@zackbart/connecta 0.34.0 → 0.35.0

package/dist/providers/cloudflare/{value-safety.js → safety.js}

@@ -4,7 +4,8 @@
 // `value-safety.node.test.ts` runs the shared harness over it.
 //
 // - `refuse`: the operation exists to mint, rotate, or hand back a credential
-//   (or move money through a payment secret); nothing is sent.
+//   (or move money through a payment secret), or lacks a reviewed response
+//   contract; nothing is sent.
 // - `redact`: the operation is useful, and these field paths carry a
 //   credential or stored secret; they are replaced before the result is
 //   returned, on every method. A path ending in `#url` keeps only the URL's
@@ -16,7 +17,7 @@
 // or the whole body when it is not an envelope); lists are traversed
 // implicitly and `*` matches every key of an object.
 // Embedded URL verdict (#812): reviewed paths + global signing parameters.
-// Evidence: digest-verified schema revision 3fad73eb27c381031c09ccdfa28ef9352029cd5a:
+// Evidence: digest-verified schema revision 843eae2fbf4fe774ef9c91021dd34017ac9c970a:
 // builds_BuildLogsResponse.lines (timestamp/log-message tuples),
 // pages_deployment_log.data.line and workers-observability_query_results
 // events.events and invocations.* -> telemetry_event.$metadata.message/error
@@ -30,7 +31,10 @@
 // JavaScript served as application/javascript) are not decoded or scanned.
 // Recording/download/upload capabilities retain their structured-field rules.
 // The review found no documented Cloudflare-minted links embedded in other
-// free text and justifies no Cloudflare/R2/S3-wide file-host policy.
+// free text, including AI Search item/job logs, and justifies no
+// Cloudflare/R2/S3-wide file-host policy. The new Cloudforce match responses
+// omit schemas; both operations are refused until their response contracts
+// can be reviewed, including their error bodies.
 import { redact as reviewed, refuse, safe as reviewedSafe, } from "../_shared/rest/value-safety.js";
 const MINT = "Connecta does not create, rotate, or return credentials; an operator manages this credential in the Cloudflare dashboard.";
 const API_TOKENS = "Connecta does not create, roll, edit, or delete API tokens; an operator manages tokens in the Cloudflare dashboard.";
@@ -39,6 +43,7 @@ const BEARER = "This returns a URL or upload token that grants access without Cl
 const ACTS = "This GET acts rather than reads (it completes a connection or an unsubscribe), so it is not a read.";
 const INTERNAL = "An internal Cloudflare test route; it is not part of the supported API.";
 const CAPTURE = "A URL scan's captured session (cookies, request and response headers, response bodies, DOM) can carry credentials, so Connecta does not return it. Read scan verdicts with GET /accounts/{account_id}/urlscanner/v2/search.";
+const UNREVIEWED_MATCHES = "Cloudforce match responses have no reviewed response schema; Connecta refuses this operation until its success and error values can be reviewed.";
 const METADATA = "Returns names, ids, status, and timestamps; no credential value.";
 const REVOKES = "Revokes or deletes; returns no credential value.";
 const CALLER_SUPPLIED = "The caller supplies the secret; the response returns only its name and metadata.";
@@ -152,6 +157,33 @@ const DESCRIBED_ONLY = "The spec mentions credentials in this field's descriptio
 const A = "/accounts/{account_id}";
 const Z = "/zones/{zone_id}";
 const OPERATIONS = {
+    [`POST ${A}/ai-gateway/billing/topup/config`]: refuse("Returns a payment client secret; complete billing setup in the dashboard."),
+    ...Object.fromEntries([
+        `GET ${A}/cws/basic-auth-credentials`,
+        `POST ${A}/cws/basic-auth-credentials`,
+        `GET ${A}/cws/basic-auth-credentials/{credential_id}`,
+        `DELETE ${A}/cws/basic-auth-credentials/{credential_id}`,
+        `GET ${A}/cws/basic-auth-credentials/{credential_id}/secrets`,
+        `POST ${A}/cws/basic-auth-credentials/{credential_id}/secrets`,
+        `GET ${A}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}`,
+        `DELETE ${A}/cws/basic-auth-credentials/{credential_id}/secrets/{secret_id}`,
+    ].map((key) => [
+        key,
+        safe("CWS returns only username, ids, and creation/expiry metadata; password input and hashes are never returned."),
+    ])),
+    ...Object.fromEntries([
+        `GET ${A}/devices/policies`,
+        `GET ${A}/devices/policy`,
+        `POST ${A}/devices/policy`,
+        `PATCH ${A}/devices/policy`,
+        `GET ${A}/devices/policy/{policy_id}`,
+        `PATCH ${A}/devices/policy/{policy_id}`,
+        `DELETE ${A}/devices/policy/{policy_id}`,
+    ].map((key) => [
+        key,
+        safe("Device credential authentication is a boolean reauthentication policy, not a credential.", "enable_device_credential_authentication"),
+    ])),
+    "GET /cws/filter-schema": safe("Filter-builder fields and advisory operator labels; no credentials.", "policy_fields.operators", "workload_fields.operators"),
     // Access
     [`GET ${A}/access/apps`]: ACCESS_APP,
     [`POST ${A}/access/apps`]: ACCESS_APP,
@@ -291,6 +323,8 @@ const OPERATIONS = {
     [`GET ${A}/cfd_tunnel/{tunnel_id}/token`]: refuse("A tunnel token lets anyone run this tunnel; Connecta does not return it. Read the tunnel itself instead."),
     [`GET ${A}/warp_connector/{tunnel_id}/token`]: refuse("A Mesh node token lets anyone run this connector; Connecta does not return it."),
     // Cloudforce One
+    [`GET ${A}/cloudforce-one/v2/priority-intelligence/{priority_id}/matches`]: refuse(UNREVIEWED_MATCHES),
+    [`PATCH ${A}/cloudforce-one/v2/priority-intelligence/{priority_id}/matches`]: refuse(UNREVIEWED_MATCHES),
     [`GET ${A}/cloudforce-one/v2/credential-monitor/domains`]: safe(METADATA),
     [`POST ${A}/cloudforce-one/v2/credential-monitor/domains`]: safe(METADATA),
     [`DELETE ${A}/cloudforce-one/v2/credential-monitor/domains/{id}`]: safe(REVOKES),
@@ -656,6 +690,18 @@ const OPERATIONS = {
     [`GET ${A}/urlscanner/v2/har/{scan_id}`]: refuse(CAPTURE),
     [`GET ${A}/urlscanner/v2/dom/{scan_id}`]: refuse(CAPTURE),
     [`GET ${A}/urlscanner/v2/responses/{response_id}`]: refuse(CAPTURE),
+    // Custom crawler headers may authenticate under any name. Withhold every
+    // value in stored or echoed instance configuration, preserving header names.
+    ...Object.fromEntries([
+        `GET ${A}/ai-search/namespaces/{namespace}/instances`,
+        `POST ${A}/ai-search/namespaces/{namespace}/instances`,
+        `GET ${A}/ai-search/namespaces/{namespace}/instances/{id}`,
+        `PUT ${A}/ai-search/namespaces/{namespace}/instances/{id}`,
+        `DELETE ${A}/ai-search/namespaces/{namespace}/instances/{id}`,
+    ].map((key) => [
+        key,
+        reviewed("Crawler include_headers stores custom request header values that can authenticate under arbitrary names.", ["source_params.web_crawler.parse_options.include_headers{}"]),
+    ])),
     // Reviewed safe: the flagged field is metadata, a header name list, a count, or third-party data the operation exists to return.
     ...Object.fromEntries([
         [`GET ${A}/access/ai-controls/mcp/portals`, "servers.auth_config_summary"],
@@ -668,20 +714,6 @@ const OPERATIONS = {
         [`PUT ${A}/access/ai-controls/mcp/servers/{id}`, "auth_config_summary"],
         [`DELETE ${A}/access/ai-controls/mcp/servers/{id}`, "auth_config_summary"],
         [`GET ${A}/access/users/{user_id}/last_seen_identity`, "passkeys"],
-        [`GET ${A}/ai-search/namespaces/{name}/instances`, "source_params.web_crawler.parse_options.include_headers"],
-        [`POST ${A}/ai-search/namespaces/{name}/instances`, "source_params.web_crawler.parse_options.include_headers"],
-        [
-            `GET ${A}/ai-search/namespaces/{name}/instances/{id}`,
-            "source_params.web_crawler.parse_options.include_headers",
-        ],
-        [
-            `PUT ${A}/ai-search/namespaces/{name}/instances/{id}`,
-            "source_params.web_crawler.parse_options.include_headers",
-        ],
-        [
-            `DELETE ${A}/ai-search/namespaces/{name}/instances/{id}`,
-            "source_params.web_crawler.parse_options.include_headers",
-        ],
         [`POST ${A}/ai/tomarkdown`, "tokens"],
         [`GET ${A}/basin-catalog/{bucket_name}/maintenance-configs`, ""],
         [`GET ${A}/billable/usage/billable-metrics`, "DimensionKeys"],
@@ -1039,7 +1071,7 @@ const OPERATIONS = {
         key,
         safe("OAuth client registrations: ids, URIs, and whether a secret was rotated; the secret itself is refused at creation."),
     ])),
-    [`GET ${A}/one/applications/{application_id}/setup-flows`]: safe("Setup flows describe the OAuth authorization URL and form fields to fill, not credentials.", "steps.form_fields.name", "steps.form_fields.type"),
+    [`GET ${A}/one/applications/{application_id}/setup-flows`]: reviewed("Setup form defaults may carry credential values; withhold defaults while retaining field names and input types.", ["steps.form_fields.default_value"], ["steps", "steps.form_fields.name", "steps.form_fields.type"]),
     ...Object.fromEntries([
         `GET ${A}/realtime/kit/{app_id}/meetings`,
         `POST ${A}/realtime/kit/{app_id}/meetings`,
@@ -1168,6 +1200,493 @@ const OPERATIONS = {
  * are reviewed metadata wherever they appear.
  */
 export const CLOUDFLARE_VALUE_SAFETY = {
+    absent: {
+        "reason": "Paths a shared verdict carries (Access rules, Pages projects, Workers Builds, containers, RealtimeKit, Zaraz, certificates) that this operation's pinned response schema does not declare, or fields the schema leaves undeclared (binding payloads under a Worker's env map). They stay applied at runtime, so an undeclared field the vendor returns is still removed; listing them here keeps every other path checked against the schema.",
+        "operations": {
+            "DELETE /accounts/{account_id}/pages/projects/{project_name}/source": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/builds/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/builds/latest": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/builds/{build_uuid}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/triggers/{trigger_uuid}/environment_variables": [
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{external_script_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/cni/cnis": ["bgp.md5_key"],
+            "GET /accounts/{account_id}/cni/cnis/{cni}": ["items.bgp.md5_key"],
+            "GET /accounts/{account_id}/containers/applications": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}/instances-v2": [
+                "next_page_token",
+                "page_token",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}/versions": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "GET /accounts/{account_id}/pages/projects": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/pages/projects/{project_name}": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/pages/projects/{project_name}/deployments": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "GET /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams/{livestream_id}": [
+                "data.livestreams.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams/{livestream_id}/active-livestream-session": [
+                "data.livestreams.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/active-livestream": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/livestream": [
+                "data.livestream.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/stream/live_inputs": [
+                "rtmps.streamKey",
+                "rtmps.url",
+                "rtmpsPlayback.streamKey",
+                "rtmpsPlayback.url",
+                "srt.passphrase",
+                "srt.url",
+                "srtPlayback.passphrase",
+                "srtPlayback.url",
+                "webRTC.url#url",
+                "webRTCPlayback.url",
+            ],
+            "GET /accounts/{account_id}/workers/workers": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments/{deployment_id}": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions": ["env.*.json", "env.*.text"],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions/latest": ["env.*.json", "env.*.text"],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions/{version_id}": ["env.*.json", "env.*.text"],
+            "GET /organizations": ["next_page_token"],
+            "GET /organizations/{organization_id}/accounts": ["next_page_token"],
+            "GET /organizations/{organization_id}/members": ["next_page_token"],
+            "GET /zones/{zone_id}/access/apps": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/groups": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/groups/{group_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/custom_certificates": ["certificates.geo_restrictions"],
+            "GET /zones/{zone_id}/custom_certificates/{custom_certificate_id}": ["certificates.geo_restrictions"],
+            "GET /zones/{zone_id}/settings/zaraz/config": ["*.config.debugKey", "*.config.variables.*.value"],
+            "GET /zones/{zone_id}/settings/zaraz/default": ["*.config.debugKey", "*.config.variables.*.value"],
+            "GET /zones/{zone_id}/settings/zaraz/export": [
+                "*.config.debugKey",
+                "*.config.variables.*.value",
+                "*.debugKey",
+                "*.variables.*.value",
+            ],
+            "GET /zones/{zone_id}/settings/zaraz/history/configs": [
+                "*.debugKey",
+                "*.variables.*.value",
+                "debugKey",
+                "variables.*.value",
+            ],
+            "GET /zones/{zone_id}/ssl/certificate_packs": ["geo_restrictions", "policy_restrictions"],
+            "GET /zones/{zone_id}/ssl/certificate_packs/{certificate_pack_id}": ["geo_restrictions", "policy_restrictions"],
+            "PATCH /accounts/{account_id}/builds/triggers/{trigger_uuid}/environment_variables": [
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/builds/workers/{script_tag}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/containers/applications/{application_id}": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "PATCH /accounts/{account_id}/pages/projects/{project_name}": ["env_vars.*.value"],
+            "PATCH /accounts/{account_id}/workers/dispatch/namespaces/{dispatch_namespace}/scripts/{script_name}/secrets-bulk": ["key_base64", "key_jwk", "text"],
+            "PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk": ["key_base64", "key_jwk", "text"],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments/latest": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}/versions/latest": ["env.*.json", "env.*.text"],
+            "PATCH /zones/{zone_id}/custom_certificates/{custom_certificate_id}": ["certificates.geo_restrictions"],
+            "PATCH /zones/{zone_id}/ssl/certificate_packs/{certificate_pack_id}": ["geo_restrictions", "policy_restrictions"],
+            "POST /accounts/{account_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /accounts/{account_id}/access/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /accounts/{account_id}/builds/triggers/{trigger_uuid}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers/{script_tag}/migrate_to_previews": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/cni/cnis": ["items.bgp.md5_key"],
+            "POST /accounts/{account_id}/containers/applications": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "POST /accounts/{account_id}/containers/applications/{application_id}/rollouts": [
+                "configuration.authorized_keys",
+                "configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+            ],
+            "POST /accounts/{account_id}/d1/database/{database_id}/export": ["signed_url#url"],
+            "POST /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "POST /accounts/{account_id}/pages/projects": ["env_vars.*.value"],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}/retry": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}/rollback": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/source": ["env_vars.*.value"],
+            "POST /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/livestreams": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "POST /accounts/{account_id}/workers/workers": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "POST /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "POST /accounts/{account_id}/workers/workers/{worker_id}/versions": ["env.*.json", "env.*.text"],
+            "POST /zones/{zone_id}/access/apps": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "POST /zones/{zone_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /zones/{zone_id}/access/groups": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /zones/{zone_id}/custom_certificates": ["certificates.geo_restrictions"],
+            "POST /zones/{zone_id}/ssl/certificate_packs/order": ["geo_restrictions", "policy_restrictions"],
+            "PUT /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}/make_reusable": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/access/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/cni/cnis/{cni}": ["items.bgp.md5_key"],
+            "PUT /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "PUT /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "PUT /zones/{zone_id}/access/apps/{app_id}": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "PUT /zones/{zone_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /zones/{zone_id}/access/groups/{group_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /zones/{zone_id}/custom_certificates/prioritize": ["certificates.geo_restrictions"],
+            "PUT /zones/{zone_id}/settings/zaraz/config": ["*.config.debugKey", "*.config.variables.*.value"],
+            "PUT /zones/{zone_id}/settings/zaraz/history": ["*.config.debugKey", "*.config.variables.*.value"],
+        },
+    },
     embeddedUrls: {
         operations: {
             "GET /accounts/{account_id}/builds/builds/{build_uuid}/logs": ["lines"],
@@ -1223,6 +1742,7 @@ export const CLOUDFLARE_VALUE_SAFETY = {
             ["amr_matching_session_duration", "A session duration."],
             ["doh_jwt_duration", "A token lifetime setting."],
             ["token_endpoint_auth_method", "An OAuth client authentication method name."],
+            ["leak_reporter", "The secret-scanning partner name, not the leaked token."],
             ["has_rotated_secret", "Whether a client secret was rotated; a flag."],
             ["secret_preview", "A masked preview of a caller-supplied key."],
             ["token_pricing", "Per-token model pricing."],