@vigilbase/cli 0.2.4 → 0.2.6

package/dist/local/cloudflare-checkup/contract.d.ts

@@ -21,8 +21,8 @@
  * Line references below are to `packages/tools/src/cloudflare-checkup/scanner.ts`
  * before the read-client refactor; the function names are the stable anchor.
  *
- * Any change to a field read or a projection rule is a new schema version
- * (`/2`), and the server then accepts both for at least one CLI minor release.
+ * Optional protection entries and DNS hostname coverage extend V1; older V1
+ * snapshots remain accepted with the same required entry checks.
  */
 import { z } from 'zod';
 export declare const SNAPSHOT_SCHEMA_VERSION: "vigilbase.cloudflare-checkup.snapshot/1";
@@ -39,6 +39,8 @@ export declare const LOCAL_AVAILABILITY_PATH: "/api/v1/tools/cloudflare-checkup/
 export declare const LOCAL_REQUEST_PATH: "/api/v1/tools/cloudflare-checkup/local-session/request";
 /** The CLI trades the verification token and the emailed code for a session code. */
 export declare const LOCAL_VERIFY_PATH: "/api/v1/tools/cloudflare-checkup/local-session/verify";
+/** Exchange a signed, run-scoped One identity proof for an upload session. */
+export declare const LOCAL_IDENTITY_PATH: "/api/v1/tools/cloudflare-checkup/local-session/identity";
 /** `vbcv1_` + base64url_nopad(iv[12] ‖ AES-256-GCM(runId[16] ‖ iat[4]) ‖ tag[16]): names a run awaiting its emailed code. */
 export declare const VERIFICATION_TOKEN_REGEX: RegExp;
 /** The six-digit code One emails for a tool run. */
@@ -68,7 +70,7 @@ export declare const SNAPSHOT_LIMITS: Readonly<{
     maxCollectionHours: 6;
     maxAgeHours: 24;
     maxFutureSkewSeconds: 300;
-    rulesetListTruncationAt: 100;
+    rulesetListTruncationAt: 50;
 }>;
 export declare const ZONE_SETTING_IDS: readonly ["ssl", "always_use_https", "min_tls_version", "tls_1_3", "security_level", "email_obfuscation", "hotlink_protection", "browser_check", "origin_pulls", "challenge_ttl", "browser_cache_ttl", "minify", "early_hints", "rocket_loader", "waf", "automatic_https_rewrites", "security_header", "opportunistic_encryption", "always_online"];
 export declare const MANAGED_RULESET_IDS: readonly string[];
@@ -76,12 +78,32 @@ export declare const MANAGED_NAME_NEEDLES: readonly ["cloudflare managed ruleset
 export declare const LEGACY_PAGE_RULE_ACTIONS: readonly ["disable_security", "disable_performance", "waf", "security_level", "browser_check"];
 export declare const ACCOUNT_KINDS: readonly ["account", "zones", "account_members", "account_rulesets", "account_access_rules", "access_apps", "access_identity_providers", "access_service_tokens", "gateway_rules", "gateway_locations", "cfd_tunnels"];
 export declare const ZONE_SINGLE_KINDS: readonly ["zone_dnssec", "zone_dns_records", "zone_universal_ssl", "zone_total_tls", "zone_rulesets", "zone_access_rules", "zone_page_rules", "zone_bot_management", "zone_page_shield", "zone_schema_validation_settings", "zone_schema_validation_schemas"];
+export declare const OPTIONAL_ZONE_KINDS: readonly ["zone_certificate_packs", "zone_custom_certificates", "zone_api_operations"];
+export declare const SNAPSHOT_PROTECTION_COVERAGE_DESCRIPTORS: {
+    readonly zone_certificate_packs: {
+        readonly label: "Edge certificate packs";
+        readonly affects: readonly ["certificate_coverage", "certificate_expiry"];
+    };
+    readonly zone_custom_certificates: {
+        readonly label: "Custom edge certificates";
+        readonly affects: readonly ["certificate_coverage", "certificate_expiry"];
+    };
+    readonly zone_api_operations: {
+        readonly label: "API operation schema enforcement";
+        readonly affects: readonly ["api_enforcement_coverage"];
+    };
+    readonly zone_effective_waf_inputs: {
+        readonly label: "Effective WAF scope and overrides";
+        readonly affects: readonly ["managed_ruleset_coverage", "managed_ruleset_overrides"];
+    };
+};
 export declare const NOT_COLLECTABLE_ZONE_KINDS: readonly ["zone_legacy_firewall_rules", "zone_legacy_filters", "zone_legacy_waf_packages", "zone_legacy_rate_limits", "zone_waf_analytics"];
-export declare const SNAPSHOT_KINDS: readonly ["account", "zones", "account_members", "account_rulesets", "account_access_rules", "access_apps", "access_identity_providers", "access_service_tokens", "gateway_rules", "gateway_locations", "cfd_tunnels", "zone_setting", "zone_dnssec", "zone_dns_records", "zone_universal_ssl", "zone_total_tls", "zone_rulesets", "zone_access_rules", "zone_page_rules", "zone_bot_management", "zone_page_shield", "zone_schema_validation_settings", "zone_schema_validation_schemas", "zone_ruleset", "zone_legacy_firewall_rules", "zone_legacy_filters", "zone_legacy_waf_packages", "zone_legacy_rate_limits", "zone_waf_analytics"];
+export declare const SNAPSHOT_KINDS: readonly ["account", "zones", "account_members", "account_rulesets", "account_access_rules", "access_apps", "access_identity_providers", "access_service_tokens", "gateway_rules", "gateway_locations", "cfd_tunnels", "zone_setting", "zone_dnssec", "zone_dns_records", "zone_universal_ssl", "zone_total_tls", "zone_rulesets", "zone_access_rules", "zone_page_rules", "zone_bot_management", "zone_page_shield", "zone_schema_validation_settings", "zone_schema_validation_schemas", "zone_certificate_packs", "zone_custom_certificates", "zone_api_operations", "zone_ruleset", "zone_legacy_firewall_rules", "zone_legacy_filters", "zone_legacy_waf_packages", "zone_legacy_rate_limits", "zone_waf_analytics"];
 export declare const COLLECTION_FAILURE_DETAILS: readonly ["cf_error", "invalid_output", "timeout", "output_too_large", "possibly_truncated", "page_limit", "command_unavailable"];
 export declare const RECOMMENDED_CF_SCOPES: readonly ["account:read", "account-settings.read", "memberships.read", "user:read", "user-details.read", "zone:read", "zone.read", "zone-settings.read", "dns.read", "dns_records:read", "ssl-and-certificates.read", "zone-waf.read", "account-waf.read", "account-rulesets.read", "http-ddos-managed-ruleset.read", "firewall-services.read", "account-firewall-access-rules.read", "page-rules.read", "bot-management.read", "page-shield.read", "domain-page-shield.read", "api-gateway.read", "access.read", "access:read", "access-app.read", "access-idp.read", "access-service-token.read", "teams.read", "teams:read", "argotunnel.read", "teams-connector-cloudflared.read"];
 export type AccountKind = (typeof ACCOUNT_KINDS)[number];
 export type ZoneSingleKind = (typeof ZONE_SINGLE_KINDS)[number];
+export type OptionalZoneKind = (typeof OPTIONAL_ZONE_KINDS)[number];
 export type NotCollectableZoneKind = (typeof NOT_COLLECTABLE_ZONE_KINDS)[number];
 export type SnapshotKind = (typeof SNAPSHOT_KINDS)[number];
 export type CollectableKind = Exclude<SnapshotKind, NotCollectableZoneKind>;
@@ -140,7 +162,8 @@ export declare const ZoneData: z.ZodObject<{
     type: z.ZodOptional<z.ZodString>;
     development_mode: z.ZodOptional<z.ZodNumber>;
     plan: z.ZodOptional<z.ZodObject<{
-        name: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        legacy_id: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     account: z.ZodObject<{
         id: z.ZodString;
@@ -182,7 +205,7 @@ export declare const DnssecData: z.ZodObject<{
     status: z.ZodOptional<z.ZodString>;
     algorithm: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
 }, z.core.$strict>;
-export declare const DnsRecordData: z.ZodObject<{
+export declare const DnsRecordData: z.ZodUnion<readonly [z.ZodObject<{
     type: z.ZodEnum<{
         A: "A";
         AAAA: "AAAA";
@@ -190,16 +213,61 @@ export declare const DnsRecordData: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     content: z.ZodString;
     proxied: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"CNAME">;
+    name: z.ZodOptional<z.ZodString>;
+    proxied: z.ZodLiteral<true>;
+}, z.core.$strict>]>;
+export declare const CertificateData: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_on: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>;
+export declare const CertificatePackData: z.ZodObject<{
+    status: z.ZodOptional<z.ZodString>;
+    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    expires_on: z.ZodOptional<z.ZodISODateTime>;
+    certificates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        status: z.ZodOptional<z.ZodString>;
+        hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        expires_on: z.ZodOptional<z.ZodISODateTime>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare const ApiOperationData: z.ZodObject<{
+    features: z.ZodOptional<z.ZodObject<{
+        schema_info: z.ZodOptional<z.ZodObject<{
+            active_schema: z.ZodOptional<z.ZodObject<{
+                id: z.ZodString;
+            }, z.core.$strict>>;
+            mitigation_action: z.ZodOptional<z.ZodEnum<{
+                block: "block";
+                log: "log";
+                none: "none";
+            }>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export declare const RulesetHeadData: z.ZodObject<{
     id: z.ZodString;
     phase: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        custom: "custom";
+        root: "root";
+        managed: "managed";
+        zone: "zone";
+    }>>;
 }, z.core.$strict>;
 export declare const RulesetDetailData: z.ZodObject<{
     id: z.ZodString;
     phase: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        custom: "custom";
+        root: "root";
+        managed: "managed";
+        zone: "zone";
+    }>>;
     rulesBody: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const PageRuleData: z.ZodObject<{
@@ -225,6 +293,7 @@ export declare const ProjectedRuleData: z.ZodObject<{
     action: z.ZodOptional<z.ZodString>;
     enabled: z.ZodOptional<z.ZodLiteral<false>>;
     expression: z.ZodOptional<z.ZodEnum<{
+        false: "false";
         true: "true";
         "ip.geoip.country in": "ip.geoip.country in";
     }>>;
@@ -240,6 +309,7 @@ export declare const RuleRunData: z.ZodObject<{
     action: z.ZodOptional<z.ZodString>;
     enabled: z.ZodOptional<z.ZodLiteral<false>>;
     expression: z.ZodOptional<z.ZodEnum<{
+        false: "false";
         true: "true";
         "ip.geoip.country in": "ip.geoip.country in";
     }>>;
@@ -256,10 +326,17 @@ export declare const ProjectedRulesetDetailData: z.ZodObject<{
     id: z.ZodString;
     phase: z.ZodOptional<z.ZodString>;
     name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        custom: "custom";
+        root: "root";
+        managed: "managed";
+        zone: "zone";
+    }>>;
     rules: z.ZodArray<z.ZodObject<{
         action: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodLiteral<false>>;
         expression: z.ZodOptional<z.ZodEnum<{
+            false: "false";
             true: "true";
             "ip.geoip.country in": "ip.geoip.country in";
         }>>;
@@ -322,7 +399,8 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             type: z.ZodOptional<z.ZodString>;
             development_mode: z.ZodOptional<z.ZodNumber>;
             plan: z.ZodOptional<z.ZodObject<{
-                name: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                legacy_id: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             account: z.ZodObject<{
                 id: z.ZodString;
@@ -633,7 +711,7 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     zoneId: z.ZodString;
     result: z.ZodUnion<readonly [z.ZodObject<{
         ok: z.ZodLiteral<true>;
-        data: z.ZodArray<z.ZodObject<{
+        data: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             type: z.ZodEnum<{
                 A: "A";
                 AAAA: "AAAA";
@@ -641,7 +719,11 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
             content: z.ZodString;
             proxied: z.ZodOptional<z.ZodLiteral<true>>;
-        }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"CNAME">;
+            name: z.ZodOptional<z.ZodString>;
+            proxied: z.ZodLiteral<true>;
+        }, z.core.$strict>]>>;
     }, z.core.$strict>, z.ZodObject<{
         ok: z.ZodLiteral<false>;
         reason: z.ZodLiteral<"http_error">;
@@ -718,6 +800,12 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
             phase: z.ZodOptional<z.ZodString>;
             name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                custom: "custom";
+                root: "root";
+                managed: "managed";
+                zone: "zone";
+            }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>, z.ZodObject<{
         ok: z.ZodLiteral<false>;
@@ -746,6 +834,12 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
             phase: z.ZodOptional<z.ZodString>;
             name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+            kind: z.ZodOptional<z.ZodEnum<{
+                custom: "custom";
+                root: "root";
+                managed: "managed";
+                zone: "zone";
+            }>>;
             rulesBody: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
@@ -911,6 +1005,110 @@ export declare const SnapshotEntrySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             command_unavailable: "command_unavailable";
         }>;
     }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_certificate_packs">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            status: z.ZodOptional<z.ZodString>;
+            hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            expires_on: z.ZodOptional<z.ZodISODateTime>;
+            certificates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                expires_on: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_custom_certificates">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            status: z.ZodOptional<z.ZodString>;
+            hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            expires_on: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>]>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"zone_api_operations">;
+    zoneId: z.ZodString;
+    result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        data: z.ZodArray<z.ZodObject<{
+            features: z.ZodOptional<z.ZodObject<{
+                schema_info: z.ZodOptional<z.ZodObject<{
+                    active_schema: z.ZodOptional<z.ZodObject<{
+                        id: z.ZodString;
+                    }, z.core.$strict>>;
+                    mitigation_action: z.ZodOptional<z.ZodEnum<{
+                        block: "block";
+                        log: "log";
+                        none: "none";
+                    }>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"http_error">;
+        status: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"collection_failed">;
+        detail: z.ZodEnum<{
+            timeout: "timeout";
+            cf_error: "cf_error";
+            invalid_output: "invalid_output";
+            output_too_large: "output_too_large";
+            possibly_truncated: "possibly_truncated";
+            page_limit: "page_limit";
+            command_unavailable: "command_unavailable";
+        }>;
+    }, z.core.$strict>]>, z.ZodObject<{
+        ok: z.ZodLiteral<false>;
+        reason: z.ZodLiteral<"not_collected">;
+    }, z.core.$strict>]>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
     zoneId: z.ZodString;
@@ -1025,7 +1223,8 @@ declare const SnapshotObjectSchema: z.ZodObject<{
                 type: z.ZodOptional<z.ZodString>;
                 development_mode: z.ZodOptional<z.ZodNumber>;
                 plan: z.ZodOptional<z.ZodObject<{
-                    name: z.ZodString;
+                    name: z.ZodOptional<z.ZodString>;
+                    legacy_id: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 account: z.ZodObject<{
                     id: z.ZodString;
@@ -1336,7 +1535,7 @@ declare const SnapshotObjectSchema: z.ZodObject<{
         zoneId: z.ZodString;
         result: z.ZodUnion<readonly [z.ZodObject<{
             ok: z.ZodLiteral<true>;
-            data: z.ZodArray<z.ZodObject<{
+            data: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
                 type: z.ZodEnum<{
                     A: "A";
                     AAAA: "AAAA";
@@ -1344,7 +1543,11 @@ declare const SnapshotObjectSchema: z.ZodObject<{
                 name: z.ZodOptional<z.ZodString>;
                 content: z.ZodString;
                 proxied: z.ZodOptional<z.ZodLiteral<true>>;
-            }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"CNAME">;
+                name: z.ZodOptional<z.ZodString>;
+                proxied: z.ZodLiteral<true>;
+            }, z.core.$strict>]>>;
         }, z.core.$strict>, z.ZodObject<{
             ok: z.ZodLiteral<false>;
             reason: z.ZodLiteral<"http_error">;
@@ -1421,6 +1624,12 @@ declare const SnapshotObjectSchema: z.ZodObject<{
                 id: z.ZodString;
                 phase: z.ZodOptional<z.ZodString>;
                 name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    custom: "custom";
+                    root: "root";
+                    managed: "managed";
+                    zone: "zone";
+                }>>;
             }, z.core.$strict>>;
         }, z.core.$strict>, z.ZodObject<{
             ok: z.ZodLiteral<false>;
@@ -1449,6 +1658,12 @@ declare const SnapshotObjectSchema: z.ZodObject<{
                 id: z.ZodString;
                 phase: z.ZodOptional<z.ZodString>;
                 name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    custom: "custom";
+                    root: "root";
+                    managed: "managed";
+                    zone: "zone";
+                }>>;
                 rulesBody: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
@@ -1614,6 +1829,110 @@ declare const SnapshotObjectSchema: z.ZodObject<{
                 command_unavailable: "command_unavailable";
             }>;
         }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_certificate_packs">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                expires_on: z.ZodOptional<z.ZodISODateTime>;
+                certificates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    status: z.ZodOptional<z.ZodString>;
+                    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    expires_on: z.ZodOptional<z.ZodISODateTime>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_custom_certificates">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                expires_on: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_api_operations">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                features: z.ZodOptional<z.ZodObject<{
+                    schema_info: z.ZodOptional<z.ZodObject<{
+                        active_schema: z.ZodOptional<z.ZodObject<{
+                            id: z.ZodString;
+                        }, z.core.$strict>>;
+                        mitigation_action: z.ZodOptional<z.ZodEnum<{
+                            block: "block";
+                            log: "log";
+                            none: "none";
+                        }>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
         zoneId: z.ZodString;
@@ -1654,6 +1973,7 @@ declare const SnapshotObjectSchema: z.ZodObject<{
         action: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodLiteral<false>>;
         expression: z.ZodOptional<z.ZodEnum<{
+            false: "false";
             true: "true";
             "ip.geoip.country in": "ip.geoip.country in";
         }>>;
@@ -1724,7 +2044,8 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
                 type: z.ZodOptional<z.ZodString>;
                 development_mode: z.ZodOptional<z.ZodNumber>;
                 plan: z.ZodOptional<z.ZodObject<{
-                    name: z.ZodString;
+                    name: z.ZodOptional<z.ZodString>;
+                    legacy_id: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 account: z.ZodObject<{
                     id: z.ZodString;
@@ -2035,7 +2356,7 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
         zoneId: z.ZodString;
         result: z.ZodUnion<readonly [z.ZodObject<{
             ok: z.ZodLiteral<true>;
-            data: z.ZodArray<z.ZodObject<{
+            data: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
                 type: z.ZodEnum<{
                     A: "A";
                     AAAA: "AAAA";
@@ -2043,7 +2364,11 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
                 name: z.ZodOptional<z.ZodString>;
                 content: z.ZodString;
                 proxied: z.ZodOptional<z.ZodLiteral<true>>;
-            }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"CNAME">;
+                name: z.ZodOptional<z.ZodString>;
+                proxied: z.ZodLiteral<true>;
+            }, z.core.$strict>]>>;
         }, z.core.$strict>, z.ZodObject<{
             ok: z.ZodLiteral<false>;
             reason: z.ZodLiteral<"http_error">;
@@ -2120,6 +2445,12 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
                 id: z.ZodString;
                 phase: z.ZodOptional<z.ZodString>;
                 name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    custom: "custom";
+                    root: "root";
+                    managed: "managed";
+                    zone: "zone";
+                }>>;
             }, z.core.$strict>>;
         }, z.core.$strict>, z.ZodObject<{
             ok: z.ZodLiteral<false>;
@@ -2148,6 +2479,12 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
                 id: z.ZodString;
                 phase: z.ZodOptional<z.ZodString>;
                 name: z.ZodOptional<z.ZodLiteral<"ddos">>;
+                kind: z.ZodOptional<z.ZodEnum<{
+                    custom: "custom";
+                    root: "root";
+                    managed: "managed";
+                    zone: "zone";
+                }>>;
                 rulesBody: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
@@ -2313,6 +2650,110 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
                 command_unavailable: "command_unavailable";
             }>;
         }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_certificate_packs">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                expires_on: z.ZodOptional<z.ZodISODateTime>;
+                certificates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    status: z.ZodOptional<z.ZodString>;
+                    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    expires_on: z.ZodOptional<z.ZodISODateTime>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_custom_certificates">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                expires_on: z.ZodOptional<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"zone_api_operations">;
+        zoneId: z.ZodString;
+        result: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+            data: z.ZodArray<z.ZodObject<{
+                features: z.ZodOptional<z.ZodObject<{
+                    schema_info: z.ZodOptional<z.ZodObject<{
+                        active_schema: z.ZodOptional<z.ZodObject<{
+                            id: z.ZodString;
+                        }, z.core.$strict>>;
+                        mitigation_action: z.ZodOptional<z.ZodEnum<{
+                            block: "block";
+                            log: "log";
+                            none: "none";
+                        }>>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"http_error">;
+            status: z.ZodNumber;
+        }, z.core.$strict>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"collection_failed">;
+            detail: z.ZodEnum<{
+                timeout: "timeout";
+                cf_error: "cf_error";
+                invalid_output: "invalid_output";
+                output_too_large: "output_too_large";
+                possibly_truncated: "possibly_truncated";
+                page_limit: "page_limit";
+                command_unavailable: "command_unavailable";
+            }>;
+        }, z.core.$strict>]>, z.ZodObject<{
+            ok: z.ZodLiteral<false>;
+            reason: z.ZodLiteral<"not_collected">;
+        }, z.core.$strict>]>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"zone_legacy_firewall_rules">;
         zoneId: z.ZodString;
@@ -2353,6 +2794,7 @@ export declare const CloudflareCheckupSnapshotV1Schema: z.ZodObject<{
         action: z.ZodOptional<z.ZodString>;
         enabled: z.ZodOptional<z.ZodLiteral<false>>;
         expression: z.ZodOptional<z.ZodEnum<{
+            false: "false";
             true: "true";
             "ip.geoip.country in": "ip.geoip.country in";
         }>>;
@@ -2454,7 +2896,7 @@ export type ProjectionResult<T> = {
 export declare function projectAccount(raw: unknown): ProjectionResult<AccountData>;
 /**
  * `zones` (all pages merged, API order): `id, name, status, paused, type,
- * development_mode, plan.name, account.{id,name}`. zoneCtxFor (4338) prints the
+ * development_mode, plan.{name,legacy_id}, account.{id,name}`. zoneCtxFor (4338) prints the
  * account; createZoneStatusCheck (1960-1990), createDevModeCheck (2165-2197),
  * createDNSModeCheck (3218-3234) and assembleCheckupResult (5099-5102) read the rest.
  * `paused` is only tested for truthiness.
@@ -2526,14 +2968,18 @@ export declare function projectZoneSetting(raw: unknown): ProjectionResult<Setti
  */
 export declare function projectDnssec(raw: unknown): ProjectionResult<DnssecData>;
 /**
- * `zone_dns_records` (all pages, API order): only `(A|AAAA) && content` records.
+ * `zone_dns_records` (all pages, API order): `(A|AAAA) && content` records and
+ * proxied CNAME hostnames without their targets.
  * findOriginExposure and detectOriginIpReuseAcrossZones (3307-3373) read
  * `type`, `content` (as a Map key and through `maskIp`), `proxied` (truthiness)
- * and `name`, which is printed only for non-proxied records (3292-3297); proxied
- * names are only counted. `content` stays raw here and is pseudonymised by
+ * and `name`. Certificate coverage reads proxied hostnames. Address `content`
+ * stays raw here and is pseudonymised by
  * `createIpPseudonymizer` (via `assembleSnapshot`) once every zone is collected.
  */
 export declare function projectDnsRecords(raw: unknown): ProjectionResult<DnsRecordData[]>;
+export declare function projectCertificatePacks(raw: unknown): ProjectionResult<z.infer<typeof CertificatePackData>[]>;
+export declare function projectCustomCertificates(raw: unknown): ProjectionResult<z.infer<typeof CertificateData>[]>;
+export declare function projectApiOperations(raw: unknown): ProjectionResult<z.infer<typeof ApiOperationData>[]>;
 /**
  * `zone_universal_ssl`, `zone_total_tls`, `zone_page_shield`: `enabled`.
  * The checks read `enabled !== false` (3797) and `enabled === true` (2697,
@@ -2542,7 +2988,8 @@ export declare function projectDnsRecords(raw: unknown): ProjectionResult<DnsRec
 export declare function projectEnabledOnly(raw: unknown): ProjectionResult<EnabledOnlyData>;
 /**
  * `zone_rulesets` heads: `id, phase`, `name:'ddos'` iff the name contains
- * "ddos"; `kind` and `version` are dropped. `name` is read only by
+ * "ddos"; the managed `kind` marker is retained to distinguish vendor definitions
+ * from customer configuration, while `version` is dropped. `name` is read only by
  * createDDoSCheck (2511); `phase` at 2326, 2511, 2559-2564, 3446 and 4019.
  */
 export declare function projectRulesetHeads(raw: unknown): ProjectionResult<RulesetHeadData[]>;
@@ -2614,6 +3061,9 @@ export declare const PROJECTORS: {
     readonly zone_page_shield: typeof projectEnabledOnly;
     readonly zone_schema_validation_settings: typeof projectSchemaValidationSettings;
     readonly zone_schema_validation_schemas: typeof projectCounted;
+    readonly zone_certificate_packs: typeof projectCertificatePacks;
+    readonly zone_custom_certificates: typeof projectCustomCertificates;
+    readonly zone_api_operations: typeof projectApiOperations;
 };
 export declare const NOT_COLLECTED_RESULT: NotCollectedResult;
 export declare function httpErrorResult(status: number): HttpErrorResult;
@@ -2741,6 +3191,16 @@ export declare const LocalRequestBodySchema: z.ZodObject<{
         ar: "ar";
     }>;
 }, z.core.$strict>;
+export declare const LocalIdentityBodySchema: z.ZodObject<{
+    runId: z.ZodUUID;
+    email: z.ZodEmail;
+    proof: z.ZodString;
+    locale: z.ZodEnum<{
+        en: "en";
+        "pt-PT": "pt-PT";
+        ar: "ar";
+    }>;
+}, z.core.$strict>;
 export declare const LocalVerifyBodySchema: z.ZodObject<{
     verification: z.ZodString;
     code: z.ZodString;
@@ -2805,6 +3265,7 @@ export type LocalAvailabilityResponse = z.infer<typeof LocalAvailabilityResponse
 export type LocalSnapshotResponse = z.infer<typeof LocalSnapshotResponseSchema>;
 export type LocalErrorResponse = z.infer<typeof LocalErrorResponseSchema>;
 export type LocalRequestBody = z.infer<typeof LocalRequestBodySchema>;
+export type LocalIdentityBody = z.infer<typeof LocalIdentityBodySchema>;
 export type LocalVerifyBody = z.infer<typeof LocalVerifyBodySchema>;
 export type LocalRequestResponse = z.infer<typeof LocalRequestResponseSchema>;
 export type LocalVerifyResponse = z.infer<typeof LocalVerifyResponseSchema>;