.ZodString;
+        settingId: z.ZodEnum<{
+            waf: "waf";
+            ssl: "ssl";
+            always_use_https: "always_use_https";
+            min_tls_version: "min_tls_version";
+            tls_1_3: "tls_1_3";
+            security_level: "security_level";
+            email_obfuscation: "email_obfuscation";
+            hotlink_protection: "hotlink_protection";
+            browser_check: "browser_check";
+            origin_pulls: "origin_pulls";
+            challenge_ttl: "challenge_ttl";
+            browser_cache_ttl: "browser_cache_ttl";
+            minify: "minify";
+            early_hints: "early_hints";
+            rocket_loader: "rocket_loader";
+            automatic_https_rewrites: "automatic_https_rewrites";
+            security_header: "security_header";
+            opportunistic_encryption: "opportunistic_encryption";
+            always_online: "always_online";
+        }>;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                value: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>]>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_dnssec">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                algorithm: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_dns_records">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    A: "A";
+                    AAAA: "AAAA";
+                }>;
+                name: z.ZodOptional<z.ZodString>;
+                content: z.ZodString;
+                proxied: z.ZodOptional<z.ZodLiteral<true>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_universal_ssl">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_total_tls">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_rulesets">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                phase: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_ruleset">;
+        zoneId: z.ZodString;
+        rulesetId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                id: z.ZodString;
+                phase: z.ZodOptional<z.ZodString>;
+                name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                rulesBody: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_access_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                mode: z.ZodOptional<z.ZodString>;
+                configuration: z.ZodOptional<z.ZodObject<{
+                    target: z.ZodOptional<z.ZodString>;
+                    value: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_page_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                actions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    id: z.ZodEnum<{
+                        waf: "waf";
+                        security_level: "security_level";
+                        browser_check: "browser_check";
+                        disable_security: "disable_security";
+                        disable_performance: "disable_performance";
+                    }>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_bot_management">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodString>]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_page_shield">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_schema_validation_settings">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<"">, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_schema_validation_schemas">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodObject<{
+                count: z.ZodNumber;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_filters">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_waf_packages">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_legacy_rate_limits">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_waf_analytics">;
+        zoneId: z.ZodString;
+        result: z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "kind">>;
+    ruleBodies: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        action: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodLiteral<false>>;
+        expression: z.ZodOptional<z.ZodEnum<{
+            true: "true";
+            "ip.geoip.country in": "ip.geoip.country in";
+        }>>;
+        action_parameters: z.ZodOptional<z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        id: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        n: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type CloudflareCheckupSnapshotV1 = z.infer<typeof CloudflareCheckupSnapshotV1Schema>;
+/** The `reason` a rejected snapshot maps to (§C4). */
+export type SnapshotRejectReason = 'snapshot_invalid' | 'snapshot_incomplete' | 'secret_like_value';
+export type SnapshotSemanticIssue = {
+    code: 'custom';
+    /** A stable issue code such as `missing_entry`; never a value from the snapshot. */
+    message: string;
+    path: PropertyKey[];
+    params: {
+        reason: SnapshotRejectReason;
+    };
+};
+export interface SnapshotIssueSink {
+    addIssue(issue: SnapshotSemanticIssue): void;
+}
+/**
+ * Cross-entry rules the per-entry schema cannot express. Runs as the
+ * snapshot schema's `superRefine`; every issue carries `params.reason`, which
+ * `snapshotRejectReason` maps to the HTTP reason. The time window relative to
+ * the server clock is checked in com, not here.
+ */
+export declare function validateSnapshotSemantics(snapshot: SnapshotShape, ctx: SnapshotIssueSink): void;
+/**
+ * Credential tripwire (§D1.6): a Vigilbase session code or verification token, a 40-character
+ * `[A-Za-z0-9_-]` window with upper case, lower case and a digit (the
+ * Cloudflare API token shape), a JWT, a PEM header or a bearer header.
+ */
+export declare function containsSecretLikeValue(value: string): boolean;
+/**
+ * Map the issues of a failed `CloudflareCheckupSnapshotV1Schema.safeParse` to
+ * the HTTP reason: the tripwire wins, then key-set errors, then everything else.
+ */
+export declare function snapshotRejectReason(issues: ReadonlyArray<{
+    code?: unknown;
+    params?: unknown;
+}>): SnapshotRejectReason;
+/**
+ * The `issues` array of a local-session error response: at most 20
+ * `{path, code}` pairs and never a value from the snapshot.
+ */
+export declare function snapshotIssueList(issues: ReadonlyArray<{
+    code?: string;
+    message?: string;
+    path?: ReadonlyArray<PropertyKey>;
+}>): {
+    path: string;
+    code: string;
+}[];
+export interface SnapshotKeyIds {
+    accountId: string;
+    zoneId?: string;
+    settingId?: string;
+    rulesetId?: string;
+}
+/** The scanner REST call a snapshot entry answers. The replay client derives the same key per call. */
+export declare function snapshotRequestKey(kind: SnapshotKind, ids: SnapshotKeyIds): string;
+type KeyedEntry = {
+    kind: SnapshotKind;
+    zoneId?: string;
+    settingId?: string;
+    rulesetId?: string;
+};
+export declare function snapshotEntryKey(entry: KeyedEntry, accountId: string): string;
+/**
+ * Every key a complete snapshot holds, in canonical entry order: account kinds,
+ * then per zone (in list order) the 19 settings, the single kinds with each
+ * listed ruleset detail right after `zone_rulesets`, then the not-collectable
+ * kinds. `rulesetIdsByZone` holds only zones whose `zone_rulesets` is ok.
+ */
+export declare function expectedEntryKeys(accountId: string, zones: ReadonlyArray<string | {
+    id: string;
+}>, rulesetIdsByZone: Readonly<Record<string, readonly string[]>>): string[];
+/** A projector's outcome: the snapshot data, or the `collection_failed` detail. */
+export type ProjectionResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    detail: CollectionFailureDetail;
+};
+/**
+ * `account`: `id, name, type, settings.enforce_twofactor`. createAccountMfaCheck
+ * (1110) compares `enforce_twofactor === true`; runInitPhase (4369-4381) and
+ * assembleCheckupResult (5127-5136) print `name`, `type` and `enforce_twofactor`.
+ */
+export declare function projectAccount(raw: unknown): ProjectionResult<AccountData>;
+/**
+ * `zones` (all pages merged, API order): `id, name, status, paused, type,
+ * development_mode, plan.name, account.{id,name}`. zoneCtxFor (4338) prints the
+ * account; createZoneStatusCheck (1960-1990), createDevModeCheck (2165-2197),
+ * createDNSModeCheck (3218-3234) and assembleCheckupResult (5099-5102) read the rest.
+ * `paused` is only tested for truthiness.
+ */
+export declare function projectZones(raw: unknown): ProjectionResult<ZoneData[]>;
+/**
+ * `account_members`: one item per member, in order. createMemberMfaCheck and
+ * createPendingMembersCheck (1162-1198, 1224-1252) read only `status ===
+ * 'pending'`, `two_factor_authentication_enabled === false`, `.length`, and the
+ * first 8 truthy `m.email || m.user.email` of each selection.
+ */
+export declare function projectAccountMembers(raw: unknown): ProjectionResult<MemberData[]>;
+/**
+ * `account_rulesets`, `access_apps`, `gateway_locations`,
+ * `zone_schema_validation_schemas`: only `.length` is read (1259-1297, 1421,
+ * 1744, 3872), so only the count leaves the machine.
+ */
+export declare function projectCounted(raw: unknown): ProjectionResult<CountedData>;
+/**
+ * `account_access_rules`. createAccountAccessRulesCheck (1318-1354): broad =
+ * `mode === 'whitelist' || target === 'country' || target === 'asn'`; prints
+ * `broad.length`, `accessRules.length` and the first 5 broad rules. Later broad
+ * rules keep only the fields that make them broad; other rules are `{}`.
+ */
+export declare function projectAccountAccessRules(raw: unknown): ProjectionResult<AccessRuleData[]>;
+/**
+ * `zone_access_rules`. createZoneIpAccessRulesCheck (2613-2673): broad =
+ * `target.toLowerCase() ∈ {ip, ip_range, country, asn} || value ∈ {0.0.0.0/0, ::/0}`.
+ * Same first-5 rule as the account list.
+ */
+export declare function projectZoneAccessRules(raw: unknown): ProjectionResult<AccessRuleData[]>;
+/**
+ * `access_identity_providers`: `{type}`. createAccessIdentityProvidersCheck
+ * (1515-1540) reads `.length` and compares `type.toLowerCase()` with fixed
+ * literals; `type` is never printed, so non-token types become `'other'`.
+ */
+export declare function projectIdentityProviders(raw: unknown): ProjectionResult<IdentityProviderData[]>;
+/**
+ * `access_service_tokens`: `expires_at`. createAccessServiceTokensCheck
+ * (1587-1593) only evaluates `Date.parse(expires_at || expiresAt) < now` for
+ * string values, so a parseable value is normalised to ISO (extended years are
+ * clamped to the 4-digit range, which keeps the comparison) and anything else
+ * is dropped (both give "not expired").
+ */
+export declare function projectServiceTokens(raw: unknown): ProjectionResult<ServiceTokenData[]>;
+/**
+ * `gateway_rules`: `enabled:false` iff `=== false`, `filters` verbatim.
+ * createGatewayRulesCheck (1655-1680) counts `enabled !== false` and prints
+ * each filter with its count.
+ */
+export declare function projectGatewayRules(raw: unknown): ProjectionResult<GatewayRuleData[]>;
+/**
+ * `cfd_tunnels`: `status` and `is_deleted:true` iff `deleted_at || is_deleted
+ * === true`. createCloudflareTunnelsCheck (1801-1814) only compares
+ * `status.toLowerCase()` with fixed literals, so non-token statuses become `'other'`.
+ */
+export declare function projectTunnels(raw: unknown): ProjectionResult<TunnelData[]>;
+/**
+ * `zone_setting`: `value` only, verbatim. Every setting check reads
+ * `statusValue(read)` (= `.value`, 1053-1056) or `wafSetting.data.value`
+ * (2324, 3535); minify (2905-2953) and HSTS (3695-3727) print sub-keys at
+ * depth ≤ 2. Values are printed, so a non-token string, an array or a deeper
+ * object fails the entry rather than being altered.
+ */
+export declare function projectZoneSetting(raw: unknown): ProjectionResult<SettingData>;
+/**
+ * `zone_dnssec`: `status, algorithm`. createDNSSECCheck (2114-2160) compares
+ * and prints `status.toLowerCase()` and prints a truthy `algorithm`.
+ */
+export declare function projectDnssec(raw: unknown): ProjectionResult<DnssecData>;
+/**
+ * `zone_dns_records` (all pages, API order): only `(A|AAAA) && content` records.
+ * findOriginExposure and detectOriginIpReuseAcrossZones (3307-3373) read
+ * `type`, `content` (as a Map key and through `maskIp`), `proxied` (truthiness)
+ * and `name`, which is printed only for non-proxied records (3292-3297); proxied
+ * names are only counted. `content` stays raw here and is pseudonymised by
+ * `createIpPseudonymizer` (via `assembleSnapshot`) once every zone is collected.
+ */
+export declare function projectDnsRecords(raw: unknown): ProjectionResult<DnsRecordData[]>;
+/**
+ * `zone_universal_ssl`, `zone_total_tls`, `zone_page_shield`: `enabled`.
+ * The checks read `enabled !== false` (3797) and `enabled === true` (2697,
+ * 3832); a non-boolean `enabled` gives the same outcome as an absent one.
+ */
+export declare function projectEnabledOnly(raw: unknown): ProjectionResult<EnabledOnlyData>;
+/**
+ * `zone_rulesets` heads: `id, phase`, `name:'ddos'` iff the name contains
+ * "ddos"; `kind` and `version` are dropped. `name` is read only by
+ * createDDoSCheck (2511); `phase` at 2326, 2511, 2559-2564, 3446 and 4019.
+ */
+export declare function projectRulesetHeads(raw: unknown): ProjectionResult<RulesetHeadData[]>;
+/**
+ * `zone_ruleset` detail: the head fields plus projected rules (not yet
+ * encoded). Rules feed analyzeRulesets (3425-3460), createWAFAnalysisFromRulesets
+ * (3979-4047), hasExecutedRuleset (2412-2429) and the rate-limiting count (2559-2564):
+ * - `action` raw if `^[A-Za-z_]{1,32}$`, else `'other'` (never equal to a compared action);
+ * - `enabled:false` iff `=== false`;
+ * - `expression` only on block rules: `'true'` or the geoip sentinel, else omitted;
+ * - `action_parameters` only on `execute`: a managed `id` and the matched name needles;
+ * - `id`, `description` (or `ref` when `description` is empty) only on issue rules.
+ * More than `maxRulesPerBody` rules, or more than `maxRunsPerBody` runs, fails
+ * with `output_too_large`.
+ */
+export declare function projectRulesetDetail(raw: unknown): ProjectionResult<ProjectedRulesetDetail>;
+/**
+ * `zone_page_rules`: one item per rule; `actions[].id` filtered to the five
+ * legacy IDs (first occurrence order). createPageRulesCheck (3601-3650) reads
+ * `.length` and detectDeprecatedPageRuleActions.
+ */
+export declare function projectPageRules(raw: unknown): ProjectionResult<PageRuleData[]>;
+/**
+ * `zone_bot_management`. createBotManagementCheck (2815-2850) prints
+ * `Boolean(fight_mode)` and `Boolean(enable_js)` (kept as `!!value`), tests
+ * `Object.values(...).some(v === 'block' || v === 'enabled')` (other strings
+ * become `''` or `'other'`, preserving truthiness) and prints
+ * `Object.keys(stale_zone_configuration).join(', ')`. That key list is kept as
+ * an array in exactly the `Object.keys` order the live scanner sees (integer-like
+ * keys first, then insertion order); the replay client turns it back into
+ * `{key: true}`. An object would lose the order, because the serialiser sorts
+ * object keys.
+ */
+export declare function projectBotManagement(raw: unknown): ProjectionResult<BotManagementData>;
+/**
+ * `zone_schema_validation_settings`: top-level primitives (same string rule as
+ * bot management). createApiShieldCheck (3858-3883) compares values with
+ * `'block'`, `'log'` and `true`.
+ */
+export declare function projectSchemaValidationSettings(raw: unknown): ProjectionResult<SchemaValidationSettingsData>;
+/**
+ * One projector per collectable kind. Each takes the raw `cf` JSON exactly as
+ * printed (the bare result object, or for lists the bare arrays of every page
+ * concatenated in API order) and returns the snapshot data or a
+ * `collection_failed` detail.
+ */
+export declare const PROJECTORS: {
+    readonly account: typeof projectAccount;
+    readonly zones: typeof projectZones;
+    readonly account_members: typeof projectAccountMembers;
+    readonly account_rulesets: typeof projectCounted;
+    readonly account_access_rules: typeof projectAccountAccessRules;
+    readonly access_apps: typeof projectCounted;
+    readonly access_identity_providers: typeof projectIdentityProviders;
+    readonly access_service_tokens: typeof projectServiceTokens;
+    readonly gateway_rules: typeof projectGatewayRules;
+    readonly gateway_locations: typeof projectCounted;
+    readonly cfd_tunnels: typeof projectTunnels;
+    readonly zone_setting: typeof projectZoneSetting;
+    readonly zone_dnssec: typeof projectDnssec;
+    readonly zone_dns_records: typeof projectDnsRecords;
+    readonly zone_universal_ssl: typeof projectEnabledOnly;
+    readonly zone_total_tls: typeof projectEnabledOnly;
+    readonly zone_rulesets: typeof projectRulesetHeads;
+    readonly zone_ruleset: typeof projectRulesetDetail;
+    readonly zone_access_rules: typeof projectZoneAccessRules;
+    readonly zone_page_rules: typeof projectPageRules;
+    readonly zone_bot_management: typeof projectBotManagement;
+    readonly zone_page_shield: typeof projectEnabledOnly;
+    readonly zone_schema_validation_settings: typeof projectSchemaValidationSettings;
+    readonly zone_schema_validation_schemas: typeof projectCounted;
+};
+export declare const NOT_COLLECTED_RESULT: NotCollectedResult;
+export declare function httpErrorResult(status: number): HttpErrorResult;
+export declare function collectionFailedResult(detail: CollectionFailureDetail): CollectionFailedResult;
+/** Turn a projector outcome into an entry `result`. */
+export declare function projectionToResult<T>(projection: ProjectionResult<T>): {
+    ok: true;
+    data: T;
+} | CollectionFailedResult;
+/** Run-length encode consecutive identical projected rules into `{...rule, n}`. */
+export declare function encodeRuleRuns(rules: readonly ProjectedRule[]): RuleRun[];
+/** Restore the exact rule order and count of a body; every rule is a fresh object. */
+export declare function expandRuleRuns(runs: readonly RuleRun[]): ProjectedRule[];
+export interface RuleBodyEncoder {
+    /** Encode a ruleset's rules; returns its body ref, or `undefined` when it has no rules. */
+    add(rules: readonly ProjectedRule[]): string | undefined;
+    /** Bodies named `r0`, `r1`, … in first-occurrence order; identical content shares a body. */
+    bodies(): Record<string, RuleRun[]>;
+}
+export declare function createRuleBodyEncoder(): RuleBodyEncoder;
+export interface IpPseudonymizer {
+    /** Pseudonymise one A/AAAA content string; memoised by the exact string. */
+    pseudonymize(content: string): ProjectionResult<string>;
+}
+/**
+ * Per-prefix sequential pseudonyms, applied in zone list order and record API
+ * order. IPv6 (any `:`) keeps its first three `:`-groups and becomes
+ * `${prefix}:ffff:${n.toString(16)}`; IPv4 (4 dot parts) keeps `a.b` and
+ * becomes `a.b.${n >> 8}.${n & 255}`; `n` counts from 1 per prefix. The mapping
+ * is a bijection on the snapshot, keeps Map insertion order, distinct prefixes
+ * never collide, and scanner `maskIp` (4234-4240) output is byte-identical.
+ */
+export declare function createIpPseudonymizer(): IpPseudonymizer;
+export type CollectedRulesetEntry = {
+    kind: 'zone_ruleset';
+    zoneId: string;
+    rulesetId: string;
+    result: {
+        ok: true;
+        data: ProjectedRulesetDetail;
+    } | HttpErrorResult | CollectionFailedResult;
+};
+/** An entry as the collector holds it: final, except ruleset details keep their projected rules. */
+export type CollectedEntry = Exclude<SnapshotEntry, {
+    kind: 'zone_ruleset';
+}> | CollectedRulesetEntry;
+export interface AssembleSnapshotInput {
+    accountId: string;
+    collector: SnapshotCollector;
+    entries: readonly CollectedEntry[];
+}
+/**
+ * Build the snapshot from collected entries. In order:
+ * 1. Collector rule: a zone with any `collection_failed` ruleset detail gets its
+ *    `zone_rulesets` rewritten to `collection_failed` with that detail (first
+ *    failure in list order) and keeps no `zone_ruleset` entries, so the scanner
+ *    never falls back to rule-less heads (874-891).
+ * 2. IP pseudonymisation over `zone_dns_records` in zone list order and record
+ *    order; a list with unrepresentable content becomes `collection_failed`.
+ * 3. Canonical entry order (`expectedEntryKeys`); unexpected entries go last.
+ * 4. Rule bodies encoded and deduplicated in that order.
+ * The result is not validated: parse it with `CloudflareCheckupSnapshotV1Schema`.
+ */
+export declare function assembleSnapshot(input: AssembleSnapshotInput): CloudflareCheckupSnapshotV1;
+/**
+ * Stable snapshot formatting (§F7): top-level keys in a fixed order, one
+ * compact entry and one compact rule body per line, trailing newline. Entry
+ * keys keep a fixed order and data keys are sorted, so the output depends only
+ * on content (`serializeSnapshot(parse(text)) === text`). The output is the
+ * exact byte sequence the CLI writes, hashes and uploads.
+ */
+export declare function serializeSnapshot(snapshot: CloudflareCheckupSnapshotV1): string;
+export declare const LOCAL_ERROR_REASONS: readonly ["session_invalid", "session_expired", "session_used", "session_busy", "session_not_ready", "run_closed", "browser_origin", "malformed_json", "digest_mismatch", "unsupported_media_type", "length_required", "snapshot_too_large", "snapshot_invalid", "snapshot_incomplete", "account_mismatch", "snapshot_stale", "collector_unsupported", "secret_like_value", "evaluation_failed", "rate_limited", "local_mode_disabled", "storage_unavailable", "request_invalid", "email_invalid", "code_invalid", "verification_invalid", "verification_expired"];
+export type LocalErrorReason = (typeof LOCAL_ERROR_REASONS)[number];
+export declare const LOCAL_SESSION_STATES: readonly ["awaiting_upload", "processing", "completed"];
+export type LocalSessionState = (typeof LOCAL_SESSION_STATES)[number];
+export declare const LocalSessionResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    session: z.ZodObject<{
+        accountId: z.ZodNullable<z.ZodString>;
+        requester: z.ZodString;
+        expiresAt: z.ZodISODateTime;
+        state: z.ZodEnum<{
+            completed: "completed";
+            awaiting_upload: "awaiting_upload";
+            processing: "processing";
+        }>;
+        accepts: z.ZodObject<{
+            schemaVersions: z.ZodArray<z.ZodString>;
+            maxBytes: z.ZodNumber;
+            maxZones: z.ZodNumber;
+        }, z.core.$strip>;
+        minCliVersion: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const LocalSnapshotResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    replayed: z.ZodBoolean;
+    snapshotSha256: z.ZodString;
+    provenance: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    report: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    resultsUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export declare const LocalRequestBodySchema: z.ZodObject<{
+    email: z.ZodString;
+    locale: z.ZodEnum<{
+        en: "en";
+        "pt-PT": "pt-PT";
+        ar: "ar";
+    }>;
+}, z.core.$strict>;
+export declare const LocalVerifyBodySchema: z.ZodObject<{
+    verification: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strict>;
+export declare const LocalRequestResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    verification: z.ZodObject<{
+        token: z.ZodString;
+        requester: z.ZodString;
+        expiresAt: z.ZodISODateTime;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const LocalVerifyResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    session: z.ZodObject<{
+        code: z.ZodString;
+        requester: z.ZodString;
+        expiresAt: z.ZodISODateTime;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const LocalErrorResponseSchema: z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    status: z.ZodNumber;
+    code: z.ZodString;
+    reason: z.ZodOptional<z.ZodEnum<{
+        rate_limited: "rate_limited";
+        snapshot_invalid: "snapshot_invalid";
+        snapshot_incomplete: "snapshot_incomplete";
+        secret_like_value: "secret_like_value";
+        session_invalid: "session_invalid";
+        session_expired: "session_expired";
+        session_used: "session_used";
+        session_busy: "session_busy";
+        session_not_ready: "session_not_ready";
+        run_closed: "run_closed";
+        browser_origin: "browser_origin";
+        malformed_json: "malformed_json";
+        digest_mismatch: "digest_mismatch";
+        unsupported_media_type: "unsupported_media_type";
+        length_required: "length_required";
+        snapshot_too_large: "snapshot_too_large";
+        account_mismatch: "account_mismatch";
+        snapshot_stale: "snapshot_stale";
+        collector_unsupported: "collector_unsupported";
+        evaluation_failed: "evaluation_failed";
+        local_mode_disabled: "local_mode_disabled";
+        storage_unavailable: "storage_unavailable";
+        request_invalid: "request_invalid";
+        email_invalid: "email_invalid";
+        code_invalid: "code_invalid";
+        verification_invalid: "verification_invalid";
+        verification_expired: "verification_expired";
+    }>>;
+    retryAfterSec: z.ZodOptional<z.ZodNumber>;
+    issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        code: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type LocalSessionResponse = z.infer<typeof LocalSessionResponseSchema>;
+export type LocalSnapshotResponse = z.infer<typeof LocalSnapshotResponseSchema>;
+export type LocalErrorResponse = z.infer<typeof LocalErrorResponseSchema>;
+export type LocalRequestBody = z.infer<typeof LocalRequestBodySchema>;
+export type LocalVerifyBody = z.infer<typeof LocalVerifyBodySchema>;
+export type LocalRequestResponse = z.infer<typeof LocalRequestResponseSchema>;
+export type LocalVerifyResponse = z.infer<typeof LocalVerifyResponseSchema>;
+export {};
+//# sourceMappingURL=contract.d.ts.map