@zackbart/connecta 0.34.1 → 0.36.0

package/dist/providers/cloudflare/{value-safety.js → safety.js}

@@ -1200,6 +1200,493 @@ const OPERATIONS = {
  * are reviewed metadata wherever they appear.
  */
 export const CLOUDFLARE_VALUE_SAFETY = {
+    absent: {
+        "reason": "Paths a shared verdict carries (Access rules, Pages projects, Workers Builds, containers, RealtimeKit, Zaraz, certificates) that this operation's pinned response schema does not declare, or fields the schema leaves undeclared (binding payloads under a Worker's env map). They stay applied at runtime, so an undeclared field the vendor returns is still removed; listing them here keeps every other path checked against the schema.",
+        "operations": {
+            "DELETE /accounts/{account_id}/pages/projects/{project_name}/source": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/access/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /accounts/{account_id}/builds/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/builds/latest": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/builds/{build_uuid}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/triggers/{trigger_uuid}/environment_variables": [
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{external_script_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "GET /accounts/{account_id}/cni/cnis": ["bgp.md5_key"],
+            "GET /accounts/{account_id}/cni/cnis/{cni}": ["items.bgp.md5_key"],
+            "GET /accounts/{account_id}/containers/applications": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}/instances-v2": [
+                "next_page_token",
+                "page_token",
+            ],
+            "GET /accounts/{account_id}/containers/applications/{application_id}/versions": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "GET /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "GET /accounts/{account_id}/pages/projects": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/pages/projects/{project_name}": ["env_vars.*.value"],
+            "GET /accounts/{account_id}/pages/projects/{project_name}/deployments": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "GET /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams/{livestream_id}": [
+                "data.livestreams.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/livestreams/{livestream_id}/active-livestream-session": [
+                "data.livestreams.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/active-livestream": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "GET /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/livestream": [
+                "data.livestream.stream_key",
+                "data.stream_key",
+            ],
+            "GET /accounts/{account_id}/stream/live_inputs": [
+                "rtmps.streamKey",
+                "rtmps.url",
+                "rtmpsPlayback.streamKey",
+                "rtmpsPlayback.url",
+                "srt.passphrase",
+                "srt.url",
+                "srtPlayback.passphrase",
+                "srtPlayback.url",
+                "webRTC.url#url",
+                "webRTCPlayback.url",
+            ],
+            "GET /accounts/{account_id}/workers/workers": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments/{deployment_id}": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions": ["env.*.json", "env.*.text"],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions/latest": ["env.*.json", "env.*.text"],
+            "GET /accounts/{account_id}/workers/workers/{worker_id}/versions/{version_id}": ["env.*.json", "env.*.text"],
+            "GET /organizations": ["next_page_token"],
+            "GET /organizations/{organization_id}/accounts": ["next_page_token"],
+            "GET /organizations/{organization_id}/members": ["next_page_token"],
+            "GET /zones/{zone_id}/access/apps": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/groups": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/access/groups/{group_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "GET /zones/{zone_id}/custom_certificates": ["certificates.geo_restrictions"],
+            "GET /zones/{zone_id}/custom_certificates/{custom_certificate_id}": ["certificates.geo_restrictions"],
+            "GET /zones/{zone_id}/settings/zaraz/config": ["*.config.debugKey", "*.config.variables.*.value"],
+            "GET /zones/{zone_id}/settings/zaraz/default": ["*.config.debugKey", "*.config.variables.*.value"],
+            "GET /zones/{zone_id}/settings/zaraz/export": [
+                "*.config.debugKey",
+                "*.config.variables.*.value",
+                "*.debugKey",
+                "*.variables.*.value",
+            ],
+            "GET /zones/{zone_id}/settings/zaraz/history/configs": [
+                "*.debugKey",
+                "*.variables.*.value",
+                "debugKey",
+                "variables.*.value",
+            ],
+            "GET /zones/{zone_id}/ssl/certificate_packs": ["geo_restrictions", "policy_restrictions"],
+            "GET /zones/{zone_id}/ssl/certificate_packs/{certificate_pack_id}": ["geo_restrictions", "policy_restrictions"],
+            "PATCH /accounts/{account_id}/builds/triggers/{trigger_uuid}/environment_variables": [
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/builds/workers/{script_tag}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+            ],
+            "PATCH /accounts/{account_id}/containers/applications/{application_id}": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "PATCH /accounts/{account_id}/pages/projects/{project_name}": ["env_vars.*.value"],
+            "PATCH /accounts/{account_id}/workers/dispatch/namespaces/{dispatch_namespace}/scripts/{script_name}/secrets-bulk": ["key_base64", "key_jwk", "text"],
+            "PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk": ["key_base64", "key_jwk", "text"],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments/latest": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "PATCH /accounts/{account_id}/workers/workers/{worker_id}/versions/latest": ["env.*.json", "env.*.text"],
+            "PATCH /zones/{zone_id}/custom_certificates/{custom_certificate_id}": ["certificates.geo_restrictions"],
+            "PATCH /zones/{zone_id}/ssl/certificate_packs/{certificate_pack_id}": ["geo_restrictions", "policy_restrictions"],
+            "POST /accounts/{account_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /accounts/{account_id}/access/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /accounts/{account_id}/builds/triggers/{trigger_uuid}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers/{script_tag}/migrate_to_previews": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/builds/workers/{script_tag}/previews/{preview_id}/builds": [
+                "*.value",
+                "build_trigger_metadata.environment_variables.*.value",
+                "builds.*.build_trigger_metadata.environment_variables.*.value",
+                "previews_base_config.environment_variables.*.value",
+                "production_settings.environment_variables.*.value",
+                "settings.environment_variables.*.value",
+            ],
+            "POST /accounts/{account_id}/cni/cnis": ["items.bgp.md5_key"],
+            "POST /accounts/{account_id}/containers/applications": [
+                "current_configuration.authorized_keys",
+                "current_configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+                "target_configuration.authorized_keys",
+                "target_configuration.environment_variables.value",
+            ],
+            "POST /accounts/{account_id}/containers/applications/{application_id}/rollouts": [
+                "configuration.authorized_keys",
+                "configuration.environment_variables.value",
+                "next_page_token",
+                "page_token",
+            ],
+            "POST /accounts/{account_id}/d1/database/{database_id}/export": ["signed_url#url"],
+            "POST /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "POST /accounts/{account_id}/pages/projects": ["env_vars.*.value"],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}/retry": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}/rollback": [
+                "canonical_deployment.build_config.web_analytics_token",
+                "canonical_deployment.env_vars.*.value",
+                "deployment_configs.preview.ai_bindings",
+                "deployment_configs.preview.env_vars.*.value",
+                "deployment_configs.preview.hyperdrive_bindings",
+                "deployment_configs.preview.vectorize_bindings",
+                "deployment_configs.production.ai_bindings",
+                "deployment_configs.production.env_vars.*.value",
+                "deployment_configs.production.hyperdrive_bindings",
+                "deployment_configs.production.vectorize_bindings",
+                "latest_deployment.build_config.web_analytics_token",
+                "latest_deployment.env_vars.*.value",
+            ],
+            "POST /accounts/{account_id}/pages/projects/{project_name}/source": ["env_vars.*.value"],
+            "POST /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/livestreams": [
+                "data.livestream.stream_key",
+                "data.livestreams.stream_key",
+            ],
+            "POST /accounts/{account_id}/workers/workers": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "POST /accounts/{account_id}/workers/workers/{worker_id}/previews/{preview_id}/deployments": [
+                "env.*.json",
+                "env.*.text",
+            ],
+            "POST /accounts/{account_id}/workers/workers/{worker_id}/versions": ["env.*.json", "env.*.text"],
+            "POST /zones/{zone_id}/access/apps": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "POST /zones/{zone_id}/access/apps/{app_id}/policies": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /zones/{zone_id}/access/groups": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "POST /zones/{zone_id}/custom_certificates": ["certificates.geo_restrictions"],
+            "POST /zones/{zone_id}/ssl/certificate_packs/order": ["geo_restrictions", "policy_restrictions"],
+            "PUT /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/access/apps/{app_id}/policies/{policy_id}/make_reusable": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/access/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /accounts/{account_id}/cni/cnis/{cni}": ["items.bgp.md5_key"],
+            "PUT /accounts/{account_id}/dlp/profiles/predefined/{profile_id}/config": ["shared_entries.secret"],
+            "PUT /accounts/{account_id}/workers/workers/{worker_id}": [
+                "previews_base_config.env.*.json",
+                "previews_base_config.env.*.text",
+            ],
+            "PUT /zones/{zone_id}/access/apps/{app_id}": [
+                "policies.exclude.any_valid_service_token",
+                "policies.exclude.linked_app_token",
+                "policies.exclude.service_token",
+                "policies.include.any_valid_service_token",
+                "policies.include.linked_app_token",
+                "policies.include.service_token",
+                "policies.require.any_valid_service_token",
+                "policies.require.linked_app_token",
+                "policies.require.service_token",
+                "read_service_tokens_from_header",
+            ],
+            "PUT /zones/{zone_id}/access/apps/{app_id}/policies/{policy_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /zones/{zone_id}/access/groups/{group_id}": [
+                "is_default.any_valid_service_token",
+                "is_default.linked_app_token",
+                "is_default.service_token",
+            ],
+            "PUT /zones/{zone_id}/custom_certificates/prioritize": ["certificates.geo_restrictions"],
+            "PUT /zones/{zone_id}/settings/zaraz/config": ["*.config.debugKey", "*.config.variables.*.value"],
+            "PUT /zones/{zone_id}/settings/zaraz/history": ["*.config.debugKey", "*.config.variables.*.value"],
+        },
+    },
     embeddedUrls: {
         operations: {
             "GET /accounts/{account_id}/builds/builds/{build_uuid}/logs": ["lines"],

package/dist/providers/cloudflare/skill.generated.js

@@ -1,13 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "- Resolve account and zone ids before acting; never guess one. Ids are 32-character hex strings, and a zone is found by its domain name. Defaults and pins route a connector; Cloudflare's permissions still decide what the credential may do.\n- Read state before replacing, rolling back, or purging. For DNS, PATCH changes the fields you send and PUT replaces the whole record, so read the record first and send its type, name, and content with the change. Prefer a targeted cache purge (files, tags, hosts, or prefixes) over purging everything.\n- Cloudflare reports failures in `errors` with numeric codes and returns `success: false`; read the message instead of retrying the same call.\n- Honor rate-limit waits. Cloudflare documents 1,200 requests per five minutes per user, counted across the dashboard and every token; Connecta's per-runtime window approximates it, and a limited user is blocked for the rest of the window.\n- Treat every create, update, delete, purge, deploy, and upload as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
-    "instructionsHeading": "Account instructions",
-    "fragments": {
-        "oauth": "\n\n- The catalog is Cloudflare's own `docs`, `search`, and `execute`. `docs` searches Cloudflare developer documentation. `search` runs code against Cloudflare's OpenAPI document; `execute` runs code that may call any Cloudflare API endpoint the OAuth grant allows.\n- Connecta classifies `execute` as a write, even for a program that only reads, because one program can mix GET, POST, PUT, PATCH, and DELETE and no schema proves otherwise. A read-only endpoint therefore gets `docs` and `search` here. Deployments that need API reads from a read-only endpoint configure an API-token connector, whose `cloudflare_api_read` and named reads are reads.\n- Use `search` to find the exact method, path, and fields before writing an execute program. Do not guess an endpoint from product naming.\n- Keep returned values small. Filter and project inside the Cloudflare program, then reduce again inside Connecta's `execute_code` when several calls must be joined.\n- This connection has none of the REST connector's tools: no `cloudflare_api_*` validation against a pinned index, no `graphql_query`, no `cloudflare_api_upload`, and no account or zone pin. OAuth permissions are the boundary.\n",
-        "oauth_tail": "- An `auth_required` failure means this connector's Cloudflare authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged.\n",
-        "global_warning": "\n\nThis connector holds a Global API Key. It acts as its Cloudflare user with every permission that user has, in every account and zone the user belongs to, and nothing on Cloudflare's side narrows it. A mistaken write can reach production domains, billing, and members across all of them. Prefer reads, state the account and zone of every write, and stop when a request is ambiguous. Writes under `/user` and `/memberships` are refused. R2 accepts API tokens only, so R2 operations fail with this key.\n",
-        "key": "\n\n- This is Connecta's REST connector to the Cloudflare v4 API, holding one operator-managed credential. `cloudflare_api_search` finds API operations in a pinned index (not records) and names the tool that calls each; `cloudflare_api_details` returns one operation's parameters and body with types, enums, and required names. Neither sends a request.\n- `cloudflare_api_read` calls GET operations plus reviewed read-only POSTs: analytics queries, Analytics Engine and SQL API queries, Log Explorer SQL, Vectorize queries, KV bulk get, telemetry queries, application-name lookup, and validation checks (including custom posture finding types). `cloudflare_api_write` calls every other POST, PUT, PATCH, and DELETE with `method` and `path` stated. D1 `…/query` and `…/raw`, Durable Object queries, Workers AI `…/ai/run`, AI Search and AutoRAG search (query rewriting runs billed models), monetization checks, and flag evaluation are writes: they can change data, cost money, or activate something.\n- Paths are concrete: substitute ids into the template search returned (`/zones/<zone id>/dns_records/<record id>`). Pass `query` and `body` as JSON named as details lists them; text operations (Analytics Engine SQL, Log Explorer SQL, Worker scripts) take a string body, and Vectorize inserts a list of objects sent as NDJSON. R2 calls accept `headers` with `cf-r2-jurisdiction` or `cf-r2-storage-class`. Encode a `/` inside an R2 object key or KV key name as `%2F`.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Cloudflare, so fix the call from that answer.\n- Under an account pin, each uncached zone-ownership check also spends the connector's call budget. Checks stay capped at three per call and 60 per five minutes per connector; an exhausted budget stops the check and the requested operation.\n- Results arrive as `{ status, data, page? }` with Cloudflare's envelope unwrapped: `data` is the `result`. On a list, pass `page.next` as the `page.param` query argument (`page` for numbered lists, `cursor` for KV, R2, and other cursor lists). Lists belong inside `execute_code`; pass `select` (dot paths such as `id` and `name`) to keep only the fields the question needs.\n- `list_zones` and `list_accounts` resolve names to ids; `verify_credential` separates a bad credential from a missing permission. `graphql_query` runs read-only GraphQL Analytics queries (mutations are refused before sending); filter every `zones` or `accounts` field by `zoneTag` or `accountTag`. A pinned connector sends one query per document, with every fragment it defines used.\n- Multipart, binary, and file bodies go through `cloudflare_api_upload`: Worker scripts and versions, KV values, R2 objects, Pages deployments, Images, Stream, DNS zone-file import, and Snippets. It takes `textBody`, `base64Body`, or multipart `parts`, never a local file.\n- Refused by design: every operation that mints, rotates, or hands back a credential (API tokens, Access service tokens, R2 temporary credentials, tunnel and Mesh node tokens, signing keys, registry credentials, direct-upload URLs, deploy hooks, preview and participant tokens), payment client secrets (including AI Gateway top-up configuration), Cloudforce One priority-intelligence match reads and updates (their response schemas are unreviewed), URL Scanner captures (results, HAR, DOM, raw responses: they hold the scanned session's cookies and headers; use the scan search for verdicts), and GETs that act (an email unsubscribe, a PagerDuty connect). Stored and embedded secrets (Turnstile, TSIG, webhook and identity-provider secrets, Stream keys, Logpush destination credentials, probe, custom-provider, and AI Search crawler headers (every `include_headers` map value; names stay), BGP keys, Zaraz variables, Hyperdrive database passwords, RealtimeKit storage credentials, transform-rule header values) and application setup form defaults and every environment or plain-text binding value (Pages, Containers, Workers, Builds; names and types stay) come back as `\"[redacted]\"` on every method. Notification, RealtimeKit, and data security webhook destinations keep only their scheme and host. Workers KV values are application data and come back as stored. Reviewed operations, and operations that take credentials, report Cloudflare's error codes without its error text. Worker script content is readable: it is code, and secret bindings are not part of it.\n- An `auth_required` failure means the credential is missing, revoked, or malformed: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. `provider_permission_denied` means the credential works but lacks this permission or resource, or the call is outside the pin; ask rather than retry.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in Workers build `lines`, Pages log `data.line`, and telemetry `$metadata.message`/`error` and raw string/object `source` payloads in both `events.events` and `invocations.*` on the reviewed log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. DNS TXT content, KV values, Access/Waiting Room custom HTML and other operator content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. KV bulk writes also inspect decoded `value` fields with `base64: true` (up to Cloudflare's 25 MiB decoded value limit; malformed or oversized base64 is refused, and the host's inbound body cap still applies). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan. Binary responses represented as base64, including Worker JavaScript served as `application/javascript`, are returned unchanged and are not decoded/scanned. An envelope cursor that would change under URL sanitizing is omitted rather than echoed or reused.\n",
-        "shared": "- Resolve account and zone ids before acting; never guess one. Ids are 32-character hex strings, and a zone is found by its domain name. Defaults and pins route a connector; Cloudflare's permissions still decide what the credential may do.\n- Read state before replacing, rolling back, or purging. For DNS, PATCH changes the fields you send and PUT replaces the whole record, so read the record first and send its type, name, and content with the change. Prefer a targeted cache purge (files, tags, hosts, or prefixes) over purging everything.\n- Cloudflare reports failures in `errors` with numeric codes and returns `success: false`; read the message instead of retrying the same call.\n- Honor rate-limit waits. Cloudflare documents 1,200 requests per five minutes per user, counted across the dashboard and every token; Connecta's per-runtime window approximates it, and a limited user is blocked for the rest of the window.\n- Treat every create, update, delete, purge, deploy, and upload as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
-        "key_tail": "- Cloudflare answers a rate limit with HTTP 429; the failure carries `retryAfterMs`. Failed authentication is limited separately (code 10502), so diagnose a credential once with `verify_credential` rather than retrying calls.\n"
-    }
+    "content": "## Accounts, domains and records\n\nResolve account and zone ids before acting. A zone is a domain, found by its name;\nits account id joins it to the account inventory. Cloudflare ids are normally\n32-character hex strings. A default id routes a request; a pin limits its scope.\n\nDNS TTL is in seconds; TTL 1 means automatic. Read the record before changing it.\nPATCH changes supplied fields; PUT replaces the record, so preserve its type,\nname and content. Read state before replacing, rolling back or purging. Prefer\na targeted cache purge by files, tags, hosts or prefixes over purging everything.\n\nHatch data keeps Cloudflare's vendor envelope. For example, select DNS record\nidentities with `fields: [\"result.id\", \"result.name\"]`; a list stays under\n`data.result`. Named account and zone lists keep projected rows with camelCase\naccount and name-server fields.\n\n## Workers, storage and analytics\n\nWorker script source is code; secret binding values are separate and unavailable.\nKV values are application data. Encode a slash inside a KV key or R2 object key\nas `%2F`. R2 requires API-token authentication, rather than a Global API Key.\n\nGraphQL Analytics uses accountTag and zoneTag for account/zone identities.\nFilter every accounts/zones field by equality or an explicit set of those ids.\nA pinned query uses one operation per document and every declared fragment.\nAnalytics Engine SQL is read-only; D1 SQL and Durable Object queries can write.\nAI inference, previews and outbound checks can cost money or activate work.\n\n## Disqualifiers and recovery\n\nCredential minting, rotation, stored secrets, private session captures and signed\nupload or deployment links are unavailable. Use the Cloudflare dashboard for\ncredential administration. A Global API Key cannot change user settings or\nmemberships through this connection.\n\nAfter an authentication failure, use `verify_credential` once to distinguish a\nrejected credential from a permission gap. An operator replaces the credential;\nrepeating the failed request does not add permissions. Cloudflare's global limit\ncounts dashboard traffic and all tokens together, so reduce requests as well as\nhonoring the returned wait.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `cloudflare_api_details`, `cloudflare_api_search`, `list_accounts`, `list_zones`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. For `cloudflare_api_read`, put it in `query[page.param]` or `body[page.param]`, as `page.in` specifies. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 20, at most 50). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Envelope fields:** hatch data keeps the vendor envelope. Select declared fields with `fields: [\"result.id\", \"result.name\"]`; array traversal also accepts `result[].id`. Named reads keep their projected fields.\n- **Hatch:** `cloudflare_api_search` finds this API's operations and reads no account data, `cloudflare_api_details` shows one operation's contract, and `cloudflare_api_read` calls a reviewed read. `cloudflare_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 70 operations are refused by design; use `cloudflare_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Account instructions"
 };