@zackbart/connecta 0.34.1 → 0.36.0

package/dist/providers/vercel/{value-safety.js → safety.js}

@@ -1,3 +1,194 @@
+const absent = {
+    "reason": "Paths a shared verdict carries (drains, webhooks, projects, deployments, firewall configurations, environment variables) that this operation's pinned response schema does not declare, including list-root and create-only variants. They stay applied at runtime, so an undeclared field the vendor returns is still removed; listing them here keeps every other path checked against the schema.",
+    "operations": {
+        "GET /v1/projects/{idOrName}/daemons": ["daemons.replicas.items.iroh.publicKeyCiphertext"],
+        "DELETE /v1/env": ["created[].value", "data[].value", "updated[].value"],
+        "DELETE /v1/projects/{idOrName}/avatar": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "DELETE /v1/projects/{idOrName}/env": ["[].legacyValue", "[].value", "legacyValue", "value", "vsmValue"],
+        "DELETE /v9/projects/{idOrName}/env/{id}": ["vsmValue"],
+        "GET /v1/drains": ["drains[].headers{}", "drains[].secret", "origin:drains[].url"],
+        "GET /v1/drains/{id}": ["headers{}", "origin:url", "secret"],
+        "GET /v1/env": ["created[].value", "failed[].error.value", "updated[].value"],
+        "GET /v1/log-drains": [
+            "[].delivery.headers{}",
+            "[].delivery.secret",
+            "[].headers{}",
+            "[].secret",
+            "drains[].headers{}",
+            "drains[].secret",
+            "origin:[].delivery.endpoint",
+            "origin:[].delivery.endpoint.traces",
+            "origin:[].url",
+            "origin:drains[].url",
+        ],
+        "GET /v1/log-drains/{id}": [
+            "delivery.headers{}",
+            "delivery.secret",
+            "headers{}",
+            "origin:delivery.endpoint",
+            "origin:delivery.endpoint.traces",
+            "origin:url",
+            "secret",
+        ],
+        "GET /v1/microfrontends/groups/{groupId}/projects": [
+            "projects[].internalRoutes[].missing[?header].value",
+            "projects[].security.firewallRoutes[].has[?header].value",
+            "projects[].security.firewallRoutes[].missing[?header].value",
+            "projects[].security.firewallRoutes[].response_has[?header].value",
+        ],
+        "GET /v1/security/firewall/config": [
+            "active.conditions[].conditionGroup[].conditions[?header].values",
+            "active.rules[].conditionGroup[].conditions[?header].values",
+            "active.rulesets[].conditionGroup[].conditions[?header].values",
+            "draft.conditions[].conditionGroup[].conditions[?header].values",
+            "draft.rules[].conditionGroup[].conditions[?header].values",
+            "draft.rulesets[].conditionGroup[].conditions[?header].values",
+            "versions[].conditions[].conditionGroup[].conditions[?header].values",
+            "versions[].rules[].conditionGroup[].conditions[?header].values",
+            "versions[].rulesets[].conditionGroup[].conditions[?header].values",
+        ],
+        "GET /v1/security/firewall/config/{configVersion}": [
+            "conditions[].conditionGroup[].conditions[?header].values",
+            "rules[].conditionGroup[].conditions[?header].values",
+            "rulesets[].conditionGroup[].conditions[?header].values",
+        ],
+        "GET /v1/webhooks": ["[].secret", "origin:webhooks[].url", "webhooks[].secret"],
+        "GET /v1/webhooks/{id}": ["secret"],
+        "GET /v10/projects": [
+            "[].dismissedToasts[].value",
+            "[].internalRoutes[].missing[?header].value",
+            "[].protectionBypass",
+            "[].protectionBypass@keys",
+            "[].usageStatus.bypassThrottleUntil",
+            "projects[].internalRoutes[].missing[?header].value",
+        ],
+        "GET /v13/deployments/{idOrUrl}": [
+            "services[].redirects[].headers{}",
+            "services[].redirects[].locale.cookie",
+            "services[].redirects[].transforms[].args",
+            "services[].rewrites[].headers{}",
+            "services[].rewrites[].locale.cookie",
+        ],
+        "GET /v2/integrations/log-drains": [
+            "[].delivery.headers{}",
+            "[].delivery.secret",
+            "[].secret",
+            "origin:[].delivery.endpoint",
+            "origin:[].delivery.endpoint.traces",
+        ],
+        "GET /v3/events": ["events[?env].payload.vsmValue"],
+        "GET /v9/projects/{idOrName}": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "PATCH /v1/drains/{id}": ["headers{}", "origin:url", "secret"],
+        "PATCH /v1/env": ["created[].value", "data[].value"],
+        "PATCH /v1/env/{id}/unlink/{projectId}": ["value"],
+        "PATCH /v1/projects/{projectId}/microfrontends": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "PATCH /v12/deployments/{id}/cancel": [
+            "services[].redirects[].headers{}",
+            "services[].redirects[].locale.cookie",
+            "services[].redirects[].transforms[].args",
+            "services[].rewrites[].headers{}",
+            "services[].rewrites[].locale.cookie",
+        ],
+        "PATCH /v9/projects/{idOrName}": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "PATCH /v9/projects/{idOrName}/env/{id}": ["[].legacyValue", "[].value", "vsmValue"],
+        "POST /v1/drains": ["headers{}", "origin:url", "secret"],
+        "POST /v1/drains/test": [
+            "delivery.headers{}",
+            "delivery.secret",
+            "headers{}",
+            "origin:delivery.endpoint",
+            "origin:delivery.endpoint.traces",
+            "origin:url",
+            "secret",
+        ],
+        "POST /v1/env": ["data[].value", "updated[].value"],
+        "POST /v1/log-drains": [
+            "delivery.headers{}",
+            "delivery.secret",
+            "headers{}",
+            "origin:delivery.endpoint",
+            "origin:delivery.endpoint.traces",
+            "origin:url",
+            "secret",
+        ],
+        "POST /v1/projects/{idOrName}/avatar": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "POST /v1/projects/{projectId}/routes/generate": [
+            "route.has[?header].value",
+            "route.headers{}",
+            "route.locale.cookie",
+            "route.missing[?header].value",
+            "route.transforms[].args",
+        ],
+        "POST /v1/security/firewall/config/generate-rule": ["rule.conditionGroup[].conditions[?header].values"],
+        "POST /v1/security/firewall/config/{configVersion}/activate": [
+            "conditions[].conditionGroup[].conditions[?header].values",
+            "rules[].conditionGroup[].conditions[?header].values",
+            "rulesets[].conditionGroup[].conditions[?header].values",
+        ],
+        "POST /v11/projects": [
+            "internalRoutes[].missing[?header].value",
+            "security.firewallRoutes[].has[?header].value",
+            "security.firewallRoutes[].missing[?header].value",
+            "security.firewallRoutes[].response_has[?header].value",
+        ],
+        "POST /v13/deployments": [
+            "services[].redirects[].headers{}",
+            "services[].redirects[].locale.cookie",
+            "services[].redirects[].transforms[].args",
+            "services[].rewrites[].headers{}",
+            "services[].rewrites[].locale.cookie",
+        ],
+        "POST /v2/integrations/log-drains": [
+            "delivery.headers{}",
+            "delivery.secret",
+            "origin:delivery.endpoint",
+            "origin:delivery.endpoint.traces",
+            "secret",
+        ],
+        "PUT /v1/security/firewall/config": [
+            "active.conditions[].conditionGroup[].conditions[?header].values",
+            "active.rules[].conditionGroup[].conditions[?header].values",
+            "active.rulesets[].conditionGroup[].conditions[?header].values",
+            "draft.conditions[].conditionGroup[].conditions[?header].value",
+            "draft.conditions[].conditionGroup[].conditions[?header].values",
+            "draft.rules[].conditionGroup[].conditions[?header].value",
+            "draft.rules[].conditionGroup[].conditions[?header].values",
+            "draft.rulesets[].conditionGroup[].conditions[?header].value",
+            "draft.rulesets[].conditionGroup[].conditions[?header].values",
+            "versions[].conditions[].conditionGroup[].conditions[?header].value",
+            "versions[].conditions[].conditionGroup[].conditions[?header].values",
+            "versions[].rules[].conditionGroup[].conditions[?header].value",
+            "versions[].rules[].conditionGroup[].conditions[?header].values",
+            "versions[].rulesets[].conditionGroup[].conditions[?header].value",
+            "versions[].rulesets[].conditionGroup[].conditions[?header].values",
+        ],
+    },
+};
 // Vercel's reviewed value-safety table (decision 0005, "Value safety"), on the
 // shared mechanism in `../_shared/rest/value-safety.ts`.
 //
@@ -21,7 +212,7 @@
 //    whose label is credential-named, environment-variable containers, and
 //    URLs with userinfo or credential query parameters.
 //
-// Residual risk, as with Infisical: a secret a person typed into a free-text
+// Residual risk: a secret a person typed into a free-text
 // name, description, log line, or identifier is out of scope.
 // Embedded URL verdict (#812): reviewed paths + global signing parameters.
 // Evidence: pinned index/candidates sha256:5a702fd2dc76 identify deployment
@@ -122,6 +313,12 @@ const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team
  * these operations project it themselves (value-safe environment variables).
  */
 const VALUE_SAFETY = {
+    // Re-pin 4a06e85c: withhold the entire extensible API-key subtree, including
+    // arbitrary metadata/leakedUrl, rather than exempting a credential object.
+    "PATCH /api-keys/{apiKeyID}/quota": redact("Changes a budget, not an API key; withhold the complete API-key metadata subtree and retain quota facts.", ["apiKey"], ["quota"]),
+    "GET /v1/projects/{projectIdOrName}/feature-flags/labels": safe("Lists attribute labels: entity kind, attribute key, label and value; no credential-bearing fields."),
+    "GET /v1/projects/{projectIdOrName}/feature-flags/labels/counts": safe("Lists attribute label counts without credentials or stored secret values."),
+    "POST /v1/projects/{projectIdOrName}/feature-flags/labels/lookup": safe("Returns matching attribute labels and missing keys, without credentials; retains conservative write classification."),
     "GET /ai-gateway/budgets/list": safe("Coverage counts per API key; no key value.", ["defaultCoveredCounts.api-key"]),
     "GET /v8/artifacts/status": safe("Remote-cache read-only status is a flag.", ["readOnly"]),
     "GET /v1/security/firewall/bypass/rules": redact(FIREWALL_REASON, under(["", "rules[]"], BYPASS_CONDITIONS)),
@@ -155,9 +352,9 @@ const VALUE_SAFETY = {
     "GET /v1/webhooks/{id}": redact(WEBHOOK_REASON, WEBHOOK),
     "DELETE /v1/webhooks/{id}": safe(NO_SECRET_REASON),
     "GET /v1/env": redact(ENV_REASON, SHARED_ENV),
-    "POST /v1/env": redact(ENV_REASON, SHARED_ENV),
-    "PATCH /v1/env": redact(ENV_REASON, SHARED_ENV),
-    "DELETE /v1/env": redact(ENV_REASON, SHARED_ENV),
+    "POST /v1/env": redact(ENV_REASON, [...SHARED_ENV, "failed[].error.message"]),
+    "PATCH /v1/env": redact(ENV_REASON, [...SHARED_ENV, "failed[].error.message"]),
+    "DELETE /v1/env": redact(ENV_REASON, [...SHARED_ENV, "failed[].error.message"]),
     "GET /v1/env/{id}": refuse("returns a shared environment variable's decrypted value."),
     "PATCH /v1/env/{id}/unlink/{projectId}": redact(ENV_REASON, ["value"]),
     "GET /v1/global-config": safe("Global Config metadata: ids, slugs, sizes, and digests, without items."),
@@ -238,6 +435,7 @@ const VALUE_SAFETY = {
         "created[].vsmValue",
         "created[].legacyValue",
         "failed[].error.value",
+        "failed[].error.message",
     ]),
     "POST /v11/projects": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
     "PATCH /v12/deployments/{id}/cancel": redact(DEPLOYMENT_REASON, DEPLOYMENT),
@@ -310,6 +508,7 @@ const VALUE_SAFETY = {
  * names, which the heuristic leaves.
  */
 export const VERCEL_VALUE_SAFETY = {
+    absent,
     embeddedUrls: {
         operations: {
             "GET /v13/deployments/{idOrUrl}": ["errorMessage"],
@@ -323,38 +522,48 @@ export const VERCEL_VALUE_SAFETY = {
     operations: VALUE_SAFETY,
     envBodies: /^\/v\d+\/(?:env(?:\/|$)|projects\/\{[^}]+\}\/env(?:\/|$))/,
     scopeMaps: ["permissions"],
-    fields: Object.fromEntries([
-        ["env", "Environment names and variable-name lists; values inside environment containers go structurally."],
-        ["environments", "Environment slugs or ids a policy or variable applies to."],
-        ["environmentVariables", "Environment variable names a store connects, never values."],
-        ["type", "A variable's or record's type (plain, encrypted, sensitive, secret)."],
-        ["visibility", "A variable's visibility setting."],
-        ["keys", "Rate-limit key kinds (ip, ja4) and changed variable names."],
-        ["logHeaders", "Header names a firewall rule logs."],
-        ["log_headers", "Header names the firewall logs."],
-        ["signingKeys", "KMS signing key metadata and public key material; private keys stay with Vercel."],
-        ["bindings", "Service-to-service binding names and targets."],
-        ["canaryResponseHeader", "Whether a canary response sets a header; a boolean."],
-        ["inferenceRegion", "An AI Gateway routing region."],
-        ["providerTimeouts", "Provider timeouts in milliseconds."],
-        ["redirectUri", "A connector's registered OAuth redirect URI, public by design."],
-        ["supportsRevocation", "Whether a connector can revoke tokens; a boolean."],
-        ["claims", "OIDC claim matchers a policy requires, not tokens."],
-        ["customClaims", "OIDC claim configuration, not tokens."],
-        ["limited", "Whether a record is limited by the token's privileges; a boolean."],
-        ["enforced", "Whether SAML is enforced; a boolean."],
-        ["kind", "A store or record kind."],
-        ["budget", "An AI Gateway key's spend budget."],
-        ["origin", "How a token was issued (manual, oauth)."],
-        ["scope", "A token's scope (user, team, project)."],
-        ["issuedBefore", "A revocation cutoff timestamp."],
-        ["issuerUrl", "The OIDC issuer URL, public by design."],
-        ["oidcSubject", "The OIDC subject claim, an identifier."],
-        ["next", "A pagination cursor; it grants nothing."],
-        ["partialKeyValue", "A masked SDK key preview."],
-        ["appUrlRegistrationSupport", "Whether a partner accepts app URLs; a boolean."],
-        ["disjunctiveProductionSecretPolicy", "A team policy setting."],
-        ["sensitiveEnvironmentVariablePolicy", "A team policy setting."],
-        ["strictPasswordProtectionSettings", "A team policy setting."],
-    ].map(([name, reason]) => [name, { verdict: "keep", reason }])),
+    fields: {
+        ...Object.fromEntries(["drainUrl", "logDrainUrl", "webhookUrl", "prevWebhookUrl"].map((name) => [
+            name,
+            {
+                verdict: "redact",
+                reason: "Audit-event drain and budget webhook destinations may embed credentials in path segments and query tokens; withhold the entire URL in every response shape.",
+            },
+        ])),
+        ...Object.fromEntries([
+            ["env", "Environment names and variable-name lists; values inside environment containers go structurally."],
+            ["environments", "Environment slugs or ids a policy or variable applies to."],
+            ["environmentVariables", "Environment variable names a store connects, never values."],
+            ["secretsOutdated", "A boolean indicating outdated integration secrets; no secret value."],
+            ["type", "A variable's or record's type (plain, encrypted, sensitive, secret)."],
+            ["visibility", "A variable's visibility setting."],
+            ["keys", "Rate-limit key kinds (ip, ja4) and changed variable names."],
+            ["logHeaders", "Header names a firewall rule logs."],
+            ["log_headers", "Header names the firewall logs."],
+            ["signingKeys", "KMS signing key metadata and public key material; private keys stay with Vercel."],
+            ["bindings", "Service-to-service binding names and targets."],
+            ["canaryResponseHeader", "Whether a canary response sets a header; a boolean."],
+            ["inferenceRegion", "An AI Gateway routing region."],
+            ["providerTimeouts", "Provider timeouts in milliseconds."],
+            ["redirectUri", "A connector's registered OAuth redirect URI, public by design."],
+            ["supportsRevocation", "Whether a connector can revoke tokens; a boolean."],
+            ["claims", "OIDC claim matchers a policy requires, not tokens."],
+            ["customClaims", "OIDC claim configuration, not tokens."],
+            ["limited", "Whether a record is limited by the token's privileges; a boolean."],
+            ["enforced", "Whether SAML is enforced; a boolean."],
+            ["kind", "A store or record kind."],
+            ["budget", "An AI Gateway key's spend budget."],
+            ["origin", "How a token was issued (manual, oauth)."],
+            ["scope", "A token's scope (user, team, project)."],
+            ["issuedBefore", "A revocation cutoff timestamp."],
+            ["issuerUrl", "The OIDC issuer URL, public by design."],
+            ["oidcSubject", "The OIDC subject claim, an identifier."],
+            ["next", "A pagination cursor; it grants nothing."],
+            ["partialKeyValue", "A masked SDK key preview."],
+            ["appUrlRegistrationSupport", "Whether a partner accepts app URLs; a boolean."],
+            ["disjunctiveProductionSecretPolicy", "A team policy setting."],
+            ["sensitiveEnvironmentVariablePolicy", "A team policy setting."],
+            ["strictPasswordProtectionSettings", "A team policy setting."],
+        ].map(([name, reason]) => [name, { verdict: "keep", reason }])),
+    },
 };

package/dist/providers/vercel/skill.generated.js

@@ -1,10 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
-    "instructionsHeading": "Account instructions",
-    "fragments": {
-        "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `web_fetch_vercel_url` runs application code and is reviewed as destructive; the toolbar reply, reaction, edit, and resolve tools are writes.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, daemon liveness-probe header values and internal endpoint ciphertext, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), conditional firewall bypass compiled `condition` expressions and their credential match values, team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in deployment `errorMessage`, build-event `payload.text`/`text`, and runtime-log `message` on the reviewed deployment/log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Deployment metadata and other application content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. Deployment creation also inspects decoded `files[].data` when `encoding` is `base64` (one decode bounded by the field's encoded length and the host's request limit; malformed base64 is refused). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
-        "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
-    }
+    "content": "## Projects, deployments and domains\n\nResolve a team by slug, a project by name, and deployments by the observed\nproject id. Team ids start with `team_`, project ids with `prj_`, and deployment\nids with `dpl_`. A deployment hostname and a deployment id identify the same\ndeployment; an alias can later point to a different deployment.\n\nSome project paths accept a project name, but a deployment list's projectId\nfilter requires the observed `prj_` id. Resolve the name before listing its\ndeployments; an empty result for a guessed name does not prove absence.\nComplete each identifier lookup before starting the reads that depend on it.\n\n<!-- when: unpinned -->\nThe configured team is a routing default, not a restriction. Explicit teamId\nor slug selects another team the token can reach; teamId: null selects personal\nscope. Vercel token permissions determine access. Prefer an explicit team when\njoining resources across several calls.\n<!-- end -->\n\n<!-- when: pinned -->\nThe deployment confines this connection to one team. A supplied team slug must\nbelong to that team; personal scope and foreign teams are refused. Project and\ndeployment references require ownership reads. Global/account and transfer\noperations without a verifiable team boundary remain unavailable. A team list\nreturns only the pinned team.\n<!-- end -->\n\nRead deployment state before its build events. Runtime logs diagnose requests\nafter a deployment built; build logs explain a failed build. Narrow time windows\nbefore raising collection limits. Generic reads refuse live follow streams;\nuse the bounded build/runtime readers. Deployment timestamps are milliseconds.\n\nProject domains and deployment aliases are different joins: a project domain\nbelongs to the project, while an alias identifies its assigned deployment.\nRead a pending domain's verification instructions before changing DNS.\n\n## Environment changes\n\nResolve environment-variable ids using metadata, including target, branch and\ncustom environment. A key can have distinct production and preview values.\nExisting values cannot be retrieved. Supply new values only when the task asks\nfor a change; confirm the returned id and metadata.\n\nEnvironment changes apply to future deployments. A new deployment is a separate\nwrite. Promoting an existing deployment does not rebuild it or update embedded\nenvironment values. After an uncertain update, reconcile observable metadata\nsuch as id, targets and comment; reading metadata cannot verify a secret value.\n\n## Explicit files and credentials\n\nDeployment files can reference previously uploaded digests. File uploads accept\nexplicit bytes and never read a path on the agent's machine. Decrypted-value,\ncredential-minting, protection-bypass-link, signing and domain move-out operations\nare refused; use Vercel's dashboard for those workflows.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `list_teams`, `vercel_api_details`, `vercel_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. For `vercel_api_read`, put it in `query[page.param]` or `body[page.param]`, as `page.in` specifies. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 20, at most 100). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `vercel_api_search` finds this API's operations and reads no account data, `vercel_api_details` shows one operation's contract, and `vercel_api_read` calls a reviewed read. `vercel_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 29 operations are refused by design; use `vercel_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Account instructions"
 };