fix: Vercel region collides with unified region; 8 legacy fields leak invalid Cloudflare wirefilter

[gfargo]

Fixes #270
Fixes #271

(Also closes #273, a duplicate of #270/#271 filed independently in this same session before the duplication was noticed — see the comment on #273 for details.)

Summary

Two related, independently-verified translator correctness bugs, found and empirically confirmed (running the real vercelToUnified/unifiedToCloudflare functions against test fixtures, not just reading the code) during a rules.md doc-accuracy audit.

• Vercel region condition silently collides with unified schema's differently-meaning region field on Cloudflare sync #270 — Vercel's region silently collides with the unified region field. Vercel's native region means the edge/deployment region a request is served from (e.g. "sfo1") — mapVercelTypeToUnified had no entry for it, so it passed through unchanged into a unified condition with field: "region". But the unified schema already has a region FieldType meaning something else entirely — the client's geographic subdivision, which Cloudflare's translator maps to ip.geoip.subdivision_1. The two silently shared one name: a Vercel region condition became a syntactically valid Cloudflare rule (zero warnings) whose condition could never actually match anything — a deny/challenge rule that never fires, or a bypass/allow rule that silently blocks everyone it was meant to exempt. Fixed by namespacing Vercel's region to vercel_region, which no other provider's field vocabulary uses; mapUnifiedTypeToVercel keeps the reverse direction in sync so the round trip stays lossless.

• 8 legacy-only Vercel condition types produce invalid Cloudflare filter syntax with no warning #271 — 8 other legacy-only Vercel fields leaked invalid wirefilter syntax. geo_continent, protocol, target_path, environment, ja3_digest, ja4_digest, and rate_limit_api_id all pass through the same way, and mapUnifiedFieldToCloudflare's mapping[field] || field fallback then leaked each one as a bare, non-existent wirefilter identifier (e.g. geo_continent eq "NA") — again with zero warnings. Every other unsupported-field case in this codebase (mapUnifiedTypeToVercel, mapUnifiedFieldToFastly) already returns null and lets the caller drop the condition with a TranslationWarning; mapUnifiedFieldToCloudflare was the only one that fell through instead. Now it returns string | null to match, and unifiedToCloudflare filters unsupported conditions with a warning before building the expression — throwing if that leaves zero conditions, mirroring unifiedToVercel's identical existing guard (never silently sync a conditionless rule that would match all traffic).

geo_country_region (one of the 8 in #271) turned out not to need the drop-with-warning treatment: rules.md already documents it as Vercel's real client-subdivision field ("Region/state code", e.g. "CA") — the same concept as unified region, not a separate one — so it now maps there directly and translates normally.

Also fixes a threat_score (cf.threat_score) gap a pre-existing test relied on this exact same silent-fallback bug for, and corrects cloudflare.md's field table plus a claim it made that turned out to be inaccurate against actual runtime behavior (legacy-only fields "aren't reachable through a provider-tagged config" — they are; UnifiedCondition.field accepts arbitrary strings).

Test plan

• Regression tests for both bugs, mutation-verified (reverted the source fix while keeping the new tests, confirmed all 13 new/changed assertions fail legibly against the old behavior — including one showing the literal invalid ja4_digest eq "test" string that used to leak into the expression — then restored and confirmed green)
• pnpm tsc --noEmit && pnpm test && pnpm lint all pass (1756 tests, 0 lint errors)
• Confirmed no regression on the legitimate unified region (client geo) path — still produces ip.geoip.subdivision_1 with zero warnings
• Confirmed the Vercel region → unified vercel_region → Vercel region round trip stays lossless

[github-actions]

🎉 This PR is included in version 3.15.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀