cf 0.0.6 → 0.1.0

package/dist/magic-transit-troGMFb9.mjs

@@ -1,30 +0,0 @@
-#!/usr/bin/env node
-import{d as e,h as t,o as n,p as r,t as i}from"./auth-BHD_B2p9.mjs";import{n as a,r as o}from"./input-validation-BpVQi9rR.mjs";import{n as s,t as c}from"./body-parser-iA3vRFmh.mjs";import{t as l}from"./output-CqGQp2r6.mjs";import{t as u}from"./dry-run-FV0pZwdg.mjs";import{t as d}from"./local-OqhVQbv0.mjs";import{t as f}from"./progress-5sHFvwez.mjs";import{n as p,t as m}from"./raw-fetch-CxFs4i0R.mjs";const h={command:`create`,describe:`Create a DNS Protection rule for an account.`,builder:e=>e.option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`name`,{type:`string`,description:`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`profile-sensitivity`,{type:`string`,description:`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new DNS Protection rule to add.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-dns-protection configs dns protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`json`,body:{burstSensitivity:r.burstSensitivity,mode:r.mode,name:r.name,profileSensitivity:r.profileSensitivity,rateSensitivity:r.rateSensitivity,scope:r.scope,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_dns_protection/configs/dns_protection/rules`,{body:e})),{successLabel:`Created rule`});return}r.burstSensitivity===void 0&&(r.burstSensitivity=await t(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.mode===void 0&&(r.mode=await t(`mode`,`The mode for DNS Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the DNS Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r.profileSensitivity===void 0&&(r.profileSensitivity=await t(`profile-sensitivity`,`The profile sensitivity. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`)),r.rateSensitivity===void 0&&(r.rateSensitivity=await t(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await t(`scope`,`The scope for the DNS Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let h={};r.burstSensitivity!==void 0&&s(h,[`burst_sensitivity`],a(r.burstSensitivity,`burstSensitivity`,`text`)),r.mode!==void 0&&s(h,[`mode`],a(r.mode,`mode`,`text`)),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.profileSensitivity!==void 0&&s(h,[`profile_sensitivity`],a(r.profileSensitivity,`profileSensitivity`,`text`)),r.rateSensitivity!==void 0&&s(h,[`rate_sensitivity`],a(r.rateSensitivity,`rateSensitivity`,`text`)),r.scope!==void 0&&s(h,[`scope`],a(r.scope,`scope`,`text`)),l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_dns_protection/configs/dns_protection/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created rule`})}},g={command:`account`,describe:`Delete all DNS Protection rules for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedDNSProtection.configs.dns.protection.rules.delete.for.account(s)),{successLabel:`Deleted for`})}},ee={command:`for`,describe:`Advanced Dns Protection operations`,builder:e=>e.command(g).demandCommand(1),handler:()=>{}},te={command:`rule <ruleId>`,describe:`Delete a DNS Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the DNS Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-dns-protection configs dns protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`protection`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting protection`,async()=>a.magicTransit.advancedDNSProtection.configs.dns.protection.rules.delete.protection.rule(s,t.ruleId)),{successLabel:`Deleted protection`})}},_={command:`protection`,describe:`Advanced Dns Protection operations`,builder:e=>e.command(te).demandCommand(1),handler:()=>{}},v={command:`delete`,describe:`Operations for advanced-dns-protection.configs.dns.protection.rules.delete`,builder:e=>e.command(ee).command(_).demandCommand(1),handler:()=>{}},y={command:`get <ruleId>`,describe:`Get a DNS Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the DNS Protection rule.`,demandOption:!0}),handler:async e=>{o(e.ruleId,`ruleId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading rule`,async()=>t.magicTransit.advancedDNSProtection.configs.dns.protection.rules.get(r,e.ruleId)),{successLabel:`Loaded rule`})}},b={command:`list`,describe:`List all DNS Protection rules for an account.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading rules`,async()=>r.magicTransit.advancedDNSProtection.configs.dns.protection.rules.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded rules`})}},x={command:`update <ruleId>`,describe:`Update a DNS Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the DNS Protection rule to update.`,demandOption:!0}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The new mode for DNS Protection. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`profile-sensitivity`,{type:`string`,description:`The new profile sensitivity. Optional. Recommended setting is 'low'. Must be one of 'low', 'medium', 'high', or 'very_high'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the DNS Protection rule.`}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-dns-protection configs dns protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_dns_protection/configs/dns_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{burstSensitivity:t.burstSensitivity,mode:t.mode,profileSensitivity:t.profileSensitivity,rateSensitivity:t.rateSensitivity,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_dns_protection/configs/dns_protection/rules/${t.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}let m={};t.burstSensitivity!==void 0&&s(m,[`burst_sensitivity`],a(t.burstSensitivity,`burstSensitivity`,`text`)),t.mode!==void 0&&s(m,[`mode`],a(t.mode,`mode`,`text`)),t.profileSensitivity!==void 0&&s(m,[`profile_sensitivity`],a(t.profileSensitivity,`profileSensitivity`,`text`)),t.rateSensitivity!==void 0&&s(m,[`rate_sensitivity`],a(t.rateSensitivity,`rateSensitivity`,`text`)),l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_dns_protection/configs/dns_protection/rules/${t.ruleId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated rule`})}},S={command:`rules`,describe:`Advanced Dns Protection operations`,builder:e=>e.command(h).command(y).command(b).command(x).command(v).demandCommand(1),handler:()=>{}},C={command:`protection`,describe:`Operations for advanced-dns-protection.configs.dns.protection`,builder:e=>e.command(S).demandCommand(1),handler:()=>{}},w={command:`dns`,describe:`Operations for advanced-dns-protection.configs.dns`,builder:e=>e.command(C).demandCommand(1),handler:()=>{}},T={command:`configs`,describe:`Operations for advanced-dns-protection.configs`,builder:e=>e.command(w).demandCommand(1),handler:()=>{}},E={command:`advanced-dns-protection`,describe:`Operations for advanced-dns-protection`,builder:e=>e.command(T).demandCommand(1),handler:()=>{}},D={command:`create`,describe:`Create an allowlist prefix for an account.`,builder:e=>e.option(`comment`,{type:`string`,description:`An comment describing the allowlist prefix.`}).option(`enabled`,{type:`boolean`,description:`Whether to enable the allowlist prefix into effect.`}).option(`prefix`,{type:`string`,description:`The allowlist prefix to add in CIDR format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new allowlist prefix to create.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs allowlist create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`json`,body:{comment:r.comment,enabled:r.enabled,prefix:r.prefix,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating allowlist`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/allowlist`,{body:e})),{successLabel:`Created allowlist`});return}if(r.comment===void 0&&(r.comment=await t(`comment`,`An comment describing the allowlist prefix.`)),r.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);r.prefix===void 0&&(r.prefix=await t(`prefix`,`The allowlist prefix to add in CIDR format.`));let h={};r.comment!==void 0&&s(h,[`comment`],a(r.comment,`comment`,`text`)),r.enabled!==void 0&&s(h,[`enabled`],r.enabled),r.prefix!==void 0&&s(h,[`prefix`],a(r.prefix,`prefix`,`text`)),l(await f(`Creating allowlist`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/allowlist`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created allowlist`})}},O={command:`prefix <prefixId>`,describe:`Delete the allowlist prefix for an account given a UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the allowlist prefix to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.prefixId,`prefixId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs allowlist delete allowlist prefix`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${t.prefixId??`<prefixId>`}`,pathParams:{prefixId:String(t.prefixId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`allowlist`,String(t.prefixId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting allowlist`,async()=>a.magicTransit.advancedTCPProtection.configs.allowlist.delete.allowlist.prefix(s,t.prefixId)),{successLabel:`Deleted allowlist`})}},k={command:`allowlist`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(O).demandCommand(1),handler:()=>{}},A={command:`account`,describe:`Delete all allowlist prefixes for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs allowlist delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.allowlist.delete.for.account(s)),{successLabel:`Deleted for`})}},j={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(A).demandCommand(1),handler:()=>{}},M={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.allowlist.delete`,builder:e=>e.command(k).command(j).demandCommand(1),handler:()=>{}},N={command:`get <prefixId>`,describe:`Get an allowlist prefix specified by the given UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the allowlist prefix.`,demandOption:!0}),handler:async e=>{o(e.prefixId,`prefixId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading allowlist`,async()=>t.magicTransit.advancedTCPProtection.configs.allowlist.get(r,e.prefixId)),{successLabel:`Loaded allowlist`})}},P={command:`list`,describe:`List all allowlist prefixes for an account.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading allowlist`,async()=>r.magicTransit.advancedTCPProtection.configs.allowlist.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded allowlist`})}},F={command:`update <prefixId>`,describe:`Update an allowlist prefix specified by the given UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the allowlist prefix to update.`,demandOption:!0}).option(`comment`,{type:`string`,description:`A comment describing the allowlist prefix. Optional.`}).option(`enabled`,{type:`boolean`,description:`Whether to enable the allowlist prefix into effect. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the allowlist prefix.`}),handler:async t=>{if(o(t.prefixId,`prefixId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs allowlist update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/allowlist/${t.prefixId??`<prefixId>`}`,pathParams:{prefixId:String(t.prefixId??``)},bodyKind:`json`,body:{comment:t.comment,enabled:t.enabled,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating allowlist`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/allowlist/${t.prefixId}`,{body:e})),{successLabel:`Updated allowlist`});return}let m={};t.comment!==void 0&&s(m,[`comment`],a(t.comment,`comment`,`text`)),t.enabled!==void 0&&s(m,[`enabled`],t.enabled),l(await f(`Updating allowlist`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/allowlist/${t.prefixId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated allowlist`})}},I={command:`allowlist`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(D).command(N).command(P).command(F).command(M).demandCommand(1),handler:()=>{}},L={command:`create`,describe:`Create multiple prefixes for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The list of new prefixes to create.`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs prefixes bulk create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/bulk`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Creating bulk`,async()=>r.post(`/accounts/${a}/magic/advanced_tcp_protection/configs/prefixes/bulk`,{body:e})),{successLabel:`Created bulk`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},R={command:`bulk`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(L).demandCommand(1),handler:()=>{}},z={command:`create`,describe:`Create a prefix for an account.`,builder:e=>e.option(`comment`,{type:`string`,description:`A comment describing the prefix.`}).option(`excluded`,{type:`boolean`,description:`Whether to exclude the prefix from protection.`}).option(`prefix`,{type:`string`,description:`The prefix to add in CIDR format.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new prefix to create.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs prefixes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes`,pathParams:{},bodyKind:`json`,body:{comment:r.comment,excluded:r.excluded,prefix:r.prefix,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating prefixe`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/prefixes`,{body:e})),{successLabel:`Created prefixe`});return}if(r.comment===void 0&&(r.comment=await t(`comment`,`A comment describing the prefix.`)),r.excluded===void 0)throw Error(`--excluded is required (or pass --body with this field set).`);r.prefix===void 0&&(r.prefix=await t(`prefix`,`The prefix to add in CIDR format.`));let h={};r.comment!==void 0&&s(h,[`comment`],a(r.comment,`comment`,`text`)),r.excluded!==void 0&&s(h,[`excluded`],r.excluded),r.prefix!==void 0&&s(h,[`prefix`],a(r.prefix,`prefix`,`text`)),l(await f(`Creating prefixe`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/prefixes`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created prefixe`})}},B={command:`account`,describe:`Delete all prefixes for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs prefixes delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.prefixes.delete.for.account(s)),{successLabel:`Deleted for`})}},V={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(B).demandCommand(1),handler:()=>{}},H={command:`prefix <prefixId>`,describe:`Delete the prefix for an account given a UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the prefix to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.prefixId,`prefixId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs prefixes delete prefix`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/${t.prefixId??`<prefixId>`}`,pathParams:{prefixId:String(t.prefixId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`delete`,String(t.prefixId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting delete`,async()=>a.magicTransit.advancedTCPProtection.configs.prefixes.delete.prefix(s,t.prefixId)),{successLabel:`Deleted delete`})}},U={command:`delete`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(H).command(V).demandCommand(1),handler:()=>{}},W={command:`get <prefixId>`,describe:`Get a prefix specified by the given UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the prefix.`,demandOption:!0}),handler:async e=>{o(e.prefixId,`prefixId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading prefixe`,async()=>t.magicTransit.advancedTCPProtection.configs.prefixes.get(r,e.prefixId)),{successLabel:`Loaded prefixe`})}},G={command:`list`,describe:`List all prefixes for an account.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading prefixes`,async()=>r.magicTransit.advancedTCPProtection.configs.prefixes.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded prefixes`})}},K={command:`update <prefixId>`,describe:`Update a prefix specified by the given UUID.`,builder:e=>e.positional(`prefixId`,{type:`string`,description:`The UUID of the prefix to update.`,demandOption:!0}).option(`comment`,{type:`string`,description:`A new comment for the prefix. Optional.`}).option(`excluded`,{type:`boolean`,description:`Whether to exclude the prefix from protection. Optional.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the prefix.`}),handler:async t=>{if(o(t.prefixId,`prefixId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs prefixes update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/prefixes/${t.prefixId??`<prefixId>`}`,pathParams:{prefixId:String(t.prefixId??``)},bodyKind:`json`,body:{comment:t.comment,excluded:t.excluded,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating prefixe`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/prefixes/${t.prefixId}`,{body:e})),{successLabel:`Updated prefixe`});return}let m={};t.comment!==void 0&&s(m,[`comment`],a(t.comment,`comment`,`text`)),t.excluded!==void 0&&s(m,[`excluded`],t.excluded),l(await f(`Updating prefixe`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/prefixes/${t.prefixId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated prefixe`})}},q={command:`prefixes`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(z).command(W).command(G).command(K).command(R).command(U).demandCommand(1),handler:()=>{}},J={command:`create`,describe:`Create a SYN Protection filter for an account.`,builder:e=>e.option(`expression`,{type:`string`,description:`The filter expression.`}).option(`mode`,{type:`string`,description:`The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new filter to create.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection filters create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters`,pathParams:{},bodyKind:`json`,body:{expression:r.expression,mode:r.mode,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating filter`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/syn_protection/filters`,{body:e})),{successLabel:`Created filter`});return}r.expression===void 0&&(r.expression=await t(`expression`,`The filter expression.`)),r.mode===void 0&&(r.mode=await t(`mode`,`The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'.`));let h={};r.expression!==void 0&&s(h,[`expression`],a(r.expression,`expression`,`text`)),r.mode!==void 0&&s(h,[`mode`],a(r.mode,`mode`,`text`)),l(await f(`Creating filter`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/syn_protection/filters`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created filter`})}},Y={command:`account`,describe:`Delete all SYN Protection filters for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection filters delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.syn.protection.filters.delete.for.account(s)),{successLabel:`Deleted for`})}},X={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Y).demandCommand(1),handler:()=>{}},Z={command:`filter <filterId>`,describe:`Delete a SYN Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.filterId,`filterId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection filters delete protection filter`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters/${t.filterId??`<filterId>`}`,pathParams:{filterId:String(t.filterId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`protection`,String(t.filterId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting protection`,async()=>a.magicTransit.advancedTCPProtection.configs.syn.protection.filters.delete.protection.filter(s,t.filterId)),{successLabel:`Deleted protection`})}},Q={command:`protection`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Z).demandCommand(1),handler:()=>{}},ne={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.filters.delete`,builder:e=>e.command(X).command(Q).demandCommand(1),handler:()=>{}},re={command:`get <filterId>`,describe:`Get a SYN Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to retrieve.`,demandOption:!0}),handler:async e=>{o(e.filterId,`filterId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading filter`,async()=>t.magicTransit.advancedTCPProtection.configs.syn.protection.filters.get(r,e.filterId)),{successLabel:`Loaded filter`})}},ie={command:`list`,describe:`List all SYN Protection filters for an account.`,builder:e=>e.option(`mode`,{type:`string`,description:`The mode of the filters to get. Optional. Valid values: 'enabled', 'disabled', 'monitoring'.`}).option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.mode!==void 0&&(t.mode=e.mode),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading filters`,async()=>r.magicTransit.advancedTCPProtection.configs.syn.protection.filters.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded filters`})}},ae={command:`update <filterId>`,describe:`Update a SYN Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to update.`,demandOption:!0}).option(`expression`,{type:`string`,description:`The new filter expression. Optional.`}).option(`mode`,{type:`string`,description:`The new mode for the filter. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the filter.`}),handler:async t=>{if(o(t.filterId,`filterId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection filters update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/filters/${t.filterId??`<filterId>`}`,pathParams:{filterId:String(t.filterId??``)},bodyKind:`json`,body:{expression:t.expression,mode:t.mode,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating filter`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/syn_protection/filters/${t.filterId}`,{body:e})),{successLabel:`Updated filter`});return}let m={};t.expression!==void 0&&s(m,[`expression`],a(t.expression,`expression`,`text`)),t.mode!==void 0&&s(m,[`mode`],a(t.mode,`mode`,`text`)),l(await f(`Updating filter`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/syn_protection/filters/${t.filterId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated filter`})}},oe={command:`filters`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(J).command(re).command(ie).command(ae).command(ne).demandCommand(1),handler:()=>{}},se={command:`create`,describe:`Create a SYN Protection rule for an account.`,builder:e=>e.option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mitigation-type`,{type:`string`,description:`The type of mitigation. Must be one of 'challenge' or 'retransmit'. Optional. Defaults to 'challenge'.`}).option(`mode`,{type:`string`,description:`The mode for SYN Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`name`,{type:`string`,description:`The name of the SYN Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the SYN Protection rule. Must be one of 'global', 'region', or 'datacenter'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new SYN Protection rule to add.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules`,pathParams:{},bodyKind:`json`,body:{burstSensitivity:r.burstSensitivity,mitigationType:r.mitigationType,mode:r.mode,name:r.name,rateSensitivity:r.rateSensitivity,scope:r.scope,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/syn_protection/rules`,{body:e})),{successLabel:`Created rule`});return}r.burstSensitivity===void 0&&(r.burstSensitivity=await t(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.mode===void 0&&(r.mode=await t(`mode`,`The mode for SYN Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the SYN Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r.rateSensitivity===void 0&&(r.rateSensitivity=await t(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await t(`scope`,`The scope for the SYN Protection rule. Must be one of 'global', 'region', or 'datacenter'.`));let h={};r.burstSensitivity!==void 0&&s(h,[`burst_sensitivity`],a(r.burstSensitivity,`burstSensitivity`,`text`)),r.mitigationType!==void 0&&s(h,[`mitigation_type`],a(r.mitigationType,`mitigationType`,`text`)),r.mode!==void 0&&s(h,[`mode`],a(r.mode,`mode`,`text`)),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.rateSensitivity!==void 0&&s(h,[`rate_sensitivity`],a(r.rateSensitivity,`rateSensitivity`,`text`)),r.scope!==void 0&&s(h,[`scope`],a(r.scope,`scope`,`text`)),l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/syn_protection/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created rule`})}},ce={command:`account`,describe:`Delete all SYN Protection rules for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.syn.protection.rules.delete.for.account(s)),{successLabel:`Deleted for`})}},le={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(ce).demandCommand(1),handler:()=>{}},ue={command:`rule <ruleId>`,describe:`Delete a SYN Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the SYN Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`protection`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting protection`,async()=>a.magicTransit.advancedTCPProtection.configs.syn.protection.rules.delete.protection.rule(s,t.ruleId)),{successLabel:`Deleted protection`})}},de={command:`protection`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(ue).demandCommand(1),handler:()=>{}},fe={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.syn.protection.rules.delete`,builder:e=>e.command(le).command(de).demandCommand(1),handler:()=>{}},pe={command:`get <ruleId>`,describe:`Get a SYN Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the SYN Protection rule.`,demandOption:!0}),handler:async e=>{o(e.ruleId,`ruleId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading rule`,async()=>t.magicTransit.advancedTCPProtection.configs.syn.protection.rules.get(r,e.ruleId)),{successLabel:`Loaded rule`})}},me={command:`list`,describe:`List all SYN Protection rules for an account.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading rules`,async()=>r.magicTransit.advancedTCPProtection.configs.syn.protection.rules.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded rules`})}},he={command:`update <ruleId>`,describe:`Update a SYN Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the SYN Protection rule to update.`,demandOption:!0}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`mitigation-type`,{type:`string`,description:`The new mitigation type. Optional. Must be one of 'challenge' or 'retransmit'.`}).option(`mode`,{type:`string`,description:`The new mode for SYN Protection. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The fields to update on the SYN Protection rule.`}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs syn protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/syn_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{burstSensitivity:t.burstSensitivity,mitigationType:t.mitigationType,mode:t.mode,rateSensitivity:t.rateSensitivity,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/syn_protection/rules/${t.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}let m={};t.burstSensitivity!==void 0&&s(m,[`burst_sensitivity`],a(t.burstSensitivity,`burstSensitivity`,`text`)),t.mitigationType!==void 0&&s(m,[`mitigation_type`],a(t.mitigationType,`mitigationType`,`text`)),t.mode!==void 0&&s(m,[`mode`],a(t.mode,`mode`,`text`)),t.rateSensitivity!==void 0&&s(m,[`rate_sensitivity`],a(t.rateSensitivity,`rateSensitivity`,`text`)),l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/syn_protection/rules/${t.ruleId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated rule`})}},ge={command:`rules`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(se).command(pe).command(me).command(he).command(fe).demandCommand(1),handler:()=>{}},_e={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.syn.protection`,builder:e=>e.command(oe).command(ge).demandCommand(1),handler:()=>{}},ve={command:`syn`,describe:`Operations for advanced-tcp-protection.configs.syn`,builder:e=>e.command(_e).demandCommand(1),handler:()=>{}},ye={command:`create`,describe:`Create a TCP Flow Protection filter for an account.`,builder:e=>e.option(`expression`,{type:`string`,description:`The filter expression.`}).option(`mode`,{type:`string`,description:`The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new filter to create.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,pathParams:{},bodyKind:`json`,body:{expression:r.expression,mode:r.mode,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating filter`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,{body:e})),{successLabel:`Created filter`});return}r.expression===void 0&&(r.expression=await t(`expression`,`The filter expression.`)),r.mode===void 0&&(r.mode=await t(`mode`,`The filter's mode. Must be one of 'enabled', 'disabled', 'monitoring'.`));let h={};r.expression!==void 0&&s(h,[`expression`],a(r.expression,`expression`,`text`)),r.mode!==void 0&&s(h,[`mode`],a(r.mode,`mode`,`text`)),l(await f(`Creating filter`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created filter`})}},be={command:`account`,describe:`Delete all TCP Flow Protection filters for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.filters.delete.for.account(s)),{successLabel:`Deleted for`})}},xe={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(be).demandCommand(1),handler:()=>{}},Se={command:`filter <filterId>`,describe:`Delete a TCP Flow Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.filterId,`filterId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters delete protection filter`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${t.filterId??`<filterId>`}`,pathParams:{filterId:String(t.filterId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`protection`,String(t.filterId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting protection`,async()=>a.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.filters.delete.protection.filter(s,t.filterId)),{successLabel:`Deleted protection`})}},Ce={command:`protection`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Se).demandCommand(1),handler:()=>{}},we={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.filters.delete`,builder:e=>e.command(xe).command(Ce).demandCommand(1),handler:()=>{}},Te={command:`get <filterId>`,describe:`Get a TCP Flow Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to retrieve.`,demandOption:!0}),handler:async e=>{o(e.filterId,`filterId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading filter`,async()=>t.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.filters.get(r,e.filterId)),{successLabel:`Loaded filter`})}},Ee={command:`list`,describe:`List all TCP Flow Protection filters for an account.`,builder:e=>e.option(`mode`,{type:`string`,description:`The mode of the filters to get. Optional. Valid values: 'enabled', 'disabled', 'monitoring'.`}).option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.mode!==void 0&&(t.mode=e.mode),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading filters`,async()=>r.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.filters.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded filters`})}},De={command:`update <filterId>`,describe:`Update a TCP Flow Protection filter specified by the given UUID.`,builder:e=>e.positional(`filterId`,{type:`string`,description:`The UUID of the filter to update.`,demandOption:!0}).option(`expression`,{type:`string`,description:`The new filter expression. Optional.`}).option(`mode`,{type:`string`,description:`The new mode for the filter. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the filter.`}),handler:async t=>{if(o(t.filterId,`filterId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection filters update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${t.filterId??`<filterId>`}`,pathParams:{filterId:String(t.filterId??``)},bodyKind:`json`,body:{expression:t.expression,mode:t.mode,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating filter`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${t.filterId}`,{body:e})),{successLabel:`Updated filter`});return}let m={};t.expression!==void 0&&s(m,[`expression`],a(t.expression,`expression`,`text`)),t.mode!==void 0&&s(m,[`mode`],a(t.mode,`mode`,`text`)),l(await f(`Updating filter`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/tcp_flow_protection/filters/${t.filterId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated filter`})}},Oe={command:`filters`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(ye).command(Te).command(Ee).command(De).command(we).demandCommand(1),handler:()=>{}},ke={command:`create`,describe:`Create a TCP Flow Protection rule for an account.`,builder:e=>e.option(`burst-sensitivity`,{type:`string`,description:`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The mode for the TCP Flow Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`name`,{type:`string`,description:`The name of the TCP Flow Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`}).option(`rate-sensitivity`,{type:`string`,description:`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`}).option(`scope`,{type:`string`,description:`The scope for the TCP Flow Protection rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The new TCP Flow Protection rule.`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,pathParams:{},bodyKind:`json`,body:{burstSensitivity:r.burstSensitivity,mode:r.mode,name:r.name,rateSensitivity:r.rateSensitivity,scope:r.scope,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,{body:e})),{successLabel:`Created rule`});return}r.burstSensitivity===void 0&&(r.burstSensitivity=await t(`burst-sensitivity`,`The burst sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.mode===void 0&&(r.mode=await t(`mode`,`The mode for the TCP Flow Protection. Must be one of 'enabled', 'disabled', 'monitoring'.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the TCP Flow Protection rule. Value is relative to the 'scope' setting. For 'global' scope, name should be 'global'. For either the 'region' or 'datacenter' scope, name should be the actual name of the region or datacenter, e.g., 'wnam' or 'lax'.`)),r.rateSensitivity===void 0&&(r.rateSensitivity=await t(`rate-sensitivity`,`The rate sensitivity. Must be one of 'low', 'medium', 'high'.`)),r.scope===void 0&&(r.scope=await t(`scope`,`The scope for the TCP Flow Protection rule.`));let h={};r.burstSensitivity!==void 0&&s(h,[`burst_sensitivity`],a(r.burstSensitivity,`burstSensitivity`,`text`)),r.mode!==void 0&&s(h,[`mode`],a(r.mode,`mode`,`text`)),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.rateSensitivity!==void 0&&s(h,[`rate_sensitivity`],a(r.rateSensitivity,`rateSensitivity`,`text`)),r.scope!==void 0&&s(h,[`scope`],a(r.scope,`scope`,`text`)),l(await f(`Creating rule`,async()=>p.post(`/accounts/${m}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created rule`})}},Ae={command:`account`,describe:`Delete all TCP Flow Protection rules for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete for account`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`for`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting for`,async()=>a.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.rules.delete.for.account(s)),{successLabel:`Deleted for`})}},je={command:`for`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Ae).demandCommand(1),handler:()=>{}},Me={command:`rule <ruleId>`,describe:`Delete a TCP Flow Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the TCP Flow Protection rule to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules delete protection rule`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`protection`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting protection`,async()=>a.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.rules.delete.protection.rule(s,t.ruleId)),{successLabel:`Deleted protection`})}},Ne={command:`protection`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Me).demandCommand(1),handler:()=>{}},Pe={command:`delete`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection.rules.delete`,builder:e=>e.command(je).command(Ne).demandCommand(1),handler:()=>{}},Fe={command:`get <ruleId>`,describe:`Get a TCP Flow Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the TCP Flow Protection rule.`,demandOption:!0}),handler:async e=>{o(e.ruleId,`ruleId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading rule`,async()=>t.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.rules.get(r,e.ruleId)),{successLabel:`Loaded rule`})}},Ie={command:`list`,describe:`List all TCP Flow Protection rules for an account.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number for pagination. Defaults to 1.`}).option(`per-page`,{type:`number`,description:`The number of items per page. Must be between 10 and 1000. Defaults to 25.`}).option(`order`,{type:`string`,description:`The field to order by. Defaults to 'prefix'.`}).option(`direction`,{type:`string`,description:`The direction of ordering (ASC or DESC). Defaults to 'ASC'.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading rules`,async()=>r.magicTransit.advancedTCPProtection.configs.tcp.flow.protection.rules.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded rules`})}},Le={command:`update <ruleId>`,describe:`Update a TCP Flow Protection rule specified by the given UUID.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`The UUID of the TCP Flow Protection rule to update.`,demandOption:!0}).option(`burst-sensitivity`,{type:`string`,description:`The new burst sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`mode`,{type:`string`,description:`The new mode for TCP Flow Protection. Optional. Must be one of 'enabled', 'disabled', 'monitoring'.`}).option(`rate-sensitivity`,{type:`string`,description:`The new rate sensitivity. Optional. Must be one of 'low', 'medium', 'high'.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updates to apply to the TCP Flow Protection rule.`}),handler:async t=>{if(o(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp flow protection rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{burstSensitivity:t.burstSensitivity,mode:t.mode,rateSensitivity:t.rateSensitivity,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${t.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}let m={};t.burstSensitivity!==void 0&&s(m,[`burst_sensitivity`],a(t.burstSensitivity,`burstSensitivity`,`text`)),t.mode!==void 0&&s(m,[`mode`],a(t.mode,`mode`,`text`)),t.rateSensitivity!==void 0&&s(m,[`rate_sensitivity`],a(t.rateSensitivity,`rateSensitivity`,`text`)),l(await f(`Updating rule`,async()=>r.patch(`/accounts/${p}/magic/advanced_tcp_protection/configs/tcp_flow_protection/rules/${t.ruleId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated rule`})}},Re={command:`rules`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(ke).command(Fe).command(Ie).command(Le).command(Pe).demandCommand(1),handler:()=>{}},ze={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow.protection`,builder:e=>e.command(Oe).command(Re).demandCommand(1),handler:()=>{}},Be={command:`flow`,describe:`Operations for advanced-tcp-protection.configs.tcp.flow`,builder:e=>e.command(ze).demandCommand(1),handler:()=>{}},Ve={command:`get`,describe:`Get the protection status of the account.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading status`,async()=>t.magicTransit.advancedTCPProtection.configs.tcp.protection.status.get(r)),{successLabel:`Loaded status`})}},He={command:`update`,describe:`Update the protection status of the account.`,builder:e=>e.option(`enabled`,{type:`boolean`,description:`Enables or disables protection.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The update to apply to the protection status.`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit advanced-tcp-protection configs tcp protection status update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/advanced_tcp_protection/configs/tcp_protection_status`,pathParams:{},bodyKind:`json`,body:{enabled:t.enabled,body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Updating status`,async()=>r.patch(`/accounts/${a}/magic/advanced_tcp_protection/configs/tcp_protection_status`,{body:e})),{successLabel:`Updated status`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let p={};t.enabled!==void 0&&s(p,[`enabled`],t.enabled),l(await f(`Updating status`,async()=>r.patch(`/accounts/${a}/magic/advanced_tcp_protection/configs/tcp_protection_status`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated status`})}},Ue={command:`status`,describe:`Advanced Tcp Protection operations`,builder:e=>e.command(Ve).command(He).demandCommand(1),handler:()=>{}},We={command:`protection`,describe:`Operations for advanced-tcp-protection.configs.tcp.protection`,builder:e=>e.command(Ue).demandCommand(1),handler:()=>{}},Ge={command:`tcp`,describe:`Operations for advanced-tcp-protection.configs.tcp`,builder:e=>e.command(Be).command(We).demandCommand(1),handler:()=>{}},Ke={command:`configs`,describe:`Operations for advanced-tcp-protection.configs`,builder:e=>e.command(I).command(q).command(ve).command(Ge).demandCommand(1),handler:()=>{}},qe={command:`advanced-tcp-protection`,describe:`Operations for advanced-tcp-protection`,builder:e=>e.command(Ke).demandCommand(1),handler:()=>{}},Je={command:`create`,describe:`Creates a new App for an account`,builder:e=>e.option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/apps`,pathParams:{},bodyKind:`json`,body:{hostnames:r.hostnames,name:r.name,type:r.type,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating app`,async()=>p.post(`/accounts/${m}/magic/apps`,{body:e})),{successLabel:`Created app`});return}r.name===void 0&&(r.name=await t(`name`,`Display name for the app.`)),r.type===void 0&&(r.type=await t(`type`,`Category of the app.`));let h={};r.hostnames!==void 0&&s(h,[`hostnames`],r.hostnames),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.type!==void 0&&s(h,[`type`],a(r.type,`type`,`text`)),l(await f(`Creating app`,async()=>p.post(`/accounts/${m}/magic/apps`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created app`})}},Ye={command:`delete <accountAppId>`,describe:`Deletes specific Account App.`,builder:e=>e.positional(`accountAppId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.accountAppId,`accountAppId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/apps/${t.accountAppId??`<accountAppId>`}`,pathParams:{accountAppId:String(t.accountAppId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`app`,String(t.accountAppId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting app`,async()=>a.magicTransit.apps.delete(s,t.accountAppId)),{successLabel:`Deleted app`})}},Xe={command:`edit <accountAppId>`,describe:`Updates an Account App`,builder:e=>e.positional(`accountAppId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.accountAppId,`accountAppId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit apps edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/apps/${t.accountAppId??`<accountAppId>`}`,pathParams:{accountAppId:String(t.accountAppId??``)},bodyKind:`json`,body:{hostnames:t.hostnames,name:t.name,type:t.type,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating app`,async()=>r.patch(`/accounts/${p}/magic/apps/${t.accountAppId}`,{body:e})),{successLabel:`Updated app`});return}let m={};t.hostnames!==void 0&&s(m,[`hostnames`],t.hostnames),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.type!==void 0&&s(m,[`type`],a(t.type,`type`,`text`)),l(await f(`Updating app`,async()=>r.patch(`/accounts/${p}/magic/apps/${t.accountAppId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated app`})}},Ze={command:`list`,describe:`Lists Apps associated with an account.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading apps`,async()=>t.magicTransit.apps.list(r)),{successLabel:`Loaded apps`})}},Qe={command:`update <accountAppId>`,describe:`Updates an Account App`,builder:e=>e.positional(`accountAppId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`hostnames`,{type:`string`,array:!0,description:`FQDNs to associate with traffic decisions.`}).option(`name`,{type:`string`,description:`Display name for the app.`}).option(`type`,{type:`string`,description:`Category of the app.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.accountAppId,`accountAppId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/apps/${t.accountAppId??`<accountAppId>`}`,pathParams:{accountAppId:String(t.accountAppId??``)},bodyKind:`json`,body:{hostnames:t.hostnames,name:t.name,type:t.type,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating app`,async()=>r.put(`/accounts/${p}/magic/apps/${t.accountAppId}`,{body:e})),{successLabel:`Updated app`});return}let m={};t.hostnames!==void 0&&s(m,[`hostnames`],t.hostnames),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.type!==void 0&&s(m,[`type`],a(t.type,`type`,`text`)),l(await f(`Updating app`,async()=>r.put(`/accounts/${p}/magic/apps/${t.accountAppId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated app`})}},$e={command:`apps`,describe:`Application-aware traffic policies for Magic WAN that steer traffic by app type`,builder:e=>e.command(Je).command(Ye).command(Xe).command(Ze).command(Qe).demandCommand(1),handler:()=>{}},et={command:`bulk-update`,describe:"Updates multiple interconnects associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{let r={};if(t.xMagicNewHcTarget!==void 0&&(r[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit cf-interconnects bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/cf_interconnects`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,t.body){let e=c(t.body);l(await f(`Updating cf interconnects`,async()=>a.put(`/accounts/${s}/magic/cf_interconnects`,{body:e,headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated cf interconnects`});return}l(await f(`Updating cf interconnects`,async()=>a.put(`/accounts/${s}/magic/cf_interconnects`,{headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated cf interconnects`})}},tt={command:`get <cfInterconnectId>`,describe:`Lists details for a specific interconnect.`,builder:e=>e.positional(`cfInterconnectId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{o(e.cfInterconnectId,`cfInterconnectId`);let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading cf interconnect`,async()=>r.get(`/accounts/${a}/magic/cf_interconnects/${e.cfInterconnectId}`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded cf interconnect`})}},nt={command:`list`,describe:`Lists interconnects associated with an account.`,builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading cf interconnects`,async()=>r.get(`/accounts/${a}/magic/cf_interconnects`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded cf interconnects`})}},rt={command:`update <cfInterconnectId>`,describe:"Updates a specific interconnect associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.positional(`cfInterconnectId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:`True if automatic stateful return routing should be enabled for a tunnel, false otherwise.`,default:!1}).option(`description`,{type:`string`,description:`An optional description of the interconnect.`}).option(`gre-cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel created as part of the Interconnect.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`The Maximum Transmission Unit (MTU) in bytes for the interconnect. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the interconnect. The name cannot share a name with other tunnels.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{o(t.cfInterconnectId,`cfInterconnectId`);let r={};if(t.xMagicNewHcTarget!==void 0&&(r[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit cf-interconnects update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/cf_interconnects/${t.cfInterconnectId??`<cfInterconnectId>`}`,pathParams:{cfInterconnectId:String(t.cfInterconnectId??``)},bodyKind:`json`,body:{automaticReturnRouting:t.automaticReturnRouting,description:t.description,greCloudflareEndpoint:t.greCloudflareEndpoint,healthCheckEnabled:t.healthCheckEnabled,healthCheckRate:t.healthCheckRate,healthCheckTargetSaved:t.healthCheckTargetSaved,healthCheckType:t.healthCheckType,interfaceAddress:t.interfaceAddress,interfaceAddress6:t.interfaceAddress6,mtu:t.mtu,name:t.name,body:t.body},validation:`passed`});return}let p=await i(t),m=t.local?d:await n(p);if(t.accountId=m,t.body){let e=c(t.body);l(await f(`Updating cf interconnect`,async()=>p.put(`/accounts/${m}/magic/cf_interconnects/${t.cfInterconnectId}`,{body:e,headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated cf interconnect`});return}let h={};t.automaticReturnRouting!==void 0&&s(h,[`automatic_return_routing`],t.automaticReturnRouting),t.description!==void 0&&s(h,[`description`],a(t.description,`description`,`text`)),t.greCloudflareEndpoint!==void 0&&s(h,[`gre`,`cloudflare_endpoint`],a(t.greCloudflareEndpoint,`greCloudflareEndpoint`,`text`)),t.healthCheckEnabled!==void 0&&s(h,[`health_check`,`enabled`],t.healthCheckEnabled),t.healthCheckRate!==void 0&&s(h,[`health_check`,`rate`],a(t.healthCheckRate,`healthCheckRate`,`text`)),t.healthCheckTargetSaved!==void 0&&s(h,[`health_check`,`target`,`saved`],a(t.healthCheckTargetSaved,`healthCheckTargetSaved`,`text`)),t.healthCheckType!==void 0&&s(h,[`health_check`,`type`],a(t.healthCheckType,`healthCheckType`,`text`)),t.interfaceAddress!==void 0&&s(h,[`interface_address`],a(t.interfaceAddress,`interfaceAddress`,`text`)),t.interfaceAddress6!==void 0&&s(h,[`interface_address6`],a(t.interfaceAddress6,`interfaceAddress6`,`text`)),t.mtu!==void 0&&s(h,[`mtu`],t.mtu),t.name!==void 0&&s(h,[`name`],a(t.name,`name`,`text`)),l(await f(`Updating cf interconnect`,async()=>p.put(`/accounts/${m}/magic/cf_interconnects/${t.cfInterconnectId}`,{body:Object.keys(h).length>0?h:void 0,headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated cf interconnect`})}},it={command:`cf-interconnects`,describe:`Cloudflare Network Interconnect (CNI) links for direct physical or virtual peering`,builder:e=>e.command(et).command(tt).command(nt).command(rt).demandCommand(1),handler:()=>{}},at={command:`create`,describe:`Creates a new Magic WAN Connector for establishing secure network connectivity. Connectors enable site-to-site VPN and SDWAN functionality.`,builder:e=>e.option(`device-id`,{type:`string`,description:`The device.id field`}).option(`device-provision-license`,{type:`boolean`,description:`When true, create and provision a new licence key for the connector.`}).option(`device-serial-number`,{type:`string`,description:`The device.serial_number field`}).option(`activated`,{type:`boolean`,description:`The activated field`}).option(`interrupt-window-days-of-week`,{type:`string`,array:!0,description:`Allowed days of the week for upgrades. Default is all days.`}).option(`interrupt-window-duration-hours`,{type:`number`,description:`The interrupt_window_duration_hours field`}).option(`interrupt-window-embargo-dates`,{type:`string`,array:!0,description:`List of dates (YYYY-MM-DD) when upgrades are blocked.`}).option(`interrupt-window-hour-of-day`,{type:`number`,description:`The interrupt_window_hour_of_day field`}).option(`notes`,{type:`string`,description:`The notes field`}).option(`timezone`,{type:`string`,description:`The timezone field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit connectors create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/connectors`,pathParams:{},bodyKind:`json`,body:{deviceId:t.deviceId,deviceProvisionLicense:t.deviceProvisionLicense,deviceSerialNumber:t.deviceSerialNumber,activated:t.activated,interruptWindowDaysOfWeek:t.interruptWindowDaysOfWeek,interruptWindowDurationHours:t.interruptWindowDurationHours,interruptWindowEmbargoDates:t.interruptWindowEmbargoDates,interruptWindowHourOfDay:t.interruptWindowHourOfDay,notes:t.notes,timezone:t.timezone,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Creating connector`,async()=>r.post(`/accounts/${p}/magic/connectors`,{body:e})),{successLabel:`Created connector`});return}let m={};t.deviceId!==void 0&&s(m,[`device`,`id`],a(t.deviceId,`deviceId`,`text`)),t.deviceProvisionLicense!==void 0&&s(m,[`device`,`provision_license`],t.deviceProvisionLicense),t.deviceSerialNumber!==void 0&&s(m,[`device`,`serial_number`],a(t.deviceSerialNumber,`deviceSerialNumber`,`text`)),t.activated!==void 0&&s(m,[`activated`],t.activated),t.interruptWindowDaysOfWeek!==void 0&&s(m,[`interrupt_window_days_of_week`],t.interruptWindowDaysOfWeek),t.interruptWindowDurationHours!==void 0&&s(m,[`interrupt_window_duration_hours`],t.interruptWindowDurationHours),t.interruptWindowEmbargoDates!==void 0&&s(m,[`interrupt_window_embargo_dates`],t.interruptWindowEmbargoDates),t.interruptWindowHourOfDay!==void 0&&s(m,[`interrupt_window_hour_of_day`],t.interruptWindowHourOfDay),t.notes!==void 0&&s(m,[`notes`],a(t.notes,`notes`,`text`)),t.timezone!==void 0&&s(m,[`timezone`],a(t.timezone,`timezone`,`text`)),l(await f(`Creating connector`,async()=>r.post(`/accounts/${p}/magic/connectors`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Created connector`})}},ot={command:`delete <connectorId>`,describe:`Removes a Magic WAN Connector. The connector will be deregistered and network connectivity through it will be terminated.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.connectorId,`connectorId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit connectors delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/connectors/${t.connectorId??`<connectorId>`}`,pathParams:{connectorId:String(t.connectorId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`connector`,String(t.connectorId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting connector`,async()=>a.magicTransit.connectors.delete(s,t.connectorId)),{successLabel:`Deleted connector`})}},st={command:`edit <connectorId>`,describe:`Updates the configuration of an existing Magic WAN Connector, such as network settings or policies.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`activated`,{type:`boolean`,description:`The activated field`}).option(`interrupt-window-days-of-week`,{type:`string`,array:!0,description:`Allowed days of the week for upgrades. Default is all days.`}).option(`interrupt-window-duration-hours`,{type:`number`,description:`The interrupt_window_duration_hours field`}).option(`interrupt-window-embargo-dates`,{type:`string`,array:!0,description:`List of dates (YYYY-MM-DD) when upgrades are blocked.`}).option(`interrupt-window-hour-of-day`,{type:`number`,description:`The interrupt_window_hour_of_day field`}).option(`notes`,{type:`string`,description:`The notes field`}).option(`timezone`,{type:`string`,description:`The timezone field`}).option(`provision-license`,{type:`boolean`,description:`When true, regenerate license key for the connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.connectorId,`connectorId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit connectors edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/connectors/${t.connectorId??`<connectorId>`}`,pathParams:{connectorId:String(t.connectorId??``)},bodyKind:`json`,body:{activated:t.activated,interruptWindowDaysOfWeek:t.interruptWindowDaysOfWeek,interruptWindowDurationHours:t.interruptWindowDurationHours,interruptWindowEmbargoDates:t.interruptWindowEmbargoDates,interruptWindowHourOfDay:t.interruptWindowHourOfDay,notes:t.notes,timezone:t.timezone,provisionLicense:t.provisionLicense,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating connector`,async()=>r.patch(`/accounts/${p}/magic/connectors/${t.connectorId}`,{body:e})),{successLabel:`Updated connector`});return}let m={};t.activated!==void 0&&s(m,[`activated`],t.activated),t.interruptWindowDaysOfWeek!==void 0&&s(m,[`interrupt_window_days_of_week`],t.interruptWindowDaysOfWeek),t.interruptWindowDurationHours!==void 0&&s(m,[`interrupt_window_duration_hours`],t.interruptWindowDurationHours),t.interruptWindowEmbargoDates!==void 0&&s(m,[`interrupt_window_embargo_dates`],t.interruptWindowEmbargoDates),t.interruptWindowHourOfDay!==void 0&&s(m,[`interrupt_window_hour_of_day`],t.interruptWindowHourOfDay),t.notes!==void 0&&s(m,[`notes`],a(t.notes,`notes`,`text`)),t.timezone!==void 0&&s(m,[`timezone`],a(t.timezone,`timezone`,`text`)),t.provisionLicense!==void 0&&s(m,[`provision_license`],t.provisionLicense),l(await f(`Updating connector`,async()=>r.patch(`/accounts/${p}/magic/connectors/${t.connectorId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated connector`})}},ct={command:`get <eventN>`,describe:`Retrieves a specific telemetry event from a Magic WAN Connector for troubleshooting and monitoring.`,builder:e=>e.positional(`eventN`,{type:`string`,description:`Event n`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`event-t`,{type:`string`,description:`Event t`,demandOption:!0}),handler:async e=>{o(e.eventN,`eventN`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading event`,async()=>t.magicTransit.connectors.events.get(r,e.connectorId,e.eventT,e.eventN)),{successLabel:`Loaded event`})}},lt={command:`list`,describe:`Retrieves the most recent telemetry events from a Magic WAN Connector.`,builder:e=>e.option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading latest`,async()=>t.magicTransit.connectors.events.latest.list(r,e.connectorId)),{successLabel:`Loaded latest`})}},ut={command:`latest`,describe:`Magic WAN Connector appliances — provisioning, telemetry events, and configuration snapshots`,builder:e=>e.command(lt).demandCommand(1),handler:()=>{}},dt={command:`list`,describe:`Lists telemetry events from a Magic WAN Connector, showing connection events and status changes.`,builder:e=>e.option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`from`,{type:`number`,description:`From`,demandOption:!0}).option(`to`,{type:`number`,description:`To`,demandOption:!0}).option(`limit`,{type:`number`,description:`Limit`}).option(`cursor`,{type:`string`,description:`Cursor`}).option(`k`,{type:`string`,description:`Filter by event kind`}),handler:async e=>{let t={};e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.limit!==void 0&&(t.limit=e.limit),e.cursor!==void 0&&(t.cursor=e.cursor),e.k!==void 0&&(t.k=e.k);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading events`,async()=>r.magicTransit.connectors.events.list(a,e.connectorId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded events`})}},ft={command:`events`,describe:`Magic WAN Connector appliances — provisioning, telemetry events, and configuration snapshots`,builder:e=>e.command(ct).command(dt).command(ut).demandCommand(1),handler:()=>{}},pt={command:`get <connectorId>`,describe:`Retrieves detailed configuration for a specific Magic WAN Connector, including its status and network settings.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`Connector ID`,demandOption:!0}),handler:async e=>{o(e.connectorId,`connectorId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading connector`,async()=>t.magicTransit.connectors.get(r,e.connectorId)),{successLabel:`Loaded connector`})}},mt={command:`list`,describe:`Lists all Magic WAN Connectors configured for the account with their status and connection information.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading connectors`,async()=>t.magicTransit.connectors.list(r)),{successLabel:`Loaded connectors`})}},ht={command:`get <snapshotT>`,describe:`Gets a specific telemetry snapshot from a Magic WAN Connector, showing point-in-time metrics.`,builder:e=>e.positional(`snapshotT`,{type:`string`,description:`Snapshot t`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}),handler:async e=>{o(e.snapshotT,`snapshotT`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading snapshot`,async()=>t.magicTransit.connectors.snapshots.get(r,e.connectorId,e.snapshotT)),{successLabel:`Loaded snapshot`})}},gt={command:`list`,describe:`Retrieves the most recent telemetry snapshots from a Magic WAN Connector.`,builder:e=>e.option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading latest`,async()=>t.magicTransit.connectors.snapshots.latest.list(r,e.connectorId)),{successLabel:`Loaded latest`})}},_t={command:`latest`,describe:`Magic WAN Connector appliances — provisioning, telemetry events, and configuration snapshots`,builder:e=>e.command(gt).demandCommand(1),handler:()=>{}},vt={command:`list`,describe:`Lists telemetry snapshots from a Magic WAN Connector, providing historical performance data.`,builder:e=>e.option(`connector-id`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`from`,{type:`number`,description:`From`,demandOption:!0}).option(`to`,{type:`number`,description:`To`,demandOption:!0}).option(`limit`,{type:`number`,description:`Limit`}).option(`cursor`,{type:`string`,description:`Cursor`}),handler:async e=>{let t={};e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.limit!==void 0&&(t.limit=e.limit),e.cursor!==void 0&&(t.cursor=e.cursor);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading snapshots`,async()=>r.magicTransit.connectors.snapshots.list(a,e.connectorId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded snapshots`})}},yt={command:`snapshots`,describe:`Magic WAN Connector appliances — provisioning, telemetry events, and configuration snapshots`,builder:e=>e.command(ht).command(vt).command(_t).demandCommand(1),handler:()=>{}},bt={command:`update <connectorId>`,describe:`Replaces the configuration of an existing Magic WAN Connector with new settings.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`Connector ID`,demandOption:!0}).option(`activated`,{type:`boolean`,description:`The activated field`}).option(`interrupt-window-days-of-week`,{type:`string`,array:!0,description:`Allowed days of the week for upgrades. Default is all days.`}).option(`interrupt-window-duration-hours`,{type:`number`,description:`The interrupt_window_duration_hours field`}).option(`interrupt-window-embargo-dates`,{type:`string`,array:!0,description:`List of dates (YYYY-MM-DD) when upgrades are blocked.`}).option(`interrupt-window-hour-of-day`,{type:`number`,description:`The interrupt_window_hour_of_day field`}).option(`notes`,{type:`string`,description:`The notes field`}).option(`timezone`,{type:`string`,description:`The timezone field`}).option(`provision-license`,{type:`boolean`,description:`When true, regenerate license key for the connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.connectorId,`connectorId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit connectors update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/connectors/${t.connectorId??`<connectorId>`}`,pathParams:{connectorId:String(t.connectorId??``)},bodyKind:`json`,body:{activated:t.activated,interruptWindowDaysOfWeek:t.interruptWindowDaysOfWeek,interruptWindowDurationHours:t.interruptWindowDurationHours,interruptWindowEmbargoDates:t.interruptWindowEmbargoDates,interruptWindowHourOfDay:t.interruptWindowHourOfDay,notes:t.notes,timezone:t.timezone,provisionLicense:t.provisionLicense,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating connector`,async()=>r.put(`/accounts/${p}/magic/connectors/${t.connectorId}`,{body:e})),{successLabel:`Updated connector`});return}let m={};t.activated!==void 0&&s(m,[`activated`],t.activated),t.interruptWindowDaysOfWeek!==void 0&&s(m,[`interrupt_window_days_of_week`],t.interruptWindowDaysOfWeek),t.interruptWindowDurationHours!==void 0&&s(m,[`interrupt_window_duration_hours`],t.interruptWindowDurationHours),t.interruptWindowEmbargoDates!==void 0&&s(m,[`interrupt_window_embargo_dates`],t.interruptWindowEmbargoDates),t.interruptWindowHourOfDay!==void 0&&s(m,[`interrupt_window_hour_of_day`],t.interruptWindowHourOfDay),t.notes!==void 0&&s(m,[`notes`],a(t.notes,`notes`,`text`)),t.timezone!==void 0&&s(m,[`timezone`],a(t.timezone,`timezone`,`text`)),t.provisionLicense!==void 0&&s(m,[`provision_license`],t.provisionLicense),l(await f(`Updating connector`,async()=>r.put(`/accounts/${p}/magic/connectors/${t.connectorId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated connector`})}},xt={command:`connectors`,describe:`Magic WAN Connector appliances — provisioning, telemetry events, and configuration snapshots`,builder:e=>e.command(at).command(ot).command(st).command(pt).command(mt).command(bt).command(ft).command(yt).demandCommand(1),handler:()=>{}},St={command:`bulk-update`,describe:"Updates multiple GRE tunnels. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{let r={};if(t.xMagicNewHcTarget!==void 0&&(r[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit gre-tunnels bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,t.body){let e=c(t.body);l(await f(`Updating gre tunnels`,async()=>a.put(`/accounts/${s}/magic/gre_tunnels`,{body:e,headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated gre tunnels`});return}l(await f(`Updating gre tunnels`,async()=>a.put(`/accounts/${s}/magic/gre_tunnels`,{headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated gre tunnels`})}},Ct={command:`create`,describe:"Creates a new GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:`True if automatic stateful return routing should be enabled for a tunnel, false otherwise.`,default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-md5-key`,{type:`string`,description:"MD5 key to use for session authentication.  Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is *only* supported for preventing misconfiguration, not for defending against malicious attacks.  The MD5 key, if set, must be of non-zero length and consist only of the following types of character:  * ASCII alphanumerics: `[a-zA-Z0-9]` * Special characters in the set `'!@#$%^&*()+[]{}<>/.,;:_-~`= \\|`  In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark (`\"`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (`?`). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected."}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`,default:64}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-extra-prefixes`,`bgp-md5key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0}),handler:async r=>{let p={};if(r.xMagicNewHcTarget!==void 0&&(p[`x-magic-new-hc-target`]=String(r.xMagicNewHcTarget)),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit gre-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/gre_tunnels`,pathParams:{},bodyKind:`json`,body:{automaticReturnRouting:r.automaticReturnRouting,bgpCustomerAsn:r.bgpCustomerAsn,bgpExtraPrefixes:r.bgpExtraPrefixes,bgpMd5Key:r.bgpMd5Key,cloudflareGreEndpoint:r.cloudflareGreEndpoint,customerGreEndpoint:r.customerGreEndpoint,description:r.description,healthCheckEnabled:r.healthCheckEnabled,healthCheckRate:r.healthCheckRate,healthCheckTargetSaved:r.healthCheckTargetSaved,healthCheckType:r.healthCheckType,healthCheckDirection:r.healthCheckDirection,interfaceAddress:r.interfaceAddress,interfaceAddress6:r.interfaceAddress6,mtu:r.mtu,name:r.name,ttl:r.ttl,body:r.body},validation:`passed`});return}let m=await i(r),h=r.local?d:await n(m);if(r.accountId=h,r.body){let e=c(r.body);l(await f(`Creating gre tunnel`,async()=>m.post(`/accounts/${h}/magic/gre_tunnels`,{body:e,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Created gre tunnel`});return}r.cloudflareGreEndpoint===void 0&&(r.cloudflareGreEndpoint=await t(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),r.customerGreEndpoint===void 0&&(r.customerGreEndpoint=await t(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),r.interfaceAddress===void 0&&(r.interfaceAddress=await t(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let g={};r.automaticReturnRouting!==void 0&&s(g,[`automatic_return_routing`],r.automaticReturnRouting),r.bgpCustomerAsn!==void 0&&s(g,[`bgp`,`customer_asn`],r.bgpCustomerAsn),r.bgpExtraPrefixes!==void 0&&s(g,[`bgp`,`extra_prefixes`],r.bgpExtraPrefixes),r.bgpMd5Key!==void 0&&s(g,[`bgp`,`md5_key`],a(r.bgpMd5Key,`bgpMd5Key`,`text`)),r.cloudflareGreEndpoint!==void 0&&s(g,[`cloudflare_gre_endpoint`],a(r.cloudflareGreEndpoint,`cloudflareGreEndpoint`,`text`)),r.customerGreEndpoint!==void 0&&s(g,[`customer_gre_endpoint`],a(r.customerGreEndpoint,`customerGreEndpoint`,`text`)),r.description!==void 0&&s(g,[`description`],a(r.description,`description`,`text`)),r.healthCheckEnabled!==void 0&&s(g,[`health_check`,`enabled`],r.healthCheckEnabled),r.healthCheckRate!==void 0&&s(g,[`health_check`,`rate`],a(r.healthCheckRate,`healthCheckRate`,`text`)),r.healthCheckTargetSaved!==void 0&&s(g,[`health_check`,`target`,`saved`],a(r.healthCheckTargetSaved,`healthCheckTargetSaved`,`text`)),r.healthCheckType!==void 0&&s(g,[`health_check`,`type`],a(r.healthCheckType,`healthCheckType`,`text`)),r.healthCheckDirection!==void 0&&s(g,[`health_check`,`direction`],a(r.healthCheckDirection,`healthCheckDirection`,`text`)),r.interfaceAddress!==void 0&&s(g,[`interface_address`],a(r.interfaceAddress,`interfaceAddress`,`text`)),r.interfaceAddress6!==void 0&&s(g,[`interface_address6`],a(r.interfaceAddress6,`interfaceAddress6`,`text`)),r.mtu!==void 0&&s(g,[`mtu`],r.mtu),r.name!==void 0&&s(g,[`name`],a(r.name,`name`,`text`)),r.ttl!==void 0&&s(g,[`ttl`],r.ttl),l(await f(`Creating gre tunnel`,async()=>m.post(`/accounts/${h}/magic/gre_tunnels`,{body:Object.keys(g).length>0?g:void 0,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Created gre tunnel`})}},wt={command:`delete <greTunnelId>`,describe:"Disables and removes a specific static GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.positional(`greTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{o(t.greTunnelId,`greTunnelId`);let a={};if(t.xMagicNewHcTarget!==void 0&&(a[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit gre-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/gre_tunnels/${t.greTunnelId??`<greTunnelId>`}`,pathParams:{greTunnelId:String(t.greTunnelId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let s=await i(t),p=t.local?d:await n(s);if(t.accountId=p,!await r(`gre tunnel`,String(t.greTunnelId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting gre tunnel`,async()=>s.delete(`/accounts/${p}/magic/gre_tunnels/${t.greTunnelId}`,{body:e,headers:Object.keys(a).length>0?a:void 0})),{successLabel:`Deleted gre tunnel`});return}l(await f(`Deleting gre tunnel`,async()=>s.delete(`/accounts/${p}/magic/gre_tunnels/${t.greTunnelId}`,{headers:Object.keys(a).length>0?a:void 0})),{successLabel:`Deleted gre tunnel`})}},Tt={command:`get <greTunnelId>`,describe:`Lists informtion for a specific GRE tunnel.`,builder:e=>e.positional(`greTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{o(e.greTunnelId,`greTunnelId`);let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading gre tunnel`,async()=>r.get(`/accounts/${a}/magic/gre_tunnels/${e.greTunnelId}`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded gre tunnel`})}},Et={command:`list`,describe:`Lists GRE tunnels associated with an account.`,builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading gre tunnels`,async()=>r.get(`/accounts/${a}/magic/gre_tunnels`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded gre tunnels`})}},Dt={command:`update <greTunnelId>`,describe:"Updates a specific GRE tunnel. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.positional(`greTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:`True if automatic stateful return routing should be enabled for a tunnel, false otherwise.`,default:!1}).option(`cloudflare-gre-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the GRE tunnel.`}).option(`customer-gre-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the GRE tunnel.`}).option(`description`,{type:`string`,description:`An optional description of the GRE tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`mtu`,{type:`number`,description:`Maximum Transmission Unit (MTU) in bytes for the GRE tunnel. The minimum value is 576.`,default:1476}).option(`name`,{type:`string`,description:`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`}).option(`ttl`,{type:`number`,description:`Time To Live (TTL) in number of hops of the GRE tunnel.`,default:64}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{o(r.greTunnelId,`greTunnelId`);let p={};if(r.xMagicNewHcTarget!==void 0&&(p[`x-magic-new-hc-target`]=String(r.xMagicNewHcTarget)),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit gre-tunnels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/gre_tunnels/${r.greTunnelId??`<greTunnelId>`}`,pathParams:{greTunnelId:String(r.greTunnelId??``)},bodyKind:`json`,body:{automaticReturnRouting:r.automaticReturnRouting,cloudflareGreEndpoint:r.cloudflareGreEndpoint,customerGreEndpoint:r.customerGreEndpoint,description:r.description,healthCheckEnabled:r.healthCheckEnabled,healthCheckRate:r.healthCheckRate,healthCheckTargetSaved:r.healthCheckTargetSaved,healthCheckType:r.healthCheckType,healthCheckDirection:r.healthCheckDirection,interfaceAddress:r.interfaceAddress,interfaceAddress6:r.interfaceAddress6,mtu:r.mtu,name:r.name,ttl:r.ttl,body:r.body},validation:`passed`});return}let m=await i(r),h=r.local?d:await n(m);if(r.accountId=h,r.body){let e=c(r.body);l(await f(`Updating gre tunnel`,async()=>m.put(`/accounts/${h}/magic/gre_tunnels/${r.greTunnelId}`,{body:e,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated gre tunnel`});return}r.cloudflareGreEndpoint===void 0&&(r.cloudflareGreEndpoint=await t(`cloudflare-gre-endpoint`,`The IP address assigned to the Cloudflare side of the GRE tunnel.`)),r.customerGreEndpoint===void 0&&(r.customerGreEndpoint=await t(`customer-gre-endpoint`,`The IP address assigned to the customer side of the GRE tunnel.`)),r.interfaceAddress===void 0&&(r.interfaceAddress=await t(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the tunnel. The name cannot contain spaces or special characters, must be 15 characters or less, and cannot share a name with another GRE tunnel.`));let g={};r.automaticReturnRouting!==void 0&&s(g,[`automatic_return_routing`],r.automaticReturnRouting),r.cloudflareGreEndpoint!==void 0&&s(g,[`cloudflare_gre_endpoint`],a(r.cloudflareGreEndpoint,`cloudflareGreEndpoint`,`text`)),r.customerGreEndpoint!==void 0&&s(g,[`customer_gre_endpoint`],a(r.customerGreEndpoint,`customerGreEndpoint`,`text`)),r.description!==void 0&&s(g,[`description`],a(r.description,`description`,`text`)),r.healthCheckEnabled!==void 0&&s(g,[`health_check`,`enabled`],r.healthCheckEnabled),r.healthCheckRate!==void 0&&s(g,[`health_check`,`rate`],a(r.healthCheckRate,`healthCheckRate`,`text`)),r.healthCheckTargetSaved!==void 0&&s(g,[`health_check`,`target`,`saved`],a(r.healthCheckTargetSaved,`healthCheckTargetSaved`,`text`)),r.healthCheckType!==void 0&&s(g,[`health_check`,`type`],a(r.healthCheckType,`healthCheckType`,`text`)),r.healthCheckDirection!==void 0&&s(g,[`health_check`,`direction`],a(r.healthCheckDirection,`healthCheckDirection`,`text`)),r.interfaceAddress!==void 0&&s(g,[`interface_address`],a(r.interfaceAddress,`interfaceAddress`,`text`)),r.interfaceAddress6!==void 0&&s(g,[`interface_address6`],a(r.interfaceAddress6,`interfaceAddress6`,`text`)),r.mtu!==void 0&&s(g,[`mtu`],r.mtu),r.name!==void 0&&s(g,[`name`],a(r.name,`name`,`text`)),r.ttl!==void 0&&s(g,[`ttl`],r.ttl),l(await f(`Updating gre tunnel`,async()=>m.put(`/accounts/${h}/magic/gre_tunnels/${r.greTunnelId}`,{body:Object.keys(g).length>0?g:void 0,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated gre tunnel`})}},Ot={command:`gre-tunnels`,describe:`GRE tunnel endpoints that connect your network to Cloudflare for Magic Transit`,builder:e=>e.command(St).command(Ct).command(wt).command(Tt).command(Et).command(Dt).demandCommand(1),handler:()=>{}},kt={command:`bulk-update`,describe:"Update multiple IPsec tunnels associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{let r={};if(t.xMagicNewHcTarget!==void 0&&(r[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit ipsec-tunnels bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,t.body){let e=c(t.body);l(await f(`Updating ipsec tunnels`,async()=>a.put(`/accounts/${s}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated ipsec tunnels`});return}l(await f(`Updating ipsec tunnels`,async()=>a.put(`/accounts/${s}/magic/ipsec_tunnels`,{headers:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated ipsec tunnels`})}},At={command:`create`,describe:"Creates a new IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:`True if automatic stateful return routing should be enabled for a tunnel, false otherwise.`,default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-md5-key`,{type:`string`,description:"MD5 key to use for session authentication.  Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is *only* supported for preventing misconfiguration, not for defending against malicious attacks.  The MD5 key, if set, must be of non-zero length and consist only of the following types of character:  * ASCII alphanumerics: `[a-zA-Z0-9]` * Special characters in the set `'!@#$%^&*()+[]{}<>/.,;:_-~`= \\|`  In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark (`\"`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (`?`). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected."}).option(`cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the IPsec tunnel.`}).option(`custom-remote-identities-fqdn-id`,{type:`string`,description:"A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The generated IKE IDs can still be used even if this custom value is specified.  Must be of the form `<custom label>.<account ID>.custom.ipsec.cloudflare.com`.  This custom ID does not need to be unique. Two IPsec tunnels may have the same custom fqdn_id. However, if another IPsec tunnel has the same value then the two tunnels cannot have the same cloudflare_endpoint."}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction.",default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-extra-prefixes`,`bgp-md5key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0}),handler:async r=>{let p={};if(r.xMagicNewHcTarget!==void 0&&(p[`x-magic-new-hc-target`]=String(r.xMagicNewHcTarget)),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit ipsec-tunnels create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/ipsec_tunnels`,pathParams:{},bodyKind:`json`,body:{automaticReturnRouting:r.automaticReturnRouting,bgpCustomerAsn:r.bgpCustomerAsn,bgpExtraPrefixes:r.bgpExtraPrefixes,bgpMd5Key:r.bgpMd5Key,cloudflareEndpoint:r.cloudflareEndpoint,customRemoteIdentitiesFqdnId:r.customRemoteIdentitiesFqdnId,customerEndpoint:r.customerEndpoint,description:r.description,healthCheckEnabled:r.healthCheckEnabled,healthCheckRate:r.healthCheckRate,healthCheckTargetSaved:r.healthCheckTargetSaved,healthCheckType:r.healthCheckType,healthCheckDirection:r.healthCheckDirection,interfaceAddress:r.interfaceAddress,interfaceAddress6:r.interfaceAddress6,name:r.name,psk:r.psk,replayProtection:r.replayProtection,body:r.body},validation:`passed`});return}let m=await i(r),h=r.local?d:await n(m);if(r.accountId=h,r.body){let e=c(r.body);l(await f(`Creating ipsec tunnel`,async()=>m.post(`/accounts/${h}/magic/ipsec_tunnels`,{body:e,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Created ipsec tunnel`});return}r.cloudflareEndpoint===void 0&&(r.cloudflareEndpoint=await t(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),r.interfaceAddress===void 0&&(r.interfaceAddress=await t(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let g={};r.automaticReturnRouting!==void 0&&s(g,[`automatic_return_routing`],r.automaticReturnRouting),r.bgpCustomerAsn!==void 0&&s(g,[`bgp`,`customer_asn`],r.bgpCustomerAsn),r.bgpExtraPrefixes!==void 0&&s(g,[`bgp`,`extra_prefixes`],r.bgpExtraPrefixes),r.bgpMd5Key!==void 0&&s(g,[`bgp`,`md5_key`],a(r.bgpMd5Key,`bgpMd5Key`,`text`)),r.cloudflareEndpoint!==void 0&&s(g,[`cloudflare_endpoint`],a(r.cloudflareEndpoint,`cloudflareEndpoint`,`text`)),r.customRemoteIdentitiesFqdnId!==void 0&&s(g,[`custom_remote_identities`,`fqdn_id`],a(r.customRemoteIdentitiesFqdnId,`customRemoteIdentitiesFqdnId`,`text`)),r.customerEndpoint!==void 0&&s(g,[`customer_endpoint`],a(r.customerEndpoint,`customerEndpoint`,`text`)),r.description!==void 0&&s(g,[`description`],a(r.description,`description`,`text`)),r.healthCheckEnabled!==void 0&&s(g,[`health_check`,`enabled`],r.healthCheckEnabled),r.healthCheckRate!==void 0&&s(g,[`health_check`,`rate`],a(r.healthCheckRate,`healthCheckRate`,`text`)),r.healthCheckTargetSaved!==void 0&&s(g,[`health_check`,`target`,`saved`],a(r.healthCheckTargetSaved,`healthCheckTargetSaved`,`text`)),r.healthCheckType!==void 0&&s(g,[`health_check`,`type`],a(r.healthCheckType,`healthCheckType`,`text`)),r.healthCheckDirection!==void 0&&s(g,[`health_check`,`direction`],a(r.healthCheckDirection,`healthCheckDirection`,`text`)),r.interfaceAddress!==void 0&&s(g,[`interface_address`],a(r.interfaceAddress,`interfaceAddress`,`text`)),r.interfaceAddress6!==void 0&&s(g,[`interface_address6`],a(r.interfaceAddress6,`interfaceAddress6`,`text`)),r.name!==void 0&&s(g,[`name`],a(r.name,`name`,`text`)),r.psk!==void 0&&s(g,[`psk`],a(r.psk,`psk`,`text`)),r.replayProtection!==void 0&&s(g,[`replay_protection`],r.replayProtection),l(await f(`Creating ipsec tunnel`,async()=>m.post(`/accounts/${h}/magic/ipsec_tunnels`,{body:Object.keys(g).length>0?g:void 0,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Created ipsec tunnel`})}},jt={command:`delete <ipsecTunnelId>`,describe:"Disables and removes a specific static IPsec Tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.positional(`ipsecTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{o(t.ipsecTunnelId,`ipsecTunnelId`);let a={};if(t.xMagicNewHcTarget!==void 0&&(a[`x-magic-new-hc-target`]=String(t.xMagicNewHcTarget)),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit ipsec-tunnels delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/ipsec_tunnels/${t.ipsecTunnelId??`<ipsecTunnelId>`}`,pathParams:{ipsecTunnelId:String(t.ipsecTunnelId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let s=await i(t),p=t.local?d:await n(s);if(t.accountId=p,!await r(`ipsec tunnel`,String(t.ipsecTunnelId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting ipsec tunnel`,async()=>s.delete(`/accounts/${p}/magic/ipsec_tunnels/${t.ipsecTunnelId}`,{body:e,headers:Object.keys(a).length>0?a:void 0})),{successLabel:`Deleted ipsec tunnel`});return}l(await f(`Deleting ipsec tunnel`,async()=>s.delete(`/accounts/${p}/magic/ipsec_tunnels/${t.ipsecTunnelId}`,{headers:Object.keys(a).length>0?a:void 0})),{successLabel:`Deleted ipsec tunnel`})}},Mt={command:`get <ipsecTunnelId>`,describe:`Lists details for a specific IPsec tunnel.`,builder:e=>e.positional(`ipsecTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{o(e.ipsecTunnelId,`ipsecTunnelId`);let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading ipsec tunnel`,async()=>r.get(`/accounts/${a}/magic/ipsec_tunnels/${e.ipsecTunnelId}`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded ipsec tunnel`})}},Nt={command:`list`,describe:`Lists IPsec tunnels associated with an account.`,builder:e=>e.option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading ipsec tunnels`,async()=>r.get(`/accounts/${a}/magic/ipsec_tunnels`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded ipsec tunnels`})}},Pt={command:`psk-generate <ipsecTunnelId>`,describe:"Generates a Pre Shared Key for a specific IPsec tunnel used in the IKE session. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes. After a PSK is generated, the PSK is immediately persisted to Cloudflare's edge and cannot be retrieved later. Note the PSK in a safe place.",builder:e=>e.positional(`ipsecTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.ipsecTunnelId,`ipsecTunnelId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit ipsec-tunnels psk-generate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/ipsec_tunnels/${t.ipsecTunnelId??`<ipsecTunnelId>`}/psk_generate`,pathParams:{ipsecTunnelId:String(t.ipsecTunnelId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Creating ipsec tunnel`,async()=>r.post(`/accounts/${a}/magic/ipsec_tunnels/${t.ipsecTunnelId}/psk_generate`,{body:e})),{successLabel:`Created ipsec tunnel`});return}l(await f(`Creating ipsec tunnel`,async()=>r.magicTransit.ipsecTunnels.pskGenerate(t.ipsecTunnelId,a)),{successLabel:`Created ipsec tunnel`})}},Ft={command:`update <ipsecTunnelId>`,describe:"Updates a specific IPsec tunnel associated with an account. Use `?validate_only=true` as an optional query parameter to only run validation without persisting changes.",builder:e=>e.positional(`ipsecTunnelId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the request and response bodies will be presented using the new object format. Defaults to false.`}).option(`automatic-return-routing`,{type:`boolean`,description:`True if automatic stateful return routing should be enabled for a tunnel, false otherwise.`,default:!1}).option(`bgp-customer-asn`,{type:`number`,description:`ASN used on the customer end of the BGP session`}).option(`bgp-extra-prefixes`,{type:`string`,array:!0,description:`Prefixes in this list will be advertised to the customer device, in addition to the routes in the Magic routing table.`}).option(`bgp-md5-key`,{type:`string`,description:"MD5 key to use for session authentication.  Note that *this is not a security measure*. MD5 is not a valid security mechanism, and the key is not treated as a secret value. This is *only* supported for preventing misconfiguration, not for defending against malicious attacks.  The MD5 key, if set, must be of non-zero length and consist only of the following types of character:  * ASCII alphanumerics: `[a-zA-Z0-9]` * Special characters in the set `'!@#$%^&*()+[]{}<>/.,;:_-~`= \\|`  In other words, MD5 keys may contain any printable ASCII character aside from newline (0x0A), quotation mark (`\"`), vertical tab (0x0B), carriage return (0x0D), tab (0x09), form feed (0x0C), and the question mark (`?`). Requests specifying an MD5 key with one or more of these disallowed characters will be rejected."}).option(`cloudflare-endpoint`,{type:`string`,description:`The IP address assigned to the Cloudflare side of the IPsec tunnel.`}).option(`custom-remote-identities-fqdn-id`,{type:`string`,description:"A custom IKE ID of type FQDN that may be used to identity the IPsec tunnel. The generated IKE IDs can still be used even if this custom value is specified.  Must be of the form `<custom label>.<account ID>.custom.ipsec.cloudflare.com`.  This custom ID does not need to be unique. Two IPsec tunnels may have the same custom fqdn_id. However, if another IPsec tunnel has the same value then the two tunnels cannot have the same cloudflare_endpoint."}).option(`customer-endpoint`,{type:`string`,description:`The IP address assigned to the customer side of the IPsec tunnel. Not required, but must be set for proactive traceroutes to work.`}).option(`description`,{type:`string`,description:`An optional description forthe IPsec tunnel.`}).option(`health-check-enabled`,{type:`boolean`,description:`Determines whether to run healthchecks for a tunnel.`,default:!0}).option(`health-check-rate`,{type:`string`,description:"How frequent the health check is run. The default value is `mid`.",choices:[`low`,`mid`,`high`],default:`mid`}).option(`health-check-target-saved`,{type:`string`,description:`The saved health check target. Setting the value to the empty string indicates that the calculated default value will be used.`}).option(`health-check-type`,{type:`string`,description:"The type of healthcheck to run, reply or request. The default value is `reply`.",choices:[`reply`,`request`],default:`reply`}).option(`health-check-direction`,{type:`string`,description:`The direction of the flow of the healthcheck. Either unidirectional, where the probe comes to you via the tunnel and the result comes back to Cloudflare via the open Internet, or bidirectional where both the probe and result come and go via the tunnel.`,choices:[`unidirectional`,`bidirectional`],default:`unidirectional`}).option(`interface-address`,{type:`string`,description:`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`}).option(`interface-address6`,{type:`string`,description:`A 127 bit IPV6 prefix from within the virtual_subnet6 prefix space with the address being the first IP of the subnet and not same as the address of virtual_subnet6. Eg if virtual_subnet6 is 2606:54c1:7:0:a9fe:12d2::/127 , interface_address6 could be 2606:54c1:7:0:a9fe:12d2:1:200/127`}).option(`name`,{type:`string`,description:`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`}).option(`psk`,{type:`string`,description:`A randomly generated or provided string for use in the IPsec tunnel.`}).option(`replay-protection`,{type:`boolean`,description:"If `true`, then IPsec replay protection will be supported in the Cloudflare-to-customer direction.",default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`bgp-customer-asn`,`bgp-extra-prefixes`,`bgp-md5key`].some(t=>e[t]!==void 0)){let t=[`bgp-customer-asn`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --bgp-* flag is set`)}return!0}),handler:async r=>{o(r.ipsecTunnelId,`ipsecTunnelId`);let p={};if(r.xMagicNewHcTarget!==void 0&&(p[`x-magic-new-hc-target`]=String(r.xMagicNewHcTarget)),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit ipsec-tunnels update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/ipsec_tunnels/${r.ipsecTunnelId??`<ipsecTunnelId>`}`,pathParams:{ipsecTunnelId:String(r.ipsecTunnelId??``)},bodyKind:`json`,body:{automaticReturnRouting:r.automaticReturnRouting,bgpCustomerAsn:r.bgpCustomerAsn,bgpExtraPrefixes:r.bgpExtraPrefixes,bgpMd5Key:r.bgpMd5Key,cloudflareEndpoint:r.cloudflareEndpoint,customRemoteIdentitiesFqdnId:r.customRemoteIdentitiesFqdnId,customerEndpoint:r.customerEndpoint,description:r.description,healthCheckEnabled:r.healthCheckEnabled,healthCheckRate:r.healthCheckRate,healthCheckTargetSaved:r.healthCheckTargetSaved,healthCheckType:r.healthCheckType,healthCheckDirection:r.healthCheckDirection,interfaceAddress:r.interfaceAddress,interfaceAddress6:r.interfaceAddress6,name:r.name,psk:r.psk,replayProtection:r.replayProtection,body:r.body},validation:`passed`});return}let m=await i(r),h=r.local?d:await n(m);if(r.accountId=h,r.body){let e=c(r.body);l(await f(`Updating ipsec tunnel`,async()=>m.put(`/accounts/${h}/magic/ipsec_tunnels/${r.ipsecTunnelId}`,{body:e,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated ipsec tunnel`});return}r.cloudflareEndpoint===void 0&&(r.cloudflareEndpoint=await t(`cloudflare-endpoint`,`The IP address assigned to the Cloudflare side of the IPsec tunnel.`)),r.interfaceAddress===void 0&&(r.interfaceAddress=await t(`interface-address`,`A 31-bit prefix (/31 in CIDR notation) supporting two hosts, one for each side of the tunnel. Select the subnet from the following private IP space: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, 192.168.0.0–192.168.255.255.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the IPsec tunnel. The name cannot share a name with other tunnels.`));let g={};r.automaticReturnRouting!==void 0&&s(g,[`automatic_return_routing`],r.automaticReturnRouting),r.bgpCustomerAsn!==void 0&&s(g,[`bgp`,`customer_asn`],r.bgpCustomerAsn),r.bgpExtraPrefixes!==void 0&&s(g,[`bgp`,`extra_prefixes`],r.bgpExtraPrefixes),r.bgpMd5Key!==void 0&&s(g,[`bgp`,`md5_key`],a(r.bgpMd5Key,`bgpMd5Key`,`text`)),r.cloudflareEndpoint!==void 0&&s(g,[`cloudflare_endpoint`],a(r.cloudflareEndpoint,`cloudflareEndpoint`,`text`)),r.customRemoteIdentitiesFqdnId!==void 0&&s(g,[`custom_remote_identities`,`fqdn_id`],a(r.customRemoteIdentitiesFqdnId,`customRemoteIdentitiesFqdnId`,`text`)),r.customerEndpoint!==void 0&&s(g,[`customer_endpoint`],a(r.customerEndpoint,`customerEndpoint`,`text`)),r.description!==void 0&&s(g,[`description`],a(r.description,`description`,`text`)),r.healthCheckEnabled!==void 0&&s(g,[`health_check`,`enabled`],r.healthCheckEnabled),r.healthCheckRate!==void 0&&s(g,[`health_check`,`rate`],a(r.healthCheckRate,`healthCheckRate`,`text`)),r.healthCheckTargetSaved!==void 0&&s(g,[`health_check`,`target`,`saved`],a(r.healthCheckTargetSaved,`healthCheckTargetSaved`,`text`)),r.healthCheckType!==void 0&&s(g,[`health_check`,`type`],a(r.healthCheckType,`healthCheckType`,`text`)),r.healthCheckDirection!==void 0&&s(g,[`health_check`,`direction`],a(r.healthCheckDirection,`healthCheckDirection`,`text`)),r.interfaceAddress!==void 0&&s(g,[`interface_address`],a(r.interfaceAddress,`interfaceAddress`,`text`)),r.interfaceAddress6!==void 0&&s(g,[`interface_address6`],a(r.interfaceAddress6,`interfaceAddress6`,`text`)),r.name!==void 0&&s(g,[`name`],a(r.name,`name`,`text`)),r.psk!==void 0&&s(g,[`psk`],a(r.psk,`psk`,`text`)),r.replayProtection!==void 0&&s(g,[`replay_protection`],r.replayProtection),l(await f(`Updating ipsec tunnel`,async()=>m.put(`/accounts/${h}/magic/ipsec_tunnels/${r.ipsecTunnelId}`,{body:Object.keys(g).length>0?g:void 0,headers:Object.keys(p).length>0?p:void 0})),{successLabel:`Updated ipsec tunnel`})}},It={command:`ipsec-tunnels`,describe:`IPsec tunnel endpoints with pre-shared key management for encrypted transit`,builder:e=>e.command(kt).command(At).command(jt).command(Mt).command(Nt).command(Pt).command(Ft).demandCommand(1),handler:()=>{}},Lt={command:`create`,describe:`Create new PCAP request for account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit pcaps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/pcaps`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Creating pcap`,async()=>r.post(`/accounts/${a}/pcaps`,{body:e})),{successLabel:`Created pcap`});return}l(await f(`Creating pcap`,async()=>r.magicTransit.pcaps.create(a)),{successLabel:`Created pcap`})}},Rt={command:`get <pcapId>`,describe:`Download PCAP information into a file. Response is a binary PCAP file.`,builder:e=>e.positional(`pcapId`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1}),handler:async e=>{o(e.pcapId,`pcapId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r;let a=await f(`Loading download`,async()=>m(`/accounts/${r}/pcaps/${e.pcapId}/download`,`GET`,e.local?e.localEndpoint:void 0));p(e.text===!0?a.toString(`utf-8`):a)}},zt={command:`download`,describe:`Packet capture requests for debugging traffic flowing through Magic Transit tunnels`,builder:e=>e.command(Rt).demandCommand(1),handler:()=>{}},Bt={command:`get <pcapId>`,describe:`Get information for a PCAP request by id.`,builder:e=>e.positional(`pcapId`,{type:`string`,description:`Identifier.`,demandOption:!0}),handler:async e=>{o(e.pcapId,`pcapId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading pcap`,async()=>t.magicTransit.pcaps.get(e.pcapId,r)),{successLabel:`Loaded pcap`})}},Vt={command:`list`,describe:`Lists all packet capture requests for an account.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading pcaps`,async()=>t.magicTransit.pcaps.list(r)),{successLabel:`Loaded pcaps`})}},Ht={command:`create`,describe:`Adds an AWS or GCP bucket to use with full packet captures.`,builder:e=>e.option(`destination-conf`,{type:`string`,description:"The full URI for the bucket. This field only applies to `full` packet captures."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit pcaps ownership create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/pcaps/ownership`,pathParams:{},bodyKind:`json`,body:{destinationConf:r.destinationConf,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating ownership`,async()=>p.post(`/accounts/${m}/pcaps/ownership`,{body:e})),{successLabel:`Created ownership`});return}r.destinationConf===void 0&&(r.destinationConf=await t(`destination-conf`,"The full URI for the bucket. This field only applies to `full` packet captures."));let h={};r.destinationConf!==void 0&&s(h,[`destination_conf`],a(r.destinationConf,`destinationConf`,`text`)),l(await f(`Creating ownership`,async()=>p.post(`/accounts/${m}/pcaps/ownership`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created ownership`})}},Ut={command:`delete <ownershipId>`,describe:`Deletes buckets added to the packet captures API.`,builder:e=>e.positional(`ownershipId`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.ownershipId,`ownershipId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit pcaps ownership delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/pcaps/ownership/${t.ownershipId??`<ownershipId>`}`,pathParams:{ownershipId:String(t.ownershipId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`ownership`,String(t.ownershipId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting ownership`,async()=>a.magicTransit.pcaps.ownership.delete(t.ownershipId,s)),{successLabel:`Deleted ownership`})}},Wt={command:`get`,describe:`List all buckets configured for use with PCAPs API.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading ownership`,async()=>t.magicTransit.pcaps.ownership.get(r)),{successLabel:`Loaded ownership`})}},Gt={command:`validate`,describe:`Validates buckets added to the packet captures API.`,builder:e=>e.option(`destination-conf`,{type:`string`,description:"The full URI for the bucket. This field only applies to `full` packet captures."}).option(`ownership-challenge`,{type:`string`,description:`The ownership challenge filename stored in the bucket.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit pcaps ownership validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/pcaps/ownership/validate`,pathParams:{},bodyKind:`json`,body:{destinationConf:r.destinationConf,ownershipChallenge:r.ownershipChallenge,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating ownership`,async()=>p.post(`/accounts/${m}/pcaps/ownership/validate`,{body:e})),{successLabel:`Created ownership`});return}r.destinationConf===void 0&&(r.destinationConf=await t(`destination-conf`,"The full URI for the bucket. This field only applies to `full` packet captures.")),r.ownershipChallenge===void 0&&(r.ownershipChallenge=await t(`ownership-challenge`,`The ownership challenge filename stored in the bucket.`));let h={};r.destinationConf!==void 0&&s(h,[`destination_conf`],a(r.destinationConf,`destinationConf`,`text`)),r.ownershipChallenge!==void 0&&s(h,[`ownership_challenge`],a(r.ownershipChallenge,`ownershipChallenge`,`text`)),l(await f(`Creating ownership`,async()=>p.post(`/accounts/${m}/pcaps/ownership/validate`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created ownership`})}},Kt={command:`ownership`,describe:`Packet capture requests for debugging traffic flowing through Magic Transit tunnels`,builder:e=>e.command(Ht).command(Ut).command(Wt).command(Gt).demandCommand(1),handler:()=>{}},qt={command:`stop <pcapId>`,describe:`Stop full PCAP.`,builder:e=>e.positional(`pcapId`,{type:`string`,description:`Identifier.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.pcapId,`pcapId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit pcaps stop`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/pcaps/${t.pcapId??`<pcapId>`}/stop`,pathParams:{pcapId:String(t.pcapId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`pcap`,String(t.pcapId??``),{force:!!t.force,message:`This operation halts an in-progress full packet capture. Any unsaved capture data will be lost.`})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting pcap`,async()=>a.magicTransit.pcaps.stop(t.pcapId,s)),{successLabel:`Deleted pcap`})}},Jt={command:`pcaps`,describe:`Packet capture requests for debugging traffic flowing through Magic Transit tunnels`,builder:e=>e.command(Lt).command(Bt).command(Vt).command(qt).command(zt).command(Kt).demandCommand(1),handler:()=>{}},Yt={command:`bulk-update`,describe:"Update multiple Magic static routes. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes. Only fields for a route that need to be changed need be provided.",builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit routes bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Updating routes`,async()=>r.put(`/accounts/${a}/magic/routes`,{body:e})),{successLabel:`Updated routes`});return}l(await f(`Updating routes`,async()=>r.magicTransit.routes.bulkUpdate(a)),{successLabel:`Updated routes`})}},Xt={command:`create`,describe:"Creates a new Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.",builder:e=>e.option(`description`,{type:`string`,description:`An optional human provided description of the static route.`}).option(`nexthop`,{type:`string`,description:`The next-hop IP Address for the static route.`}).option(`prefix`,{type:`string`,description:`IP Prefix in Classless Inter-Domain Routing format.`}).option(`priority`,{type:`number`,description:`Priority of the static route.`}).option(`scope-colo-names`,{type:`string`,array:!0,description:`List of colo names for the ECMP scope.`}).option(`scope-colo-regions`,{type:`string`,array:!0,description:`List of colo regions for the ECMP scope.`}).option(`weight`,{type:`number`,description:`Optional weight of the ECMP scope - if provided.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:{description:r.description,nexthop:r.nexthop,prefix:r.prefix,priority:r.priority,scopeColoNames:r.scopeColoNames,scopeColoRegions:r.scopeColoRegions,weight:r.weight,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating route`,async()=>p.post(`/accounts/${m}/magic/routes`,{body:e})),{successLabel:`Created route`});return}if(r.nexthop===void 0&&(r.nexthop=await t(`nexthop`,`The next-hop IP Address for the static route.`)),r.prefix===void 0&&(r.prefix=await t(`prefix`,`IP Prefix in Classless Inter-Domain Routing format.`)),r.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);let h={};r.description!==void 0&&s(h,[`description`],a(r.description,`description`,`text`)),r.nexthop!==void 0&&s(h,[`nexthop`],a(r.nexthop,`nexthop`,`text`)),r.prefix!==void 0&&s(h,[`prefix`],a(r.prefix,`prefix`,`text`)),r.priority!==void 0&&s(h,[`priority`],r.priority),r.scopeColoNames!==void 0&&s(h,[`scope`,`colo_names`],r.scopeColoNames),r.scopeColoRegions!==void 0&&s(h,[`scope`,`colo_regions`],r.scopeColoRegions),r.weight!==void 0&&s(h,[`weight`],r.weight),l(await f(`Creating route`,async()=>p.post(`/accounts/${m}/magic/routes`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created route`})}},Zt={command:`delete <routeId>`,describe:`Disable and remove a specific Magic static route.`,builder:e=>e.positional(`routeId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.routeId,`routeId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/routes/${t.routeId??`<routeId>`}`,pathParams:{routeId:String(t.routeId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`route`,String(t.routeId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting route`,async()=>a.delete(`/accounts/${s}/magic/routes/${t.routeId}`,{body:e})),{successLabel:`Deleted route`});return}l(await f(`Deleting route`,async()=>a.magicTransit.routes.delete(t.routeId,s)),{successLabel:`Deleted route`})}},Qt={command:`empty`,describe:`Delete multiple Magic static routes.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit routes empty`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/routes`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`route`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting route`,async()=>a.delete(`/accounts/${s}/magic/routes`,{body:e})),{successLabel:`Deleted route`});return}l(await f(`Deleting route`,async()=>a.magicTransit.routes.empty(s)),{successLabel:`Deleted route`})}},$t={command:`get <routeId>`,describe:`Get a specific Magic static route.`,builder:e=>e.positional(`routeId`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{o(e.routeId,`routeId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading route`,async()=>t.magicTransit.routes.get(e.routeId,r)),{successLabel:`Loaded route`})}},en={command:`list`,describe:`List all Magic static routes.`,builder:e=>e,handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading routes`,async()=>t.magicTransit.routes.list(r)),{successLabel:`Loaded routes`})}},tn={command:`update <routeId>`,describe:"Update a specific Magic static route. Use `?validate_only=true` as an optional query parameter to run validation only without persisting changes.",builder:e=>e.positional(`routeId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional human provided description of the static route.`}).option(`nexthop`,{type:`string`,description:`The next-hop IP Address for the static route.`}).option(`prefix`,{type:`string`,description:`IP Prefix in Classless Inter-Domain Routing format.`}).option(`priority`,{type:`number`,description:`Priority of the static route.`}).option(`scope-colo-names`,{type:`string`,array:!0,description:`List of colo names for the ECMP scope.`}).option(`scope-colo-regions`,{type:`string`,array:!0,description:`List of colo regions for the ECMP scope.`}).option(`weight`,{type:`number`,description:`Optional weight of the ECMP scope - if provided.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(o(r.routeId,`routeId`),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit routes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/routes/${r.routeId??`<routeId>`}`,pathParams:{routeId:String(r.routeId??``)},bodyKind:`json`,body:{description:r.description,nexthop:r.nexthop,prefix:r.prefix,priority:r.priority,scopeColoNames:r.scopeColoNames,scopeColoRegions:r.scopeColoRegions,weight:r.weight,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Updating route`,async()=>p.put(`/accounts/${m}/magic/routes/${r.routeId}`,{body:e})),{successLabel:`Updated route`});return}if(r.nexthop===void 0&&(r.nexthop=await t(`nexthop`,`The next-hop IP Address for the static route.`)),r.prefix===void 0&&(r.prefix=await t(`prefix`,`IP Prefix in Classless Inter-Domain Routing format.`)),r.priority===void 0)throw Error(`--priority is required (or pass --body with this field set).`);let h={};r.description!==void 0&&s(h,[`description`],a(r.description,`description`,`text`)),r.nexthop!==void 0&&s(h,[`nexthop`],a(r.nexthop,`nexthop`,`text`)),r.prefix!==void 0&&s(h,[`prefix`],a(r.prefix,`prefix`,`text`)),r.priority!==void 0&&s(h,[`priority`],r.priority),r.scopeColoNames!==void 0&&s(h,[`scope`,`colo_names`],r.scopeColoNames),r.scopeColoRegions!==void 0&&s(h,[`scope`,`colo_regions`],r.scopeColoRegions),r.weight!==void 0&&s(h,[`weight`],r.weight),l(await f(`Updating route`,async()=>p.put(`/accounts/${m}/magic/routes/${r.routeId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated route`})}},nn={command:`routes`,describe:`Static routes that direct IP prefix traffic through specific GRE/IPsec tunnels`,builder:e=>e.command(Yt).command(Xt).command(Zt).command(Qt).command($t).command(en).command(tn).demandCommand(1),handler:()=>{}},rn={command:`create <siteId>`,describe:`Creates a new Site ACL.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Bidirectional ACL policy for local network traffic within a site.`}),handler:async r=>{if(o(r.siteId,`siteId`),r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit sites acls create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/sites/${r.siteId??`<siteId>`}/acls`,pathParams:{siteId:String(r.siteId??``)},bodyKind:`json`,body:{description:r.description,forwardLocally:r.forwardLocally,lan1LanId:r.lan1LanId,lan1LanName:r.lan1LanName,lan1PortRanges:r.lan1PortRanges,lan1Ports:r.lan1Ports,lan2LanId:r.lan2LanId,lan2LanName:r.lan2LanName,lan2PortRanges:r.lan2PortRanges,lan2Ports:r.lan2Ports,name:r.name,protocols:r.protocols,unidirectional:r.unidirectional,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating acl`,async()=>p.post(`/accounts/${m}/magic/sites/${r.siteId}/acls`,{body:e})),{successLabel:`Created acl`});return}r.lan1LanId===void 0&&(r.lan1LanId=await t(`lan1lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r.lan2LanId===void 0&&(r.lan2LanId=await t(`lan2lan-id`,`The identifier for the LAN you want to create an ACL policy with.`)),r.name===void 0&&(r.name=await t(`name`,`The name of the ACL.`));let h={};r.description!==void 0&&s(h,[`description`],a(r.description,`description`,`text`)),r.forwardLocally!==void 0&&s(h,[`forward_locally`],r.forwardLocally),r.lan1LanId!==void 0&&s(h,[`lan_1`,`lan_id`],a(r.lan1LanId,`lan1LanId`,`text`)),r.lan1LanName!==void 0&&s(h,[`lan_1`,`lan_name`],a(r.lan1LanName,`lan1LanName`,`text`)),r.lan1PortRanges!==void 0&&s(h,[`lan_1`,`port_ranges`],r.lan1PortRanges),r.lan1Ports!==void 0&&s(h,[`lan_1`,`ports`],r.lan1Ports),r.lan2LanId!==void 0&&s(h,[`lan_2`,`lan_id`],a(r.lan2LanId,`lan2LanId`,`text`)),r.lan2LanName!==void 0&&s(h,[`lan_2`,`lan_name`],a(r.lan2LanName,`lan2LanName`,`text`)),r.lan2PortRanges!==void 0&&s(h,[`lan_2`,`port_ranges`],r.lan2PortRanges),r.lan2Ports!==void 0&&s(h,[`lan_2`,`ports`],r.lan2Ports),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.protocols!==void 0&&s(h,[`protocols`],r.protocols),r.unidirectional!==void 0&&s(h,[`unidirectional`],r.unidirectional),l(await f(`Creating acl`,async()=>p.post(`/accounts/${m}/magic/sites/${r.siteId}/acls`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created acl`})}},an={command:`delete <aclId>`,describe:`Remove a specific Site ACL.`,builder:e=>e.positional(`aclId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.aclId,`aclId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites acls delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/acls/${t.aclId??`<aclId>`}`,pathParams:{siteId:String(t.siteId??``),aclId:String(t.aclId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`acl`,String(t.aclId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting acl`,async()=>a.delete(`/accounts/${s}/magic/sites/${t.siteId}/acls/${t.aclId}`,{body:e})),{successLabel:`Deleted acl`});return}l(await f(`Deleting acl`,async()=>a.magicTransit.sites.acls.delete(t.siteId,s,t.aclId)),{successLabel:`Deleted acl`})}},on={command:`edit <aclId>`,describe:`Patch a specific Site ACL.`,builder:e=>e.positional(`aclId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan1lan-id`,`lan1lan-name`,`lan1port-ranges`,`lan1ports`].some(t=>e[t]!==void 0)){let t=[`lan1lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan2lan-id`,`lan2lan-name`,`lan2port-ranges`,`lan2ports`].some(t=>e[t]!==void 0)){let t=[`lan2lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0}),handler:async t=>{if(o(t.aclId,`aclId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites acls edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/acls/${t.aclId??`<aclId>`}`,pathParams:{siteId:String(t.siteId??``),aclId:String(t.aclId??``)},bodyKind:`json`,body:{description:t.description,forwardLocally:t.forwardLocally,lan1LanId:t.lan1LanId,lan1LanName:t.lan1LanName,lan1PortRanges:t.lan1PortRanges,lan1Ports:t.lan1Ports,lan2LanId:t.lan2LanId,lan2LanName:t.lan2LanName,lan2PortRanges:t.lan2PortRanges,lan2Ports:t.lan2Ports,name:t.name,protocols:t.protocols,unidirectional:t.unidirectional,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating acl`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/acls/${t.aclId}`,{body:e})),{successLabel:`Updated acl`});return}let m={};t.description!==void 0&&s(m,[`description`],a(t.description,`description`,`text`)),t.forwardLocally!==void 0&&s(m,[`forward_locally`],t.forwardLocally),t.lan1LanId!==void 0&&s(m,[`lan_1`,`lan_id`],a(t.lan1LanId,`lan1LanId`,`text`)),t.lan1LanName!==void 0&&s(m,[`lan_1`,`lan_name`],a(t.lan1LanName,`lan1LanName`,`text`)),t.lan1PortRanges!==void 0&&s(m,[`lan_1`,`port_ranges`],t.lan1PortRanges),t.lan1Ports!==void 0&&s(m,[`lan_1`,`ports`],t.lan1Ports),t.lan2LanId!==void 0&&s(m,[`lan_2`,`lan_id`],a(t.lan2LanId,`lan2LanId`,`text`)),t.lan2LanName!==void 0&&s(m,[`lan_2`,`lan_name`],a(t.lan2LanName,`lan2LanName`,`text`)),t.lan2PortRanges!==void 0&&s(m,[`lan_2`,`port_ranges`],t.lan2PortRanges),t.lan2Ports!==void 0&&s(m,[`lan_2`,`ports`],t.lan2Ports),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.protocols!==void 0&&s(m,[`protocols`],t.protocols),t.unidirectional!==void 0&&s(m,[`unidirectional`],t.unidirectional),l(await f(`Updating acl`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/acls/${t.aclId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated acl`})}},sn={command:`get <aclId>`,describe:`Get a specific Site ACL.`,builder:e=>e.positional(`aclId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{o(e.aclId,`aclId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading acl`,async()=>t.magicTransit.sites.acls.get(e.siteId,r,e.aclId)),{successLabel:`Loaded acl`})}},cn={command:`list`,describe:`Lists Site ACLs associated with an account.`,builder:e=>e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading acls`,async()=>t.magicTransit.sites.acls.list(r,e.siteId)),{successLabel:`Loaded acls`})}},ln={command:`update <aclId>`,describe:`Update a specific Site ACL.`,builder:e=>e.positional(`aclId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`description`,{type:`string`,description:`Description for the ACL.`}).option(`forward-locally`,{type:`boolean`,description:`The desired forwarding action for this ACL policy. If set to "false", the policy will forward traffic to Cloudflare. If set to "true", the policy will forward traffic locally on the Magic Connector. If not included in request, will default to false.`}).option(`lan-1-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-1-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-1-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-1-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-lan-id`,{type:`string`,description:`The identifier for the LAN you want to create an ACL policy with.`}).option(`lan-2-lan-name`,{type:`string`,description:`The name of the LAN based on the provided lan_id.`}).option(`lan-2-port-ranges`,{type:`string`,array:!0,description:`Array of port ranges on the provided LAN that will be included in the ACL. If no ports or port rangess are provided, communication on any port on this LAN is allowed.`}).option(`lan-2-ports`,{type:`string`,array:!0,description:`Array of ports on the provided LAN that will be included in the ACL. If no ports or port ranges are provided, communication on any port on this LAN is allowed.`}).option(`name`,{type:`string`,description:`The name of the ACL.`}).option(`protocols`,{type:`string`,array:!0,description:`The protocols field`}).option(`unidirectional`,{type:`boolean`,description:`The desired traffic direction for this ACL policy. If set to "false", the policy will allow bidirectional traffic. If set to "true", the policy will only allow traffic in one direction. If not included in request, will default to false.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`lan1lan-id`,`lan1lan-name`,`lan1port-ranges`,`lan1ports`].some(t=>e[t]!==void 0)){let t=[`lan1lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_1-* flag is set`)}return!0}).check(e=>{if([`lan2lan-id`,`lan2lan-name`,`lan2port-ranges`,`lan2ports`].some(t=>e[t]!==void 0)){let t=[`lan2lan-id`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --lan_2-* flag is set`)}return!0}),handler:async t=>{if(o(t.aclId,`aclId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites acls update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/acls/${t.aclId??`<aclId>`}`,pathParams:{siteId:String(t.siteId??``),aclId:String(t.aclId??``)},bodyKind:`json`,body:{description:t.description,forwardLocally:t.forwardLocally,lan1LanId:t.lan1LanId,lan1LanName:t.lan1LanName,lan1PortRanges:t.lan1PortRanges,lan1Ports:t.lan1Ports,lan2LanId:t.lan2LanId,lan2LanName:t.lan2LanName,lan2PortRanges:t.lan2PortRanges,lan2Ports:t.lan2Ports,name:t.name,protocols:t.protocols,unidirectional:t.unidirectional,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating acl`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/acls/${t.aclId}`,{body:e})),{successLabel:`Updated acl`});return}let m={};t.description!==void 0&&s(m,[`description`],a(t.description,`description`,`text`)),t.forwardLocally!==void 0&&s(m,[`forward_locally`],t.forwardLocally),t.lan1LanId!==void 0&&s(m,[`lan_1`,`lan_id`],a(t.lan1LanId,`lan1LanId`,`text`)),t.lan1LanName!==void 0&&s(m,[`lan_1`,`lan_name`],a(t.lan1LanName,`lan1LanName`,`text`)),t.lan1PortRanges!==void 0&&s(m,[`lan_1`,`port_ranges`],t.lan1PortRanges),t.lan1Ports!==void 0&&s(m,[`lan_1`,`ports`],t.lan1Ports),t.lan2LanId!==void 0&&s(m,[`lan_2`,`lan_id`],a(t.lan2LanId,`lan2LanId`,`text`)),t.lan2LanName!==void 0&&s(m,[`lan_2`,`lan_name`],a(t.lan2LanName,`lan2LanName`,`text`)),t.lan2PortRanges!==void 0&&s(m,[`lan_2`,`port_ranges`],t.lan2PortRanges),t.lan2Ports!==void 0&&s(m,[`lan_2`,`ports`],t.lan2Ports),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.protocols!==void 0&&s(m,[`protocols`],t.protocols),t.unidirectional!==void 0&&s(m,[`unidirectional`],t.unidirectional),l(await f(`Updating acl`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/acls/${t.aclId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated acl`})}},un={command:`acls`,describe:`Magic WAN branch sites with LAN/WAN interface configuration and connector assignments`,builder:e=>e.command(rn).command(an).command(on).command(sn).command(cn).command(ln).demandCommand(1),handler:()=>{}},dn={command:`create <siteId>`,describe:`Creates a new App Config for a site`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites app-configuration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/app_configs`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{breakout:t.breakout,preferredWans:t.preferredWans,priority:t.priority,body:t.body},validation:`passed`});return}let r=await i(t),a=t.local?d:await n(r);if(t.accountId=a,t.body){let e=c(t.body);l(await f(`Creating app configuration`,async()=>r.post(`/accounts/${a}/magic/sites/${t.siteId}/app_configs`,{body:e})),{successLabel:`Created app configuration`});return}let p={};t.breakout!==void 0&&s(p,[`breakout`],t.breakout),t.preferredWans!==void 0&&s(p,[`preferred_wans`],t.preferredWans),t.priority!==void 0&&s(p,[`priority`],t.priority),l(await f(`Creating app configuration`,async()=>r.post(`/accounts/${a}/magic/sites/${t.siteId}/app_configs`,{body:Object.keys(p).length>0?p:void 0})),{successLabel:`Created app configuration`})}},fn={command:`delete <appConfigId>`,describe:`Deletes specific App Config associated with a site.`,builder:e=>e.positional(`appConfigId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(o(t.appConfigId,`appConfigId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites app-configuration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/app_configs/${t.appConfigId??`<appConfigId>`}`,pathParams:{siteId:String(t.siteId??``),appConfigId:String(t.appConfigId??``)},bodyKind:`none`,validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`app configuration`,String(t.appConfigId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}l(await f(`Deleting app configuration`,async()=>a.magicTransit.sites.appConfiguration.delete(s,t.siteId,t.appConfigId)),{successLabel:`Deleted app configuration`})}},pn={command:`edit <appConfigId>`,describe:`Updates an App Config for a site`,builder:e=>e.positional(`appConfigId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.appConfigId,`appConfigId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites app-configuration edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/app_configs/${t.appConfigId??`<appConfigId>`}`,pathParams:{siteId:String(t.siteId??``),appConfigId:String(t.appConfigId??``)},bodyKind:`json`,body:{accountAppId:t.accountAppId,breakout:t.breakout,managedAppId:t.managedAppId,preferredWans:t.preferredWans,priority:t.priority,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating app configuration`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/app_configs/${t.appConfigId}`,{body:e})),{successLabel:`Updated app configuration`});return}let m={};t.accountAppId!==void 0&&s(m,[`account_app_id`],a(t.accountAppId,`accountAppId`,`text`)),t.breakout!==void 0&&s(m,[`breakout`],t.breakout),t.managedAppId!==void 0&&s(m,[`managed_app_id`],a(t.managedAppId,`managedAppId`,`text`)),t.preferredWans!==void 0&&s(m,[`preferred_wans`],t.preferredWans),t.priority!==void 0&&s(m,[`priority`],t.priority),l(await f(`Updating app configuration`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/app_configs/${t.appConfigId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated app configuration`})}},mn={command:`list`,describe:`Lists App Configs associated with a site.`,builder:e=>e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading app configuration`,async()=>t.magicTransit.sites.appConfiguration.list(r,e.siteId)),{successLabel:`Loaded app configuration`})}},hn={command:`update <appConfigId>`,describe:`Updates an App Config for a site`,builder:e=>e.positional(`appConfigId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`account-app-id`,{type:`string`,description:`Magic account app ID.`}).option(`breakout`,{type:`boolean`,description:`Whether to breakout traffic to the app's endpoints directly. Null preserves default behavior.`}).option(`managed-app-id`,{type:`string`,description:`Managed app ID.`}).option(`preferred-wans`,{type:`string`,array:!0,description:`WAN interfaces to prefer over default WANs, highest-priority first. Can only be specified for breakout rules (breakout must be true).`}).option(`priority`,{type:`number`,description:`Priority of traffic. 0 is default, anything greater is prioritized. (Currently only 0 and 1 are supported)`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.appConfigId,`appConfigId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites app-configuration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/app_configs/${t.appConfigId??`<appConfigId>`}`,pathParams:{siteId:String(t.siteId??``),appConfigId:String(t.appConfigId??``)},bodyKind:`json`,body:{accountAppId:t.accountAppId,breakout:t.breakout,managedAppId:t.managedAppId,preferredWans:t.preferredWans,priority:t.priority,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating app configuration`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/app_configs/${t.appConfigId}`,{body:e})),{successLabel:`Updated app configuration`});return}let m={};t.accountAppId!==void 0&&s(m,[`account_app_id`],a(t.accountAppId,`accountAppId`,`text`)),t.breakout!==void 0&&s(m,[`breakout`],t.breakout),t.managedAppId!==void 0&&s(m,[`managed_app_id`],a(t.managedAppId,`managedAppId`,`text`)),t.preferredWans!==void 0&&s(m,[`preferred_wans`],t.preferredWans),t.priority!==void 0&&s(m,[`priority`],t.priority),l(await f(`Updating app configuration`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/app_configs/${t.appConfigId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated app configuration`})}},gn={command:`app-configuration`,describe:`Magic WAN site app configuration and NetFlow config management`,builder:e=>e.command(dn).command(fn).command(pn).command(mn).command(hn).demandCommand(1),handler:()=>{}},_n={command:`create`,describe:`Creates a new Site`,builder:e=>e.option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`ha-mode`,{type:`boolean`,description:`Site high availability mode. If set to true, the site can have two connectors and runs in high availability mode.`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async r=>{if(r.dryRun){let t=e();t&&o(t,`accountId`),u({command:`cf magic-transit sites create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/magic/sites`,pathParams:{},bodyKind:`json`,body:{connectorId:r.connectorId,description:r.description,haMode:r.haMode,locationLat:r.locationLat,locationLon:r.locationLon,name:r.name,secondaryConnectorId:r.secondaryConnectorId,body:r.body},validation:`passed`});return}let p=await i(r),m=r.local?d:await n(p);if(r.accountId=m,r.body){let e=c(r.body);l(await f(`Creating site`,async()=>p.post(`/accounts/${m}/magic/sites`,{body:e})),{successLabel:`Created site`});return}r.name===void 0&&(r.name=await t(`name`,`The name of the site.`));let h={};r.connectorId!==void 0&&s(h,[`connector_id`],a(r.connectorId,`connectorId`,`text`)),r.description!==void 0&&s(h,[`description`],a(r.description,`description`,`text`)),r.haMode!==void 0&&s(h,[`ha_mode`],r.haMode),r.locationLat!==void 0&&s(h,[`location`,`lat`],a(r.locationLat,`locationLat`,`text`)),r.locationLon!==void 0&&s(h,[`location`,`lon`],a(r.locationLon,`locationLon`,`text`)),r.name!==void 0&&s(h,[`name`],a(r.name,`name`,`text`)),r.secondaryConnectorId!==void 0&&s(h,[`secondary_connector_id`],a(r.secondaryConnectorId,`secondaryConnectorId`,`text`)),l(await f(`Creating site`,async()=>p.post(`/accounts/${m}/magic/sites`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created site`})}},vn={command:`delete <siteId>`,describe:`Remove a specific Site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`site`,String(t.siteId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting site`,async()=>a.delete(`/accounts/${s}/magic/sites/${t.siteId}`,{body:e})),{successLabel:`Deleted site`});return}l(await f(`Deleting site`,async()=>a.magicTransit.sites.delete(t.siteId,s)),{successLabel:`Deleted site`})}},yn={command:`edit <siteId>`,describe:`Patch a specific Site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{connectorId:t.connectorId,description:t.description,locationLat:t.locationLat,locationLon:t.locationLon,name:t.name,secondaryConnectorId:t.secondaryConnectorId,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating site`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}`,{body:e})),{successLabel:`Updated site`});return}let m={};t.connectorId!==void 0&&s(m,[`connector_id`],a(t.connectorId,`connectorId`,`text`)),t.description!==void 0&&s(m,[`description`],a(t.description,`description`,`text`)),t.locationLat!==void 0&&s(m,[`location`,`lat`],a(t.locationLat,`locationLat`,`text`)),t.locationLon!==void 0&&s(m,[`location`,`lon`],a(t.locationLon,`locationLon`,`text`)),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.secondaryConnectorId!==void 0&&s(m,[`secondary_connector_id`],a(t.secondaryConnectorId,`secondaryConnectorId`,`text`)),l(await f(`Updating site`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated site`})}},bn={command:`get <siteId>`,describe:`Get a specific Site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`x-magic-new-hc-target`,{type:`string`,description:`If true, the health check target in the response body will be presented using the new object format. Defaults to false.`}),handler:async e=>{o(e.siteId,`siteId`);let t={};e.xMagicNewHcTarget!==void 0&&(t[`x-magic-new-hc-target`]=String(e.xMagicNewHcTarget));let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading site`,async()=>r.get(`/accounts/${a}/magic/sites/${e.siteId}`,{headers:Object.keys(t).length>0?t:void 0})),{successLabel:`Loaded site`})}},xn={command:`create <siteId>`,describe:`Creates a new Site LAN. If the site is in high availability mode, static_addressing is required along with secondary and virtual address.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`ha-link`,{type:`boolean`,description:`mark true to use this LAN for HA probing. only works for site with HA turned on. only one LAN can be set as the ha_link.`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites lans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/lans`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{bondId:t.bondId,haLink:t.haLink,isBreakout:t.isBreakout,isPrioritized:t.isPrioritized,name:t.name,natStaticPrefix:t.natStaticPrefix,physport:t.physport,staticAddressingAddress:t.staticAddressingAddress,staticAddressingDhcpRelayServerAddresses:t.staticAddressingDhcpRelayServerAddresses,staticAddressingDhcpServerDhcpPoolEnd:t.staticAddressingDhcpServerDhcpPoolEnd,staticAddressingDhcpServerDhcpPoolStart:t.staticAddressingDhcpServerDhcpPoolStart,staticAddressingDhcpServerDnsServer:t.staticAddressingDhcpServerDnsServer,staticAddressingDhcpServerDnsServers:t.staticAddressingDhcpServerDnsServers,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,staticAddressingVirtualAddress:t.staticAddressingVirtualAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Creating lan`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/lans`,{body:e})),{successLabel:`Created lan`});return}let m={};t.bondId!==void 0&&s(m,[`bond_id`],t.bondId),t.haLink!==void 0&&s(m,[`ha_link`],t.haLink),t.isBreakout!==void 0&&s(m,[`is_breakout`],t.isBreakout),t.isPrioritized!==void 0&&s(m,[`is_prioritized`],t.isPrioritized),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.natStaticPrefix!==void 0&&s(m,[`nat`,`static_prefix`],a(t.natStaticPrefix,`natStaticPrefix`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingDhcpRelayServerAddresses!==void 0&&s(m,[`static_addressing`,`dhcp_relay`,`server_addresses`],t.staticAddressingDhcpRelayServerAddresses),t.staticAddressingDhcpServerDhcpPoolEnd!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_end`],a(t.staticAddressingDhcpServerDhcpPoolEnd,`staticAddressingDhcpServerDhcpPoolEnd`,`text`)),t.staticAddressingDhcpServerDhcpPoolStart!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_start`],a(t.staticAddressingDhcpServerDhcpPoolStart,`staticAddressingDhcpServerDhcpPoolStart`,`text`)),t.staticAddressingDhcpServerDnsServer!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_server`],a(t.staticAddressingDhcpServerDnsServer,`staticAddressingDhcpServerDnsServer`,`text`)),t.staticAddressingDhcpServerDnsServers!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_servers`],t.staticAddressingDhcpServerDnsServers),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.staticAddressingVirtualAddress!==void 0&&s(m,[`static_addressing`,`virtual_address`],a(t.staticAddressingVirtualAddress,`staticAddressingVirtualAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Creating lan`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/lans`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Created lan`})}},Sn={command:`delete <lanId>`,describe:`Remove a specific Site LAN.`,builder:e=>e.positional(`lanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.lanId,`lanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites lans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/lans/${t.lanId??`<lanId>`}`,pathParams:{siteId:String(t.siteId??``),lanId:String(t.lanId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`lan`,String(t.lanId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting lan`,async()=>a.delete(`/accounts/${s}/magic/sites/${t.siteId}/lans/${t.lanId}`,{body:e})),{successLabel:`Deleted lan`});return}l(await f(`Deleting lan`,async()=>a.magicTransit.sites.lans.delete(t.siteId,s,t.lanId)),{successLabel:`Deleted lan`})}},Cn={command:`edit <lanId>`,describe:`Patch a specific Site LAN.`,builder:e=>e.positional(`lanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.lanId,`lanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites lans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/lans/${t.lanId??`<lanId>`}`,pathParams:{siteId:String(t.siteId??``),lanId:String(t.lanId??``)},bodyKind:`json`,body:{bondId:t.bondId,isBreakout:t.isBreakout,isPrioritized:t.isPrioritized,name:t.name,natStaticPrefix:t.natStaticPrefix,physport:t.physport,staticAddressingAddress:t.staticAddressingAddress,staticAddressingDhcpRelayServerAddresses:t.staticAddressingDhcpRelayServerAddresses,staticAddressingDhcpServerDhcpPoolEnd:t.staticAddressingDhcpServerDhcpPoolEnd,staticAddressingDhcpServerDhcpPoolStart:t.staticAddressingDhcpServerDhcpPoolStart,staticAddressingDhcpServerDnsServer:t.staticAddressingDhcpServerDnsServer,staticAddressingDhcpServerDnsServers:t.staticAddressingDhcpServerDnsServers,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,staticAddressingVirtualAddress:t.staticAddressingVirtualAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating lan`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/lans/${t.lanId}`,{body:e})),{successLabel:`Updated lan`});return}let m={};t.bondId!==void 0&&s(m,[`bond_id`],t.bondId),t.isBreakout!==void 0&&s(m,[`is_breakout`],t.isBreakout),t.isPrioritized!==void 0&&s(m,[`is_prioritized`],t.isPrioritized),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.natStaticPrefix!==void 0&&s(m,[`nat`,`static_prefix`],a(t.natStaticPrefix,`natStaticPrefix`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingDhcpRelayServerAddresses!==void 0&&s(m,[`static_addressing`,`dhcp_relay`,`server_addresses`],t.staticAddressingDhcpRelayServerAddresses),t.staticAddressingDhcpServerDhcpPoolEnd!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_end`],a(t.staticAddressingDhcpServerDhcpPoolEnd,`staticAddressingDhcpServerDhcpPoolEnd`,`text`)),t.staticAddressingDhcpServerDhcpPoolStart!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_start`],a(t.staticAddressingDhcpServerDhcpPoolStart,`staticAddressingDhcpServerDhcpPoolStart`,`text`)),t.staticAddressingDhcpServerDnsServer!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_server`],a(t.staticAddressingDhcpServerDnsServer,`staticAddressingDhcpServerDnsServer`,`text`)),t.staticAddressingDhcpServerDnsServers!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_servers`],t.staticAddressingDhcpServerDnsServers),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.staticAddressingVirtualAddress!==void 0&&s(m,[`static_addressing`,`virtual_address`],a(t.staticAddressingVirtualAddress,`staticAddressingVirtualAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Updating lan`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/lans/${t.lanId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated lan`})}},wn={command:`get <lanId>`,describe:`Get a specific Site LAN.`,builder:e=>e.positional(`lanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{o(e.lanId,`lanId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading lan`,async()=>t.magicTransit.sites.lans.get(e.siteId,r,e.lanId)),{successLabel:`Loaded lan`})}},Tn={command:`list`,describe:`Lists Site LANs associated with an account.`,builder:e=>e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading lans`,async()=>t.magicTransit.sites.lans.list(r,e.siteId)),{successLabel:`Loaded lans`})}},En={command:`update <lanId>`,describe:`Update a specific Site LAN.`,builder:e=>e.positional(`lanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`bond-id`,{type:`number`,description:`The bond_id field`}).option(`is-breakout`,{type:`boolean`,description:`mark true to use this LAN for source-based breakout traffic`}).option(`is-prioritized`,{type:`boolean`,description:`mark true to use this LAN for source-based prioritized traffic`}).option(`name`,{type:`string`,description:`The name field`}).option(`nat-static-prefix`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-dhcp-relay-server-addresses`,{type:`string`,array:!0,description:`List of DHCP server IPs.`}).option(`static-addressing-dhcp-server-dhcp-pool-end`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dhcp-pool-start`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-server`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-dhcp-server-dns-servers`,{type:`string`,array:!0,description:`The static_addressing.dhcp_server.dns_servers field`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-virtual-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-dhcp-relay-server-addresses`,`static-addressing-dhcp-server-dhcp-pool-end`,`static-addressing-dhcp-server-dhcp-pool-start`,`static-addressing-dhcp-server-dns-server`,`static-addressing-dhcp-server-dns-servers`,`static-addressing-secondary-address`,`static-addressing-virtual-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.lanId,`lanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites lans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/lans/${t.lanId??`<lanId>`}`,pathParams:{siteId:String(t.siteId??``),lanId:String(t.lanId??``)},bodyKind:`json`,body:{bondId:t.bondId,isBreakout:t.isBreakout,isPrioritized:t.isPrioritized,name:t.name,natStaticPrefix:t.natStaticPrefix,physport:t.physport,staticAddressingAddress:t.staticAddressingAddress,staticAddressingDhcpRelayServerAddresses:t.staticAddressingDhcpRelayServerAddresses,staticAddressingDhcpServerDhcpPoolEnd:t.staticAddressingDhcpServerDhcpPoolEnd,staticAddressingDhcpServerDhcpPoolStart:t.staticAddressingDhcpServerDhcpPoolStart,staticAddressingDhcpServerDnsServer:t.staticAddressingDhcpServerDnsServer,staticAddressingDhcpServerDnsServers:t.staticAddressingDhcpServerDnsServers,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,staticAddressingVirtualAddress:t.staticAddressingVirtualAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating lan`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/lans/${t.lanId}`,{body:e})),{successLabel:`Updated lan`});return}let m={};t.bondId!==void 0&&s(m,[`bond_id`],t.bondId),t.isBreakout!==void 0&&s(m,[`is_breakout`],t.isBreakout),t.isPrioritized!==void 0&&s(m,[`is_prioritized`],t.isPrioritized),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.natStaticPrefix!==void 0&&s(m,[`nat`,`static_prefix`],a(t.natStaticPrefix,`natStaticPrefix`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingDhcpRelayServerAddresses!==void 0&&s(m,[`static_addressing`,`dhcp_relay`,`server_addresses`],t.staticAddressingDhcpRelayServerAddresses),t.staticAddressingDhcpServerDhcpPoolEnd!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_end`],a(t.staticAddressingDhcpServerDhcpPoolEnd,`staticAddressingDhcpServerDhcpPoolEnd`,`text`)),t.staticAddressingDhcpServerDhcpPoolStart!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dhcp_pool_start`],a(t.staticAddressingDhcpServerDhcpPoolStart,`staticAddressingDhcpServerDhcpPoolStart`,`text`)),t.staticAddressingDhcpServerDnsServer!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_server`],a(t.staticAddressingDhcpServerDnsServer,`staticAddressingDhcpServerDnsServer`,`text`)),t.staticAddressingDhcpServerDnsServers!==void 0&&s(m,[`static_addressing`,`dhcp_server`,`dns_servers`],t.staticAddressingDhcpServerDnsServers),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.staticAddressingVirtualAddress!==void 0&&s(m,[`static_addressing`,`virtual_address`],a(t.staticAddressingVirtualAddress,`staticAddressingVirtualAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Updating lan`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/lans/${t.lanId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated lan`})}},$={command:`lans`,describe:`Magic WAN branch sites with LAN/WAN interface configuration and connector assignments`,builder:e=>e.command(xn).command(Sn).command(Cn).command(wn).command(Tn).command(En).demandCommand(1),handler:()=>{}},Dn={command:`list`,describe:`Lists Sites associated with an account. Use connectorid query param to return sites where connectorid matches either site.ConnectorID or site.SecondaryConnectorID.`,builder:e=>e.option(`connectorid`,{type:`string`,description:`Identifier`}),handler:async e=>{let t={};e.connectorid!==void 0&&(t.connectorid=e.connectorid);let r=await i(e),a=e.local?d:await n(r);e.accountId=a,l(await f(`Loading sites`,async()=>r.magicTransit.sites.list(a,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded sites`})}},On={command:`create <siteId>`,describe:`Creates a NetFlow configuration for a site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites netflow-config create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/netflow_config`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{activeTimeout:t.activeTimeout,collectorIp:t.collectorIp,collectorPort:t.collectorPort,inactiveTimeout:t.inactiveTimeout,samplingRate:t.samplingRate,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Creating netflow config`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:e})),{successLabel:`Created netflow config`});return}let m={};t.activeTimeout!==void 0&&s(m,[`active_timeout`],t.activeTimeout),t.collectorIp!==void 0&&s(m,[`collector_ip`],a(t.collectorIp,`collectorIp`,`text`)),t.collectorPort!==void 0&&s(m,[`collector_port`],t.collectorPort),t.inactiveTimeout!==void 0&&s(m,[`inactive_timeout`],t.inactiveTimeout),t.samplingRate!==void 0&&s(m,[`sampling_rate`],t.samplingRate),l(await f(`Creating netflow config`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Created netflow config`})}},kn={command:`delete <siteId>`,describe:`Remove NetFlow configuration for a site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites netflow-config delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/netflow_config`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`netflow config`,String(t.siteId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting netflow config`,async()=>a.delete(`/accounts/${s}/magic/sites/${t.siteId}/netflow_config`,{body:e})),{successLabel:`Deleted netflow config`});return}l(await f(`Deleting netflow config`,async()=>a.magicTransit.sites.netflowConfig.delete(s,t.siteId)),{successLabel:`Deleted netflow config`})}},An={command:`edit <siteId>`,describe:`Updates NetFlow configuration for a site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites netflow-config edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/netflow_config`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{activeTimeout:t.activeTimeout,collectorIp:t.collectorIp,collectorPort:t.collectorPort,inactiveTimeout:t.inactiveTimeout,samplingRate:t.samplingRate,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating netflow config`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:e})),{successLabel:`Updated netflow config`});return}let m={};t.activeTimeout!==void 0&&s(m,[`active_timeout`],t.activeTimeout),t.collectorIp!==void 0&&s(m,[`collector_ip`],a(t.collectorIp,`collectorIp`,`text`)),t.collectorPort!==void 0&&s(m,[`collector_port`],t.collectorPort),t.inactiveTimeout!==void 0&&s(m,[`inactive_timeout`],t.inactiveTimeout),t.samplingRate!==void 0&&s(m,[`sampling_rate`],t.samplingRate),l(await f(`Updating netflow config`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated netflow config`})}},jn={command:`get <siteId>`,describe:`Get NetFlow configuration for a site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{o(e.siteId,`siteId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading netflow config`,async()=>t.magicTransit.sites.netflowConfig.get(r,e.siteId)),{successLabel:`Loaded netflow config`})}},Mn={command:`update <siteId>`,describe:`Updates NetFlow configuration for a site (partial update).`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`active-timeout`,{type:`number`,description:`Timeout in seconds for active flows.`}).option(`collector-ip`,{type:`string`,description:`IPv4 address of the NetFlow collector.`}).option(`collector-port`,{type:`number`,description:`UDP port of the NetFlow collector.`}).option(`inactive-timeout`,{type:`number`,description:`Timeout in seconds for inactive flows.`}).option(`sampling-rate`,{type:`number`,description:`Sampling rate for NetFlow records (1 = every packet).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites netflow-config update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/netflow_config`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{activeTimeout:t.activeTimeout,collectorIp:t.collectorIp,collectorPort:t.collectorPort,inactiveTimeout:t.inactiveTimeout,samplingRate:t.samplingRate,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating netflow config`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:e})),{successLabel:`Updated netflow config`});return}let m={};t.activeTimeout!==void 0&&s(m,[`active_timeout`],t.activeTimeout),t.collectorIp!==void 0&&s(m,[`collector_ip`],a(t.collectorIp,`collectorIp`,`text`)),t.collectorPort!==void 0&&s(m,[`collector_port`],t.collectorPort),t.inactiveTimeout!==void 0&&s(m,[`inactive_timeout`],t.inactiveTimeout),t.samplingRate!==void 0&&s(m,[`sampling_rate`],t.samplingRate),l(await f(`Updating netflow config`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/netflow_config`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated netflow config`})}},Nn={command:`netflow-config`,describe:`Magic WAN site app configuration and NetFlow config management`,builder:e=>e.command(On).command(kn).command(An).command(jn).command(Mn).demandCommand(1),handler:()=>{}},Pn={command:`update <siteId>`,describe:`Update a specific Site.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`connector-id`,{type:`string`,description:`Magic Connector identifier tag.`}).option(`description`,{type:`string`,description:`The description field`}).option(`location-lat`,{type:`string`,description:`Latitude`}).option(`location-lon`,{type:`string`,description:`Longitude`}).option(`name`,{type:`string`,description:`The name of the site.`}).option(`secondary-connector-id`,{type:`string`,description:`Magic Connector identifier tag. Used when high availability mode is on.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{connectorId:t.connectorId,description:t.description,locationLat:t.locationLat,locationLon:t.locationLon,name:t.name,secondaryConnectorId:t.secondaryConnectorId,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating site`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}`,{body:e})),{successLabel:`Updated site`});return}let m={};t.connectorId!==void 0&&s(m,[`connector_id`],a(t.connectorId,`connectorId`,`text`)),t.description!==void 0&&s(m,[`description`],a(t.description,`description`,`text`)),t.locationLat!==void 0&&s(m,[`location`,`lat`],a(t.locationLat,`locationLat`,`text`)),t.locationLon!==void 0&&s(m,[`location`,`lon`],a(t.locationLon,`locationLon`,`text`)),t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.secondaryConnectorId!==void 0&&s(m,[`secondary_connector_id`],a(t.secondaryConnectorId,`secondaryConnectorId`,`text`)),l(await f(`Updating site`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated site`})}},Fn={command:`create <siteId>`,describe:`Creates a new Site WAN.`,builder:e=>e.positional(`siteId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.siteId,`siteId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites wans create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/wans`,pathParams:{siteId:String(t.siteId??``)},bodyKind:`json`,body:{name:t.name,physport:t.physport,priority:t.priority,staticAddressingAddress:t.staticAddressingAddress,staticAddressingGatewayAddress:t.staticAddressingGatewayAddress,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Creating wan`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/wans`,{body:e})),{successLabel:`Created wan`});return}if(t.physport===void 0)throw Error(`--physport is required (or pass --body with this field set).`);let m={};t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.priority!==void 0&&s(m,[`priority`],t.priority),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingGatewayAddress!==void 0&&s(m,[`static_addressing`,`gateway_address`],a(t.staticAddressingGatewayAddress,`staticAddressingGatewayAddress`,`text`)),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Creating wan`,async()=>r.post(`/accounts/${p}/magic/sites/${t.siteId}/wans`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Created wan`})}},In={command:`delete <wanId>`,describe:`Remove a specific Site WAN.`,builder:e=>e.positional(`wanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(o(t.wanId,`wanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites wans delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/wans/${t.wanId??`<wanId>`}`,pathParams:{siteId:String(t.siteId??``),wanId:String(t.wanId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let a=await i(t),s=t.local?d:await n(a);if(t.accountId=s,!await r(`wan`,String(t.wanId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=c(t.body);l(await f(`Deleting wan`,async()=>a.delete(`/accounts/${s}/magic/sites/${t.siteId}/wans/${t.wanId}`,{body:e})),{successLabel:`Deleted wan`});return}l(await f(`Deleting wan`,async()=>a.magicTransit.sites.wans.delete(t.siteId,s,t.wanId)),{successLabel:`Deleted wan`})}},Ln={command:`edit <wanId>`,describe:`Patch a specific Site WAN.`,builder:e=>e.positional(`wanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.wanId,`wanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites wans edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/wans/${t.wanId??`<wanId>`}`,pathParams:{siteId:String(t.siteId??``),wanId:String(t.wanId??``)},bodyKind:`json`,body:{name:t.name,physport:t.physport,priority:t.priority,staticAddressingAddress:t.staticAddressingAddress,staticAddressingGatewayAddress:t.staticAddressingGatewayAddress,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating wan`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/wans/${t.wanId}`,{body:e})),{successLabel:`Updated wan`});return}let m={};t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.priority!==void 0&&s(m,[`priority`],t.priority),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingGatewayAddress!==void 0&&s(m,[`static_addressing`,`gateway_address`],a(t.staticAddressingGatewayAddress,`staticAddressingGatewayAddress`,`text`)),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Updating wan`,async()=>r.patch(`/accounts/${p}/magic/sites/${t.siteId}/wans/${t.wanId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated wan`})}},Rn={command:`get <wanId>`,describe:`Get a specific Site WAN.`,builder:e=>e.positional(`wanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{o(e.wanId,`wanId`);let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading wan`,async()=>t.magicTransit.sites.wans.get(e.siteId,r,e.wanId)),{successLabel:`Loaded wan`})}},zn={command:`list`,describe:`Lists Site WANs associated with an account.`,builder:e=>e.option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}),handler:async e=>{let t=await i(e),r=e.local?d:await n(t);e.accountId=r,l(await f(`Loading wans`,async()=>t.magicTransit.sites.wans.list(r,e.siteId)),{successLabel:`Loaded wans`})}},Bn={command:`update <wanId>`,describe:`Update a specific Site WAN.`,builder:e=>e.positional(`wanId`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`site-id`,{type:`string`,description:`Identifier`,demandOption:!0}).option(`name`,{type:`string`,description:`The name field`}).option(`physport`,{type:`number`,description:`The physport field`}).option(`priority`,{type:`number`,description:`The priority field`}).option(`static-addressing-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`static-addressing-gateway-address`,{type:`string`,description:`A valid IPv4 address.`}).option(`static-addressing-secondary-address`,{type:`string`,description:`A valid CIDR notation representing an IP range.`}).option(`vlan-tag`,{type:`number`,description:`VLAN ID. Use zero for untagged.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`static-addressing-address`,`static-addressing-gateway-address`,`static-addressing-secondary-address`].some(t=>e[t]!==void 0)){let t=[`static-addressing-address`,`static-addressing-gateway-address`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --static_addressing-* flag is set`)}return!0}),handler:async t=>{if(o(t.wanId,`wanId`),t.dryRun){let n=e();n&&o(n,`accountId`),u({command:`cf magic-transit sites wans update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/magic/sites/${t.siteId??`<siteId>`}/wans/${t.wanId??`<wanId>`}`,pathParams:{siteId:String(t.siteId??``),wanId:String(t.wanId??``)},bodyKind:`json`,body:{name:t.name,physport:t.physport,priority:t.priority,staticAddressingAddress:t.staticAddressingAddress,staticAddressingGatewayAddress:t.staticAddressingGatewayAddress,staticAddressingSecondaryAddress:t.staticAddressingSecondaryAddress,vlanTag:t.vlanTag,body:t.body},validation:`passed`});return}let r=await i(t),p=t.local?d:await n(r);if(t.accountId=p,t.body){let e=c(t.body);l(await f(`Updating wan`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/wans/${t.wanId}`,{body:e})),{successLabel:`Updated wan`});return}let m={};t.name!==void 0&&s(m,[`name`],a(t.name,`name`,`text`)),t.physport!==void 0&&s(m,[`physport`],t.physport),t.priority!==void 0&&s(m,[`priority`],t.priority),t.staticAddressingAddress!==void 0&&s(m,[`static_addressing`,`address`],a(t.staticAddressingAddress,`staticAddressingAddress`,`text`)),t.staticAddressingGatewayAddress!==void 0&&s(m,[`static_addressing`,`gateway_address`],a(t.staticAddressingGatewayAddress,`staticAddressingGatewayAddress`,`text`)),t.staticAddressingSecondaryAddress!==void 0&&s(m,[`static_addressing`,`secondary_address`],a(t.staticAddressingSecondaryAddress,`staticAddressingSecondaryAddress`,`text`)),t.vlanTag!==void 0&&s(m,[`vlan_tag`],t.vlanTag),l(await f(`Updating wan`,async()=>r.put(`/accounts/${p}/magic/sites/${t.siteId}/wans/${t.wanId}`,{body:Object.keys(m).length>0?m:void 0})),{successLabel:`Updated wan`})}},Vn={command:`wans`,describe:`Magic WAN branch sites with LAN/WAN interface configuration and connector assignments`,builder:e=>e.command(Fn).command(In).command(Ln).command(Rn).command(zn).command(Bn).demandCommand(1),handler:()=>{}},Hn={command:`sites`,describe:`Magic WAN branch sites with LAN/WAN interface configuration and connector assignments`,builder:e=>e.command(_n).command(vn).command(yn).command(bn).command(Dn).command(Pn).command(un).command(gn).command($).command(Nn).command(Vn).demandCommand(1),handler:()=>{}},Un={command:`magic-transit`,describe:`DDoS-protected network transit — GRE/IPsec tunnels, static routes, Magic WAN sites, connectors, and packet captures`,builder:e=>e.command(E).command(qe).command($e).command(it).command(xt).command(Ot).command(It).command(Jt).command(nn).command(Hn).demandCommand(1),handler:()=>{}};export{Un as default};