@zackbart/connecta 0.29.0 → 0.31.0

package/dist/providers/vercel/skill.generated.js

@@ -1,11 +1,10 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "`. Every named account-scoped tool accepts a `teamId` override; pass `null` to target the token owner's personal account.\n## REST complement routing\n\nHosted MCP is the default. Configure this complement with `surface: \"api\"`\nand a separate connector id and access-token credential. OAuth and API-token\nstores are independent; failures never switch identity or replay a write.\nTeam defaults route calls and do not constrain the token's permissions.\n\nUse hosted `list_teams`, `list_projects`, `get_project`, `list_deployments`,\n`get_deployment`, `get_deployment_build_logs` or `list_deployment_events`,\n`get_runtime_logs`, `list_project_domains`, `add_project_domain`, and\n`cancel_deployment` for the corresponding operations. Follow their live schemas,\nnot the removed REST argument shapes. Read deployment status before logs and\nnarrow log windows.\n\nThis complement retains `verify_project_domain`, `remove_project_domain`,\nand `delete_deployment` because the reviewed category\npages do not publish equivalent tools. Hosted `request_promote` moves an existing\nbuild to production and does not rebuild it (the rolling-releases category\nprovides the equivalent that the deployments category does not list). New deployments use hosted\n`create_deployment` or `deploy_to_vercel`.\n\n## Environment values\n\n`list_project_env_vars` never decrypts or returns values. Set `upsert: false` on\n`upsert_project_env_var` for create-only writes that refuse to overwrite. `upsert_project_env_var`,\n`update_project_env_var`, and `delete_project_env_var` return metadata without\nvalues. Create/update values are write input only. The hosted connector excludes\n`filter_project_envs`, `get_project_env`, `create_project_env`, and\n`edit_project_env`, whose published contracts lack these response protections.\nEnvironment changes apply to future deployments.\n\n## REST gaps and uploads\n\n`vercel_api_get` and `vercel_api_mutate` reach uncovered endpoints. They refuse\npaths owned by the canonical hosted or value-safe named tools, including\nproject creation/update, pause/unpause and protection bypass. Ownership covers\nthe published tool categories, not just the old reviewed classifier names;\nunreviewed live tools remain fail-closed writes. Do not use a\nraw hatch to restore a removed duplicate. `upload_file` on MCP owns deployment\nfile uploads; `vercel_api_upload` retains other raw-body endpoints and explicit\nheaders. It never reads a local file. Paths include the API version and cannot\nbe absolute URLs. Query parameters are name/value pairs; `personalAccount: true`\nomits this connection's default team. Rate-limit failures carry vendor retry timing.\n# Vercel MCP usage\n\nOfficial MCP surface: tool names, descriptions, argument schemas, and result\nschemas come from Vercel's live server. Connecta preserves retained vendor contracts and\napplies release-reviewed classification. Reviewed writes stay writes even when Vercel claims they only read.\n\nAccount purpose: \n\n- Hosted MCP owns discovery, deployments, logs, project-domain listing/adding,\n  cancellation and file uploads. Use the separately configured REST complement\n  for value-safe project environment variables, uncovered lifecycle/domain\n  operations and REST gaps. It has its own connector id and credential.\n- Discover the live catalog before assuming a tool exists. Vercel can change\n  the surface independently of a Connecta release, and account features may\n  affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access. A configured API `teamId` is a routing default, not an authorization boundary.\n- MCP pagination and arguments follow the live MCP schemas; do not apply API pagination or argument shapes to them.\n- Resolve team, project, deployment, run, thread, and order ids with the list\n  and get tools. Do not guess opaque ids.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error\n  clusters, and runtime logs. Narrow time windows before raising result limits.\n- Purchase tools change billing. Read a quote first and carry its price,\n  idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL\n  it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update\n  live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n",
+    "content": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
     "instructionsHeading": "Account instructions",
     "fragments": {
-        "guide_0": "`. Every named account-scoped tool accepts a `teamId` override; pass `null` to target the token owner's personal account.",
-        "guide_1": "\n## REST complement routing\n\nHosted MCP is the default. Configure this complement with `surface: \"api\"`\nand a separate connector id and access-token credential. OAuth and API-token\nstores are independent; failures never switch identity or replay a write.\nTeam defaults route calls and do not constrain the token's permissions.\n\nUse hosted `list_teams`, `list_projects`, `get_project`, `list_deployments`,\n`get_deployment`, `get_deployment_build_logs` or `list_deployment_events`,\n`get_runtime_logs`, `list_project_domains`, `add_project_domain`, and\n`cancel_deployment` for the corresponding operations. Follow their live schemas,\nnot the removed REST argument shapes. Read deployment status before logs and\nnarrow log windows.\n\nThis complement retains `verify_project_domain`, `remove_project_domain`,\nand `delete_deployment` because the reviewed category\npages do not publish equivalent tools. Hosted `request_promote` moves an existing\nbuild to production and does not rebuild it (the rolling-releases category\nprovides the equivalent that the deployments category does not list). New deployments use hosted\n`create_deployment` or `deploy_to_vercel`.\n\n## Environment values\n\n`list_project_env_vars` never decrypts or returns values. Set `upsert: false` on\n`upsert_project_env_var` for create-only writes that refuse to overwrite. `upsert_project_env_var`,\n`update_project_env_var`, and `delete_project_env_var` return metadata without\nvalues. Create/update values are write input only. The hosted connector excludes\n`filter_project_envs`, `get_project_env`, `create_project_env`, and\n`edit_project_env`, whose published contracts lack these response protections.\nEnvironment changes apply to future deployments.\n\n## REST gaps and uploads\n\n`vercel_api_get` and `vercel_api_mutate` reach uncovered endpoints. They refuse\npaths owned by the canonical hosted or value-safe named tools, including\nproject creation/update, pause/unpause and protection bypass. Ownership covers\nthe published tool categories, not just the old reviewed classifier names;\nunreviewed live tools remain fail-closed writes. Do not use a\nraw hatch to restore a removed duplicate. `upload_file` on MCP owns deployment\nfile uploads; `vercel_api_upload` retains other raw-body endpoints and explicit\nheaders. It never reads a local file. Paths include the API version and cannot\nbe absolute URLs. Query parameters are name/value pairs; `personalAccount: true`\nomits this connection's default team. Rate-limit failures carry vendor retry timing.\n",
-        "guide_2": "# Vercel MCP usage\n\nOfficial MCP surface: tool names, descriptions, argument schemas, and result\nschemas come from Vercel's live server. Connecta preserves retained vendor contracts and\napplies release-reviewed classification. Reviewed writes stay writes even when Vercel claims they only read.\n\nAccount purpose: ",
-        "guide_3": "\n\n- Hosted MCP owns discovery, deployments, logs, project-domain listing/adding,\n  cancellation and file uploads. Use the separately configured REST complement\n  for value-safe project environment variables, uncovered lifecycle/domain\n  operations and REST gaps. It has its own connector id and credential.\n- Discover the live catalog before assuming a tool exists. Vercel can change\n  the surface independently of a Connecta release, and account features may\n  affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access. A configured API `teamId` is a routing default, not an authorization boundary.\n- MCP pagination and arguments follow the live MCP schemas; do not apply API pagination or argument shapes to them.\n- Resolve team, project, deployment, run, thread, and order ids with the list\n  and get tools. Do not guess opaque ids.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error\n  clusters, and runtime logs. Narrow time windows before raising result limits.\n- Purchase tools change billing. Read a quote first and carry its price,\n  idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL\n  it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update\n  live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or\n  expired. Run `authorize_connector` for this connector id, then retry.\n"
+        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes and the pool's trust policy gates them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; execution follows the configured pool trust policy.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n",
+        "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
     }
 };

package/dist/providers/vercel/value-safety.js

@@ -0,0 +1,328 @@
+// Vercel's reviewed value-safety table (decision 0005, "Value safety"), on the
+// shared mechanism in `../_shared/rest/value-safety.ts`.
+//
+// No tool response, success or error, returns a credential (API, service, or
+// bypass tokens, signing secrets, deploy-hook and other bearer URLs, private
+// keys, authorization verifiers, auth headers) or a stored secret value
+// (environment variables, Global Config items), unless a reviewed named tool
+// exists to return it. Three layers, strongest first:
+//
+// 1. Refuse by operation. `scripts/value-safety.mjs` flags every operation in
+//    the pinned spec whose response may carry one (committed as
+//    `value-safety.candidates.json`); each needs a verdict here, and
+//    `value-safety.node.test.ts` runs the shared harness over this table.
+// 2. Reviewed field paths for `redact` verdicts, applied to every success body
+//    on every path (generic tools, HEAD data, named tools, logs, uploads)
+//    before cursors or `select` read it. Every reviewed operation, and every
+//    one whose request accepts a credential-named field, also answers
+//    failures with fixed messages, never the vendor's text.
+// 3. The shared key-name heuristic, defense in depth only, over every body:
+//    any subtree under a credential-named key, labelled key/value records
+//    whose label is credential-named, environment-variable containers, and
+//    URLs with userinfo or credential query parameters.
+//
+// Residual risk, as with Infisical: a secret a person typed into a free-text
+// name, description, log line, or identifier is out of scope.
+import { redact, refuse as refusal, safe, under, } from "../_shared/rest/value-safety.js";
+/** A refusal's reason reads as a sentence about the operation: "It mints …". */
+const refuse = (reason) => refusal(`It ${reason}`);
+/** A project object: env values, deploy hooks, and protection-bypass secrets. */
+const PROJECT = [
+    "env[].value",
+    "env[].vsmValue",
+    "env[].legacyValue",
+    "link.deployHooks[].url",
+    "protectionBypass@keys",
+    // Header, cookie, and query conditions on internal and firewall routes.
+    "internalRoutes[].has[?header].value",
+    "internalRoutes[].missing[?header].value",
+    "security.firewallRoutes[].has[?header].value",
+    "security.firewallRoutes[].missing[?header].value",
+];
+/** Project metadata whose names contain a credential word. */
+const PROJECT_ALLOW = [
+    "protectionBypass",
+    "oidcTokenConfig",
+    "security.firewallBypassIps",
+    "usageStatus.bypassThrottleUntil",
+    "dismissedToasts[].value",
+];
+const DRAIN = [
+    "delivery.secret",
+    "delivery.headers{}",
+    "origin:delivery.endpoint",
+    "origin:delivery.endpoint.traces",
+    "secret",
+    "headers{}",
+    "origin:url",
+];
+const SHARED_ENV = ["data[].value", "created[].value", "updated[].value", "failed[].error.value"];
+const PROJECT_ENV = ["value", "legacyValue", "vsmValue", "[].value", "[].legacyValue"];
+const CONNECTOR_ALLOW = ["appTokens", "userTokens"];
+const PROJECT_REASON = "Project objects embed environment values, deploy hook URLs, and protection-bypass secrets.";
+const DRAIN_REASON = "Drains store destination credentials (headers, URLs whose path or query can be a bearer secret) and a signing secret.";
+const WEBHOOK = ["secret", "origin:url"];
+const WEBHOOK_REASON = "Webhooks carry a signing secret and a destination URL whose path can be a bearer secret.";
+/** Route rules: a transform that sets a credential-named header carries the credential in `args`. */
+/**
+ * Route rules: every header, cookie, or query transform's `args` and every
+ * header, cookie, or query condition's `value` go, whatever the target key's
+ * form (a string, or a predicate object such as `{ eq: "Authorization" }`);
+ * a header-name list would always miss one (`X-Auth-Key`).
+ */
+const ROUTE_TRANSFORMS = [
+    "transforms[].args",
+    "has[?header].value",
+    "missing[?header].value",
+    // Headers a route sets, and the locale cookie it reads (its name is credential vocabulary).
+    "headers{}",
+    "locale.cookie",
+];
+const DEPLOYMENT = [
+    ...under(["routes[]", "services[].routes[]", "services[].rewrites[]", "services[].redirects[]"], ROUTE_TRANSFORMS),
+    "services[].headers[].headers[].value",
+    "services[].headers[].has[?header].value",
+    "services[].headers[].missing[?header].value",
+];
+const DEPLOYMENT_REASON = "Deployment routes can set credential-named headers (transforms with target.key Authorization) whose args are the credential.";
+const ROUTE_REASON = "Route transforms can set credential-named headers whose args are the credential.";
+const ENV_REASON = "Environment-variable bodies carry decrypted or encrypted values.";
+const NO_SECRET_REASON = "Answers status or nothing; the flag is the operation's name, not its response.";
+const EDGE_ITEMS = "returns Global Config item values, which may be secrets; read them from your application with the Edge Config SDK.";
+const MINT = "mints a credential and returns it in cleartext.";
+const MODEL_CONFIG = "AI Gateway routing configuration; its descriptions mention tokens as model usage units.";
+const KMS_POLICY = "Issuer policies name environments and claims; signing keys stay with Vercel.";
+/** A firewall rule's header, cookie, and query conditions: their values can be credentials (an `X-Auth-Key` match). */
+const FIREWALL_CONDITIONS = [
+    "conditionGroup[].conditions[?header].value",
+    "conditionGroup[].conditions[?header].values",
+];
+/** Every firewall config shape: rules, rulesets, and top-level conditions, active, draft, and versions. */
+const FIREWALL = under(["rules[]", "rulesets[]", "conditions[]"], FIREWALL_CONDITIONS);
+const FIREWALL_REASON = "Firewall rules match header, cookie, and query values, which can be credentials a rule checks for (an X-Auth-Key).";
+const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team (visible to owners).";
+/**
+ * The reviewed verdict for every flagged operation, keyed `METHOD /path`.
+ * `refuse` is never sent by the generic tools; named tools that need one of
+ * these operations project it themselves (value-safe environment variables).
+ */
+const VALUE_SAFETY = {
+    "PATCH /aliases/{id}/protection-bypass": refuse("creates a shareable link that bypasses Deployment Protection."),
+    "POST /api-keys": refuse("mints an AI Gateway API key and returns it in cleartext."),
+    "POST /v1/connect/authorize/{connector}": refuse("starts a Connect authorization for a caller-chosen subject and returns its verifier and device code."),
+    "POST /v1/connect/connectors": safe("Connector capability metadata; appTokens and userTokens describe grants, not tokens.", CONNECTOR_ALLOW),
+    "GET /v1/connect/connectors/{connector}": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "POST /v1/connect/connectors/{connector}/managed/eject": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "PATCH /v1/connect/connectors/{connector}/trigger-destinations": safe("Connector capability metadata.", CONNECTOR_ALLOW),
+    "GET /v2/connect/connectors": safe("Connector capability metadata.", under(["connectors[]"], CONNECTOR_ALLOW)),
+    "PATCH /v2/connect/connectors/{connector}": safe("Connector capability metadata.", under(["connector"], CONNECTOR_ALLOW)),
+    "POST /v1/connect/token/{connector}": refuse("mints a token for a Connect connector."),
+    "GET /v1/drains": redact(DRAIN_REASON, under(["drains[]"], DRAIN)),
+    "POST /v1/drains": redact(DRAIN_REASON, DRAIN),
+    "POST /v1/drains/test": redact("Answers a delivery test; treated as part of the drain family.", DRAIN),
+    "GET /v1/drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "PATCH /v1/drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/log-drains": redact(DRAIN_REASON, under(["drains[]", "[]"], DRAIN)),
+    "POST /v1/log-drains": redact(DRAIN_REASON, DRAIN),
+    "GET /v1/log-drains/{id}": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/log-drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v2/integrations/log-drains": redact(DRAIN_REASON, under(["[]"], DRAIN)),
+    "POST /v2/integrations/log-drains": redact(DRAIN_REASON, DRAIN),
+    "DELETE /v1/integrations/log-drains/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/webhooks": redact(WEBHOOK_REASON, under(["[]", "webhooks[]"], WEBHOOK)),
+    "POST /v1/webhooks": redact(WEBHOOK_REASON, WEBHOOK),
+    "GET /v1/webhooks/{id}": redact(WEBHOOK_REASON, WEBHOOK),
+    "DELETE /v1/webhooks/{id}": safe(NO_SECRET_REASON),
+    "GET /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "POST /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "PATCH /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "DELETE /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "GET /v1/env/{id}": refuse("returns a shared environment variable's decrypted value."),
+    "PATCH /v1/env/{id}/unlink/{projectId}": redact(ENV_REASON, ["value"]),
+    "GET /v1/global-config": safe("Global Config metadata: ids, slugs, sizes, and digests, without items."),
+    "POST /v1/global-config": safe("Answers the created Global Config's metadata."),
+    "GET /v1/global-config/{edgeConfigId}": safe("Global Config metadata without items."),
+    "PUT /v1/global-config/{edgeConfigId}": safe("Answers the updated Global Config's metadata."),
+    "DELETE /v1/global-config/{edgeConfigId}": safe(NO_SECRET_REASON),
+    "GET /v1/global-config/{edgeConfigId}/backups": safe("Lists backup versions and sizes, without items."),
+    "GET /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}": refuse(EDGE_ITEMS),
+    "POST /v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}/restore": safe(NO_SECRET_REASON),
+    "GET /v1/global-config/{edgeConfigId}/item/{edgeConfigItemKey}": refuse(EDGE_ITEMS),
+    "GET /v1/global-config/{edgeConfigId}/items": refuse(EDGE_ITEMS),
+    "PATCH /v1/global-config/{edgeConfigId}/items": safe("Answers a status; item values are write input only."),
+    "GET /v1/global-config/{edgeConfigId}/schema": safe("A JSON Schema for items, without values."),
+    "POST /v1/global-config/{edgeConfigId}/schema": safe("Answers the schema, without values."),
+    "DELETE /v1/global-config/{edgeConfigId}/schema": safe(NO_SECRET_REASON),
+    "POST /v1/global-config/{edgeConfigId}/token": refuse(MINT),
+    "GET /v1/global-config/{edgeConfigId}/token/{token}": refuse("returns a Global Config read token."),
+    "GET /v1/global-config/{edgeConfigId}/tokens": refuse("returns every Global Config read token in cleartext."),
+    "DELETE /v1/global-config/{edgeConfigId}/tokens": safe(NO_SECRET_REASON),
+    "GET /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": refuse(EDGE_ITEMS),
+    "PUT /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": redact("Answers the synced Global Config, items included; item values can be secrets.", ["items"]),
+    "HEAD /v1/installations/{integrationConfigurationId}/resources/{resourceId}/experimentation/global-config": safe("Headers only; the heuristic still covers them."),
+    "POST /v1/installations/{integrationConfigurationId}/credentials/revoke": safe(NO_SECRET_REASON),
+    "POST /v1/installations/{integrationConfigurationId}/credentials/rotate": refuse("rotates an installation credential and returns the new access token."),
+    "PUT /v1/installations/{integrationConfigurationId}/resources/{resourceId}/secrets": safe("Answers nothing; secrets are write input only."),
+    "POST /v1/integrations/sso/token": refuse("exchanges an integration SSO code for access, ID, and refresh tokens."),
+    "POST /v1/kms/issuers/{issuerId}/keys": safe("Answers public key material and key metadata; private keys stay with Vercel."),
+    "POST /v1/kms/issuers/{issuerId}/keys/{keyId}/activate": safe("Answers key metadata."),
+    "POST /v1/kms/issuers/{issuerId}/keys/{keyId}/revoke": safe("Answers issuer metadata; tokenClaims are policy, not tokens."),
+    "POST /v1/kms/issuers/{issuerId}/sign/message": refuse("signs a message with the issuer's private key, acting as the organization."),
+    "POST /v1/kms/issuers/{issuerId}/sign/token": refuse("signs a token with the issuer's private key."),
+    "GET /v1/microfrontends/groups/{groupId}/projects": redact(PROJECT_REASON, under(["projects[]"], PROJECT), under(["projects[]"], PROJECT_ALLOW)),
+    "POST /v1/projects/traces/session": refuse("mints a trace session token for a deployment."),
+    "POST /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "DELETE /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "DELETE /v1/projects/{idOrName}/env": redact(ENV_REASON, PROJECT_ENV),
+    "GET /v1/projects/{idOrName}/env/{id}": refuse("returns one environment variable's decrypted value. Read its metadata with list_project_env_vars."),
+    "PATCH /v1/projects/{idOrName}/protection-bypass": refuse("generates Protection Bypass for Automation secrets."),
+    "POST /v1/projects/{idOrName}/token": refuse("mints a project OIDC token."),
+    "GET /v1/projects/{projectIdOrName}/feature-flags/sdk-keys": safe("Lists SDK key metadata with masked partialKeyValue."),
+    "PUT /v1/projects/{projectIdOrName}/feature-flags/sdk-keys": refuse("mints a Flags SDK key and returns it in cleartext."),
+    "DELETE /v1/projects/{projectIdOrName}/feature-flags/sdk-keys/{hashKey}": safe(NO_SECRET_REASON),
+    "PATCH /v1/projects/{projectId}/microfrontends": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "GET /v1/projects/{projectId}/routes": redact(ROUTE_REASON, under(["routes[].route"], ROUTE_TRANSFORMS)),
+    "POST /v1/projects/{projectId}/routes": redact(ROUTE_REASON, under(["route.route"], ROUTE_TRANSFORMS)),
+    "POST /v1/projects/{projectId}/routes/generate": redact(ROUTE_REASON, [
+        ...under(["route"], ROUTE_TRANSFORMS),
+        "route.actions[].headers[].value",
+        "route.conditions[?header].value",
+    ]),
+    "PATCH /v1/projects/{projectId}/routes/{routeId}": redact(ROUTE_REASON, under(["route.route"], ROUTE_TRANSFORMS)),
+    "GET /v1/registrar/domains/{domain}/auth-code": refuse("returns the domain's transfer authorization code, which lets its holder move the domain to another registrar."),
+    "GET /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration: addresses, not secrets."),
+    "POST /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration."),
+    "DELETE /v1/security/firewall/bypass": safe("IP bypass rules are firewall configuration."),
+    "GET /v1/security/firewall/config": redact(FIREWALL_REASON, under(["active", "draft", "versions[]"], FIREWALL)),
+    "PUT /v1/security/firewall/config": redact(FIREWALL_REASON, under(["active", "draft", "versions[]"], FIREWALL)),
+    "POST /v1/security/firewall/config/generate-rule": redact(FIREWALL_REASON, under(["rule"], FIREWALL_CONDITIONS)),
+    "GET /v1/security/firewall/config/{configVersion}": redact(FIREWALL_REASON, FIREWALL),
+    "POST /v1/security/firewall/config/{configVersion}/activate": redact(FIREWALL_REASON, FIREWALL),
+    "POST /v1/storage/stores/integration/direct": safe("store.secrets lists secret names and lengths, never values.", [
+        "store.secrets",
+        "store.secretRotationRequestedBy",
+        "store.secretRotationRequestedReason",
+    ]),
+    "GET /v1/vcr/repository/{idOrName}/images/{imageIdOrDigest}": redact("Image layer environment entries are build-time NAME=value pairs.", ["image.layers[].env"]),
+    "GET /v10/projects": redact(PROJECT_REASON, under(["projects[]", "[]"], PROJECT), under(["projects[]", "[]"], PROJECT_ALLOW)),
+    "GET /v10/projects/{idOrName}/env": refuse("returns environment values beside their metadata. Use list_project_env_vars, which never decrypts or returns a value."),
+    "POST /v10/projects/{idOrName}/env": redact(ENV_REASON, [
+        "created.value",
+        "created.vsmValue",
+        "created.legacyValue",
+        "created[].value",
+        "created[].vsmValue",
+        "created[].legacyValue",
+        "failed[].error.value",
+    ]),
+    "POST /v11/projects": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v12/deployments/{id}/cancel": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "POST /v13/deployments": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "GET /v13/deployments/{idOrUrl}": redact(DEPLOYMENT_REASON, DEPLOYMENT),
+    "GET /v2/deployments/{id}/aliases": redact("Aliases carry protection-bypass secrets as map keys.", ["aliases[].protectionBypass@keys"], ["aliases[].protectionBypass"]),
+    "POST /v2/deployments/{id}/aliases": safe("Answers the alias assignment."),
+    "GET /v2/user": safe("ipBypass lists firewall IP rules, not secrets.", ["user.resourceConfig.security.ipBypass"]),
+    "PATCH /v3/domains/{domain}": redact("A move-out answers a transfer token; Connecta refuses move-out by body, and redacts any token.", ["token"]),
+    "GET /v3/events": redact("Audit events carry environment variables (with or without key or type) and credential metadata in payloads.", [
+        "events[].payload.newEnvVar.value",
+        "events[].payload.oldEnvVar.value",
+        "events[?env].payload.value",
+        "events[?env].payload.vsmValue",
+        "events[].payload.apiKey",
+        "events[].payload.credential",
+        "events[].payload.inviteCode",
+        "events[].payload.gitCredentialSource",
+    ]),
+    "POST /v3/user/tokens": refuse("mints a Vercel access token."),
+    "DELETE /v3/user/tokens/{tokenId}": safe(NO_SECRET_REASON),
+    "GET /v4/aliases": redact("Aliases carry protection-bypass secrets as map keys.", ["aliases[].protectionBypass@keys"], ["aliases[].protectionBypass"]),
+    "GET /v4/aliases/{idOrAlias}": redact("Aliases carry protection-bypass secrets as map keys.", ["protectionBypass@keys"], ["protectionBypass"]),
+    "GET /v5/user/tokens/{tokenId}": safe("Answers token metadata (`token` is an object of ids, prefix, suffix, and scopes).", ["token"]),
+    "GET /v6/user/tokens": safe("Lists token metadata, never token values.", ["tokens"]),
+    "GET /v9/projects/{idOrName}": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v9/projects/{idOrName}": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
+    "PATCH /v9/projects/{idOrName}/env/{id}": redact(ENV_REASON, PROJECT_ENV),
+    "DELETE /v9/projects/{idOrName}/env/{id}": redact(ENV_REASON, PROJECT_ENV),
+    // Flagged by description or a transfer/claim/invite family (round 3).
+    "POST /projects/{idOrName}/transfer-request": refuse("returns a code that lets another team claim the project for 24 hours."),
+    "PUT /projects/transfer-request/{code}": safe("Accepts a transfer with a code the caller holds; answers transfer results."),
+    "GET /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "POST /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "PATCH /ai-gateway/virtual-model-configs": safe(MODEL_CONFIG),
+    "GET /ai-gateway/virtual-model-configs/list": safe(MODEL_CONFIG),
+    "GET /ai-gateway/virtual-model-configs/{vmcSlug}": safe(MODEL_CONFIG),
+    "PATCH /ai-gateway/virtual-model-configs/{vmcSlug}": safe(MODEL_CONFIG),
+    "GET /v1/ai-gateway/routers": safe(MODEL_CONFIG),
+    "POST /storage/stores/blob": safe("store.kind names the store type; no token is returned."),
+    "GET /storage/stores/{id}": safe("A store's metadata; projectsMetadata lists environment variable names, not values."),
+    "GET /v1/installations/{integrationConfigurationId}/resources/{resourceId}": safe("customClaims are OIDC claim configuration, not tokens."),
+    "GET /v1/integrations/configuration/{id}/products": redact("protocols.authentication describes supported auth flows, not credentials; a product's log and trace drain protocols carry destination headers.", [
+        "products[].protocols.logDrain.headers{}",
+        "products[].protocols.traceDrain.headers{}",
+        "origin:products[].protocols.logDrain.endpoint",
+        "origin:products[].protocols.traceDrain.endpoint",
+    ]),
+    "GET /v1/kms/issuers": safe(KMS_POLICY),
+    "POST /v1/kms/issuers": safe(KMS_POLICY),
+    "GET /v1/kms/issuers/{issuerId}": safe(KMS_POLICY),
+    "PATCH /v1/kms/issuers/{issuerId}": safe(KMS_POLICY),
+    "POST /v1/kms/issuers/{issuerId}/policies": safe(KMS_POLICY),
+    "PATCH /v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}": safe(KMS_POLICY),
+    "GET /v1/registrar/domains/{domain}/transfer": safe("Answers a transfer-in status only."),
+    "POST /v1/registrar/domains/{domain}/transfer": safe("Answers an order id; the auth code is request input only."),
+    "DELETE /v1/teams/{teamId}/invites/{inviteId}": safe(NO_SECRET_REASON),
+    "GET /v2/teams": redact(TEAM_INVITE, ["teams[].inviteCode"]),
+    "GET /v2/teams/{teamId}": redact(TEAM_INVITE, ["inviteCode"]),
+    "PATCH /v2/teams/{teamId}": redact(TEAM_INVITE, ["inviteCode"]),
+    "GET /v3/teams/{teamId}/members": safe("emailInviteCodes lists pending invitations (email, role, expiry) without codes.", ["emailInviteCodes"]),
+    "POST /v2/teams/{teamId}/members": safe("Answers the invited email, role, and permissions; no invite link or code."),
+    "POST /v7/domains": safe("Answers the added domain's metadata."),
+    "POST /v9/domains/{domain}/claim": safe("Claims by verified TXT record and answers domain metadata; issues nothing."),
+};
+/**
+ * Vercel's reviewed table. Environment-variable endpoints answer bodies that
+ * are environment variables whether or not each carries a `key`, so their
+ * values go whole; `permissions` maps list action scopes under resource
+ * names, which the heuristic leaves.
+ */
+export const VERCEL_VALUE_SAFETY = {
+    title: "Vercel",
+    operations: VALUE_SAFETY,
+    envBodies: /^\/v\d+\/(?:env(?:\/|$)|projects\/\{[^}]+\}\/env(?:\/|$))/,
+    scopeMaps: ["permissions"],
+    fields: Object.fromEntries([
+        ["env", "Environment names and variable-name lists; values inside environment containers go structurally."],
+        ["environments", "Environment slugs or ids a policy or variable applies to."],
+        ["environmentVariables", "Environment variable names a store connects, never values."],
+        ["type", "A variable's or record's type (plain, encrypted, sensitive, secret)."],
+        ["visibility", "A variable's visibility setting."],
+        ["keys", "Rate-limit key kinds (ip, ja4) and changed variable names."],
+        ["logHeaders", "Header names a firewall rule logs."],
+        ["log_headers", "Header names the firewall logs."],
+        ["signingKeys", "KMS signing key metadata and public key material; private keys stay with Vercel."],
+        ["bindings", "Service-to-service binding names and targets."],
+        ["canaryResponseHeader", "Whether a canary response sets a header; a boolean."],
+        ["inferenceRegion", "An AI Gateway routing region."],
+        ["providerTimeouts", "Provider timeouts in milliseconds."],
+        ["redirectUri", "A connector's registered OAuth redirect URI, public by design."],
+        ["supportsRevocation", "Whether a connector can revoke tokens; a boolean."],
+        ["claims", "OIDC claim matchers a policy requires, not tokens."],
+        ["customClaims", "OIDC claim configuration, not tokens."],
+        ["limited", "Whether a record is limited by the token's privileges; a boolean."],
+        ["enforced", "Whether SAML is enforced; a boolean."],
+        ["kind", "A store or record kind."],
+        ["budget", "An AI Gateway key's spend budget."],
+        ["origin", "How a token was issued (manual, oauth)."],
+        ["scope", "A token's scope (user, team, project)."],
+        ["issuedBefore", "A revocation cutoff timestamp."],
+        ["issuerUrl", "The OIDC issuer URL, public by design."],
+        ["oidcSubject", "The OIDC subject claim, an identifier."],
+        ["next", "A pagination cursor; it grants nothing."],
+        ["partialKeyValue", "A masked SDK key preview."],
+        ["appUrlRegistrationSupport", "Whether a partner accepts app URLs; a boolean."],
+        ["disjunctiveProductionSecretPolicy", "A team policy setting."],
+        ["sensitiveEnvironmentVariablePolicy", "A team policy setting."],
+        ["strictPasswordProtectionSettings", "A team policy setting."],
+    ].map(([name, reason]) => [name, { verdict: "keep", reason }])),
+};

package/dist/registry.d.ts

@@ -112,7 +112,7 @@ export interface RegistryView {
     resultsStorage(): KVStorage;
     resultIdentity(): ResultIdentity;
     /** Recheck live auth/grants and pool admission before exposing stored data. */
-    recheckResultAccess(address: string, classification: "read" | "write", signal?: AbortSignal): Promise<boolean>;
+    recheckResultAccess(address: string | undefined, classification: "read" | "write", signal?: AbortSignal, access?: "catalog"): Promise<boolean>;
     /** Reserve deployment-wide capacity before writing a paging envelope's chunks. */
     stashResult(id: string, chunks: readonly string[], ttlSeconds: number): Promise<boolean>;
     /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
@@ -142,7 +142,7 @@ export interface RegistryScope {
     principalKey?: string;
     endpoint?: string;
     origin?: string | null;
-    currentResultAccess?: (address: string, classification: "read" | "write", signal?: AbortSignal) => Promise<boolean>;
+    currentResultAccess?: (address: string | undefined, classification: "read" | "write", signal?: AbortSignal, access?: "catalog") => Promise<boolean>;
     /** The admitted caller, readable only by built-in connectors; see connector-caller.ts. */
     caller?: ConnectorCaller;
 }
@@ -241,9 +241,11 @@ export declare class Registry implements RegistryView {
      * The bounds are the deployment's, not this isolate's. Every charge is a
      * row in one ledger record in storage, booked by compare-and-set before any
      * chunk is written, so every isolate and process sharing the store sees the
-     * same entries and bytes. A charge leaves the ledger just after its
-     * result's deadline, which every chunk's TTL ends by; the storage TTL
-     * reclaims the rows themselves.
+     * same entries and bytes. A pending write keeps its finite charge reserved.
+     * Writes stop after 30 seconds; absolute chunk expiries cannot pass the
+     * booked deadline even on late commit. Rejected responses leave writes
+     * unconfirmed and retain their charge. Cleanup/release and settlement each
+     * stop waiting after 15 seconds. Storage TTL reclaims the rows.
      */
     stashResult(id: string, chunks: readonly string[], ttlSeconds: number, partition?: string): Promise<boolean>;
     /**
@@ -251,7 +253,7 @@ export declare class Registry implements RegistryView {
      * connector's namespace. Backs connecta.result.
      */
     resultIdentity(): ResultIdentity;
-    recheckResultAccess(_address: string, _classification: "read" | "write", _signal?: AbortSignal): Promise<boolean>;
+    recheckResultAccess(_address: string | undefined, _classification: "read" | "write", _signal?: AbortSignal, _access?: "catalog"): Promise<boolean>;
     resultsStorage(): KVStorage;
     credentialUiAvailable(): boolean;
     bindOAuthHandoff(id: string, authorizationUrl: string, principalKey?: string): Promise<void>;