cf 0.0.6 → 0.2.0

package/dist/zero-trust-Btix6zOy.mjs

@@ -1,73 +0,0 @@
-#!/usr/bin/env node
-import{d as e,h as t,m as n,o as r,p as i,t as a,u as o}from"./auth-BHD_B2p9.mjs";import{n as s,r as c}from"./input-validation-BpVQi9rR.mjs";import{n as l,t as u}from"./body-parser-iA3vRFmh.mjs";import{t as d}from"./output-CqGQp2r6.mjs";import{t as f}from"./dry-run-FV0pZwdg.mjs";import{t as p}from"./local-OqhVQbv0.mjs";import{t as m}from"./progress-5sHFvwez.mjs";import{n as h,t as g}from"./raw-fetch-CxFs4i0R.mjs";const _={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:e=>e.option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`,default:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`portal id`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access ai-controls mcp portals create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/ai-controls/mcp/portals`,pathParams:{},bodyKind:`json`,body:{allowCodeMode:n.allowCodeMode,description:n.description,hostname:n.hostname,id:n.id,name:n.name,secureWebGateway:n.secureWebGateway,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating portal`,async()=>i.post(`/accounts/${o}/access/ai-controls/mcp/portals`,{body:e})),{successLabel:`Created portal`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,``)),n.id===void 0&&(n.id=await t(`id`,`portal id`)),n.name===void 0&&(n.name=await t(`name`,``));let h={};n.allowCodeMode!==void 0&&l(h,[`allow_code_mode`],n.allowCodeMode),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.hostname!==void 0&&l(h,[`hostname`],s(n.hostname,`hostname`,`text`)),n.id!==void 0&&l(h,[`id`],s(n.id,`id`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.secureWebGateway!==void 0&&l(h,[`secure_web_gateway`],n.secureWebGateway),d(await m(`Creating portal`,async()=>i.post(`/accounts/${o}/access/ai-controls/mcp/portals`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created portal`})}},v={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:e=>e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.id,`id`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access ai-controls mcp portals delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/ai-controls/mcp/portals/${t.id??`<id>`}`,pathParams:{id:String(t.id??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`portal`,String(t.id??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting portal`,async()=>n.zeroTrust.access.aiControls.mcp.portals.delete(o,t.id)),{successLabel:`Deleted portal`})}},ee={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:e=>e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name, hostname`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.search!==void 0&&(t.search=e.search);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading portals`,async()=>n.zeroTrust.access.aiControls.mcp.portals.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded portals`})}},te={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:e=>e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}),handler:async e=>{c(e.id,`id`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading portal`,async()=>t.zeroTrust.access.aiControls.mcp.portals.read(e.id,n)),{successLabel:`Loaded portal`})}},y={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:e=>e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`allow-code-mode`,{type:`boolean`,description:`Allow remote code execution in Dynamic Workers (beta)`}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`name`,{type:`string`,description:`The name field`}).option(`secure-web-gateway`,{type:`boolean`,description:`Route outbound MCP traffic through Zero Trust Secure Web Gateway`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.id,`id`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access ai-controls mcp portals update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/ai-controls/mcp/portals/${t.id??`<id>`}`,pathParams:{id:String(t.id??``)},bodyKind:`json`,body:{allowCodeMode:t.allowCodeMode,description:t.description,hostname:t.hostname,name:t.name,secureWebGateway:t.secureWebGateway,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating portal`,async()=>n.put(`/accounts/${i}/access/ai-controls/mcp/portals/${t.id}`,{body:e})),{successLabel:`Updated portal`});return}let o={};t.allowCodeMode!==void 0&&l(o,[`allow_code_mode`],t.allowCodeMode),t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.hostname!==void 0&&l(o,[`hostname`],s(t.hostname,`hostname`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.secureWebGateway!==void 0&&l(o,[`secure_web_gateway`],t.secureWebGateway),d(await m(`Updating portal`,async()=>n.put(`/accounts/${i}/access/ai-controls/mcp/portals/${t.id}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated portal`})}},b={command:`portals`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(_).command(v).command(ee).command(te).command(y).demandCommand(1),handler:()=>{}},x={command:`create`,describe:`Creates a new MCP portal for managing AI tool access through Cloudflare Access.`,builder:e=>e.option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`auth-type`,{type:`string`,description:`The auth_type field`,choices:[`oauth`,`bearer`,`unauthenticated`]}).option(`description`,{type:`string`,description:`The description field`}).option(`hostname`,{type:`string`,description:`The hostname field`}).option(`id`,{type:`string`,description:`server id`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access ai-controls mcp servers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/ai-controls/mcp/servers`,pathParams:{},bodyKind:`json`,body:{authCredentials:i.authCredentials,authType:i.authType,description:i.description,hostname:i.hostname,id:i.id,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating server`,async()=>o.post(`/accounts/${h}/access/ai-controls/mcp/servers`,{body:e})),{successLabel:`Created server`});return}i.authType===void 0&&(i.authType=await n(`auth-type`,``,[`oauth`,`bearer`,`unauthenticated`])),i.hostname===void 0&&(i.hostname=await t(`hostname`,``)),i.id===void 0&&(i.id=await t(`id`,`server id`)),i.name===void 0&&(i.name=await t(`name`,``));let g={};i.authCredentials!==void 0&&l(g,[`auth_credentials`],s(i.authCredentials,`authCredentials`,`text`)),i.authType!==void 0&&l(g,[`auth_type`],s(i.authType,`authType`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.hostname!==void 0&&l(g,[`hostname`],s(i.hostname,`hostname`,`text`)),i.id!==void 0&&l(g,[`id`],s(i.id,`id`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Creating server`,async()=>o.post(`/accounts/${h}/access/ai-controls/mcp/servers`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created server`})}},S={command:`delete <id>`,describe:`Deletes an MCP portal from the account.`,builder:e=>e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.id,`id`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access ai-controls mcp servers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/ai-controls/mcp/servers/${t.id??`<id>`}`,pathParams:{id:String(t.id??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`server`,String(t.id??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting server`,async()=>n.zeroTrust.access.aiControls.mcp.servers.delete(o,t.id)),{successLabel:`Deleted server`})}},C={command:`list`,describe:`Lists all MCP portals configured for the account.`,builder:e=>e.option(`page`,{type:`number`,description:`Page`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`search`,{type:`string`,description:`Search by id, name`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.search!==void 0&&(t.search=e.search);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading servers`,async()=>n.zeroTrust.access.aiControls.mcp.servers.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded servers`})}},w={command:`read <id>`,describe:`Retrieves gateway configuration for MCP portals.`,builder:e=>e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}),handler:async e=>{c(e.id,`id`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading server`,async()=>t.zeroTrust.access.aiControls.mcp.servers.read(n,e.id)),{successLabel:`Loaded server`})}},T={command:`sync <id>`,describe:`Syncs an MCP server's tool catalog with the portal.`,builder:e=>e.positional(`id`,{type:`string`,description:`portal id`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.id,`id`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access ai-controls mcp servers sync`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/ai-controls/mcp/servers/${t.id??`<id>`}/sync`,pathParams:{id:String(t.id??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating server`,async()=>n.zeroTrust.access.aiControls.mcp.servers.sync(t.id,i)),{successLabel:`Created server`})}},E={command:`update <id>`,describe:`Updates an MCP portal configuration.`,builder:e=>e.positional(`id`,{type:`string`,description:`server id`,demandOption:!0}).option(`auth-credentials`,{type:`string`,description:`The auth_credentials field`}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.id,`id`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access ai-controls mcp servers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/ai-controls/mcp/servers/${t.id??`<id>`}`,pathParams:{id:String(t.id??``)},bodyKind:`json`,body:{authCredentials:t.authCredentials,description:t.description,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating server`,async()=>n.put(`/accounts/${i}/access/ai-controls/mcp/servers/${t.id}`,{body:e})),{successLabel:`Updated server`});return}let o={};t.authCredentials!==void 0&&l(o,[`auth_credentials`],s(t.authCredentials,`authCredentials`,`text`)),t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating server`,async()=>n.put(`/accounts/${i}/access/ai-controls/mcp/servers/${t.id}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated server`})}},D={command:`servers`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(x).command(S).command(C).command(w).command(T).command(E).demandCommand(1),handler:()=>{}},O={command:`mcp`,describe:`Operations for access.ai-controls.mcp`,builder:e=>e.command(b).command(D).demandCommand(1),handler:()=>{}},k={command:`ai-controls`,describe:`Operations for access.ai-controls`,builder:e=>e.command(O).demandCommand(1),handler:()=>{}},A={command:`create <appId>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications cas create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/ca`,pathParams:{appId:String(t.appId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating ca`,async()=>n.zeroTrust.access.applications.cas.create(t.appId,i)),{successLabel:`Created ca`})}},j={command:`delete <appId>`,describe:`Deletes a short-lived certificate CA.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications cas delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/ca`,pathParams:{appId:String(t.appId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`ca`,String(t.appId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting ca`,async()=>n.zeroTrust.access.applications.cas.delete(t.appId,o)),{successLabel:`Deleted ca`})}},M={command:`get <appId>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.appId,`appId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading ca`,async()=>t.zeroTrust.access.applications.cas.get(e.appId,n)),{successLabel:`Loaded ca`})}},N={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading cas`,async()=>n.zeroTrust.access.applications.cas.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded cas`})}},P={command:`cas`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(A).command(j).command(M).command(N).demandCommand(1),handler:()=>{}},F={command:`create`,describe:`Adds a new application to Access.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating application`,async()=>n.post(`/accounts/${i}/access/apps`,{body:e})),{successLabel:`Created application`});return}d(await m(`Creating application`,async()=>n.zeroTrust.access.applications.create(i)),{successLabel:`Created application`})}},I={command:`delete <appId>`,describe:`Deletes an application from Access.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}`,pathParams:{appId:String(t.appId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`application`,String(t.appId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting application`,async()=>n.zeroTrust.access.applications.delete(t.appId,o)),{successLabel:`Deleted application`})}},L={command:`get <appId>`,describe:`Fetches information about an Access application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}),handler:async e=>{c(e.appId,`appId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading application`,async()=>t.zeroTrust.access.applications.get(e.appId,n)),{successLabel:`Loaded application`})}},R={command:`list`,describe:`Lists all Access applications in an account.`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the app.`}).option(`domain`,{type:`string`,description:`The domain of the app.`}).option(`aud`,{type:`string`,description:`The aud of the app.`}).option(`target-attributes`,{type:`string`,description:`Target Criteria attributes in key=value format.`}).option(`exact`,{type:`boolean`,description:`True for only exact string matches against passed name/domain query parameters.`,default:!1}).option(`search`,{type:`string`,description:`Search for apps by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.domain!==void 0&&(t.domain=e.domain),e.aud!==void 0&&(t.aud=e.aud),e.targetAttributes!==void 0&&(t.target_attributes=e.targetAttributes),e.exact!==void 0&&(t.exact=e.exact),e.search!==void 0&&(t.search=e.search),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading applications`,async()=>n.zeroTrust.access.applications.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded applications`})}},z={command:`create <appId>`,describe:`Creates a policy applying exclusive to a single application that defines the users or groups who can reach it. We recommend creating a reusable policy instead and subsequently referencing its ID in the application's 'policies' array.`,builder:e=>e.positional(`appId`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app. `}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.",default:`24h`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(c(i.appId,`appId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access applications policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/apps/${i.appId??`<appId>`}/policies`,pathParams:{appId:String(i.appId??``)},bodyKind:`json`,body:{precedence:i.precedence,approvalRequired:i.approvalRequired,connectionRulesRdpAllowedClipboardLocalToRemoteFormats:i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats,connectionRulesRdpAllowedClipboardRemoteToLocalFormats:i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats,isolationRequired:i.isolationRequired,mfaConfigAllowedAuthenticators:i.mfaConfigAllowedAuthenticators,mfaConfigMfaDisabled:i.mfaConfigMfaDisabled,mfaConfigSessionDuration:i.mfaConfigSessionDuration,purposeJustificationPrompt:i.purposeJustificationPrompt,purposeJustificationRequired:i.purposeJustificationRequired,sessionDuration:i.sessionDuration,decision:i.decision,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating policy`,async()=>o.post(`/accounts/${h}/access/apps/${i.appId}/policies`,{body:e})),{successLabel:`Created policy`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await t(`name`,`The name of the Access policy.`));let g={};i.precedence!==void 0&&l(g,[`precedence`],i.precedence),i.approvalRequired!==void 0&&l(g,[`approval_required`],i.approvalRequired),i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats!==void 0&&l(g,[`connection_rules`,`rdp`,`allowed_clipboard_local_to_remote_formats`],i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats),i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats!==void 0&&l(g,[`connection_rules`,`rdp`,`allowed_clipboard_remote_to_local_formats`],i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats),i.isolationRequired!==void 0&&l(g,[`isolation_required`],i.isolationRequired),i.mfaConfigAllowedAuthenticators!==void 0&&l(g,[`mfa_config`,`allowed_authenticators`],i.mfaConfigAllowedAuthenticators),i.mfaConfigMfaDisabled!==void 0&&l(g,[`mfa_config`,`mfa_disabled`],i.mfaConfigMfaDisabled),i.mfaConfigSessionDuration!==void 0&&l(g,[`mfa_config`,`session_duration`],s(i.mfaConfigSessionDuration,`mfaConfigSessionDuration`,`text`)),i.purposeJustificationPrompt!==void 0&&l(g,[`purpose_justification_prompt`],s(i.purposeJustificationPrompt,`purposeJustificationPrompt`,`text`)),i.purposeJustificationRequired!==void 0&&l(g,[`purpose_justification_required`],i.purposeJustificationRequired),i.sessionDuration!==void 0&&l(g,[`session_duration`],s(i.sessionDuration,`sessionDuration`,`text`)),i.decision!==void 0&&l(g,[`decision`],s(i.decision,`decision`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Creating policy`,async()=>o.post(`/accounts/${h}/access/apps/${i.appId}/policies`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created policy`})}},B={command:`delete <policyId>`,describe:`Deletes an Access policy specific to an application. To delete a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/policies/${t.policyId??`<policyId>`}`,pathParams:{appId:String(t.appId??``),policyId:String(t.policyId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`policy`,String(t.policyId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting policy`,async()=>n.zeroTrust.access.applications.policies.delete(t.appId,t.policyId,o)),{successLabel:`Deleted policy`})}},V={command:`get <policyId>`,describe:`Fetches a single Access policy configured for an application. Returns both exclusively owned and reusable policies used by the application.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading policy`,async()=>t.zeroTrust.access.applications.policies.get(e.appId,e.policyId,n)),{successLabel:`Loaded policy`})}},H={command:`list`,describe:`Lists Access policies configured for an application. Returns both exclusively scoped and reusable policies used by the application.`,builder:e=>e.option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading policies`,async()=>n.zeroTrust.access.applications.policies.list(e.appId,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded policies`})}},U={command:`update <policyId>`,describe:`Updates an Access policy specific to an application. To update a reusable policy, use the /accounts/{account_id}/policies/{uid} endpoint.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy within an app. `}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`}).option(`connection-rules-rdp-allowed-clipboard-local-to-remote-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from local machine to remote RDP session.`}).option(`connection-rules-rdp-allowed-clipboard-remote-to-local-formats`,{type:`string`,array:!0,description:`Clipboard formats allowed when copying from remote RDP session to local machine.`}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-mfa-disabled`,{type:`boolean`,description:`Indicates whether to disable MFA for this resource. This option is available at the application and policy level.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for the application will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.",default:`24h`}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(c(i.policyId,`policyId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access applications policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/apps/${i.appId??`<appId>`}/policies/${i.policyId??`<policyId>`}`,pathParams:{appId:String(i.appId??``),policyId:String(i.policyId??``)},bodyKind:`json`,body:{precedence:i.precedence,approvalRequired:i.approvalRequired,connectionRulesRdpAllowedClipboardLocalToRemoteFormats:i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats,connectionRulesRdpAllowedClipboardRemoteToLocalFormats:i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats,isolationRequired:i.isolationRequired,mfaConfigAllowedAuthenticators:i.mfaConfigAllowedAuthenticators,mfaConfigMfaDisabled:i.mfaConfigMfaDisabled,mfaConfigSessionDuration:i.mfaConfigSessionDuration,purposeJustificationPrompt:i.purposeJustificationPrompt,purposeJustificationRequired:i.purposeJustificationRequired,sessionDuration:i.sessionDuration,decision:i.decision,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating policy`,async()=>o.put(`/accounts/${h}/access/apps/${i.appId}/policies/${i.policyId}`,{body:e})),{successLabel:`Updated policy`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await t(`name`,`The name of the Access policy.`));let g={};i.precedence!==void 0&&l(g,[`precedence`],i.precedence),i.approvalRequired!==void 0&&l(g,[`approval_required`],i.approvalRequired),i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats!==void 0&&l(g,[`connection_rules`,`rdp`,`allowed_clipboard_local_to_remote_formats`],i.connectionRulesRdpAllowedClipboardLocalToRemoteFormats),i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats!==void 0&&l(g,[`connection_rules`,`rdp`,`allowed_clipboard_remote_to_local_formats`],i.connectionRulesRdpAllowedClipboardRemoteToLocalFormats),i.isolationRequired!==void 0&&l(g,[`isolation_required`],i.isolationRequired),i.mfaConfigAllowedAuthenticators!==void 0&&l(g,[`mfa_config`,`allowed_authenticators`],i.mfaConfigAllowedAuthenticators),i.mfaConfigMfaDisabled!==void 0&&l(g,[`mfa_config`,`mfa_disabled`],i.mfaConfigMfaDisabled),i.mfaConfigSessionDuration!==void 0&&l(g,[`mfa_config`,`session_duration`],s(i.mfaConfigSessionDuration,`mfaConfigSessionDuration`,`text`)),i.purposeJustificationPrompt!==void 0&&l(g,[`purpose_justification_prompt`],s(i.purposeJustificationPrompt,`purposeJustificationPrompt`,`text`)),i.purposeJustificationRequired!==void 0&&l(g,[`purpose_justification_required`],i.purposeJustificationRequired),i.sessionDuration!==void 0&&l(g,[`session_duration`],s(i.sessionDuration,`sessionDuration`,`text`)),i.decision!==void 0&&l(g,[`decision`],s(i.decision,`decision`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Updating policy`,async()=>o.put(`/accounts/${h}/access/apps/${i.appId}/policies/${i.policyId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated policy`})}},W={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(z).command(B).command(V).command(H).command(U).demandCommand(1),handler:()=>{}},G={command:`create`,describe:`Starts an Access policy test.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications policy-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/policy-tests`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating policy test`,async()=>n.post(`/accounts/${i}/access/policy-tests`,{body:e})),{successLabel:`Created policy test`});return}d(await m(`Creating policy test`,async()=>n.zeroTrust.access.applications.policyTests.create(i)),{successLabel:`Created policy test`})}},K={command:`get <policyTestId>`,describe:`Fetches the current status of a given Access policy test.`,builder:e=>e.positional(`policyTestId`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}),handler:async e=>{c(e.policyTestId,`policyTestId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading policy test`,async()=>t.zeroTrust.access.applications.policyTests.get(n,e.policyTestId)),{successLabel:`Loaded policy test`})}},q={command:`list`,describe:`Fetches a single page of user results from an Access policy test.`,builder:e=>e.option(`policy-test-id`,{type:`string`,description:`The UUID of the policy test.`,demandOption:!0}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Per page`}).option(`status`,{type:`string`,description:`Filter users by their policy evaluation status.`,choices:[`success`,`fail`,`error`]}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.status!==void 0&&(t.status=e.status);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading users`,async()=>n.zeroTrust.access.applications.policyTests.users.list(i,e.policyTestId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded users`})}},J={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(q).demandCommand(1),handler:()=>{}},Y={command:`policy-tests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(G).command(K).command(J).demandCommand(1),handler:()=>{}},X={command:`revoke-tokens <appId>`,describe:`Revokes all tokens issued for an application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications revoke-tokens`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/revoke_tokens`,pathParams:{appId:String(t.appId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`application`,String(t.appId??``),{force:!!t.force,message:`This operation invalidates every service token for the app.`})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting application`,async()=>n.zeroTrust.access.applications.revokeTokens(t.appId,o)),{successLabel:`Deleted application`})}},Z={command:`edit <appId>`,describe:`Updates Access application settings.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/settings`,pathParams:{appId:String(t.appId??``)},bodyKind:`json`,body:{allowIframe:t.allowIframe,skipInterstitial:t.skipInterstitial,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/access/apps/${t.appId}/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.allowIframe!==void 0&&l(o,[`allow_iframe`],t.allowIframe),t.skipInterstitial!==void 0&&l(o,[`skip_interstitial`],t.skipInterstitial),d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/access/apps/${t.appId}/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},Q={command:`update <appId>`,describe:`Updates Access application settings.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/settings`,pathParams:{appId:String(t.appId??``)},bodyKind:`json`,body:{allowIframe:t.allowIframe,skipInterstitial:t.skipInterstitial,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/access/apps/${t.appId}/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.allowIframe!==void 0&&l(o,[`allow_iframe`],t.allowIframe),t.skipInterstitial!==void 0&&l(o,[`skip_interstitial`],t.skipInterstitial),d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/access/apps/${t.appId}/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},ne={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Z).command(Q).demandCommand(1),handler:()=>{}},re={command:`update <appId>`,describe:`Updates an Access application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.appId,`appId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access applications update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}`,pathParams:{appId:String(t.appId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating application`,async()=>n.put(`/accounts/${i}/access/apps/${t.appId}`,{body:e})),{successLabel:`Updated application`});return}d(await m(`Updating application`,async()=>n.zeroTrust.access.applications.update(t.appId,i)),{successLabel:`Updated application`})}},ie={command:`list`,describe:`Tests if a specific user has permission to access an application.`,builder:e=>e.option(`app-id`,{type:`string`,description:`App ID`,demandOption:!0}),handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading user policy checks`,async()=>t.zeroTrust.access.applications.userPolicyChecks.list(e.appId,n)),{successLabel:`Loaded user policy checks`})}},ae={command:`user-policy-checks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ie).demandCommand(1),handler:()=>{}},oe={command:`applications`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(F).command(I).command(L).command(R).command(X).command(re).command(P).command(W).command(Y).command(ne).command(ae).demandCommand(1),handler:()=>{}},se={command:`create <bookmarkId>`,describe:`Create a new Bookmark application.`,builder:e=>e.positional(`bookmarkId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.bookmarkId,`bookmarkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access bookmarks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/bookmarks/${t.bookmarkId??`<bookmarkId>`}`,pathParams:{bookmarkId:String(t.bookmarkId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating bookmark`,async()=>n.post(`/accounts/${i}/access/bookmarks/${t.bookmarkId}`,{body:e})),{successLabel:`Created bookmark`});return}d(await m(`Creating bookmark`,async()=>n.zeroTrust.access.bookmarks.create(t.bookmarkId,i)),{successLabel:`Created bookmark`})}},ce={command:`delete <bookmarkId>`,describe:`Deletes a Bookmark application.`,builder:e=>e.positional(`bookmarkId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.bookmarkId,`bookmarkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access bookmarks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/bookmarks/${t.bookmarkId??`<bookmarkId>`}`,pathParams:{bookmarkId:String(t.bookmarkId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`bookmark`,String(t.bookmarkId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting bookmark`,async()=>n.delete(`/accounts/${o}/access/bookmarks/${t.bookmarkId}`,{body:e})),{successLabel:`Deleted bookmark`});return}d(await m(`Deleting bookmark`,async()=>n.zeroTrust.access.bookmarks.delete(t.bookmarkId,o)),{successLabel:`Deleted bookmark`})}},le={command:`get <bookmarkId>`,describe:`Fetches a single Bookmark application.`,builder:e=>e.positional(`bookmarkId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.bookmarkId,`bookmarkId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading bookmark`,async()=>t.zeroTrust.access.bookmarks.get(e.bookmarkId,n)),{successLabel:`Loaded bookmark`})}},ue={command:`list`,describe:`Lists Bookmark applications.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading bookmarks`,async()=>t.zeroTrust.access.bookmarks.list(n)),{successLabel:`Loaded bookmarks`})}},de={command:`update <bookmarkId>`,describe:`Updates a configured Bookmark application.`,builder:e=>e.positional(`bookmarkId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.bookmarkId,`bookmarkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access bookmarks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/bookmarks/${t.bookmarkId??`<bookmarkId>`}`,pathParams:{bookmarkId:String(t.bookmarkId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating bookmark`,async()=>n.put(`/accounts/${i}/access/bookmarks/${t.bookmarkId}`,{body:e})),{successLabel:`Updated bookmark`});return}d(await m(`Updating bookmark`,async()=>n.zeroTrust.access.bookmarks.update(t.bookmarkId,i)),{successLabel:`Updated bookmark`})}},fe={command:`bookmarks`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(se).command(ce).command(le).command(ue).command(de).demandCommand(1),handler:()=>{}},pe={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:e=>e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/certificates`,pathParams:{},bodyKind:`json`,body:{associatedHostnames:n.associatedHostnames,certificate:n.certificate,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating certificate`,async()=>i.post(`/accounts/${o}/access/certificates`,{body:e})),{successLabel:`Created certificate`});return}n.certificate===void 0&&(n.certificate=await t(`certificate`,`The certificate content.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the certificate.`));let h={};n.associatedHostnames!==void 0&&l(h,[`associated_hostnames`],n.associatedHostnames),n.certificate!==void 0&&l(h,[`certificate`],s(n.certificate,`certificate`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating certificate`,async()=>i.post(`/accounts/${o}/access/certificates`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created certificate`})}},me={command:`delete <certificateId>`,describe:`Deletes an mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/certificates/${t.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`certificate`,String(t.certificateId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting certificate`,async()=>n.zeroTrust.access.certificates.delete(t.certificateId,o)),{successLabel:`Deleted certificate`})}},he={command:`get <certificateId>`,describe:`Fetches a single mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.certificateId,`certificateId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading certificate`,async()=>t.zeroTrust.access.certificates.get(e.certificateId,n)),{successLabel:`Loaded certificate`})}},ge={command:`list`,describe:`Lists all mTLS root certificates.`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading certificates`,async()=>n.zeroTrust.access.certificates.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded certificates`})}},_e={command:`get`,describe:`List all mTLS hostname settings for this account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading setting`,async()=>t.zeroTrust.access.certificates.settings.get(n)),{successLabel:`Loaded setting`})}},ve={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/certificates/settings`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/access/certificates/settings`,{body:e})),{successLabel:`Updated setting`});return}d(await m(`Updating setting`,async()=>n.zeroTrust.access.certificates.settings.update(i)),{successLabel:`Updated setting`})}},ye={command:`settings`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(_e).command(ve).demandCommand(1),handler:()=>{}},be={command:`update <certificateId>`,describe:`Updates a configured mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/certificates/${t.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`json`,body:{associatedHostnames:t.associatedHostnames,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating certificate`,async()=>n.put(`/accounts/${i}/access/certificates/${t.certificateId}`,{body:e})),{successLabel:`Updated certificate`});return}if(t.associatedHostnames===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let o={};t.associatedHostnames!==void 0&&l(o,[`associated_hostnames`],t.associatedHostnames),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating certificate`,async()=>n.put(`/accounts/${i}/access/certificates/${t.certificateId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated certificate`})}},xe={command:`certificates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(pe).command(me).command(he).command(ge).command(be).command(ye).demandCommand(1),handler:()=>{}},Se={command:`create`,describe:`Create a custom page`,builder:e=>e.option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access custom-pages create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/custom_pages`,pathParams:{},bodyKind:`json`,body:{appCount:i.appCount,customHtml:i.customHtml,name:i.name,type:i.type,uid:i.uid,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating custom page`,async()=>o.post(`/accounts/${h}/access/custom_pages`,{body:e})),{successLabel:`Created custom page`});return}i.customHtml===void 0&&(i.customHtml=await t(`custom-html`,`Custom page HTML.`)),i.name===void 0&&(i.name=await t(`name`,`Custom page name.`)),i.type===void 0&&(i.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let g={};i.appCount!==void 0&&l(g,[`app_count`],i.appCount),i.customHtml!==void 0&&l(g,[`custom_html`],s(i.customHtml,`customHtml`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),i.uid!==void 0&&l(g,[`uid`],s(i.uid,`uid`,`text`)),d(await m(`Creating custom page`,async()=>o.post(`/accounts/${h}/access/custom_pages`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created custom page`})}},Ce={command:`delete <customPageId>`,describe:`Delete a custom page`,builder:e=>e.positional(`customPageId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.customPageId,`customPageId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access custom-pages delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/custom_pages/${t.customPageId??`<customPageId>`}`,pathParams:{customPageId:String(t.customPageId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`custom page`,String(t.customPageId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting custom page`,async()=>n.zeroTrust.access.customPages.delete(t.customPageId,o)),{successLabel:`Deleted custom page`})}},we={command:`get <customPageId>`,describe:`Fetches a custom page and also returns its HTML.`,builder:e=>e.positional(`customPageId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.customPageId,`customPageId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom page`,async()=>t.zeroTrust.access.customPages.get(e.customPageId,n)),{successLabel:`Loaded custom page`})}},Te={command:`list`,describe:`List custom pages`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading custom pages`,async()=>n.zeroTrust.access.customPages.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded custom pages`})}},Ee={command:`update <customPageId>`,describe:`Update a custom page`,builder:e=>e.positional(`customPageId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-count`,{type:`number`,description:`Number of apps the custom page is assigned to.`}).option(`custom-html`,{type:`string`,description:`Custom page HTML.`}).option(`name`,{type:`string`,description:`Custom page name.`}).option(`type`,{type:`string`,description:`Custom page type.`,choices:[`identity_denied`,`forbidden`]}).option(`uid`,{type:`string`,description:`UUID.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(c(i.customPageId,`customPageId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access custom-pages update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/custom_pages/${i.customPageId??`<customPageId>`}`,pathParams:{customPageId:String(i.customPageId??``)},bodyKind:`json`,body:{appCount:i.appCount,customHtml:i.customHtml,name:i.name,type:i.type,uid:i.uid,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating custom page`,async()=>o.put(`/accounts/${h}/access/custom_pages/${i.customPageId}`,{body:e})),{successLabel:`Updated custom page`});return}i.customHtml===void 0&&(i.customHtml=await t(`custom-html`,`Custom page HTML.`)),i.name===void 0&&(i.name=await t(`name`,`Custom page name.`)),i.type===void 0&&(i.type=await n(`type`,`Custom page type.`,[`identity_denied`,`forbidden`]));let g={};i.appCount!==void 0&&l(g,[`app_count`],i.appCount),i.customHtml!==void 0&&l(g,[`custom_html`],s(i.customHtml,`customHtml`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),i.uid!==void 0&&l(g,[`uid`],s(i.uid,`uid`,`text`)),d(await m(`Updating custom page`,async()=>o.put(`/accounts/${h}/access/custom_pages/${i.customPageId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated custom page`})}},De={command:`custom-pages`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Se).command(Ce).command(we).command(Te).command(Ee).demandCommand(1),handler:()=>{}},Oe={command:`create`,describe:`Adds a new SSH Certificate Authority (CA).`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access gateway-ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/gateway_ca`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating gateway ca`,async()=>n.zeroTrust.access.gatewayCa.create(i)),{successLabel:`Created gateway ca`})}},ke={command:`delete <certificateId>`,describe:`Deletes an SSH Certificate Authority.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access gateway-ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/gateway_ca/${t.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`gateway ca`,String(t.certificateId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting gateway ca`,async()=>n.zeroTrust.access.gatewayCa.delete(t.certificateId,o)),{successLabel:`Deleted gateway ca`})}},Ae={command:`list`,describe:`Lists SSH Certificate Authorities (CA).`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading gateway ca`,async()=>t.zeroTrust.access.gatewayCa.list(n)),{successLabel:`Loaded gateway ca`})}},je={command:`gateway-ca`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Oe).command(ke).command(Ae).demandCommand(1),handler:()=>{}},Me={command:`create`,describe:`Creates a new Access group.`,builder:e=>e.option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/groups`,pathParams:{},bodyKind:`json`,body:{isDefault:n.isDefault,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating group`,async()=>i.post(`/accounts/${o}/access/groups`,{body:e})),{successLabel:`Created group`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the Access group.`));let h={};n.isDefault!==void 0&&l(h,[`is_default`],n.isDefault),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating group`,async()=>i.post(`/accounts/${o}/access/groups`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created group`})}},Ne={command:`delete <groupId>`,describe:`Deletes an Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.groupId,`groupId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/groups/${t.groupId??`<groupId>`}`,pathParams:{groupId:String(t.groupId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`group`,String(t.groupId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting group`,async()=>n.zeroTrust.access.groups.delete(t.groupId,o)),{successLabel:`Deleted group`})}},Pe={command:`get <groupId>`,describe:`Fetches a single Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.groupId,`groupId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading group`,async()=>t.zeroTrust.access.groups.get(e.groupId,n)),{successLabel:`Loaded group`})}},Fe={command:`list`,describe:`Lists all Access groups.`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the group.`}).option(`search`,{type:`string`,description:`Search for groups by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.search!==void 0&&(t.search=e.search),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading groups`,async()=>n.zeroTrust.access.groups.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded groups`})}},Ie={command:`update <groupId>`,describe:`Updates a configured Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`is-default`,{type:`boolean`,description:`Whether this is the default group`}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.groupId,`groupId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/groups/${n.groupId??`<groupId>`}`,pathParams:{groupId:String(n.groupId??``)},bodyKind:`json`,body:{isDefault:n.isDefault,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating group`,async()=>i.put(`/accounts/${o}/access/groups/${n.groupId}`,{body:e})),{successLabel:`Updated group`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the Access group.`));let h={};n.isDefault!==void 0&&l(h,[`is_default`],n.isDefault),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating group`,async()=>i.put(`/accounts/${o}/access/groups/${n.groupId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated group`})}},Le={command:`groups`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Me).command(Ne).command(Pe).command(Fe).command(Ie).demandCommand(1),handler:()=>{}},Re={command:`bulk-delete-v2`,describe:`Removes one or more targets.`,builder:e=>e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access infrastructure targets bulk-delete-v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/infrastructure/targets/batch_delete`,pathParams:{},bodyKind:`json`,body:{targetIds:t.targetIds,body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`targets`,``,{force:!!t.force,message:`This operation bulk-deletes infrastructure targets destructively.`})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting targets`,async()=>n.post(`/accounts/${o}/infrastructure/targets/batch_delete`,{body:e})),{successLabel:`Deleted targets`});return}if(t.targetIds===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let s={};t.targetIds!==void 0&&l(s,[`target_ids`],t.targetIds),d(await m(`Deleting targets`,async()=>n.post(`/accounts/${o}/infrastructure/targets/batch_delete`,{body:Object.keys(s).length>0?s:void 0})),{successLabel:`Deleted targets`})}},ze={command:`bulk-delete`,describe:`Removes one or more targets.`,builder:e=>e.option(`target-ids`,{type:`string`,array:!0,description:`List of target IDs to bulk delete`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access infrastructure targets bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:{targetIds:t.targetIds,body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`targets`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting targets`,async()=>n.delete(`/accounts/${o}/infrastructure/targets/batch`,{body:e})),{successLabel:`Deleted targets`});return}if(t.targetIds===void 0)throw Error(`--target-ids is required (or pass --body with this field set).`);let s={};t.targetIds!==void 0&&l(s,[`target_ids`],t.targetIds),d(await m(`Deleting targets`,async()=>n.delete(`/accounts/${o}/infrastructure/targets/batch`,{body:Object.keys(s).length>0?s:void 0})),{successLabel:`Deleted targets`})}},Be={command:`bulk-update`,describe:`Adds one or more targets.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access infrastructure targets bulk-update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/infrastructure/targets/batch`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating targets`,async()=>n.put(`/accounts/${i}/infrastructure/targets/batch`,{body:e})),{successLabel:`Updated targets`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ve={command:`create`,describe:`Creates a new infrastructure access target for secure access through Cloudflare Access. Targets can be servers, databases, or other infrastructure.`,builder:e=>e.option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access infrastructure targets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/infrastructure/targets`,pathParams:{},bodyKind:`json`,body:{hostname:n.hostname,ipIpv4IpAddr:n.ipIpv4IpAddr,ipIpv4VirtualNetworkId:n.ipIpv4VirtualNetworkId,ipIpv6IpAddr:n.ipIpv6IpAddr,ipIpv6VirtualNetworkId:n.ipIpv6VirtualNetworkId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating target`,async()=>i.post(`/accounts/${o}/infrastructure/targets`,{body:e})),{successLabel:`Created target`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let h={};n.hostname!==void 0&&l(h,[`hostname`],s(n.hostname,`hostname`,`text`)),n.ipIpv4IpAddr!==void 0&&l(h,[`ip`,`ipv4`,`ip_addr`],s(n.ipIpv4IpAddr,`ipIpv4IpAddr`,`text`)),n.ipIpv4VirtualNetworkId!==void 0&&l(h,[`ip`,`ipv4`,`virtual_network_id`],s(n.ipIpv4VirtualNetworkId,`ipIpv4VirtualNetworkId`,`text`)),n.ipIpv6IpAddr!==void 0&&l(h,[`ip`,`ipv6`,`ip_addr`],s(n.ipIpv6IpAddr,`ipIpv6IpAddr`,`text`)),n.ipIpv6VirtualNetworkId!==void 0&&l(h,[`ip`,`ipv6`,`virtual_network_id`],s(n.ipIpv6VirtualNetworkId,`ipIpv6VirtualNetworkId`,`text`)),d(await m(`Creating target`,async()=>i.post(`/accounts/${o}/infrastructure/targets`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created target`})}},He={command:`delete <targetId>`,describe:`Removes an infrastructure access target. The target will no longer be accessible through Cloudflare Access.`,builder:e=>e.positional(`targetId`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.targetId,`targetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access infrastructure targets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/infrastructure/targets/${t.targetId??`<targetId>`}`,pathParams:{targetId:String(t.targetId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`target`,String(t.targetId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting target`,async()=>n.zeroTrust.access.infrastructure.targets.delete(o,t.targetId)),{successLabel:`Deleted target`})}},Ue={command:`get <targetId>`,describe:`Retrieves details for a specific infrastructure access target, including its hostname, IP, and access configuration.`,builder:e=>e.positional(`targetId`,{type:`string`,description:`Target identifier`,demandOption:!0}),handler:async e=>{c(e.targetId,`targetId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading target`,async()=>t.zeroTrust.access.infrastructure.targets.get(n,e.targetId)),{successLabel:`Loaded target`})}},We={command:`list`,describe:`Lists and sorts an account’s targets. Filters are optional and are ANDed together.`,builder:e=>e.option(`hostname`,{type:`string`,description:`Hostname of a target`}).option(`hostname-contains`,{type:`string`,description:`Partial match to the hostname of a target`}).option(`virtual-network-id`,{type:`string`,description:`Private virtual network identifier of the target`}).option(`ip-v4`,{type:`string`,description:`IPv4 address of the target`}).option(`ip-v6`,{type:`string`,description:`IPv6 address of the target`}).option(`created-before`,{type:`string`,description:`Date and time at which the target was created before (inclusive)`}).option(`created-after`,{type:`string`,description:`Date and time at which the target was created after (inclusive)`}).option(`modified-before`,{type:`string`,description:`Date and time at which the target was modified before (inclusive)`}).option(`modified-after`,{type:`string`,description:`Date and time at which the target was modified after (inclusive)`}).option(`ips`,{type:`string`,description:"Filters for targets that have any of the following IP addresses. Specify `ips` multiple times in query parameter to build list of candidates."}).option(`target-ids`,{type:`string`,description:"Filters for targets that have any of the following UUIDs. Specify `target_ids` multiple times in query parameter to build list of candidates."}).option(`ip-like`,{type:`string`,description:"Filters for targets whose IP addresses look like the specified string. Supports `*` as a wildcard character"}).option(`ipv4-start`,{type:`string`,description:"Defines an IPv4 filter range's starting value (inclusive). Requires `ipv4_end` to be specified as well."}).option(`ipv4-end`,{type:`string`,description:"Defines an IPv4 filter range's ending value (inclusive). Requires `ipv4_start` to be specified as well."}).option(`ipv6-start`,{type:`string`,description:"Defines an IPv6 filter range's starting value (inclusive). Requires `ipv6_end` to be specified as well."}).option(`ipv6-end`,{type:`string`,description:"Defines an IPv6 filter range's ending value (inclusive). Requires `ipv6_start` to be specified as well."}).option(`page`,{type:`number`,description:`Current page in the response`}).option(`per-page`,{type:`number`,description:`Max amount of entries returned per page`}).option(`order`,{type:`string`,description:`The field to sort by.`,choices:[`hostname`,`created_at`]}).option(`direction`,{type:`string`,description:`The sorting direction.`}),handler:async e=>{let t={};e.hostname!==void 0&&(t.hostname=e.hostname),e.hostnameContains!==void 0&&(t.hostname_contains=e.hostnameContains),e.virtualNetworkId!==void 0&&(t.virtual_network_id=e.virtualNetworkId),e.ipV4!==void 0&&(t.ip_v4=e.ipV4),e.ipV6!==void 0&&(t.ip_v6=e.ipV6),e.createdBefore!==void 0&&(t.created_before=e.createdBefore),e.createdAfter!==void 0&&(t.created_after=e.createdAfter),e.modifiedBefore!==void 0&&(t.modified_before=e.modifiedBefore),e.modifiedAfter!==void 0&&(t.modified_after=e.modifiedAfter),e.ips!==void 0&&(t.ips=e.ips),e.targetIds!==void 0&&(t.target_ids=e.targetIds),e.ipLike!==void 0&&(t.ip_like=e.ipLike),e.ipv4Start!==void 0&&(t.ipv4_start=e.ipv4Start),e.ipv4End!==void 0&&(t.ipv4_end=e.ipv4End),e.ipv6Start!==void 0&&(t.ipv6_start=e.ipv6Start),e.ipv6End!==void 0&&(t.ipv6_end=e.ipv6End),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.order!==void 0&&(t.order=e.order),e.direction!==void 0&&(t.direction=e.direction);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading targets`,async()=>n.zeroTrust.access.infrastructure.targets.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded targets`})}},Ge={command:`update <targetId>`,describe:`Updates an existing infrastructure access target's configuration, including connection parameters and access policies.`,builder:e=>e.positional(`targetId`,{type:`string`,description:`Target identifier`,demandOption:!0}).option(`hostname`,{type:`string`,description:`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`}).option(`ip-ipv4-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv4-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`ip-ipv6-ip-addr`,{type:`string`,description:`IP address of the target`}).option(`ip-ipv6-virtual-network-id`,{type:`string`,description:`(optional) Private virtual network identifier for the target. If omitted, the default virtual network ID will be used.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.targetId,`targetId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access infrastructure targets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/infrastructure/targets/${n.targetId??`<targetId>`}`,pathParams:{targetId:String(n.targetId??``)},bodyKind:`json`,body:{hostname:n.hostname,ipIpv4IpAddr:n.ipIpv4IpAddr,ipIpv4VirtualNetworkId:n.ipIpv4VirtualNetworkId,ipIpv6IpAddr:n.ipIpv6IpAddr,ipIpv6VirtualNetworkId:n.ipIpv6VirtualNetworkId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating target`,async()=>i.put(`/accounts/${o}/infrastructure/targets/${n.targetId}`,{body:e})),{successLabel:`Updated target`});return}n.hostname===void 0&&(n.hostname=await t(`hostname`,`A non-unique field that refers to a target. Case insensitive, maximum length of 255 characters, supports the use of special characters dash and period, does not support spaces, and must start and end with an alphanumeric character.`));let h={};n.hostname!==void 0&&l(h,[`hostname`],s(n.hostname,`hostname`,`text`)),n.ipIpv4IpAddr!==void 0&&l(h,[`ip`,`ipv4`,`ip_addr`],s(n.ipIpv4IpAddr,`ipIpv4IpAddr`,`text`)),n.ipIpv4VirtualNetworkId!==void 0&&l(h,[`ip`,`ipv4`,`virtual_network_id`],s(n.ipIpv4VirtualNetworkId,`ipIpv4VirtualNetworkId`,`text`)),n.ipIpv6IpAddr!==void 0&&l(h,[`ip`,`ipv6`,`ip_addr`],s(n.ipIpv6IpAddr,`ipIpv6IpAddr`,`text`)),n.ipIpv6VirtualNetworkId!==void 0&&l(h,[`ip`,`ipv6`,`virtual_network_id`],s(n.ipIpv6VirtualNetworkId,`ipIpv6VirtualNetworkId`,`text`)),d(await m(`Updating target`,async()=>i.put(`/accounts/${o}/infrastructure/targets/${n.targetId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated target`})}},Ke={command:`targets`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ze).command(Re).command(Be).command(Ve).command(He).command(Ue).command(We).command(Ge).demandCommand(1),handler:()=>{}},qe={command:`infrastructure`,describe:`Operations for access.infrastructure`,builder:e=>e.command(Ke).demandCommand(1),handler:()=>{}},Je={command:`get`,describe:`Gets the Access key rotation settings for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading key`,async()=>t.zeroTrust.access.keys.get(n)),{successLabel:`Loaded key`})}},Ye={command:`rotate`,describe:`Perfoms a key rotation for an account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access keys rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/keys/rotate`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating key`,async()=>n.zeroTrust.access.keys.rotate(i)),{successLabel:`Created key`})}},Xe={command:`update`,describe:`Updates the Access key rotation settings for an account.`,builder:e=>e.option(`key-rotation-interval-days`,{type:`number`,description:`The number of days between key rotations.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access keys update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/keys`,pathParams:{},bodyKind:`json`,body:{keyRotationIntervalDays:t.keyRotationIntervalDays,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating key`,async()=>n.put(`/accounts/${i}/access/keys`,{body:e})),{successLabel:`Updated key`});return}if(t.keyRotationIntervalDays===void 0)throw Error(`--key-rotation-interval-days is required (or pass --body with this field set).`);let o={};t.keyRotationIntervalDays!==void 0&&l(o,[`key_rotation_interval_days`],t.keyRotationIntervalDays),d(await m(`Updating key`,async()=>n.put(`/accounts/${i}/access/keys`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated key`})}},Ze={command:`keys`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Je).command(Ye).command(Xe).demandCommand(1),handler:()=>{}},Qe={command:`list`,describe:`Gets a list of Access authentication audit logs for an account.`,builder:e=>e.option(`limit`,{type:`number`,description:`The maximum number of log entries to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological sorting order for the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`The earliest event timestamp to query.`}).option(`until`,{type:`string`,description:`The latest event timestamp to query.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}).option(`email`,{type:`string`,description:"Filter by user email. Defaults to substring matching. To force exact matching, set `email_exact=true`. Example (default): `email=@example.com` returns all events with that domain. Example (exact): `email=user@example.com&email_exact=true` returns only that user."}).option(`email-exact`,{type:`boolean`,description:"When true, `email` is matched exactly instead of substring matching.",default:!1}).option(`user-id`,{type:`string`,description:`Filter by user UUID.`}).option(`allowed-op`,{type:`string`,description:"Operator for the `allowed` filter.",choices:[`eq`,`neq`]}).option(`country-code-op`,{type:`string`,description:"Operator for the `country_code` filter.",choices:[`eq`,`neq`]}).option(`app-type-op`,{type:`string`,description:"Operator for the `app_type` filter.",choices:[`eq`,`neq`]}).option(`app-uid-op`,{type:`string`,description:"Operator for the `app_uid` filter.",choices:[`eq`,`neq`]}).option(`ray-id-op`,{type:`string`,description:"Operator for the `ray_id` filter.",choices:[`eq`,`neq`]}).option(`email-op`,{type:`string`,description:"Operator for the `email` filter.",choices:[`eq`,`neq`]}).option(`idp-op`,{type:`string`,description:"Operator for the `idp` filter.",choices:[`eq`,`neq`]}).option(`non-identity-op`,{type:`string`,description:"Operator for the `non_identity` filter.",choices:[`eq`,`neq`]}).option(`user-id-op`,{type:`string`,description:"Operator for the `user_id` filter.",choices:[`eq`,`neq`]}).option(`fields`,{type:`string`,description:`Comma-separated list of fields to include in the response. When omitted, all fields are returned.`}),handler:async e=>{let t={};e.limit!==void 0&&(t.limit=e.limit),e.direction!==void 0&&(t.direction=e.direction),e.since!==void 0&&(t.since=e.since),e.until!==void 0&&(t.until=e.until),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.email!==void 0&&(t.email=e.email),e.emailExact!==void 0&&(t.email_exact=e.emailExact),e.userId!==void 0&&(t.user_id=e.userId),e.allowedOp!==void 0&&(t.allowedOp=e.allowedOp),e.countryCodeop!==void 0&&(t.country_codeOp=e.countryCodeop),e.appTypeop!==void 0&&(t.app_typeOp=e.appTypeop),e.appUidop!==void 0&&(t.app_uidOp=e.appUidop),e.rayIdop!==void 0&&(t.ray_idOp=e.rayIdop),e.emailOp!==void 0&&(t.emailOp=e.emailOp),e.idpOp!==void 0&&(t.idpOp=e.idpOp),e.nonIdentityop!==void 0&&(t.non_identityOp=e.nonIdentityop),e.userIdop!==void 0&&(t.user_idOp=e.userIdop),e.fields!==void 0&&(t.fields=e.fields);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading access requests`,async()=>n.zeroTrust.access.logs.accessRequests.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded access requests`})}},$e={command:`access-requests`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Qe).demandCommand(1),handler:()=>{}},et={command:`list`,describe:`Lists Access SCIM update logs that maintain a record of updates made to User and Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:e=>e.option(`limit`,{type:`string`,description:`The maximum number of update logs to retrieve.`}).option(`direction`,{type:`string`,description:`The chronological order used to sort the logs.`,choices:[`desc`,`asc`]}).option(`since`,{type:`string`,description:`the timestamp of the earliest update log.`}).option(`until`,{type:`string`,description:`the timestamp of the most-recent update log.`}).option(`idp-id`,{type:`string`,description:`The unique Id of the IdP that has SCIM enabled.`,demandOption:!0}).option(`status`,{type:`string`,description:`The status of the SCIM request.`}).option(`resource-type`,{type:`string`,description:`The resource type of the SCIM request.`}).option(`request-method`,{type:`string`,description:`The request method of the SCIM request.`}).option(`resource-user-email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`resource-group-name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM resource.`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.limit!==void 0&&(t.limit=e.limit),e.direction!==void 0&&(t.direction=e.direction),e.since!==void 0&&(t.since=e.since),e.until!==void 0&&(t.until=e.until),e.idpId!==void 0&&(t.idp_id=e.idpId),e.status!==void 0&&(t.status=e.status),e.resourceType!==void 0&&(t.resource_type=e.resourceType),e.requestMethod!==void 0&&(t.request_method=e.requestMethod),e.resourceUserEmail!==void 0&&(t.resource_user_email=e.resourceUserEmail),e.resourceGroupName!==void 0&&(t.resource_group_name=e.resourceGroupName),e.cfResourceId!==void 0&&(t.cf_resource_id=e.cfResourceId),e.idpResourceId!==void 0&&(t.idp_resource_id=e.idpResourceId),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading updates`,async()=>n.zeroTrust.access.logs.scim.updates.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded updates`})}},tt={command:`updates`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(et).demandCommand(1),handler:()=>{}},nt={command:`scim`,describe:`Operations for access.logs.scim`,builder:e=>e.command(tt).demandCommand(1),handler:()=>{}},rt={command:`logs`,describe:`Operations for access.logs`,builder:e=>e.command($e).command(nt).demandCommand(1),handler:()=>{}},it={command:`create`,describe:`Creates a new Access reusable policy.`,builder:e=>e.option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/policies`,pathParams:{},bodyKind:`json`,body:{decision:i.decision,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating policy`,async()=>o.post(`/accounts/${h}/access/policies`,{body:e})),{successLabel:`Created policy`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await t(`name`,`The name of the Access policy.`));let g={};i.decision!==void 0&&l(g,[`decision`],s(i.decision,`decision`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Creating policy`,async()=>o.post(`/accounts/${h}/access/policies`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created policy`})}},at={command:`delete <policyId>`,describe:`Deletes an Access reusable policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/policies/${t.policyId??`<policyId>`}`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`policy`,String(t.policyId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting policy`,async()=>n.zeroTrust.access.policies.delete(o,t.policyId)),{successLabel:`Deleted policy`})}},ot={command:`get <policyId>`,describe:`Fetches a single Access reusable policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading policy`,async()=>t.zeroTrust.access.policies.get(n,e.policyId)),{successLabel:`Loaded policy`})}},st={command:`list`,describe:`Lists Access reusable policies.`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading policies`,async()=>n.zeroTrust.access.policies.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded policies`})}},ct={command:`update <policyId>`,describe:`Updates a Access reusable policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The UUID of the policy`,demandOption:!0}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(c(i.policyId,`policyId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/policies/${i.policyId??`<policyId>`}`,pathParams:{policyId:String(i.policyId??``)},bodyKind:`json`,body:{decision:i.decision,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating policy`,async()=>o.put(`/accounts/${h}/access/policies/${i.policyId}`,{body:e})),{successLabel:`Updated policy`});return}i.decision===void 0&&(i.decision=await n(`decision`,`The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.`,[`allow`,`deny`,`non_identity`,`bypass`])),i.name===void 0&&(i.name=await t(`name`,`The name of the Access policy.`));let g={};i.decision!==void 0&&l(g,[`decision`],s(i.decision,`decision`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Updating policy`,async()=>o.put(`/accounts/${h}/access/policies/${i.policyId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated policy`})}},lt={command:`policies`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(it).command(at).command(ot).command(st).command(ct).demandCommand(1),handler:()=>{}},ut={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to rotate the Client Secret or create a new service token.`,builder:e=>e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/service_tokens`,pathParams:{},bodyKind:`json`,body:{clientSecretVersion:n.clientSecretVersion,duration:n.duration,name:n.name,previousClientSecretExpiresAt:n.previousClientSecretExpiresAt,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating service token`,async()=>i.post(`/accounts/${o}/access/service_tokens`,{body:e})),{successLabel:`Created service token`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the service token.`));let h={};n.clientSecretVersion!==void 0&&l(h,[`client_secret_version`],n.clientSecretVersion),n.duration!==void 0&&l(h,[`duration`],s(n.duration,`duration`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.previousClientSecretExpiresAt!==void 0&&l(h,[`previous_client_secret_expires_at`],s(n.previousClientSecretExpiresAt,`previousClientSecretExpiresAt`,`text`)),d(await m(`Creating service token`,async()=>i.post(`/accounts/${o}/access/service_tokens`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created service token`})}},dt={command:`delete <serviceTokenId>`,describe:`Deletes a service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.serviceTokenId,`serviceTokenId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/service_tokens/${t.serviceTokenId??`<serviceTokenId>`}`,pathParams:{serviceTokenId:String(t.serviceTokenId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`service token`,String(t.serviceTokenId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting service token`,async()=>n.zeroTrust.access.serviceTokens.delete(t.serviceTokenId,o)),{successLabel:`Deleted service token`})}},ft={command:`get <serviceTokenId>`,describe:`Fetches a single service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.serviceTokenId,`serviceTokenId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading service token`,async()=>t.zeroTrust.access.serviceTokens.get(e.serviceTokenId,n)),{successLabel:`Loaded service token`})}},pt={command:`list`,describe:`Lists all service tokens.`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the service token.`}).option(`search`,{type:`string`,description:`Search for service tokens by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.search!==void 0&&(t.search=e.search),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading service tokens`,async()=>n.zeroTrust.access.serviceTokens.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded service tokens`})}},mt={command:`refresh <serviceTokenId>`,describe:`Refreshes the expiration of a service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.serviceTokenId,`serviceTokenId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access service-tokens refresh`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/service_tokens/${t.serviceTokenId??`<serviceTokenId>`}/refresh`,pathParams:{serviceTokenId:String(t.serviceTokenId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating service token`,async()=>n.zeroTrust.access.serviceTokens.refresh(t.serviceTokenId,i)),{successLabel:`Created service token`})}},ht={command:`rotate <serviceTokenId>`,describe:`Generates a new Client Secret for a service token and revokes the old one.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. If not provided, it defaults to the current timestamp in order to immediately expire the previous secret."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.serviceTokenId,`serviceTokenId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access service-tokens rotate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/service_tokens/${t.serviceTokenId??`<serviceTokenId>`}/rotate`,pathParams:{serviceTokenId:String(t.serviceTokenId??``)},bodyKind:`json`,body:{previousClientSecretExpiresAt:t.previousClientSecretExpiresAt,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating service token`,async()=>n.post(`/accounts/${i}/access/service_tokens/${t.serviceTokenId}/rotate`,{body:e})),{successLabel:`Created service token`});return}let o={};t.previousClientSecretExpiresAt!==void 0&&l(o,[`previous_client_secret_expires_at`],s(t.previousClientSecretExpiresAt,`previousClientSecretExpiresAt`,`text`)),d(await m(`Creating service token`,async()=>n.post(`/accounts/${i}/access/service_tokens/${t.serviceTokenId}/rotate`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created service token`})}},gt={command:`update <serviceTokenId>`,describe:`Updates a configured service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.serviceTokenId,`serviceTokenId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/service_tokens/${t.serviceTokenId??`<serviceTokenId>`}`,pathParams:{serviceTokenId:String(t.serviceTokenId??``)},bodyKind:`json`,body:{clientSecretVersion:t.clientSecretVersion,duration:t.duration,name:t.name,previousClientSecretExpiresAt:t.previousClientSecretExpiresAt,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating service token`,async()=>n.put(`/accounts/${i}/access/service_tokens/${t.serviceTokenId}`,{body:e})),{successLabel:`Updated service token`});return}let o={};t.clientSecretVersion!==void 0&&l(o,[`client_secret_version`],t.clientSecretVersion),t.duration!==void 0&&l(o,[`duration`],s(t.duration,`duration`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.previousClientSecretExpiresAt!==void 0&&l(o,[`previous_client_secret_expires_at`],s(t.previousClientSecretExpiresAt,`previousClientSecretExpiresAt`,`text`)),d(await m(`Updating service token`,async()=>n.put(`/accounts/${i}/access/service_tokens/${t.serviceTokenId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated service token`})}},_t={command:`service-tokens`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(ut).command(dt).command(ft).command(pt).command(mt).command(ht).command(gt).demandCommand(1),handler:()=>{}},vt={command:`create`,describe:`Create a tag`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access tags create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/tags`,pathParams:{},bodyKind:`json`,body:{name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating tag`,async()=>n.post(`/accounts/${i}/access/tags`,{body:e})),{successLabel:`Created tag`});return}let o={};t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Creating tag`,async()=>n.post(`/accounts/${i}/access/tags`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created tag`})}},yt={command:`delete <tagName>`,describe:`Delete a tag`,builder:e=>e.positional(`tagName`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.tagName,`tagName`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access tags delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/tags/${t.tagName??`<tagName>`}`,pathParams:{tagName:String(t.tagName??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`tag`,String(t.tagName??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting tag`,async()=>n.zeroTrust.access.tags.delete(o,t.tagName)),{successLabel:`Deleted tag`})}},bt={command:`get <tagName>`,describe:`Get a tag`,builder:e=>e.positional(`tagName`,{type:`string`,description:`The name of the tag`,demandOption:!0}),handler:async e=>{c(e.tagName,`tagName`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading tag`,async()=>t.zeroTrust.access.tags.get(n,e.tagName)),{successLabel:`Loaded tag`})}},xt={command:`list`,describe:`List tags`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading tags`,async()=>n.zeroTrust.access.tags.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded tags`})}},St={command:`update <tagName>`,describe:`Update a tag`,builder:e=>e.positional(`tagName`,{type:`string`,description:`The name of the tag`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the tag`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A tag`}),handler:async n=>{if(c(n.tagName,`tagName`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access tags update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/tags/${n.tagName??`<tagName>`}`,pathParams:{tagName:String(n.tagName??``)},bodyKind:`json`,body:{name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating tag`,async()=>i.put(`/accounts/${o}/access/tags/${n.tagName}`,{body:e})),{successLabel:`Updated tag`});return}n.name===void 0&&(n.name=await t(`name`,`The name of the tag`));let h={};n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating tag`,async()=>i.put(`/accounts/${o}/access/tags/${n.tagName}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated tag`})}},Ct={command:`tags`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(vt).command(yt).command(bt).command(xt).command(St).demandCommand(1),handler:()=>{}},wt={command:`get <nonce>`,describe:`Get an active session for a single user.`,builder:e=>e.positional(`nonce`,{type:`string`,description:`Nonce`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.nonce,`nonce`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading active session`,async()=>t.zeroTrust.access.users.activeSessions.get(e.userId,n,e.nonce)),{successLabel:`Loaded active session`})}},Tt={command:`list`,describe:`Get active sessions for a single user.`,builder:e=>e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading active sessions`,async()=>t.zeroTrust.access.users.activeSessions.list(e.userId,n)),{successLabel:`Loaded active sessions`})}},Et={command:`active-sessions`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(wt).command(Tt).demandCommand(1),handler:()=>{}},Dt={command:`create`,describe:`Creates a new user.`,builder:e=>e.option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access users create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/users`,pathParams:{},bodyKind:`json`,body:{email:n.email,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating user`,async()=>i.post(`/accounts/${o}/access/users`,{body:e})),{successLabel:`Created user`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user.`));let h={};n.email!==void 0&&l(h,[`email`],s(n.email,`email`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating user`,async()=>i.post(`/accounts/${o}/access/users`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created user`})}},Ot={command:`delete <userId>`,describe:`Deletes a specific user for an account. This will also revoke any active seats and tokens for the user.`,builder:e=>e.positional(`userId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.userId,`userId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust access users delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/users/${t.userId??`<userId>`}`,pathParams:{userId:String(t.userId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`user`,String(t.userId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting user`,async()=>n.zeroTrust.access.users.delete(t.userId,o)),{successLabel:`Deleted user`})}},kt={command:`list`,describe:`Get all failed login attempts for a single user.`,builder:e=>e.option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading failed logins`,async()=>t.zeroTrust.access.users.failedLogins.list(e.userId,n)),{successLabel:`Loaded failed logins`})}},At={command:`failed-logins`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(kt).demandCommand(1),handler:()=>{}},jt={command:`get <userId>`,describe:`Gets a specific user for an account.`,builder:e=>e.positional(`userId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.userId,`userId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading user`,async()=>t.zeroTrust.access.users.get(e.userId,n)),{successLabel:`Loaded user`})}},Mt={command:`get <userId>`,describe:`Get last seen identity for a single user.`,builder:e=>e.positional(`userId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.userId,`userId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading last seen identity`,async()=>t.zeroTrust.access.users.lastSeenIdentity.get(e.userId,n)),{successLabel:`Loaded last seen identity`})}},Nt={command:`last-seen-identity`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Mt).demandCommand(1),handler:()=>{}},Pt={command:`list`,describe:`Gets a list of users for an account.`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the user.`}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`search`,{type:`string`,description:`Search for users by other listed query parameters.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.email!==void 0&&(t.email=e.email),e.search!==void 0&&(t.search=e.search),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading users`,async()=>n.zeroTrust.access.users.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded users`})}},Ft={command:`update <userId>`,describe:`Updates a specific user's name for an account. Requires the user's current email as confirmation (email cannot be changed).`,builder:e=>e.positional(`userId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`email`,{type:`string`,description:`The email of the user.`}).option(`name`,{type:`string`,description:`The name of the user.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.userId,`userId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust access users update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/users/${n.userId??`<userId>`}`,pathParams:{userId:String(n.userId??``)},bodyKind:`json`,body:{email:n.email,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating user`,async()=>i.put(`/accounts/${o}/access/users/${n.userId}`,{body:e})),{successLabel:`Updated user`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the user.`));let h={};n.email!==void 0&&l(h,[`email`],s(n.email,`email`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating user`,async()=>i.put(`/accounts/${o}/access/users/${n.userId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated user`})}},It={command:`users`,describe:`Access applications, policies, certificates, service tokens, groups, bookmarks, tags, and custom pages`,builder:e=>e.command(Dt).command(Ot).command(jt).command(Pt).command(Ft).command(Et).command(At).command(Nt).demandCommand(1),handler:()=>{}},Lt={command:`access`,describe:`Operations for access`,builder:e=>e.command(k).command(oe).command(fe).command(xe).command(De).command(je).command(Le).command(qe).command(Ze).command(rt).command(lt).command(_t).command(Ct).command(It).demandCommand(1),handler:()=>{}},Rt={command:`create <appId>`,describe:`Generates a new short-lived certificate CA and public key.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps ca create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/ca`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Creating ca`,async()=>t.zeroTrust.apps.ca.create(e.appId,n)),{successLabel:`Created ca`})}},zt={command:`delete <appId>`,describe:`Deletes a short-lived certificate CA.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps ca delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/ca`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`ca`,String(e.appId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting ca`,async()=>t.zeroTrust.apps.ca.delete(e.appId,n)),{successLabel:`Deleted ca`})}},Bt={command:`get <appId>`,describe:`Fetches a short-lived certificate CA and its public key.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.appId,`appId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading ca`,async()=>t.zeroTrust.apps.ca.get(e.appId,n)),{successLabel:`Loaded ca`})}},Vt={command:`list`,describe:`Lists short-lived certificate CAs and their public keys.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading ca`,async()=>t.zeroTrust.apps.ca.list(n)),{successLabel:`Loaded ca`})}},Ht={command:`ca`,describe:`Apps operations`,builder:e=>e.command(Rt).command(zt).command(Bt).command(Vt).demandCommand(1),handler:()=>{}},Ut={command:`create`,describe:`Adds a new application to Access.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust apps create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{body:e.body},validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let n=u(e.body);d(await m(`Creating app`,async()=>t.post(`/zones/${e.zoneId}/access/apps`,{body:n})),{successLabel:`Created app`});return}d(await m(`Creating app`,async()=>t.zeroTrust.apps.create(n)),{successLabel:`Created app`})}},Wt={command:`delete <appId>`,describe:`Deletes an application from Access.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`app`,String(e.appId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting app`,async()=>t.zeroTrust.apps.delete(e.appId,n)),{successLabel:`Deleted app`})}},Gt={command:`get <appId>`,describe:`Fetches information about an Access application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}),handler:async e=>{c(e.appId,`appId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading app`,async()=>t.zeroTrust.apps.get(e.appId,n)),{successLabel:`Loaded app`})}},Kt={command:`list`,describe:`List all Access Applications in a zone.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading apps`,async()=>t.zeroTrust.apps.list(n)),{successLabel:`Loaded apps`})}},qt={command:`create <appId>`,describe:`Create a new Access policy for an application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps policies create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/policies`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{approvalRequired:e.approvalRequired,decision:e.decision,isolationRequired:e.isolationRequired,name:e.name,precedence:e.precedence,purposeJustificationPrompt:e.purposeJustificationPrompt,purposeJustificationRequired:e.purposeJustificationRequired,body:e.body},validation:`passed`});return}let r=await a(e);if(e.zoneId=await o({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Creating policy`,async()=>r.post(`/zones/${e.zoneId}/access/apps/${e.appId}/policies`,{body:t})),{successLabel:`Created policy`});return}e.decision===void 0&&(e.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let i={};e.approvalRequired!==void 0&&l(i,[`approval_required`],e.approvalRequired),e.decision!==void 0&&l(i,[`decision`],s(e.decision,`decision`,`text`)),e.isolationRequired!==void 0&&l(i,[`isolation_required`],e.isolationRequired),e.name!==void 0&&l(i,[`name`],s(e.name,`name`,`text`)),e.precedence!==void 0&&l(i,[`precedence`],e.precedence),e.purposeJustificationPrompt!==void 0&&l(i,[`purpose_justification_prompt`],s(e.purposeJustificationPrompt,`purposeJustificationPrompt`,`text`)),e.purposeJustificationRequired!==void 0&&l(i,[`purpose_justification_required`],e.purposeJustificationRequired),d(await m(`Creating policy`,async()=>r.post(`/zones/${e.zoneId}/access/apps/${e.appId}/policies`,{body:Object.keys(i).length>0?i:void 0})),{successLabel:`Created policy`})}},Jt={command:`delete <policyId>`,describe:`Delete an Access policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.policyId,`policyId`),e.dryRun){f({command:`cf zero-trust apps policies delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/policies/${e.policyId??`<policyId>`}`,pathParams:{policyId:String(e.policyId??``),appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`policy`,String(e.policyId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting policy`,async()=>t.zeroTrust.apps.policies.delete(e.policyId,e.appId,n)),{successLabel:`Deleted policy`})}},Yt={command:`get <policyId>`,describe:`Fetches a single Access policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading policy`,async()=>t.zeroTrust.apps.policies.get(e.policyId,e.appId,n)),{successLabel:`Loaded policy`})}},Xt={command:`list`,describe:`Lists Access policies configured for an application.`,builder:e=>e.option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading policies`,async()=>t.zeroTrust.apps.policies.list(e.appId,n)),{successLabel:`Loaded policies`})}},Zt={command:`update <policyId>`,describe:`Converts an application-scoped policy to a reusable policy. The policy will no longer be exclusively scoped to the application. Further updates to the policy should go through the /accounts/{account_id}/policies/{uid} endpoint.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`The policy ID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`The application ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust apps policies make reusable update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/apps/${t.appId??`<appId>`}/policies/${t.policyId??`<policyId>`}/make_reusable`,pathParams:{appId:String(t.appId??``),policyId:String(t.policyId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Updating reusable`,async()=>n.zeroTrust.apps.policies.make.reusable.update(t.appId,t.policyId,i)),{successLabel:`Updated reusable`})}},Qt={command:`reusable`,describe:`Apps operations`,builder:e=>e.command(Zt).demandCommand(1),handler:()=>{}},$t={command:`make`,describe:`Operations for apps.policies.make`,builder:e=>e.command(Qt).demandCommand(1),handler:()=>{}},en={command:`update <policyId>`,describe:`Update a configured Access policy.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`app-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`approval-required`,{type:`boolean`,description:`Requires the user to request access from an administrator at the start of each session.`,default:!1}).option(`decision`,{type:`string`,description:`The action Access will take if a user matches this policy.`,choices:[`allow`,`deny`,`non_identity`,`bypass`]}).option(`isolation-required`,{type:`boolean`,description:`Require this application to be served in an isolated browser for users matching this policy.`,default:!1}).option(`name`,{type:`string`,description:`The name of the Access policy.`}).option(`precedence`,{type:`number`,description:`The order of execution for this policy. Must be unique for each policy.`}).option(`purpose-justification-prompt`,{type:`string`,description:`A custom message that will appear on the purpose justification screen.`}).option(`purpose-justification-required`,{type:`boolean`,description:`Require users to enter a justification when they log in to the application.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.policyId,`policyId`),e.dryRun){f({command:`cf zero-trust apps policies update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/policies/${e.policyId??`<policyId>`}`,pathParams:{policyId:String(e.policyId??``),appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{approvalRequired:e.approvalRequired,decision:e.decision,isolationRequired:e.isolationRequired,name:e.name,precedence:e.precedence,purposeJustificationPrompt:e.purposeJustificationPrompt,purposeJustificationRequired:e.purposeJustificationRequired,body:e.body},validation:`passed`});return}let r=await a(e);if(e.zoneId=await o({zone:e.zone},r,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Updating policy`,async()=>r.put(`/zones/${e.zoneId}/access/apps/${e.appId}/policies/${e.policyId}`,{body:t})),{successLabel:`Updated policy`});return}e.decision===void 0&&(e.decision=await n(`decision`,`The action Access will take if a user matches this policy.`,[`allow`,`deny`,`non_identity`,`bypass`])),e.name===void 0&&(e.name=await t(`name`,`The name of the Access policy.`));let i={};e.approvalRequired!==void 0&&l(i,[`approval_required`],e.approvalRequired),e.decision!==void 0&&l(i,[`decision`],s(e.decision,`decision`,`text`)),e.isolationRequired!==void 0&&l(i,[`isolation_required`],e.isolationRequired),e.name!==void 0&&l(i,[`name`],s(e.name,`name`,`text`)),e.precedence!==void 0&&l(i,[`precedence`],e.precedence),e.purposeJustificationPrompt!==void 0&&l(i,[`purpose_justification_prompt`],s(e.purposeJustificationPrompt,`purposeJustificationPrompt`,`text`)),e.purposeJustificationRequired!==void 0&&l(i,[`purpose_justification_required`],e.purposeJustificationRequired),d(await m(`Updating policy`,async()=>r.put(`/zones/${e.zoneId}/access/apps/${e.appId}/policies/${e.policyId}`,{body:Object.keys(i).length>0?i:void 0})),{successLabel:`Updated policy`})}},tn={command:`policies`,describe:`Apps operations`,builder:e=>e.command(qt).command(Jt).command(Yt).command(Xt).command(en).command($t).demandCommand(1),handler:()=>{}},nn={command:`list`,describe:`Retrieve the statuses of your applications.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading status`,async()=>t.zeroTrust.apps.review.status.list(n)),{successLabel:`Loaded status`})}},rn={command:`update`,describe:`Update the statuses of your applications.`,builder:e=>e.option(`approved-apps`,{type:`string`,array:!0,description:`Contains the ids of the approved applications.`}).option(`in-review-apps`,{type:`string`,array:!0,description:`Contains the ids of the applications in review.`}).option(`unapproved-apps`,{type:`string`,array:!0,description:`Contains the ids of the unapproved applications.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust apps review status update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/apps/review_status`,pathParams:{},bodyKind:`json`,body:{approvedApps:t.approvedApps,inReviewApps:t.inReviewApps,unapprovedApps:t.unapprovedApps,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating status`,async()=>n.put(`/accounts/${i}/gateway/apps/review_status`,{body:e})),{successLabel:`Updated status`});return}if(t.approvedApps===void 0)throw Error(`--approved-apps is required (or pass --body with this field set).`);if(t.inReviewApps===void 0)throw Error(`--in-review-apps is required (or pass --body with this field set).`);if(t.unapprovedApps===void 0)throw Error(`--unapproved-apps is required (or pass --body with this field set).`);let o={};t.approvedApps!==void 0&&l(o,[`approved_apps`],t.approvedApps),t.inReviewApps!==void 0&&l(o,[`in_review_apps`],t.inReviewApps),t.unapprovedApps!==void 0&&l(o,[`unapproved_apps`],t.unapprovedApps),d(await m(`Updating status`,async()=>n.put(`/accounts/${i}/gateway/apps/review_status`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated status`})}},an={command:`status`,describe:`Apps operations`,builder:e=>e.command(nn).command(rn).demandCommand(1),handler:()=>{}},on={command:`review`,describe:`Operations for apps.review`,builder:e=>e.command(an).demandCommand(1),handler:()=>{}},sn={command:`create <appId>`,describe:`Revokes all tokens issued for an application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps revoke tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/revoke_tokens`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`token`,String(e.appId??``),{force:!!e.force,message:`This operation revokes all service tokens for the application.`})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting token`,async()=>t.zeroTrust.apps.revoke.tokens.create(e.appId,n)),{successLabel:`Deleted token`})}},cn={command:`tokens`,describe:`Apps operations`,builder:e=>e.command(sn).demandCommand(1),handler:()=>{}},ln={command:`revoke`,describe:`Operations for apps.revoke`,builder:e=>e.command(cn).demandCommand(1),handler:()=>{}},un={command:`edit <appId>`,describe:`Updates application settings.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/settings`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{allowIframe:e.allowIframe,skipInterstitial:e.skipInterstitial,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating setting`,async()=>t.patch(`/zones/${e.zoneId}/access/apps/${e.appId}/settings`,{body:n})),{successLabel:`Updated setting`});return}let n={};e.allowIframe!==void 0&&l(n,[`allow_iframe`],e.allowIframe),e.skipInterstitial!==void 0&&l(n,[`skip_interstitial`],e.skipInterstitial),d(await m(`Updating setting`,async()=>t.patch(`/zones/${e.zoneId}/access/apps/${e.appId}/settings`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated setting`})}},dn={command:`update <appId>`,describe:`Updates application settings.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`allow-iframe`,{type:`boolean`,description:`Enables loading application content in an iFrame.`}).option(`skip-interstitial`,{type:`boolean`,description:`Enables automatic authentication through cloudflared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}/settings`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{allowIframe:e.allowIframe,skipInterstitial:e.skipInterstitial,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating setting`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${e.appId}/settings`,{body:n})),{successLabel:`Updated setting`});return}let n={};e.allowIframe!==void 0&&l(n,[`allow_iframe`],e.allowIframe),e.skipInterstitial!==void 0&&l(n,[`skip_interstitial`],e.skipInterstitial),d(await m(`Updating setting`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${e.appId}/settings`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated setting`})}},fn={command:`settings`,describe:`Apps operations`,builder:e=>e.command(un).command(dn).demandCommand(1),handler:()=>{}},pn={command:`update <appId>`,describe:`Updates an Access application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.appId,`appId`),e.dryRun){f({command:`cf zero-trust apps update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/apps/${e.appId??`<appId>`}`,pathParams:{appId:String(e.appId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{body:e.body},validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let n=u(e.body);d(await m(`Updating app`,async()=>t.put(`/zones/${e.zoneId}/access/apps/${e.appId}`,{body:n})),{successLabel:`Updated app`});return}d(await m(`Updating app`,async()=>t.zeroTrust.apps.update(e.appId,n)),{successLabel:`Updated app`})}},mn={command:`get <appId>`,describe:`Tests if a specific user has permission to access an application.`,builder:e=>e.positional(`appId`,{type:`string`,description:`App ID`,demandOption:!0}),handler:async e=>{c(e.appId,`appId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading check`,async()=>t.zeroTrust.apps.user.policy.checks.get(e.appId,n)),{successLabel:`Loaded check`})}},hn={command:`checks`,describe:`Apps operations`,builder:e=>e.command(mn).demandCommand(1),handler:()=>{}},gn={command:`policy`,describe:`Operations for apps.user.policy`,builder:e=>e.command(hn).demandCommand(1),handler:()=>{}},_n={command:`user`,describe:`Operations for apps.user`,builder:e=>e.command(gn).demandCommand(1),handler:()=>{}},vn={command:`apps`,describe:`Apps operations`,builder:e=>e.command(Ut).command(Wt).command(Gt).command(Kt).command(pn).command(Ht).command(tn).command(on).command(ln).command(fn).command(_n).demandCommand(1),handler:()=>{}},yn={command:`create`,describe:`Adds a new mTLS root certificate to Access.`,builder:e=>e.option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`certificate`,{type:`string`,description:`The certificate content.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/certificates`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{associatedHostnames:e.associatedHostnames,certificate:e.certificate,name:e.name,body:e.body},validation:`passed`});return}let n=await a(e);if(e.zoneId=await o({zone:e.zone},n,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Creating certificate`,async()=>n.post(`/zones/${e.zoneId}/access/certificates`,{body:t})),{successLabel:`Created certificate`});return}e.certificate===void 0&&(e.certificate=await t(`certificate`,`The certificate content.`)),e.name===void 0&&(e.name=await t(`name`,`The name of the certificate.`));let r={};e.associatedHostnames!==void 0&&l(r,[`associated_hostnames`],e.associatedHostnames),e.certificate!==void 0&&l(r,[`certificate`],s(e.certificate,`certificate`,`text`)),e.name!==void 0&&l(r,[`name`],s(e.name,`name`,`text`)),d(await m(`Creating certificate`,async()=>n.post(`/zones/${e.zoneId}/access/certificates`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Created certificate`})}},bn={command:`delete <certificateId>`,describe:`Deletes an mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.certificateId,`certificateId`),e.dryRun){f({command:`cf zero-trust certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/certificates/${e.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(e.certificateId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`certificate`,String(e.certificateId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting certificate`,async()=>t.zeroTrust.certificates.delete(e.certificateId,n)),{successLabel:`Deleted certificate`})}},xn={command:`get <certificateId>`,describe:`Fetches a single mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.certificateId,`certificateId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading certificate`,async()=>t.zeroTrust.certificates.get(e.certificateId,n)),{successLabel:`Loaded certificate`})}},Sn={command:`list`,describe:`Lists all mTLS certificates.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading certificates`,async()=>t.zeroTrust.certificates.list(n)),{successLabel:`Loaded certificates`})}},Cn={command:`list`,describe:`List all mTLS hostname settings for this zone.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading settings`,async()=>t.zeroTrust.certificates.settings.list(n)),{successLabel:`Loaded settings`})}},wn={command:`update`,describe:`Updates an mTLS certificate's hostname settings.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust certificates settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/certificates/settings`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{body:e.body},validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let n=u(e.body);d(await m(`Updating setting`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/settings`,{body:n})),{successLabel:`Updated setting`});return}d(await m(`Updating setting`,async()=>t.zeroTrust.certificates.settings.update(n)),{successLabel:`Updated setting`})}},Tn={command:`settings`,describe:`Certificates operations`,builder:e=>e.command(Cn).command(wn).demandCommand(1),handler:()=>{}},En={command:`update <certificateId>`,describe:`Updates a configured mTLS certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`associated-hostnames`,{type:`string`,array:!0,description:`The hostnames of the applications that will use this certificate.`}).option(`name`,{type:`string`,description:`The name of the certificate.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.certificateId,`certificateId`),e.dryRun){f({command:`cf zero-trust certificates update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/certificates/${e.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(e.certificateId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{associatedHostnames:e.associatedHostnames,name:e.name,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating certificate`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/${e.certificateId}`,{body:n})),{successLabel:`Updated certificate`});return}if(e.associatedHostnames===void 0)throw Error(`--associated-hostnames is required (or pass --body with this field set).`);let n={};e.associatedHostnames!==void 0&&l(n,[`associated_hostnames`],e.associatedHostnames),e.name!==void 0&&l(n,[`name`],s(e.name,`name`,`text`)),d(await m(`Updating certificate`,async()=>t.put(`/zones/${e.zoneId}/access/certificates/${e.certificateId}`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated certificate`})}},Dn={command:`certificates`,describe:`Certificates operations`,builder:e=>e.command(yn).command(bn).command(xn).command(Sn).command(En).command(Tn).demandCommand(1),handler:()=>{}},On={command:`edit`,describe:`Updates the Zero Trust Connectivity Settings for the given account.`,builder:e=>e.option(`icmp-proxy-enabled`,{type:`boolean`,description:`A flag to enable the ICMP proxy for the account network.`}).option(`offramp-warp-enabled`,{type:`boolean`,description:`A flag to enable WARP to WARP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust connectivity-settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/connectivity_settings`,pathParams:{},bodyKind:`json`,body:{icmpProxyEnabled:t.icmpProxyEnabled,offrampWarpEnabled:t.offrampWarpEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating connectivity setting`,async()=>n.patch(`/accounts/${i}/zerotrust/connectivity_settings`,{body:e})),{successLabel:`Updated connectivity setting`});return}let o={};t.icmpProxyEnabled!==void 0&&l(o,[`icmp_proxy_enabled`],t.icmpProxyEnabled),t.offrampWarpEnabled!==void 0&&l(o,[`offramp_warp_enabled`],t.offrampWarpEnabled),d(await m(`Updating connectivity setting`,async()=>n.patch(`/accounts/${i}/zerotrust/connectivity_settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated connectivity setting`})}},kn={command:`get`,describe:`Gets the Zero Trust Connectivity Settings for the given account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading connectivity setting`,async()=>t.zeroTrust.connectivitySettings.get(n)),{successLabel:`Loaded connectivity setting`})}},An={command:`connectivity-settings`,describe:`Account-level connectivity defaults for WARP, IPv6, and ICMP proxy behavior`,builder:e=>e.command(On).command(kn).demandCommand(1),handler:()=>{}},jn={command:`list`,describe:`Retrieves a list of all available target environments with their display names. This endpoint is in Beta.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading environments`,async()=>t.zeroTrust.devices.client.target.environments.list(n)),{successLabel:`Loaded environments`})}},Mn={command:`environments`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(jn).demandCommand(1),handler:()=>{}},Nn={command:`target`,describe:`Operations for devices.client.target`,builder:e=>e.command(Mn).demandCommand(1),handler:()=>{}},Pn={command:`list`,describe:`Lists available WARP client versions for a specific target environment and release track. This endpoint is in Beta.`,builder:e=>e.option(`target-environment`,{type:`string`,description:`The target environment for the client version (e.g., windows, macos).`,demandOption:!0}).option(`release-track`,{type:`string`,description:`The release track (ga for General Availability, beta for Beta releases).`,choices:[`ga`,`beta`],demandOption:!0}).option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of versions to return per page.`}),handler:async e=>{let t={};e.targetEnvironment!==void 0&&(t.target_environment=e.targetEnvironment),e.releaseTrack!==void 0&&(t.release_track=e.releaseTrack),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading versions`,async()=>n.zeroTrust.devices.client.versions.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded versions`})}},Fn={command:`versions`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Pn).demandCommand(1),handler:()=>{}},In={command:`client`,describe:`Operations for devices.client`,builder:e=>e.command(Nn).command(Fn).demandCommand(1),handler:()=>{}},Ln={command:`create`,describe:`Creates a new deployment group. Policy IDs must be unique across all deployment groups. This endpoint is in Beta.`,builder:e=>e.option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Contains an optional list of policy IDs assigned to a group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices deployment groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/deployment-groups`,pathParams:{},bodyKind:`json`,body:{name:n.name,policyIds:n.policyIds,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating group`,async()=>i.post(`/accounts/${o}/devices/deployment-groups`,{body:e})),{successLabel:`Created group`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the deployment group.`));let h={};n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.policyIds!==void 0&&l(h,[`policy_ids`],n.policyIds),d(await m(`Creating group`,async()=>i.post(`/accounts/${o}/devices/deployment-groups`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created group`})}},Rn={command:`delete <groupId>`,describe:`Deletes a deployment group. Associated policies no longer apply and devices stop receiving version targets. This endpoint is in Beta.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.groupId,`groupId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices deployment groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/deployment-groups/${t.groupId??`<groupId>`}`,pathParams:{groupId:String(t.groupId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`group`,String(t.groupId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting group`,async()=>n.zeroTrust.devices.deployment.groups.delete(o,t.groupId)),{successLabel:`Deleted group`})}},zn={command:`get <groupId>`,describe:`Fetches a single deployment group by its ID. This endpoint is in Beta.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`Group ID`,demandOption:!0}),handler:async e=>{c(e.groupId,`groupId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading group`,async()=>t.zeroTrust.devices.deployment.groups.get(n,e.groupId)),{successLabel:`Loaded group`})}},Bn={command:`list`,describe:`Lists all deployment groups for an account. Use deployment groups to assign target WARP client versions to specific devices. This endpoint is in Beta.`,builder:e=>e.option(`page`,{type:`number`,description:`The page number to return.`}).option(`per-page`,{type:`number`,description:`The maximum number of deployment groups to return per page.`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading groups`,async()=>n.zeroTrust.devices.deployment.groups.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded groups`})}},Vn={command:`update <groupId>`,describe:`Updates a deployment group. Returns 409 if any newly added policy IDs already belong to another deployment group. This endpoint is in Beta.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`Group ID`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for the deployment group.`}).option(`policy-ids`,{type:`string`,array:!0,description:`Replaces the entire list of policy IDs.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.groupId,`groupId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices deployment groups update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/deployment-groups/${t.groupId??`<groupId>`}`,pathParams:{groupId:String(t.groupId??``)},bodyKind:`json`,body:{name:t.name,policyIds:t.policyIds,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating group`,async()=>n.patch(`/accounts/${i}/devices/deployment-groups/${t.groupId}`,{body:e})),{successLabel:`Updated group`});return}let o={};t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.policyIds!==void 0&&l(o,[`policy_ids`],t.policyIds),d(await m(`Updating group`,async()=>n.patch(`/accounts/${i}/devices/deployment-groups/${t.groupId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated group`})}},Hn={command:`groups`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Ln).command(Rn).command(zn).command(Bn).command(Vn).demandCommand(1),handler:()=>{}},Un={command:`deployment`,describe:`Operations for devices.deployment`,builder:e=>e.command(Hn).demandCommand(1),handler:()=>{}},Wn={command:`delete <deviceId>`,describe:`Deletes a WARP device.`,builder:e=>e.positional(`deviceId`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.deviceId,`deviceId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices devices delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/physical-devices/${t.deviceId??`<deviceId>`}`,pathParams:{deviceId:String(t.deviceId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`device`,String(t.deviceId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting device`,async()=>n.zeroTrust.devices.devices.delete(t.deviceId,o)),{successLabel:`Deleted device`})}},Gn={command:`get <deviceId>`,describe:`Fetches a single WARP device.`,builder:e=>e.positional(`deviceId`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}),handler:async e=>{c(e.deviceId,`deviceId`);let t={};e.include!==void 0&&(t.include=e.include);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading device`,async()=>n.zeroTrust.devices.devices.get(e.deviceId,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded device`})}},Kn={command:`list`,describe:`Lists WARP devices.`,builder:e=>e.option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`sort-by`,{type:`string`,description:`The device field to order results by.`,choices:[`name`,`id`,`client_version`,`last_seen_user.email`,`last_seen_at`,`active_registrations`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`last-seen-user-email`,{type:`string`,description:`Filter by the last seen user's email.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only devices last seen before this timestamp.`}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Search by device details.`}).option(`active-registrations`,{type:`string`,description:`Include or exclude devices with active registrations. The default is "only" - return only devices with active registrations.`,choices:[`include`,`only`,`exclude`]}).option(`id`,{type:`string`,description:`Filter by a one or more device IDs.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the device response. Supported values are: "last_seen_registration.policy".`}),handler:async e=>{let t={};e.cursor!==void 0&&(t.cursor=e.cursor),e.sortBy!==void 0&&(t.sort_by=e.sortBy),e.sortOrder!==void 0&&(t.sort_order=e.sortOrder),e.lastSeenUserEmail!==void 0&&(t.lastSeenUserEmail=e.lastSeenUserEmail),e.seenAfter!==void 0&&(t.seen_after=e.seenAfter),e.seenBefore!==void 0&&(t.seen_before=e.seenBefore),e.perPage!==void 0&&(t.per_page=e.perPage),e.search!==void 0&&(t.search=e.search),e.activeRegistrations!==void 0&&(t.active_registrations=e.activeRegistrations),e.id!==void 0&&(t.id=e.id),e.include!==void 0&&(t.include=e.include);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading devices`,async()=>n.zeroTrust.devices.devices.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded devices`})}},qn={command:`revoke <deviceId>`,describe:`Revokes all WARP registrations associated with the specified device.`,builder:e=>e.positional(`deviceId`,{type:`string`,description:`Device ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.deviceId,`deviceId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices devices revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/physical-devices/${t.deviceId??`<deviceId>`}/revoke`,pathParams:{deviceId:String(t.deviceId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`device`,String(t.deviceId??``),{force:!!t.force,message:`This operation revokes a device's session destructively.`})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting device`,async()=>n.zeroTrust.devices.devices.revoke(o,t.deviceId)),{successLabel:`Deleted device`})}},Jn={command:`devices`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Wn).command(Gn).command(Kn).command(qn).demandCommand(1),handler:()=>{}},Yn={command:`create`,describe:`Create a DEX test.`,builder:e=>e.option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices dex-tests create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dex/devices/dex_tests`,pathParams:{},bodyKind:`json`,body:{dataHost:i.dataHost,dataKind:i.dataKind,dataMethod:i.dataMethod,description:i.description,enabled:i.enabled,interval:i.interval,name:i.name,targeted:i.targeted,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating dex test`,async()=>o.post(`/accounts/${h}/dex/devices/dex_tests`,{body:e})),{successLabel:`Created dex test`});return}if(i.dataHost===void 0&&(i.dataHost=await t(`data-host`,`The desired endpoint to test.`)),i.dataKind===void 0&&(i.dataKind=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.interval===void 0&&(i.interval=await t(`interval`,`How often the test will run.`)),i.name===void 0&&(i.name=await t(`name`,`The name of the DEX test. Must be unique.`));let g={};i.dataHost!==void 0&&l(g,[`data`,`host`],s(i.dataHost,`dataHost`,`text`)),i.dataKind!==void 0&&l(g,[`data`,`kind`],s(i.dataKind,`dataKind`,`text`)),i.dataMethod!==void 0&&l(g,[`data`,`method`],s(i.dataMethod,`dataMethod`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.interval!==void 0&&l(g,[`interval`],s(i.interval,`interval`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.targeted!==void 0&&l(g,[`targeted`],i.targeted),d(await m(`Creating dex test`,async()=>o.post(`/accounts/${h}/dex/devices/dex_tests`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created dex test`})}},Xn={command:`delete <dexTestId>`,describe:`Delete a Device DEX test. Returns the remaining device dex tests for the account.`,builder:e=>e.positional(`dexTestId`,{type:`string`,description:`API Resource UUID tag.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.dexTestId,`dexTestId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices dex-tests delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dex/devices/dex_tests/${t.dexTestId??`<dexTestId>`}`,pathParams:{dexTestId:String(t.dexTestId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`dex test`,String(t.dexTestId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting dex test`,async()=>n.zeroTrust.devices.dexTests.delete(o,t.dexTestId)),{successLabel:`Deleted dex test`})}},Zn={command:`get <dexTestId>`,describe:`Fetch a single DEX test.`,builder:e=>e.positional(`dexTestId`,{type:`string`,description:`The unique identifier for the test.`,demandOption:!0}),handler:async e=>{c(e.dexTestId,`dexTestId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading dex test`,async()=>t.zeroTrust.devices.dexTests.get(n,e.dexTestId)),{successLabel:`Loaded dex test`})}},Qn={command:`list`,describe:`Fetch all DEX tests`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`test-name`,{type:`string`,description:`Filter by test name`}).option(`kind`,{type:`string`,description:`Filter by test type`,choices:[`http`,`traceroute`]}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.testName!==void 0&&(t.testName=e.testName),e.kind!==void 0&&(t.kind=e.kind);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading dex tests`,async()=>n.zeroTrust.devices.dexTests.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded dex tests`})}},$n={command:`update <dexTestId>`,describe:`Update a DEX test.`,builder:e=>e.positional(`dexTestId`,{type:`string`,description:`API Resource UUID tag.`,demandOption:!0}).option(`data-host`,{type:`string`,description:`The desired endpoint to test.`}).option(`data-kind`,{type:`string`,description:`The type of test.`,choices:[`http`,`traceroute`]}).option(`data-method`,{type:`string`,description:`The HTTP request method type.`,choices:[`GET`]}).option(`description`,{type:`string`,description:`Additional details about the test.`}).option(`enabled`,{type:`boolean`,description:`Determines whether or not the test is active.`}).option(`interval`,{type:`string`,description:`How often the test will run.`}).option(`name`,{type:`string`,description:`The name of the DEX test. Must be unique.`}).option(`targeted`,{type:`boolean`,description:`The targeted field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(c(i.dexTestId,`dexTestId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices dex-tests update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dex/devices/dex_tests/${i.dexTestId??`<dexTestId>`}`,pathParams:{dexTestId:String(i.dexTestId??``)},bodyKind:`json`,body:{dataHost:i.dataHost,dataKind:i.dataKind,dataMethod:i.dataMethod,description:i.description,enabled:i.enabled,interval:i.interval,name:i.name,targeted:i.targeted,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating dex test`,async()=>o.put(`/accounts/${h}/dex/devices/dex_tests/${i.dexTestId}`,{body:e})),{successLabel:`Updated dex test`});return}if(i.dataHost===void 0&&(i.dataHost=await t(`data-host`,`The desired endpoint to test.`)),i.dataKind===void 0&&(i.dataKind=await n(`data-kind`,`The type of test.`,[`http`,`traceroute`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.interval===void 0&&(i.interval=await t(`interval`,`How often the test will run.`)),i.name===void 0&&(i.name=await t(`name`,`The name of the DEX test. Must be unique.`));let g={};i.dataHost!==void 0&&l(g,[`data`,`host`],s(i.dataHost,`dataHost`,`text`)),i.dataKind!==void 0&&l(g,[`data`,`kind`],s(i.dataKind,`dataKind`,`text`)),i.dataMethod!==void 0&&l(g,[`data`,`method`],s(i.dataMethod,`dataMethod`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.interval!==void 0&&l(g,[`interval`],s(i.interval,`interval`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.targeted!==void 0&&l(g,[`targeted`],i.targeted),d(await m(`Updating dex test`,async()=>o.put(`/accounts/${h}/dex/devices/dex_tests/${i.dexTestId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated dex test`})}},er={command:`dex-tests`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Yn).command(Xn).command(Zn).command(Qn).command($n).demandCommand(1),handler:()=>{}},tr={command:`get <deviceId>`,describe:`Get the live status of a latest device given device_id from the device_state table`,builder:e=>e.positional(`deviceId`,{type:`string`,description:`Unique identifier for device`,demandOption:!0}).option(`since-minutes`,{type:`string`,description:`Number of minutes before current time`,demandOption:!0}).option(`time-now`,{type:`string`,description:`Number of minutes before current time`}).option(`colo`,{type:`string`,description:`List of data centers to filter results`}),handler:async e=>{c(e.deviceId,`deviceId`);let t={};e.sinceMinutes!==void 0&&(t.since_minutes=e.sinceMinutes),e.timeNow!==void 0&&(t.time_now=e.timeNow),e.colo!==void 0&&(t.colo=e.colo);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading fleet statu`,async()=>n.zeroTrust.devices.fleetStatus.get(i,e.deviceId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded fleet statu`})}},nr={command:`fleet-status`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(tr).demandCommand(1),handler:()=>{}},rr={command:`get <deviceId>`,describe:`Fetches a single WARP device. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices/{device_id} - GET /accounts/{account_id}/devices/registrations/{registration_id}`,builder:e=>e.positional(`deviceId`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}),handler:async e=>{c(e.deviceId,`deviceId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading device`,async()=>t.zeroTrust.devices.get(e.deviceId,n)),{successLabel:`Loaded device`})}},ir={command:`create`,describe:`Creates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:e=>e.option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile will be applied to matching devices.`,default:!0}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices ip-profiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/ip-profiles`,pathParams:{},bodyKind:`json`,body:{description:n.description,enabled:n.enabled,match:n.match,name:n.name,precedence:n.precedence,subnetId:n.subnetId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating ip profile`,async()=>i.post(`/accounts/${o}/devices/ip-profiles`,{body:e})),{successLabel:`Created ip profile`});return}if(n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`)),n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the Device IP profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);n.subnetId===void 0&&(n.subnetId=await t(`subnet-id`,`The ID of the Subnet.`));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.match!==void 0&&l(h,[`match`],s(n.match,`match`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.precedence!==void 0&&l(h,[`precedence`],n.precedence),n.subnetId!==void 0&&l(h,[`subnet_id`],s(n.subnetId,`subnetId`,`text`)),d(await m(`Creating ip profile`,async()=>i.post(`/accounts/${o}/devices/ip-profiles`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created ip profile`})}},ar={command:`delete <profileId>`,describe:`Delete a WARP Device IP profile.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices ip-profiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/ip-profiles/${t.profileId??`<profileId>`}`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`ip profile`,String(t.profileId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting ip profile`,async()=>n.zeroTrust.devices.ipProfiles.delete(o,t.profileId)),{successLabel:`Deleted ip profile`})}},or={command:`get <profileId>`,describe:`Fetches a single WARP Device IP profile.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}),handler:async e=>{c(e.profileId,`profileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading ip profile`,async()=>t.zeroTrust.devices.ipProfiles.get(n,e.profileId)),{successLabel:`Loaded ip profile`})}},sr={command:`list`,describe:`Lists WARP Device IP profiles.`,builder:e=>e.option(`per-page`,{type:`number`,description:`The number of IP profiles to return per page.`}),handler:async e=>{let t={};e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading ip profiles`,async()=>n.zeroTrust.devices.ipProfiles.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded ip profiles`})}},cr={command:`update <profileId>`,describe:`Updates a WARP Device IP profile. Currently, only IPv4 Device subnets can be associated.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`description`,{type:`string`,description:`An optional description of the Device IP profile.`}).option(`enabled`,{type:`boolean`,description:`Whether the Device IP profile is enabled.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".`}).option(`name`,{type:`string`,description:`A user-friendly name for the Device IP profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the Device IP profile. Lower values indicate higher precedence. Device IP profile will be evaluated in ascending order of this field.`}).option(`subnet-id`,{type:`string`,description:`The ID of the Subnet.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices ip-profiles update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/ip-profiles/${t.profileId??`<profileId>`}`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`json`,body:{description:t.description,enabled:t.enabled,match:t.match,name:t.name,precedence:t.precedence,subnetId:t.subnetId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating ip profile`,async()=>n.patch(`/accounts/${i}/devices/ip-profiles/${t.profileId}`,{body:e})),{successLabel:`Updated ip profile`});return}let o={};t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.enabled!==void 0&&l(o,[`enabled`],t.enabled),t.match!==void 0&&l(o,[`match`],s(t.match,`match`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.precedence!==void 0&&l(o,[`precedence`],t.precedence),t.subnetId!==void 0&&l(o,[`subnet_id`],s(t.subnetId,`subnetId`,`text`)),d(await m(`Updating ip profile`,async()=>n.patch(`/accounts/${i}/devices/ip-profiles/${t.profileId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated ip profile`})}},lr={command:`ip-profiles`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ir).command(ar).command(or).command(sr).command(cr).demandCommand(1),handler:()=>{}},ur={command:`list`,describe:`List WARP devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated**: please use one of the following endpoints instead: - GET /accounts/{account_id}/devices/physical-devices - GET /accounts/{account_id}/devices/registrations`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading devices`,async()=>t.zeroTrust.devices.list(n)),{successLabel:`Loaded devices`})}},dr={command:`create`,describe:`Creates a new device managed network.`,builder:e=>e.option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/networks`,pathParams:{},bodyKind:`json`,body:{configSha256:i.configSha256,configTlsSockaddr:i.configTlsSockaddr,name:i.name,type:i.type,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating network`,async()=>o.post(`/accounts/${h}/devices/networks`,{body:e})),{successLabel:`Created network`});return}i.configTlsSockaddr===void 0&&(i.configTlsSockaddr=await t(`config-tls-sockaddr`,`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`)),i.name===void 0&&(i.name=await t(`name`,`The name of the device managed network. This name must be unique.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device managed network.`,[`tls`]));let g={};i.configSha256!==void 0&&l(g,[`config`,`sha256`],s(i.configSha256,`configSha256`,`text`)),i.configTlsSockaddr!==void 0&&l(g,[`config`,`tls_sockaddr`],s(i.configTlsSockaddr,`configTlsSockaddr`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),d(await m(`Creating network`,async()=>o.post(`/accounts/${h}/devices/networks`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created network`})}},fr={command:`delete <networkId>`,describe:`Deletes a device managed network and fetches a list of the remaining device managed networks for an account.`,builder:e=>e.positional(`networkId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.networkId,`networkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/networks/${t.networkId??`<networkId>`}`,pathParams:{networkId:String(t.networkId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`network`,String(t.networkId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting network`,async()=>n.delete(`/accounts/${o}/devices/networks/${t.networkId}`,{body:e})),{successLabel:`Deleted network`});return}d(await m(`Deleting network`,async()=>n.zeroTrust.devices.networks.delete(t.networkId,o)),{successLabel:`Deleted network`})}},pr={command:`get <networkId>`,describe:`Fetches details for a single managed network.`,builder:e=>e.positional(`networkId`,{type:`string`,description:`API UUID.`,demandOption:!0}),handler:async e=>{c(e.networkId,`networkId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading network`,async()=>t.zeroTrust.devices.networks.get(e.networkId,n)),{successLabel:`Loaded network`})}},mr={command:`list`,describe:`Fetches a list of managed networks for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading networks`,async()=>t.zeroTrust.devices.networks.list(n)),{successLabel:`Loaded networks`})}},hr={command:`update <networkId>`,describe:`Updates a configured device managed network.`,builder:e=>e.positional(`networkId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-sha256`,{type:`string`,description:`The SHA-256 hash of the TLS certificate presented by the host found at tls_sockaddr. If absent, regular certificate verification (trusted roots, valid timestamp, etc) will be used to validate the certificate.`}).option(`config-tls-sockaddr`,{type:`string`,description:`A network address of the form "host:port" that the WARP client will use to detect the presence of a TLS host.`}).option(`name`,{type:`string`,description:`The name of the device managed network. This name must be unique.`}).option(`type`,{type:`string`,description:`The type of device managed network.`,choices:[`tls`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-sha256`,`config-tls-sockaddr`].some(t=>e[t]!==void 0)){let t=[`config-tls-sockaddr`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0}),handler:async t=>{if(c(t.networkId,`networkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices networks update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/networks/${t.networkId??`<networkId>`}`,pathParams:{networkId:String(t.networkId??``)},bodyKind:`json`,body:{configSha256:t.configSha256,configTlsSockaddr:t.configTlsSockaddr,name:t.name,type:t.type,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating network`,async()=>n.put(`/accounts/${i}/devices/networks/${t.networkId}`,{body:e})),{successLabel:`Updated network`});return}let o={};t.configSha256!==void 0&&l(o,[`config`,`sha256`],s(t.configSha256,`configSha256`,`text`)),t.configTlsSockaddr!==void 0&&l(o,[`config`,`tls_sockaddr`],s(t.configTlsSockaddr,`configTlsSockaddr`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.type!==void 0&&l(o,[`type`],s(t.type,`type`,`text`)),d(await m(`Updating network`,async()=>n.put(`/accounts/${i}/devices/networks/${t.networkId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated network`})}},gr={command:`networks`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(dr).command(fr).command(pr).command(mr).command(hr).demandCommand(1),handler:()=>{}},_r={command:`get <registrationId>`,describe:`Fetches one-time use admin override codes for a registration. This relies on the **Admin Override** setting being enabled in your device configuration.`,builder:e=>e.positional(`registrationId`,{type:`string`,description:`Registration ID`,demandOption:!0}),handler:async e=>{c(e.registrationId,`registrationId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading override code`,async()=>t.zeroTrust.devices.overrideCodes.get(n,e.registrationId)),{successLabel:`Loaded override code`})}},vr={command:`list`,describe:`Fetches a one-time use admin override code for a device. This relies on the **Admin Override** setting being enabled in your device configuration. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled for the account. **Deprecated:** please use GET /accounts/{account_id}/devices/registrations/{registration_id}/override_codes instead.`,builder:e=>e.option(`device-id`,{type:`string`,description:`Registration ID. Equal to Device ID except for accounts which enabled [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).`,demandOption:!0}),handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading override codes`,async()=>t.zeroTrust.devices.overrideCodes.list(e.deviceId,n)),{successLabel:`Loaded override codes`})}},yr={command:`override-codes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(_r).command(vr).demandCommand(1),handler:()=>{}},br={command:`create`,describe:`Creates a device settings profile to be applied to certain devices matching the criteria.`,builder:e=>e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`,default:!0}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices policies custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:{allowModeSwitch:n.allowModeSwitch,allowUpdates:n.allowUpdates,allowedToLeave:n.allowedToLeave,autoConnect:n.autoConnect,captivePortal:n.captivePortal,disableAutoFallback:n.disableAutoFallback,enabled:n.enabled,excludeOfficeIps:n.excludeOfficeIps,lanAllowMinutes:n.lanAllowMinutes,lanAllowSubnetSize:n.lanAllowSubnetSize,match:n.match,name:n.name,precedence:n.precedence,registerInterfaceIpWithDns:n.registerInterfaceIpWithDns,sccmVpnBoundarySupport:n.sccmVpnBoundarySupport,serviceModeV2Mode:n.serviceModeV2Mode,serviceModeV2Port:n.serviceModeV2Port,supportUrl:n.supportUrl,switchLocked:n.switchLocked,tunnelProtocol:n.tunnelProtocol,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/devices/policy`,{body:e})),{successLabel:`Created custom`});return}if(n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`)),n.name===void 0&&(n.name=await t(`name`,`The name of the device settings profile.`)),n.precedence===void 0)throw Error(`--precedence is required (or pass --body with this field set).`);let h={};n.allowModeSwitch!==void 0&&l(h,[`allow_mode_switch`],n.allowModeSwitch),n.allowUpdates!==void 0&&l(h,[`allow_updates`],n.allowUpdates),n.allowedToLeave!==void 0&&l(h,[`allowed_to_leave`],n.allowedToLeave),n.autoConnect!==void 0&&l(h,[`auto_connect`],n.autoConnect),n.captivePortal!==void 0&&l(h,[`captive_portal`],n.captivePortal),n.disableAutoFallback!==void 0&&l(h,[`disable_auto_fallback`],n.disableAutoFallback),n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.excludeOfficeIps!==void 0&&l(h,[`exclude_office_ips`],n.excludeOfficeIps),n.lanAllowMinutes!==void 0&&l(h,[`lan_allow_minutes`],n.lanAllowMinutes),n.lanAllowSubnetSize!==void 0&&l(h,[`lan_allow_subnet_size`],n.lanAllowSubnetSize),n.match!==void 0&&l(h,[`match`],s(n.match,`match`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.precedence!==void 0&&l(h,[`precedence`],n.precedence),n.registerInterfaceIpWithDns!==void 0&&l(h,[`register_interface_ip_with_dns`],n.registerInterfaceIpWithDns),n.sccmVpnBoundarySupport!==void 0&&l(h,[`sccm_vpn_boundary_support`],n.sccmVpnBoundarySupport),n.serviceModeV2Mode!==void 0&&l(h,[`service_mode_v2`,`mode`],s(n.serviceModeV2Mode,`serviceModeV2Mode`,`text`)),n.serviceModeV2Port!==void 0&&l(h,[`service_mode_v2`,`port`],n.serviceModeV2Port),n.supportUrl!==void 0&&l(h,[`support_url`],s(n.supportUrl,`supportUrl`,`text`)),n.switchLocked!==void 0&&l(h,[`switch_locked`],n.switchLocked),n.tunnelProtocol!==void 0&&l(h,[`tunnel_protocol`],s(n.tunnelProtocol,`tunnelProtocol`,`text`)),d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/devices/policy`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created custom`})}},xr={command:`delete <policyId>`,describe:`Deletes a device settings profile and fetches a list of the remaining profiles for an account.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/${t.policyId??`<policyId>`}`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`custom`,String(t.policyId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting custom`,async()=>n.delete(`/accounts/${o}/devices/policy/${t.policyId}`,{body:e})),{successLabel:`Deleted custom`});return}d(await m(`Deleting custom`,async()=>n.zeroTrust.devices.policies.custom.delete(t.policyId,o)),{successLabel:`Deleted custom`})}},Sr={command:`edit <policyId>`,describe:`Updates a configured device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`description`,{type:`string`,description:`A description of the policy.`}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`enabled`,{type:`boolean`,description:`Whether the policy will be applied to matching devices.`}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`match`,{type:`string`,description:`The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".`}).option(`name`,{type:`string`,description:`The name of the device settings profile.`}).option(`precedence`,{type:`number`,description:`The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies custom edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/${t.policyId??`<policyId>`}`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`json`,body:{allowModeSwitch:t.allowModeSwitch,allowUpdates:t.allowUpdates,allowedToLeave:t.allowedToLeave,autoConnect:t.autoConnect,captivePortal:t.captivePortal,description:t.description,disableAutoFallback:t.disableAutoFallback,enabled:t.enabled,excludeOfficeIps:t.excludeOfficeIps,lanAllowMinutes:t.lanAllowMinutes,lanAllowSubnetSize:t.lanAllowSubnetSize,match:t.match,name:t.name,precedence:t.precedence,registerInterfaceIpWithDns:t.registerInterfaceIpWithDns,sccmVpnBoundarySupport:t.sccmVpnBoundarySupport,serviceModeV2Mode:t.serviceModeV2Mode,serviceModeV2Port:t.serviceModeV2Port,supportUrl:t.supportUrl,switchLocked:t.switchLocked,tunnelProtocol:t.tunnelProtocol,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating custom`,async()=>n.patch(`/accounts/${i}/devices/policy/${t.policyId}`,{body:e})),{successLabel:`Updated custom`});return}let o={};t.allowModeSwitch!==void 0&&l(o,[`allow_mode_switch`],t.allowModeSwitch),t.allowUpdates!==void 0&&l(o,[`allow_updates`],t.allowUpdates),t.allowedToLeave!==void 0&&l(o,[`allowed_to_leave`],t.allowedToLeave),t.autoConnect!==void 0&&l(o,[`auto_connect`],t.autoConnect),t.captivePortal!==void 0&&l(o,[`captive_portal`],t.captivePortal),t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.disableAutoFallback!==void 0&&l(o,[`disable_auto_fallback`],t.disableAutoFallback),t.enabled!==void 0&&l(o,[`enabled`],t.enabled),t.excludeOfficeIps!==void 0&&l(o,[`exclude_office_ips`],t.excludeOfficeIps),t.lanAllowMinutes!==void 0&&l(o,[`lan_allow_minutes`],t.lanAllowMinutes),t.lanAllowSubnetSize!==void 0&&l(o,[`lan_allow_subnet_size`],t.lanAllowSubnetSize),t.match!==void 0&&l(o,[`match`],s(t.match,`match`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.precedence!==void 0&&l(o,[`precedence`],t.precedence),t.registerInterfaceIpWithDns!==void 0&&l(o,[`register_interface_ip_with_dns`],t.registerInterfaceIpWithDns),t.sccmVpnBoundarySupport!==void 0&&l(o,[`sccm_vpn_boundary_support`],t.sccmVpnBoundarySupport),t.serviceModeV2Mode!==void 0&&l(o,[`service_mode_v2`,`mode`],s(t.serviceModeV2Mode,`serviceModeV2Mode`,`text`)),t.serviceModeV2Port!==void 0&&l(o,[`service_mode_v2`,`port`],t.serviceModeV2Port),t.supportUrl!==void 0&&l(o,[`support_url`],s(t.supportUrl,`supportUrl`,`text`)),t.switchLocked!==void 0&&l(o,[`switch_locked`],t.switchLocked),t.tunnelProtocol!==void 0&&l(o,[`tunnel_protocol`],s(t.tunnelProtocol,`tunnelProtocol`,`text`)),d(await m(`Updating custom`,async()=>n.patch(`/accounts/${i}/devices/policy/${t.policyId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated custom`})}},Cr={command:`get <policyId>`,describe:`Fetches the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading exclude`,async()=>t.zeroTrust.devices.policies.custom.excludes.get(e.policyId,n)),{successLabel:`Loaded exclude`})}},wr={command:`update <policyId>`,describe:`Sets the list of routes excluded from the WARP client's tunnel for a specific device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies custom excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/${t.policyId??`<policyId>`}/exclude`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating exclude`,async()=>n.put(`/accounts/${i}/devices/policy/${t.policyId}/exclude`,{body:e})),{successLabel:`Updated exclude`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Tr={command:`excludes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Cr).command(wr).demandCommand(1),handler:()=>{}},Er={command:`get <policyId>`,describe:`Fetches the list of domains to bypass Gateway DNS resolution from a specified device settings profile. These domains will use the specified local DNS resolver instead.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading fallback domain`,async()=>t.zeroTrust.devices.policies.custom.fallbackDomains.get(e.policyId,n)),{successLabel:`Loaded fallback domain`})}},Dr={command:`update <policyId>`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead. This will only apply to the specified device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies custom fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/${t.policyId??`<policyId>`}/fallback_domains`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating fallback domain`,async()=>n.put(`/accounts/${i}/devices/policy/${t.policyId}/fallback_domains`,{body:e})),{successLabel:`Updated fallback domain`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Or={command:`fallback-domains`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Er).command(Dr).demandCommand(1),handler:()=>{}},kr={command:`get <policyId>`,describe:`Fetches a device settings profile by ID.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.devices.policies.custom.get(e.policyId,n)),{successLabel:`Loaded custom`})}},Ar={command:`get <policyId>`,describe:`Fetches the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}),handler:async e=>{c(e.policyId,`policyId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading include`,async()=>t.zeroTrust.devices.policies.custom.includes.get(e.policyId,n)),{successLabel:`Loaded include`})}},jr={command:`update <policyId>`,describe:`Sets the list of routes included in the WARP client's tunnel for a specific device settings profile.`,builder:e=>e.positional(`policyId`,{type:`string`,description:`Policy ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.policyId,`policyId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies custom includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/${t.policyId??`<policyId>`}/include`,pathParams:{policyId:String(t.policyId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating include`,async()=>n.put(`/accounts/${i}/devices/policy/${t.policyId}/include`,{body:e})),{successLabel:`Updated include`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Mr={command:`includes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Ar).command(jr).demandCommand(1),handler:()=>{}},Nr={command:`list`,describe:`Fetches a list of the device settings profiles for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.devices.policies.custom.list(n)),{successLabel:`Loaded custom`})}},Pr={command:`custom`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(br).command(xr).command(Sr).command(kr).command(Nr).command(Tr).command(Or).command(Mr).demandCommand(1),handler:()=>{}},Fr={command:`edit`,describe:`Enable Zero Trust Clients to provision a certificate, containing a x509 subject, and referenced by Access device posture policies when the client visits MTLS protected domains. This facilitates device posture without a WARP session.`,builder:e=>e.option(`enabled`,{type:`boolean`,description:`The current status of the device policy certificate provisioning feature for WARP clients.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust devices policies default certificates edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/devices/policy/certificates`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{enabled:e.enabled,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating certificate`,async()=>t.patch(`/zones/${e.zoneId}/devices/policy/certificates`,{body:n})),{successLabel:`Updated certificate`});return}if(e.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let n={};e.enabled!==void 0&&l(n,[`enabled`],e.enabled),d(await m(`Updating certificate`,async()=>t.patch(`/zones/${e.zoneId}/devices/policy/certificates`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated certificate`})}},Ir={command:`get`,describe:`Fetches device certificate provisioning.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading certificate`,async()=>t.zeroTrust.devices.policies.default.certificates.get(n)),{successLabel:`Loaded certificate`})}},Lr={command:`certificates`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Fr).command(Ir).demandCommand(1),handler:()=>{}},Rr={command:`edit`,describe:`Updates the default device settings profile for an account.`,builder:e=>e.option(`allow-mode-switch`,{type:`boolean`,description:`Whether to allow the user to switch WARP between modes.`,default:!1}).option(`allow-updates`,{type:`boolean`,description:`Whether to receive update notifications when a new version of the client is available.`,default:!1}).option(`allowed-to-leave`,{type:`boolean`,description:`Whether to allow devices to leave the organization.`,default:!0}).option(`auto-connect`,{type:`number`,description:`The amount of time in seconds to reconnect after having been disabled.`,default:0}).option(`captive-portal`,{type:`number`,description:`Turn on the captive portal after the specified amount of time.`,default:180}).option(`disable-auto-fallback`,{type:`boolean`,description:"If the `dns_server` field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to `true`.",default:!1}).option(`exclude-office-ips`,{type:`boolean`,description:`Whether to add Microsoft IPs to Split Tunnel exclusions.`,default:!1}).option(`lan-allow-minutes`,{type:`number`,description:`The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.`}).option(`lan-allow-subnet-size`,{type:`number`,description:`The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.`}).option(`register-interface-ip-with-dns`,{type:`boolean`,description:`Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.`,default:!0}).option(`sccm-vpn-boundary-support`,{type:`boolean`,description:`Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).`,default:!1}).option(`service-mode-v2-mode`,{type:`string`,description:`The mode to run the WARP client under.`}).option(`service-mode-v2-port`,{type:`number`,description:`The port number when used with proxy mode.`}).option(`support-url`,{type:`string`,description:`The URL to launch when the Send Feedback button is clicked.`,default:``}).option(`switch-locked`,{type:`boolean`,description:`Whether to allow the user to turn off the WARP switch and disconnect the client.`,default:!1}).option(`tunnel-protocol`,{type:`string`,description:`Determines which tunnel protocol to use.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies default edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy`,pathParams:{},bodyKind:`json`,body:{allowModeSwitch:t.allowModeSwitch,allowUpdates:t.allowUpdates,allowedToLeave:t.allowedToLeave,autoConnect:t.autoConnect,captivePortal:t.captivePortal,disableAutoFallback:t.disableAutoFallback,excludeOfficeIps:t.excludeOfficeIps,lanAllowMinutes:t.lanAllowMinutes,lanAllowSubnetSize:t.lanAllowSubnetSize,registerInterfaceIpWithDns:t.registerInterfaceIpWithDns,sccmVpnBoundarySupport:t.sccmVpnBoundarySupport,serviceModeV2Mode:t.serviceModeV2Mode,serviceModeV2Port:t.serviceModeV2Port,supportUrl:t.supportUrl,switchLocked:t.switchLocked,tunnelProtocol:t.tunnelProtocol,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating default`,async()=>n.patch(`/accounts/${i}/devices/policy`,{body:e})),{successLabel:`Updated default`});return}let o={};t.allowModeSwitch!==void 0&&l(o,[`allow_mode_switch`],t.allowModeSwitch),t.allowUpdates!==void 0&&l(o,[`allow_updates`],t.allowUpdates),t.allowedToLeave!==void 0&&l(o,[`allowed_to_leave`],t.allowedToLeave),t.autoConnect!==void 0&&l(o,[`auto_connect`],t.autoConnect),t.captivePortal!==void 0&&l(o,[`captive_portal`],t.captivePortal),t.disableAutoFallback!==void 0&&l(o,[`disable_auto_fallback`],t.disableAutoFallback),t.excludeOfficeIps!==void 0&&l(o,[`exclude_office_ips`],t.excludeOfficeIps),t.lanAllowMinutes!==void 0&&l(o,[`lan_allow_minutes`],t.lanAllowMinutes),t.lanAllowSubnetSize!==void 0&&l(o,[`lan_allow_subnet_size`],t.lanAllowSubnetSize),t.registerInterfaceIpWithDns!==void 0&&l(o,[`register_interface_ip_with_dns`],t.registerInterfaceIpWithDns),t.sccmVpnBoundarySupport!==void 0&&l(o,[`sccm_vpn_boundary_support`],t.sccmVpnBoundarySupport),t.serviceModeV2Mode!==void 0&&l(o,[`service_mode_v2`,`mode`],s(t.serviceModeV2Mode,`serviceModeV2Mode`,`text`)),t.serviceModeV2Port!==void 0&&l(o,[`service_mode_v2`,`port`],t.serviceModeV2Port),t.supportUrl!==void 0&&l(o,[`support_url`],s(t.supportUrl,`supportUrl`,`text`)),t.switchLocked!==void 0&&l(o,[`switch_locked`],t.switchLocked),t.tunnelProtocol!==void 0&&l(o,[`tunnel_protocol`],s(t.tunnelProtocol,`tunnelProtocol`,`text`)),d(await m(`Updating default`,async()=>n.patch(`/accounts/${i}/devices/policy`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated default`})}},zr={command:`get`,describe:`Fetches the list of routes excluded from the WARP client's tunnel.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading exclude`,async()=>t.zeroTrust.devices.policies.default.excludes.get(n)),{successLabel:`Loaded exclude`})}},Br={command:`update`,describe:`Sets the list of routes excluded from the WARP client's tunnel.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies default excludes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/exclude`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating exclude`,async()=>n.put(`/accounts/${i}/devices/policy/exclude`,{body:e})),{successLabel:`Updated exclude`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Vr={command:`excludes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(zr).command(Br).demandCommand(1),handler:()=>{}},Hr={command:`get`,describe:`Fetches a list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading fallback domain`,async()=>t.zeroTrust.devices.policies.default.fallbackDomains.get(n)),{successLabel:`Loaded fallback domain`})}},Ur={command:`update`,describe:`Sets the list of domains to bypass Gateway DNS resolution. These domains will use the specified local DNS resolver instead.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies default fallback-domains update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/fallback_domains`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating fallback domain`,async()=>n.put(`/accounts/${i}/devices/policy/fallback_domains`,{body:e})),{successLabel:`Updated fallback domain`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Wr={command:`fallback-domains`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Hr).command(Ur).demandCommand(1),handler:()=>{}},Gr={command:`get`,describe:`Fetches the default device settings profile for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading default`,async()=>t.zeroTrust.devices.policies.default.get(n)),{successLabel:`Loaded default`})}},Kr={command:`get`,describe:`Fetches the list of routes included in the WARP client's tunnel.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading include`,async()=>t.zeroTrust.devices.policies.default.includes.get(n)),{successLabel:`Loaded include`})}},qr={command:`update`,describe:`Sets the list of routes included in the WARP client's tunnel.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices policies default includes update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/policy/include`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating include`,async()=>n.put(`/accounts/${i}/devices/policy/include`,{body:e})),{successLabel:`Updated include`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Jr={command:`includes`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Kr).command(qr).demandCommand(1),handler:()=>{}},Yr={command:`default`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Rr).command(Gr).command(Lr).command(Vr).command(Wr).command(Jr).demandCommand(1),handler:()=>{}},Xr={command:`policies`,describe:`Operations for devices.policies`,builder:e=>e.command(Pr).command(Yr).demandCommand(1),handler:()=>{}},Zr={command:`create`,describe:`Creates a new device posture rule.`,builder:e=>e.option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`]),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices posture create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/posture`,pathParams:{},bodyKind:`json`,body:{description:i.description,expiration:i.expiration,inputExists:i.inputExists,inputOperatingSystem:i.inputOperatingSystem,inputPath:i.inputPath,inputSha256:i.inputSha256,inputThumbprint:i.inputThumbprint,inputId:i.inputId,inputDomain:i.inputDomain,inputOperator:i.inputOperator,inputOsDistroName:i.inputOsDistroName,inputOsDistroRevision:i.inputOsDistroRevision,inputOsVersionExtra:i.inputOsVersionExtra,inputVersion:i.inputVersion,inputEnabled:i.inputEnabled,inputCheckDisks:i.inputCheckDisks,inputRequireAll:i.inputRequireAll,inputCertificateId:i.inputCertificateId,inputCn:i.inputCn,inputCheckPrivateKey:i.inputCheckPrivateKey,inputExtendedKeyUsage:i.inputExtendedKeyUsage,inputLocationsPaths:i.inputLocationsPaths,inputLocationsTrustStores:i.inputLocationsTrustStores,inputSubjectAlternativeNames:i.inputSubjectAlternativeNames,inputUpdateWindowDays:i.inputUpdateWindowDays,inputComplianceStatus:i.inputComplianceStatus,inputConnectionId:i.inputConnectionId,inputLastSeen:i.inputLastSeen,inputOs:i.inputOs,inputOverall:i.inputOverall,inputSensorConfig:i.inputSensorConfig,inputState:i.inputState,inputVersionOperator:i.inputVersionOperator,inputAuthState:i.inputAuthState,inputCountOperator:i.inputCountOperator,inputIssueCount:i.inputIssueCount,inputEidLastSeen:i.inputEidLastSeen,inputRiskLevel:i.inputRiskLevel,inputScoreOperator:i.inputScoreOperator,inputTotalScore:i.inputTotalScore,inputActiveThreats:i.inputActiveThreats,inputInfected:i.inputInfected,inputIsActive:i.inputIsActive,inputNetworkStatus:i.inputNetworkStatus,inputOperationalState:i.inputOperationalState,inputScore:i.inputScore,name:i.name,schedule:i.schedule,type:i.type,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating posture`,async()=>o.post(`/accounts/${h}/devices/posture`,{body:e})),{successLabel:`Created posture`});return}i.name===void 0&&(i.name=await t(`name`,`The name of the device posture rule.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let g={};i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.expiration!==void 0&&l(g,[`expiration`],s(i.expiration,`expiration`,`text`)),i.inputExists!==void 0&&l(g,[`input`,`exists`],i.inputExists),i.inputOperatingSystem!==void 0&&l(g,[`input`,`operating_system`],s(i.inputOperatingSystem,`inputOperatingSystem`,`text`)),i.inputPath!==void 0&&l(g,[`input`,`path`],s(i.inputPath,`inputPath`,`text`)),i.inputSha256!==void 0&&l(g,[`input`,`sha256`],s(i.inputSha256,`inputSha256`,`text`)),i.inputThumbprint!==void 0&&l(g,[`input`,`thumbprint`],s(i.inputThumbprint,`inputThumbprint`,`text`)),i.inputId!==void 0&&l(g,[`input`,`id`],s(i.inputId,`inputId`,`text`)),i.inputDomain!==void 0&&l(g,[`input`,`domain`],s(i.inputDomain,`inputDomain`,`text`)),i.inputOperator!==void 0&&l(g,[`input`,`operator`],s(i.inputOperator,`inputOperator`,`text`)),i.inputOsDistroName!==void 0&&l(g,[`input`,`os_distro_name`],s(i.inputOsDistroName,`inputOsDistroName`,`text`)),i.inputOsDistroRevision!==void 0&&l(g,[`input`,`os_distro_revision`],s(i.inputOsDistroRevision,`inputOsDistroRevision`,`text`)),i.inputOsVersionExtra!==void 0&&l(g,[`input`,`os_version_extra`],s(i.inputOsVersionExtra,`inputOsVersionExtra`,`text`)),i.inputVersion!==void 0&&l(g,[`input`,`version`],s(i.inputVersion,`inputVersion`,`text`)),i.inputEnabled!==void 0&&l(g,[`input`,`enabled`],i.inputEnabled),i.inputCheckDisks!==void 0&&l(g,[`input`,`checkDisks`],i.inputCheckDisks),i.inputRequireAll!==void 0&&l(g,[`input`,`requireAll`],i.inputRequireAll),i.inputCertificateId!==void 0&&l(g,[`input`,`certificate_id`],s(i.inputCertificateId,`inputCertificateId`,`text`)),i.inputCn!==void 0&&l(g,[`input`,`cn`],s(i.inputCn,`inputCn`,`text`)),i.inputCheckPrivateKey!==void 0&&l(g,[`input`,`check_private_key`],i.inputCheckPrivateKey),i.inputExtendedKeyUsage!==void 0&&l(g,[`input`,`extended_key_usage`],i.inputExtendedKeyUsage),i.inputLocationsPaths!==void 0&&l(g,[`input`,`locations`,`paths`],i.inputLocationsPaths),i.inputLocationsTrustStores!==void 0&&l(g,[`input`,`locations`,`trust_stores`],i.inputLocationsTrustStores),i.inputSubjectAlternativeNames!==void 0&&l(g,[`input`,`subject_alternative_names`],i.inputSubjectAlternativeNames),i.inputUpdateWindowDays!==void 0&&l(g,[`input`,`update_window_days`],i.inputUpdateWindowDays),i.inputComplianceStatus!==void 0&&l(g,[`input`,`compliance_status`],s(i.inputComplianceStatus,`inputComplianceStatus`,`text`)),i.inputConnectionId!==void 0&&l(g,[`input`,`connection_id`],s(i.inputConnectionId,`inputConnectionId`,`text`)),i.inputLastSeen!==void 0&&l(g,[`input`,`last_seen`],s(i.inputLastSeen,`inputLastSeen`,`text`)),i.inputOs!==void 0&&l(g,[`input`,`os`],s(i.inputOs,`inputOs`,`text`)),i.inputOverall!==void 0&&l(g,[`input`,`overall`],s(i.inputOverall,`inputOverall`,`text`)),i.inputSensorConfig!==void 0&&l(g,[`input`,`sensor_config`],s(i.inputSensorConfig,`inputSensorConfig`,`text`)),i.inputState!==void 0&&l(g,[`input`,`state`],s(i.inputState,`inputState`,`text`)),i.inputVersionOperator!==void 0&&l(g,[`input`,`versionOperator`],s(i.inputVersionOperator,`inputVersionOperator`,`text`)),i.inputAuthState!==void 0&&l(g,[`input`,`auth_state`],i.inputAuthState),i.inputCountOperator!==void 0&&l(g,[`input`,`countOperator`],s(i.inputCountOperator,`inputCountOperator`,`text`)),i.inputIssueCount!==void 0&&l(g,[`input`,`issue_count`],s(i.inputIssueCount,`inputIssueCount`,`text`)),i.inputEidLastSeen!==void 0&&l(g,[`input`,`eid_last_seen`],s(i.inputEidLastSeen,`inputEidLastSeen`,`text`)),i.inputRiskLevel!==void 0&&l(g,[`input`,`risk_level`],s(i.inputRiskLevel,`inputRiskLevel`,`text`)),i.inputScoreOperator!==void 0&&l(g,[`input`,`scoreOperator`],s(i.inputScoreOperator,`inputScoreOperator`,`text`)),i.inputTotalScore!==void 0&&l(g,[`input`,`total_score`],i.inputTotalScore),i.inputActiveThreats!==void 0&&l(g,[`input`,`active_threats`],i.inputActiveThreats),i.inputInfected!==void 0&&l(g,[`input`,`infected`],i.inputInfected),i.inputIsActive!==void 0&&l(g,[`input`,`is_active`],i.inputIsActive),i.inputNetworkStatus!==void 0&&l(g,[`input`,`network_status`],s(i.inputNetworkStatus,`inputNetworkStatus`,`text`)),i.inputOperationalState!==void 0&&l(g,[`input`,`operational_state`],s(i.inputOperationalState,`inputOperationalState`,`text`)),i.inputScore!==void 0&&l(g,[`input`,`score`],i.inputScore),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.schedule!==void 0&&l(g,[`schedule`],s(i.schedule,`schedule`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),d(await m(`Creating posture`,async()=>o.post(`/accounts/${h}/devices/posture`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created posture`})}},Qr={command:`delete <ruleId>`,describe:`Deletes a device posture rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices posture delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/posture/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`posture`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting posture`,async()=>n.delete(`/accounts/${o}/devices/posture/${t.ruleId}`,{body:e})),{successLabel:`Deleted posture`});return}d(await m(`Deleting posture`,async()=>n.zeroTrust.devices.posture.delete(t.ruleId,o)),{successLabel:`Deleted posture`})}},$r={command:`get <ruleId>`,describe:`Fetches a single device posture rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`API UUID.`,demandOption:!0}),handler:async e=>{c(e.ruleId,`ruleId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading posture`,async()=>t.zeroTrust.devices.posture.get(e.ruleId,n)),{successLabel:`Loaded posture`})}},ei={command:`create`,describe:`Create a new device posture integration.`,builder:e=>e.option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`]),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices posture integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/posture/integration`,pathParams:{},bodyKind:`json`,body:{configApiUrl:i.configApiUrl,configAuthUrl:i.configAuthUrl,configClientId:i.configClientId,configClientSecret:i.configClientSecret,configCustomerId:i.configCustomerId,configClientKey:i.configClientKey,configAccessClientId:i.configAccessClientId,configAccessClientSecret:i.configAccessClientSecret,interval:i.interval,name:i.name,type:i.type,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating integration`,async()=>o.post(`/accounts/${h}/devices/posture/integration`,{body:e})),{successLabel:`Created integration`});return}i.interval===void 0&&(i.interval=await t(`interval`,"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`).")),i.name===void 0&&(i.name=await t(`name`,`The name of the device posture integration.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture integration.`,[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]));let g={};i.configApiUrl!==void 0&&l(g,[`config`,`api_url`],s(i.configApiUrl,`configApiUrl`,`text`)),i.configAuthUrl!==void 0&&l(g,[`config`,`auth_url`],s(i.configAuthUrl,`configAuthUrl`,`text`)),i.configClientId!==void 0&&l(g,[`config`,`client_id`],s(i.configClientId,`configClientId`,`text`)),i.configClientSecret!==void 0&&l(g,[`config`,`client_secret`],s(i.configClientSecret,`configClientSecret`,`text`)),i.configCustomerId!==void 0&&l(g,[`config`,`customer_id`],s(i.configCustomerId,`configCustomerId`,`text`)),i.configClientKey!==void 0&&l(g,[`config`,`client_key`],s(i.configClientKey,`configClientKey`,`text`)),i.configAccessClientId!==void 0&&l(g,[`config`,`access_client_id`],s(i.configAccessClientId,`configAccessClientId`,`text`)),i.configAccessClientSecret!==void 0&&l(g,[`config`,`access_client_secret`],s(i.configAccessClientSecret,`configAccessClientSecret`,`text`)),i.interval!==void 0&&l(g,[`interval`],s(i.interval,`interval`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),d(await m(`Creating integration`,async()=>o.post(`/accounts/${h}/devices/posture/integration`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created integration`})}},ti={command:`delete <integrationId>`,describe:`Delete a configured device posture integration.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.integrationId,`integrationId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices posture integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/posture/integration/${t.integrationId??`<integrationId>`}`,pathParams:{integrationId:String(t.integrationId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`integration`,String(t.integrationId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting integration`,async()=>n.delete(`/accounts/${o}/devices/posture/integration/${t.integrationId}`,{body:e})),{successLabel:`Deleted integration`});return}d(await m(`Deleting integration`,async()=>n.zeroTrust.devices.posture.integrations.delete(t.integrationId,o)),{successLabel:`Deleted integration`})}},ni={command:`edit <integrationId>`,describe:`Updates a configured device posture integration.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`config-api-url`,{type:`string`,description:`The Workspace One API URL provided in the Workspace One Admin Dashboard.`}).option(`config-auth-url`,{type:`string`,description:`The Workspace One Authorization URL depending on your region.`}).option(`config-client-id`,{type:`string`,description:`The Workspace One client ID provided in the Workspace One Admin Dashboard.`}).option(`config-client-secret`,{type:`string`,description:`The Workspace One client secret provided in the Workspace One Admin Dashboard.`}).option(`config-customer-id`,{type:`string`,description:`The Crowdstrike customer ID.`}).option(`config-client-key`,{type:`string`,description:`The Uptycs client secret.`}).option(`config-access-client-id`,{type:`string`,description:"If present, this id will be passed in the `CF-Access-Client-ID` header when hitting the `api_url`."}).option(`config-access-client-secret`,{type:`string`,description:"If present, this secret will be passed in the `CF-Access-Client-Secret` header when hitting the `api_url`."}).option(`interval`,{type:`string`,description:"The interval between each posture check with the third-party API. Use `m` for minutes (e.g. `5m`) and `h` for hours (e.g. `12h`)."}).option(`name`,{type:`string`,description:`The name of the device posture integration.`}).option(`type`,{type:`string`,description:`The type of device posture integration.`,choices:[`workspace_one`,`crowdstrike_s2s`,`uptycs`,`intune`,`kolide`,`tanium_s2s`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`config-api-url`,[`config-customer-id`,`config-client-id`,`config-client-secret`]).conflicts(`config-auth-url`,[`config-customer-id`,`config-client-key`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-auth-url`,[`config-api-url`,`config-client-id`,`config-client-secret`]).conflicts(`config-client-id`,[`config-client-key`,`config-customer-id`,`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-client-secret`,[`config-access-client-id`,`config-access-client-secret`,`config-api-url`]).conflicts(`config-customer-id`,[`config-auth-url`,`config-client-id`,`config-api-url`,`config-access-client-id`,`config-access-client-secret`]).conflicts(`config-client-key`,[`config-auth-url`,`config-client-id`,`config-access-client-id`,`config-access-client-secret`]).implies(`config-client-key`,[`config-api-url`,`config-customer-id`,`config-client-secret`]).conflicts(`config-access-client-id`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-id`,[`config-api-url`,`config-access-client-secret`]).conflicts(`config-access-client-secret`,[`config-auth-url`,`config-client-id`,`config-client-secret`,`config-customer-id`,`config-client-key`]).implies(`config-access-client-secret`,[`config-api-url`,`config-access-client-id`]),handler:async t=>{if(c(t.integrationId,`integrationId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices posture integrations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/posture/integration/${t.integrationId??`<integrationId>`}`,pathParams:{integrationId:String(t.integrationId??``)},bodyKind:`json`,body:{configApiUrl:t.configApiUrl,configAuthUrl:t.configAuthUrl,configClientId:t.configClientId,configClientSecret:t.configClientSecret,configCustomerId:t.configCustomerId,configClientKey:t.configClientKey,configAccessClientId:t.configAccessClientId,configAccessClientSecret:t.configAccessClientSecret,interval:t.interval,name:t.name,type:t.type,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating integration`,async()=>n.patch(`/accounts/${i}/devices/posture/integration/${t.integrationId}`,{body:e})),{successLabel:`Updated integration`});return}let o={};t.configApiUrl!==void 0&&l(o,[`config`,`api_url`],s(t.configApiUrl,`configApiUrl`,`text`)),t.configAuthUrl!==void 0&&l(o,[`config`,`auth_url`],s(t.configAuthUrl,`configAuthUrl`,`text`)),t.configClientId!==void 0&&l(o,[`config`,`client_id`],s(t.configClientId,`configClientId`,`text`)),t.configClientSecret!==void 0&&l(o,[`config`,`client_secret`],s(t.configClientSecret,`configClientSecret`,`text`)),t.configCustomerId!==void 0&&l(o,[`config`,`customer_id`],s(t.configCustomerId,`configCustomerId`,`text`)),t.configClientKey!==void 0&&l(o,[`config`,`client_key`],s(t.configClientKey,`configClientKey`,`text`)),t.configAccessClientId!==void 0&&l(o,[`config`,`access_client_id`],s(t.configAccessClientId,`configAccessClientId`,`text`)),t.configAccessClientSecret!==void 0&&l(o,[`config`,`access_client_secret`],s(t.configAccessClientSecret,`configAccessClientSecret`,`text`)),t.interval!==void 0&&l(o,[`interval`],s(t.interval,`interval`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.type!==void 0&&l(o,[`type`],s(t.type,`type`,`text`)),d(await m(`Updating integration`,async()=>n.patch(`/accounts/${i}/devices/posture/integration/${t.integrationId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated integration`})}},ri={command:`get <integrationId>`,describe:`Fetches details for a single device posture integration.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`API UUID.`,demandOption:!0}),handler:async e=>{c(e.integrationId,`integrationId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integration`,async()=>t.zeroTrust.devices.posture.integrations.get(e.integrationId,n)),{successLabel:`Loaded integration`})}},ii={command:`list`,describe:`Fetches the list of device posture integrations for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integrations`,async()=>t.zeroTrust.devices.posture.integrations.list(n)),{successLabel:`Loaded integrations`})}},ai={command:`integrations`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(ei).command(ti).command(ni).command(ri).command(ii).demandCommand(1),handler:()=>{}},oi={command:`list`,describe:`Fetches device posture rules for a Zero Trust account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading posture`,async()=>t.zeroTrust.devices.posture.list(n)),{successLabel:`Loaded posture`})}},si={command:`update <ruleId>`,describe:`Updates a device posture rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`API UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`The description of the device posture rule.`}).option(`expiration`,{type:`string`,description:`Sets the expiration time for a posture check result. If empty, the result remains valid until it is overwritten by new data from the WARP client.`}).option(`input-exists`,{type:`boolean`,description:`Whether or not file exists.`}).option(`input-operating-system`,{type:`string`,description:`Operating system.`,choices:[`windows`,`linux`,`mac`,`android`,`ios`,`chromeos`]}).option(`input-path`,{type:`string`,description:`File path.`}).option(`input-sha256`,{type:`string`,description:`SHA-256.`}).option(`input-thumbprint`,{type:`string`,description:`Signing certificate thumbprint.`}).option(`input-id`,{type:`string`,description:`List ID.`}).option(`input-domain`,{type:`string`,description:`Domain.`}).option(`input-operator`,{type:`string`,description:`Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-os-distro-name`,{type:`string`,description:`Operating System Distribution Name (linux only).`}).option(`input-os-distro-revision`,{type:`string`,description:`Version of OS Distribution (linux only).`}).option(`input-os-version-extra`,{type:`string`,description:`Additional operating system version details. For Windows, the UBR (Update Build Revision). For Mac or iOS, the Product Version Extra. For Linux, the distribution name and version.`}).option(`input-version`,{type:`string`,description:`Version of OS.`}).option(`input-enabled`,{type:`boolean`,description:`Enabled.`}).option(`input-check-disks`,{type:`string`,array:!0,description:`List of volume names to be checked for encryption.`}).option(`input-require-all`,{type:`boolean`,description:`Whether to check all disks for encryption.`}).option(`input-certificate-id`,{type:`string`,description:`UUID of Cloudflare managed certificate.`}).option(`input-cn`,{type:`string`,description:`Common Name that is protected by the certificate.`}).option(`input-check-private-key`,{type:`boolean`,description:`Confirm the certificate was not imported from another device. We recommend keeping this enabled unless the certificate was deployed without a private key.`}).option(`input-extended-key-usage`,{type:`string`,array:!0,description:`List of values indicating purposes for which the certificate public key can be used.`}).option(`input-locations-paths`,{type:`string`,array:!0,description:`List of paths to check for client certificate on linux.`}).option(`input-locations-trust-stores`,{type:`string`,array:!0,description:`List of trust stores to check for client certificate.`}).option(`input-subject-alternative-names`,{type:`string`,array:!0,description:`List of certificate Subject Alternative Names.`}).option(`input-update-window-days`,{type:`number`,description:`Number of days that the antivirus should be updated within.`}).option(`input-compliance-status`,{type:`string`,description:`Compliance Status.`,choices:[`compliant`,`noncompliant`,`unknown`,`notapplicable`,`ingraceperiod`,`error`]}).option(`input-connection-id`,{type:`string`,description:`Posture Integration ID.`}).option(`input-last-seen`,{type:`string`,description:`For more details on last seen, please refer to the Crowdstrike documentation.`}).option(`input-os`,{type:`string`,description:`Os Version.`}).option(`input-overall`,{type:`string`,description:`Overall.`}).option(`input-sensor-config`,{type:`string`,description:`SensorConfig.`}).option(`input-state`,{type:`string`,description:`For more details on state, please refer to the Crowdstrike documentation.`,choices:[`online`,`offline`,`unknown`]}).option(`input-version-operator`,{type:`string`,description:`Version Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-auth-state`,{type:`string`,array:!0,description:`The set of Kolide device authentication states that pass the posture check. Device must match one of the specified states.`}).option(`input-count-operator`,{type:`string`,description:`Count Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-issue-count`,{type:`string`,description:`The Number of Issues.`}).option(`input-eid-last-seen`,{type:`string`,description:`For more details on eid last seen, refer to the Tanium documentation.`}).option(`input-risk-level`,{type:`string`,description:`For more details on risk level, refer to the Tanium documentation.`,choices:[`low`,`medium`,`high`,`critical`]}).option(`input-score-operator`,{type:`string`,description:`Score Operator.`,choices:[`<`,`<=`,`>`,`>=`,`==`]}).option(`input-total-score`,{type:`number`,description:`For more details on total score, refer to the Tanium documentation.`}).option(`input-active-threats`,{type:`number`,description:`The Number of active threats.`}).option(`input-infected`,{type:`boolean`,description:`Whether device is infected.`}).option(`input-is-active`,{type:`boolean`,description:`Whether device is active.`}).option(`input-network-status`,{type:`string`,description:`Network status of device.`,choices:[`connected`,`disconnected`,`disconnecting`,`connecting`]}).option(`input-operational-state`,{type:`string`,description:`Agent operational state.`,choices:[`na`,`partially_disabled`,`auto_fully_disabled`,`fully_disabled`,`auto_partially_disabled`,`disabled_error`,`db_corruption`]}).option(`input-score`,{type:`number`,description:`A value between 0-100 assigned to devices set by the 3rd party posture provider.`}).option(`name`,{type:`string`,description:`The name of the device posture rule.`}).option(`schedule`,{type:`string`,description:"Polling frequency for the WARP client posture check. Default: `5m` (poll every five minutes). Minimum: `1m`."}).option(`type`,{type:`string`,description:`The type of device posture rule.`,choices:[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).conflicts(`input-exists`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operating-system`,`input-id.input-check-disks.input-require-all.input-certificate-id.input-cn.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-operator.input-os.input-overall.input-sensor-config.input-state.input-version.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-path`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sha256`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-thumbprint`,`input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-id`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-domain`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-operator`,[`input-exists`,`input-path`,`input-sha256`,`input-thumbprint`,`input-operating-system`,`input-id`,`input-domain`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`,`input-compliance-status`,`input-connection-id`,`input-auth-state`,`input-count-operator`,`input-issue-count`]).conflicts(`input-os-distro-name`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-distro-revision`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os-version-extra`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version`,`input-exists.input-path.input-sha256.input-thumbprint.input-operating-system.input-id.input-domain.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-version`,[`input-operating-system`,`input-operator`]).conflicts(`input-enabled`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-enabled`,[`input-operating-system`]).conflicts(`input-check-disks`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-require-all`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-certificate-id`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-cn`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-cn`,[`input-certificate-id`]).conflicts(`input-check-private-key`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).implies(`input-check-private-key`,[`input-certificate-id`,`input-operating-system`]).conflicts(`input-extended-key-usage`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-paths`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-locations-trust-stores`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-subject-alternative-names`,`input-exists.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-update-window-days.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-update-window-days`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-compliance-status.input-connection-id.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-compliance-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-connection-id`,[`input-exists`,`input-operating-system`,`input-path`,`input-sha256`,`input-thumbprint`,`input-id`,`input-domain`,`input-operator`,`input-os-distro-name`,`input-os-distro-revision`,`input-os-version-extra`,`input-version`,`input-enabled`,`input-check-disks`,`input-require-all`,`input-certificate-id`,`input-cn`,`input-check-private-key`,`input-extended-key-usage`,`input-locations-paths`,`input-locations-trust-stores`,`input-subject-alternative-names`,`input-update-window-days`]).conflicts(`input-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-os`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-overall`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-sensor-config`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-version-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-auth-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-count-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-issue-count`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-operator.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-eid-last-seen`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-risk-level`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-score-operator`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-total-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state.input-score`.split(`.`)).conflicts(`input-active-threats`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-infected`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-is-active`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-network-status`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-operational-state`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-score`.split(`.`)).conflicts(`input-score`,`input-exists.input-operating-system.input-path.input-sha256.input-thumbprint.input-id.input-domain.input-os-distro-name.input-os-distro-revision.input-os-version-extra.input-version.input-enabled.input-check-disks.input-require-all.input-certificate-id.input-cn.input-check-private-key.input-extended-key-usage.input-locations-paths.input-locations-trust-stores.input-subject-alternative-names.input-update-window-days.input-compliance-status.input-last-seen.input-os.input-overall.input-sensor-config.input-state.input-version-operator.input-auth-state.input-count-operator.input-issue-count.input-eid-last-seen.input-risk-level.input-score-operator.input-total-score.input-active-threats.input-infected.input-is-active.input-network-status.input-operational-state`.split(`.`)).implies(`input-score`,[`input-connection-id`,`input-operator`]),handler:async i=>{if(c(i.ruleId,`ruleId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices posture update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/posture/${i.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(i.ruleId??``)},bodyKind:`json`,body:{description:i.description,expiration:i.expiration,inputExists:i.inputExists,inputOperatingSystem:i.inputOperatingSystem,inputPath:i.inputPath,inputSha256:i.inputSha256,inputThumbprint:i.inputThumbprint,inputId:i.inputId,inputDomain:i.inputDomain,inputOperator:i.inputOperator,inputOsDistroName:i.inputOsDistroName,inputOsDistroRevision:i.inputOsDistroRevision,inputOsVersionExtra:i.inputOsVersionExtra,inputVersion:i.inputVersion,inputEnabled:i.inputEnabled,inputCheckDisks:i.inputCheckDisks,inputRequireAll:i.inputRequireAll,inputCertificateId:i.inputCertificateId,inputCn:i.inputCn,inputCheckPrivateKey:i.inputCheckPrivateKey,inputExtendedKeyUsage:i.inputExtendedKeyUsage,inputLocationsPaths:i.inputLocationsPaths,inputLocationsTrustStores:i.inputLocationsTrustStores,inputSubjectAlternativeNames:i.inputSubjectAlternativeNames,inputUpdateWindowDays:i.inputUpdateWindowDays,inputComplianceStatus:i.inputComplianceStatus,inputConnectionId:i.inputConnectionId,inputLastSeen:i.inputLastSeen,inputOs:i.inputOs,inputOverall:i.inputOverall,inputSensorConfig:i.inputSensorConfig,inputState:i.inputState,inputVersionOperator:i.inputVersionOperator,inputAuthState:i.inputAuthState,inputCountOperator:i.inputCountOperator,inputIssueCount:i.inputIssueCount,inputEidLastSeen:i.inputEidLastSeen,inputRiskLevel:i.inputRiskLevel,inputScoreOperator:i.inputScoreOperator,inputTotalScore:i.inputTotalScore,inputActiveThreats:i.inputActiveThreats,inputInfected:i.inputInfected,inputIsActive:i.inputIsActive,inputNetworkStatus:i.inputNetworkStatus,inputOperationalState:i.inputOperationalState,inputScore:i.inputScore,name:i.name,schedule:i.schedule,type:i.type,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating posture`,async()=>o.put(`/accounts/${h}/devices/posture/${i.ruleId}`,{body:e})),{successLabel:`Updated posture`});return}i.name===void 0&&(i.name=await t(`name`,`The name of the device posture rule.`)),i.type===void 0&&(i.type=await n(`type`,`The type of device posture rule.`,[`file`,`application`,`tanium`,`gateway`,`warp`,`disk_encryption`,`serial_number`,`sentinelone`,`carbonblack`,`firewall`,`os_version`,`domain_joined`,`client_certificate`,`client_certificate_v2`,`antivirus`,`unique_client_id`,`kolide`,`tanium_s2s`,`crowdstrike_s2s`,`intune`,`workspace_one`,`sentinelone_s2s`,`custom_s2s`]));let g={};i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.expiration!==void 0&&l(g,[`expiration`],s(i.expiration,`expiration`,`text`)),i.inputExists!==void 0&&l(g,[`input`,`exists`],i.inputExists),i.inputOperatingSystem!==void 0&&l(g,[`input`,`operating_system`],s(i.inputOperatingSystem,`inputOperatingSystem`,`text`)),i.inputPath!==void 0&&l(g,[`input`,`path`],s(i.inputPath,`inputPath`,`text`)),i.inputSha256!==void 0&&l(g,[`input`,`sha256`],s(i.inputSha256,`inputSha256`,`text`)),i.inputThumbprint!==void 0&&l(g,[`input`,`thumbprint`],s(i.inputThumbprint,`inputThumbprint`,`text`)),i.inputId!==void 0&&l(g,[`input`,`id`],s(i.inputId,`inputId`,`text`)),i.inputDomain!==void 0&&l(g,[`input`,`domain`],s(i.inputDomain,`inputDomain`,`text`)),i.inputOperator!==void 0&&l(g,[`input`,`operator`],s(i.inputOperator,`inputOperator`,`text`)),i.inputOsDistroName!==void 0&&l(g,[`input`,`os_distro_name`],s(i.inputOsDistroName,`inputOsDistroName`,`text`)),i.inputOsDistroRevision!==void 0&&l(g,[`input`,`os_distro_revision`],s(i.inputOsDistroRevision,`inputOsDistroRevision`,`text`)),i.inputOsVersionExtra!==void 0&&l(g,[`input`,`os_version_extra`],s(i.inputOsVersionExtra,`inputOsVersionExtra`,`text`)),i.inputVersion!==void 0&&l(g,[`input`,`version`],s(i.inputVersion,`inputVersion`,`text`)),i.inputEnabled!==void 0&&l(g,[`input`,`enabled`],i.inputEnabled),i.inputCheckDisks!==void 0&&l(g,[`input`,`checkDisks`],i.inputCheckDisks),i.inputRequireAll!==void 0&&l(g,[`input`,`requireAll`],i.inputRequireAll),i.inputCertificateId!==void 0&&l(g,[`input`,`certificate_id`],s(i.inputCertificateId,`inputCertificateId`,`text`)),i.inputCn!==void 0&&l(g,[`input`,`cn`],s(i.inputCn,`inputCn`,`text`)),i.inputCheckPrivateKey!==void 0&&l(g,[`input`,`check_private_key`],i.inputCheckPrivateKey),i.inputExtendedKeyUsage!==void 0&&l(g,[`input`,`extended_key_usage`],i.inputExtendedKeyUsage),i.inputLocationsPaths!==void 0&&l(g,[`input`,`locations`,`paths`],i.inputLocationsPaths),i.inputLocationsTrustStores!==void 0&&l(g,[`input`,`locations`,`trust_stores`],i.inputLocationsTrustStores),i.inputSubjectAlternativeNames!==void 0&&l(g,[`input`,`subject_alternative_names`],i.inputSubjectAlternativeNames),i.inputUpdateWindowDays!==void 0&&l(g,[`input`,`update_window_days`],i.inputUpdateWindowDays),i.inputComplianceStatus!==void 0&&l(g,[`input`,`compliance_status`],s(i.inputComplianceStatus,`inputComplianceStatus`,`text`)),i.inputConnectionId!==void 0&&l(g,[`input`,`connection_id`],s(i.inputConnectionId,`inputConnectionId`,`text`)),i.inputLastSeen!==void 0&&l(g,[`input`,`last_seen`],s(i.inputLastSeen,`inputLastSeen`,`text`)),i.inputOs!==void 0&&l(g,[`input`,`os`],s(i.inputOs,`inputOs`,`text`)),i.inputOverall!==void 0&&l(g,[`input`,`overall`],s(i.inputOverall,`inputOverall`,`text`)),i.inputSensorConfig!==void 0&&l(g,[`input`,`sensor_config`],s(i.inputSensorConfig,`inputSensorConfig`,`text`)),i.inputState!==void 0&&l(g,[`input`,`state`],s(i.inputState,`inputState`,`text`)),i.inputVersionOperator!==void 0&&l(g,[`input`,`versionOperator`],s(i.inputVersionOperator,`inputVersionOperator`,`text`)),i.inputAuthState!==void 0&&l(g,[`input`,`auth_state`],i.inputAuthState),i.inputCountOperator!==void 0&&l(g,[`input`,`countOperator`],s(i.inputCountOperator,`inputCountOperator`,`text`)),i.inputIssueCount!==void 0&&l(g,[`input`,`issue_count`],s(i.inputIssueCount,`inputIssueCount`,`text`)),i.inputEidLastSeen!==void 0&&l(g,[`input`,`eid_last_seen`],s(i.inputEidLastSeen,`inputEidLastSeen`,`text`)),i.inputRiskLevel!==void 0&&l(g,[`input`,`risk_level`],s(i.inputRiskLevel,`inputRiskLevel`,`text`)),i.inputScoreOperator!==void 0&&l(g,[`input`,`scoreOperator`],s(i.inputScoreOperator,`inputScoreOperator`,`text`)),i.inputTotalScore!==void 0&&l(g,[`input`,`total_score`],i.inputTotalScore),i.inputActiveThreats!==void 0&&l(g,[`input`,`active_threats`],i.inputActiveThreats),i.inputInfected!==void 0&&l(g,[`input`,`infected`],i.inputInfected),i.inputIsActive!==void 0&&l(g,[`input`,`is_active`],i.inputIsActive),i.inputNetworkStatus!==void 0&&l(g,[`input`,`network_status`],s(i.inputNetworkStatus,`inputNetworkStatus`,`text`)),i.inputOperationalState!==void 0&&l(g,[`input`,`operational_state`],s(i.inputOperationalState,`inputOperationalState`,`text`)),i.inputScore!==void 0&&l(g,[`input`,`score`],i.inputScore),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.schedule!==void 0&&l(g,[`schedule`],s(i.schedule,`schedule`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),d(await m(`Updating posture`,async()=>o.put(`/accounts/${h}/devices/posture/${i.ruleId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated posture`})}},ci={command:`posture`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Zr).command(Qr).command($r).command(oi).command(si).command(ai).demandCommand(1),handler:()=>{}},li={command:`bulk-delete`,describe:`Deletes a list of WARP registrations.`,builder:e=>e.option(`id`,{type:`string`,description:`A list of registration IDs to delete.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{let n={};if(t.id!==void 0&&(n.id=t.id),t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices registrations bulk-delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/registrations`,pathParams:{},bodyKind:`json`,body:{...n},validation:`passed`});return}let o=await a(t),s=t.local?p:await r(o);if(t.accountId=s,!await i(`registrations`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting registrations`,async()=>o.zeroTrust.devices.registrations.bulkDelete(s,Object.keys(n).length>0?n:void 0)),{successLabel:`Deleted registrations`})}},ui={command:`delete <registrationId>`,describe:`Deletes a WARP registration.`,builder:e=>e.positional(`registrationId`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.registrationId,`registrationId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices registrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/registrations/${t.registrationId??`<registrationId>`}`,pathParams:{registrationId:String(t.registrationId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`registration`,String(t.registrationId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting registration`,async()=>n.zeroTrust.devices.registrations.delete(t.registrationId,o)),{successLabel:`Deleted registration`})}},di={command:`get <registrationId>`,describe:`Fetches a single WARP registration.`,builder:e=>e.positional(`registrationId`,{type:`string`,description:`Registration ID`,demandOption:!0}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}),handler:async e=>{c(e.registrationId,`registrationId`);let t={};e.include!==void 0&&(t.include=e.include);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading registration`,async()=>n.zeroTrust.devices.registrations.get(e.registrationId,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded registration`})}},fi={command:`list`,describe:`Lists WARP registrations.`,builder:e=>e.option(`user-id`,{type:`string`,description:`Filter by user ID.`}).option(`seen-after`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen after this timestamp.`}).option(`seen-before`,{type:`string`,description:`Filter by the last_seen timestamp - returns only registrations last seen before this timestamp.`}).option(`status`,{type:`string`,description:`Filter by registration status. Defaults to 'active'.`,choices:[`active`,`all`,`revoked`]}).option(`per-page`,{type:`number`,description:`The maximum number of devices to return in a single response.`}).option(`search`,{type:`string`,description:`Filter by registration details.`}).option(`sort-by`,{type:`string`,description:`The registration field to order results by.`,choices:[`id`,`user.name`,`user.email`,`last_seen_at`,`created_at`]}).option(`sort-order`,{type:`string`,description:`Sort direction.`,choices:[`asc`,`desc`]}).option(`cursor`,{type:`string`,description:`Opaque token indicating the starting position when requesting the next set of records. A cursor value can be obtained from the result_info.cursor field in the response.`}).option(`id`,{type:`string`,description:`Filter by registration ID.`}).option(`device-id`,{type:`string`,description:`Filter by WARP device ID.`}).option(`include`,{type:`string`,description:`Comma-separated list of additional information that should be included in the registration response. Supported values are: "policy".`}),handler:async e=>{let t={};e.userId!==void 0&&(t.userId=e.userId),e.seenAfter!==void 0&&(t.seen_after=e.seenAfter),e.seenBefore!==void 0&&(t.seen_before=e.seenBefore),e.status!==void 0&&(t.status=e.status),e.perPage!==void 0&&(t.per_page=e.perPage),e.search!==void 0&&(t.search=e.search),e.sortBy!==void 0&&(t.sort_by=e.sortBy),e.sortOrder!==void 0&&(t.sort_order=e.sortOrder),e.cursor!==void 0&&(t.cursor=e.cursor),e.id!==void 0&&(t.id=e.id),e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.include!==void 0&&(t.include=e.include);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading registrations`,async()=>n.zeroTrust.devices.registrations.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded registrations`})}},pi={command:`revoke`,describe:`Revokes a list of WARP registrations.`,builder:e=>e.option(`id`,{type:`string`,description:`A list of registration IDs to revoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{let n={};if(t.id!==void 0&&(n.id=t.id),t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices registrations revoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/registrations/revoke`,pathParams:{},bodyKind:`json`,body:{...n},validation:`passed`});return}let o=await a(t),s=t.local?p:await r(o);if(t.accountId=s,!await i(`registration`,``,{force:!!t.force,message:`This operation revokes device registrations destructively.`})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting registration`,async()=>o.zeroTrust.devices.registrations.revoke(s,Object.keys(n).length>0?n:void 0)),{successLabel:`Deleted registration`})}},mi={command:`unrevoke`,describe:`Unrevokes a list of WARP registrations.`,builder:e=>e.option(`id`,{type:`string`,description:`A list of registration IDs to unrevoke.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{let n={};if(t.id!==void 0&&(n.id=t.id),t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices registrations unrevoke`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/registrations/unrevoke`,pathParams:{},bodyKind:`json`,body:{...n},validation:`passed`});return}let i=await a(t),o=t.local?p:await r(i);t.accountId=o,d(await m(`Creating registration`,async()=>i.zeroTrust.devices.registrations.unrevoke(o,Object.keys(n).length>0?n:void 0)),{successLabel:`Created registration`})}},hi={command:`registrations`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(li).command(ui).command(di).command(fi).command(pi).command(mi).demandCommand(1),handler:()=>{}},gi={command:`create`,describe:`Sets the Global WARP override state.`,builder:e=>e.option(`disconnect`,{type:`boolean`,description:`Disconnects all devices on the account using Global WARP override.`}).option(`justification`,{type:`string`,description:`Reasoning for setting the Global WARP override state. This will be surfaced in the audit log.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices resilience global-warp-override create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/resilience/disconnect`,pathParams:{},bodyKind:`json`,body:{disconnect:t.disconnect,justification:t.justification,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating global warp override`,async()=>n.post(`/accounts/${i}/devices/resilience/disconnect`,{body:e})),{successLabel:`Created global warp override`});return}if(t.disconnect===void 0)throw Error(`--disconnect is required (or pass --body with this field set).`);let o={};t.disconnect!==void 0&&l(o,[`disconnect`],t.disconnect),t.justification!==void 0&&l(o,[`justification`],s(t.justification,`justification`,`text`)),d(await m(`Creating global warp override`,async()=>n.post(`/accounts/${i}/devices/resilience/disconnect`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created global warp override`})}},_i={command:`get`,describe:`Fetch the Global WARP override state.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading global warp override`,async()=>t.zeroTrust.devices.resilience.globalWarpOverride.get(n)),{successLabel:`Loaded global warp override`})}},vi={command:`global-warp-override`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(gi).command(_i).demandCommand(1),handler:()=>{}},yi={command:`resilience`,describe:`Operations for devices.resilience`,builder:e=>e.command(vi).demandCommand(1),handler:()=>{}},bi={command:`create`,describe:`Revokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/revoke instead.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to revoke.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices revoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/revoke`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`device`,``,{force:!!t.force,message:`This operation revokes sessions for a batch of devices destructively.`})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting device`,async()=>n.post(`/accounts/${o}/devices/revoke`,{body:e})),{successLabel:`Deleted device`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},xi={command:`revoke`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(bi).demandCommand(1),handler:()=>{}},Si={command:`delete`,describe:`Resets the current device settings for a Zero Trust account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust devices settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`setting`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting setting`,async()=>n.zeroTrust.devices.settings.delete(o)),{successLabel:`Deleted setting`})}},Ci={command:`edit`,describe:`Patches the current device settings for a Zero Trust account.`,builder:e=>e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:{disableForTime:t.disableForTime,externalEmergencySignalEnabled:t.externalEmergencySignalEnabled,externalEmergencySignalFingerprint:t.externalEmergencySignalFingerprint,externalEmergencySignalInterval:t.externalEmergencySignalInterval,externalEmergencySignalUrl:t.externalEmergencySignalUrl,gatewayProxyEnabled:t.gatewayProxyEnabled,gatewayUdpProxyEnabled:t.gatewayUdpProxyEnabled,rootCertificateInstallationEnabled:t.rootCertificateInstallationEnabled,useZtVirtualIp:t.useZtVirtualIp,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/devices/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.disableForTime!==void 0&&l(o,[`disable_for_time`],t.disableForTime),t.externalEmergencySignalEnabled!==void 0&&l(o,[`external_emergency_signal_enabled`],t.externalEmergencySignalEnabled),t.externalEmergencySignalFingerprint!==void 0&&l(o,[`external_emergency_signal_fingerprint`],s(t.externalEmergencySignalFingerprint,`externalEmergencySignalFingerprint`,`text`)),t.externalEmergencySignalInterval!==void 0&&l(o,[`external_emergency_signal_interval`],s(t.externalEmergencySignalInterval,`externalEmergencySignalInterval`,`text`)),t.externalEmergencySignalUrl!==void 0&&l(o,[`external_emergency_signal_url`],s(t.externalEmergencySignalUrl,`externalEmergencySignalUrl`,`text`)),t.gatewayProxyEnabled!==void 0&&l(o,[`gateway_proxy_enabled`],t.gatewayProxyEnabled),t.gatewayUdpProxyEnabled!==void 0&&l(o,[`gateway_udp_proxy_enabled`],t.gatewayUdpProxyEnabled),t.rootCertificateInstallationEnabled!==void 0&&l(o,[`root_certificate_installation_enabled`],t.rootCertificateInstallationEnabled),t.useZtVirtualIp!==void 0&&l(o,[`use_zt_virtual_ip`],t.useZtVirtualIp),d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/devices/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},wi={command:`get`,describe:`Describes the current device settings for a Zero Trust account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading setting`,async()=>t.zeroTrust.devices.settings.get(n)),{successLabel:`Loaded setting`})}},Ti={command:`update`,describe:`Updates the current device settings for a Zero Trust account.`,builder:e=>e.option(`disable-for-time`,{type:`number`,description:`Sets the time limit, in seconds, that a user can use an override code to bypass WARP.`}).option(`external-emergency-signal-enabled`,{type:`boolean`,description:`Controls whether the external emergency disconnect feature is enabled.`}).option(`external-emergency-signal-fingerprint`,{type:`string`,description:`The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.`}).option(`external-emergency-signal-interval`,{type:`string`,description:`The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.`}).option(`external-emergency-signal-url`,{type:`string`,description:`The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.`}).option(`gateway-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on TCP.`}).option(`gateway-udp-proxy-enabled`,{type:`boolean`,description:`Enable gateway proxy filtering on UDP.`}).option(`root-certificate-installation-enabled`,{type:`boolean`,description:`Enable installation of cloudflare managed root certificate.`}).option(`use-zt-virtual-ip`,{type:`boolean`,description:`Enable using CGNAT virtual IPv4.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/settings`,pathParams:{},bodyKind:`json`,body:{disableForTime:t.disableForTime,externalEmergencySignalEnabled:t.externalEmergencySignalEnabled,externalEmergencySignalFingerprint:t.externalEmergencySignalFingerprint,externalEmergencySignalInterval:t.externalEmergencySignalInterval,externalEmergencySignalUrl:t.externalEmergencySignalUrl,gatewayProxyEnabled:t.gatewayProxyEnabled,gatewayUdpProxyEnabled:t.gatewayUdpProxyEnabled,rootCertificateInstallationEnabled:t.rootCertificateInstallationEnabled,useZtVirtualIp:t.useZtVirtualIp,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/devices/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.disableForTime!==void 0&&l(o,[`disable_for_time`],t.disableForTime),t.externalEmergencySignalEnabled!==void 0&&l(o,[`external_emergency_signal_enabled`],t.externalEmergencySignalEnabled),t.externalEmergencySignalFingerprint!==void 0&&l(o,[`external_emergency_signal_fingerprint`],s(t.externalEmergencySignalFingerprint,`externalEmergencySignalFingerprint`,`text`)),t.externalEmergencySignalInterval!==void 0&&l(o,[`external_emergency_signal_interval`],s(t.externalEmergencySignalInterval,`externalEmergencySignalInterval`,`text`)),t.externalEmergencySignalUrl!==void 0&&l(o,[`external_emergency_signal_url`],s(t.externalEmergencySignalUrl,`externalEmergencySignalUrl`,`text`)),t.gatewayProxyEnabled!==void 0&&l(o,[`gateway_proxy_enabled`],t.gatewayProxyEnabled),t.gatewayUdpProxyEnabled!==void 0&&l(o,[`gateway_udp_proxy_enabled`],t.gatewayUdpProxyEnabled),t.rootCertificateInstallationEnabled!==void 0&&l(o,[`root_certificate_installation_enabled`],t.rootCertificateInstallationEnabled),t.useZtVirtualIp!==void 0&&l(o,[`use_zt_virtual_ip`],t.useZtVirtualIp),d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/devices/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},Ei={command:`settings`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Si).command(Ci).command(wi).command(Ti).demandCommand(1),handler:()=>{}},Di={command:`create`,describe:`Unrevokes a list of devices. Not supported when [multi-user mode](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/) is enabled. **Deprecated**: please use POST /accounts/{account_id}/devices/registrations/unrevoke instead.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A list of Registration IDs to unrevoke.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust devices unrevoke create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/devices/unrevoke`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating unrevoke`,async()=>n.post(`/accounts/${i}/devices/unrevoke`,{body:e})),{successLabel:`Created unrevoke`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Oi={command:`unrevoke`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(Di).demandCommand(1),handler:()=>{}},ki={command:`devices`,describe:`Enrolled devices, WARP client profiles, posture checks, and device-level policies`,builder:e=>e.command(rr).command(ur).command(In).command(Un).command(Jn).command(er).command(nr).command(lr).command(gr).command(yr).command(Xr).command(ci).command(hi).command(yi).command(xi).command(Ei).command(Oi).demandCommand(1),handler:()=>{}},Ai={command:`list`,describe:`List Cloudflare colos that account's devices were connected to during a time period, sorted by usage starting from the most used colo. Colos without traffic are also returned and sorted alphabetically.`,builder:e=>e.option(`from`,{type:`string`,description:`Start time for connection period in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for connection period in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Type of usage that colos should be sorted by. If unspecified, returns all Cloudflare colos sorted alphabetically.`,choices:[`fleet-status-usage`,`application-tests-usage`]}),handler:async e=>{let t={};e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.sortBy!==void 0&&(t.sortBy=e.sortBy);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading colos`,async()=>n.zeroTrust.dex.colos.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded colos`})}},ji={command:`colos`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ai).demandCommand(1),handler:()=>{}},Mi={command:`create`,describe:`Initiate commands for up to 10 devices per account`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dex commands create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dex/commands`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating command`,async()=>n.post(`/accounts/${i}/dex/commands`,{body:e})),{successLabel:`Created command`});return}d(await m(`Creating command`,async()=>n.zeroTrust.dex.commands.create(i)),{successLabel:`Created command`})}},Ni={command:`list`,describe:`List devices with WARP client support for remote captures which have been connected in the last 1 hour.`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`search`,{type:`string`,description:`Filter devices by name or email`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.search!==void 0&&(t.search=e.search);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading devices`,async()=>n.zeroTrust.dex.commands.devices.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded devices`})}},Pi={command:`devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ni).demandCommand(1),handler:()=>{}},Fi={command:`get <filename>`,describe:`Downloads artifacts for an executed command. Bulk downloads are not supported`,builder:e=>e.positional(`filename`,{type:`string`,description:"The name of the file to be downloaded, including the `.zip` extension",demandOption:!0}).option(`command-id`,{type:`string`,description:`Unique identifier for command`,demandOption:!0}).option(`text`,{type:`boolean`,description:`Decode the response body as UTF-8 text instead of writing raw bytes`,default:!1}),handler:async e=>{c(e.filename,`filename`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n;let i=await m(`Loading download`,async()=>g(`/accounts/${n}/dex/commands/${e.commandId}/downloads/${e.filename}`,`GET`,e.local?e.localEndpoint:void 0));h(e.text===!0?i.toString(`utf-8`):i)}},Ii={command:`downloads`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Fi).demandCommand(1),handler:()=>{}},Li={command:`list`,describe:`Retrieves a paginated list of commands issued to devices under the specified account, optionally filtered by time range, device, or other parameters`,builder:e=>e.option(`page`,{type:`number`,description:`Page number for pagination`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of results per page`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`}).option(`device-id`,{type:`string`,description:`Unique identifier for a device`}).option(`user-email`,{type:`string`,description:`Email tied to the device`}).option(`command-type`,{type:`string`,description:`Optionally filter executed commands by command type`}).option(`status`,{type:`string`,description:`Optionally filter executed commands by status`,choices:[`PENDING_EXEC`,`PENDING_UPLOAD`,`SUCCESS`,`FAILED`]}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.deviceId!==void 0&&(t.device_id=e.deviceId),e.userEmail!==void 0&&(t.user_email=e.userEmail),e.commandType!==void 0&&(t.command_type=e.commandType),e.status!==void 0&&(t.status=e.status);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading commands`,async()=>n.zeroTrust.dex.commands.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded commands`})}},Ri={command:`get`,describe:`Retrieves the current quota usage and limits for device commands within a specific account, including the time when the quota will reset`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading quota`,async()=>t.zeroTrust.dex.commands.quota.get(n)),{successLabel:`Loaded quota`})}},zi={command:`quota`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ri).demandCommand(1),handler:()=>{}},Bi={command:`commands`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Mi).command(Li).command(Pi).command(Ii).command(zi).demandCommand(1),handler:()=>{}},Vi={command:`list`,describe:`List details for devices using WARP`,builder:e=>e.option(`to`,{type:`string`,description:`Time range end in ISO format`,demandOption:!0}).option(`from`,{type:`string`,description:`Time range beginning in ISO format`,demandOption:!0}).option(`page`,{type:`string`,description:`Page number`,demandOption:!0}).option(`per-page`,{type:`string`,description:`Number of results per page`,demandOption:!0}).option(`sort-by`,{type:`string`,description:`Dimension to sort results by`,choices:[`colo`,`device_id`,`mode`,`platform`,`status`,`timestamp`,`version`]}).option(`colo`,{type:`string`,description:`Cloudflare colo`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID v4`}).option(`mode`,{type:`string`,description:`The mode under which the WARP client is run`}).option(`status`,{type:`string`,description:`Network status`}).option(`platform`,{type:`string`,description:`Operating system`}).option(`version`,{type:`string`,description:`WARP client version`}).option(`source`,{type:`string`,description:"Source:   * `hourly` - device details aggregated hourly, up to 7 days prior   * `last_seen` - device details, up to 60 minutes prior. Time windows exceeding 60 minutes will be rejected from June 1st, 2026. Please use 'hourly' or 'raw' instead for longer time ranges.   * `raw` - device details, up to 7 days prior",choices:[`last_seen`,`hourly`,`raw`]}),handler:async e=>{let t={};e.to!==void 0&&(t.to=e.to),e.from!==void 0&&(t.from=e.from),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.sortBy!==void 0&&(t.sort_by=e.sortBy),e.colo!==void 0&&(t.colo=e.colo),e.deviceId!==void 0&&(t.device_id=e.deviceId),e.mode!==void 0&&(t.mode=e.mode),e.status!==void 0&&(t.status=e.status),e.platform!==void 0&&(t.platform=e.platform),e.version!==void 0&&(t.version=e.version),e.source!==void 0&&(t.source=e.source);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading devices`,async()=>n.zeroTrust.dex.fleetStatus.devices.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded devices`})}},Hi={command:`devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Vi).demandCommand(1),handler:()=>{}},Ui={command:`live`,describe:`List details for live (up to 60 minutes) devices using WARP`,builder:e=>e.option(`since-minutes`,{type:`string`,description:`Number of minutes before current time`,demandOption:!0}),handler:async e=>{let t={};e.sinceMinutes!==void 0&&(t.since_minutes=e.sinceMinutes);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading fleet statu`,async()=>n.zeroTrust.dex.fleetStatus.live(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded fleet statu`})}},Wi={command:`over-time`,describe:`List details for devices using WARP, up to 7 days`,builder:e=>e.option(`to`,{type:`string`,description:`Time range end in ISO format`,demandOption:!0}).option(`from`,{type:`string`,description:`Time range beginning in ISO format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Cloudflare colo`}).option(`device-id`,{type:`string`,description:`Device-specific ID, given as UUID v4`}),handler:async e=>{let t={};e.to!==void 0&&(t.to=e.to),e.from!==void 0&&(t.from=e.from),e.colo!==void 0&&(t.colo=e.colo),e.deviceId!==void 0&&(t.device_id=e.deviceId);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading fleet statu`,async()=>n.zeroTrust.dex.fleetStatus.overTime(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded fleet statu`})}},Gi={command:`fleet-status`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ui).command(Wi).command(Hi).demandCommand(1),handler:()=>{}},Ki={command:`get <testId>`,describe:`Get test details and aggregate performance metrics for an http test for a given time period between 1 hour and 7 days.`,builder:e=>e.positional(`testId`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}),handler:async e=>{c(e.testId,`testId`);let t={};e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.interval!==void 0&&(t.interval=e.interval),e.colo!==void 0&&(t.colo=e.colo);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading http test`,async()=>n.zeroTrust.dex.httpTests.get(i,e.testId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded http test`})}},qi={command:`get <testId>`,describe:`Get percentiles for an http test for a given time period between 1 hour and 7 days.`,builder:e=>e.positional(`testId`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}),handler:async e=>{c(e.testId,`testId`);let t={};e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.colo!==void 0&&(t.colo=e.colo);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading percentile`,async()=>n.zeroTrust.dex.httpTests.percentiles.get(i,e.testId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded percentile`})}},Ji={command:`percentiles`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(qi).demandCommand(1),handler:()=>{}},Yi={command:`http-tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Ki).command(Ji).demandCommand(1),handler:()=>{}},Xi={command:`create`,describe:`Create a DEX Rule`,builder:e=>e.option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dex rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dex/rules`,pathParams:{},bodyKind:`json`,body:{description:n.description,match:n.match,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating rule`,async()=>i.post(`/accounts/${o}/dex/rules`,{body:e})),{successLabel:`Created rule`});return}n.match===void 0&&(n.match=await t(`match`,`The wirefilter expression to match.`)),n.name===void 0&&(n.name=await t(`name`,`The name of the Rule.`));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.match!==void 0&&l(h,[`match`],s(n.match,`match`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating rule`,async()=>i.post(`/accounts/${o}/dex/rules`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created rule`})}},Zi={command:`delete <ruleId>`,describe:`Delete a DEX Rule`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dex rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dex/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`rule`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting rule`,async()=>n.zeroTrust.dex.rules.delete(o,t.ruleId)),{successLabel:`Deleted rule`})}},Qi={command:`get <ruleId>`,describe:`Get details for a DEX Rule`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}),handler:async e=>{c(e.ruleId,`ruleId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rule`,async()=>t.zeroTrust.dex.rules.get(n,e.ruleId)),{successLabel:`Loaded rule`})}},$i={command:`list`,describe:`List DEX Rules`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`sort-order`,{type:`string`,description:`Sort direction for sort_by property`,choices:[`ASC`,`DESC`]}).option(`sort-by`,{type:`string`,description:`Which property to sort results by`,choices:[`name`,`created_at`,`updated_at`]}).option(`name`,{type:`string`,description:`Filter results by rule name`}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.sortOrder!==void 0&&(t.sort_order=e.sortOrder),e.sortBy!==void 0&&(t.sort_by=e.sortBy),e.name!==void 0&&(t.name=e.name);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading rules`,async()=>n.zeroTrust.dex.rules.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded rules`})}},ea={command:`update <ruleId>`,describe:`Update a DEX Rule`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`unique identifier of the rule`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match`,{type:`string`,description:`The wirefilter expression to match.`}).option(`name`,{type:`string`,description:`The name of the Rule.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dex rules update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dex/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{description:t.description,match:t.match,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating rule`,async()=>n.patch(`/accounts/${i}/dex/rules/${t.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}let o={};t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.match!==void 0&&l(o,[`match`],s(t.match,`match`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating rule`,async()=>n.patch(`/accounts/${i}/dex/rules/${t.ruleId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated rule`})}},ta={command:`rules`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(Xi).command(Zi).command(Qi).command($i).command(ea).demandCommand(1),handler:()=>{}},na={command:`list`,describe:`List DEX tests with overview metrics`,builder:e=>e.option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}).option(`test-name`,{type:`string`,description:`Optionally filter results by test name`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`registration-id`,{type:`string`,description:`Optionally filter results to a specific device registration. Must be used in combination with a single deviceId.`}).option(`page`,{type:`number`,description:`Page number of paginated results`}).option(`per-page`,{type:`number`,description:`Number of items per page`}).option(`kind`,{type:`string`,description:`Filter by test type`,choices:[`http`,`traceroute`]}),handler:async e=>{let t={};e.colo!==void 0&&(t.colo=e.colo),e.testName!==void 0&&(t.testName=e.testName),e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.registrationId!==void 0&&(t.registration_id=e.registrationId),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.kind!==void 0&&(t.kind=e.kind);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading tests`,async()=>n.zeroTrust.dex.tests.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded tests`})}},ra={command:`list`,describe:`Returns unique count of devices that have run synthetic application monitoring tests in the past 7 days.`,builder:e=>e.option(`test-name`,{type:`string`,description:`Optionally filter results by test name`}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}),handler:async e=>{let t={};e.testName!==void 0&&(t.testName=e.testName),e.deviceId!==void 0&&(t.deviceId=e.deviceId);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading unique devices`,async()=>n.zeroTrust.dex.tests.uniqueDevices.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded unique devices`})}},ia={command:`unique-devices`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(ra).demandCommand(1),handler:()=>{}},aa={command:`tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(na).command(ia).demandCommand(1),handler:()=>{}},oa={command:`get <testResultId>`,describe:`Get a breakdown of hops and performance metrics for a specific traceroute test run`,builder:e=>e.positional(`testResultId`,{type:`string`,description:`unique identifier for a specific traceroute test`,demandOption:!0}),handler:async e=>{c(e.testResultId,`testResultId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading network path`,async()=>t.zeroTrust.dex.tracerouteTestResults.networkPath.get(n,e.testResultId)),{successLabel:`Loaded network path`})}},sa={command:`network-path`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(oa).demandCommand(1),handler:()=>{}},ca={command:`traceroute-test-results`,describe:`Operations for dex.traceroute-test-results`,builder:e=>e.command(sa).demandCommand(1),handler:()=>{}},la={command:`get <testId>`,describe:`Get test details and aggregate performance metrics for an traceroute test for a given time period between 1 hour and 7 days.`,builder:e=>e.positional(`testId`,{type:`string`,description:`Unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}),handler:async e=>{c(e.testId,`testId`);let t={};e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.interval!==void 0&&(t.interval=e.interval),e.colo!==void 0&&(t.colo=e.colo);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading traceroute test`,async()=>n.zeroTrust.dex.tracerouteTests.get(i,e.testId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded traceroute test`})}},ua={command:`network-path <testId>`,describe:`Get a breakdown of metrics by hop for individual traceroute test runs`,builder:e=>e.positional(`testId`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Device to filter tracroute result runs to`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for aggregate metrics in ISO ms`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for aggregate metrics in ISO ms`,demandOption:!0}).option(`interval`,{type:`string`,description:`Time interval for aggregate time slots.`,choices:[`minute`,`hour`],demandOption:!0}),handler:async e=>{c(e.testId,`testId`);let t={};e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.interval!==void 0&&(t.interval=e.interval);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading traceroute test`,async()=>n.zeroTrust.dex.tracerouteTests.networkPath(i,e.testId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded traceroute test`})}},da={command:`percentiles <testId>`,describe:`Get percentiles for a traceroute test for a given time period between 1 hour and 7 days.`,builder:e=>e.positional(`testId`,{type:`string`,description:`unique identifier for a specific test`,demandOption:!0}).option(`device-id`,{type:`string`,description:`Optionally filter result stats to a specific device(s). Cannot be used in combination with colo param.`}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`colo`,{type:`string`,description:`Optionally filter result stats to a Cloudflare colo. Cannot be used in combination with deviceId param.`}),handler:async e=>{c(e.testId,`testId`);let t={};e.deviceId!==void 0&&(t.deviceId=e.deviceId),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.colo!==void 0&&(t.colo=e.colo);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading traceroute test`,async()=>n.zeroTrust.dex.tracerouteTests.percentiles(i,e.testId,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded traceroute test`})}},fa={command:`traceroute-tests`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(la).command(ua).command(da).demandCommand(1),handler:()=>{}},pa={command:`get`,describe:`List WARP configuration and enablement toggle change events by device.`,builder:e=>e.option(`page`,{type:`number`,description:`Page number of paginated results`,demandOption:!0}).option(`per-page`,{type:`number`,description:`Number of items per page`,demandOption:!0}).option(`from`,{type:`string`,description:`Start time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`to`,{type:`string`,description:`End time for the query in ISO (RFC3339 - ISO 8601) format`,demandOption:!0}).option(`type`,{type:`string`,description:`Filter events by type 'config' or 'toggle'`,choices:[`config`,`toggle`]}).option(`toggle`,{type:`string`,description:`Filter events by type toggle value. Applicable to type='toggle' events only.`,choices:[`on`,`off`]}).option(`config-name`,{type:`string`,description:`Filter events by WARP configuration name changed from or to. Applicable to type='config' events only.`}).option(`account-name`,{type:`string`,description:`Filter events by account name.`}).option(`sort-order`,{type:`string`,description:`Sort response by event timestamp.`,choices:[`ASC`,`DESC`]}),handler:async e=>{let t={};e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage),e.from!==void 0&&(t.from=e.from),e.to!==void 0&&(t.to=e.to),e.type!==void 0&&(t.type=e.type),e.toggle!==void 0&&(t.toggle=e.toggle),e.configName!==void 0&&(t.config_name=e.configName),e.accountName!==void 0&&(t.account_name=e.accountName),e.sortOrder!==void 0&&(t.sort_order=e.sortOrder);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading warp change event`,async()=>n.zeroTrust.dex.warpChangeEvents.get(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded warp change event`})}},ma={command:`warp-change-events`,describe:`Digital Experience Monitoring — synthetic tests, fleet-wide device metrics, and network path diagnostics`,builder:e=>e.command(pa).demandCommand(1),handler:()=>{}},ha={command:`dex`,describe:`Operations for dex`,builder:e=>e.command(ji).command(Bi).command(Gi).command(Yi).command(ta).command(aa).command(ca).command(fa).command(ma).demandCommand(1),handler:()=>{}},ga={command:`create`,describe:`Creates a new DLP (Data Loss Prevention) dataset for storing custom detection patterns. Datasets can contain exact match data, word lists, or EDM (Exact Data Match) configurations.`,builder:e=>e.option(`case-sensitive`,{type:`boolean`,description:"Only applies to custom word lists. Determines if the words should be matched in a case-sensitive manner Cannot be set to false if `secret` is true or undefined"}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`encoding-version`,{type:`number`,description:`Dataset encoding version  Non-secret custom word lists with no header are always version 1. Secret EDM lists with no header are version 1. Multicolumn CSV with headers are version 2. Omitting this field provides the default value 0, which is interpreted the same as 1.`}).option(`name`,{type:`string`,description:`The name field`}).option(`secret`,{type:`boolean`,description:`Generate a secret dataset.  If true, the response will include a secret to use with the EDM encoder. If false, the response has no secret and the dataset is uploaded in plaintext.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp datasets create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/datasets`,pathParams:{},bodyKind:`json`,body:{caseSensitive:n.caseSensitive,description:n.description,encodingVersion:n.encodingVersion,name:n.name,secret:n.secret,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating dataset`,async()=>i.post(`/accounts/${o}/dlp/datasets`,{body:e})),{successLabel:`Created dataset`});return}n.name===void 0&&(n.name=await t(`name`,``));let h={};n.caseSensitive!==void 0&&l(h,[`case_sensitive`],n.caseSensitive),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.encodingVersion!==void 0&&l(h,[`encoding_version`],n.encodingVersion),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.secret!==void 0&&l(h,[`secret`],n.secret),d(await m(`Creating dataset`,async()=>i.post(`/accounts/${o}/dlp/datasets`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created dataset`})}},_a={command:`delete <datasetId>`,describe:`This deletes all versions of the dataset.`,builder:e=>e.positional(`datasetId`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.datasetId,`datasetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}`,pathParams:{datasetId:String(t.datasetId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`dataset`,String(t.datasetId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting dataset`,async()=>n.zeroTrust.dlp.datasets.delete(o,t.datasetId)),{successLabel:`Deleted dataset`})}},va={command:`get <datasetId>`,describe:`Retrieves detailed information about a specific DLP dataset, including its type, status, and entry count.`,builder:e=>e.positional(`datasetId`,{type:`string`,description:`Dataset ID`,demandOption:!0}),handler:async e=>{c(e.datasetId,`datasetId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading dataset`,async()=>t.zeroTrust.dlp.datasets.get(n,e.datasetId)),{successLabel:`Loaded dataset`})}},ya={command:`list`,describe:`Lists all DLP datasets configured for the account, including custom word lists and EDM datasets.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading datasets`,async()=>t.zeroTrust.dlp.datasets.list(n)),{successLabel:`Loaded datasets`})}},ba={command:`update <datasetId>`,describe:`Updates the configuration of an existing DLP dataset, such as its name, description, or detection settings.`,builder:e=>e.positional(`datasetId`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`case-sensitive`,{type:`boolean`,description:`Determines if the words should be matched in a case-sensitive manner.  Only required for custom word lists.`}).option(`description`,{type:`string`,description:`The description of the dataset.`}).option(`name`,{type:`string`,description:`The name of the dataset, must be unique.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset description.`}),handler:async t=>{if(c(t.datasetId,`datasetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}`,pathParams:{datasetId:String(t.datasetId??``)},bodyKind:`json`,body:{caseSensitive:t.caseSensitive,description:t.description,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating dataset`,async()=>n.put(`/accounts/${i}/dlp/datasets/${t.datasetId}`,{body:e})),{successLabel:`Updated dataset`});return}let o={};t.caseSensitive!==void 0&&l(o,[`case_sensitive`],t.caseSensitive),t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating dataset`,async()=>n.put(`/accounts/${i}/dlp/datasets/${t.datasetId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated dataset`})}},xa={command:`create <datasetId>`,describe:`Creates a new version of a DLP dataset, allowing you to stage changes before activation. Used for single-column EDM and custom word lists.`,builder:e=>e.positional(`datasetId`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.datasetId,`datasetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets upload create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}/upload`,pathParams:{datasetId:String(t.datasetId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating upload`,async()=>n.zeroTrust.dlp.datasets.upload.create(i,t.datasetId)),{successLabel:`Created upload`})}},Sa={command:`edit <version>`,describe:`This is used for single-column EDMv1 and Custom Word Lists. The EDM format can only be created in the Cloudflare dashboard. For other clients, this operation can only be used for non-secret Custom Word Lists. The body must be a UTF-8 encoded, newline (NL or CRNL) separated list of words to be matched.`,builder:e=>e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset. For custom wordlists this contains UTF-8 patterns separated by newline characters.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`}),handler:async t=>{if(c(t.version,`version`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets upload edit`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}/upload/${t.version??`<version>`}`,pathParams:{datasetId:String(t.datasetId??``),version:String(t.version??``)},bodyKind:`octet-stream`,body:{body:t.body,file:t.file},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.file){let{readFileSync:e}=await import(`node:fs`),{resolve:r}=await import(`node:path`),a=e(r(t.file));d(await m(`Creating upload`,async()=>n.post(`/accounts/${i}/dlp/datasets/${t.datasetId}/upload/${t.version}`,{body:a,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created upload`});return}if(t.body){let e=s(t.body,`body`,`binary`);d(await m(`Creating upload`,async()=>n.post(`/accounts/${i}/dlp/datasets/${t.datasetId}/upload/${t.version}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created upload`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ca={command:`upload`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(xa).command(Sa).demandCommand(1),handler:()=>{}},wa={command:`create <version>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard. The columns in the response appear in the same order as in the request.`,builder:e=>e.positional(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`array of new columns to create for this dataset version.`}),handler:async t=>{if(c(t.version,`version`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets versions create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}/versions/${t.version??`<version>`}`,pathParams:{datasetId:String(t.datasetId??``),version:String(t.version??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating version`,async()=>n.post(`/accounts/${i}/dlp/datasets/${t.datasetId}/versions/${t.version}`,{body:e})),{successLabel:`Created version`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ta={command:`create <entryId>`,describe:`This is used for multi-column EDMv2 datasets. The EDMv2 format can only be created in the Cloudflare dashboard.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dataset-id`,{type:`string`,description:`Dataset ID`,demandOption:!0}).option(`version`,{type:`string`,description:`Version`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Dataset content.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp datasets versions entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/datasets/${t.datasetId??`<datasetId>`}/versions/${t.version??`<version>`}/entries/${t.entryId??`<entryId>`}`,pathParams:{datasetId:String(t.datasetId??``),version:String(t.version??``),entryId:String(t.entryId??``)},bodyKind:`octet-stream`,body:{body:t.body,file:t.file},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.file){let{readFileSync:e}=await import(`node:fs`),{resolve:r}=await import(`node:path`),a=e(r(t.file));d(await m(`Creating entry`,async()=>n.post(`/accounts/${i}/dlp/datasets/${t.datasetId}/versions/${t.version}/entries/${t.entryId}`,{body:a,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created entry`});return}if(t.body){let e=s(t.body,`body`,`binary`);d(await m(`Creating entry`,async()=>n.post(`/accounts/${i}/dlp/datasets/${t.datasetId}/versions/${t.version}/entries/${t.entryId}`,{body:e,headers:{"Content-Type":`application/octet-stream`}})),{successLabel:`Created entry`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ea={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ta).demandCommand(1),handler:()=>{}},Da={command:`versions`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(wa).command(Ea).demandCommand(1),handler:()=>{}},Oa={command:`datasets`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ga).command(_a).command(va).command(ya).command(ba).command(Ca).command(Da).demandCommand(1),handler:()=>{}},ka={command:`create`,describe:`Creates a mapping between a Cloudflare account and an email provider for DLP email scanning integration.`,builder:e=>e.option(`auth-requirements-allowed-microsoft-organizations`,{type:`string`,array:!0,description:`The auth_requirements.allowed_microsoft_organizations field`}).option(`auth-requirements-type`,{type:`string`,description:`The auth_requirements.type field`,choices:[`Org`,`NoAuth`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Account mapping.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp email account-mapping create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/email/account_mapping`,pathParams:{},bodyKind:`json`,body:{authRequirementsAllowedMicrosoftOrganizations:t.authRequirementsAllowedMicrosoftOrganizations,authRequirementsType:t.authRequirementsType,body:t.body},validation:`passed`});return}let i=await a(t),o=t.local?p:await r(i);if(t.accountId=o,t.body){let e=u(t.body);d(await m(`Creating account mapping`,async()=>i.post(`/accounts/${o}/dlp/email/account_mapping`,{body:e})),{successLabel:`Created account mapping`});return}t.authRequirementsType===void 0&&(t.authRequirementsType=await n(`auth-requirements-type`,``,[`Org`,`NoAuth`]));let h={};t.authRequirementsAllowedMicrosoftOrganizations!==void 0&&l(h,[`auth_requirements`,`allowed_microsoft_organizations`],t.authRequirementsAllowedMicrosoftOrganizations),t.authRequirementsType!==void 0&&l(h,[`auth_requirements`,`type`],s(t.authRequirementsType,`authRequirementsType`,`text`)),d(await m(`Creating account mapping`,async()=>i.post(`/accounts/${o}/dlp/email/account_mapping`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created account mapping`})}},$={command:`get`,describe:`Retrieves the email provider mapping configuration for DLP email scanning.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading account mapping`,async()=>t.zeroTrust.dlp.email.accountMapping.get(n)),{successLabel:`Loaded account mapping`})}},Aa={command:`account-mapping`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ka).command($).demandCommand(1),handler:()=>{}},ja={command:`bulk-edit`,describe:`Reorders DLP email scanning rules by updating their priority values. Higher priority rules are evaluated first.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule priorities.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp email rules bulk-edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating rules`,async()=>n.patch(`/accounts/${i}/dlp/email/rules`,{body:e})),{successLabel:`Updated rules`});return}d(await m(`Updating rules`,async()=>n.zeroTrust.dlp.email.rules.bulkEdit(i)),{successLabel:`Updated rules`})}},Ma={command:`create`,describe:`Creates a new DLP email scanning rule that defines what content patterns to detect in email messages and what actions to take.`,builder:e=>e.option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp email rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/email/rules`,pathParams:{},bodyKind:`json`,body:{actionAction:i.actionAction,actionMessage:i.actionMessage,description:i.description,enabled:i.enabled,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating rule`,async()=>o.post(`/accounts/${h}/dlp/email/rules`,{body:e})),{successLabel:`Created rule`});return}if(i.actionAction===void 0&&(i.actionAction=await n(`action-action`,``,[`Block`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await t(`name`,``));let g={};i.actionAction!==void 0&&l(g,[`action`,`action`],s(i.actionAction,`actionAction`,`text`)),i.actionMessage!==void 0&&l(g,[`action`,`message`],s(i.actionMessage,`actionMessage`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Creating rule`,async()=>o.post(`/accounts/${h}/dlp/email/rules`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created rule`})}},Na={command:`delete <ruleId>`,describe:`Removes a DLP email scanning rule. The rule will no longer be applied to email messages.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp email rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/email/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`rule`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting rule`,async()=>n.zeroTrust.dlp.email.rules.delete(o,t.ruleId)),{successLabel:`Deleted rule`})}},Pa={command:`get <ruleId>`,describe:`Gets detailed configuration for a specific DLP email scanning rule, including detection patterns and actions.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Rule ID`,demandOption:!0}),handler:async e=>{c(e.ruleId,`ruleId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rule`,async()=>t.zeroTrust.dlp.email.rules.get(n,e.ruleId)),{successLabel:`Loaded rule`})}},Fa={command:`list`,describe:`Lists all email scanner rules for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rules`,async()=>t.zeroTrust.dlp.email.rules.list(n)),{successLabel:`Loaded rules`})}},Ia={command:`update <ruleId>`,describe:`Modifies an existing DLP email scanning rule, updating detection patterns, conditions, or actions.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Rule ID`,demandOption:!0}).option(`action-action`,{type:`string`,description:`The action.action field`,choices:[`Block`]}).option(`action-message`,{type:`string`,description:`The action.message field`}).option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Rule description.`}),handler:async i=>{if(c(i.ruleId,`ruleId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp email rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/email/rules/${i.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(i.ruleId??``)},bodyKind:`json`,body:{actionAction:i.actionAction,actionMessage:i.actionMessage,description:i.description,enabled:i.enabled,name:i.name,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating rule`,async()=>o.put(`/accounts/${h}/dlp/email/rules/${i.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}if(i.actionAction===void 0&&(i.actionAction=await n(`action-action`,``,[`Block`])),i.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);i.name===void 0&&(i.name=await t(`name`,``));let g={};i.actionAction!==void 0&&l(g,[`action`,`action`],s(i.actionAction,`actionAction`,`text`)),i.actionMessage!==void 0&&l(g,[`action`,`message`],s(i.actionMessage,`actionMessage`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),d(await m(`Updating rule`,async()=>o.put(`/accounts/${h}/dlp/email/rules/${i.ruleId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated rule`})}},La={command:`rules`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(ja).command(Ma).command(Na).command(Pa).command(Fa).command(Ia).demandCommand(1),handler:()=>{}},Ra={command:`email`,describe:`Operations for dlp.email`,builder:e=>e.command(Aa).command(La).demandCommand(1),handler:()=>{}},za={command:`create`,describe:`Creates a DLP custom entry.`,builder:e=>e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp entries create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:{description:n.description,enabled:n.enabled,name:n.name,patternRegex:n.patternRegex,profileId:n.profileId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating entry`,async()=>i.post(`/accounts/${o}/dlp/entries`,{body:e})),{successLabel:`Created entry`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await t(`name`,``)),n.patternRegex===void 0&&(n.patternRegex=await t(`pattern-regex`,``));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.patternRegex!==void 0&&l(h,[`pattern`,`regex`],s(n.patternRegex,`patternRegex`,`text`)),n.profileId!==void 0&&l(h,[`profile_id`],s(n.profileId,`profileId`,`text`)),d(await m(`Creating entry`,async()=>i.post(`/accounts/${o}/dlp/entries`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created entry`})}},Ba={command:`create`,describe:`Creates a DLP custom entry.`,builder:e=>e.option(`description`,{type:`string`,description:`The description field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new entry to create.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp entries custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/entries`,pathParams:{},bodyKind:`json`,body:{description:n.description,enabled:n.enabled,name:n.name,patternRegex:n.patternRegex,profileId:n.profileId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/dlp/entries`,{body:e})),{successLabel:`Created custom`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await t(`name`,``)),n.patternRegex===void 0&&(n.patternRegex=await t(`pattern-regex`,``));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.patternRegex!==void 0&&l(h,[`pattern`,`regex`],s(n.patternRegex,`patternRegex`,`text`)),n.profileId!==void 0&&l(h,[`profile_id`],s(n.profileId,`profileId`,`text`)),d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/dlp/entries`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created custom`})}},Va={command:`delete <entryId>`,describe:`Deletes a DLP custom entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`custom`,String(t.entryId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting custom`,async()=>n.zeroTrust.dlp.entries.custom.delete(o,t.entryId)),{successLabel:`Deleted custom`})}},Ha={command:`get <entryId>`,describe:`Fetches a DLP entry by ID.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}),handler:async e=>{c(e.entryId,`entryId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.dlp.entries.custom.get(n,e.entryId)),{successLabel:`Loaded custom`})}},Ua={command:`list`,describe:`Lists all DLP entries in an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.dlp.entries.custom.list(n)),{successLabel:`Loaded custom`})}},Wa={command:`update <entryId>`,describe:`Updates a DLP custom entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`name`,{type:`string`,description:`The name field`}).option(`pattern-regex`,{type:`string`,description:`The pattern.regex field`}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`}),handler:async n=>{if(c(n.entryId,`entryId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp entries custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/entries/custom/${n.entryId??`<entryId>`}`,pathParams:{entryId:String(n.entryId??``)},bodyKind:`json`,body:{description:n.description,name:n.name,patternRegex:n.patternRegex,enabled:n.enabled,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating custom`,async()=>i.put(`/accounts/${o}/dlp/entries/custom/${n.entryId}`,{body:e})),{successLabel:`Updated custom`});return}if(n.name===void 0&&(n.name=await t(`name`,``)),n.patternRegex===void 0&&(n.patternRegex=await t(`pattern-regex`,``)),n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.patternRegex!==void 0&&l(h,[`pattern`,`regex`],s(n.patternRegex,`patternRegex`,`text`)),n.enabled!==void 0&&l(h,[`enabled`],n.enabled),d(await m(`Updating custom`,async()=>i.put(`/accounts/${o}/dlp/entries/custom/${n.entryId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated custom`})}},Ga={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ba).command(Va).command(Ha).command(Ua).command(Wa).demandCommand(1),handler:()=>{}},Ka={command:`delete <entryId>`,describe:`Deletes a DLP custom entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`entry`,String(t.entryId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting entry`,async()=>n.zeroTrust.dlp.entries.delete(o,t.entryId)),{successLabel:`Deleted entry`})}},qa={command:`get <entryId>`,describe:`Fetches a DLP entry by ID.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}),handler:async e=>{c(e.entryId,`entryId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading entry`,async()=>t.zeroTrust.dlp.entries.get(n,e.entryId)),{successLabel:`Loaded entry`})}},Ja={command:`create`,describe:`Integration entries can't be created, this will update an existing integration entry. This is needed for our generated terraform API.`,builder:e=>e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile. For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing integration entry. It is not possible to create new integration entries.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp entries integration create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/entries/integration`,pathParams:{},bodyKind:`json`,body:{enabled:n.enabled,entryId:n.entryId,profileId:n.profileId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating integration`,async()=>i.post(`/accounts/${o}/dlp/entries/integration`,{body:e})),{successLabel:`Created integration`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.entryId===void 0&&(n.entryId=await t(`entry-id`,``));let h={};n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.entryId!==void 0&&l(h,[`entry_id`],s(n.entryId,`entryId`,`text`)),n.profileId!==void 0&&l(h,[`profile_id`],s(n.profileId,`profileId`,`text`)),d(await m(`Creating integration`,async()=>i.post(`/accounts/${o}/dlp/entries/integration`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created integration`})}},Ya={command:`delete <entryId>`,describe:`This is a no-op as integration entires can't be deleted but is needed for our generated terraform API.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries integration delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/integration/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`integration`,String(t.entryId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting integration`,async()=>n.zeroTrust.dlp.entries.integration.delete(o,t.entryId)),{successLabel:`Deleted integration`})}},Xa={command:`get <entryId>`,describe:`Fetches a DLP entry by ID.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}),handler:async e=>{c(e.entryId,`entryId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integration`,async()=>t.zeroTrust.dlp.entries.integration.get(n,e.entryId)),{successLabel:`Loaded integration`})}},Za={command:`list`,describe:`Lists all DLP entries in an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integration`,async()=>t.zeroTrust.dlp.entries.integration.list(n)),{successLabel:`Loaded integration`})}},Qa={command:`update <entryId>`,describe:`Updates a DLP entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Enable or disable integration entry in owning profile.`}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries integration update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/integration/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`json`,body:{enabled:t.enabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating integration`,async()=>n.put(`/accounts/${i}/dlp/entries/integration/${t.entryId}`,{body:e})),{successLabel:`Updated integration`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let o={};t.enabled!==void 0&&l(o,[`enabled`],t.enabled),d(await m(`Updating integration`,async()=>n.put(`/accounts/${i}/dlp/entries/integration/${t.entryId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated integration`})}},$a={command:`integration`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(Ja).command(Ya).command(Xa).command(Za).command(Qa).demandCommand(1),handler:()=>{}},eo={command:`list`,describe:`Lists all DLP entries in an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading entries`,async()=>t.zeroTrust.dlp.entries.list(n)),{successLabel:`Loaded entries`})}},to={command:`create`,describe:`Predefined entries can't be created, this will update an existing predefined entry. This is needed for our generated terraform API.`,builder:e=>e.option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`entry-id`,{type:`string`,description:`The entry_id field`}).option(`profile-id`,{type:`string`,description:`This field is not used as the owning profile. For predefined entries it is already set to a predefined profile.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`This endpoint will update an existing predefined entry. It is not possible to create new predefined entries.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp entries predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/entries/predefined`,pathParams:{},bodyKind:`json`,body:{enabled:n.enabled,entryId:n.entryId,profileId:n.profileId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating predefined`,async()=>i.post(`/accounts/${o}/dlp/entries/predefined`,{body:e})),{successLabel:`Created predefined`});return}if(n.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);n.entryId===void 0&&(n.entryId=await t(`entry-id`,``));let h={};n.enabled!==void 0&&l(h,[`enabled`],n.enabled),n.entryId!==void 0&&l(h,[`entry_id`],s(n.entryId,`entryId`,`text`)),n.profileId!==void 0&&l(h,[`profile_id`],s(n.profileId,`profileId`,`text`)),d(await m(`Creating predefined`,async()=>i.post(`/accounts/${o}/dlp/entries/predefined`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created predefined`})}},no={command:`delete <entryId>`,describe:`This is a no-op as predefined entires can't be deleted but is needed for our generated terraform API.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/predefined/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`predefined`,String(t.entryId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting predefined`,async()=>n.zeroTrust.dlp.entries.predefined.delete(o,t.entryId)),{successLabel:`Deleted predefined`})}},ro={command:`get <entryId>`,describe:`Fetches a DLP entry by ID.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}),handler:async e=>{c(e.entryId,`entryId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading predefined`,async()=>t.zeroTrust.dlp.entries.predefined.get(n,e.entryId)),{successLabel:`Loaded predefined`})}},io={command:`list`,describe:`Lists all DLP entries in an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading predefined`,async()=>t.zeroTrust.dlp.entries.predefined.list(n)),{successLabel:`Loaded predefined`})}},ao={command:`update <entryId>`,describe:`Updates a DLP entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Settings to enable or disable predefined entry in owning profile.`}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/predefined/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`json`,body:{enabled:t.enabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/entries/predefined/${t.entryId}`,{body:e})),{successLabel:`Updated predefined`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let o={};t.enabled!==void 0&&l(o,[`enabled`],t.enabled),d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/entries/predefined/${t.entryId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated predefined`})}},oo={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(to).command(no).command(ro).command(io).command(ao).demandCommand(1),handler:()=>{}},so={command:`update <entryId>`,describe:`Updates a DLP entry.`,builder:e=>e.positional(`entryId`,{type:`string`,description:`Entry ID`,demandOption:!0}).option(`enabled`,{type:`boolean`,description:`The enabled field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Update to be applied to the entry.`}),handler:async t=>{if(c(t.entryId,`entryId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp entries update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/entries/${t.entryId??`<entryId>`}`,pathParams:{entryId:String(t.entryId??``)},bodyKind:`json`,body:{enabled:t.enabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating entry`,async()=>n.put(`/accounts/${i}/dlp/entries/${t.entryId}`,{body:e})),{successLabel:`Updated entry`});return}if(t.enabled===void 0)throw Error(`--enabled is required (or pass --body with this field set).`);let o={};t.enabled!==void 0&&l(o,[`enabled`],t.enabled),d(await m(`Updating entry`,async()=>n.put(`/accounts/${i}/dlp/entries/${t.entryId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated entry`})}},co={command:`entries`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(za).command(Ka).command(qa).command(eo).command(so).command(Ga).command($a).command(oo).demandCommand(1),handler:()=>{}},lo={command:`list`,describe:`Retrieves current DLP usage limits and quotas for the account, including maximum allowed counts and current usage for custom entries, dataset cells, and document fingerprints.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading limits`,async()=>t.zeroTrust.dlp.limits.list(n)),{successLabel:`Loaded limits`})}},uo={command:`limits`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(lo).demandCommand(1),handler:()=>{}},fo={command:`validate`,describe:"Validates whether this pattern is a valid regular expression. Rejects it if the regular expression is too complex or can match an unbounded-length string. The regex will be rejected if it uses `*` or `+`. Bound the maximum number of characters that can be matched using a range, e.g. `{1,100}`.",builder:e=>e.option(`max-match-bytes`,{type:`number`,description:"Maximum number of bytes that the regular expression can match.  If this is `null` then there is no limit on the length. Patterns can use `*` and `+`. Otherwise repeats should use a range `{m,n}` to restrict patterns to the length. If this field is missing, then a default length limit is used.  Note that the length is specified in bytes. Since regular expressions use UTF-8 the pattern `.` can match up to 4 bytes. Hence `.{1,256}` has a maximum length of 1024 bytes."}).option(`regex`,{type:`string`,description:`The regex field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Validation query.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp patterns validate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/patterns/validate`,pathParams:{},bodyKind:`json`,body:{maxMatchBytes:n.maxMatchBytes,regex:n.regex,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating pattern`,async()=>i.post(`/accounts/${o}/dlp/patterns/validate`,{body:e})),{successLabel:`Created pattern`});return}n.regex===void 0&&(n.regex=await t(`regex`,``));let h={};n.maxMatchBytes!==void 0&&l(h,[`max_match_bytes`],n.maxMatchBytes),n.regex!==void 0&&l(h,[`regex`],s(n.regex,`regex`,`text`)),d(await m(`Creating pattern`,async()=>i.post(`/accounts/${o}/dlp/patterns/validate`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created pattern`})}},po={command:`patterns`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(fo).demandCommand(1),handler:()=>{}},mo={command:`get`,describe:`Gets the current payload logging configuration for DLP, showing whether matched content is being logged.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading payload log`,async()=>t.zeroTrust.dlp.payloadLogs.get(n)),{successLabel:`Loaded payload log`})}},ho={command:`update`,describe:`Enables or disables payload logging for DLP matches. When enabled, matched content is stored for review.`,builder:e=>e.option(`public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.  - Set to null or empty string to disable payload logging. - Set to a non-empty base64 string to enable payload logging with the given key.  For customers with configurable payload masking feature rolled out: - If the field is missing, the existing setting will be kept. Note that this is different from setting to null or empty string.  For all other customers: - If the field is missing, the existing setting will be cleared.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New payload log settings.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp payload-logs update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/payload_log`,pathParams:{},bodyKind:`json`,body:{publicKey:t.publicKey,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating payload log`,async()=>n.put(`/accounts/${i}/dlp/payload_log`,{body:e})),{successLabel:`Updated payload log`});return}let o={};t.publicKey!==void 0&&l(o,[`public_key`],s(t.publicKey,`publicKey`,`text`)),d(await m(`Updating payload log`,async()=>n.put(`/accounts/${i}/dlp/payload_log`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated payload log`})}},go={command:`payload-logs`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(mo).command(ho).demandCommand(1),handler:()=>{}},_o={command:`create`,describe:`Creates a DLP custom profile.`,builder:e=>e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`Related DLP policies will trigger when the match count exceeds the number set.`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`,default:!1}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`,default:!1}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`A new profile to create.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp profiles custom create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/profiles/custom`,pathParams:{},bodyKind:`json`,body:{aiContextEnabled:n.aiContextEnabled,allowedMatchCount:n.allowedMatchCount,confidenceThreshold:n.confidenceThreshold,contextAwarenessEnabled:n.contextAwarenessEnabled,contextAwarenessSkipFiles:n.contextAwarenessSkipFiles,dataClasses:n.dataClasses,dataTags:n.dataTags,description:n.description,name:n.name,ocrEnabled:n.ocrEnabled,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/dlp/profiles/custom`,{body:e})),{successLabel:`Created custom`});return}n.name===void 0&&(n.name=await t(`name`,``));let h={};n.aiContextEnabled!==void 0&&l(h,[`ai_context_enabled`],n.aiContextEnabled),n.allowedMatchCount!==void 0&&l(h,[`allowed_match_count`],n.allowedMatchCount),n.confidenceThreshold!==void 0&&l(h,[`confidence_threshold`],s(n.confidenceThreshold,`confidenceThreshold`,`text`)),n.contextAwarenessEnabled!==void 0&&l(h,[`context_awareness`,`enabled`],n.contextAwarenessEnabled),n.contextAwarenessSkipFiles!==void 0&&l(h,[`context_awareness`,`skip`,`files`],n.contextAwarenessSkipFiles),n.dataClasses!==void 0&&l(h,[`data_classes`],n.dataClasses),n.dataTags!==void 0&&l(h,[`data_tags`],n.dataTags),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.ocrEnabled!==void 0&&l(h,[`ocr_enabled`],n.ocrEnabled),d(await m(`Creating custom`,async()=>i.post(`/accounts/${o}/dlp/profiles/custom`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created custom`})}},vo={command:`delete <profileId>`,describe:`Deletes a DLP custom profile.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp profiles custom delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/profiles/custom/${t.profileId??`<profileId>`}`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`custom`,String(t.profileId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting custom`,async()=>n.zeroTrust.dlp.profiles.custom.delete(o,t.profileId)),{successLabel:`Deleted custom`})}},yo={command:`get <profileId>`,describe:`Fetches a custom DLP profile by id.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}),handler:async e=>{c(e.profileId,`profileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.dlp.profiles.custom.get(n,e.profileId)),{successLabel:`Loaded custom`})}},bo={command:`update <profileId>`,describe:`Updates a DLP custom profile.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`,default:!1}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`,default:!1}).option(`data-classes`,{type:`string`,array:!0,description:`Data class IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`data-tags`,{type:`string`,array:!0,description:`Data tag IDs to associate with the profile. If omitted, existing associations are unchanged.`}).option(`description`,{type:`string`,description:`The description of the profile.`}).option(`name`,{type:`string`,description:`The name field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0}),handler:async n=>{if(c(n.profileId,`profileId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust dlp profiles custom update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/profiles/custom/${n.profileId??`<profileId>`}`,pathParams:{profileId:String(n.profileId??``)},bodyKind:`json`,body:{aiContextEnabled:n.aiContextEnabled,allowedMatchCount:n.allowedMatchCount,confidenceThreshold:n.confidenceThreshold,contextAwarenessEnabled:n.contextAwarenessEnabled,contextAwarenessSkipFiles:n.contextAwarenessSkipFiles,dataClasses:n.dataClasses,dataTags:n.dataTags,description:n.description,name:n.name,ocrEnabled:n.ocrEnabled,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating custom`,async()=>i.put(`/accounts/${o}/dlp/profiles/custom/${n.profileId}`,{body:e})),{successLabel:`Updated custom`});return}n.name===void 0&&(n.name=await t(`name`,``));let h={};n.aiContextEnabled!==void 0&&l(h,[`ai_context_enabled`],n.aiContextEnabled),n.allowedMatchCount!==void 0&&l(h,[`allowed_match_count`],n.allowedMatchCount),n.confidenceThreshold!==void 0&&l(h,[`confidence_threshold`],s(n.confidenceThreshold,`confidenceThreshold`,`text`)),n.contextAwarenessEnabled!==void 0&&l(h,[`context_awareness`,`enabled`],n.contextAwarenessEnabled),n.contextAwarenessSkipFiles!==void 0&&l(h,[`context_awareness`,`skip`,`files`],n.contextAwarenessSkipFiles),n.dataClasses!==void 0&&l(h,[`data_classes`],n.dataClasses),n.dataTags!==void 0&&l(h,[`data_tags`],n.dataTags),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.ocrEnabled!==void 0&&l(h,[`ocr_enabled`],n.ocrEnabled),d(await m(`Updating custom`,async()=>i.put(`/accounts/${o}/dlp/profiles/custom/${n.profileId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated custom`})}},xo={command:`custom`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(_o).command(vo).command(yo).command(bo).demandCommand(1),handler:()=>{}},So={command:`get <profileId>`,describe:`Fetches a DLP profile by ID.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}),handler:async e=>{c(e.profileId,`profileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading profile`,async()=>t.zeroTrust.dlp.profiles.get(n,e.profileId)),{successLabel:`Loaded profile`})}},Co={command:`list`,describe:`Lists all DLP profiles in an account.`,builder:e=>e.option(`all`,{type:`boolean`,description:`Return all profiles, including those that current account does not have access to.`,default:!1}),handler:async e=>{let t={};e.all!==void 0&&(t.all=e.all);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading profiles`,async()=>n.zeroTrust.dlp.profiles.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded profiles`})}},wo={command:`create <profileId>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Creates a DLP predefined profile. Only supports enabling/disabling entries.",builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/profiles/predefined/${t.profileId??`<profileId>`}/config`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`json`,body:{aiContextEnabled:t.aiContextEnabled,allowedMatchCount:t.allowedMatchCount,confidenceThreshold:t.confidenceThreshold,enabledEntries:t.enabledEntries,ocrEnabled:t.ocrEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating predefined`,async()=>n.post(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}/config`,{body:e})),{successLabel:`Created predefined`});return}let o={};t.aiContextEnabled!==void 0&&l(o,[`ai_context_enabled`],t.aiContextEnabled),t.allowedMatchCount!==void 0&&l(o,[`allowed_match_count`],t.allowedMatchCount),t.confidenceThreshold!==void 0&&l(o,[`confidence_threshold`],s(t.confidenceThreshold,`confidenceThreshold`,`text`)),t.enabledEntries!==void 0&&l(o,[`enabled_entries`],t.enabledEntries),t.ocrEnabled!==void 0&&l(o,[`ocr_enabled`],t.ocrEnabled),d(await m(`Creating predefined`,async()=>n.post(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}/config`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created predefined`})}},To={command:`delete <profileId>`,describe:`This is a no-op as predefined profiles can't be deleted but is needed for our generated terraform API.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp profiles predefined delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/profiles/predefined/${t.profileId??`<profileId>`}`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`predefined`,String(t.profileId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting predefined`,async()=>n.zeroTrust.dlp.profiles.predefined.delete(o,t.profileId)),{successLabel:`Deleted predefined`})}},Eo={command:`get <profileId>`,describe:"This is similar to `get_predefined` but only returns entries that are enabled. This is needed for our terraform API Fetches a predefined DLP profile by id.",builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}),handler:async e=>{c(e.profileId,`profileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading predefined`,async()=>t.zeroTrust.dlp.profiles.predefined.get(n,e.profileId)),{successLabel:`Loaded predefined`})}},Do={command:`update <profileId>`,describe:"This is similar to `update_predefined` but only returns entries that are enabled. This is needed for our terraform API Updates a DLP predefined profile. Only supports enabling/disabling entries.",builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`enabled-entries`,{type:`string`,array:!0,description:`The enabled_entries field`}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust dlp profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/profiles/predefined/${t.profileId??`<profileId>`}/config`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`json`,body:{aiContextEnabled:t.aiContextEnabled,allowedMatchCount:t.allowedMatchCount,confidenceThreshold:t.confidenceThreshold,enabledEntries:t.enabledEntries,ocrEnabled:t.ocrEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}/config`,{body:e})),{successLabel:`Updated predefined`});return}let o={};t.aiContextEnabled!==void 0&&l(o,[`ai_context_enabled`],t.aiContextEnabled),t.allowedMatchCount!==void 0&&l(o,[`allowed_match_count`],t.allowedMatchCount),t.confidenceThreshold!==void 0&&l(o,[`confidence_threshold`],s(t.confidenceThreshold,`confidenceThreshold`,`text`)),t.enabledEntries!==void 0&&l(o,[`enabled_entries`],t.enabledEntries),t.ocrEnabled!==void 0&&l(o,[`ocr_enabled`],t.ocrEnabled),d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}/config`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated predefined`})}},Oo={command:`predefined`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(wo).command(To).command(Eo).command(Do).demandCommand(1),handler:()=>{}},ko={command:`profiles`,describe:`Data Loss Prevention — detection profiles, custom patterns, datasets, and entry scanning rules`,builder:e=>e.command(So).command(Co).command(xo).command(Oo).demandCommand(1),handler:()=>{}},Ao={command:`dlp`,describe:`Operations for dlp`,builder:e=>e.command(Oa).command(Ra).command(co).command(uo).command(po).command(go).command(ko).demandCommand(1),handler:()=>{}},jo={command:`fingerprints`,describe:`Creates a new document fingerprint for DLP scanning. Document fingerprints detect documents that are structurally similar to the uploaded sample.`,builder:e=>e.option(`description`,{type:`string`,description:`The description field`,default:``}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the new document fingerprint.`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust document-fingerprints create document fingerprints`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/document_fingerprints`,pathParams:{},bodyKind:`json`,body:{description:n.description,matchPercent:n.matchPercent,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating document`,async()=>i.post(`/accounts/${o}/dlp/document_fingerprints`,{body:e})),{successLabel:`Created document`});return}if(n.matchPercent===void 0)throw Error(`--match-percent is required (or pass --body with this field set).`);n.name===void 0&&(n.name=await t(`name`,``));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.matchPercent!==void 0&&l(h,[`match_percent`],n.matchPercent),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating document`,async()=>i.post(`/accounts/${o}/dlp/document_fingerprints`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created document`})}},Mo={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(jo).demandCommand(1),handler:()=>{}},No={command:`v2 <documentFingerprintId>`,describe:`Updates metadata for an existing document fingerprint, such as its name or description.`,builder:e=>e.positional(`documentFingerprintId`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`description`,{type:`string`,description:`The description field`}).option(`match-percent`,{type:`number`,description:`The match_percent field`}).option(`name`,{type:`string`,description:`The name field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Attributes of the document fingerprint to update.`}),handler:async t=>{if(c(t.documentFingerprintId,`documentFingerprintId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust document-fingerprints create v2`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/document_fingerprints/${t.documentFingerprintId??`<documentFingerprintId>`}`,pathParams:{documentFingerprintId:String(t.documentFingerprintId??``)},bodyKind:`json`,body:{description:t.description,matchPercent:t.matchPercent,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating create`,async()=>n.post(`/accounts/${i}/dlp/document_fingerprints/${t.documentFingerprintId}`,{body:e})),{successLabel:`Created create`});return}let o={};t.description!==void 0&&l(o,[`description`],s(t.description,`description`,`text`)),t.matchPercent!==void 0&&l(o,[`match_percent`],t.matchPercent),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Creating create`,async()=>n.post(`/accounts/${i}/dlp/document_fingerprints/${t.documentFingerprintId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created create`})}},Po={command:`create`,describe:`Document Fingerprints operations`,builder:e=>e.command(No).command(Mo).demandCommand(1),handler:()=>{}},Fo={command:`delete <documentFingerprintId>`,describe:`Removes a document fingerprint from DLP configuration. Documents matching this fingerprint will no longer be detected.`,builder:e=>e.positional(`documentFingerprintId`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.documentFingerprintId,`documentFingerprintId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust document-fingerprints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/document_fingerprints/${t.documentFingerprintId??`<documentFingerprintId>`}`,pathParams:{documentFingerprintId:String(t.documentFingerprintId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`document fingerprint`,String(t.documentFingerprintId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting document fingerprint`,async()=>n.zeroTrust.documentFingerprints.delete(o,t.documentFingerprintId)),{successLabel:`Deleted document fingerprint`})}},Io={command:`fingerprints <documentFingerprintId>`,describe:`Retrieve data about a specific document fingerprint.`,builder:e=>e.positional(`documentFingerprintId`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}),handler:async e=>{c(e.documentFingerprintId,`documentFingerprintId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading document`,async()=>t.zeroTrust.documentFingerprints.get.document.fingerprints(n,e.documentFingerprintId)),{successLabel:`Loaded document`})}},Lo={command:`document`,describe:`Document Fingerprints operations`,builder:e=>e.command(Io).demandCommand(1),handler:()=>{}},Ro={command:`all`,describe:`Lists all document fingerprints configured for DLP scanning in the account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading fingerprint`,async()=>t.zeroTrust.documentFingerprints.get.fingerprints.all(n)),{successLabel:`Loaded fingerprint`})}},zo={command:`fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Ro).demandCommand(1),handler:()=>{}},Bo={command:`get`,describe:`Operations for document-fingerprints.get`,builder:e=>e.command(Lo).command(zo).demandCommand(1),handler:()=>{}},Vo={command:`update <documentFingerprintId>`,describe:`Uploads a new document to create or update a fingerprint. The document structure is analyzed to enable detection of similar documents.`,builder:e=>e.positional(`documentFingerprintId`,{type:`string`,description:`Document fingerprint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`File used for document fingerprinting.`}).option(`file`,{type:`string`,description:`Path to a file to upload as the request body`}),handler:async t=>{if(c(t.documentFingerprintId,`documentFingerprintId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust document-fingerprints update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/document_fingerprints/${t.documentFingerprintId??`<documentFingerprintId>`}`,pathParams:{documentFingerprintId:String(t.documentFingerprintId??``)},bodyKind:`multipart`,body:{body:t.body,file:t.file},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.file!==void 0||t.body!==void 0){let e=new FormData;if(t.file){let{readFileSync:n}=await import(`node:fs`),{resolve:r}=await import(`node:path`),i=n(r(t.file));e.append(`file`,new Blob([i]),t.file.split(`/`).pop())}else t.body!==void 0&&e.append(`file`,t.body);d(await m(`Updating document fingerprint`,async()=>n.put(`/accounts/${i}/dlp/document_fingerprints/${t.documentFingerprintId}`,{body:e})),{successLabel:`Updated document fingerprint`});return}if(t.body){let e=s(t.body,`body`,`binary`);d(await m(`Updating document fingerprint`,async()=>n.put(`/accounts/${i}/dlp/document_fingerprints/${t.documentFingerprintId}`,{body:e,headers:{"Content-Type":`multipart/form-data`}})),{successLabel:`Updated document fingerprint`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},Ho={command:`document-fingerprints`,describe:`Document Fingerprints operations`,builder:e=>e.command(Fo).command(Vo).command(Po).command(Bo).demandCommand(1),handler:()=>{}},Uo={command:`list`,describe:`List all application and application type mappings.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading app types`,async()=>t.zeroTrust.gateway.appTypes.list(n)),{successLabel:`Loaded app types`})}},Wo={command:`app-types`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Uo).demandCommand(1),handler:()=>{}},Go={command:`get`,describe:`Retrieve all Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading audit ssh setting`,async()=>t.zeroTrust.gateway.auditSshSettings.get(n)),{successLabel:`Loaded audit ssh setting`})}},Ko={command:`rotate-seed`,describe:`Rotate the SSH account seed that generates the host key identity when connecting through the Cloudflare SSH Proxy.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway audit-ssh-settings rotate-seed`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/audit_ssh_settings/rotate_seed`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating audit ssh setting`,async()=>n.zeroTrust.gateway.auditSshSettings.rotateSeed(i)),{successLabel:`Created audit ssh setting`})}},qo={command:`update`,describe:`Update Zero Trust Audit SSH and SSH with Access for Infrastructure settings for an account.`,builder:e=>e.option(`public-key`,{type:`string`,description:`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway audit-ssh-settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/audit_ssh_settings`,pathParams:{},bodyKind:`json`,body:{publicKey:n.publicKey,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating audit ssh setting`,async()=>i.put(`/accounts/${o}/gateway/audit_ssh_settings`,{body:e})),{successLabel:`Updated audit ssh setting`});return}n.publicKey===void 0&&(n.publicKey=await t(`public-key`,`Provide the Base64-encoded HPKE public key that encrypts SSH session logs. See https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#enable-ssh-command-logging.`));let h={};n.publicKey!==void 0&&l(h,[`public_key`],s(n.publicKey,`publicKey`,`text`)),d(await m(`Updating audit ssh setting`,async()=>i.put(`/accounts/${o}/gateway/audit_ssh_settings`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated audit ssh setting`})}},Jo={command:`audit-ssh-settings`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Go).command(Ko).command(qo).demandCommand(1),handler:()=>{}},Yo={command:`list`,describe:`List all categories.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading categories`,async()=>t.zeroTrust.gateway.categories.list(n)),{successLabel:`Loaded categories`})}},Xo={command:`categories`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Yo).demandCommand(1),handler:()=>{}},Zo={command:`activate <certificateId>`,describe:`Bind a single Zero Trust certificate to the edge.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway certificates activate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/certificates/${t.certificateId??`<certificateId>`}/activate`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating certificate`,async()=>n.post(`/accounts/${i}/gateway/certificates/${t.certificateId}/activate`,{body:e})),{successLabel:`Created certificate`});return}d(await m(`Creating certificate`,async()=>n.zeroTrust.gateway.certificates.activate(t.certificateId,i)),{successLabel:`Created certificate`})}},Qo={command:`create`,describe:`Create a new Zero Trust certificate.`,builder:e=>e.option(`validity-period-days`,{type:`number`,description:"Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). **Important**: This field is only settable during the certificate creation.  Certificates becomes immutable after creation - use the `/activate` and `/deactivate` endpoints to manage certificate lifecycle."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway certificates create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/certificates`,pathParams:{},bodyKind:`json`,body:{validityPeriodDays:t.validityPeriodDays,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating certificate`,async()=>n.post(`/accounts/${i}/gateway/certificates`,{body:e})),{successLabel:`Created certificate`});return}let o={};t.validityPeriodDays!==void 0&&l(o,[`validity_period_days`],t.validityPeriodDays),d(await m(`Creating certificate`,async()=>n.post(`/accounts/${i}/gateway/certificates`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created certificate`})}},$o={command:`deactivate <certificateId>`,describe:`Unbind a single Zero Trust certificate from the edge.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway certificates deactivate`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/certificates/${t.certificateId??`<certificateId>`}/deactivate`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating certificate`,async()=>n.post(`/accounts/${i}/gateway/certificates/${t.certificateId}/deactivate`,{body:e})),{successLabel:`Created certificate`});return}d(await m(`Creating certificate`,async()=>n.zeroTrust.gateway.certificates.deactivate(t.certificateId,i)),{successLabel:`Created certificate`})}},es={command:`delete <certificateId>`,describe:`Delete a gateway-managed Zero Trust certificate. You must deactivate the certificate from the edge (inactive) before deleting it.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.certificateId,`certificateId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway certificates delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/certificates/${t.certificateId??`<certificateId>`}`,pathParams:{certificateId:String(t.certificateId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`certificate`,String(t.certificateId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting certificate`,async()=>n.delete(`/accounts/${o}/gateway/certificates/${t.certificateId}`,{body:e})),{successLabel:`Deleted certificate`});return}d(await m(`Deleting certificate`,async()=>n.zeroTrust.gateway.certificates.delete(t.certificateId,o)),{successLabel:`Deleted certificate`})}},ts={command:`get <certificateId>`,describe:`Get a single Zero Trust certificate.`,builder:e=>e.positional(`certificateId`,{type:`string`,description:`Identify the certificate with a UUID.`,demandOption:!0}),handler:async e=>{c(e.certificateId,`certificateId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading certificate`,async()=>t.zeroTrust.gateway.certificates.get(e.certificateId,n)),{successLabel:`Loaded certificate`})}},ns={command:`list`,describe:`List all Zero Trust certificates for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading certificates`,async()=>t.zeroTrust.gateway.certificates.list(n)),{successLabel:`Loaded certificates`})}},rs={command:`certificates`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Zo).command(Qo).command($o).command(es).command(ts).command(ns).demandCommand(1),handler:()=>{}},is={command:`get`,describe:`Retrieve the current Zero Trust certificate configuration.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom certificate`,async()=>t.zeroTrust.gateway.configurations.customCertificate.get(n)),{successLabel:`Loaded custom certificate`})}},as={command:`custom-certificate`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(is).demandCommand(1),handler:()=>{}},os={command:`edit`,describe:"Update (PATCH) a single subcollection of settings such as `antivirus`, `tls_decrypt`, `activity_log`, `block_page`, `browser_isolation`, `fips`, `body_scanning`, or `certificate` without updating the entire configuration object. This endpoint returns an error if any settings collection lacks proper configuration.",builder:e=>e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`],default:``}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`,default:!1}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway configurations edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:{settingsActivityLogEnabled:t.settingsActivityLogEnabled,settingsAntivirusEnabledDownloadPhase:t.settingsAntivirusEnabledDownloadPhase,settingsAntivirusEnabledUploadPhase:t.settingsAntivirusEnabledUploadPhase,settingsAntivirusFailClosed:t.settingsAntivirusFailClosed,settingsAntivirusNotificationSettingsEnabled:t.settingsAntivirusNotificationSettingsEnabled,settingsAntivirusNotificationSettingsIncludeContext:t.settingsAntivirusNotificationSettingsIncludeContext,settingsAntivirusNotificationSettingsMsg:t.settingsAntivirusNotificationSettingsMsg,settingsAntivirusNotificationSettingsSupportUrl:t.settingsAntivirusNotificationSettingsSupportUrl,settingsBlockPageBackgroundColor:t.settingsBlockPageBackgroundColor,settingsBlockPageEnabled:t.settingsBlockPageEnabled,settingsBlockPageFooterText:t.settingsBlockPageFooterText,settingsBlockPageHeaderText:t.settingsBlockPageHeaderText,settingsBlockPageIncludeContext:t.settingsBlockPageIncludeContext,settingsBlockPageLogoPath:t.settingsBlockPageLogoPath,settingsBlockPageMailtoAddress:t.settingsBlockPageMailtoAddress,settingsBlockPageMailtoSubject:t.settingsBlockPageMailtoSubject,settingsBlockPageMode:t.settingsBlockPageMode,settingsBlockPageName:t.settingsBlockPageName,settingsBlockPageSuppressFooter:t.settingsBlockPageSuppressFooter,settingsBlockPageTargetUri:t.settingsBlockPageTargetUri,settingsBodyScanningInspectionMode:t.settingsBodyScanningInspectionMode,settingsBrowserIsolationNonIdentityEnabled:t.settingsBrowserIsolationNonIdentityEnabled,settingsBrowserIsolationUrlBrowserIsolationEnabled:t.settingsBrowserIsolationUrlBrowserIsolationEnabled,settingsCertificateId:t.settingsCertificateId,settingsCustomCertificateEnabled:t.settingsCustomCertificateEnabled,settingsCustomCertificateId:t.settingsCustomCertificateId,settingsExtendedEmailMatchingEnabled:t.settingsExtendedEmailMatchingEnabled,settingsFipsTls:t.settingsFipsTls,settingsHostSelectorEnabled:t.settingsHostSelectorEnabled,settingsInspectionMode:t.settingsInspectionMode,settingsProtocolDetectionEnabled:t.settingsProtocolDetectionEnabled,settingsSandboxEnabled:t.settingsSandboxEnabled,settingsSandboxFallbackAction:t.settingsSandboxFallbackAction,settingsTlsDecryptEnabled:t.settingsTlsDecryptEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating configuration`,async()=>n.patch(`/accounts/${i}/gateway/configuration`,{body:e})),{successLabel:`Updated configuration`});return}let o={};t.settingsActivityLogEnabled!==void 0&&l(o,[`settings`,`activity_log`,`enabled`],t.settingsActivityLogEnabled),t.settingsAntivirusEnabledDownloadPhase!==void 0&&l(o,[`settings`,`antivirus`,`enabled_download_phase`],t.settingsAntivirusEnabledDownloadPhase),t.settingsAntivirusEnabledUploadPhase!==void 0&&l(o,[`settings`,`antivirus`,`enabled_upload_phase`],t.settingsAntivirusEnabledUploadPhase),t.settingsAntivirusFailClosed!==void 0&&l(o,[`settings`,`antivirus`,`fail_closed`],t.settingsAntivirusFailClosed),t.settingsAntivirusNotificationSettingsEnabled!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`enabled`],t.settingsAntivirusNotificationSettingsEnabled),t.settingsAntivirusNotificationSettingsIncludeContext!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`include_context`],t.settingsAntivirusNotificationSettingsIncludeContext),t.settingsAntivirusNotificationSettingsMsg!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`msg`],s(t.settingsAntivirusNotificationSettingsMsg,`settingsAntivirusNotificationSettingsMsg`,`text`)),t.settingsAntivirusNotificationSettingsSupportUrl!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`support_url`],s(t.settingsAntivirusNotificationSettingsSupportUrl,`settingsAntivirusNotificationSettingsSupportUrl`,`text`)),t.settingsBlockPageBackgroundColor!==void 0&&l(o,[`settings`,`block_page`,`background_color`],s(t.settingsBlockPageBackgroundColor,`settingsBlockPageBackgroundColor`,`text`)),t.settingsBlockPageEnabled!==void 0&&l(o,[`settings`,`block_page`,`enabled`],t.settingsBlockPageEnabled),t.settingsBlockPageFooterText!==void 0&&l(o,[`settings`,`block_page`,`footer_text`],s(t.settingsBlockPageFooterText,`settingsBlockPageFooterText`,`text`)),t.settingsBlockPageHeaderText!==void 0&&l(o,[`settings`,`block_page`,`header_text`],s(t.settingsBlockPageHeaderText,`settingsBlockPageHeaderText`,`text`)),t.settingsBlockPageIncludeContext!==void 0&&l(o,[`settings`,`block_page`,`include_context`],t.settingsBlockPageIncludeContext),t.settingsBlockPageLogoPath!==void 0&&l(o,[`settings`,`block_page`,`logo_path`],s(t.settingsBlockPageLogoPath,`settingsBlockPageLogoPath`,`text`)),t.settingsBlockPageMailtoAddress!==void 0&&l(o,[`settings`,`block_page`,`mailto_address`],s(t.settingsBlockPageMailtoAddress,`settingsBlockPageMailtoAddress`,`text`)),t.settingsBlockPageMailtoSubject!==void 0&&l(o,[`settings`,`block_page`,`mailto_subject`],s(t.settingsBlockPageMailtoSubject,`settingsBlockPageMailtoSubject`,`text`)),t.settingsBlockPageMode!==void 0&&l(o,[`settings`,`block_page`,`mode`],s(t.settingsBlockPageMode,`settingsBlockPageMode`,`text`)),t.settingsBlockPageName!==void 0&&l(o,[`settings`,`block_page`,`name`],s(t.settingsBlockPageName,`settingsBlockPageName`,`text`)),t.settingsBlockPageSuppressFooter!==void 0&&l(o,[`settings`,`block_page`,`suppress_footer`],t.settingsBlockPageSuppressFooter),t.settingsBlockPageTargetUri!==void 0&&l(o,[`settings`,`block_page`,`target_uri`],s(t.settingsBlockPageTargetUri,`settingsBlockPageTargetUri`,`text`)),t.settingsBodyScanningInspectionMode!==void 0&&l(o,[`settings`,`body_scanning`,`inspection_mode`],s(t.settingsBodyScanningInspectionMode,`settingsBodyScanningInspectionMode`,`text`)),t.settingsBrowserIsolationNonIdentityEnabled!==void 0&&l(o,[`settings`,`browser_isolation`,`non_identity_enabled`],t.settingsBrowserIsolationNonIdentityEnabled),t.settingsBrowserIsolationUrlBrowserIsolationEnabled!==void 0&&l(o,[`settings`,`browser_isolation`,`url_browser_isolation_enabled`],t.settingsBrowserIsolationUrlBrowserIsolationEnabled),t.settingsCertificateId!==void 0&&l(o,[`settings`,`certificate`,`id`],s(t.settingsCertificateId,`settingsCertificateId`,`text`)),t.settingsCustomCertificateEnabled!==void 0&&l(o,[`settings`,`custom_certificate`,`enabled`],t.settingsCustomCertificateEnabled),t.settingsCustomCertificateId!==void 0&&l(o,[`settings`,`custom_certificate`,`id`],s(t.settingsCustomCertificateId,`settingsCustomCertificateId`,`text`)),t.settingsExtendedEmailMatchingEnabled!==void 0&&l(o,[`settings`,`extended_email_matching`,`enabled`],t.settingsExtendedEmailMatchingEnabled),t.settingsFipsTls!==void 0&&l(o,[`settings`,`fips`,`tls`],t.settingsFipsTls),t.settingsHostSelectorEnabled!==void 0&&l(o,[`settings`,`host_selector`,`enabled`],t.settingsHostSelectorEnabled),t.settingsInspectionMode!==void 0&&l(o,[`settings`,`inspection`,`mode`],s(t.settingsInspectionMode,`settingsInspectionMode`,`text`)),t.settingsProtocolDetectionEnabled!==void 0&&l(o,[`settings`,`protocol_detection`,`enabled`],t.settingsProtocolDetectionEnabled),t.settingsSandboxEnabled!==void 0&&l(o,[`settings`,`sandbox`,`enabled`],t.settingsSandboxEnabled),t.settingsSandboxFallbackAction!==void 0&&l(o,[`settings`,`sandbox`,`fallback_action`],s(t.settingsSandboxFallbackAction,`settingsSandboxFallbackAction`,`text`)),t.settingsTlsDecryptEnabled!==void 0&&l(o,[`settings`,`tls_decrypt`,`enabled`],t.settingsTlsDecryptEnabled),d(await m(`Updating configuration`,async()=>n.patch(`/accounts/${i}/gateway/configuration`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated configuration`})}},ss={command:`get`,describe:`Retrieve the current Zero Trust account configuration.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading configuration`,async()=>t.zeroTrust.gateway.configurations.get(n)),{successLabel:`Loaded configuration`})}},cs={command:`update`,describe:`Update the current Zero Trust account configuration.`,builder:e=>e.option(`settings-activity-log-enabled`,{type:`boolean`,description:`Specify whether to log activity.`}).option(`settings-antivirus-enabled-download-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on downloads.`}).option(`settings-antivirus-enabled-upload-phase`,{type:`boolean`,description:`Specify whether to enable anti-virus scanning on uploads.`}).option(`settings-antivirus-fail-closed`,{type:`boolean`,description:`Specify whether to block requests for unscannable files.`}).option(`settings-antivirus-notification-settings-enabled`,{type:`boolean`,description:`Specify whether to enable notifications.`}).option(`settings-antivirus-notification-settings-include-context`,{type:`boolean`,description:`Specify whether to include context information as query parameters.`}).option(`settings-antivirus-notification-settings-msg`,{type:`string`,description:`Specify the message to show in the notification.`}).option(`settings-antivirus-notification-settings-support-url`,{type:`string`,description:`Specify a URL that directs users to more information. If unset, the notification opens a block page.`}).option(`settings-block-page-background-color`,{type:`string`,description:"Specify the block page background color in `#rrggbb` format when the mode is customized_block_page."}).option(`settings-block-page-enabled`,{type:`boolean`,description:`Specify whether to enable the custom block page.`}).option(`settings-block-page-footer-text`,{type:`string`,description:`Specify the block page footer text when the mode is customized_block_page.`}).option(`settings-block-page-header-text`,{type:`string`,description:`Specify the block page header text when the mode is customized_block_page.`}).option(`settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to append context to target_uri as query parameters. This applies only when the mode is redirect_uri.`}).option(`settings-block-page-logo-path`,{type:`string`,description:`Specify the full URL to the logo file when the mode is customized_block_page.`}).option(`settings-block-page-mailto-address`,{type:`string`,description:`Specify the admin email for users to contact when the mode is customized_block_page.`}).option(`settings-block-page-mailto-subject`,{type:`string`,description:`Specify the subject line for emails created from the block page when the mode is customized_block_page.`}).option(`settings-block-page-mode`,{type:`string`,description:`Specify whether to redirect users to a Cloudflare-hosted block page or a customer-provided URI.`,choices:[`customized_block_page`,`redirect_uri`],default:``}).option(`settings-block-page-name`,{type:`string`,description:`Specify the block page title when the mode is customized_block_page.`}).option(`settings-block-page-suppress-footer`,{type:`boolean`,description:`Specify whether to suppress detailed information at the bottom of the block page when the mode is customized_block_page.`}).option(`settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to redirect users to when the mode is redirect_uri.`}).option(`settings-body-scanning-inspection-mode`,{type:`string`,description:"Specify the inspection mode as either `deep` or `shallow`.",choices:[`deep`,`shallow`]}).option(`settings-browser-isolation-non-identity-enabled`,{type:`boolean`,description:`Specify whether to enable non-identity onramp support for Browser Isolation.`}).option(`settings-browser-isolation-url-browser-isolation-enabled`,{type:`boolean`,description:`Specify whether to enable Clientless Browser Isolation.`}).option(`settings-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate used for interception. Ensure the certificate is available at the edge(previously called 'active'). A nil UUID directs Cloudflare to use the Root CA.`}).option(`settings-custom-certificate-enabled`,{type:`boolean`,description:`Specify whether to enable a custom certificate authority for signing Gateway traffic.`,default:!1}).option(`settings-custom-certificate-id`,{type:`string`,description:`Specify the UUID of the certificate (ID from MTLS certificate store).`}).option(`settings-extended-email-matching-enabled`,{type:`boolean`,description:`Specify whether to match all variants of user emails (with + or . modifiers) used as criteria in Firewall policies.`}).option(`settings-fips-tls`,{type:`boolean`,description:`Enforce cipher suites and TLS versions compliant with FIPS 140-2.`}).option(`settings-host-selector-enabled`,{type:`boolean`,description:`Specify whether to enable filtering via hosts for egress policies.`}).option(`settings-inspection-mode`,{type:`string`,description:`Define the proxy inspection mode.   1. static: Gateway applies static inspection to HTTP on TCP(80). With TLS decryption on, Gateway inspects HTTPS traffic on TCP(443) and UDP(443).   2. dynamic: Gateway applies protocol detection to inspect HTTP and HTTPS traffic on any port. TLS decryption must remain on to inspect HTTPS traffic.`,choices:[`static`,`dynamic`]}).option(`settings-protocol-detection-enabled`,{type:`boolean`,description:`Specify whether to detect protocols from the initial bytes of client traffic.`}).option(`settings-sandbox-enabled`,{type:`boolean`,description:`Specify whether to enable the sandbox.`}).option(`settings-sandbox-fallback-action`,{type:`string`,description:`Specify the action to take when the system cannot scan the file.`,choices:[`allow`,`block`]}).option(`settings-tls-decrypt-enabled`,{type:`boolean`,description:`Specify whether to inspect encrypted HTTP traffic.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Specify account settings.`}).check(e=>{if(`settings-activity-log-enabled.settings-antivirus-enabled-download-phase.settings-antivirus-enabled-upload-phase.settings-antivirus-fail-closed.settings-antivirus-notification-settings-enabled.settings-antivirus-notification-settings-include-context.settings-antivirus-notification-settings-msg.settings-antivirus-notification-settings-support-url.settings-block-page-background-color.settings-block-page-enabled.settings-block-page-footer-text.settings-block-page-header-text.settings-block-page-include-context.settings-block-page-logo-path.settings-block-page-mailto-address.settings-block-page-mailto-subject.settings-block-page-name.settings-block-page-suppress-footer.settings-block-page-target-uri.settings-body-scanning-inspection-mode.settings-browser-isolation-non-identity-enabled.settings-browser-isolation-url-browser-isolation-enabled.settings-certificate-id.settings-custom-certificate-enabled.settings-custom-certificate-id.settings-extended-email-matching-enabled.settings-fips-tls.settings-host-selector-enabled.settings-inspection-mode.settings-protocol-detection-enabled.settings-sandbox-enabled.settings-sandbox-fallback-action.settings-tls-decrypt-enabled`.split(`.`).some(t=>e[t]!==void 0)){let t=[`settings-certificate-id`,`settings-custom-certificate-enabled`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --settings-* flag is set`)}return!0}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/configuration`,pathParams:{},bodyKind:`json`,body:{settingsActivityLogEnabled:t.settingsActivityLogEnabled,settingsAntivirusEnabledDownloadPhase:t.settingsAntivirusEnabledDownloadPhase,settingsAntivirusEnabledUploadPhase:t.settingsAntivirusEnabledUploadPhase,settingsAntivirusFailClosed:t.settingsAntivirusFailClosed,settingsAntivirusNotificationSettingsEnabled:t.settingsAntivirusNotificationSettingsEnabled,settingsAntivirusNotificationSettingsIncludeContext:t.settingsAntivirusNotificationSettingsIncludeContext,settingsAntivirusNotificationSettingsMsg:t.settingsAntivirusNotificationSettingsMsg,settingsAntivirusNotificationSettingsSupportUrl:t.settingsAntivirusNotificationSettingsSupportUrl,settingsBlockPageBackgroundColor:t.settingsBlockPageBackgroundColor,settingsBlockPageEnabled:t.settingsBlockPageEnabled,settingsBlockPageFooterText:t.settingsBlockPageFooterText,settingsBlockPageHeaderText:t.settingsBlockPageHeaderText,settingsBlockPageIncludeContext:t.settingsBlockPageIncludeContext,settingsBlockPageLogoPath:t.settingsBlockPageLogoPath,settingsBlockPageMailtoAddress:t.settingsBlockPageMailtoAddress,settingsBlockPageMailtoSubject:t.settingsBlockPageMailtoSubject,settingsBlockPageMode:t.settingsBlockPageMode,settingsBlockPageName:t.settingsBlockPageName,settingsBlockPageSuppressFooter:t.settingsBlockPageSuppressFooter,settingsBlockPageTargetUri:t.settingsBlockPageTargetUri,settingsBodyScanningInspectionMode:t.settingsBodyScanningInspectionMode,settingsBrowserIsolationNonIdentityEnabled:t.settingsBrowserIsolationNonIdentityEnabled,settingsBrowserIsolationUrlBrowserIsolationEnabled:t.settingsBrowserIsolationUrlBrowserIsolationEnabled,settingsCertificateId:t.settingsCertificateId,settingsCustomCertificateEnabled:t.settingsCustomCertificateEnabled,settingsCustomCertificateId:t.settingsCustomCertificateId,settingsExtendedEmailMatchingEnabled:t.settingsExtendedEmailMatchingEnabled,settingsFipsTls:t.settingsFipsTls,settingsHostSelectorEnabled:t.settingsHostSelectorEnabled,settingsInspectionMode:t.settingsInspectionMode,settingsProtocolDetectionEnabled:t.settingsProtocolDetectionEnabled,settingsSandboxEnabled:t.settingsSandboxEnabled,settingsSandboxFallbackAction:t.settingsSandboxFallbackAction,settingsTlsDecryptEnabled:t.settingsTlsDecryptEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating configuration`,async()=>n.put(`/accounts/${i}/gateway/configuration`,{body:e})),{successLabel:`Updated configuration`});return}let o={};t.settingsActivityLogEnabled!==void 0&&l(o,[`settings`,`activity_log`,`enabled`],t.settingsActivityLogEnabled),t.settingsAntivirusEnabledDownloadPhase!==void 0&&l(o,[`settings`,`antivirus`,`enabled_download_phase`],t.settingsAntivirusEnabledDownloadPhase),t.settingsAntivirusEnabledUploadPhase!==void 0&&l(o,[`settings`,`antivirus`,`enabled_upload_phase`],t.settingsAntivirusEnabledUploadPhase),t.settingsAntivirusFailClosed!==void 0&&l(o,[`settings`,`antivirus`,`fail_closed`],t.settingsAntivirusFailClosed),t.settingsAntivirusNotificationSettingsEnabled!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`enabled`],t.settingsAntivirusNotificationSettingsEnabled),t.settingsAntivirusNotificationSettingsIncludeContext!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`include_context`],t.settingsAntivirusNotificationSettingsIncludeContext),t.settingsAntivirusNotificationSettingsMsg!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`msg`],s(t.settingsAntivirusNotificationSettingsMsg,`settingsAntivirusNotificationSettingsMsg`,`text`)),t.settingsAntivirusNotificationSettingsSupportUrl!==void 0&&l(o,[`settings`,`antivirus`,`notification_settings`,`support_url`],s(t.settingsAntivirusNotificationSettingsSupportUrl,`settingsAntivirusNotificationSettingsSupportUrl`,`text`)),t.settingsBlockPageBackgroundColor!==void 0&&l(o,[`settings`,`block_page`,`background_color`],s(t.settingsBlockPageBackgroundColor,`settingsBlockPageBackgroundColor`,`text`)),t.settingsBlockPageEnabled!==void 0&&l(o,[`settings`,`block_page`,`enabled`],t.settingsBlockPageEnabled),t.settingsBlockPageFooterText!==void 0&&l(o,[`settings`,`block_page`,`footer_text`],s(t.settingsBlockPageFooterText,`settingsBlockPageFooterText`,`text`)),t.settingsBlockPageHeaderText!==void 0&&l(o,[`settings`,`block_page`,`header_text`],s(t.settingsBlockPageHeaderText,`settingsBlockPageHeaderText`,`text`)),t.settingsBlockPageIncludeContext!==void 0&&l(o,[`settings`,`block_page`,`include_context`],t.settingsBlockPageIncludeContext),t.settingsBlockPageLogoPath!==void 0&&l(o,[`settings`,`block_page`,`logo_path`],s(t.settingsBlockPageLogoPath,`settingsBlockPageLogoPath`,`text`)),t.settingsBlockPageMailtoAddress!==void 0&&l(o,[`settings`,`block_page`,`mailto_address`],s(t.settingsBlockPageMailtoAddress,`settingsBlockPageMailtoAddress`,`text`)),t.settingsBlockPageMailtoSubject!==void 0&&l(o,[`settings`,`block_page`,`mailto_subject`],s(t.settingsBlockPageMailtoSubject,`settingsBlockPageMailtoSubject`,`text`)),t.settingsBlockPageMode!==void 0&&l(o,[`settings`,`block_page`,`mode`],s(t.settingsBlockPageMode,`settingsBlockPageMode`,`text`)),t.settingsBlockPageName!==void 0&&l(o,[`settings`,`block_page`,`name`],s(t.settingsBlockPageName,`settingsBlockPageName`,`text`)),t.settingsBlockPageSuppressFooter!==void 0&&l(o,[`settings`,`block_page`,`suppress_footer`],t.settingsBlockPageSuppressFooter),t.settingsBlockPageTargetUri!==void 0&&l(o,[`settings`,`block_page`,`target_uri`],s(t.settingsBlockPageTargetUri,`settingsBlockPageTargetUri`,`text`)),t.settingsBodyScanningInspectionMode!==void 0&&l(o,[`settings`,`body_scanning`,`inspection_mode`],s(t.settingsBodyScanningInspectionMode,`settingsBodyScanningInspectionMode`,`text`)),t.settingsBrowserIsolationNonIdentityEnabled!==void 0&&l(o,[`settings`,`browser_isolation`,`non_identity_enabled`],t.settingsBrowserIsolationNonIdentityEnabled),t.settingsBrowserIsolationUrlBrowserIsolationEnabled!==void 0&&l(o,[`settings`,`browser_isolation`,`url_browser_isolation_enabled`],t.settingsBrowserIsolationUrlBrowserIsolationEnabled),t.settingsCertificateId!==void 0&&l(o,[`settings`,`certificate`,`id`],s(t.settingsCertificateId,`settingsCertificateId`,`text`)),t.settingsCustomCertificateEnabled!==void 0&&l(o,[`settings`,`custom_certificate`,`enabled`],t.settingsCustomCertificateEnabled),t.settingsCustomCertificateId!==void 0&&l(o,[`settings`,`custom_certificate`,`id`],s(t.settingsCustomCertificateId,`settingsCustomCertificateId`,`text`)),t.settingsExtendedEmailMatchingEnabled!==void 0&&l(o,[`settings`,`extended_email_matching`,`enabled`],t.settingsExtendedEmailMatchingEnabled),t.settingsFipsTls!==void 0&&l(o,[`settings`,`fips`,`tls`],t.settingsFipsTls),t.settingsHostSelectorEnabled!==void 0&&l(o,[`settings`,`host_selector`,`enabled`],t.settingsHostSelectorEnabled),t.settingsInspectionMode!==void 0&&l(o,[`settings`,`inspection`,`mode`],s(t.settingsInspectionMode,`settingsInspectionMode`,`text`)),t.settingsProtocolDetectionEnabled!==void 0&&l(o,[`settings`,`protocol_detection`,`enabled`],t.settingsProtocolDetectionEnabled),t.settingsSandboxEnabled!==void 0&&l(o,[`settings`,`sandbox`,`enabled`],t.settingsSandboxEnabled),t.settingsSandboxFallbackAction!==void 0&&l(o,[`settings`,`sandbox`,`fallback_action`],s(t.settingsSandboxFallbackAction,`settingsSandboxFallbackAction`,`text`)),t.settingsTlsDecryptEnabled!==void 0&&l(o,[`settings`,`tls_decrypt`,`enabled`],t.settingsTlsDecryptEnabled),d(await m(`Updating configuration`,async()=>n.put(`/accounts/${i}/gateway/configuration`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated configuration`})}},ls={command:`configurations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(os).command(ss).command(cs).command(as).demandCommand(1),handler:()=>{}},us={command:`create`,describe:`Create a Zero Trust account for an existing Cloudflare account.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating gateway`,async()=>n.zeroTrust.gateway.create(i)),{successLabel:`Created gateway`})}},ds={command:`list`,describe:`Retrieve information about the current Zero Trust account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading gateway`,async()=>t.zeroTrust.gateway.list(n)),{successLabel:`Loaded gateway`})}},fs={command:`create`,describe:`Creates a new Zero Trust list.`,builder:e=>e.option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway lists create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/lists`,pathParams:{},bodyKind:`json`,body:{description:i.description,name:i.name,type:i.type,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating list`,async()=>o.post(`/accounts/${h}/gateway/lists`,{body:e})),{successLabel:`Created list`});return}i.name===void 0&&(i.name=await t(`name`,`Specify the list name.`)),i.type===void 0&&(i.type=await n(`type`,`Specify the list type.`,[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]));let g={};i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.type!==void 0&&l(g,[`type`],s(i.type,`type`,`text`)),d(await m(`Creating list`,async()=>o.post(`/accounts/${h}/gateway/lists`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created list`})}},ps={command:`delete <listId>`,describe:`Deletes a Zero Trust list.`,builder:e=>e.positional(`listId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.listId,`listId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway lists delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/lists/${t.listId??`<listId>`}`,pathParams:{listId:String(t.listId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`list`,String(t.listId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting list`,async()=>n.delete(`/accounts/${o}/gateway/lists/${t.listId}`,{body:e})),{successLabel:`Deleted list`});return}d(await m(`Deleting list`,async()=>n.zeroTrust.gateway.lists.delete(t.listId,o)),{successLabel:`Deleted list`})}},ms={command:`edit <listId>`,describe:`Appends or removes an item from a configured Zero Trust list.`,builder:e=>e.positional(`listId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`remove`,{type:`string`,array:!0,description:`Lists of item values you want to remove.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.listId,`listId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway lists edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/lists/${t.listId??`<listId>`}`,pathParams:{listId:String(t.listId??``)},bodyKind:`json`,body:{remove:t.remove,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating list`,async()=>n.patch(`/accounts/${i}/gateway/lists/${t.listId}`,{body:e})),{successLabel:`Updated list`});return}let o={};t.remove!==void 0&&l(o,[`remove`],t.remove),d(await m(`Updating list`,async()=>n.patch(`/accounts/${i}/gateway/lists/${t.listId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated list`})}},hs={command:`get <listId>`,describe:`Fetch a single Zero Trust list.`,builder:e=>e.positional(`listId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}),handler:async e=>{c(e.listId,`listId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading list`,async()=>t.zeroTrust.gateway.lists.get(e.listId,n)),{successLabel:`Loaded list`})}},gs={command:`list`,describe:`Fetch all items in a single Zero Trust list.`,builder:e=>e.option(`list-id`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}),handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading items`,async()=>t.zeroTrust.gateway.lists.items.list(e.listId,n)),{successLabel:`Loaded items`})}},_s={command:`items`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(gs).demandCommand(1),handler:()=>{}},vs={command:`list`,describe:`Fetch all Zero Trust lists for an account.`,builder:e=>e.option(`type`,{type:`string`,description:`Specify the list type.`,choices:[`SERIAL`,`URL`,`DOMAIN`,`EMAIL`,`IP`,`CATEGORY`,`LOCATION`,`DEVICE`,`AAGUID`]}),handler:async e=>{let t={};e.type!==void 0&&(t.type=e.type);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading lists`,async()=>n.zeroTrust.gateway.lists.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded lists`})}},ys={command:`update <listId>`,describe:`Updates a configured Zero Trust list. Skips updating list items if not included in the payload. A non empty list items will overwrite the existing list.`,builder:e=>e.positional(`listId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`description`,{type:`string`,description:`Provide the list description.`}).option(`name`,{type:`string`,description:`Specify the list name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.listId,`listId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway lists update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/lists/${n.listId??`<listId>`}`,pathParams:{listId:String(n.listId??``)},bodyKind:`json`,body:{description:n.description,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating list`,async()=>i.put(`/accounts/${o}/gateway/lists/${n.listId}`,{body:e})),{successLabel:`Updated list`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the list name.`));let h={};n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating list`,async()=>i.put(`/accounts/${o}/gateway/lists/${n.listId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated list`})}},bs={command:`lists`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(fs).command(ps).command(ms).command(hs).command(vs).command(ys).command(_s).demandCommand(1),handler:()=>{}},xs={command:`create`,describe:`Create a new Zero Trust Gateway location.`,builder:e=>e.option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway locations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/locations`,pathParams:{},bodyKind:`json`,body:{clientDefault:n.clientDefault,dnsDestinationIpsId:n.dnsDestinationIpsId,ecsSupport:n.ecsSupport,endpointsDohEnabled:n.endpointsDohEnabled,endpointsDohRequireToken:n.endpointsDohRequireToken,endpointsDotEnabled:n.endpointsDotEnabled,endpointsIpv4Enabled:n.endpointsIpv4Enabled,endpointsIpv6Enabled:n.endpointsIpv6Enabled,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating location`,async()=>i.post(`/accounts/${o}/gateway/locations`,{body:e})),{successLabel:`Created location`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the location name.`));let h={};n.clientDefault!==void 0&&l(h,[`client_default`],n.clientDefault),n.dnsDestinationIpsId!==void 0&&l(h,[`dns_destination_ips_id`],s(n.dnsDestinationIpsId,`dnsDestinationIpsId`,`text`)),n.ecsSupport!==void 0&&l(h,[`ecs_support`],n.ecsSupport),n.endpointsDohEnabled!==void 0&&l(h,[`endpoints`,`doh`,`enabled`],n.endpointsDohEnabled),n.endpointsDohRequireToken!==void 0&&l(h,[`endpoints`,`doh`,`require_token`],n.endpointsDohRequireToken),n.endpointsDotEnabled!==void 0&&l(h,[`endpoints`,`dot`,`enabled`],n.endpointsDotEnabled),n.endpointsIpv4Enabled!==void 0&&l(h,[`endpoints`,`ipv4`,`enabled`],n.endpointsIpv4Enabled),n.endpointsIpv6Enabled!==void 0&&l(h,[`endpoints`,`ipv6`,`enabled`],n.endpointsIpv6Enabled),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating location`,async()=>i.post(`/accounts/${o}/gateway/locations`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created location`})}},Ss={command:`delete <locationId>`,describe:`Delete a configured Zero Trust Gateway location.`,builder:e=>e.positional(`locationId`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.locationId,`locationId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway locations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/locations/${t.locationId??`<locationId>`}`,pathParams:{locationId:String(t.locationId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`location`,String(t.locationId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting location`,async()=>n.delete(`/accounts/${o}/gateway/locations/${t.locationId}`,{body:e})),{successLabel:`Deleted location`});return}d(await m(`Deleting location`,async()=>n.zeroTrust.gateway.locations.delete(t.locationId,o)),{successLabel:`Deleted location`})}},Cs={command:`get <locationId>`,describe:`Get a single Zero Trust Gateway location.`,builder:e=>e.positional(`locationId`,{type:`string`,description:`Location ID`,demandOption:!0}),handler:async e=>{c(e.locationId,`locationId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading location`,async()=>t.zeroTrust.gateway.locations.get(e.locationId,n)),{successLabel:`Loaded location`})}},ws={command:`list`,describe:`List Zero Trust Gateway locations for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading locations`,async()=>t.zeroTrust.gateway.locations.list(n)),{successLabel:`Loaded locations`})}},Ts={command:`update <locationId>`,describe:`Update a configured Zero Trust Gateway location.`,builder:e=>e.positional(`locationId`,{type:`string`,description:`Location ID`,demandOption:!0}).option(`client-default`,{type:`boolean`,description:`Indicate whether this location is the default location.`,default:!1}).option(`dns-destination-ips-id`,{type:`string`,description:`Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.`}).option(`ecs-support`,{type:`boolean`,description:`Indicate whether the location must resolve EDNS queries.`,default:!1}).option(`endpoints-doh-enabled`,{type:`boolean`,description:`Indicate whether the DOH endpoint is enabled for this location.`}).option(`endpoints-doh-require-token`,{type:`boolean`,description:`Specify whether the DOH endpoint requires user identity authentication.`}).option(`endpoints-dot-enabled`,{type:`boolean`,description:`Indicate whether the DOT endpoint is enabled for this location.`}).option(`endpoints-ipv4-enabled`,{type:`boolean`,description:`Indicate whether the IPv4 endpoint is enabled for this location.`}).option(`endpoints-ipv6-enabled`,{type:`boolean`,description:`Indicate whether the IPV6 endpoint is enabled for this location.`}).option(`name`,{type:`string`,description:`Specify the location name.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.locationId,`locationId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway locations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/locations/${n.locationId??`<locationId>`}`,pathParams:{locationId:String(n.locationId??``)},bodyKind:`json`,body:{clientDefault:n.clientDefault,dnsDestinationIpsId:n.dnsDestinationIpsId,ecsSupport:n.ecsSupport,endpointsDohEnabled:n.endpointsDohEnabled,endpointsDohRequireToken:n.endpointsDohRequireToken,endpointsDotEnabled:n.endpointsDotEnabled,endpointsIpv4Enabled:n.endpointsIpv4Enabled,endpointsIpv6Enabled:n.endpointsIpv6Enabled,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating location`,async()=>i.put(`/accounts/${o}/gateway/locations/${n.locationId}`,{body:e})),{successLabel:`Updated location`});return}n.name===void 0&&(n.name=await t(`name`,`Specify the location name.`));let h={};n.clientDefault!==void 0&&l(h,[`client_default`],n.clientDefault),n.dnsDestinationIpsId!==void 0&&l(h,[`dns_destination_ips_id`],s(n.dnsDestinationIpsId,`dnsDestinationIpsId`,`text`)),n.ecsSupport!==void 0&&l(h,[`ecs_support`],n.ecsSupport),n.endpointsDohEnabled!==void 0&&l(h,[`endpoints`,`doh`,`enabled`],n.endpointsDohEnabled),n.endpointsDohRequireToken!==void 0&&l(h,[`endpoints`,`doh`,`require_token`],n.endpointsDohRequireToken),n.endpointsDotEnabled!==void 0&&l(h,[`endpoints`,`dot`,`enabled`],n.endpointsDotEnabled),n.endpointsIpv4Enabled!==void 0&&l(h,[`endpoints`,`ipv4`,`enabled`],n.endpointsIpv4Enabled),n.endpointsIpv6Enabled!==void 0&&l(h,[`endpoints`,`ipv6`,`enabled`],n.endpointsIpv6Enabled),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating location`,async()=>i.put(`/accounts/${o}/gateway/locations/${n.locationId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated location`})}},Es={command:`locations`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(xs).command(Ss).command(Cs).command(ws).command(Ts).demandCommand(1),handler:()=>{}},Ds={command:`get`,describe:`Retrieve the current logging settings for the Zero Trust account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading logging`,async()=>t.zeroTrust.gateway.logging.get(n)),{successLabel:`Loaded logging`})}},Os={command:`update`,describe:`Update logging settings for the current Zero Trust account.`,builder:e=>e.option(`redact-pii`,{type:`boolean`,description:`Indicate whether to redact personally identifiable information from activity logging (PII fields include source IP, user email, user ID, device ID, URL, referrer, and user agent).`,default:!1}).option(`settings-by-rule-type-dns-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`,default:!1}).option(`settings-by-rule-type-dns-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`,default:!1}).option(`settings-by-rule-type-http-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`,default:!1}).option(`settings-by-rule-type-http-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`,default:!1}).option(`settings-by-rule-type-l4-log-all`,{type:`boolean`,description:`Specify whether to log all requests to this service.`,default:!1}).option(`settings-by-rule-type-l4-log-blocks`,{type:`boolean`,description:`Specify whether to log only blocking requests to this service.`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway logging update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/logging`,pathParams:{},bodyKind:`json`,body:{redactPii:t.redactPii,settingsByRuleTypeDnsLogAll:t.settingsByRuleTypeDnsLogAll,settingsByRuleTypeDnsLogBlocks:t.settingsByRuleTypeDnsLogBlocks,settingsByRuleTypeHttpLogAll:t.settingsByRuleTypeHttpLogAll,settingsByRuleTypeHttpLogBlocks:t.settingsByRuleTypeHttpLogBlocks,settingsByRuleTypeL4LogAll:t.settingsByRuleTypeL4LogAll,settingsByRuleTypeL4LogBlocks:t.settingsByRuleTypeL4LogBlocks,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating logging`,async()=>n.put(`/accounts/${i}/gateway/logging`,{body:e})),{successLabel:`Updated logging`});return}let o={};t.redactPii!==void 0&&l(o,[`redact_pii`],t.redactPii),t.settingsByRuleTypeDnsLogAll!==void 0&&l(o,[`settings_by_rule_type`,`dns`,`log_all`],t.settingsByRuleTypeDnsLogAll),t.settingsByRuleTypeDnsLogBlocks!==void 0&&l(o,[`settings_by_rule_type`,`dns`,`log_blocks`],t.settingsByRuleTypeDnsLogBlocks),t.settingsByRuleTypeHttpLogAll!==void 0&&l(o,[`settings_by_rule_type`,`http`,`log_all`],t.settingsByRuleTypeHttpLogAll),t.settingsByRuleTypeHttpLogBlocks!==void 0&&l(o,[`settings_by_rule_type`,`http`,`log_blocks`],t.settingsByRuleTypeHttpLogBlocks),t.settingsByRuleTypeL4LogAll!==void 0&&l(o,[`settings_by_rule_type`,`l4`,`log_all`],t.settingsByRuleTypeL4LogAll),t.settingsByRuleTypeL4LogBlocks!==void 0&&l(o,[`settings_by_rule_type`,`l4`,`log_blocks`],t.settingsByRuleTypeL4LogBlocks),d(await m(`Updating logging`,async()=>n.put(`/accounts/${i}/gateway/logging`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated logging`})}},ks={command:`logging`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Ds).command(Os).demandCommand(1),handler:()=>{}},As={command:`create`,describe:`Create a new Zero Trust Gateway PAC file.`,builder:e=>e.option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`slug`,{type:`string`,description:`URL-friendly version of the PAC file name. If not provided, it will be auto-generated`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway pacfiles create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/pacfiles`,pathParams:{},bodyKind:`json`,body:{contents:n.contents,description:n.description,name:n.name,slug:n.slug,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating pacfile`,async()=>i.post(`/accounts/${o}/gateway/pacfiles`,{body:e})),{successLabel:`Created pacfile`});return}n.contents===void 0&&(n.contents=await t(`contents`,`Actual contents of the PAC file`)),n.name===void 0&&(n.name=await t(`name`,`Name of the PAC file.`));let h={};n.contents!==void 0&&l(h,[`contents`],s(n.contents,`contents`,`text`)),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.slug!==void 0&&l(h,[`slug`],s(n.slug,`slug`,`text`)),d(await m(`Creating pacfile`,async()=>i.post(`/accounts/${o}/gateway/pacfiles`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created pacfile`})}},js={command:`delete <pacfileId>`,describe:`Delete a configured Zero Trust Gateway PAC file.`,builder:e=>e.positional(`pacfileId`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.pacfileId,`pacfileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway pacfiles delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/pacfiles/${t.pacfileId??`<pacfileId>`}`,pathParams:{pacfileId:String(t.pacfileId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`pacfile`,String(t.pacfileId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting pacfile`,async()=>n.zeroTrust.gateway.pacfiles.delete(t.pacfileId,o)),{successLabel:`Deleted pacfile`})}},Ms={command:`get <pacfileId>`,describe:`Get a single Zero Trust Gateway PAC file.`,builder:e=>e.positional(`pacfileId`,{type:`string`,description:`Pacfile ID`,demandOption:!0}),handler:async e=>{c(e.pacfileId,`pacfileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading pacfile`,async()=>t.zeroTrust.gateway.pacfiles.get(e.pacfileId,n)),{successLabel:`Loaded pacfile`})}},Ns={command:`list`,describe:`List all Zero Trust Gateway PAC files for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading pacfiles`,async()=>t.zeroTrust.gateway.pacfiles.list(n)),{successLabel:`Loaded pacfiles`})}},Ps={command:`update <pacfileId>`,describe:`Update a configured Zero Trust Gateway PAC file.`,builder:e=>e.positional(`pacfileId`,{type:`string`,description:`Pacfile ID`,demandOption:!0}).option(`contents`,{type:`string`,description:`Actual contents of the PAC file`}).option(`description`,{type:`string`,description:`Detailed description of the PAC file.`}).option(`name`,{type:`string`,description:`Name of the PAC file.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.pacfileId,`pacfileId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway pacfiles update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/pacfiles/${n.pacfileId??`<pacfileId>`}`,pathParams:{pacfileId:String(n.pacfileId??``)},bodyKind:`json`,body:{contents:n.contents,description:n.description,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating pacfile`,async()=>i.put(`/accounts/${o}/gateway/pacfiles/${n.pacfileId}`,{body:e})),{successLabel:`Updated pacfile`});return}n.contents===void 0&&(n.contents=await t(`contents`,`Actual contents of the PAC file`)),n.description===void 0&&(n.description=await t(`description`,`Detailed description of the PAC file.`)),n.name===void 0&&(n.name=await t(`name`,`Name of the PAC file.`));let h={};n.contents!==void 0&&l(h,[`contents`],s(n.contents,`contents`,`text`)),n.description!==void 0&&l(h,[`description`],s(n.description,`description`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Updating pacfile`,async()=>i.put(`/accounts/${o}/gateway/pacfiles/${n.pacfileId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated pacfile`})}},Fs={command:`pacfiles`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(As).command(js).command(Ms).command(Ns).command(Ps).demandCommand(1),handler:()=>{}},Is={command:`create`,describe:`Create a new Zero Trust Gateway proxy endpoint.`,builder:e=>e.option(`kind`,{type:`string`,description:`The proxy endpoint kind.`,choices:[`ip`,`identity`],default:`ip`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway proxy-endpoints create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/proxy_endpoints`,pathParams:{},bodyKind:`json`,body:{kind:n.kind,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating proxy endpoint`,async()=>i.post(`/accounts/${o}/gateway/proxy_endpoints`,{body:e})),{successLabel:`Created proxy endpoint`});return}n.kind===`identity`&&n.kind===void 0&&(n.kind=await t(`kind`,`The proxy endpoint kind.`,{question:`Enter value for --kind`}));let h={};n.kind!==void 0&&l(h,[`kind`],s(n.kind,`kind`,`text`)),d(await m(`Creating proxy endpoint`,async()=>i.post(`/accounts/${o}/gateway/proxy_endpoints`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created proxy endpoint`})}},Ls={command:`delete <proxyEndpointId>`,describe:`Delete a configured Zero Trust Gateway proxy endpoint.`,builder:e=>e.positional(`proxyEndpointId`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.proxyEndpointId,`proxyEndpointId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway proxy-endpoints delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/proxy_endpoints/${t.proxyEndpointId??`<proxyEndpointId>`}`,pathParams:{proxyEndpointId:String(t.proxyEndpointId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`proxy endpoint`,String(t.proxyEndpointId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting proxy endpoint`,async()=>n.delete(`/accounts/${o}/gateway/proxy_endpoints/${t.proxyEndpointId}`,{body:e})),{successLabel:`Deleted proxy endpoint`});return}d(await m(`Deleting proxy endpoint`,async()=>n.zeroTrust.gateway.proxyEndpoints.delete(t.proxyEndpointId,o)),{successLabel:`Deleted proxy endpoint`})}},Rs={command:`edit <proxyEndpointId>`,describe:`Update a configured Zero Trust Gateway proxy endpoint.`,builder:e=>e.positional(`proxyEndpointId`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}).option(`ips`,{type:`string`,array:!0,description:`Specify the list of CIDRs to restrict ingress connections.`}).option(`name`,{type:`string`,description:`Specify the name of the proxy endpoint.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.proxyEndpointId,`proxyEndpointId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway proxy-endpoints edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/proxy_endpoints/${t.proxyEndpointId??`<proxyEndpointId>`}`,pathParams:{proxyEndpointId:String(t.proxyEndpointId??``)},bodyKind:`json`,body:{ips:t.ips,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating proxy endpoint`,async()=>n.patch(`/accounts/${i}/gateway/proxy_endpoints/${t.proxyEndpointId}`,{body:e})),{successLabel:`Updated proxy endpoint`});return}let o={};t.ips!==void 0&&l(o,[`ips`],t.ips),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating proxy endpoint`,async()=>n.patch(`/accounts/${i}/gateway/proxy_endpoints/${t.proxyEndpointId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated proxy endpoint`})}},zs={command:`get <proxyEndpointId>`,describe:`Get a single Zero Trust Gateway proxy endpoint.`,builder:e=>e.positional(`proxyEndpointId`,{type:`string`,description:`Proxy endpoint ID`,demandOption:!0}),handler:async e=>{c(e.proxyEndpointId,`proxyEndpointId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading proxy endpoint`,async()=>t.zeroTrust.gateway.proxyEndpoints.get(e.proxyEndpointId,n)),{successLabel:`Loaded proxy endpoint`})}},Bs={command:`list`,describe:`List all Zero Trust Gateway proxy endpoints for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading proxy endpoints`,async()=>t.zeroTrust.gateway.proxyEndpoints.list(n)),{successLabel:`Loaded proxy endpoints`})}},Vs={command:`proxy-endpoints`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Is).command(Ls).command(Rs).command(zs).command(Bs).demandCommand(1),handler:()=>{}},Hs={command:`create`,describe:`Create a new Zero Trust Gateway rule.`,builder:e=>e.option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-egress-ipv4.rule-settings-egress-ipv4fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway rules create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/rules`,pathParams:{},bodyKind:`json`,body:{action:i.action,description:i.description,devicePosture:i.devicePosture,enabled:i.enabled,expirationDuration:i.expirationDuration,filters:i.filters,identity:i.identity,name:i.name,precedence:i.precedence,ruleSettingsAllowChildBypass:i.ruleSettingsAllowChildBypass,ruleSettingsAuditSshCommandLogging:i.ruleSettingsAuditSshCommandLogging,ruleSettingsBisoAdminControlsCopy:i.ruleSettingsBisoAdminControlsCopy,ruleSettingsBisoAdminControlsDcp:i.ruleSettingsBisoAdminControlsDcp,ruleSettingsBisoAdminControlsDd:i.ruleSettingsBisoAdminControlsDd,ruleSettingsBisoAdminControlsDk:i.ruleSettingsBisoAdminControlsDk,ruleSettingsBisoAdminControlsDownload:i.ruleSettingsBisoAdminControlsDownload,ruleSettingsBisoAdminControlsDp:i.ruleSettingsBisoAdminControlsDp,ruleSettingsBisoAdminControlsDu:i.ruleSettingsBisoAdminControlsDu,ruleSettingsBisoAdminControlsKeyboard:i.ruleSettingsBisoAdminControlsKeyboard,ruleSettingsBisoAdminControlsPaste:i.ruleSettingsBisoAdminControlsPaste,ruleSettingsBisoAdminControlsPrinting:i.ruleSettingsBisoAdminControlsPrinting,ruleSettingsBisoAdminControlsUpload:i.ruleSettingsBisoAdminControlsUpload,ruleSettingsBisoAdminControlsVersion:i.ruleSettingsBisoAdminControlsVersion,ruleSettingsBisoAdminControlsWmId:i.ruleSettingsBisoAdminControlsWmId,ruleSettingsBlockPageIncludeContext:i.ruleSettingsBlockPageIncludeContext,ruleSettingsBlockPageTargetUri:i.ruleSettingsBlockPageTargetUri,ruleSettingsBlockPageEnabled:i.ruleSettingsBlockPageEnabled,ruleSettingsBlockReason:i.ruleSettingsBlockReason,ruleSettingsBypassParentRule:i.ruleSettingsBypassParentRule,ruleSettingsCheckSessionDuration:i.ruleSettingsCheckSessionDuration,ruleSettingsCheckSessionEnforce:i.ruleSettingsCheckSessionEnforce,ruleSettingsEgressIpv4:i.ruleSettingsEgressIpv4,ruleSettingsEgressIpv4Fallback:i.ruleSettingsEgressIpv4Fallback,ruleSettingsEgressIpv6:i.ruleSettingsEgressIpv6,ruleSettingsForensicCopyEnabled:i.ruleSettingsForensicCopyEnabled,ruleSettingsIgnoreCnameCategoryMatches:i.ruleSettingsIgnoreCnameCategoryMatches,ruleSettingsInsecureDisableDnssecValidation:i.ruleSettingsInsecureDisableDnssecValidation,ruleSettingsIpCategories:i.ruleSettingsIpCategories,ruleSettingsIpIndicatorFeeds:i.ruleSettingsIpIndicatorFeeds,ruleSettingsL4overrideIp:i.ruleSettingsL4overrideIp,ruleSettingsL4overridePort:i.ruleSettingsL4overridePort,ruleSettingsNotificationSettingsEnabled:i.ruleSettingsNotificationSettingsEnabled,ruleSettingsNotificationSettingsIncludeContext:i.ruleSettingsNotificationSettingsIncludeContext,ruleSettingsNotificationSettingsMsg:i.ruleSettingsNotificationSettingsMsg,ruleSettingsNotificationSettingsSupportUrl:i.ruleSettingsNotificationSettingsSupportUrl,ruleSettingsOverrideHost:i.ruleSettingsOverrideHost,ruleSettingsOverrideIps:i.ruleSettingsOverrideIps,ruleSettingsPayloadLogEnabled:i.ruleSettingsPayloadLogEnabled,ruleSettingsQuarantineFileTypes:i.ruleSettingsQuarantineFileTypes,ruleSettingsRedirectIncludeContext:i.ruleSettingsRedirectIncludeContext,ruleSettingsRedirectPreservePathAndQuery:i.ruleSettingsRedirectPreservePathAndQuery,ruleSettingsRedirectTargetUri:i.ruleSettingsRedirectTargetUri,ruleSettingsResolveDnsInternallyFallback:i.ruleSettingsResolveDnsInternallyFallback,ruleSettingsResolveDnsInternallyViewId:i.ruleSettingsResolveDnsInternallyViewId,ruleSettingsResolveDnsThroughCloudflare:i.ruleSettingsResolveDnsThroughCloudflare,ruleSettingsUntrustedCertAction:i.ruleSettingsUntrustedCertAction,scheduleFri:i.scheduleFri,scheduleMon:i.scheduleMon,scheduleSat:i.scheduleSat,scheduleSun:i.scheduleSun,scheduleThu:i.scheduleThu,scheduleTimeZone:i.scheduleTimeZone,scheduleTue:i.scheduleTue,scheduleWed:i.scheduleWed,traffic:i.traffic,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating rule`,async()=>o.post(`/accounts/${h}/gateway/rules`,{body:e})),{successLabel:`Created rule`});return}i.action===void 0&&(i.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),i.name===void 0&&(i.name=await t(`name`,`Specify the rule name.`));let g={};i.action!==void 0&&l(g,[`action`],s(i.action,`action`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.devicePosture!==void 0&&l(g,[`device_posture`],s(i.devicePosture,`devicePosture`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.expirationDuration!==void 0&&l(g,[`expiration`,`duration`],i.expirationDuration),i.filters!==void 0&&l(g,[`filters`],i.filters),i.identity!==void 0&&l(g,[`identity`],s(i.identity,`identity`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.precedence!==void 0&&l(g,[`precedence`],i.precedence),i.ruleSettingsAllowChildBypass!==void 0&&l(g,[`rule_settings`,`allow_child_bypass`],i.ruleSettingsAllowChildBypass),i.ruleSettingsAuditSshCommandLogging!==void 0&&l(g,[`rule_settings`,`audit_ssh`,`command_logging`],i.ruleSettingsAuditSshCommandLogging),i.ruleSettingsBisoAdminControlsCopy!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`copy`],s(i.ruleSettingsBisoAdminControlsCopy,`ruleSettingsBisoAdminControlsCopy`,`text`)),i.ruleSettingsBisoAdminControlsDcp!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dcp`],i.ruleSettingsBisoAdminControlsDcp),i.ruleSettingsBisoAdminControlsDd!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dd`],i.ruleSettingsBisoAdminControlsDd),i.ruleSettingsBisoAdminControlsDk!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dk`],i.ruleSettingsBisoAdminControlsDk),i.ruleSettingsBisoAdminControlsDownload!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`download`],s(i.ruleSettingsBisoAdminControlsDownload,`ruleSettingsBisoAdminControlsDownload`,`text`)),i.ruleSettingsBisoAdminControlsDp!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dp`],i.ruleSettingsBisoAdminControlsDp),i.ruleSettingsBisoAdminControlsDu!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`du`],i.ruleSettingsBisoAdminControlsDu),i.ruleSettingsBisoAdminControlsKeyboard!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`keyboard`],s(i.ruleSettingsBisoAdminControlsKeyboard,`ruleSettingsBisoAdminControlsKeyboard`,`text`)),i.ruleSettingsBisoAdminControlsPaste!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`paste`],s(i.ruleSettingsBisoAdminControlsPaste,`ruleSettingsBisoAdminControlsPaste`,`text`)),i.ruleSettingsBisoAdminControlsPrinting!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`printing`],s(i.ruleSettingsBisoAdminControlsPrinting,`ruleSettingsBisoAdminControlsPrinting`,`text`)),i.ruleSettingsBisoAdminControlsUpload!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`upload`],s(i.ruleSettingsBisoAdminControlsUpload,`ruleSettingsBisoAdminControlsUpload`,`text`)),i.ruleSettingsBisoAdminControlsVersion!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`version`],s(i.ruleSettingsBisoAdminControlsVersion,`ruleSettingsBisoAdminControlsVersion`,`text`)),i.ruleSettingsBisoAdminControlsWmId!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`wm_id`],s(i.ruleSettingsBisoAdminControlsWmId,`ruleSettingsBisoAdminControlsWmId`,`text`)),i.ruleSettingsBlockPageIncludeContext!==void 0&&l(g,[`rule_settings`,`block_page`,`include_context`],i.ruleSettingsBlockPageIncludeContext),i.ruleSettingsBlockPageTargetUri!==void 0&&l(g,[`rule_settings`,`block_page`,`target_uri`],s(i.ruleSettingsBlockPageTargetUri,`ruleSettingsBlockPageTargetUri`,`text`)),i.ruleSettingsBlockPageEnabled!==void 0&&l(g,[`rule_settings`,`block_page_enabled`],i.ruleSettingsBlockPageEnabled),i.ruleSettingsBlockReason!==void 0&&l(g,[`rule_settings`,`block_reason`],s(i.ruleSettingsBlockReason,`ruleSettingsBlockReason`,`text`)),i.ruleSettingsBypassParentRule!==void 0&&l(g,[`rule_settings`,`bypass_parent_rule`],i.ruleSettingsBypassParentRule),i.ruleSettingsCheckSessionDuration!==void 0&&l(g,[`rule_settings`,`check_session`,`duration`],s(i.ruleSettingsCheckSessionDuration,`ruleSettingsCheckSessionDuration`,`text`)),i.ruleSettingsCheckSessionEnforce!==void 0&&l(g,[`rule_settings`,`check_session`,`enforce`],i.ruleSettingsCheckSessionEnforce),i.ruleSettingsEgressIpv4!==void 0&&l(g,[`rule_settings`,`egress`,`ipv4`],s(i.ruleSettingsEgressIpv4,`ruleSettingsEgressIpv4`,`text`)),i.ruleSettingsEgressIpv4Fallback!==void 0&&l(g,[`rule_settings`,`egress`,`ipv4_fallback`],s(i.ruleSettingsEgressIpv4Fallback,`ruleSettingsEgressIpv4Fallback`,`text`)),i.ruleSettingsEgressIpv6!==void 0&&l(g,[`rule_settings`,`egress`,`ipv6`],s(i.ruleSettingsEgressIpv6,`ruleSettingsEgressIpv6`,`text`)),i.ruleSettingsForensicCopyEnabled!==void 0&&l(g,[`rule_settings`,`forensic_copy`,`enabled`],i.ruleSettingsForensicCopyEnabled),i.ruleSettingsIgnoreCnameCategoryMatches!==void 0&&l(g,[`rule_settings`,`ignore_cname_category_matches`],i.ruleSettingsIgnoreCnameCategoryMatches),i.ruleSettingsInsecureDisableDnssecValidation!==void 0&&l(g,[`rule_settings`,`insecure_disable_dnssec_validation`],i.ruleSettingsInsecureDisableDnssecValidation),i.ruleSettingsIpCategories!==void 0&&l(g,[`rule_settings`,`ip_categories`],i.ruleSettingsIpCategories),i.ruleSettingsIpIndicatorFeeds!==void 0&&l(g,[`rule_settings`,`ip_indicator_feeds`],i.ruleSettingsIpIndicatorFeeds),i.ruleSettingsL4overrideIp!==void 0&&l(g,[`rule_settings`,`l4override`,`ip`],s(i.ruleSettingsL4overrideIp,`ruleSettingsL4overrideIp`,`text`)),i.ruleSettingsL4overridePort!==void 0&&l(g,[`rule_settings`,`l4override`,`port`],i.ruleSettingsL4overridePort),i.ruleSettingsNotificationSettingsEnabled!==void 0&&l(g,[`rule_settings`,`notification_settings`,`enabled`],i.ruleSettingsNotificationSettingsEnabled),i.ruleSettingsNotificationSettingsIncludeContext!==void 0&&l(g,[`rule_settings`,`notification_settings`,`include_context`],i.ruleSettingsNotificationSettingsIncludeContext),i.ruleSettingsNotificationSettingsMsg!==void 0&&l(g,[`rule_settings`,`notification_settings`,`msg`],s(i.ruleSettingsNotificationSettingsMsg,`ruleSettingsNotificationSettingsMsg`,`text`)),i.ruleSettingsNotificationSettingsSupportUrl!==void 0&&l(g,[`rule_settings`,`notification_settings`,`support_url`],s(i.ruleSettingsNotificationSettingsSupportUrl,`ruleSettingsNotificationSettingsSupportUrl`,`text`)),i.ruleSettingsOverrideHost!==void 0&&l(g,[`rule_settings`,`override_host`],s(i.ruleSettingsOverrideHost,`ruleSettingsOverrideHost`,`text`)),i.ruleSettingsOverrideIps!==void 0&&l(g,[`rule_settings`,`override_ips`],i.ruleSettingsOverrideIps),i.ruleSettingsPayloadLogEnabled!==void 0&&l(g,[`rule_settings`,`payload_log`,`enabled`],i.ruleSettingsPayloadLogEnabled),i.ruleSettingsQuarantineFileTypes!==void 0&&l(g,[`rule_settings`,`quarantine`,`file_types`],i.ruleSettingsQuarantineFileTypes),i.ruleSettingsRedirectIncludeContext!==void 0&&l(g,[`rule_settings`,`redirect`,`include_context`],i.ruleSettingsRedirectIncludeContext),i.ruleSettingsRedirectPreservePathAndQuery!==void 0&&l(g,[`rule_settings`,`redirect`,`preserve_path_and_query`],i.ruleSettingsRedirectPreservePathAndQuery),i.ruleSettingsRedirectTargetUri!==void 0&&l(g,[`rule_settings`,`redirect`,`target_uri`],s(i.ruleSettingsRedirectTargetUri,`ruleSettingsRedirectTargetUri`,`text`)),i.ruleSettingsResolveDnsInternallyFallback!==void 0&&l(g,[`rule_settings`,`resolve_dns_internally`,`fallback`],s(i.ruleSettingsResolveDnsInternallyFallback,`ruleSettingsResolveDnsInternallyFallback`,`text`)),i.ruleSettingsResolveDnsInternallyViewId!==void 0&&l(g,[`rule_settings`,`resolve_dns_internally`,`view_id`],s(i.ruleSettingsResolveDnsInternallyViewId,`ruleSettingsResolveDnsInternallyViewId`,`text`)),i.ruleSettingsResolveDnsThroughCloudflare!==void 0&&l(g,[`rule_settings`,`resolve_dns_through_cloudflare`],i.ruleSettingsResolveDnsThroughCloudflare),i.ruleSettingsUntrustedCertAction!==void 0&&l(g,[`rule_settings`,`untrusted_cert`,`action`],s(i.ruleSettingsUntrustedCertAction,`ruleSettingsUntrustedCertAction`,`text`)),i.scheduleFri!==void 0&&l(g,[`schedule`,`fri`],s(i.scheduleFri,`scheduleFri`,`text`)),i.scheduleMon!==void 0&&l(g,[`schedule`,`mon`],s(i.scheduleMon,`scheduleMon`,`text`)),i.scheduleSat!==void 0&&l(g,[`schedule`,`sat`],s(i.scheduleSat,`scheduleSat`,`text`)),i.scheduleSun!==void 0&&l(g,[`schedule`,`sun`],s(i.scheduleSun,`scheduleSun`,`text`)),i.scheduleThu!==void 0&&l(g,[`schedule`,`thu`],s(i.scheduleThu,`scheduleThu`,`text`)),i.scheduleTimeZone!==void 0&&l(g,[`schedule`,`time_zone`],s(i.scheduleTimeZone,`scheduleTimeZone`,`text`)),i.scheduleTue!==void 0&&l(g,[`schedule`,`tue`],s(i.scheduleTue,`scheduleTue`,`text`)),i.scheduleWed!==void 0&&l(g,[`schedule`,`wed`],s(i.scheduleWed,`scheduleWed`,`text`)),i.traffic!==void 0&&l(g,[`traffic`],s(i.traffic,`traffic`,`text`)),d(await m(`Creating rule`,async()=>o.post(`/accounts/${h}/gateway/rules`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created rule`})}},Us={command:`delete <ruleId>`,describe:`Delete a Zero Trust Gateway rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway rules delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/rules/${t.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`rule`,String(t.ruleId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting rule`,async()=>n.delete(`/accounts/${o}/gateway/rules/${t.ruleId}`,{body:e})),{successLabel:`Deleted rule`});return}d(await m(`Deleting rule`,async()=>n.zeroTrust.gateway.rules.delete(t.ruleId,o)),{successLabel:`Deleted rule`})}},Ws={command:`get <ruleId>`,describe:`Get a single Zero Trust Gateway rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}),handler:async e=>{c(e.ruleId,`ruleId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rule`,async()=>t.zeroTrust.gateway.rules.get(e.ruleId,n)),{successLabel:`Loaded rule`})}},Gs={command:`list-tenant`,describe:`List Zero Trust Gateway rules for the parent account of an account in the MSP configuration.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rule`,async()=>t.zeroTrust.gateway.rules.listTenant(n)),{successLabel:`Loaded rule`})}},Ks={command:`list`,describe:`List Zero Trust Gateway rules for an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading rules`,async()=>t.zeroTrust.gateway.rules.list(n)),{successLabel:`Loaded rules`})}},qs={command:`reset-expiration <ruleId>`,describe:"Resets the expiration of a Zero Trust Gateway Rule if its duration elapsed and it has a default duration. The Zero Trust Gateway Rule must have values for both `expiration.expires_at` and `expiration.duration`.",builder:e=>e.positional(`ruleId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.ruleId,`ruleId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust gateway rules reset-expiration`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/gateway/rules/${t.ruleId??`<ruleId>`}/reset_expiration`,pathParams:{ruleId:String(t.ruleId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Creating rule`,async()=>n.zeroTrust.gateway.rules.resetExpiration(t.ruleId,i)),{successLabel:`Created rule`})}},Js={command:`update <ruleId>`,describe:`Update a configured Zero Trust Gateway rule.`,builder:e=>e.positional(`ruleId`,{type:`string`,description:`Identify the API resource with a UUID.`,demandOption:!0}).option(`action`,{type:`string`,description:"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",choices:[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`]}).option(`description`,{type:`string`,description:`Specify the rule description.`}).option(`device-posture`,{type:`string`,description:`Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`enabled`,{type:`boolean`,description:`Specify whether the rule is enabled.`,default:!1}).option(`expiration-duration`,{type:`number`,description:"Defines the default duration a policy active in minutes. Must set in order to use the `reset_expiration` endpoint on this rule."}).option(`filters`,{type:`string`,array:!0,description:`Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.`}).option(`identity`,{type:`string`,description:`Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`name`,{type:`string`,description:`Specify the rule name.`}).option(`precedence`,{type:`number`,description:`Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to [Order of enforcement](http://developers.cloudflare.com/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/#manage-precedence-with-terraform) to manage precedence via Terraform.`}).option(`rule-settings-allow-child-bypass`,{type:`boolean`,description:`Set to enable MSP children to bypass this rule. Only parent MSP accounts can set this. this rule. Settable for all types of rules.`}).option(`rule-settings-audit-ssh-command-logging`,{type:`boolean`,description:`Enable SSH command logging.`}).option(`rule-settings-biso-admin-controls-copy`,{type:`string`,description:`Configure copy behavior. If set to remote_only, users cannot copy isolated content from the remote browser to the local clipboard. If this field is absent, copying remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dcp`,{type:`boolean`,description:'Set to false to enable copy-pasting. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dd`,{type:`boolean`,description:'Set to false to enable downloading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-dk`,{type:`boolean`,description:'Set to false to enable keyboard usage. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-download`,{type:`string`,description:`Configure download behavior. When set to remote_only, users can view downloads but cannot save them. If this field is absent, downloading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-dp`,{type:`boolean`,description:'Set to false to enable printing. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-du`,{type:`boolean`,description:'Set to false to enable uploading. Only applies when `version == "v1"`.'}).option(`rule-settings-biso-admin-controls-keyboard`,{type:`string`,description:`Configure keyboard usage behavior. If this field is absent, keyboard usage remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-paste`,{type:`string`,description:`Configure paste behavior. If set to remote_only, users cannot paste content from the local clipboard into isolated pages. If this field is absent, pasting remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`,`remote_only`]}).option(`rule-settings-biso-admin-controls-printing`,{type:`string`,description:`Configure print behavior. Default, Printing is enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-upload`,{type:`string`,description:`Configure upload behavior. If this field is absent, uploading remains enabled. Applies only when version == "v2".`,choices:[`enabled`,`disabled`]}).option(`rule-settings-biso-admin-controls-version`,{type:`string`,description:`Indicate which version of the browser isolation controls should apply.`,choices:[`v1`,`v2`],default:`v1`}).option(`rule-settings-biso-admin-controls-wm-id`,{type:`string`,description:`Specify the watermark ID (UUID) to apply to the isolated browser session. When present, enables watermark rendering in the isolated browser.`}).option(`rule-settings-block-page-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-block-page-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-block-page-enabled`,{type:`boolean`,description:"Enable the custom block page. Settable only for `dns` rules with action `block`."}).option(`rule-settings-block-reason`,{type:`string`,description:"Explain why the rule blocks the request. The custom block page shows this text (if enabled). Settable only for `dns`, `l4`, and `http` rules when the action set to `block`."}).option(`rule-settings-bypass-parent-rule`,{type:`boolean`,description:`Set to enable MSP accounts to bypass their parent's rules. Only MSP child accounts can set this. Settable for all types of rules.`}).option(`rule-settings-check-session-duration`,{type:`string`,description:`Sets the required session freshness threshold. The API returns a normalized version of this value.`}).option(`rule-settings-check-session-enforce`,{type:`boolean`,description:`Enable session enforcement.`}).option(`rule-settings-egress-ipv4`,{type:`string`,description:`Specify the IPv4 address to use for egress.`}).option(`rule-settings-egress-ipv4-fallback`,{type:`string`,description:`Specify the fallback IPv4 address to use for egress when the primary IPv4 fails. Set '0.0.0.0' to indicate local egress via WARP IPs.`}).option(`rule-settings-egress-ipv6`,{type:`string`,description:`Specify the IPv6 range to use for egress.`}).option(`rule-settings-forensic-copy-enabled`,{type:`boolean`,description:`Enable sending the copy to storage.`}).option(`rule-settings-ignore-cname-category-matches`,{type:`boolean`,description:"Ignore category matches at CNAME domains in a response. When off, evaluate categories in this rule against all CNAME domain categories in the response. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-insecure-disable-dnssec-validation`,{type:`boolean`,description:"Specify whether to disable DNSSEC validation (for Allow actions) [INSECURE]. Settable only for `dns` rules."}).option(`rule-settings-ip-categories`,{type:`boolean`,description:"Enable IPs in DNS resolver category blocks. The system blocks only domain name categories unless you enable this setting. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-ip-indicator-feeds`,{type:`boolean`,description:"Indicates whether to include IPs in DNS resolver indicator feed blocks. Default, indicator feeds block only domain names. Settable only for `dns` and `dns_resolver` rules."}).option(`rule-settings-l4override-ip`,{type:`string`,description:`Defines the IPv4 or IPv6 address.`}).option(`rule-settings-l4override-port`,{type:`number`,description:`Defines a port number to use for TCP/UDP overrides.`}).option(`rule-settings-notification-settings-enabled`,{type:`boolean`,description:`Enable notification.`}).option(`rule-settings-notification-settings-include-context`,{type:`boolean`,description:`Indicates whether to pass the context information as query parameters.`}).option(`rule-settings-notification-settings-msg`,{type:`string`,description:`Customize the message shown in the notification.`}).option(`rule-settings-notification-settings-support-url`,{type:`string`,description:`Defines an optional URL to direct users to additional information. If unset, the notification opens a block page.`}).option(`rule-settings-override-host`,{type:`string`,description:"Defines a hostname for override, for the matching DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-override-ips`,{type:`string`,array:!0,description:"Defines a an IP or set of IPs for overriding matched DNS queries. Settable only for `dns` rules with the action set to `override`."}).option(`rule-settings-payload-log-enabled`,{type:`boolean`,description:`Enable DLP payload logging for this rule.`}).option(`rule-settings-quarantine-file-types`,{type:`string`,array:!0,description:`Specify the types of files to sandbox.`}).option(`rule-settings-redirect-include-context`,{type:`boolean`,description:`Specify whether to pass the context information as query parameters.`}).option(`rule-settings-redirect-preserve-path-and-query`,{type:`boolean`,description:`Specify whether to append the path and query parameters from the original request to target_uri.`}).option(`rule-settings-redirect-target-uri`,{type:`string`,description:`Specify the URI to which the user is redirected.`}).option(`rule-settings-resolve-dns-internally-fallback`,{type:`string`,description:`Specify the fallback behavior to apply when the internal DNS response code differs from 'NOERROR' or when the response data contains only CNAME records for 'A' or 'AAAA' queries.`,choices:[`none`,`public_dns`]}).option(`rule-settings-resolve-dns-internally-view-id`,{type:`string`,description:`Specify the internal DNS view identifier to pass to the internal DNS service.`}).option(`rule-settings-resolve-dns-through-cloudflare`,{type:`boolean`,description:"Enable to send queries that match the policy to Cloudflare's default 1.1.1.1 DNS resolver. Cannot set when 'dns_resolvers' specified or 'resolve_dns_internally' is set. Only valid when a rule's action set to 'resolve'. Settable only for `dns_resolver` rules."}).option(`rule-settings-untrusted-cert-action`,{type:`string`,description:`Defines the action performed when an untrusted certificate seen. The default action an error with HTTP code 526.`,choices:[`pass_through`,`block`,`error`]}).option(`schedule-fri`,{type:`string`,description:`Specify the time intervals when the rule is active on Fridays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Fridays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-mon`,{type:`string`,description:`Specify the time intervals when the rule is active on Mondays, in the increasing order from 00:00-24:00(capped at maximum of 6 time splits). If this parameter omitted, the rule is deactivated on Mondays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sat`,{type:`string`,description:`Specify the time intervals when the rule is active on Saturdays, in the increasing order from 00:00-24:00.  If this parameter omitted, the rule is deactivated on Saturdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-sun`,{type:`string`,description:`Specify the time intervals when the rule is active on Sundays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Sundays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-thu`,{type:`string`,description:`Specify the time intervals when the rule is active on Thursdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Thursdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-time-zone`,{type:`string`,description:`Specify the time zone for rule evaluation. When a [valid time zone city name](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List) is provided, Gateway always uses the current time for that time zone. When this parameter is omitted, Gateway uses the time zone determined from the user's IP address. Colo time zone is used when the user's IP address does not resolve to a location.`}).option(`schedule-tue`,{type:`string`,description:`Specify the time intervals when the rule is active on Tuesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Tuesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`schedule-wed`,{type:`string`,description:`Specify the time intervals when the rule is active on Wednesdays, in the increasing order from 00:00-24:00. If this parameter omitted, the rule is deactivated on Wednesdays. API returns a formatted version of this string, which may cause Terraform drift if a unformatted value is used.`}).option(`traffic`,{type:`string`,description:`Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.`,default:``}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if(`rule-settings-allow-child-bypass.rule-settings-audit-ssh-command-logging.rule-settings-biso-admin-controls-copy.rule-settings-biso-admin-controls-dcp.rule-settings-biso-admin-controls-dd.rule-settings-biso-admin-controls-dk.rule-settings-biso-admin-controls-download.rule-settings-biso-admin-controls-dp.rule-settings-biso-admin-controls-du.rule-settings-biso-admin-controls-keyboard.rule-settings-biso-admin-controls-paste.rule-settings-biso-admin-controls-printing.rule-settings-biso-admin-controls-upload.rule-settings-biso-admin-controls-wm-id.rule-settings-block-page-include-context.rule-settings-block-page-target-uri.rule-settings-block-page-enabled.rule-settings-block-reason.rule-settings-bypass-parent-rule.rule-settings-check-session-duration.rule-settings-check-session-enforce.rule-settings-egress-ipv4.rule-settings-egress-ipv4fallback.rule-settings-egress-ipv6.rule-settings-forensic-copy-enabled.rule-settings-ignore-cname-category-matches.rule-settings-insecure-disable-dnssec-validation.rule-settings-ip-categories.rule-settings-ip-indicator-feeds.rule-settings-l4override-ip.rule-settings-l4override-port.rule-settings-notification-settings-enabled.rule-settings-notification-settings-include-context.rule-settings-notification-settings-msg.rule-settings-notification-settings-support-url.rule-settings-override-host.rule-settings-override-ips.rule-settings-payload-log-enabled.rule-settings-quarantine-file-types.rule-settings-redirect-include-context.rule-settings-redirect-preserve-path-and-query.rule-settings-redirect-target-uri.rule-settings-resolve-dns-internally-fallback.rule-settings-resolve-dns-internally-view-id.rule-settings-resolve-dns-through-cloudflare.rule-settings-untrusted-cert-action`.split(`.`).some(t=>e[t]!==void 0)){let t=[`rule-settings-block-page-target-uri`,`rule-settings-redirect-target-uri`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --rule_settings-* flag is set`)}return!0}),handler:async i=>{if(c(i.ruleId,`ruleId`),i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust gateway rules update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/gateway/rules/${i.ruleId??`<ruleId>`}`,pathParams:{ruleId:String(i.ruleId??``)},bodyKind:`json`,body:{action:i.action,description:i.description,devicePosture:i.devicePosture,enabled:i.enabled,expirationDuration:i.expirationDuration,filters:i.filters,identity:i.identity,name:i.name,precedence:i.precedence,ruleSettingsAllowChildBypass:i.ruleSettingsAllowChildBypass,ruleSettingsAuditSshCommandLogging:i.ruleSettingsAuditSshCommandLogging,ruleSettingsBisoAdminControlsCopy:i.ruleSettingsBisoAdminControlsCopy,ruleSettingsBisoAdminControlsDcp:i.ruleSettingsBisoAdminControlsDcp,ruleSettingsBisoAdminControlsDd:i.ruleSettingsBisoAdminControlsDd,ruleSettingsBisoAdminControlsDk:i.ruleSettingsBisoAdminControlsDk,ruleSettingsBisoAdminControlsDownload:i.ruleSettingsBisoAdminControlsDownload,ruleSettingsBisoAdminControlsDp:i.ruleSettingsBisoAdminControlsDp,ruleSettingsBisoAdminControlsDu:i.ruleSettingsBisoAdminControlsDu,ruleSettingsBisoAdminControlsKeyboard:i.ruleSettingsBisoAdminControlsKeyboard,ruleSettingsBisoAdminControlsPaste:i.ruleSettingsBisoAdminControlsPaste,ruleSettingsBisoAdminControlsPrinting:i.ruleSettingsBisoAdminControlsPrinting,ruleSettingsBisoAdminControlsUpload:i.ruleSettingsBisoAdminControlsUpload,ruleSettingsBisoAdminControlsVersion:i.ruleSettingsBisoAdminControlsVersion,ruleSettingsBisoAdminControlsWmId:i.ruleSettingsBisoAdminControlsWmId,ruleSettingsBlockPageIncludeContext:i.ruleSettingsBlockPageIncludeContext,ruleSettingsBlockPageTargetUri:i.ruleSettingsBlockPageTargetUri,ruleSettingsBlockPageEnabled:i.ruleSettingsBlockPageEnabled,ruleSettingsBlockReason:i.ruleSettingsBlockReason,ruleSettingsBypassParentRule:i.ruleSettingsBypassParentRule,ruleSettingsCheckSessionDuration:i.ruleSettingsCheckSessionDuration,ruleSettingsCheckSessionEnforce:i.ruleSettingsCheckSessionEnforce,ruleSettingsEgressIpv4:i.ruleSettingsEgressIpv4,ruleSettingsEgressIpv4Fallback:i.ruleSettingsEgressIpv4Fallback,ruleSettingsEgressIpv6:i.ruleSettingsEgressIpv6,ruleSettingsForensicCopyEnabled:i.ruleSettingsForensicCopyEnabled,ruleSettingsIgnoreCnameCategoryMatches:i.ruleSettingsIgnoreCnameCategoryMatches,ruleSettingsInsecureDisableDnssecValidation:i.ruleSettingsInsecureDisableDnssecValidation,ruleSettingsIpCategories:i.ruleSettingsIpCategories,ruleSettingsIpIndicatorFeeds:i.ruleSettingsIpIndicatorFeeds,ruleSettingsL4overrideIp:i.ruleSettingsL4overrideIp,ruleSettingsL4overridePort:i.ruleSettingsL4overridePort,ruleSettingsNotificationSettingsEnabled:i.ruleSettingsNotificationSettingsEnabled,ruleSettingsNotificationSettingsIncludeContext:i.ruleSettingsNotificationSettingsIncludeContext,ruleSettingsNotificationSettingsMsg:i.ruleSettingsNotificationSettingsMsg,ruleSettingsNotificationSettingsSupportUrl:i.ruleSettingsNotificationSettingsSupportUrl,ruleSettingsOverrideHost:i.ruleSettingsOverrideHost,ruleSettingsOverrideIps:i.ruleSettingsOverrideIps,ruleSettingsPayloadLogEnabled:i.ruleSettingsPayloadLogEnabled,ruleSettingsQuarantineFileTypes:i.ruleSettingsQuarantineFileTypes,ruleSettingsRedirectIncludeContext:i.ruleSettingsRedirectIncludeContext,ruleSettingsRedirectPreservePathAndQuery:i.ruleSettingsRedirectPreservePathAndQuery,ruleSettingsRedirectTargetUri:i.ruleSettingsRedirectTargetUri,ruleSettingsResolveDnsInternallyFallback:i.ruleSettingsResolveDnsInternallyFallback,ruleSettingsResolveDnsInternallyViewId:i.ruleSettingsResolveDnsInternallyViewId,ruleSettingsResolveDnsThroughCloudflare:i.ruleSettingsResolveDnsThroughCloudflare,ruleSettingsUntrustedCertAction:i.ruleSettingsUntrustedCertAction,scheduleFri:i.scheduleFri,scheduleMon:i.scheduleMon,scheduleSat:i.scheduleSat,scheduleSun:i.scheduleSun,scheduleThu:i.scheduleThu,scheduleTimeZone:i.scheduleTimeZone,scheduleTue:i.scheduleTue,scheduleWed:i.scheduleWed,traffic:i.traffic,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Updating rule`,async()=>o.put(`/accounts/${h}/gateway/rules/${i.ruleId}`,{body:e})),{successLabel:`Updated rule`});return}i.action===void 0&&(i.action=await n(`action`,"Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to `true`.",[`on`,`off`,`allow`,`block`,`scan`,`noscan`,`safesearch`,`ytrestricted`,`isolate`,`noisolate`,`override`,`l4_override`,`egress`,`resolve`,`quarantine`,`redirect`])),i.name===void 0&&(i.name=await t(`name`,`Specify the rule name.`));let g={};i.action!==void 0&&l(g,[`action`],s(i.action,`action`,`text`)),i.description!==void 0&&l(g,[`description`],s(i.description,`description`,`text`)),i.devicePosture!==void 0&&l(g,[`device_posture`],s(i.devicePosture,`devicePosture`,`text`)),i.enabled!==void 0&&l(g,[`enabled`],i.enabled),i.expirationDuration!==void 0&&l(g,[`expiration`,`duration`],i.expirationDuration),i.filters!==void 0&&l(g,[`filters`],i.filters),i.identity!==void 0&&l(g,[`identity`],s(i.identity,`identity`,`text`)),i.name!==void 0&&l(g,[`name`],s(i.name,`name`,`text`)),i.precedence!==void 0&&l(g,[`precedence`],i.precedence),i.ruleSettingsAllowChildBypass!==void 0&&l(g,[`rule_settings`,`allow_child_bypass`],i.ruleSettingsAllowChildBypass),i.ruleSettingsAuditSshCommandLogging!==void 0&&l(g,[`rule_settings`,`audit_ssh`,`command_logging`],i.ruleSettingsAuditSshCommandLogging),i.ruleSettingsBisoAdminControlsCopy!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`copy`],s(i.ruleSettingsBisoAdminControlsCopy,`ruleSettingsBisoAdminControlsCopy`,`text`)),i.ruleSettingsBisoAdminControlsDcp!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dcp`],i.ruleSettingsBisoAdminControlsDcp),i.ruleSettingsBisoAdminControlsDd!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dd`],i.ruleSettingsBisoAdminControlsDd),i.ruleSettingsBisoAdminControlsDk!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dk`],i.ruleSettingsBisoAdminControlsDk),i.ruleSettingsBisoAdminControlsDownload!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`download`],s(i.ruleSettingsBisoAdminControlsDownload,`ruleSettingsBisoAdminControlsDownload`,`text`)),i.ruleSettingsBisoAdminControlsDp!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`dp`],i.ruleSettingsBisoAdminControlsDp),i.ruleSettingsBisoAdminControlsDu!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`du`],i.ruleSettingsBisoAdminControlsDu),i.ruleSettingsBisoAdminControlsKeyboard!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`keyboard`],s(i.ruleSettingsBisoAdminControlsKeyboard,`ruleSettingsBisoAdminControlsKeyboard`,`text`)),i.ruleSettingsBisoAdminControlsPaste!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`paste`],s(i.ruleSettingsBisoAdminControlsPaste,`ruleSettingsBisoAdminControlsPaste`,`text`)),i.ruleSettingsBisoAdminControlsPrinting!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`printing`],s(i.ruleSettingsBisoAdminControlsPrinting,`ruleSettingsBisoAdminControlsPrinting`,`text`)),i.ruleSettingsBisoAdminControlsUpload!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`upload`],s(i.ruleSettingsBisoAdminControlsUpload,`ruleSettingsBisoAdminControlsUpload`,`text`)),i.ruleSettingsBisoAdminControlsVersion!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`version`],s(i.ruleSettingsBisoAdminControlsVersion,`ruleSettingsBisoAdminControlsVersion`,`text`)),i.ruleSettingsBisoAdminControlsWmId!==void 0&&l(g,[`rule_settings`,`biso_admin_controls`,`wm_id`],s(i.ruleSettingsBisoAdminControlsWmId,`ruleSettingsBisoAdminControlsWmId`,`text`)),i.ruleSettingsBlockPageIncludeContext!==void 0&&l(g,[`rule_settings`,`block_page`,`include_context`],i.ruleSettingsBlockPageIncludeContext),i.ruleSettingsBlockPageTargetUri!==void 0&&l(g,[`rule_settings`,`block_page`,`target_uri`],s(i.ruleSettingsBlockPageTargetUri,`ruleSettingsBlockPageTargetUri`,`text`)),i.ruleSettingsBlockPageEnabled!==void 0&&l(g,[`rule_settings`,`block_page_enabled`],i.ruleSettingsBlockPageEnabled),i.ruleSettingsBlockReason!==void 0&&l(g,[`rule_settings`,`block_reason`],s(i.ruleSettingsBlockReason,`ruleSettingsBlockReason`,`text`)),i.ruleSettingsBypassParentRule!==void 0&&l(g,[`rule_settings`,`bypass_parent_rule`],i.ruleSettingsBypassParentRule),i.ruleSettingsCheckSessionDuration!==void 0&&l(g,[`rule_settings`,`check_session`,`duration`],s(i.ruleSettingsCheckSessionDuration,`ruleSettingsCheckSessionDuration`,`text`)),i.ruleSettingsCheckSessionEnforce!==void 0&&l(g,[`rule_settings`,`check_session`,`enforce`],i.ruleSettingsCheckSessionEnforce),i.ruleSettingsEgressIpv4!==void 0&&l(g,[`rule_settings`,`egress`,`ipv4`],s(i.ruleSettingsEgressIpv4,`ruleSettingsEgressIpv4`,`text`)),i.ruleSettingsEgressIpv4Fallback!==void 0&&l(g,[`rule_settings`,`egress`,`ipv4_fallback`],s(i.ruleSettingsEgressIpv4Fallback,`ruleSettingsEgressIpv4Fallback`,`text`)),i.ruleSettingsEgressIpv6!==void 0&&l(g,[`rule_settings`,`egress`,`ipv6`],s(i.ruleSettingsEgressIpv6,`ruleSettingsEgressIpv6`,`text`)),i.ruleSettingsForensicCopyEnabled!==void 0&&l(g,[`rule_settings`,`forensic_copy`,`enabled`],i.ruleSettingsForensicCopyEnabled),i.ruleSettingsIgnoreCnameCategoryMatches!==void 0&&l(g,[`rule_settings`,`ignore_cname_category_matches`],i.ruleSettingsIgnoreCnameCategoryMatches),i.ruleSettingsInsecureDisableDnssecValidation!==void 0&&l(g,[`rule_settings`,`insecure_disable_dnssec_validation`],i.ruleSettingsInsecureDisableDnssecValidation),i.ruleSettingsIpCategories!==void 0&&l(g,[`rule_settings`,`ip_categories`],i.ruleSettingsIpCategories),i.ruleSettingsIpIndicatorFeeds!==void 0&&l(g,[`rule_settings`,`ip_indicator_feeds`],i.ruleSettingsIpIndicatorFeeds),i.ruleSettingsL4overrideIp!==void 0&&l(g,[`rule_settings`,`l4override`,`ip`],s(i.ruleSettingsL4overrideIp,`ruleSettingsL4overrideIp`,`text`)),i.ruleSettingsL4overridePort!==void 0&&l(g,[`rule_settings`,`l4override`,`port`],i.ruleSettingsL4overridePort),i.ruleSettingsNotificationSettingsEnabled!==void 0&&l(g,[`rule_settings`,`notification_settings`,`enabled`],i.ruleSettingsNotificationSettingsEnabled),i.ruleSettingsNotificationSettingsIncludeContext!==void 0&&l(g,[`rule_settings`,`notification_settings`,`include_context`],i.ruleSettingsNotificationSettingsIncludeContext),i.ruleSettingsNotificationSettingsMsg!==void 0&&l(g,[`rule_settings`,`notification_settings`,`msg`],s(i.ruleSettingsNotificationSettingsMsg,`ruleSettingsNotificationSettingsMsg`,`text`)),i.ruleSettingsNotificationSettingsSupportUrl!==void 0&&l(g,[`rule_settings`,`notification_settings`,`support_url`],s(i.ruleSettingsNotificationSettingsSupportUrl,`ruleSettingsNotificationSettingsSupportUrl`,`text`)),i.ruleSettingsOverrideHost!==void 0&&l(g,[`rule_settings`,`override_host`],s(i.ruleSettingsOverrideHost,`ruleSettingsOverrideHost`,`text`)),i.ruleSettingsOverrideIps!==void 0&&l(g,[`rule_settings`,`override_ips`],i.ruleSettingsOverrideIps),i.ruleSettingsPayloadLogEnabled!==void 0&&l(g,[`rule_settings`,`payload_log`,`enabled`],i.ruleSettingsPayloadLogEnabled),i.ruleSettingsQuarantineFileTypes!==void 0&&l(g,[`rule_settings`,`quarantine`,`file_types`],i.ruleSettingsQuarantineFileTypes),i.ruleSettingsRedirectIncludeContext!==void 0&&l(g,[`rule_settings`,`redirect`,`include_context`],i.ruleSettingsRedirectIncludeContext),i.ruleSettingsRedirectPreservePathAndQuery!==void 0&&l(g,[`rule_settings`,`redirect`,`preserve_path_and_query`],i.ruleSettingsRedirectPreservePathAndQuery),i.ruleSettingsRedirectTargetUri!==void 0&&l(g,[`rule_settings`,`redirect`,`target_uri`],s(i.ruleSettingsRedirectTargetUri,`ruleSettingsRedirectTargetUri`,`text`)),i.ruleSettingsResolveDnsInternallyFallback!==void 0&&l(g,[`rule_settings`,`resolve_dns_internally`,`fallback`],s(i.ruleSettingsResolveDnsInternallyFallback,`ruleSettingsResolveDnsInternallyFallback`,`text`)),i.ruleSettingsResolveDnsInternallyViewId!==void 0&&l(g,[`rule_settings`,`resolve_dns_internally`,`view_id`],s(i.ruleSettingsResolveDnsInternallyViewId,`ruleSettingsResolveDnsInternallyViewId`,`text`)),i.ruleSettingsResolveDnsThroughCloudflare!==void 0&&l(g,[`rule_settings`,`resolve_dns_through_cloudflare`],i.ruleSettingsResolveDnsThroughCloudflare),i.ruleSettingsUntrustedCertAction!==void 0&&l(g,[`rule_settings`,`untrusted_cert`,`action`],s(i.ruleSettingsUntrustedCertAction,`ruleSettingsUntrustedCertAction`,`text`)),i.scheduleFri!==void 0&&l(g,[`schedule`,`fri`],s(i.scheduleFri,`scheduleFri`,`text`)),i.scheduleMon!==void 0&&l(g,[`schedule`,`mon`],s(i.scheduleMon,`scheduleMon`,`text`)),i.scheduleSat!==void 0&&l(g,[`schedule`,`sat`],s(i.scheduleSat,`scheduleSat`,`text`)),i.scheduleSun!==void 0&&l(g,[`schedule`,`sun`],s(i.scheduleSun,`scheduleSun`,`text`)),i.scheduleThu!==void 0&&l(g,[`schedule`,`thu`],s(i.scheduleThu,`scheduleThu`,`text`)),i.scheduleTimeZone!==void 0&&l(g,[`schedule`,`time_zone`],s(i.scheduleTimeZone,`scheduleTimeZone`,`text`)),i.scheduleTue!==void 0&&l(g,[`schedule`,`tue`],s(i.scheduleTue,`scheduleTue`,`text`)),i.scheduleWed!==void 0&&l(g,[`schedule`,`wed`],s(i.scheduleWed,`scheduleWed`,`text`)),i.traffic!==void 0&&l(g,[`traffic`],s(i.traffic,`traffic`,`text`)),d(await m(`Updating rule`,async()=>o.put(`/accounts/${h}/gateway/rules/${i.ruleId}`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Updated rule`})}},Ys={command:`rules`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(Hs).command(Us).command(Ws).command(Ks).command(Gs).command(qs).command(Js).demandCommand(1),handler:()=>{}},Xs={command:`gateway`,describe:`Secure Web Gateway — DNS, HTTP, and network filtering rules, proxy settings, certificates, and logging`,builder:e=>e.command(us).command(ds).command(Wo).command(Jo).command(Xo).command(rs).command(ls).command(bs).command(Es).command(ks).command(Fs).command(Vs).command(Ys).demandCommand(1),handler:()=>{}},Zs={command:`create`,describe:`Creates a new Access group.`,builder:e=>e.option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust groups create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/groups`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{name:e.name,body:e.body},validation:`passed`});return}let n=await a(e);if(e.zoneId=await o({zone:e.zone},n,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Creating group`,async()=>n.post(`/zones/${e.zoneId}/access/groups`,{body:t})),{successLabel:`Created group`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let r={};e.name!==void 0&&l(r,[`name`],s(e.name,`name`,`text`)),d(await m(`Creating group`,async()=>n.post(`/zones/${e.zoneId}/access/groups`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Created group`})}},Qs={command:`delete <groupId>`,describe:`Deletes an Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.groupId,`groupId`),e.dryRun){f({command:`cf zero-trust groups delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/groups/${e.groupId??`<groupId>`}`,pathParams:{groupId:String(e.groupId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`group`,String(e.groupId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting group`,async()=>t.zeroTrust.groups.delete(e.groupId,n)),{successLabel:`Deleted group`})}},$s={command:`get <groupId>`,describe:`Fetches a single Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.groupId,`groupId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading group`,async()=>t.zeroTrust.groups.get(e.groupId,n)),{successLabel:`Loaded group`})}},ec={command:`list`,describe:`Lists all Access groups.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading groups`,async()=>t.zeroTrust.groups.list(n)),{successLabel:`Loaded groups`})}},tc={command:`update <groupId>`,describe:`Updates a configured Access group.`,builder:e=>e.positional(`groupId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`name`,{type:`string`,description:`The name of the Access group.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.groupId,`groupId`),e.dryRun){f({command:`cf zero-trust groups update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/groups/${e.groupId??`<groupId>`}`,pathParams:{groupId:String(e.groupId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{name:e.name,body:e.body},validation:`passed`});return}let n=await a(e);if(e.zoneId=await o({zone:e.zone},n,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Updating group`,async()=>n.put(`/zones/${e.zoneId}/access/groups/${e.groupId}`,{body:t})),{successLabel:`Updated group`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the Access group.`));let r={};e.name!==void 0&&l(r,[`name`],s(e.name,`name`,`text`)),d(await m(`Updating group`,async()=>n.put(`/zones/${e.zoneId}/access/groups/${e.groupId}`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Updated group`})}},nc={command:`groups`,describe:`Groups operations`,builder:e=>e.command(Zs).command(Qs).command($s).command(ec).command(tc).demandCommand(1),handler:()=>{}},rc={command:`create`,describe:`Adds a new identity provider to Access.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/identity_providers`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating identity provider`,async()=>n.post(`/accounts/${i}/access/identity_providers`,{body:e})),{successLabel:`Created identity provider`});return}d(await m(`Creating identity provider`,async()=>n.zeroTrust.identityProviders.create(i)),{successLabel:`Created identity provider`})}},ic={command:`delete <identityProviderId>`,describe:`Deletes an identity provider from Access.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.identityProviderId,`identityProviderId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/identity_providers/${t.identityProviderId??`<identityProviderId>`}`,pathParams:{identityProviderId:String(t.identityProviderId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`identity provider`,String(t.identityProviderId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting identity provider`,async()=>n.zeroTrust.identityProviders.delete(t.identityProviderId,o)),{successLabel:`Deleted identity provider`})}},ac={command:`get <identityProviderId>`,describe:`Fetches a configured identity provider.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.identityProviderId,`identityProviderId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading identity provider`,async()=>t.zeroTrust.identityProviders.get(e.identityProviderId,n)),{successLabel:`Loaded identity provider`})}},oc={command:`list`,describe:`Lists all configured identity providers.`,builder:e=>e.option(`scim-enabled`,{type:`string`,description:`Indicates to Access to only retrieve identity providers that have the System for Cross-Domain Identity Management (SCIM) enabled.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.scimEnabled!==void 0&&(t.scim_enabled=e.scimEnabled),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading identity providers`,async()=>n.zeroTrust.identityProviders.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded identity providers`})}},sc={command:`list`,describe:`Lists SCIM Group resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:e=>e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM Group resource; also known as the "Id".`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM Group resource; also known as the "external Id".`}).option(`name`,{type:`string`,description:`The display name of the SCIM Group resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.cfResourceId!==void 0&&(t.cf_resource_id=e.cfResourceId),e.idpResourceId!==void 0&&(t.idp_resource_id=e.idpResourceId),e.name!==void 0&&(t.name=e.name),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading groups`,async()=>n.zeroTrust.identityProviders.scim.groups.list(e.identityProviderId,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded groups`})}},cc={command:`groups`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(sc).demandCommand(1),handler:()=>{}},lc={command:`list`,describe:`Lists SCIM User resources synced to Cloudflare via the System for Cross-domain Identity Management (SCIM).`,builder:e=>e.option(`identity-provider-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`cf-resource-id`,{type:`string`,description:`The unique Cloudflare-generated Id of the SCIM User resource; also known as the "Id".`}).option(`idp-resource-id`,{type:`string`,description:`The IdP-generated Id of the SCIM User resource; also known as the "external Id".`}).option(`username`,{type:`string`,description:`The username of the SCIM User resource.`}).option(`email`,{type:`string`,description:`The email address of the SCIM User resource.`}).option(`name`,{type:`string`,description:`The name of the SCIM User resource.`}).option(`page`,{type:`number`,description:`Page number of results.`}).option(`per-page`,{type:`number`,description:`Number of results per page.`}),handler:async e=>{let t={};e.cfResourceId!==void 0&&(t.cf_resource_id=e.cfResourceId),e.idpResourceId!==void 0&&(t.idp_resource_id=e.idpResourceId),e.username!==void 0&&(t.username=e.username),e.email!==void 0&&(t.email=e.email),e.name!==void 0&&(t.name=e.name),e.page!==void 0&&(t.page=e.page),e.perPage!==void 0&&(t.per_page=e.perPage);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading users`,async()=>n.zeroTrust.identityProviders.scim.users.list(e.identityProviderId,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded users`})}},uc={command:`users`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(lc).demandCommand(1),handler:()=>{}},dc={command:`scim`,describe:`Operations for identity-providers.scim`,builder:e=>e.command(cc).command(uc).demandCommand(1),handler:()=>{}},fc={command:`update <identityProviderId>`,describe:`Updates a configured identity provider.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.identityProviderId,`identityProviderId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/identity_providers/${t.identityProviderId??`<identityProviderId>`}`,pathParams:{identityProviderId:String(t.identityProviderId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating identity provider`,async()=>n.put(`/accounts/${i}/access/identity_providers/${t.identityProviderId}`,{body:e})),{successLabel:`Updated identity provider`});return}d(await m(`Updating identity provider`,async()=>n.zeroTrust.identityProviders.update(t.identityProviderId,i)),{successLabel:`Updated identity provider`})}},pc={command:`identity-providers`,describe:`Identity provider integrations (Okta, Azure AD, etc.) used to authenticate users in Access`,builder:e=>e.command(rc).command(ic).command(ac).command(oc).command(fc).command(dc).demandCommand(1),handler:()=>{}},mc={command:`create`,describe:`Create a hostname route.`,builder:e=>e.option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks hostname-routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/routes/hostname`,pathParams:{},bodyKind:`json`,body:{comment:t.comment,hostname:t.hostname,tunnelId:t.tunnelId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating hostname route`,async()=>n.post(`/accounts/${i}/zerotrust/routes/hostname`,{body:e})),{successLabel:`Created hostname route`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.hostname!==void 0&&l(o,[`hostname`],s(t.hostname,`hostname`,`text`)),t.tunnelId!==void 0&&l(o,[`tunnel_id`],s(t.tunnelId,`tunnelId`,`text`)),d(await m(`Creating hostname route`,async()=>n.post(`/accounts/${i}/zerotrust/routes/hostname`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created hostname route`})}},hc={command:`delete <hostnameRouteId>`,describe:`Delete a hostname route.`,builder:e=>e.positional(`hostnameRouteId`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.hostnameRouteId,`hostnameRouteId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks hostname-routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/routes/hostname/${t.hostnameRouteId??`<hostnameRouteId>`}`,pathParams:{hostnameRouteId:String(t.hostnameRouteId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`hostname route`,String(t.hostnameRouteId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting hostname route`,async()=>n.zeroTrust.networks.hostnameRoutes.delete(o,t.hostnameRouteId)),{successLabel:`Deleted hostname route`})}},gc={command:`edit <hostnameRouteId>`,describe:`Updates a hostname route.`,builder:e=>e.positional(`hostnameRouteId`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the hostname route.`}).option(`hostname`,{type:`string`,description:`The hostname of the route.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.hostnameRouteId,`hostnameRouteId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks hostname-routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/routes/hostname/${t.hostnameRouteId??`<hostnameRouteId>`}`,pathParams:{hostnameRouteId:String(t.hostnameRouteId??``)},bodyKind:`json`,body:{comment:t.comment,hostname:t.hostname,tunnelId:t.tunnelId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating hostname route`,async()=>n.patch(`/accounts/${i}/zerotrust/routes/hostname/${t.hostnameRouteId}`,{body:e})),{successLabel:`Updated hostname route`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.hostname!==void 0&&l(o,[`hostname`],s(t.hostname,`hostname`,`text`)),t.tunnelId!==void 0&&l(o,[`tunnel_id`],s(t.tunnelId,`tunnelId`,`text`)),d(await m(`Updating hostname route`,async()=>n.patch(`/accounts/${i}/zerotrust/routes/hostname/${t.hostnameRouteId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated hostname route`})}},_c={command:`get <hostnameRouteId>`,describe:`Get a hostname route.`,builder:e=>e.positional(`hostnameRouteId`,{type:`string`,description:`The hostname route ID.`,demandOption:!0}),handler:async e=>{c(e.hostnameRouteId,`hostnameRouteId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading hostname route`,async()=>t.zeroTrust.networks.hostnameRoutes.get(n,e.hostnameRouteId)),{successLabel:`Loaded hostname route`})}},vc={command:`list`,describe:`Lists and filters hostname routes in an account.`,builder:e=>e.option(`id`,{type:`string`,description:`The hostname route ID.`}).option(`hostname`,{type:`string`,description:`If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.`}).option(`tunnel-id`,{type:`string`,description:`If set, only list hostname routes that point to a specific tunnel.`}).option(`comment`,{type:`string`,description:`If set, only list hostname routes with the given comment.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only return deleted hostname routes. If `false`, exclude deleted hostname routes.",default:!1}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.id!==void 0&&(t.id=e.id),e.hostname!==void 0&&(t.hostname=e.hostname),e.tunnelId!==void 0&&(t.tunnel_id=e.tunnelId),e.comment!==void 0&&(t.comment=e.comment),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading hostname routes`,async()=>n.zeroTrust.networks.hostnameRoutes.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded hostname routes`})}},yc={command:`hostname-routes`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(mc).command(hc).command(gc).command(_c).command(vc).demandCommand(1),handler:()=>{}},bc={command:`create`,describe:`Routes a private network through a Cloudflare Tunnel.`,builder:e=>e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust networks routes create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/teamnet/routes`,pathParams:{},bodyKind:`json`,body:{comment:n.comment,network:n.network,virtualNetworkId:n.virtualNetworkId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating route`,async()=>i.post(`/accounts/${o}/teamnet/routes`,{body:e})),{successLabel:`Created route`});return}n.network===void 0&&(n.network=await t(`network`,`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`));let h={};n.comment!==void 0&&l(h,[`comment`],s(n.comment,`comment`,`text`)),n.network!==void 0&&l(h,[`network`],s(n.network,`network`,`text`)),n.virtualNetworkId!==void 0&&l(h,[`virtual_network_id`],s(n.virtualNetworkId,`virtualNetworkId`,`text`)),d(await m(`Creating route`,async()=>i.post(`/accounts/${o}/teamnet/routes`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created route`})}},xc={command:`delete <routeId>`,describe:`Deletes a private network route from an account.`,builder:e=>e.positional(`routeId`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.routeId,`routeId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks routes delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/routes/${t.routeId??`<routeId>`}`,pathParams:{routeId:String(t.routeId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`route`,String(t.routeId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting route`,async()=>n.zeroTrust.networks.routes.delete(t.routeId,o)),{successLabel:`Deleted route`})}},Sc={command:`edit <routeId>`,describe:`Updates an existing private network route in an account. The fields that are meant to be updated should be provided in the body of the request.`,builder:e=>e.positional(`routeId`,{type:`string`,description:`UUID of the route.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range connected by the route, in CIDR notation.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.routeId,`routeId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks routes edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/routes/${t.routeId??`<routeId>`}`,pathParams:{routeId:String(t.routeId??``)},bodyKind:`json`,body:{comment:t.comment,network:t.network,virtualNetworkId:t.virtualNetworkId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating route`,async()=>n.patch(`/accounts/${i}/teamnet/routes/${t.routeId}`,{body:e})),{successLabel:`Updated route`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.network!==void 0&&l(o,[`network`],s(t.network,`network`,`text`)),t.virtualNetworkId!==void 0&&l(o,[`virtual_network_id`],s(t.virtualNetworkId,`virtualNetworkId`,`text`)),d(await m(`Updating route`,async()=>n.patch(`/accounts/${i}/teamnet/routes/${t.routeId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated route`})}},Cc={command:`get <routeId>`,describe:`Get a private network route in an account.`,builder:e=>e.positional(`routeId`,{type:`string`,description:`UUID of the route.`,demandOption:!0}),handler:async e=>{c(e.routeId,`routeId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading route`,async()=>t.zeroTrust.networks.routes.get(n,e.routeId)),{successLabel:`Loaded route`})}},wc={command:`get <ip>`,describe:`Fetches routes that contain the given IP address.`,builder:e=>e.positional(`ip`,{type:`string`,description:`Ip`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`default-virtual-network-fallback`,{type:`boolean`,description:`When the virtual_network_id parameter is not provided the request filter will default search routes that are in the default virtual network for the account. If this parameter is set to false, the search will include routes that do not have a virtual network.`,default:!1}),handler:async e=>{c(e.ip,`ip`);let t={};e.virtualNetworkId!==void 0&&(t.virtual_network_id=e.virtualNetworkId),e.defaultVirtualNetworkFallback!==void 0&&(t.default_virtual_network_fallback=e.defaultVirtualNetworkFallback);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading ip`,async()=>n.zeroTrust.networks.routes.ips.get(e.ip,i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded ip`})}},Tc={command:`ips`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(wc).demandCommand(1),handler:()=>{}},Ec={command:`list`,describe:`Lists and filters private network routes in an account.`,builder:e=>e.option(`comment`,{type:`string`,description:`Optional remark describing the route.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted routes. If `false`, exclude deleted routes. If empty, all routes will be included.",default:!1}).option(`network-subset`,{type:`string`,description:`If set, only list routes that are contained within this IP range.`}).option(`network-superset`,{type:`string`,description:`If set, only list routes that contain this IP range.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`route-id`,{type:`string`,description:`UUID of the route.`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.comment!==void 0&&(t.comment=e.comment),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.networkSubset!==void 0&&(t.network_subset=e.networkSubset),e.networkSuperset!==void 0&&(t.network_superset=e.networkSuperset),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.tunnelId!==void 0&&(t.tunnel_id=e.tunnelId),e.routeId!==void 0&&(t.route_id=e.routeId),e.tunTypes!==void 0&&(t.tun_types=e.tunTypes),e.virtualNetworkId!==void 0&&(t.virtual_network_id=e.virtualNetworkId),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading routes`,async()=>n.zeroTrust.networks.routes.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded routes`})}},Dc={command:`create <ipNetworkEncoded>`,describe:"Routes a private network through a Cloudflare Tunnel. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:e=>e.positional(`ipNetworkEncoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the route.`,default:``}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.ipNetworkEncoded,`ipNetworkEncoded`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks routes networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/routes/network/${t.ipNetworkEncoded??`<ipNetworkEncoded>`}`,pathParams:{ipNetworkEncoded:String(t.ipNetworkEncoded??``)},bodyKind:`json`,body:{comment:t.comment,virtualNetworkId:t.virtualNetworkId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating network`,async()=>n.post(`/accounts/${i}/teamnet/routes/network/${t.ipNetworkEncoded}`,{body:e})),{successLabel:`Created network`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.virtualNetworkId!==void 0&&l(o,[`virtual_network_id`],s(t.virtualNetworkId,`virtualNetworkId`,`text`)),d(await m(`Creating network`,async()=>n.post(`/accounts/${i}/teamnet/routes/network/${t.ipNetworkEncoded}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created network`})}},Oc={command:`delete <ipNetworkEncoded>`,describe:"Deletes a private network route from an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format. If no virtual_network_id is provided it will delete the route from the default vnet. If no tun_type is provided it will fetch the type from the tunnel_id or if that is missing it will assume Cloudflare Tunnel as default. If tunnel_id is provided it will delete the route from that tunnel, otherwise it will delete the route based on the vnet and tun_type.",builder:e=>e.positional(`ipNetworkEncoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`virtual-network-id`,{type:`string`,description:`UUID of the virtual network.`}).option(`tun-type`,{type:`string`,description:`The type of tunnel.`,choices:[`cfd_tunnel`,`warp_connector`,`warp`,`magic`,`ip_sec`,`gre`,`cni`]}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{c(t.ipNetworkEncoded,`ipNetworkEncoded`);let n={};if(t.virtualNetworkId!==void 0&&(n.virtual_network_id=t.virtualNetworkId),t.tunType!==void 0&&(n.tun_type=t.tunType),t.tunnelId!==void 0&&(n.tunnel_id=t.tunnelId),t.dryRun){let r=e();r&&c(r,`accountId`),f({command:`cf zero-trust networks routes networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${r??`<account-id>`}/teamnet/routes/network/${t.ipNetworkEncoded??`<ipNetworkEncoded>`}`,pathParams:{ipNetworkEncoded:String(t.ipNetworkEncoded??``)},bodyKind:`json`,body:{...n},validation:`passed`});return}let o=await a(t),s=t.local?p:await r(o);if(t.accountId=s,!await i(`network`,String(t.ipNetworkEncoded??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting network`,async()=>o.zeroTrust.networks.routes.networks.delete(t.ipNetworkEncoded,s,Object.keys(n).length>0?n:void 0)),{successLabel:`Deleted network`})}},kc={command:`edit <ipNetworkEncoded>`,describe:"Updates an existing private network route in an account. The CIDR in `ip_network_encoded` must be written in URL-encoded format.",builder:e=>e.positional(`ipNetworkEncoded`,{type:`string`,description:`IP/CIDR range in URL-encoded format`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}),handler:async t=>{if(c(t.ipNetworkEncoded,`ipNetworkEncoded`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks routes networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/routes/network/${t.ipNetworkEncoded??`<ipNetworkEncoded>`}`,pathParams:{ipNetworkEncoded:String(t.ipNetworkEncoded??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);t.accountId=i,d(await m(`Updating network`,async()=>n.zeroTrust.networks.routes.networks.edit(t.ipNetworkEncoded,i)),{successLabel:`Updated network`})}},Ac={command:`networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Dc).command(Oc).command(kc).demandCommand(1),handler:()=>{}},jc={command:`routes`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(bc).command(xc).command(Sc).command(Cc).command(Ec).command(Tc).command(Ac).demandCommand(1),handler:()=>{}},Mc={command:`update <addressFamily>`,describe:`Updates the Cloudflare Source subnet of the given address family`,builder:e=>e.positional(`addressFamily`,{type:`string`,description:"IP address family, either `v4` (IPv4) or `v6` (IPv6)",demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.addressFamily,`addressFamily`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks subnets cloudflare-source update`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/subnets/cloudflare_source/${t.addressFamily??`<addressFamily>`}`,pathParams:{addressFamily:String(t.addressFamily??``)},bodyKind:`json`,body:{comment:t.comment,name:t.name,network:t.network,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating cloudflare source`,async()=>n.patch(`/accounts/${i}/zerotrust/subnets/cloudflare_source/${t.addressFamily}`,{body:e})),{successLabel:`Updated cloudflare source`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.network!==void 0&&l(o,[`network`],s(t.network,`network`,`text`)),d(await m(`Updating cloudflare source`,async()=>n.patch(`/accounts/${i}/zerotrust/subnets/cloudflare_source/${t.addressFamily}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated cloudflare source`})}},Nc={command:`cloudflare-source`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Mc).demandCommand(1),handler:()=>{}},Pc={command:`list`,describe:`Lists and filters subnets in an account.`,builder:e=>e.option(`name`,{type:`string`,description:`If set, only list subnets with the given name`}).option(`comment`,{type:`string`,description:`If set, only list subnets with the given comment.`}).option(`network`,{type:`string`,description:`If set, only list the subnet whose network exactly matches the given CIDR.`}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`address-family`,{type:`string`,description:"If set, only include subnets in the given address family - `v4` or `v6`",choices:[`v4`,`v6`]}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include default subnets. If `false`, exclude default subnets subnets. If not set, all subnets will be included.",default:!1}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted subnets. If `false`, exclude deleted subnets. If not set, all subnets will be included.",default:!1}).option(`sort-order`,{type:`string`,description:"Sort order of the results. `asc` means oldest to newest, `desc` means newest to oldest. If not set, they will not be in any particular order.",choices:[`asc`,`desc`]}).option(`subnet-types`,{type:`string`,description:`If set, the types of subnets to include, separated by comma.`,choices:[`cloudflare_source`,`warp`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.comment!==void 0&&(t.comment=e.comment),e.network!==void 0&&(t.network=e.network),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.addressFamily!==void 0&&(t.address_family=e.addressFamily),e.isDefaultNetwork!==void 0&&(t.is_default_network=e.isDefaultNetwork),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.sortOrder!==void 0&&(t.sort_order=e.sortOrder),e.subnetTypes!==void 0&&(t.subnet_types=e.subnetTypes),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading subnets`,async()=>n.zeroTrust.networks.subnets.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded subnets`})}},Fc={command:`create`,describe:"Create a WARP IP assignment subnet. Currently, only IPv4 subnets can be created. **Network constraints:** - The network must be within one of the following private IP ranges: - `10.0.0.0/8` (RFC 1918) - `172.16.0.0/12` (RFC 1918) - `192.168.0.0/16` (RFC 1918) - `100.64.0.0/10` (RFC 6598 - CGNAT) - The subnet must have a prefix length of `/24` or larger (e.g., `/16`, `/20`, `/24` are valid; `/25`, `/28` are not)",builder:e=>e.option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust networks subnets warp create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/zerotrust/subnets/warp`,pathParams:{},bodyKind:`json`,body:{comment:n.comment,isDefaultNetwork:n.isDefaultNetwork,name:n.name,network:n.network,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating warp`,async()=>i.post(`/accounts/${o}/zerotrust/subnets/warp`,{body:e})),{successLabel:`Created warp`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the subnet.`)),n.network===void 0&&(n.network=await t(`network`,`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`));let h={};n.comment!==void 0&&l(h,[`comment`],s(n.comment,`comment`,`text`)),n.isDefaultNetwork!==void 0&&l(h,[`is_default_network`],n.isDefaultNetwork),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.network!==void 0&&l(h,[`network`],s(n.network,`network`,`text`)),d(await m(`Creating warp`,async()=>i.post(`/accounts/${o}/zerotrust/subnets/warp`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created warp`})}},Ic={command:`delete <subnetId>`,describe:`Delete a WARP IP assignment subnet. This operation is idempotent - deleting an already-deleted or non-existent subnet will return success with a null result.`,builder:e=>e.positional(`subnetId`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.subnetId,`subnetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks subnets warp delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/subnets/warp/${t.subnetId??`<subnetId>`}`,pathParams:{subnetId:String(t.subnetId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`warp`,String(t.subnetId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting warp`,async()=>n.zeroTrust.networks.subnets.warp.delete(o,t.subnetId)),{successLabel:`Deleted warp`})}},Lc={command:`edit <subnetId>`,describe:"Updates a WARP IP assignment subnet. **Update constraints:** - The `network` field cannot be modified for WARP subnets. Only `name`, `comment`, and `is_default_network` can be updated. - IPv6 subnets cannot be updated",builder:e=>e.positional(`subnetId`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}).option(`comment`,{type:`string`,description:`An optional description of the subnet.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this is the default subnet for the account. There can only be one default subnet per account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the subnet.`}).option(`network`,{type:`string`,description:`The private IPv4 or IPv6 range defining the subnet, in CIDR notation.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.subnetId,`subnetId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks subnets warp edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zerotrust/subnets/warp/${t.subnetId??`<subnetId>`}`,pathParams:{subnetId:String(t.subnetId??``)},bodyKind:`json`,body:{comment:t.comment,isDefaultNetwork:t.isDefaultNetwork,name:t.name,network:t.network,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating warp`,async()=>n.patch(`/accounts/${i}/zerotrust/subnets/warp/${t.subnetId}`,{body:e})),{successLabel:`Updated warp`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.isDefaultNetwork!==void 0&&l(o,[`is_default_network`],t.isDefaultNetwork),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.network!==void 0&&l(o,[`network`],s(t.network,`network`,`text`)),d(await m(`Updating warp`,async()=>n.patch(`/accounts/${i}/zerotrust/subnets/warp/${t.subnetId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated warp`})}},Rc={command:`get <subnetId>`,describe:`Get a WARP IP assignment subnet.`,builder:e=>e.positional(`subnetId`,{type:`string`,description:`The UUID of the subnet.`,demandOption:!0}),handler:async e=>{c(e.subnetId,`subnetId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading warp`,async()=>t.zeroTrust.networks.subnets.warp.get(n,e.subnetId)),{successLabel:`Loaded warp`})}},zc={command:`warp`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Fc).command(Ic).command(Lc).command(Rc).demandCommand(1),handler:()=>{}},Bc={command:`subnets`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Pc).command(Nc).command(zc).demandCommand(1),handler:()=>{}},Vc={command:`create`,describe:`Adds a new virtual network to an account.`,builder:e=>e.option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust networks virtual-networks create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/teamnet/virtual_networks`,pathParams:{},bodyKind:`json`,body:{comment:n.comment,isDefault:n.isDefault,isDefaultNetwork:n.isDefaultNetwork,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating virtual network`,async()=>i.post(`/accounts/${o}/teamnet/virtual_networks`,{body:e})),{successLabel:`Created virtual network`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for the virtual network.`));let h={};n.comment!==void 0&&l(h,[`comment`],s(n.comment,`comment`,`text`)),n.isDefault!==void 0&&l(h,[`is_default`],n.isDefault),n.isDefaultNetwork!==void 0&&l(h,[`is_default_network`],n.isDefaultNetwork),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating virtual network`,async()=>i.post(`/accounts/${o}/teamnet/virtual_networks`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created virtual network`})}},Hc={command:`delete <virtualNetworkId>`,describe:`Deletes an existing virtual network.`,builder:e=>e.positional(`virtualNetworkId`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.virtualNetworkId,`virtualNetworkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks virtual-networks delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/virtual_networks/${t.virtualNetworkId??`<virtualNetworkId>`}`,pathParams:{virtualNetworkId:String(t.virtualNetworkId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`virtual network`,String(t.virtualNetworkId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting virtual network`,async()=>n.delete(`/accounts/${o}/teamnet/virtual_networks/${t.virtualNetworkId}`,{body:e})),{successLabel:`Deleted virtual network`});return}d(await m(`Deleting virtual network`,async()=>n.zeroTrust.networks.virtualNetworks.delete(t.virtualNetworkId,o)),{successLabel:`Deleted virtual network`})}},Uc={command:`edit <virtualNetworkId>`,describe:`Updates an existing virtual network.`,builder:e=>e.positional(`virtualNetworkId`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account.",default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.virtualNetworkId,`virtualNetworkId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust networks virtual-networks edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/teamnet/virtual_networks/${t.virtualNetworkId??`<virtualNetworkId>`}`,pathParams:{virtualNetworkId:String(t.virtualNetworkId??``)},bodyKind:`json`,body:{comment:t.comment,isDefaultNetwork:t.isDefaultNetwork,name:t.name,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating virtual network`,async()=>n.patch(`/accounts/${i}/teamnet/virtual_networks/${t.virtualNetworkId}`,{body:e})),{successLabel:`Updated virtual network`});return}let o={};t.comment!==void 0&&l(o,[`comment`],s(t.comment,`comment`,`text`)),t.isDefaultNetwork!==void 0&&l(o,[`is_default_network`],t.isDefaultNetwork),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),d(await m(`Updating virtual network`,async()=>n.patch(`/accounts/${i}/teamnet/virtual_networks/${t.virtualNetworkId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated virtual network`})}},Wc={command:`get <virtualNetworkId>`,describe:`Get a virtual network.`,builder:e=>e.positional(`virtualNetworkId`,{type:`string`,description:`UUID of the virtual network.`,demandOption:!0}).option(`comment`,{type:`string`,description:`Optional remark describing the virtual network.`,default:``}).option(`is-default-network`,{type:`boolean`,description:"If `true`, this virtual network is the default for the account."}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}),handler:async e=>{c(e.virtualNetworkId,`virtualNetworkId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading virtual network`,async()=>t.zeroTrust.networks.virtualNetworks.get(n,e.virtualNetworkId)),{successLabel:`Loaded virtual network`})}},Gc={command:`list`,describe:`Lists and filters virtual networks in an account.`,builder:e=>e.option(`id`,{type:`string`,description:`UUID of the virtual network.`}).option(`name`,{type:`string`,description:`A user-friendly name for the virtual network.`}).option(`is-default`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.",default:!1}).option(`is-default-network`,{type:`boolean`,description:"If `true`, only include the default virtual network. If `false`, exclude the default virtual network. If empty, all virtual networks will be included.",default:!1}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted virtual networks. If `false`, exclude deleted virtual networks. If empty, all virtual networks will be included.",default:!1}),handler:async e=>{let t={};e.id!==void 0&&(t.id=e.id),e.name!==void 0&&(t.name=e.name),e.isDefault!==void 0&&(t.is_default=e.isDefault),e.isDefaultNetwork!==void 0&&(t.is_default_network=e.isDefaultNetwork),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading virtual networks`,async()=>n.zeroTrust.networks.virtualNetworks.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded virtual networks`})}},Kc={command:`virtual-networks`,describe:`Private network routing — virtual networks, IP routes, and subnet-level policies for Tunnel traffic`,builder:e=>e.command(Vc).command(Hc).command(Uc).command(Wc).command(Gc).demandCommand(1),handler:()=>{}},qc={command:`networks`,describe:`Operations for networks`,builder:e=>e.command(yc).command(jc).command(Bc).command(Kc).demandCommand(1),handler:()=>{}},Jc={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:e=>e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.`,default:!1}).option(`mfa-ssh-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-ssh-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-ssh-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:{allowAuthenticateViaWarp:n.allowAuthenticateViaWarp,authDomain:n.authDomain,autoRedirectToIdentity:n.autoRedirectToIdentity,denyUnmatchedRequests:n.denyUnmatchedRequests,denyUnmatchedRequestsExemptedZoneNames:n.denyUnmatchedRequestsExemptedZoneNames,isUiReadOnly:n.isUiReadOnly,loginDesignBackgroundColor:n.loginDesignBackgroundColor,loginDesignFooterText:n.loginDesignFooterText,loginDesignHeaderText:n.loginDesignHeaderText,loginDesignLogoPath:n.loginDesignLogoPath,loginDesignTextColor:n.loginDesignTextColor,mfaConfigAllowedAuthenticators:n.mfaConfigAllowedAuthenticators,mfaConfigAmrMatchingSessionDuration:n.mfaConfigAmrMatchingSessionDuration,mfaConfigRequiredAaguids:n.mfaConfigRequiredAaguids,mfaConfigSessionDuration:n.mfaConfigSessionDuration,mfaRequiredForAllApps:n.mfaRequiredForAllApps,mfaSshPivKeyRequirementsPinPolicy:n.mfaSshPivKeyRequirementsPinPolicy,mfaSshPivKeyRequirementsRequireFipsDevice:n.mfaSshPivKeyRequirementsRequireFipsDevice,mfaSshPivKeyRequirementsSshKeySize:n.mfaSshPivKeyRequirementsSshKeySize,mfaSshPivKeyRequirementsSshKeyType:n.mfaSshPivKeyRequirementsSshKeyType,mfaSshPivKeyRequirementsTouchPolicy:n.mfaSshPivKeyRequirementsTouchPolicy,name:n.name,sessionDuration:n.sessionDuration,uiReadOnlyToggleReason:n.uiReadOnlyToggleReason,userSeatExpirationInactiveTime:n.userSeatExpirationInactiveTime,warpAuthSessionDuration:n.warpAuthSessionDuration,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating organization`,async()=>i.post(`/accounts/${o}/access/organizations`,{body:e})),{successLabel:`Created organization`});return}n.authDomain===void 0&&(n.authDomain=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),n.name===void 0&&(n.name=await t(`name`,`The name of your Zero Trust organization.`));let h={};n.allowAuthenticateViaWarp!==void 0&&l(h,[`allow_authenticate_via_warp`],n.allowAuthenticateViaWarp),n.authDomain!==void 0&&l(h,[`auth_domain`],s(n.authDomain,`authDomain`,`text`)),n.autoRedirectToIdentity!==void 0&&l(h,[`auto_redirect_to_identity`],n.autoRedirectToIdentity),n.denyUnmatchedRequests!==void 0&&l(h,[`deny_unmatched_requests`],n.denyUnmatchedRequests),n.denyUnmatchedRequestsExemptedZoneNames!==void 0&&l(h,[`deny_unmatched_requests_exempted_zone_names`],n.denyUnmatchedRequestsExemptedZoneNames),n.isUiReadOnly!==void 0&&l(h,[`is_ui_read_only`],n.isUiReadOnly),n.loginDesignBackgroundColor!==void 0&&l(h,[`login_design`,`background_color`],s(n.loginDesignBackgroundColor,`loginDesignBackgroundColor`,`text`)),n.loginDesignFooterText!==void 0&&l(h,[`login_design`,`footer_text`],s(n.loginDesignFooterText,`loginDesignFooterText`,`text`)),n.loginDesignHeaderText!==void 0&&l(h,[`login_design`,`header_text`],s(n.loginDesignHeaderText,`loginDesignHeaderText`,`text`)),n.loginDesignLogoPath!==void 0&&l(h,[`login_design`,`logo_path`],s(n.loginDesignLogoPath,`loginDesignLogoPath`,`text`)),n.loginDesignTextColor!==void 0&&l(h,[`login_design`,`text_color`],s(n.loginDesignTextColor,`loginDesignTextColor`,`text`)),n.mfaConfigAllowedAuthenticators!==void 0&&l(h,[`mfa_config`,`allowed_authenticators`],n.mfaConfigAllowedAuthenticators),n.mfaConfigAmrMatchingSessionDuration!==void 0&&l(h,[`mfa_config`,`amr_matching_session_duration`],s(n.mfaConfigAmrMatchingSessionDuration,`mfaConfigAmrMatchingSessionDuration`,`text`)),n.mfaConfigRequiredAaguids!==void 0&&l(h,[`mfa_config`,`required_aaguids`],s(n.mfaConfigRequiredAaguids,`mfaConfigRequiredAaguids`,`text`)),n.mfaConfigSessionDuration!==void 0&&l(h,[`mfa_config`,`session_duration`],s(n.mfaConfigSessionDuration,`mfaConfigSessionDuration`,`text`)),n.mfaRequiredForAllApps!==void 0&&l(h,[`mfa_required_for_all_apps`],n.mfaRequiredForAllApps),n.mfaSshPivKeyRequirementsPinPolicy!==void 0&&l(h,[`mfa_ssh_piv_key_requirements`,`pin_policy`],s(n.mfaSshPivKeyRequirementsPinPolicy,`mfaSshPivKeyRequirementsPinPolicy`,`text`)),n.mfaSshPivKeyRequirementsRequireFipsDevice!==void 0&&l(h,[`mfa_ssh_piv_key_requirements`,`require_fips_device`],n.mfaSshPivKeyRequirementsRequireFipsDevice),n.mfaSshPivKeyRequirementsSshKeySize!==void 0&&l(h,[`mfa_ssh_piv_key_requirements`,`ssh_key_size`],n.mfaSshPivKeyRequirementsSshKeySize),n.mfaSshPivKeyRequirementsSshKeyType!==void 0&&l(h,[`mfa_ssh_piv_key_requirements`,`ssh_key_type`],n.mfaSshPivKeyRequirementsSshKeyType),n.mfaSshPivKeyRequirementsTouchPolicy!==void 0&&l(h,[`mfa_ssh_piv_key_requirements`,`touch_policy`],s(n.mfaSshPivKeyRequirementsTouchPolicy,`mfaSshPivKeyRequirementsTouchPolicy`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.sessionDuration!==void 0&&l(h,[`session_duration`],s(n.sessionDuration,`sessionDuration`,`text`)),n.uiReadOnlyToggleReason!==void 0&&l(h,[`ui_read_only_toggle_reason`],s(n.uiReadOnlyToggleReason,`uiReadOnlyToggleReason`,`text`)),n.userSeatExpirationInactiveTime!==void 0&&l(h,[`user_seat_expiration_inactive_time`],s(n.userSeatExpirationInactiveTime,`userSeatExpirationInactiveTime`,`text`)),n.warpAuthSessionDuration!==void 0&&l(h,[`warp_auth_session_duration`],s(n.warpAuthSessionDuration,`warpAuthSessionDuration`,`text`)),d(await m(`Creating organization`,async()=>i.post(`/accounts/${o}/access/organizations`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created organization`})}},Yc={command:`get`,describe:`Returns the DoH settings for your Zero Trust organization.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading doh`,async()=>t.zeroTrust.organizations.doh.get(n)),{successLabel:`Loaded doh`})}},Xc={command:`update`,describe:`Updates the DoH settings for your Zero Trust organization.`,builder:e=>e.option(`doh-jwt-duration`,{type:`string`,description:"The duration the DoH JWT is valid for. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h.  Note that the maximum duration for this setting is the same as the key rotation period on the account. Default expiration is 24h"}).option(`service-token-id`,{type:`string`,description:`The uuid of the service token you want to use for DoH authentication`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust organizations doh update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/organizations/doh`,pathParams:{},bodyKind:`json`,body:{dohJwtDuration:t.dohJwtDuration,serviceTokenId:t.serviceTokenId,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating doh`,async()=>n.put(`/accounts/${i}/access/organizations/doh`,{body:e})),{successLabel:`Updated doh`});return}let o={};t.dohJwtDuration!==void 0&&l(o,[`doh_jwt_duration`],s(t.dohJwtDuration,`dohJwtDuration`,`text`)),t.serviceTokenId!==void 0&&l(o,[`service_token_id`],s(t.serviceTokenId,`serviceTokenId`,`text`)),d(await m(`Updating doh`,async()=>n.put(`/accounts/${i}/access/organizations/doh`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated doh`})}},Zc={command:`doh`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(Yc).command(Xc).demandCommand(1),handler:()=>{}},Qc={command:`list`,describe:`Returns the configuration for your Zero Trust organization.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading organizations`,async()=>t.zeroTrust.organizations.list(n)),{successLabel:`Loaded organizations`})}},$c={command:`revoke-users`,describe:`Revokes a user's access across all applications.`,builder:e=>e.option(`devices`,{type:`boolean`,description:"When set to `true`, all devices associated with the user will be revoked.",default:!1}).option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`user-uid`,{type:`string`,description:`The uuid of the user to revoke.`}).option(`warp-session-reauth`,{type:`boolean`,description:"When set to `true`, the user will be required to re-authenticate to WARP for all Gateway policies that enforce a WARP client session duration. When `false`, the user’s WARP session will remain active"}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{let o={};if(n.devices!==void 0&&(o.devices=n.devices),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust organizations revoke-users`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/access/organizations/revoke_user`,pathParams:{},bodyKind:`json`,body:{...o,email:n.email,userUid:n.userUid,warpSessionReauth:n.warpSessionReauth,body:n.body},validation:`passed`});return}let h=await a(n),g=n.local?p:await r(h);if(n.accountId=g,!await i(`organization`,``,{force:!!n.force,message:`This operation revokes all access tokens for a user destructively.`})){process.stderr.write(`Aborted.
-`);return}if(n.body){let e=u(n.body),t=new URLSearchParams(Object.entries(o).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();d(await m(`Deleting organization`,async()=>h.post(`/accounts/${g}/access/organizations/revoke_user${t?`?`+t:``}`,{body:e})),{successLabel:`Deleted organization`});return}n.email===void 0&&(n.email=await t(`email`,`The email of the user to revoke.`));let _={};n.email!==void 0&&l(_,[`email`],s(n.email,`email`,`text`)),n.userUid!==void 0&&l(_,[`user_uid`],s(n.userUid,`userUid`,`text`)),n.warpSessionReauth!==void 0&&l(_,[`warp_session_reauth`],n.warpSessionReauth);let v=new URLSearchParams(Object.entries(o).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();d(await m(`Deleting organization`,async()=>h.post(`/accounts/${g}/access/organizations/revoke_user${v?`?`+v:``}`,{body:Object.keys(_).length>0?_:void 0})),{successLabel:`Deleted organization`})}},el={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:e=>e.option(`allow-authenticate-via-warp`,{type:`boolean`,description:`When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.`,default:!1}).option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`auto-redirect-to-identity`,{type:`boolean`,description:"When set to `true`, users skip the identity provider selection step during login.",default:!1}).option(`custom-pages-forbidden`,{type:`string`,description:`The uid of the custom page to use when a user is denied access after failing a non-identity rule.`}).option(`custom-pages-identity-denied`,{type:`string`,description:`The uid of the custom page to use when a user is denied access.`}).option(`deny-unmatched-requests`,{type:`boolean`,description:"Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the `deny_unmatched_requests_exempted_zone_names` array."}).option(`deny-unmatched-requests-exempted-zone-names`,{type:`string`,array:!0,description:"Contains zone names to exempt from the `deny_unmatched_requests` feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request."}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`,default:!1}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`mfa-config-allowed-authenticators`,{type:`string`,array:!0,description:`Lists the MFA methods that users can authenticate with.`}).option(`mfa-config-amr-matching-session-duration`,{type:`string`,description:`Allows a user to skip MFA via Authentication Method Reference (AMR) matching when the AMR claim provided by the IdP the user used to authenticate contains "mfa". Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days).`}).option(`mfa-config-required-aaguids`,{type:`string`,description:`Specifies a Cloudflare List of required FIDO2 authenticator device AAGUIDs.`}).option(`mfa-config-session-duration`,{type:`string`,description:"Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:`5m` or `24h`."}).option(`mfa-required-for-all-apps`,{type:`boolean`,description:`Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.`,default:!1}).option(`mfa-ssh-piv-key-requirements-pin-policy`,{type:`string`,description:"Defines when a PIN is required to use the SSH key. Valid values: `never` (no PIN required), `once` (PIN required once per session), `always` (PIN required for each use).",choices:[`never`,`once`,`always`]}).option(`mfa-ssh-piv-key-requirements-require-fips-device`,{type:`boolean`,description:`Requires the SSH PIV key to be stored on a FIPS 140-2 Level 1 or higher validated device.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-size`,{type:`string`,array:!0,description:`Specifies the allowed SSH key sizes in bits. Valid sizes depend on key type. Ed25519 has a fixed key size and does not accept this parameter.`}).option(`mfa-ssh-piv-key-requirements-ssh-key-type`,{type:`string`,array:!0,description:"Specifies the allowed SSH key types. Valid values are `ecdsa`, `ed25519`, and `rsa`."}).option(`mfa-ssh-piv-key-requirements-touch-policy`,{type:`string`,description:"Defines when physical touch is required to use the SSH key. Valid values: `never` (no touch required), `always` (touch required for each use), `cached` (touch cached for 15 seconds).",choices:[`never`,`always`,`cached`]}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h."}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count.  Minimum value for this setting is 1 month (730h). Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`warp-auth-session-duration`,{type:`string`,description:"The amount of time that tokens issued for applications will be valid. Must be in the format `30m` or `2h45m`. Valid time units are: m, h."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/organizations`,pathParams:{},bodyKind:`json`,body:{allowAuthenticateViaWarp:t.allowAuthenticateViaWarp,authDomain:t.authDomain,autoRedirectToIdentity:t.autoRedirectToIdentity,customPagesForbidden:t.customPagesForbidden,customPagesIdentityDenied:t.customPagesIdentityDenied,denyUnmatchedRequests:t.denyUnmatchedRequests,denyUnmatchedRequestsExemptedZoneNames:t.denyUnmatchedRequestsExemptedZoneNames,isUiReadOnly:t.isUiReadOnly,loginDesignBackgroundColor:t.loginDesignBackgroundColor,loginDesignFooterText:t.loginDesignFooterText,loginDesignHeaderText:t.loginDesignHeaderText,loginDesignLogoPath:t.loginDesignLogoPath,loginDesignTextColor:t.loginDesignTextColor,mfaConfigAllowedAuthenticators:t.mfaConfigAllowedAuthenticators,mfaConfigAmrMatchingSessionDuration:t.mfaConfigAmrMatchingSessionDuration,mfaConfigRequiredAaguids:t.mfaConfigRequiredAaguids,mfaConfigSessionDuration:t.mfaConfigSessionDuration,mfaRequiredForAllApps:t.mfaRequiredForAllApps,mfaSshPivKeyRequirementsPinPolicy:t.mfaSshPivKeyRequirementsPinPolicy,mfaSshPivKeyRequirementsRequireFipsDevice:t.mfaSshPivKeyRequirementsRequireFipsDevice,mfaSshPivKeyRequirementsSshKeySize:t.mfaSshPivKeyRequirementsSshKeySize,mfaSshPivKeyRequirementsSshKeyType:t.mfaSshPivKeyRequirementsSshKeyType,mfaSshPivKeyRequirementsTouchPolicy:t.mfaSshPivKeyRequirementsTouchPolicy,name:t.name,sessionDuration:t.sessionDuration,uiReadOnlyToggleReason:t.uiReadOnlyToggleReason,userSeatExpirationInactiveTime:t.userSeatExpirationInactiveTime,warpAuthSessionDuration:t.warpAuthSessionDuration,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating organization`,async()=>n.put(`/accounts/${i}/access/organizations`,{body:e})),{successLabel:`Updated organization`});return}let o={};t.allowAuthenticateViaWarp!==void 0&&l(o,[`allow_authenticate_via_warp`],t.allowAuthenticateViaWarp),t.authDomain!==void 0&&l(o,[`auth_domain`],s(t.authDomain,`authDomain`,`text`)),t.autoRedirectToIdentity!==void 0&&l(o,[`auto_redirect_to_identity`],t.autoRedirectToIdentity),t.customPagesForbidden!==void 0&&l(o,[`custom_pages`,`forbidden`],s(t.customPagesForbidden,`customPagesForbidden`,`text`)),t.customPagesIdentityDenied!==void 0&&l(o,[`custom_pages`,`identity_denied`],s(t.customPagesIdentityDenied,`customPagesIdentityDenied`,`text`)),t.denyUnmatchedRequests!==void 0&&l(o,[`deny_unmatched_requests`],t.denyUnmatchedRequests),t.denyUnmatchedRequestsExemptedZoneNames!==void 0&&l(o,[`deny_unmatched_requests_exempted_zone_names`],t.denyUnmatchedRequestsExemptedZoneNames),t.isUiReadOnly!==void 0&&l(o,[`is_ui_read_only`],t.isUiReadOnly),t.loginDesignBackgroundColor!==void 0&&l(o,[`login_design`,`background_color`],s(t.loginDesignBackgroundColor,`loginDesignBackgroundColor`,`text`)),t.loginDesignFooterText!==void 0&&l(o,[`login_design`,`footer_text`],s(t.loginDesignFooterText,`loginDesignFooterText`,`text`)),t.loginDesignHeaderText!==void 0&&l(o,[`login_design`,`header_text`],s(t.loginDesignHeaderText,`loginDesignHeaderText`,`text`)),t.loginDesignLogoPath!==void 0&&l(o,[`login_design`,`logo_path`],s(t.loginDesignLogoPath,`loginDesignLogoPath`,`text`)),t.loginDesignTextColor!==void 0&&l(o,[`login_design`,`text_color`],s(t.loginDesignTextColor,`loginDesignTextColor`,`text`)),t.mfaConfigAllowedAuthenticators!==void 0&&l(o,[`mfa_config`,`allowed_authenticators`],t.mfaConfigAllowedAuthenticators),t.mfaConfigAmrMatchingSessionDuration!==void 0&&l(o,[`mfa_config`,`amr_matching_session_duration`],s(t.mfaConfigAmrMatchingSessionDuration,`mfaConfigAmrMatchingSessionDuration`,`text`)),t.mfaConfigRequiredAaguids!==void 0&&l(o,[`mfa_config`,`required_aaguids`],s(t.mfaConfigRequiredAaguids,`mfaConfigRequiredAaguids`,`text`)),t.mfaConfigSessionDuration!==void 0&&l(o,[`mfa_config`,`session_duration`],s(t.mfaConfigSessionDuration,`mfaConfigSessionDuration`,`text`)),t.mfaRequiredForAllApps!==void 0&&l(o,[`mfa_required_for_all_apps`],t.mfaRequiredForAllApps),t.mfaSshPivKeyRequirementsPinPolicy!==void 0&&l(o,[`mfa_ssh_piv_key_requirements`,`pin_policy`],s(t.mfaSshPivKeyRequirementsPinPolicy,`mfaSshPivKeyRequirementsPinPolicy`,`text`)),t.mfaSshPivKeyRequirementsRequireFipsDevice!==void 0&&l(o,[`mfa_ssh_piv_key_requirements`,`require_fips_device`],t.mfaSshPivKeyRequirementsRequireFipsDevice),t.mfaSshPivKeyRequirementsSshKeySize!==void 0&&l(o,[`mfa_ssh_piv_key_requirements`,`ssh_key_size`],t.mfaSshPivKeyRequirementsSshKeySize),t.mfaSshPivKeyRequirementsSshKeyType!==void 0&&l(o,[`mfa_ssh_piv_key_requirements`,`ssh_key_type`],t.mfaSshPivKeyRequirementsSshKeyType),t.mfaSshPivKeyRequirementsTouchPolicy!==void 0&&l(o,[`mfa_ssh_piv_key_requirements`,`touch_policy`],s(t.mfaSshPivKeyRequirementsTouchPolicy,`mfaSshPivKeyRequirementsTouchPolicy`,`text`)),t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.sessionDuration!==void 0&&l(o,[`session_duration`],s(t.sessionDuration,`sessionDuration`,`text`)),t.uiReadOnlyToggleReason!==void 0&&l(o,[`ui_read_only_toggle_reason`],s(t.uiReadOnlyToggleReason,`uiReadOnlyToggleReason`,`text`)),t.userSeatExpirationInactiveTime!==void 0&&l(o,[`user_seat_expiration_inactive_time`],s(t.userSeatExpirationInactiveTime,`userSeatExpirationInactiveTime`,`text`)),t.warpAuthSessionDuration!==void 0&&l(o,[`warp_auth_session_duration`],s(t.warpAuthSessionDuration,`warpAuthSessionDuration`,`text`)),d(await m(`Updating organization`,async()=>n.put(`/accounts/${i}/access/organizations`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated organization`})}},tl={command:`organizations`,describe:`Zero Trust organization settings including login page, session duration, and user seat management`,builder:e=>e.command(Jc).command(Qc).command($c).command(el).command(Zc).demandCommand(1),handler:()=>{}},nl={command:`list`,describe:`Lists all DLP custom profiles in an account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading custom`,async()=>t.zeroTrust.profiles.custom.list(n)),{successLabel:`Loaded custom`})}},rl={command:`custom`,describe:`Profiles operations`,builder:e=>e.command(nl).demandCommand(1),handler:()=>{}},il={command:`create`,describe:`Creates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:e=>e.option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`,default:!1}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`,default:!1}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`profile-id`,{type:`string`,description:`The profile_id field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Predefined profiles can not be created. This endpoint will only update an existing predefined profiles settings.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust profiles predefined create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/profiles/predefined`,pathParams:{},bodyKind:`json`,body:{aiContextEnabled:n.aiContextEnabled,allowedMatchCount:n.allowedMatchCount,confidenceThreshold:n.confidenceThreshold,contextAwarenessEnabled:n.contextAwarenessEnabled,contextAwarenessSkipFiles:n.contextAwarenessSkipFiles,ocrEnabled:n.ocrEnabled,profileId:n.profileId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating predefined`,async()=>i.post(`/accounts/${o}/dlp/profiles/predefined`,{body:e})),{successLabel:`Created predefined`});return}n.profileId===void 0&&(n.profileId=await t(`profile-id`,``));let h={};n.aiContextEnabled!==void 0&&l(h,[`ai_context_enabled`],n.aiContextEnabled),n.allowedMatchCount!==void 0&&l(h,[`allowed_match_count`],n.allowedMatchCount),n.confidenceThreshold!==void 0&&l(h,[`confidence_threshold`],s(n.confidenceThreshold,`confidenceThreshold`,`text`)),n.contextAwarenessEnabled!==void 0&&l(h,[`context_awareness`,`enabled`],n.contextAwarenessEnabled),n.contextAwarenessSkipFiles!==void 0&&l(h,[`context_awareness`,`skip`,`files`],n.contextAwarenessSkipFiles),n.ocrEnabled!==void 0&&l(h,[`ocr_enabled`],n.ocrEnabled),n.profileId!==void 0&&l(h,[`profile_id`],s(n.profileId,`profileId`,`text`)),d(await m(`Creating predefined`,async()=>i.post(`/accounts/${o}/dlp/profiles/predefined`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created predefined`})}},al={command:`get <profileId>`,describe:`Fetches a predefined DLP profile by id.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}),handler:async e=>{c(e.profileId,`profileId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading predefined`,async()=>t.zeroTrust.profiles.predefined.get(n,e.profileId)),{successLabel:`Loaded predefined`})}},ol={command:`update <profileId>`,describe:`Updates a DLP predefined profile. Only supports enabling/disabling entries.`,builder:e=>e.positional(`profileId`,{type:`string`,description:`Profile ID`,demandOption:!0}).option(`ai-context-enabled`,{type:`boolean`,description:`The ai_context_enabled field`,default:!1}).option(`allowed-match-count`,{type:`number`,description:`The allowed_match_count field`,default:0}).option(`confidence-threshold`,{type:`string`,description:`The confidence_threshold field`,default:`low`}).option(`context-awareness-enabled`,{type:`boolean`,description:`If true, scan the context of predefined entries to only return matches surrounded by keywords.`,default:!1}).option(`context-awareness-skip-files`,{type:`boolean`,description:`If the content type is a file, skip context analysis and return all matches.`,default:!1}).option(`ocr-enabled`,{type:`boolean`,description:`The ocr_enabled field`,default:!1}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`The updated parameters for the predefined profile.`}).check(e=>{if([`context-awareness-enabled`,`context-awareness-skip-files`].some(t=>e[t]!==void 0)){let t=[`context-awareness-enabled`,`context-awareness-skip-files`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --context_awareness-* flag is set`)}return!0}),handler:async t=>{if(c(t.profileId,`profileId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust profiles predefined update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/profiles/predefined/${t.profileId??`<profileId>`}`,pathParams:{profileId:String(t.profileId??``)},bodyKind:`json`,body:{aiContextEnabled:t.aiContextEnabled,allowedMatchCount:t.allowedMatchCount,confidenceThreshold:t.confidenceThreshold,contextAwarenessEnabled:t.contextAwarenessEnabled,contextAwarenessSkipFiles:t.contextAwarenessSkipFiles,ocrEnabled:t.ocrEnabled,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}`,{body:e})),{successLabel:`Updated predefined`});return}let o={};t.aiContextEnabled!==void 0&&l(o,[`ai_context_enabled`],t.aiContextEnabled),t.allowedMatchCount!==void 0&&l(o,[`allowed_match_count`],t.allowedMatchCount),t.confidenceThreshold!==void 0&&l(o,[`confidence_threshold`],s(t.confidenceThreshold,`confidenceThreshold`,`text`)),t.contextAwarenessEnabled!==void 0&&l(o,[`context_awareness`,`enabled`],t.contextAwarenessEnabled),t.contextAwarenessSkipFiles!==void 0&&l(o,[`context_awareness`,`skip`,`files`],t.contextAwarenessSkipFiles),t.ocrEnabled!==void 0&&l(o,[`ocr_enabled`],t.ocrEnabled),d(await m(`Updating predefined`,async()=>n.put(`/accounts/${i}/dlp/profiles/predefined/${t.profileId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated predefined`})}},sl={command:`predefined`,describe:`Profiles operations`,builder:e=>e.command(il).command(al).command(ol).demandCommand(1),handler:()=>{}},cl={command:`profiles`,describe:`Operations for profiles`,builder:e=>e.command(rl).command(sl).demandCommand(1),handler:()=>{}},ll={command:`get`,describe:`Retrieves configured risk score behaviors that define how user actions affect their overall risk score.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading behaviour`,async()=>t.zeroTrust.riskScoring.behaviours.get(n)),{successLabel:`Loaded behaviour`})}},ul={command:`update`,describe:`Updates risk score behavior configurations, defining weights and thresholds for risk calculation.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Behaviors.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust risk-scoring behaviours update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zt_risk_scoring/behaviors`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating behaviour`,async()=>n.put(`/accounts/${i}/zt_risk_scoring/behaviors`,{body:e})),{successLabel:`Updated behaviour`});return}d(await m(`Updating behaviour`,async()=>n.zeroTrust.riskScoring.behaviours.update(i)),{successLabel:`Updated behaviour`})}},dl={command:`behaviours`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(ll).command(ul).demandCommand(1),handler:()=>{}},fl={command:`get <userId>`,describe:`Retrieves the detailed risk score breakdown for a specific user, including contributing factors.`,builder:e=>e.positional(`userId`,{type:`string`,description:`User ID`,demandOption:!0}),handler:async e=>{c(e.userId,`userId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading risk scoring`,async()=>t.zeroTrust.riskScoring.get(n,e.userId)),{successLabel:`Loaded risk scoring`})}},pl={command:`create`,describe:`Creates a new Zero Trust risk score integration, connecting external risk signals to Cloudflare's risk scoring system.`,builder:e=>e.option(`integration-type`,{type:`string`,description:`The integration_type field`,choices:[`Okta`]}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4). https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async i=>{if(i.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust risk-scoring integrations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/zt_risk_scoring/integrations`,pathParams:{},bodyKind:`json`,body:{integrationType:i.integrationType,referenceId:i.referenceId,tenantUrl:i.tenantUrl,body:i.body},validation:`passed`});return}let o=await a(i),h=i.local?p:await r(o);if(i.accountId=h,i.body){let e=u(i.body);d(await m(`Creating integration`,async()=>o.post(`/accounts/${h}/zt_risk_scoring/integrations`,{body:e})),{successLabel:`Created integration`});return}i.integrationType===void 0&&(i.integrationType=await n(`integration-type`,``,[`Okta`])),i.tenantUrl===void 0&&(i.tenantUrl=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let g={};i.integrationType!==void 0&&l(g,[`integration_type`],s(i.integrationType,`integrationType`,`text`)),i.referenceId!==void 0&&l(g,[`reference_id`],s(i.referenceId,`referenceId`,`text`)),i.tenantUrl!==void 0&&l(g,[`tenant_url`],s(i.tenantUrl,`tenantUrl`,`text`)),d(await m(`Creating integration`,async()=>o.post(`/accounts/${h}/zt_risk_scoring/integrations`,{body:Object.keys(g).length>0?g:void 0})),{successLabel:`Created integration`})}},ml={command:`delete <integrationId>`,describe:`Removes a Zero Trust risk score integration, disconnecting the external risk signal source.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.integrationId,`integrationId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust risk-scoring integrations delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zt_risk_scoring/integrations/${t.integrationId??`<integrationId>`}`,pathParams:{integrationId:String(t.integrationId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`integration`,String(t.integrationId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting integration`,async()=>n.zeroTrust.riskScoring.integrations.delete(o,t.integrationId)),{successLabel:`Deleted integration`})}},hl={command:`get <integrationId>`,describe:`Gets configuration details for a specific Zero Trust risk score integration.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`Integration ID`,demandOption:!0}),handler:async e=>{c(e.integrationId,`integrationId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integration`,async()=>t.zeroTrust.riskScoring.integrations.get(n,e.integrationId)),{successLabel:`Loaded integration`})}},gl={command:`list`,describe:`Lists all configured Zero Trust risk score integrations for the account.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading integrations`,async()=>t.zeroTrust.riskScoring.integrations.list(n)),{successLabel:`Loaded integrations`})}},_l={command:`get <referenceId>`,describe:`Retrieves a Zero Trust risk score integration using its external reference ID.`,builder:e=>e.positional(`referenceId`,{type:`string`,description:`Reference ID`,demandOption:!0}),handler:async e=>{c(e.referenceId,`referenceId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading reference`,async()=>t.zeroTrust.riskScoring.integrations.references.get(n,e.referenceId)),{successLabel:`Loaded reference`})}},vl={command:`references`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(_l).demandCommand(1),handler:()=>{}},yl={command:`update <integrationId>`,describe:`Overwrite the reference_id, tenant_url, and active values with the ones provided.`,builder:e=>e.positional(`integrationId`,{type:`string`,description:`Integration ID`,demandOption:!0}).option(`active`,{type:`boolean`,description:`Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.`}).option(`reference-id`,{type:`string`,description:`A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4). https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider`}).option(`tenant-url`,{type:`string`,description:`The base url of the tenant, e.g. "https://tenant.okta.com".`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.integrationId,`integrationId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust risk-scoring integrations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/zt_risk_scoring/integrations/${n.integrationId??`<integrationId>`}`,pathParams:{integrationId:String(n.integrationId??``)},bodyKind:`json`,body:{active:n.active,referenceId:n.referenceId,tenantUrl:n.tenantUrl,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating integration`,async()=>i.put(`/accounts/${o}/zt_risk_scoring/integrations/${n.integrationId}`,{body:e})),{successLabel:`Updated integration`});return}if(n.active===void 0)throw Error(`--active is required (or pass --body with this field set).`);n.tenantUrl===void 0&&(n.tenantUrl=await t(`tenant-url`,`The base url of the tenant, e.g. "https://tenant.okta.com".`));let h={};n.active!==void 0&&l(h,[`active`],n.active),n.referenceId!==void 0&&l(h,[`reference_id`],s(n.referenceId,`referenceId`,`text`)),n.tenantUrl!==void 0&&l(h,[`tenant_url`],s(n.tenantUrl,`tenantUrl`,`text`)),d(await m(`Updating integration`,async()=>i.put(`/accounts/${o}/zt_risk_scoring/integrations/${n.integrationId}`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated integration`})}},bl={command:`integrations`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(pl).command(ml).command(hl).command(gl).command(yl).command(vl).demandCommand(1),handler:()=>{}},xl={command:`reset <userId>`,describe:`Resets risk scores for specified users, clearing their accumulated risk history.`,builder:e=>e.positional(`userId`,{type:`string`,description:`User ID`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.userId,`userId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust risk-scoring reset`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/zt_risk_scoring/${t.userId??`<userId>`}/reset`,pathParams:{userId:String(t.userId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`risk scoring`,String(t.userId??``),{force:!!t.force,message:`This operation wipes risk-scoring history.`})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting risk scoring`,async()=>n.zeroTrust.riskScoring.reset(o,t.userId)),{successLabel:`Deleted risk scoring`})}},Sl={command:`get`,describe:`Gets an aggregate summary of risk scores across the account, including distribution and trends.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading summary`,async()=>t.zeroTrust.riskScoring.summary.get(n)),{successLabel:`Loaded summary`})}},Cl={command:`summary`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(Sl).demandCommand(1),handler:()=>{}},wl={command:`risk-scoring`,describe:`User and entity risk scores derived from behavior signals, used to trigger adaptive access policies`,builder:e=>e.command(fl).command(xl).command(dl).command(bl).command(Cl).demandCommand(1),handler:()=>{}},Tl={command:`edit`,describe:"Removes a user from a Zero Trust seat when both `access_seat` and `gateway_seat` are set to false.",builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust seats edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/seats`,pathParams:{},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating seat`,async()=>n.patch(`/accounts/${i}/access/seats`,{body:e})),{successLabel:`Updated seat`});return}if(t.body===void 0)throw Error(`--body is required for this command. Pass --body '<json>' or --body @path/to/file.json.`)}},El={command:`seats`,describe:`View and manage user seat allocations for your Zero Trust subscription`,builder:e=>e.command(Tl).demandCommand(1),handler:()=>{}},Dl={command:`create`,describe:`Generates a new service token. **Note:** This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new service token.`,builder:e=>e.option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust service-tokens create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/service_tokens`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{clientSecretVersion:e.clientSecretVersion,duration:e.duration,name:e.name,previousClientSecretExpiresAt:e.previousClientSecretExpiresAt,body:e.body},validation:`passed`});return}let n=await a(e);if(e.zoneId=await o({zone:e.zone},n,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Creating service token`,async()=>n.post(`/zones/${e.zoneId}/access/service_tokens`,{body:t})),{successLabel:`Created service token`});return}e.name===void 0&&(e.name=await t(`name`,`The name of the service token.`));let r={};e.clientSecretVersion!==void 0&&l(r,[`client_secret_version`],e.clientSecretVersion),e.duration!==void 0&&l(r,[`duration`],s(e.duration,`duration`,`text`)),e.name!==void 0&&l(r,[`name`],s(e.name,`name`,`text`)),e.previousClientSecretExpiresAt!==void 0&&l(r,[`previous_client_secret_expires_at`],s(e.previousClientSecretExpiresAt,`previousClientSecretExpiresAt`,`text`)),d(await m(`Creating service token`,async()=>n.post(`/zones/${e.zoneId}/access/service_tokens`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Created service token`})}},Ol={command:`delete <serviceTokenId>`,describe:`Deletes a service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.serviceTokenId,`serviceTokenId`),e.dryRun){f({command:`cf zero-trust service-tokens delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/service_tokens/${e.serviceTokenId??`<serviceTokenId>`}`,pathParams:{serviceTokenId:String(e.serviceTokenId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`service token`,String(e.serviceTokenId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting service token`,async()=>t.zeroTrust.serviceTokens.delete(e.serviceTokenId,n)),{successLabel:`Deleted service token`})}},kl={command:`get <serviceTokenId>`,describe:`Fetches a single service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.serviceTokenId,`serviceTokenId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading service token`,async()=>t.zeroTrust.serviceTokens.get(e.serviceTokenId,n)),{successLabel:`Loaded service token`})}},Al={command:`list`,describe:`Lists all service tokens.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading service tokens`,async()=>t.zeroTrust.serviceTokens.list(n)),{successLabel:`Loaded service tokens`})}},jl={command:`update <serviceTokenId>`,describe:`Updates a configured service token.`,builder:e=>e.positional(`serviceTokenId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`client-secret-version`,{type:`number`,description:"A version number identifying the current `client_secret` associated with the service token. Incrementing it triggers a rotation; the previous secret will still be accepted until the time indicated by `previous_client_secret_expires_at`.",default:1}).option(`duration`,{type:`string`,description:"The duration for how long the service token will be valid. Must be in the format `300ms` or `2h45m`. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).",default:`8760h`}).option(`name`,{type:`string`,description:`The name of the service token.`}).option(`previous-client-secret-expires-at`,{type:`string`,description:"The expiration of the previous `client_secret`. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.serviceTokenId,`serviceTokenId`),e.dryRun){f({command:`cf zero-trust service-tokens update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/service_tokens/${e.serviceTokenId??`<serviceTokenId>`}`,pathParams:{serviceTokenId:String(e.serviceTokenId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{clientSecretVersion:e.clientSecretVersion,duration:e.duration,name:e.name,previousClientSecretExpiresAt:e.previousClientSecretExpiresAt,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating service token`,async()=>t.put(`/zones/${e.zoneId}/access/service_tokens/${e.serviceTokenId}`,{body:n})),{successLabel:`Updated service token`});return}let n={};e.clientSecretVersion!==void 0&&l(n,[`client_secret_version`],e.clientSecretVersion),e.duration!==void 0&&l(n,[`duration`],s(e.duration,`duration`,`text`)),e.name!==void 0&&l(n,[`name`],s(e.name,`name`,`text`)),e.previousClientSecretExpiresAt!==void 0&&l(n,[`previous_client_secret_expires_at`],s(e.previousClientSecretExpiresAt,`previousClientSecretExpiresAt`,`text`)),d(await m(`Updating service token`,async()=>t.put(`/zones/${e.zoneId}/access/service_tokens/${e.serviceTokenId}`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated service token`})}},Ml={command:`service-tokens`,describe:`Service Tokens operations`,builder:e=>e.command(Dl).command(Ol).command(kl).command(Al).command(jl).demandCommand(1),handler:()=>{}},Nl={command:`delete`,describe:`Delete (reset) DLP account-level settings to initial values.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(t.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust settings delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`setting`,``,{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting setting`,async()=>n.zeroTrust.settings.delete(o)),{successLabel:`Deleted setting`})}},Pl={command:`edit`,describe:`Missing fields keep their existing values.`,builder:e=>e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`,default:!1}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`,default:!1}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.  - Set to a non-empty base64 string to enable payload logging with the given key. - Set to an empty string to disable payload logging. - Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`DLP settings fields to update.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust settings edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:{aiContextAnalysis:t.aiContextAnalysis,ocr:t.ocr,payloadLoggingPublicKey:t.payloadLoggingPublicKey,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/dlp/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.aiContextAnalysis!==void 0&&l(o,[`ai_context_analysis`],t.aiContextAnalysis),t.ocr!==void 0&&l(o,[`ocr`],t.ocr),t.payloadLoggingPublicKey!==void 0&&l(o,[`payload_logging`,`public_key`],s(t.payloadLoggingPublicKey,`payloadLoggingPublicKey`,`text`)),d(await m(`Updating setting`,async()=>n.patch(`/accounts/${i}/dlp/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},Fl={command:`get`,describe:`Get DLP account-level settings.`,builder:e=>e,handler:async e=>{let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading setting`,async()=>t.zeroTrust.settings.get(n)),{successLabel:`Loaded setting`})}},Il={command:`update`,describe:`Missing fields are reset to initial (unconfigured) values.`,builder:e=>e.option(`ai-context-analysis`,{type:`boolean`,description:`Whether AI context analysis is enabled at the account level.`,default:!1}).option(`ocr`,{type:`boolean`,description:`Whether OCR is enabled at the account level.`,default:!1}).option(`payload-logging-public-key`,{type:`string`,description:`Base64-encoded public key for encrypting payload logs.  - Set to a non-empty base64 string to enable payload logging with the given key. - Set to an empty string to disable payload logging. - Omit or set to null to leave unchanged (PATCH) or reset to disabled (PUT).`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`New DLP settings.`}),handler:async t=>{if(t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust settings update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/dlp/settings`,pathParams:{},bodyKind:`json`,body:{aiContextAnalysis:t.aiContextAnalysis,ocr:t.ocr,payloadLoggingPublicKey:t.payloadLoggingPublicKey,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/dlp/settings`,{body:e})),{successLabel:`Updated setting`});return}let o={};t.aiContextAnalysis!==void 0&&l(o,[`ai_context_analysis`],t.aiContextAnalysis),t.ocr!==void 0&&l(o,[`ocr`],t.ocr),t.payloadLoggingPublicKey!==void 0&&l(o,[`payload_logging`,`public_key`],s(t.payloadLoggingPublicKey,`payloadLoggingPublicKey`,`text`)),d(await m(`Updating setting`,async()=>n.put(`/accounts/${i}/dlp/settings`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated setting`})}},Ll={command:`settings`,describe:`Settings operations`,builder:e=>e.command(Nl).command(Pl).command(Fl).command(Il).demandCommand(1),handler:()=>{}},Rl={command:`get <tunnelId>`,describe:`Gets the configuration for a remotely-managed tunnel`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading configuration`,async()=>t.zeroTrust.tunnels.cloudflared.configurations.get(n,e.tunnelId)),{successLabel:`Loaded configuration`})}},zl={command:`update <tunnelId>`,describe:`Adds or updates the configuration for a remotely-managed tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`config-origin-request-access-aud-tag`,{type:`string`,array:!0,description:`Access applications that are allowed to reach this hostname for this Tunnel. Audience tags can be identified in the dashboard or via the List Access policies API.`}).option(`config-origin-request-access-required`,{type:`boolean`,description:`Deny traffic that has not fulfilled Access authorization.`}).option(`config-origin-request-access-team-name`,{type:`string`,description:`The config.originRequest.access.teamName field`}).option(`config-origin-request-ca-pool`,{type:`string`,description:`Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.`}).option(`config-origin-request-connect-timeout`,{type:`number`,description:`Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.`}).option(`config-origin-request-disable-chunked-encoding`,{type:`boolean`,description:`Disables chunked transfer encoding. Useful if you are running a WSGI server.`}).option(`config-origin-request-http2origin`,{type:`boolean`,description:`Attempt to connect to origin using HTTP2. Origin must be configured as https.`}).option(`config-origin-request-http-host-header`,{type:`string`,description:`Sets the HTTP Host header on requests sent to the local service.`}).option(`config-origin-request-keep-alive-connections`,{type:`number`,description:`Maximum number of idle keepalive connections between Tunnel and your origin. This does not restrict the total number of concurrent connections.`}).option(`config-origin-request-keep-alive-timeout`,{type:`number`,description:`Timeout after which an idle keepalive connection can be discarded.`}).option(`config-origin-request-match-snito-host`,{type:`boolean`,description:`Auto configure the Hostname on the origin server certificate.`}).option(`config-origin-request-no-happy-eyeballs`,{type:`boolean`,description:`Disable the “happy eyeballs” algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.`}).option(`config-origin-request-no-tlsverify`,{type:`boolean`,description:`Disables TLS verification of the certificate presented by your origin. Will allow any certificate from the origin to be accepted.`}).option(`config-origin-request-origin-server-name`,{type:`string`,description:`Hostname that cloudflared should expect from your origin server certificate.`}).option(`config-origin-request-proxy-type`,{type:`string`,description:`cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are: "" for the regular proxy and "socks" for a SOCKS5 proxy. `}).option(`config-origin-request-tcp-keep-alive`,{type:`number`,description:`The timeout after which a TCP keepalive packet is sent on a connection between Tunnel and the origin server.`}).option(`config-origin-request-tls-timeout`,{type:`number`,description:`Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}).check(e=>{if([`config-origin-request-access-aud-tag`,`config-origin-request-access-required`,`config-origin-request-access-team-name`,`config-origin-request-ca-pool`,`config-origin-request-connect-timeout`,`config-origin-request-disable-chunked-encoding`,`config-origin-request-http2origin`,`config-origin-request-http-host-header`,`config-origin-request-keep-alive-connections`,`config-origin-request-keep-alive-timeout`,`config-origin-request-match-snito-host`,`config-origin-request-no-happy-eyeballs`,`config-origin-request-no-tlsverify`,`config-origin-request-origin-server-name`,`config-origin-request-proxy-type`,`config-origin-request-tcp-keep-alive`,`config-origin-request-tls-timeout`].some(t=>e[t]!==void 0)){let t=[`config-origin-request-access-aud-tag`,`config-origin-request-access-team-name`].filter(t=>e[t]===void 0);if(t.length>0)throw Error(`${t.map(e=>`--`+e).join(`, `)} ${t.length===1?`is`:`are`} required when any --config-* flag is set`)}return!0}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels cloudflared configurations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/cfd_tunnel/${t.tunnelId??`<tunnelId>`}/configurations`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{configOriginRequestAccessAudTag:t.configOriginRequestAccessAudTag,configOriginRequestAccessRequired:t.configOriginRequestAccessRequired,configOriginRequestAccessTeamName:t.configOriginRequestAccessTeamName,configOriginRequestCaPool:t.configOriginRequestCaPool,configOriginRequestConnectTimeout:t.configOriginRequestConnectTimeout,configOriginRequestDisableChunkedEncoding:t.configOriginRequestDisableChunkedEncoding,configOriginRequestHttp2origin:t.configOriginRequestHttp2origin,configOriginRequestHttpHostHeader:t.configOriginRequestHttpHostHeader,configOriginRequestKeepAliveConnections:t.configOriginRequestKeepAliveConnections,configOriginRequestKeepAliveTimeout:t.configOriginRequestKeepAliveTimeout,configOriginRequestMatchSnitoHost:t.configOriginRequestMatchSnitoHost,configOriginRequestNoHappyEyeballs:t.configOriginRequestNoHappyEyeballs,configOriginRequestNoTlsverify:t.configOriginRequestNoTlsverify,configOriginRequestOriginServerName:t.configOriginRequestOriginServerName,configOriginRequestProxyType:t.configOriginRequestProxyType,configOriginRequestTcpKeepAlive:t.configOriginRequestTcpKeepAlive,configOriginRequestTlsTimeout:t.configOriginRequestTlsTimeout,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating configuration`,async()=>n.put(`/accounts/${i}/cfd_tunnel/${t.tunnelId}/configurations`,{body:e})),{successLabel:`Updated configuration`});return}let o={};t.configOriginRequestAccessAudTag!==void 0&&l(o,[`config`,`originRequest`,`access`,`audTag`],t.configOriginRequestAccessAudTag),t.configOriginRequestAccessRequired!==void 0&&l(o,[`config`,`originRequest`,`access`,`required`],t.configOriginRequestAccessRequired),t.configOriginRequestAccessTeamName!==void 0&&l(o,[`config`,`originRequest`,`access`,`teamName`],s(t.configOriginRequestAccessTeamName,`configOriginRequestAccessTeamName`,`text`)),t.configOriginRequestCaPool!==void 0&&l(o,[`config`,`originRequest`,`caPool`],s(t.configOriginRequestCaPool,`configOriginRequestCaPool`,`text`)),t.configOriginRequestConnectTimeout!==void 0&&l(o,[`config`,`originRequest`,`connectTimeout`],t.configOriginRequestConnectTimeout),t.configOriginRequestDisableChunkedEncoding!==void 0&&l(o,[`config`,`originRequest`,`disableChunkedEncoding`],t.configOriginRequestDisableChunkedEncoding),t.configOriginRequestHttp2origin!==void 0&&l(o,[`config`,`originRequest`,`http2Origin`],t.configOriginRequestHttp2origin),t.configOriginRequestHttpHostHeader!==void 0&&l(o,[`config`,`originRequest`,`httpHostHeader`],s(t.configOriginRequestHttpHostHeader,`configOriginRequestHttpHostHeader`,`text`)),t.configOriginRequestKeepAliveConnections!==void 0&&l(o,[`config`,`originRequest`,`keepAliveConnections`],t.configOriginRequestKeepAliveConnections),t.configOriginRequestKeepAliveTimeout!==void 0&&l(o,[`config`,`originRequest`,`keepAliveTimeout`],t.configOriginRequestKeepAliveTimeout),t.configOriginRequestMatchSnitoHost!==void 0&&l(o,[`config`,`originRequest`,`matchSNItoHost`],t.configOriginRequestMatchSnitoHost),t.configOriginRequestNoHappyEyeballs!==void 0&&l(o,[`config`,`originRequest`,`noHappyEyeballs`],t.configOriginRequestNoHappyEyeballs),t.configOriginRequestNoTlsverify!==void 0&&l(o,[`config`,`originRequest`,`noTLSVerify`],t.configOriginRequestNoTlsverify),t.configOriginRequestOriginServerName!==void 0&&l(o,[`config`,`originRequest`,`originServerName`],s(t.configOriginRequestOriginServerName,`configOriginRequestOriginServerName`,`text`)),t.configOriginRequestProxyType!==void 0&&l(o,[`config`,`originRequest`,`proxyType`],s(t.configOriginRequestProxyType,`configOriginRequestProxyType`,`text`)),t.configOriginRequestTcpKeepAlive!==void 0&&l(o,[`config`,`originRequest`,`tcpKeepAlive`],t.configOriginRequestTcpKeepAlive),t.configOriginRequestTlsTimeout!==void 0&&l(o,[`config`,`originRequest`,`tlsTimeout`],t.configOriginRequestTlsTimeout),d(await m(`Updating configuration`,async()=>n.put(`/accounts/${i}/cfd_tunnel/${t.tunnelId}/configurations`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated configuration`})}},Bl={command:`configurations`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(Rl).command(zl).demandCommand(1),handler:()=>{}},Vl={command:`delete <tunnelId>`,describe:`Removes a connection (aka Cloudflare Tunnel Connector) from a Cloudflare Tunnel independently of its current state. If no connector id (client_id) is provided all connectors will be removed. We recommend running this command after rotating tokens.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{c(t.tunnelId,`tunnelId`);let n={};if(t.clientId!==void 0&&(n.client_id=t.clientId),t.dryRun){let r=e();r&&c(r,`accountId`),f({command:`cf zero-trust tunnels cloudflared connections delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${r??`<account-id>`}/cfd_tunnel/${t.tunnelId??`<tunnelId>`}/connections`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{...n,body:t.body},validation:`passed`});return}let o=await a(t),s=t.local?p:await r(o);if(t.accountId=s,!await i(`connection`,String(t.tunnelId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body),r=new URLSearchParams(Object.entries(n).filter(([,e])=>e!==void 0).map(([e,t])=>[e,String(t)])).toString();d(await m(`Deleting connection`,async()=>o.delete(`/accounts/${s}/cfd_tunnel/${t.tunnelId}/connections${r?`?`+r:``}`,{body:e})),{successLabel:`Deleted connection`});return}d(await m(`Deleting connection`,async()=>o.zeroTrust.tunnels.cloudflared.connections.delete(s,t.tunnelId,Object.keys(n).length>0?n:void 0)),{successLabel:`Deleted connection`})}},Hl={command:`get <tunnelId>`,describe:`Fetches connection details for a Cloudflare Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading connection`,async()=>t.zeroTrust.tunnels.cloudflared.connections.get(n,e.tunnelId)),{successLabel:`Loaded connection`})}},Ul={command:`connections`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(Vl).command(Hl).demandCommand(1),handler:()=>{}},Wl={command:`get <connectorId>`,describe:`Fetches connector and connection details for a Cloudflare Tunnel.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.connectorId,`connectorId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading connector`,async()=>t.zeroTrust.tunnels.cloudflared.connectors.get(n,e.tunnelId,e.connectorId)),{successLabel:`Loaded connector`})}},Gl={command:`connectors`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(Wl).demandCommand(1),handler:()=>{}},Kl={command:`create`,describe:`Creates a new Cloudflare Tunnel in an account.`,builder:e=>e.option(`config-src`,{type:`string`,description:"Indicates if this is a locally or remotely configured tunnel. If `local`, manage the tunnel using a YAML file on the origin machine. If `cloudflare`, manage the tunnel on the Zero Trust dashboard.",choices:[`local`,`cloudflare`],default:`local`}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust tunnels cloudflared create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/cfd_tunnel`,pathParams:{},bodyKind:`json`,body:{configSrc:n.configSrc,name:n.name,tunnelSecret:n.tunnelSecret,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating cloudflared`,async()=>i.post(`/accounts/${o}/cfd_tunnel`,{body:e})),{successLabel:`Created cloudflared`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for a tunnel.`));let h={};n.configSrc!==void 0&&l(h,[`config_src`],s(n.configSrc,`configSrc`,`text`)),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),n.tunnelSecret!==void 0&&l(h,[`tunnel_secret`],s(n.tunnelSecret,`tunnelSecret`,`text`)),d(await m(`Creating cloudflared`,async()=>i.post(`/accounts/${o}/cfd_tunnel`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created cloudflared`})}},ql={command:`delete <tunnelId>`,describe:`Deletes a Cloudflare Tunnel from an account.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels cloudflared delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/cfd_tunnel/${t.tunnelId??`<tunnelId>`}`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`cloudflared`,String(t.tunnelId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting cloudflared`,async()=>n.delete(`/accounts/${o}/cfd_tunnel/${t.tunnelId}`,{body:e})),{successLabel:`Deleted cloudflared`});return}d(await m(`Deleting cloudflared`,async()=>n.zeroTrust.tunnels.cloudflared.delete(o,t.tunnelId)),{successLabel:`Deleted cloudflared`})}},Jl={command:`edit <tunnelId>`,describe:`Updates an existing Cloudflare Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels cloudflared edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/cfd_tunnel/${t.tunnelId??`<tunnelId>`}`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{name:t.name,tunnelSecret:t.tunnelSecret,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating cloudflared`,async()=>n.patch(`/accounts/${i}/cfd_tunnel/${t.tunnelId}`,{body:e})),{successLabel:`Updated cloudflared`});return}let o={};t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.tunnelSecret!==void 0&&l(o,[`tunnel_secret`],s(t.tunnelSecret,`tunnelSecret`,`text`)),d(await m(`Updating cloudflared`,async()=>n.patch(`/accounts/${i}/cfd_tunnel/${t.tunnelId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated cloudflared`})}},Yl={command:`get <tunnelId>`,describe:`Fetches a single Cloudflare Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading cloudflared`,async()=>t.zeroTrust.tunnels.cloudflared.get(n,e.tunnelId)),{successLabel:`Loaded cloudflared`})}},Xl={command:`list`,describe:`Lists and filters Cloudflare Tunnels in an account.`,builder:e=>e.option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.",default:!1}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.uuid!==void 0&&(t.uuid=e.uuid),e.wasActiveAt!==void 0&&(t.was_active_at=e.wasActiveAt),e.wasInactiveAt!==void 0&&(t.was_inactive_at=e.wasInactiveAt),e.includePrefix!==void 0&&(t.include_prefix=e.includePrefix),e.excludePrefix!==void 0&&(t.exclude_prefix=e.excludePrefix),e.status!==void 0&&(t.status=e.status),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading cloudflared`,async()=>n.zeroTrust.tunnels.cloudflared.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded cloudflared`})}},Zl={command:`create <tunnelId>`,describe:`Gets a management token used to access the management resources (i.e. Streaming Logs) of a tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`resources`,{type:`string`,array:!0,description:`The resources field`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels cloudflared management create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/cfd_tunnel/${t.tunnelId??`<tunnelId>`}/management`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{resources:t.resources,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Creating management`,async()=>n.post(`/accounts/${i}/cfd_tunnel/${t.tunnelId}/management`,{body:e})),{successLabel:`Created management`});return}if(t.resources===void 0)throw Error(`--resources is required (or pass --body with this field set).`);let o={};t.resources!==void 0&&l(o,[`resources`],t.resources),d(await m(`Creating management`,async()=>n.post(`/accounts/${i}/cfd_tunnel/${t.tunnelId}/management`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Created management`})}},Ql={command:`management`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(Zl).demandCommand(1),handler:()=>{}},$l={command:`get <tunnelId>`,describe:`Gets the token used to associate cloudflared with a specific tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading token`,async()=>t.zeroTrust.tunnels.cloudflared.token.get(n,e.tunnelId)),{successLabel:`Loaded token`})}},eu={command:`token`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command($l).demandCommand(1),handler:()=>{}},tu={command:`cloudflared`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(Kl).command(ql).command(Jl).command(Yl).command(Xl).command(Bl).command(Ul).command(Gl).command(Ql).command(eu).demandCommand(1),handler:()=>{}},nu={command:`list`,describe:`Lists and filters all types of Tunnels in an account.`,builder:e=>e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.",default:!1}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`tun-types`,{type:`string`,description:`The types of tunnels to filter by, separated by commas.`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.uuid!==void 0&&(t.uuid=e.uuid),e.wasActiveAt!==void 0&&(t.was_active_at=e.wasActiveAt),e.wasInactiveAt!==void 0&&(t.was_inactive_at=e.wasInactiveAt),e.includePrefix!==void 0&&(t.include_prefix=e.includePrefix),e.excludePrefix!==void 0&&(t.exclude_prefix=e.excludePrefix),e.tunTypes!==void 0&&(t.tun_types=e.tunTypes),e.status!==void 0&&(t.status=e.status),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading tunnels`,async()=>n.zeroTrust.tunnels.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded tunnels`})}},ru={command:`get <tunnelId>`,describe:`Fetches connection details for a WARP Connector Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading connection`,async()=>t.zeroTrust.tunnels.warpConnector.connections.get(n,e.tunnelId)),{successLabel:`Loaded connection`})}},iu={command:`connections`,describe:`Connections operations`,builder:e=>e.command(ru).demandCommand(1),handler:()=>{}},au={command:`get <connectorId>`,describe:`Fetches connector and connection details for a WARP Connector Tunnel.`,builder:e=>e.positional(`connectorId`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`,demandOption:!0}).option(`tunnel-id`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.connectorId,`connectorId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading connector`,async()=>t.zeroTrust.tunnels.warpConnector.connectors.get(n,e.tunnelId,e.connectorId)),{successLabel:`Loaded connector`})}},ou={command:`connectors`,describe:`Connectors operations`,builder:e=>e.command(au).demandCommand(1),handler:()=>{}},su={command:`create`,describe:`Creates a new Warp Connector Tunnel in an account.`,builder:e=>e.option(`ha`,{type:`boolean`,description:`Indicates that the tunnel will be created to be highly available. If omitted, defaults to false.`,default:!1}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust tunnels warp-connector create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/warp_connector`,pathParams:{},bodyKind:`json`,body:{ha:n.ha,name:n.name,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Creating warp connector`,async()=>i.post(`/accounts/${o}/warp_connector`,{body:e})),{successLabel:`Created warp connector`});return}n.name===void 0&&(n.name=await t(`name`,`A user-friendly name for a tunnel.`));let h={};n.ha!==void 0&&l(h,[`ha`],n.ha),n.name!==void 0&&l(h,[`name`],s(n.name,`name`,`text`)),d(await m(`Creating warp connector`,async()=>i.post(`/accounts/${o}/warp_connector`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Created warp connector`})}},cu={command:`delete <tunnelId>`,describe:`Deletes a Warp Connector Tunnel from an account.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels warp-connector delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/warp_connector/${t.tunnelId??`<tunnelId>`}`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{body:t.body},validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`warp connector`,String(t.tunnelId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}if(t.body){let e=u(t.body);d(await m(`Deleting warp connector`,async()=>n.delete(`/accounts/${o}/warp_connector/${t.tunnelId}`,{body:e})),{successLabel:`Deleted warp connector`});return}d(await m(`Deleting warp connector`,async()=>n.zeroTrust.tunnels.warpConnector.delete(o,t.tunnelId)),{successLabel:`Deleted warp connector`})}},lu={command:`edit <tunnelId>`,describe:`Updates an existing Warp Connector Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`name`,{type:`string`,description:`A user-friendly name for a tunnel.`}).option(`tunnel-secret`,{type:`string`,description:`Sets the password required to run a locally-managed tunnel. Must be at least 32 bytes and encoded as a base64 string.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async t=>{if(c(t.tunnelId,`tunnelId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust tunnels warp-connector edit`,method:`PATCH`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/warp_connector/${t.tunnelId??`<tunnelId>`}`,pathParams:{tunnelId:String(t.tunnelId??``)},bodyKind:`json`,body:{name:t.name,tunnelSecret:t.tunnelSecret,body:t.body},validation:`passed`});return}let n=await a(t),i=t.local?p:await r(n);if(t.accountId=i,t.body){let e=u(t.body);d(await m(`Updating warp connector`,async()=>n.patch(`/accounts/${i}/warp_connector/${t.tunnelId}`,{body:e})),{successLabel:`Updated warp connector`});return}let o={};t.name!==void 0&&l(o,[`name`],s(t.name,`name`,`text`)),t.tunnelSecret!==void 0&&l(o,[`tunnel_secret`],s(t.tunnelSecret,`tunnelSecret`,`text`)),d(await m(`Updating warp connector`,async()=>n.patch(`/accounts/${i}/warp_connector/${t.tunnelId}`,{body:Object.keys(o).length>0?o:void 0})),{successLabel:`Updated warp connector`})}},uu={command:`update <tunnelId>`,describe:`Triggers a manual failover for a specific WARP Connector Tunnel, setting the specified client as the active connector. The tunnel must be configured for high availability (HA) and the client must be linked to the tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}).option(`client-id`,{type:`string`,description:`UUID of the Cloudflare Tunnel connector.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async n=>{if(c(n.tunnelId,`tunnelId`),n.dryRun){let t=e();t&&c(t,`accountId`),f({command:`cf zero-trust tunnels warp-connector failover update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/accounts/${t??`<account-id>`}/warp_connector/${n.tunnelId??`<tunnelId>`}/failover`,pathParams:{tunnelId:String(n.tunnelId??``)},bodyKind:`json`,body:{clientId:n.clientId,body:n.body},validation:`passed`});return}let i=await a(n),o=n.local?p:await r(i);if(n.accountId=o,n.body){let e=u(n.body);d(await m(`Updating failover`,async()=>i.put(`/accounts/${o}/warp_connector/${n.tunnelId}/failover`,{body:e})),{successLabel:`Updated failover`});return}n.clientId===void 0&&(n.clientId=await t(`client-id`,`UUID of the Cloudflare Tunnel connector.`));let h={};n.clientId!==void 0&&l(h,[`client_id`],s(n.clientId,`clientId`,`text`)),d(await m(`Updating failover`,async()=>i.put(`/accounts/${o}/warp_connector/${n.tunnelId}/failover`,{body:Object.keys(h).length>0?h:void 0})),{successLabel:`Updated failover`})}},du={command:`failover`,describe:`Failover operations`,builder:e=>e.command(uu).demandCommand(1),handler:()=>{}},fu={command:`get <tunnelId>`,describe:`Fetches a single Warp Connector Tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading warp connector`,async()=>t.zeroTrust.tunnels.warpConnector.get(n,e.tunnelId)),{successLabel:`Loaded warp connector`})}},pu={command:`list`,describe:`Lists and filters Warp Connector Tunnels in an account.`,builder:e=>e.option(`name`,{type:`string`,description:`A user-friendly name for the tunnel.`}).option(`is-deleted`,{type:`boolean`,description:"If `true`, only include deleted tunnels. If `false`, exclude deleted tunnels. If empty, all tunnels will be included.",default:!1}).option(`existed-at`,{type:`string`,description:`If provided, include only resources that were created (and not deleted) before this time. URL encoded.`}).option(`uuid`,{type:`string`,description:`UUID of the tunnel.`}).option(`was-active-at`,{type:`string`,description:`Was active at`}).option(`was-inactive-at`,{type:`string`,description:`Was inactive at`}).option(`include-prefix`,{type:`string`,description:`Include prefix`}).option(`exclude-prefix`,{type:`string`,description:`Exclude prefix`}).option(`status`,{type:`string`,description:"The status of the tunnel. Valid values are `inactive` (tunnel has never been run), `degraded` (tunnel is active and able to serve traffic but in an unhealthy state), `healthy` (tunnel is active and able to serve traffic), or `down` (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).",choices:[`inactive`,`degraded`,`healthy`,`down`]}).option(`per-page`,{type:`string`,description:`Number of results to display.`}).option(`page`,{type:`string`,description:`Page number of paginated results.`}),handler:async e=>{let t={};e.name!==void 0&&(t.name=e.name),e.isDeleted!==void 0&&(t.is_deleted=e.isDeleted),e.existedAt!==void 0&&(t.existed_at=e.existedAt),e.uuid!==void 0&&(t.uuid=e.uuid),e.wasActiveAt!==void 0&&(t.was_active_at=e.wasActiveAt),e.wasInactiveAt!==void 0&&(t.was_inactive_at=e.wasInactiveAt),e.includePrefix!==void 0&&(t.include_prefix=e.includePrefix),e.excludePrefix!==void 0&&(t.exclude_prefix=e.excludePrefix),e.status!==void 0&&(t.status=e.status),e.perPage!==void 0&&(t.per_page=e.perPage),e.page!==void 0&&(t.page=e.page);let n=await a(e),i=e.local?p:await r(n);e.accountId=i,d(await m(`Loading warp connector`,async()=>n.zeroTrust.tunnels.warpConnector.list(i,Object.keys(t).length>0?t:void 0)),{successLabel:`Loaded warp connector`})}},mu={command:`get <tunnelId>`,describe:`Gets the token used to associate warp device with a specific Warp Connector tunnel.`,builder:e=>e.positional(`tunnelId`,{type:`string`,description:`UUID of the tunnel.`,demandOption:!0}),handler:async e=>{c(e.tunnelId,`tunnelId`);let t=await a(e),n=e.local?p:await r(t);e.accountId=n,d(await m(`Loading token`,async()=>t.zeroTrust.tunnels.warpConnector.token.get(n,e.tunnelId)),{successLabel:`Loaded token`})}},hu={command:`token`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(mu).demandCommand(1),handler:()=>{}},gu={command:`warp-connector`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(su).command(cu).command(lu).command(fu).command(pu).command(iu).command(ou).command(du).command(hu).demandCommand(1),handler:()=>{}},_u={command:`tunnels`,describe:`Cloudflare Tunnel connections that securely expose private origins without opening inbound ports`,builder:e=>e.command(nu).command(tu).command(gu).demandCommand(1),handler:()=>{}},vu={command:`delete <authenticatorId>`,describe:`Deletes a specific MFA device for a user. This action is only available if MFA is turned on for the organization.`,builder:e=>e.positional(`authenticatorId`,{type:`string`,description:`The unique identifier for the MFA device.`,demandOption:!0}).option(`user-id`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async t=>{if(c(t.authenticatorId,`authenticatorId`),t.dryRun){let n=e();n&&c(n,`accountId`),f({command:`cf zero-trust users mfa authenticators delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/accounts/${n??`<account-id>`}/access/users/${t.userId??`<userId>`}/mfa_authenticators/${t.authenticatorId??`<authenticatorId>`}`,pathParams:{userId:String(t.userId??``),authenticatorId:String(t.authenticatorId??``)},bodyKind:`none`,validation:`passed`});return}let n=await a(t),o=t.local?p:await r(n);if(t.accountId=o,!await i(`authenticator`,String(t.authenticatorId??``),{force:!!t.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting authenticator`,async()=>n.zeroTrust.users.mfa.authenticators.delete(t.userId,o,t.authenticatorId)),{successLabel:`Deleted authenticator`})}},yu={command:`authenticators`,describe:`Users operations`,builder:e=>e.command(vu).demandCommand(1),handler:()=>{}},bu={command:`mfa`,describe:`Operations for users.mfa`,builder:e=>e.command(yu).demandCommand(1),handler:()=>{}},xu={command:`users`,describe:`Operations for users`,builder:e=>e.command(bu).demandCommand(1),handler:()=>{}},Su={command:`create`,describe:`Adds a new identity provider to Access.`,builder:e=>e.option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust zone-identity-providers create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/identity_providers`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{body:e.body},validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let n=u(e.body);d(await m(`Creating zone identity provider`,async()=>t.post(`/zones/${e.zoneId}/access/identity_providers`,{body:n})),{successLabel:`Created zone identity provider`});return}d(await m(`Creating zone identity provider`,async()=>t.zeroTrust.zoneIdentityProviders.create(n)),{successLabel:`Created zone identity provider`})}},Cu={command:`delete <identityProviderId>`,describe:`Deletes an identity provider from Access.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}),handler:async e=>{if(c(e.identityProviderId,`identityProviderId`),e.dryRun){f({command:`cf zero-trust zone-identity-providers delete`,method:`DELETE`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/identity_providers/${e.identityProviderId??`<identityProviderId>`}`,pathParams:{identityProviderId:String(e.identityProviderId??``),zoneId:String(e.zoneId??``)},bodyKind:`none`,validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,!await i(`zone identity provider`,String(e.identityProviderId??``),{force:!!e.force})){process.stderr.write(`Aborted.
-`);return}d(await m(`Deleting zone identity provider`,async()=>t.zeroTrust.zoneIdentityProviders.delete(e.identityProviderId,n)),{successLabel:`Deleted zone identity provider`})}},wu={command:`get <identityProviderId>`,describe:`Fetches a configured identity provider.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}),handler:async e=>{c(e.identityProviderId,`identityProviderId`);let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading zone identity provider`,async()=>t.zeroTrust.zoneIdentityProviders.get(e.identityProviderId,n)),{successLabel:`Loaded zone identity provider`})}},Tu={command:`list`,describe:`Lists all configured identity providers.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading zone identity providers`,async()=>t.zeroTrust.zoneIdentityProviders.list(n)),{successLabel:`Loaded zone identity providers`})}},Eu={command:`update <identityProviderId>`,describe:`Updates a configured identity provider.`,builder:e=>e.positional(`identityProviderId`,{type:`string`,description:`UUID.`,demandOption:!0}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(c(e.identityProviderId,`identityProviderId`),e.dryRun){f({command:`cf zero-trust zone-identity-providers update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/identity_providers/${e.identityProviderId??`<identityProviderId>`}`,pathParams:{identityProviderId:String(e.identityProviderId??``),zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{body:e.body},validation:`passed`});return}let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});if(e.zoneId=n,e.body){let n=u(e.body);d(await m(`Updating zone identity provider`,async()=>t.put(`/zones/${e.zoneId}/access/identity_providers/${e.identityProviderId}`,{body:n})),{successLabel:`Updated zone identity provider`});return}d(await m(`Updating zone identity provider`,async()=>t.zeroTrust.zoneIdentityProviders.update(e.identityProviderId,n)),{successLabel:`Updated zone identity provider`})}},Du={command:`zone-identity-providers`,describe:`Zone-scoped Access identity provider management`,builder:e=>e.command(Su).command(Cu).command(wu).command(Tu).command(Eu).demandCommand(1),handler:()=>{}},Ou={command:`create`,describe:`Sets up a Zero Trust organization for your account.`,builder:e=>e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust zone-organizations create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/organizations`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{authDomain:e.authDomain,isUiReadOnly:e.isUiReadOnly,loginDesignBackgroundColor:e.loginDesignBackgroundColor,loginDesignFooterText:e.loginDesignFooterText,loginDesignHeaderText:e.loginDesignHeaderText,loginDesignLogoPath:e.loginDesignLogoPath,loginDesignTextColor:e.loginDesignTextColor,name:e.name,uiReadOnlyToggleReason:e.uiReadOnlyToggleReason,userSeatExpirationInactiveTime:e.userSeatExpirationInactiveTime,body:e.body},validation:`passed`});return}let n=await a(e);if(e.zoneId=await o({zone:e.zone},n,{quiet:e.quiet}),e.body){let t=u(e.body);d(await m(`Creating zone organization`,async()=>n.post(`/zones/${e.zoneId}/access/organizations`,{body:t})),{successLabel:`Created zone organization`});return}e.authDomain===void 0&&(e.authDomain=await t(`auth-domain`,`The unique subdomain assigned to your Zero Trust organization.`)),e.name===void 0&&(e.name=await t(`name`,`The name of your Zero Trust organization.`));let r={};e.authDomain!==void 0&&l(r,[`auth_domain`],s(e.authDomain,`authDomain`,`text`)),e.isUiReadOnly!==void 0&&l(r,[`is_ui_read_only`],e.isUiReadOnly),e.loginDesignBackgroundColor!==void 0&&l(r,[`login_design`,`background_color`],s(e.loginDesignBackgroundColor,`loginDesignBackgroundColor`,`text`)),e.loginDesignFooterText!==void 0&&l(r,[`login_design`,`footer_text`],s(e.loginDesignFooterText,`loginDesignFooterText`,`text`)),e.loginDesignHeaderText!==void 0&&l(r,[`login_design`,`header_text`],s(e.loginDesignHeaderText,`loginDesignHeaderText`,`text`)),e.loginDesignLogoPath!==void 0&&l(r,[`login_design`,`logo_path`],s(e.loginDesignLogoPath,`loginDesignLogoPath`,`text`)),e.loginDesignTextColor!==void 0&&l(r,[`login_design`,`text_color`],s(e.loginDesignTextColor,`loginDesignTextColor`,`text`)),e.name!==void 0&&l(r,[`name`],s(e.name,`name`,`text`)),e.uiReadOnlyToggleReason!==void 0&&l(r,[`ui_read_only_toggle_reason`],s(e.uiReadOnlyToggleReason,`uiReadOnlyToggleReason`,`text`)),e.userSeatExpirationInactiveTime!==void 0&&l(r,[`user_seat_expiration_inactive_time`],s(e.userSeatExpirationInactiveTime,`userSeatExpirationInactiveTime`,`text`)),d(await m(`Creating zone organization`,async()=>n.post(`/zones/${e.zoneId}/access/organizations`,{body:Object.keys(r).length>0?r:void 0})),{successLabel:`Created zone organization`})}},ku={command:`get`,describe:`Returns the configuration for your Zero Trust organization.`,builder:e=>e,handler:async e=>{let t=await a(e),n=await o({zone:e.zone},t,{quiet:e.quiet});e.zoneId=n,d(await m(`Loading zone organization`,async()=>t.zeroTrust.zoneOrganizations.get(n)),{successLabel:`Loaded zone organization`})}},Au={command:`revoke-user-create`,describe:`Revokes a user's access across all applications.`,builder:e=>e.option(`email`,{type:`string`,description:`The email of the user to revoke.`}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`force`,{type:`boolean`,alias:`f`,description:`Skip confirmation (useful in scripts and CI)`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust zone-organizations revoke-user-create`,method:`POST`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/organizations/revoke_user`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{email:e.email,body:e.body},validation:`passed`});return}let n=await a(e),r=await o({zone:e.zone},n,{quiet:e.quiet});if(e.zoneId=r,!await i(`zone organization`,String(r??``),{force:!!e.force,message:`This operation revokes all access tokens for a user, affecting their access to all applications within the zone.`})){process.stderr.write(`Aborted.
-`);return}if(e.body){let t=u(e.body);d(await m(`Deleting zone organization`,async()=>n.post(`/zones/${e.zoneId}/access/organizations/revoke_user`,{body:t})),{successLabel:`Deleted zone organization`});return}e.email===void 0&&(e.email=await t(`email`,`The email of the user to revoke.`));let c={};e.email!==void 0&&l(c,[`email`],s(e.email,`email`,`text`)),d(await m(`Deleting zone organization`,async()=>n.post(`/zones/${e.zoneId}/access/organizations/revoke_user`,{body:Object.keys(c).length>0?c:void 0})),{successLabel:`Deleted zone organization`})}},ju={command:`update`,describe:`Updates the configuration for your Zero Trust organization.`,builder:e=>e.option(`auth-domain`,{type:`string`,description:`The unique subdomain assigned to your Zero Trust organization.`}).option(`is-ui-read-only`,{type:`boolean`,description:`Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.`}).option(`login-design-background-color`,{type:`string`,description:`The background color on your login page.`}).option(`login-design-footer-text`,{type:`string`,description:`The text at the bottom of your login page.`}).option(`login-design-header-text`,{type:`string`,description:`The text at the top of your login page.`}).option(`login-design-logo-path`,{type:`string`,description:`The URL of the logo on your login page.`}).option(`login-design-text-color`,{type:`string`,description:`The text color on your login page.`}).option(`name`,{type:`string`,description:`The name of your Zero Trust organization.`}).option(`ui-read-only-toggle-reason`,{type:`string`,description:`A description of the reason why the UI read only field is being toggled.`}).option(`user-seat-expiration-inactive-time`,{type:`string`,description:"The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Must be in the format `300ms` or `2h45m`. Valid time units are: `ns`, `us` (or `µs`), `ms`, `s`, `m`, `h`."}).option(`dry-run`,{type:`boolean`,description:`Validate and show what would happen without executing`,default:!1}).option(`body`,{type:`string`,description:`Raw JSON request body (bypasses individual flags)`}),handler:async e=>{if(e.dryRun){f({command:`cf zero-trust zone-organizations update`,method:`PUT`,url:`https://api.cloudflare.com/client/v4/zones/${e.zoneId??`<zoneId>`}/access/organizations`,pathParams:{zoneId:String(e.zoneId??``)},bodyKind:`json`,body:{authDomain:e.authDomain,isUiReadOnly:e.isUiReadOnly,loginDesignBackgroundColor:e.loginDesignBackgroundColor,loginDesignFooterText:e.loginDesignFooterText,loginDesignHeaderText:e.loginDesignHeaderText,loginDesignLogoPath:e.loginDesignLogoPath,loginDesignTextColor:e.loginDesignTextColor,name:e.name,uiReadOnlyToggleReason:e.uiReadOnlyToggleReason,userSeatExpirationInactiveTime:e.userSeatExpirationInactiveTime,body:e.body},validation:`passed`});return}let t=await a(e);if(e.zoneId=await o({zone:e.zone},t,{quiet:e.quiet}),e.body){let n=u(e.body);d(await m(`Updating zone organization`,async()=>t.put(`/zones/${e.zoneId}/access/organizations`,{body:n})),{successLabel:`Updated zone organization`});return}let n={};e.authDomain!==void 0&&l(n,[`auth_domain`],s(e.authDomain,`authDomain`,`text`)),e.isUiReadOnly!==void 0&&l(n,[`is_ui_read_only`],e.isUiReadOnly),e.loginDesignBackgroundColor!==void 0&&l(n,[`login_design`,`background_color`],s(e.loginDesignBackgroundColor,`loginDesignBackgroundColor`,`text`)),e.loginDesignFooterText!==void 0&&l(n,[`login_design`,`footer_text`],s(e.loginDesignFooterText,`loginDesignFooterText`,`text`)),e.loginDesignHeaderText!==void 0&&l(n,[`login_design`,`header_text`],s(e.loginDesignHeaderText,`loginDesignHeaderText`,`text`)),e.loginDesignLogoPath!==void 0&&l(n,[`login_design`,`logo_path`],s(e.loginDesignLogoPath,`loginDesignLogoPath`,`text`)),e.loginDesignTextColor!==void 0&&l(n,[`login_design`,`text_color`],s(e.loginDesignTextColor,`loginDesignTextColor`,`text`)),e.name!==void 0&&l(n,[`name`],s(e.name,`name`,`text`)),e.uiReadOnlyToggleReason!==void 0&&l(n,[`ui_read_only_toggle_reason`],s(e.uiReadOnlyToggleReason,`uiReadOnlyToggleReason`,`text`)),e.userSeatExpirationInactiveTime!==void 0&&l(n,[`user_seat_expiration_inactive_time`],s(e.userSeatExpirationInactiveTime,`userSeatExpirationInactiveTime`,`text`)),d(await m(`Updating zone organization`,async()=>t.put(`/zones/${e.zoneId}/access/organizations`,{body:Object.keys(n).length>0?n:void 0})),{successLabel:`Updated zone organization`})}},Mu={command:`zone-organizations`,describe:`Zone-scoped Zero Trust organization management`,builder:e=>e.command(Ou).command(ku).command(Au).command(ju).demandCommand(1),handler:()=>{}},Nu={command:`zero-trust`,describe:`Cloudflare's SASE platform — secure access, device posture, DLP, tunnels, gateway policies, and network segmentation`,builder:e=>e.command(Lt).command(vn).command(Dn).command(An).command(ki).command(ha).command(Ao).command(Ho).command(Xs).command(nc).command(pc).command(qc).command(tl).command(cl).command(wl).command(El).command(Ml).command(Ll).command(_u).command(xu).command(Du).command(Mu).demandCommand(1),handler:()=>{}};export{Nu as default};